1

I have problem with routing (i think it's routing) on Debian server. I got 2 routers working as gateways (one of them is public). VPN Clients conecting to Router1 but getting TLS Handshake because of OpenVpn outbound traffic goes back to them via Router2 (blue arrows on image).

Router1 has enabled 1194 port forwarding to Debian server 2nd interface (192.168.40.39)

Clients can connect to OVPN when I create routing for their IP ex. ip route add client_ip via 192.168.40.40

Clients have dynamic IP so it's not a solution.

Configuration

Router1 (internal ip) 192.168.40.40
Router2 (internal ip) 192.168.40.1
Server 1st eth (internal ip) 192.168.40.2
Server 2nd eth (internal ip) 192.168.40.39

ip route

root@XXX:/etc/openvpn# ip route
default via 192.168.40.1 dev ens32 onlink
10.9.8.0/24 via 10.9.8.2 dev tun0
10.9.8.2 dev tun0 proto kernel scope link src 10.9.8.1
192.168.40.0/26 dev ens32 proto kernel scope link src 192.168.40.2
192.168.40.0/26 dev ens34 proto kernel scope link src 192.168.40.39

iptables

root@XXX:/etc/openvpn# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     udp  --  anywhere             anywhere             state NEW udp dpt:openvpn

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
DOCKER-USER  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere

Chain DOCKER (1 references)
target     prot opt source               destination

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain DOCKER-ISOLATION-STAGE-2 (1 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain DOCKER-USER (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

iptables nat

root@XXX:/etc/openvpn# iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DOCKER     all  --  anywhere             anywhere             ADDRTYPE match dst-type LOCAL

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
DOCKER     all  --  anywhere            !loopback/8           ADDRTYPE match dst-type LOCAL

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  172.17.0.0/16        anywhere

Chain DOCKER (2 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

iptables mangle

root@XXX:/etc/openvpn# iptables -L -t mangle
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

/etc/network/interfaces

cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

#source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
#allow-hotplug ens32
auto ens32
iface ens32 inet static
address 192.168.40.2
netmask 255.255.255.192
gateway 192.168.40.1

auto ens34
iface ens34 inet static
address 192.168.40.39
netmask 255.255.255.192
gateway 192.168.40.40

openvpn server config

root@XXX:/etc/openvpn# cat server.conf
port 1194
proto udp
dev tun

local 192.168.40.39

tls-server



ca      /etc/openvpn/easy-rsa/keys/ca.crt    # generated keys
cert    /etc/openvpn/easy-rsa/keys/server.crt
key     /etc/openvpn/easy-rsa/keys/server.key  # keep secret
dh      /etc/openvpn/easy-rsa/keys/dh2048.pem

server 10.9.8.0 255.255.255.0  # internal tun0 connection IP
ifconfig-pool-persist ipp.txt

keepalive 10 120

comp-lzo         # Compression - must be turned on at both end
persist-key
persist-tun

status log/openvpn-status.log

verb 6  # verbose mode
client-to-client

#add
#username-as-common-name
#duplicate-cn
#client-cert-not-required

Sample View

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.