Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to be able to access the server network from the client with an establishedVPN connection on tun0. I've got the following setup:

  • Client (10.8.0.6 on tun0 and 172.28.220.95 on wlan)
  • VPN server (10.8.0.1 on tun0 and 192.168.178.32 on eth)
  • Server-side network (192.168.178.0/24)

Routing on the client side:

client$ ip route show
10.8.0.0/24 dev tun0  scope link  src 10.8.0.6

client$ ip route show table local
local 10.8.0.6 dev tun0  proto kernel  scope host  src 10.8.0.6
local 172.28.220.95 dev wlp2s0  proto kernel  scope host  src 172.28.220.95 

And on the server side:

server$ ip route show
default via 192.168.178.1 dev eth0 
10.8.0.0/24 dev tun0  scope link 
192.168.178.0/24 dev eth0  proto kernel  scope link  src 192.168.178.32

server$ ip route show table local
local 10.8.0.1 dev tun0  proto kernel  scope host  src 10.8.0.1
local 192.168.178.32 dev eth0  proto kernel  scope host  src 192.168.178.32 

Irrelevant routes and broadcast routes left out for clarity.

The server can ping itself at 10.8.0.1. The client can ping itself at 10.8.0.6. However, when I try to ping the client from the server or vice versa I get no response (but no error either, besides the 100% packet loss).

Any ideas on what goes wrong here? I also don't quite understand the meaning of the peer addresses with ip addr.

# server
4: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
link/none 
inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0

# client
8: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
link/none 
inet 10.8.0.6 peer 10.8.0.5/32 brd 10.8.0.6 scope global tun0
share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

There is obviously an IP address mismatch on both tun0. This is a point to point connection. No need to broadcast and make layer 2 address resolution. Everything that leaves this interface reaches its target. There are only two addresses involved. On both systems one must be the local tun0 address and the other one that of the peer.

You can hardly have a running VPN connection if the addresses don't match. So if the server output is correct then the client output must be

# client
8: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
link/none
inet 10.8.0.2 peer 10.8.0.1/32 brd 10.8.0.6 scope global tun0

Probably there is an error in one of the configuration files.

share|improve this answer
    
Thanks for the hint. The server side should be correct and the client side erroneous, but I do not see any config entry that is likely to have an impact on this (the client side is set by NetworkManager). If I modify the address/peer entry manually I can sill not ping the server. –  user538603 Apr 7 '13 at 20:51
    
What VPN software are we talking about? What does tcpdump -i tun0 -n say when you try to ping? May be a firewall problem. –  Hauke Laging Apr 7 '13 at 22:34
    
No firewall that I know of. But: I changed the address pool from 10.8.0.0/24 to 10.9.0.0/24, restarted the server and the client, and now I can access the server from the client (no network yet, but that should be a simple routing issue). Guess that was some weird IP cache error or something like it. –  user538603 Apr 7 '13 at 22:47
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.