2

Ok I have an OpenVPN server A which hosts the range 10.8.0.0/24 and an OpenVPN server B that hosts 10.7.0.0/24. Server A is also a client of server B.

This is the configuration of the tun adapters of both servers.

OpenVPN Server A

inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0
inet 10.7.0.6 peer 10.7.0.5/32 scope global tun1

OpenVPN Server B

inet 10.7.0.1 peer 10.7.0.2/32 scope global tun0

Clients of OpenVPN A get all their traffic routed through Server A and out through its WAN interface. However, one IP range 192.168.0.0/24 can only be reached through the VPN of server B. I have set up a route that passes all 192.168.0.0/24 through the tun interface that connects server A to server B.

ip route add 192.168.0.0/24 dev tun1

I can ping 192.168.0.0/24 fine on server A BUT I cannot ping or reach that range when I'm on an OpenVPN client of server A. I can ping the IP of the tun address 10.7.0.6 but not 192.168.0.0/24. Can anyone shed some light into why this is happening?

1

I built a virtual network and a series of VMs, shown in this image, to make visualizing this problem easier.

virtual network serverfault question 720423

Each system expected to forward packets must have ipv4 forwarding enabled:

# sysctl net.ipv4.ip_forward=1

The configuration of openvpn in my test network is simplified. I'm using openvpn without authentication / encryption, running it from the command line, to provide a simple tunnel between machines "openvpn-a" and "openvpn-b".

openvpn-a:

root@openvpn-a# openvpn --remote openvpn-b --dev tun1

openvpn-b:

root@openvpn-b# openvpn --remote openvpn-a --dev tun1

I experienced the exact problem you describe, trying to ping openvpn-b (192.168.20.1) from client-a (192.168.10.10).

This resulted from the packet getting forwarded by openvpn-a and arriving at openvpn-b with a source address for which openvpn-b did not have a route.

A solution to this problem can be approached in several ways... one, is to add a route to the 'a' side of the network on openvpn-b, via openvpn-a's tunnel device:

openvpn-b:

root@openvpn-b# ip route add 192.168.10.0/24 via 10.8.0.1

Another is to configure openvpn-b's default route to be via openvpn-a's tunnel device:

openvpnb-b:

root@openvpn-b# ip route add default via 10.8.0.1

And still another is to configure NAT on the tunnel device on openvpn-a:

openvpn-a:

root@openvpn-a# iptables -t nat -A POSTROUTING -o tun1 -j MASQUERADE

Wireshark and/or tcpdump can be used to great effect when diagnosing this problem. As can be seen on openvpn-b's tunnel device when a packet arrives and there is no route to the source address network:

root@openvpn-b# tcpdump -n -i tun1
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun1, link-type RAW (Raw IP), capture size 65535 bytes
15:45:10.973251 IP 192.168.10.10 > 192.168.20.1: ICMP echo request, id 2550, seq 1, length 64
^C
1 packet captured
1 packet received by filter
0 packets dropped by kernel

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.