1

I have 3 Amazon VPCs (Dev - 10.100.0.0/16 , QA - 10.101.0.0/16, Prod - 10.104.0.0/16). Each of these VPNs has an OpenVPN server. They are dolling out client IPs as follows:

Dev - 10.100.0.0/16 - Tunnel 10.7.0.0/24
QA - 10.101.0.0/16 - Tunnel 10.8.0.0/24
Prod - 10.104.0.0/16 - Tunnel 10.9.0.0/24

I have an Ubuntu LTS 12.04 server running onsite and I've established 3 client connections (one to each VPC). I'm able to ssh into this Ubuntu box and get around all three subnets (10.100 , 10.101, 10.104) without any issues whatsoever.

Here's my client config [DEV / 10.100.x / tun 10.7.0.x]:

client
dev tun
proto udp
remote dev.ip.addr 1193 
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
auth-user-pass /tmp/password.txt
comp-lzo
verb 3
reneg-sec 0
tls-client
remote-cert-tls server

Here's my client config [QA / 10.101.x / tun 10.8.0.x]:

client
dev tun
proto udp
remote qa.ip.addr 1194 
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
auth-user-pass /tmp/password.txt
comp-lzo
verb 3
reneg-sec 0
tls-client
remote-cert-tls server

Here's my client config [PROD / 10.104.x / tun 10.9.0.x]:

client
dev tun
proto udp
remote prod.ip.addr 1195 
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
auth-user-pass /tmp/password.txt
comp-lzo
verb 3
reneg-sec 0
tls-client
remote-cert-tls server

Now, I want my employees (internally, while at the office), to VPN to this server (192.168.1.19) which has 3 connections to my VPCs. And, i want them to be able to connect to 10.100, 10.101, and 10.104 networks (via sql cleints, telnet to memcache servers, etc). I want to route all traffic except 80,443, and 3389 through this vpn interface.

OpenVPN Server Config for Office Server (192.168.1.19 / tun 10.10.0.x):

port 1196
proto udp
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450

ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/hqs-openvpn.mycompany.co.crt
key /etc/openvpn/easy-rsa/keys/hqs-openvpn.mycompany.co.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
plugin /usr/lib/openvpn/openvpn-auth-pam.so /etc/pam.d/login
#plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf
client-cert-not-required
username-as-common-name

server 10.10.0.0 255.255.255.0
push "route 10.7.0.0 255.255.255.0"
push "route 10.8.0.0 255.255.255.0"
push "route 10.9.0.0 255.255.255.0"
push "route 10.10.0.0 255.255.255.0"
push "route 10.104.0.0 255.255.0.0"
push "route 10.101.0.0 255.255.0.0"
push "route 10.100.0.0 255.255.0.0"

push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 5 30
comp-lzo
persist-key
persist-tun
verb 3

user nobody
group nogroup

log-append /var/log/openvpn
status /tmp/vpn.status 10

And here's the Config I'm handing out to employees (192.168.1.x / tun 10.10.0.x)

client
dev tun
proto udp
remote 192.168.1.19 1196 
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
auth-user-pass /tmp/password.txt
comp-lzo
verb 3
reneg-sec 0
tls-client
remote-cert-tls server

FROM THE SERVER (via ssh to 192.168.1.19):

  • I'm able to get to 10.104
  • I'm able to get 10 10.100
  • I'm able to get 10 10.101

    root@vpn-hqs:~# traceroute 10.104.10.104
    traceroute to 10.104.10.104 (10.104.10.104), 30 hops max, 60 byte packets
     1  10.9.0.1 (10.9.0.1)  86.094 ms  86.079 ms  86.079 ms
     2  10.104.10.104 (10.104.10.104)  86.084 ms  86.086 ms  86.087 ms
    root@vpn-hqs:~# traceroute 10.100.10.168
    traceroute to 10.100.10.168 (10.100.10.168), 30 hops max, 60 byte packets
     1  10.7.0.1 (10.7.0.1)  87.130 ms  87.121 ms  87.121 ms
     2  10.100.10.168 (10.100.10.168)  87.126 ms  87.238 ms  87.243 ms
    root@vpn-hqs:~# traceroute 10.101.10.168
    traceroute to 10.101.10.168 (10.101.10.168), 30 hops max, 60 byte packets
     1  10.8.0.1 (10.8.0.1)  87.954 ms  87.939 ms  87.937 ms
     2  10.101.10.168 (10.101.10.168)  87.943 ms  87.944 ms  88.031 ms
    root@vpn-hqs:~# route -n
    Kernel IP routing table
    Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
    0.0.0.0         192.168.1.1     0.0.0.0         UG    100    0        0 br0
    10.7.0.0        10.7.0.17       255.255.0.0     UG    0      0        0 tun0
    10.7.0.17       0.0.0.0         255.255.255.255 UH    0      0        0 tun0
    10.8.0.0        10.8.0.33       255.255.0.0     UG    0      0        0 tun1
    10.8.0.33       0.0.0.0         255.255.255.255 UH    0      0        0 tun1
    10.9.0.0        10.9.0.13       255.255.0.0     UG    0      0        0 tun2
    10.9.0.13       0.0.0.0         255.255.255.255 UH    0      0        0 tun2
    10.10.0.0       10.10.0.2       255.255.255.0   UG    0      0        0 tun3
    10.10.0.2       0.0.0.0         255.255.255.255 UH    0      0        0 tun3
    192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 br0
    

