1

We are trying to configure an OpenVPN tunnel that allows devices on our LAN to communicate with servers in an Amazon VPC. We are using the turnkey OpenVPN access server instance on Amazon and have followed documentation to set up our local server as a Gateway.

Image of configuration: http://imgur.com/Y33PdJU

The Amazon server is able to communicate with Router A on our LAN without issue (ping, ssh), however when we try to ping from Router A to the private IP of the server, it does not get through. Using tcpdump we see the echo request on Gateway A's eth0 interface, but we do not see anything on the tun1 interface. It seems like it is not being properly forwarded to the tun0 interface. Using OpenVPN's configuration we have made it so that clients should be able to act as a Gateway.

Where are we going wrong? More details below.

Left Side Gateway

netstat -rn

Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 10.23.0.1 0.0.0.0 UG 0 0 0 wlan0
10.0.0.2 10.0.2.1 255.255.255.255 UGH 0 0 0 tun1
10.0.1.0 10.0.2.1 255.255.255.0 UG 0 0 0 tun1
10.0.2.0 0.0.0.0 255.255.255.0 U 0 0 0 tun1
10.23.0.0 0.0.0.0 255.255.240.0 U 0 0 0 wlan0
54.208.149.66 10.23.0.1 255.255.255.255 UGH 0 0 0 wlan0
172.16.0.0 172.16.0.1 255.255.0.0 UG 0 0 0 tap0
192.168.0.0 192.168.10.100 255.255.0.0 UG 0 0 0 eth0

sudo iptables --list

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            

ip route

default via 10.23.0.1 dev wlan0  proto static 
10.0.0.2 via 10.0.2.1 dev tun1  metric 101 
10.0.1.0/24 via 10.0.2.1 dev tun1  metric 101 
10.0.2.0/24 dev tun1  proto kernel  scope link  src 10.0.2.12 
10.23.0.0/20 dev wlan0  proto kernel  scope link  src 10.23.3.197  metric 9 
54.208.149.66 via 10.23.0.1 dev wlan0 
172.16.0.0/16 via 172.16.0.1 dev tap0 
192.168.0.0/16 via 192.168.10.100 dev eth0 

OpenVPN Config

setenv FORWARD_COMPATIBLE 1
client
proto tcp
remote vpn.xxx.com
port 3389
dev tun
dev-type tun
ns-cert-type server
reneg-sec 604800
sndbuf 100000
rcvbuf 100000
# NOTE: LZO commands are pushed by the Access Server at connect time.
# NOTE: The below line doesn't disable LZO.
comp-lzo no
verb 3
setenv PUSH_PEER_INFO

ip rule

0:    from all lookup local 
220:    from all lookup 220 
32766:    from all lookup main 
32767:    from all lookup default

ifconfig

eth0 Link encap:Ethernet HWaddr 44:8a:5b:57:a7:68
inet addr:192.168.10.100 Bcast:192.168.10.255 Mask:255.255.255.0
inet6 addr: fe80::468a:5bff:fe57:a768/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:96265 errors:0 dropped:103 overruns:0 frame:0
TX packets:42772 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:15112811 (15.1 MB) TX bytes:6396552 (6.3 MB)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:1420458 errors:0 dropped:0 overruns:0 frame:0
TX packets:1420458 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:339956597 (339.9 MB) TX bytes:339956597 (339.9 MB)

tap0 Link encap:Ethernet HWaddr a6:0a:3c:76:bd:33
inet addr:172.16.0.1 Bcast:172.16.0.255 Mask:255.255.255.0
inet6 addr: fe80::a40a:3cff:fe76:bd33/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:138694 errors:0 dropped:1155 overruns:0 frame:0
TX packets:118026 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:49993976 (49.9 MB) TX bytes:25231042 (25.2 MB)

tun1 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.0.2.11 P-t-P:10.0.2.11 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:9 errors:0 dropped:0 overruns:0 frame:0
TX packets:9 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:1260 (1.2 KB) TX bytes:1372 (1.3 KB)

wlan0 Link encap:Ethernet HWaddr 40:f0:2f:8f:51:5c
inet addr:10.23.3.197 Bcast:10.23.15.255 Mask:255.255.240.0
inet6 addr: fe80::42f0:2fff:fe8f:515c/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2205804 errors:0 dropped:0 overruns:0 frame:0
TX packets:1773520 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1823901987 (1.8 GB) TX bytes:273830921 (273.8 MB)

Right Side Gateway

OpenVPN Access Server Version: 2.0.8    
Accepting VPN client connections on IP address: all interfaces  
Port for VPN client connections:    tcp/3389    
OSI Layer:  3 (routing/NAT) 
Clients access private subnets using:   Routing 

openvpnas@openvpnas2:/var/log$ netstat -rn

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         10.0.1.1        0.0.0.0         UG        0 0          0 eth0
10.0.1.0        10.0.1.128      255.255.255.0   UG        0 0          0 eth0
10.0.2.0        0.0.0.0         255.255.255.0   U         0 0          0 as0t0
172.16.0.0      0.0.0.0         255.255.0.0     U         0 0          0 as0t0
192.168.0.0     0.0.0.0         255.255.0.0     U         0 0          0 as0t0
0

I think that there is an iroute conf missing. Simply put you need to create a ccd folder and specify the path to it in the openvpn conf file like so:

client-config-dir /path-to-ccd/ccd

Into that folder you should create a single file which would correspond with the specific vpn conf ( if you have username-as-common-name in the conf then the name of the cert is the name of the file) and into that file put the internal subnet e.g.

iroute 192.168.x.x 255.255.x.x

In this case openvpn will know how to reach the internal subnet.

More on this here: https://community.openvpn.net/openvpn/wiki/RoutedLans

Hope this helps.

1
  • Thanks. We added this - but still we aren't seeing any traffic get forwarded from the eth0 interface on the client-side gateway to its tun1 interface. – Scott Stevenson Aug 14 '14 at 0:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.