2

Ok I have an OpenVPN server A which hosts the range 10.8.0.0/24 and an OpenVPN server B that hosts 10.7.0.0/24. Server A is also a client of server B.

This is the configuration of the tun adapters of both servers.

OpenVPN Server A

inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0
inet 10.7.0.6 peer 10.7.0.5/32 scope global tun1

OpenVPN Server B

inet 10.7.0.1 peer 10.7.0.2/32 scope global tun0

Clients of OpenVPN A get all their traffic routed through Server A and out through its WAN interface. However, one IP range 192.168.0.0/24 can only be reached through the VPN of server B. I have set up a route that passes all 192.168.0.0/24 through the tun interface that connects server A to server B.

ip route add 192.168.0.0/24 dev tun1

I can ping 192.168.0.0/24 fine on server A BUT I cannot ping or reach that range when I'm on an OpenVPN client of server A. I can ping the IP of the tun address 10.7.0.6 but not 192.168.0.0/24. Can anyone shed some light into why this is happening?

1 Answer 1

1

I built a virtual network and a series of VMs, shown in this image, to make visualizing this problem easier.

virtual network serverfault question 720423

Each system expected to forward packets must have ipv4 forwarding enabled:

# sysctl net.ipv4.ip_forward=1

The configuration of openvpn in my test network is simplified. I'm using openvpn without authentication / encryption, running it from the command line, to provide a simple tunnel between machines "openvpn-a" and "openvpn-b".

openvpn-a:

root@openvpn-a# openvpn --remote openvpn-b --dev tun1

openvpn-b:

root@openvpn-b# openvpn --remote openvpn-a --dev tun1

I experienced the exact problem you describe, trying to ping openvpn-b (192.168.20.1) from client-a (192.168.10.10).

This resulted from the packet getting forwarded by openvpn-a and arriving at openvpn-b with a source address for which openvpn-b did not have a route.

A solution to this problem can be approached in several ways... one, is to add a route to the 'a' side of the network on openvpn-b, via openvpn-a's tunnel device:

openvpn-b:

root@openvpn-b# ip route add 192.168.10.0/24 via 10.8.0.1

Another is to configure openvpn-b's default route to be via openvpn-a's tunnel device:

openvpnb-b:

root@openvpn-b# ip route add default via 10.8.0.1

And still another is to configure NAT on the tunnel device on openvpn-a:

openvpn-a:

root@openvpn-a# iptables -t nat -A POSTROUTING -o tun1 -j MASQUERADE

Wireshark and/or tcpdump can be used to great effect when diagnosing this problem. As can be seen on openvpn-b's tunnel device when a packet arrives and there is no route to the source address network:

root@openvpn-b# tcpdump -n -i tun1
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun1, link-type RAW (Raw IP), capture size 65535 bytes
15:45:10.973251 IP 192.168.10.10 > 192.168.20.1: ICMP echo request, id 2550, seq 1, length 64
^C
1 packet captured
1 packet received by filter
0 packets dropped by kernel

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .