0

I have a situation as described below: 1- I have 2 OpenVPN Server(Server A & Server B).

2- Clients connects to each server via VPN, no direct LAN's.

3- Server B connected as a VPN client to Server A.

4- Server B Runs 2 OpenVPN instances

5- Asuume Laptop B connected via VPN to Server B, I need it to reach Server A (at least).

6- Server A VPN DHCP is 10.8.0.0/24

7- Server B VPN DHCP is 172.30.0.0/16

8- Server B has a static IP 10.8.0.101 (VPN client)

  • The problem is that i cant reach Server A from Laptop B. And Server A cannot reach Server B on the on the VPN server ip,not the client ip.

Network Structure(image)

The Networking configuration is as below:

Server A configuration

    [root@localhost ~]# ifconfig
eth0      inet addr:X.X.X.X  Bcast:X.X.X.255  Mask:255.255.255.0


eth0:0    inet addr:X.X.X.X  Bcast:X.X.255.255  Mask:255.255.0.0


lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0


tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:629066 errors:0 dropped:0 overruns:0 frame:0
          TX packets:416252 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:136006302 (129.7 MiB)  TX bytes:114377768 (109.0 MiB)

Server B

    [root@vps8887 ~]# ifconfig
eth0      inet addr:X.X.X.X  Bcast:X.X.X.255  Mask:255.255.255.0

eth0:0    inet addr:X.X.X.X  Bcast:X.X.X.255  Mask:255.255.255.0

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0


tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:172.30.0.1  P-t-P:172.30.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:69 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:4140 (4.0 KiB)  TX bytes:240 (240.0 b)

tun1      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.101  P-t-P:10.8.0.102  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:34 errors:0 dropped:0 overruns:0 frame:0
          TX packets:105 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:2856 (2.7 KiB)  TX bytes:8820 (8.6 KiB)

Routing for Server A:

[root@localhost ~]# netstat -r
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
10.8.0.2        *               255.255.255.255 UH        0 0          0 tun0
10.8.0.0        10.8.0.2        255.255.255.0   UG        0 0          0 tun0
192.168.1.0     *               255.255.255.0   U         0 0          0 eth0
172.16.0.0      *               255.255.0.0     U         0 0          0 eth0
169.254.0.0     *               255.255.0.0     U         0 0          0 eth0
default         192.168.1.1     0.0.0.0         UG        0 0          0 eth0

The routing for Server B:

 [root@vps8887 ~]# netstat -r
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
10.8.0.102      *               255.255.255.255 UH        0 0          0 tun1
172.30.0.2      *               255.255.255.255 UH        0 0          0 tun0
X.X.X.0    *               255.255.255.0   U         0 0          0 eth0
10.8.0.0        10.8.0.101      255.255.255.0   UG        0 0          0 tun1
X.X.X.0   *               255.255.255.0   U         0 0          0 eth0
172.30.0.0      172.30.0.2      255.255.0.0     UG        0 0          0 tun0
link-local      *               255.255.0.0     U         0 0          0 eth0
default         X.X.X.1    0.0.0.0         UG        0 0          0 eth0
default         X.X.X.1   0.0.0.0         UG        0 0          0 eth0

A problem appears when i'm trying to add routing on Server A, when adding the following command:

route add -net 172.30.0.0/16 gw 10.8.0.101

This error appears:

"SIOCADDRT: Network is unreachable"

OpenVPN configuration for serverA port 1194

proto udp

dev tun

ca ca.crt

cert server.crt

key server.key

dh dh1024.pem

client-to-client

duplicate-cn

server 10.8.0.0 255.255.255.0

client-config-dir ccd

push "dhcp-option DNS 10.8.0.1"

status openvpn-status.log

keepalive 10 120

comp-lzo

persist-key

persist-tun

crl-verify /etc/openvpn/crl.pem

verb 3

================ Server B Client ccd ================
push "dhcp-option DNS 8.8.8.8"

ifconfig-push 10.8.0.101 10.8.0.102

=====================================================

OpenVPN Configuration for server B

======================= Server B ( Server Config )======================== 

port 1194

proto udp 

dev tun

ca ca.crt

cert server.crt

key server.key

dh dh2048.pem

client-to-client

duplicate-cn

server 172.30.0.0 255.255.0.0

push " route 10.8.0.0 255.255.255.0 "

status openvpn-status.log

keepalive 10 120

comp-lzo

persist-key

persist-tun

verb 3

==============================================================================

================= Server B ( Client Config )==============================

client

dev tun

proto udp

remote serverA 1194

resolv-retry infinite

nobind

persist-key

persist-tun

ca ca.crt

cert client.crt

key client.key

route-nopull

route 10.8.0.0 255.255.255.0 10.8.0.101

comp-lzo

verb 5

===============================================================================

Finally: i need these sites to communicate each other.

0

OpenVPN routing commands in general

route

The route command goes in the server config and tells the server to add a route to its own kernel routing table. You don't need to add a route command for the subnet in the server directive, but you do need to add a route command for every other subnet the server should handle. Essentially, this will tell the kernel to send these subnets to the openvpn server. For example:

# serverA.conf (just a fragment)
server 10.8.0.0 255.255.255.0
...
route 172.30.0.0 255.255.255.0 # Add a route to the kernel routing table

iroute

The iroute command creates routes that are "internal" to openvpn so that the openvpn server knows which clients are responsible for subnets, as described here and here. Before packets get to the kernel routing table, openvpn decrypts them as they come in from the tun/tap device and examines them to see what to do with them. Without an iroute command, the server won't recognize them.

# ccd/ServerB.conf
iroute 172.30.0.0

push " route ... "

The push command is used for other things as well, but for routing you need to push the routes for subnets to clients. This will tell the clients to alter their kernal routing table to send traffic to the vpn server. Without this, clients will not know how to get packets from the private subnet 10.8.0.0 to 172.30.0.0. These should go in the ccd/client or just in the server config if it is universal for all clients.

# ServerA.conf (more of the fragment)
server 10.8.0.0 255.255255.0
...
route 172.30.0.0 255.255.255.0 # add the route to the server's kernel
push "route 172.30.0.0 255.255.255.0" # add the route to the clients

client-to-client

The client-to-client command tells the server that clients are allowed to communicate with each other. I believe this is commented by default and is going to be necessary.

kernel ip forwarding

This is not an OpenVPN configuration, and the following is specific to linux. This will be important for anyone running an OpenVPN server, though. Each server must have ip forwarding enabled in the kernel, like this. Also ensure that firewall rules don't prevent forwarding.

Regarding your setup

It looks like you are missing iroute directives. Server B will need an entry in its ccd file. The iroute command tells the openvpn server which client knows about that subnet.

# ccd/ServerB
iroute 172.30.0.0 255.255.255.0

EDIT: Looking agagin, I notice one other thing.

It also appears that Server A is does not push the route to Server B to its clients:

# ServerA config
push " route 172.30.0.0 255.255.255.0 "

I do this with two servers I have running openvpn. You should not have to manually add any routes to any of the machines. If you get the openvpn configs correct, Server B will tell Server A it handles 172.30.0.0 with iroute. Server A will tell clients to send 172.30.0.0 through Server A with push " route ... ". And you already have Server B pushing the route for 10.8.0.0.

To test if this is working, I would recommended ping and not trying to add routes.

8
  • I tried what you are suggestion, but it doesn't work. – Liza Moly Oct 6 '15 at 6:19
  • I updated the answer with more information. If it doesn't help can you be more specific about how it's not working? How do you test it and what is the result? – dangerginger Oct 6 '15 at 7:15
  • i tried the commands iroute you suggested on server B ccd cofig. and route 172.30.0.0 255.255.0.0 . On the configuraation file of server A. The result now is that server A can ping Server B on the ip 172.30.0.1 (Server Ip). But still no ping from Laptop B to Server A. – Liza Moly Oct 7 '15 at 12:26
  • Did you add push "route 172.30.0.0 255.255.255.0" to Server A config? – dangerginger Oct 11 '15 at 5:39
  • I tried what you said push "route 172.30.0.0 255.255.255.0", it didn't make any changes. – Liza Moly Oct 13 '15 at 14:31
0

I solve it my self. The important thing "ipforwarding" wasn't enabled on both sides. This is the major problem. iroute doesnt clear for me, i looked at this article : OpenVPN and iroute The routing all done by OpenVPN. No routing needed manually. As shown below:

Structure With Solution

Finally thanks to Danger Ginger for help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.