0

I have an OpenVPN server running on Ubuntu 12.04 in an AWS VPC with 3 subnets. I am able to connect my client and can ping the server (10.8.0.1) with no issues, however I cannot reach any other machine in the VPC from my client.

Some background info:

I can ping the server from itself.

I can ping the server from the client.

I CANNOT ping the client from the server.

I can ping machines in the VPC from the server.

I CANNOT ping machines in the VPC (Other than server) from my client.

I have enabled IPV4 forwarding on the server.

I have disabled source/dest checking.

I have setup my route tables in VPC to route 10.8.0.0/16 traffic to my OpenVPN instance.

VPC Subnets:

10.0.0.0/24
10.0.1.0/24
10.0.2.0/24

The OpenVPN Server is running on 10.0.2.0/24 and I am able to ping any server on the other subnets from it, its the client that is unable to reach anything on the subnets.

Server Conf:

port 80
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.0.0
ifconfig-pool-persist ipp.txt
push "route 10.0.0.0 255.0.0.0"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
comp-lzo
max-clients 100
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
verb 6
mute 20

Client Config:

client
dev tun
proto tcp
remote xx.xx.xxx.xxx 80
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert olo-imac.crt
key olo-imac.key
tls-auth ta.key 1
comp-lzo
verb 3

Server Routes:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         10.0.2.1        0.0.0.0         UG    100    0        0 eth0
10.0.2.0        *               255.255.255.0   U     0      0        0 eth0
10.8.0.0        10.8.0.2        255.255.0.0     UG    0      0        0 tun0
10.8.0.2        *               255.255.255.255 UH    0      0        0 tun0

Client Routes:

Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     192.168.36.1   192.168.36.120     10
         10.0.0.0        255.0.0.0         10.8.0.5         10.8.0.6     30
         10.8.0.1  255.255.255.255         10.8.0.5         10.8.0.6     30
         10.8.0.4  255.255.255.252         On-link          10.8.0.6    286
         10.8.0.6  255.255.255.255         On-link          10.8.0.6    286
         10.8.0.7  255.255.255.255         On-link          10.8.0.6    286
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
     192.168.36.0    255.255.255.0         On-link    192.168.36.120    266
   192.168.36.120  255.255.255.255         On-link    192.168.36.120    266
   192.168.36.255  255.255.255.255         On-link    192.168.36.120    266
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link    192.168.36.120    266
        224.0.0.0        240.0.0.0         On-link          10.8.0.6    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link    192.168.36.120    266
  255.255.255.255  255.255.255.255         On-link          10.8.0.6    286
Improve this question
4
  • Would someone like to explain the downvote? I'm happy to revise the question or give more info, but a downvote with no feedback is not constructive. – CIGuy Sep 9 '13 at 14:29
  • Run TCPDump on your OpenVPN server, you should be able to see if the packets are indeed being forwarded from the server to the other hosts on the remote network – GeoSword Sep 9 '13 at 15:09
  • @GeoSword Thanks for the tip, that did the trick. I was able to see that packets were not being forwarded, which led me to investigate my forwarding settings. Turns out forwarding settings had not been applied even though I had restarted networking on the machine. Rebooting the machine solved my problem, still not sure why that was necessary. Please add your tip as an answer and I will award you the bounty. I feel pretty dumb for not figuring this out before. :) – CIGuy Sep 10 '13 at 14:17
  • Glad you cracked it! :D Answer posted below. – GeoSword Sep 10 '13 at 15:05
0
+100

In response to CIGuy's comments above.

Run tcpdump on your OpenVPN server. you should be able to see if the packets are indeed being forwarded from the server to the other hosts on the remote network.

Something like:

tcpdump -i any -v host <ip>

where is the ip you are trying to ping. You can also write the packet capture to file for later analysis in wireshark by adding

-s0 -w somefile.pcap

Keep in mind that some versions of tcpdump will chroot itself, so if somefile.pcap doesn't show where you expect it to be, check /var/lib/tcpdump/

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.