So I am trying to set up an OpenVPN server on a Cloud Virtual Machine running CentOS 7. The client (Windows) can connect to the OpenVPN server, I can ping the server from the client, but the server cannot ping the client.
I used the 'road warrior' setup script from here - https://github.com/Nyr/openvpn-install
which sets up the basic environment for me. I have added some lines in the server.conf file because my ultimate goal is for multiple clients to be able to connect to each other through the server. I have marked the lines that I have added using comments.
My server.conf:
port 1194
proto udp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
route 172.16.0.0 255.255.240.0 #added
client-config-dir ccd #added
client-to-client #added
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 183.60.83.19"
push "dhcp-option DNS 183.60.82.98"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem
my ccd/client file:
iroute 172.16.0.0 255.255.240.0
my client.ovpn file:
client
dev tun
proto udp
sndbuf 0
rcvbuf 0
remote <cloudvm-publicIP> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
setenv opt block-outside-dns
key-direction 1
verb 3
<ca>
-----BEGIN CERTIFICATE-----
some-cert
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
some-cert
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
some-key
-----END PRIVATE KEY-----
</key>
<tls-auth>
-----BEGIN OpenVPN Static key V1-----
some-key
-----END OpenVPN Static key V1-----
</tls-auth>
I also added push "route 172.16.0.0 255.255.240.0" to the server.conf but that didn't help either.
Output from ifconfig:
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.16.0.4 netmask 255.255.240.0 broadcast 172.16.15.255
ether 52:54:00:8b:c1:c8 txqueuelen 1000 (Ethernet)
RX packets 54319 bytes 32541424 (31.0 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 39171 bytes 8225587 (7.8 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
loop txqueuelen 1 (Local Loopback)
RX packets 12 bytes 1008 (1008.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 12 bytes 1008 (1008.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500
inet 10.8.0.1 netmask 255.255.255.0 destination 10.8.0.1
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC)
RX packets 492 bytes 74464 (72.7 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 472 bytes 175631 (171.5 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
And from route -n:
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 172.16.0.1 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
169.254.0.0 0.0.0.0 255.255.0.0 U 1002 0 0 eth0
172.16.0.0 0.0.0.0 255.255.240.0 U 0 0 0 eth0
iptables --list gives me:
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpt:openvpn
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- 10.8.0.0/24 anywhere
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
and the nat table (using iptables -t nat --list)-
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- 10.8.0.0/24 !10.8.0.0/24 to:172.16.0.4
I have a feeling it's connected to some rule I have set up, because I cannot even ping my gateway (172.16.0.1) which I get from the route -n command. The request times out.
Is there something that I am missing? It's definitely possible because this is the first time I am trying to set something up of this scale.
This question is a bit similar to this one, I have followed the accepted answer but haven't had my problem resolved yet.
Cheers.