Here's my if config of the server (192.168.1.19):

root@vpn-hqs:~# ifconfig -a
br0       Link encap:Ethernet  HWaddr 00:1d:09:26:43:3d  
          inet addr:192.168.1.19  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::21d:9ff:fe26:433d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:17149 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2770 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:2213528 (2.2 MB)  TX bytes:286915 (286.9 KB)

eth0      Link encap:Ethernet  HWaddr 00:1d:09:26:43:3d  
          inet6 addr: fe80::21d:9ff:fe26:433d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:18666 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2773 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:2719828 (2.7 MB)  TX bytes:300485 (300.4 KB)
          Interrupt:16 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.7.0.18  P-t-P:10.7.0.17  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:10 errors:0 dropped:0 overruns:0 frame:0
          TX packets:18 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:876 (876.0 B)  TX bytes:1104 (1.1 KB)

tun1      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.34  P-t-P:10.8.0.33  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:18 errors:0 dropped:0 overruns:0 frame:0
          TX packets:34 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:1584 (1.5 KB)  TX bytes:2040 (2.0 KB)

tun2      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.9.0.14  P-t-P:10.9.0.13  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:18 errors:0 dropped:0 overruns:0 frame:0
          TX packets:34 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:1584 (1.5 KB)  TX bytes:2040 (2.0 KB)

tun3      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.10.0.1  P-t-P:10.10.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:13 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:740 (740.0 B)  TX bytes:0 (0.0 B)

Now, I'm able to connect from my windows computer to 192.168.1.19 just fine. And, I get an IP address of 10.10.0.6. Perfect.

But, I can't connect / ping / telnet to anything on 10.104.0.0/16, 10.101.0.0/16, and 10.100.0.0/16 like I can when I'm ssh'd onto 192.168.1.19. Here's my route table for my windows box:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.220     10
          0.0.0.0        128.0.0.0        10.10.0.5        10.10.0.6     30
         10.7.0.0    255.255.255.0        10.10.0.5        10.10.0.6     30
         10.8.0.0    255.255.255.0        10.10.0.5        10.10.0.6     30
         10.9.0.0    255.255.255.0        10.10.0.5        10.10.0.6     30
        10.10.0.0    255.255.255.0        10.10.0.5        10.10.0.6     30
        10.10.0.1  255.255.255.255        10.10.0.5        10.10.0.6     30
        10.10.0.4  255.255.255.252         On-link         10.10.0.6    286
        10.10.0.6  255.255.255.255         On-link         10.10.0.6    286
        10.10.0.7  255.255.255.255         On-link         10.10.0.6    286
       10.100.0.0      255.255.0.0        10.10.0.5        10.10.0.6     30
       10.101.0.0      255.255.0.0        10.10.0.5        10.10.0.6     30
       10.104.0.0      255.255.0.0        10.10.0.5        10.10.0.6     30
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        128.0.0.0        128.0.0.0        10.10.0.5        10.10.0.6     30
      192.168.1.0    255.255.255.0         On-link     192.168.1.220    266
     192.168.1.19  255.255.255.255      192.168.1.1    192.168.1.220     10
    192.168.1.220  255.255.255.255         On-link     192.168.1.220    266
    192.168.1.255  255.255.255.255         On-link     192.168.1.220    266
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     192.168.1.220    266
        224.0.0.0        240.0.0.0         On-link         10.10.0.6    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     192.168.1.220    266
  255.255.255.255  255.255.255.255         On-link         10.10.0.6    286
===========================================================================
Persistent Routes:
  None

Any help getting my 10.10.0.0/24 VPN'd clients talking to 10.100.0.0/16, 10.101.0.0/16, and 10.104.0.0/16 clients would be GREATLY appreciated!

1
  • Here's a picture that may help what I'mt rying to do: link
    – Allan P
    Jan 24, 2013 at 4:30

1 Answer 1

0

Fixed. See here for an explanation:

https://forums.openvpn.net/post27110.html#p27110

3
  • Welcome to Server Fault! We really do prefer that answers contain content not pointers to content. Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference.
    – user9517
    Jan 29, 2013 at 8:52
  • @lain, if the codeblock tags here at SF worked better and felt more natural, I would have.
    – Allan P
    Jan 29, 2013 at 14:40
  • That's not the point. If the link target ever goes away (and they frequently do) then your 'answer' becomes useless.
    – user9517
    Jan 29, 2013 at 14:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .