0

I have two openvpn clients and a server using shared keys. I have internal routes specified in the ccd directory for both clients, but when they connect, the server only creates the internal route for one of them, despite the logs saying it's creating both. Both clients and the server use the "--script-security 2" command-line option. Can anyone think of why it would do this ?

My ccd files are:

client1:

iroute 192.168.0.0 255.255.255.0

client2:

iroute 10.0.1.0 255.255.255.0

My log file shows the following (cropped):

May  3 17:22:59 kino openvpn[2416]: 118.208.58.60:48730 [client1] Peer Connection Initiated with 118.208.58.60:48730
May  3 17:22:59 kino openvpn[2416]: client1/118.208.58.60:48730 OPTIONS IMPORT: reading client specific options from: ccd/client1
May  3 17:22:59 kino openvpn[2416]: client1/118.208.58.60:48730 MULTI: Learn: 192.168.150.10 -> client1/118.208.58.60:48730
May  3 17:22:59 kino openvpn[2416]: client1/118.208.58.60:48730 MULTI: primary virtual IP for client1/118.208.58.60:48730: 192.168.150.10
May  3 17:22:59 kino openvpn[2416]: client1/118.208.58.60:48730 MULTI: internal route 192.168.0.0/24 -> client1/118.208.58.60:48730
May  3 17:22:59 kino openvpn[2416]: client1/118.208.58.60:48730 MULTI: Learn: 192.168.0.0/24 -> client1/118.208.58.60:48730
May  3 17:23:01 kino openvpn[2416]: client1/118.208.58.60:48730 PUSH: Received control message: 'PUSH_REQUEST'
May  3 17:23:01 kino openvpn[2416]: client1/118.208.58.60:48730 SENT CONTROL [client1]: 'PUSH_REPLY,route 192.168.150.1,topology net30,ping 10,ping-restart 120,ifconfig 192.168.150.10 192.168.150.9' (status=1)

May  3 17:21:36 kino openvpn[2416]: 124.148.1.90:59277 [client2] Peer Connection Initiated with 124.148.1.90:59277
May  3 17:21:36 kino openvpn[2416]: client2/124.148.1.90:59277 OPTIONS IMPORT: reading client specific options from: ccd/client2
May  3 17:21:36 kino openvpn[2416]: client2/124.148.1.90:59277 MULTI: Learn: 192.168.150.14 -> client2/124.148.1.90:59277
May  3 17:21:36 kino openvpn[2416]: client2/124.148.1.90:59277 MULTI: primary virtual IP for client2/124.148.1.90:59277: 192.168.150.14
May  3 17:21:36 kino openvpn[2416]: client2/124.148.1.90:59277 MULTI: internal route 10.0.1.0/24 -> client2/124.148.1.90:59277
May  3 17:21:36 kino openvpn[2416]: client2/124.148.1.90:59277 MULTI: Learn: 10.0.1.0/24 -> client2/124.148.1.90:59277
May  3 17:21:39 kino openvpn[2416]: client2/124.148.1.90:59277 PUSH: Received control message: 'PUSH_REQUEST'
May  3 17:21:39 kino openvpn[2416]: client2/124.148.1.90:59277 SENT CONTROL [client2]: 'PUSH_REPLY,route 192.168.150.1,topology net30,ping 10,ping-restart 120,ifconfig 192.168.150.14 192.168.150.13' (status=1)

And after both clients have connected, the routing table looks like this:

192.168.150.2   0.0.0.0         255.255.255.255 UH        0 0          0 tun0
203.209.167.192 0.0.0.0         255.255.255.224 U         0 0          0 eth0
192.168.150.0   192.168.150.2   255.255.255.0   UG        0 0          0 tun0
192.168.0.0     192.168.150.2   255.255.255.0   UG        0 0          0 tun0
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
0.0.0.0         203.209.167.193 0.0.0.0         UG        0 0          0 eth0

As you can see, it's created the route to 192.168.0.0/24 (client1) but not to 10.0.1.0/24 (client2), even though the log says it's been created. Any suggestions why ?

Improve this question

3 Answers 3

Reset to default
1

Someone on IRC pointed out that I needed to declare the route manually in the server config file as well. I did that and it creates the route upon startup. I guess I didn't quite understand what iroute's were for.

Improve this answer
1

I think that the scope section of the documentation explains it in detail.

Improve this answer
1

I struggled with this, too. In my setup, the OpenVPN server was a separate machine from the router, and no matter what config I did I could not get pings to travel correctly to other machines on the network. Eventually I found this thread: http://ubuntuforums.org/archive/index.php/t-951733.html

Which makes it clear what is actually needed is a static route on the router to allow packets trying to find their way back to the OVPN server to be routed to that machine.

So, for example:

Router: 192.168.9.1
OVPN Server: 192.168.9.254
OVPN subnet: 10.101.1.0/24
Client Subnet: 192.168.231.0/24

In order to get a ping from 192.168.231.x to go to 192.168.9.x (other than 254), I needed to make sure these three things were done:

  1. create "route 192.168.231.0 255.255.255.0" in OVPN server.conf.

  2. create "iroute 192.168.231.0 255.255.255.0" in OVPN ccd/client.conf. (also: "push "route 192.168.9.0 255.255.255.0" in OVPN server.conf

  3. (the missing ingredient) add static route for 10.101.1.0/24 gw 192.168.9.254 on router.

Improve this answer
1
  • It should not be possible to set the IP address of the OVPN server as a gateway for the router because they are in different subnets.
    – Bogdan
    Oct 25, 2016 at 20:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .