-1

I want to set a subnet to subnet vpn gateway with Openvpn which should look like this:

[gwA]===[devA1]===[ovpnServer]<---vpn--->[ovpnClient]===[devB1]===[gwB]

[gw?] are default gateways of my subnets
[devA1] is the first of N computers on my openvpn server's subnet
[devB1] is the first of M computers on my openvpn client's subnet

This is not my first try with openvpn. I did several configuration like this, without having problem I can not resolve by myself. But this time, I have no more ideas.

I use tun interfaces on my openvpn nodes and apply all the documentation on routing and firewalling correctly.

My problem is:
- I can ping ovpnClient from ovpnServer
- I can ping ovpnServer from ovpnClient
- I can ping ovpnClient from any devA?
- I can ping ovpnServer from any devB?
- I can ping any devA? from ovpnClient
- I can not ping any devB? from ovpnServer (1)
- I can ping any devA? from any devB?
- I can ping any devB? from any devA?
(1) But I can ping any devB? from ovpnServer if I use my ovpnServer eth0 interface as my ping interface ("ping -I ${lanIP} ${any-devB-IP}")

I'm note sure, but I suppose that my Linux ovpnServer system choose the tun0's IP as the IP from which to ping devB? machines. If that is correct, then this dont work with that IP. But it works with the eth0's IP as the ping source IP!

Any advice to make my routing fully works?

Here are my iptables rules:

ovpnServer >$ iptables --list-rules:

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-ISOLATION
-N f2b-sshd
-A INPUT -p udp -m udp --dport 68 -j ACCEPT
-A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -p tcp -m set --match-set minuteman dst,dst -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j DOCKER-ISOLATION
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -i eth0 -o tun0 -j ACCEPT
-A FORWARD -i tun0 -o eth0 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m set --match-set minuteman dst,dst -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
-A DOCKER-ISOLATION -j RETURN
-A f2b-sshd -j RETURN

ovpnServer >$ iptables -t nat --list-rules:

-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-N DOCKER
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 192.168.254.0/24 ! -o docker0 -j MASQUERADE
-A POSTROUTING -o tun0 -j MASQUERADE
-A DOCKER -i docker0 -j RETURN

ovpnClient >$ iptables --list-rules:

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-ISOLATION
-N f2b-sshd
-A INPUT -p udp -m udp --dport 68 -j ACCEPT
-A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd
-A FORWARD -j DOCKER-ISOLATION
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -p tcp -m set --match-set minuteman dst,dst -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i eth0 -o tun0 -j ACCEPT
-A FORWARD -i tun0 -o eth0 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m set --match-set minuteman dst,dst -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
-A DOCKER-ISOLATION -j RETURN
-A f2b-sshd -j RETURN

ovpnClient >$ iptables -t nat --list-rules:

-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-N DOCKER
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 192.168.254.0/24 ! -o docker0 -j MASQUERADE
-A POSTROUTING -o tun0 -j MASQUERADE
-A DOCKER -i docker0 -j RETURN
Improve this question
8
  • Can you make a list of what you need in the end without question marks (and without not word - it's not clear what do you mean by them)... And do you have DHCP server on the network 1 & 2? You'll need it to send the routes to computers
    – Anubioz
    Sep 11, 2016 at 15:56
  • Sorry for using question marks. That's not clear.
    – TongTwist
    Sep 11, 2016 at 15:57
  • I need my openvpn server be able to established connections with any of my client's side computers. I do not understand why it is not possible if my server's side computers can talk to client's side computer. I do not have DHCP, but I have gateways sets to route to other side subnet via their openvpn node.
    – TongTwist
    Sep 11, 2016 at 16:00
  • And can you please add some example ip subnets to make your question clearer. Like gw.A = 192.168.10.1, devA1=192.168.10.0/24, OpenVPNServer=192.168.10.100|10.10.0.1, OpenVPNClient=10.10.0.6|192.168.20.100, devB1=192.168.20.0/24, gwB=192.168.20.1
    – Anubioz
    Sep 11, 2016 at 16:01
  • It's not possible to talk each other because they don't have routes they need to establish connection. You can set them either by using DHCP on gateways, or manually for each pc in both networks (openvpnserver & client have routes set automatically, but other PC-s don't) ... I'll give you commands as soon as you will provide example IPs
    – Anubioz
    Sep 11, 2016 at 16:03

1 Answer 1

Reset to default
0

So you need to set the following set of routes & allow forwarding on both OpenVPNs:

On OpenVPNServer:

ip route add 192.168.101.0/24 via 10.8.0.4
iptables -t nat -I POSTROUTING -o tun0  -j MASQUERADE
iptables -I FORWARD -i eth0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o eth0 -j ACCEPT
iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

On OpenVPNClient:

ip route add 192.168.100.0/24 via 10.8.0.1
iptables -t nat -A POSTROUTING -o tun0  -j MASQUERADE
iptables -I FORWARD -i eth0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o eth0 -j ACCEPT
iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

On gwA:

ip route add 192.168.101.0/24 via 192.168.100.2

On gwB:

ip route add 192.168.100.0/24 via 192.168.101.2

And make sure you got the following lines in the OpenVPNServer configuration file (server.conf):

route add 192.168.101.0 255.255.255.0
push "route 192.168.100.0 255.255.255.0"
iroute 192.168.101.0 255.255.255.0
client-to-client
Improve this answer
10
  • My problem remains. How does my server is not able to make connections for itself but in the same time it is able to route everything else?
    – TongTwist
    Sep 11, 2016 at 16:44
  • @TongTwist It's an iptables issue for sure, can you post iptables --list-rules && iptables -t nat --list-rules for ovpnClient & ovpnServer please?
    – Anubioz
    Sep 11, 2016 at 16:48
  • I just update my questions by adding my iptables rules
    – TongTwist
    Sep 11, 2016 at 17:01
  • There are several iptables modes, each of them is important. So please add iptables -t nat --list-rules too - it's a different command...
    – Anubioz
    Sep 11, 2016 at 17:07
  • OK done. I did it but mixed normal and nat rules. Sorry.
    – TongTwist
    Sep 11, 2016 at 17:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .