0

I have configured openvpn server and able to login as well. However after the connection is eastablished I'm not able to access intranet websites.

Server ifconfig looks like bewlow

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 52:54:00:03:90:0b brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.253/24 brd 192.168.0.255 scope global noprefixroute enp1s0
       valid_lft forever preferred_lft forever
    inet6 fd01::5054:ff:fe03:900b/64 scope global dynamic noprefixroute 
       valid_lft 259sec preferred_lft 259sec
    inet6 fe80::5054:ff:fe03:900b/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
    link/none 
    inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::aa36:56c8:3a99:2a98/64 scope link stable-privacy 
       valid_lft forever preferred_lft forever

And iptables output

Chain INPUT (policy ACCEPT 149 packets, 9788 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  322 37460 ACCEPT     udp  --  enp1s0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:1194

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 346 packets, 28928 bytes)
 pkts bytes target     prot opt in     out     source               destination    

The server is hosted on a vitual machine installed on KVM and connected to the local network through bridge connection. I think that there is some issue with iptables forwarding and accepting traffic from tunnel to ethernet. I really have no knowledge about iptables. Little help will be appreciated.

Inside Office network

traceroute officework.net
traceroute to officework.net (192.168.0.2), 30 hops max, 60 byte packets
 1  192.168.0.2 (192.168.0.2)  2.994 ms !X  2.885 ms !X  2.841 ms !X

Outside office network outside office network

traceroute officework.net
officework.net: Name or service not known
Cannot handle "host" cmdline arg `officework.net' on position 1 (argc 1)

Trceroute with IP

traceroute 192.168.0.2
traceroute to 192.168.0.2 (192.168.0.2), 30 hops max, 60 byte packets
 1  _gateway (192.168.43.1)  1.549 ms  1.416 ms  43.679 ms
 2  * * *
 3  10.71.135.19 (10.71.135.19)  31.621 ms  40.307 ms  31.470 ms
 4  192.168.31.239 (192.168.31.239)  31.274 ms 192.168.31.243 (192.168.31.243)  36.119 ms  40.036 ms
 5  192.168.37.9 (192.168.37.9)  39.465 ms  39.675 ms  39.683 ms
 6  172.25.11.164 (172.25.11.164)  35.374 ms  24.760 ms  35.150 ms
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *

ifconfig outside office network

ifconfig
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 96  bytes 7644 (7.4 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 96  bytes 7644 (7.4 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.8.0.6  netmask 255.255.255.255  destination 10.8.0.5
        inet6 fe80::3374:cf7a:d81:cc05  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 39  bytes 3394 (3.3 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

virbr0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 192.168.122.1  netmask 255.255.255.0  broadcast 192.168.122.255
        ether 52:54:00:87:ae:c6  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlp1s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.43.187  netmask 255.255.255.0  broadcast 192.168.43.255
        inet6 2409:4060:9f:2013:387c:6e1c:5399:a2c7  prefixlen 64  scopeid 0x0<global>
        inet6 fe80::31a:f142:92dd:f67a  prefixlen 64  scopeid 0x20<link>
        ether a8:a7:95:67:0f:23  txqueuelen 1000  (Ethernet)
        RX packets 6976  bytes 5783306 (5.5 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 7029  bytes 1291358 (1.2 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
5
  • What happens when you do an nslookup on the intranet site names?
    – Bert
    Jul 24, 2020 at 17:01
  • I get reply ** server can't find officework.net: NXDOMAIN
    – DAKSH
    Jul 24, 2020 at 17:08
  • What constitutes an "intranet" site? What is its address? Can you traceroute to it? Jul 24, 2020 at 17:28
  • The site are hosted on a different centos apache server with dns server. Only computers or devices connected to the office network can access it. No one outside from office router can access the site or ping it.
    – DAKSH
    Jul 24, 2020 at 17:31
  • Hi @MichaelHampton I have updated the traceroute outside office network including traceroute inside office network. The domain name is officework.net
    – DAKSH
    Jul 25, 2020 at 10:31

2 Answers 2

0

You need to use your DNS servers that host the records for the intranet site, not public DNS servers. Likely your internal servers. Try entering the IP address of the intranet site in your browser and see if that connects.

0

Finally google did help with the problem. As explained in https://openvpn.net/community-resources/how-to/#scope I added

push "route 192.168.0.0 255.255.255.0"

In server configuration file And added iptables

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o enp1s0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source  192.168.0.253

Now everything works like a charm. If you want DNS to be working just add DNS server entry in Wifi or Lan connection and you are in the office.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .