I'm new to OpenVPN and couldn't find any simmilar answer. I have 3 Linux machines (Ubuntu 16.04):

A and S are in the same network. B are in a different network which is very restricted.

There is an OpenVPN server on machine S with "client-to-client" directive enabled.

A and B sees (ping, connect) each other and the server over the VPN as they are clients.

The question is: How can I enable the server to see (ping, connect) the clients over the VPN? The routes seems ok, but I get connection timeout.

I need every machine to see (ping, connect) each other unrestricted in my VPN including the server. All three machines have access to internet separately they must only see (ping, connect) each other over the VPN no need for LAN forwarding.

I used https://github.com/Nyr/openvpn-install script to install. With the additional "client-to-client" flag in the server.conf.

UPDATE: tcpdump shows that the server uses the "real network" through the default route to access the VPN-IP. Maybe some routing problem on the server?

My current configs (half-working as stated above) derived from kal3v's post:

server:

tls-server
tls-auth ta.key 0  # This has to be added, or does not connects
proto tcp
port 443
dev tun

ca ca.crt
cert server.crt
key server.key
dh dh.pem
server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

client-to-client

keepalive 10 120

comp-lzo

persist-key
persist-tun

status openvpn-status.log
log-append  /var/log/openvpn.log
verb 4
mute 20

client:

client
tls-client  # This has to be added, or does not connects
dev tun
proto tcp-client
remote [SERVER IP REDACTED] 443
resolv-retry infinite

ca ca.crt
cert client1.crt
key client1.key

nobind
persist-key
persist-tun
comp-lzo
tls-auth ta.key 1  # This has to be added, or does not connects

#status openvpn-status.log
#log-append  /var/log/openvpn.log
verb 4
mute 20
<ca>
[REDACTED]
</ca>
<cert>
[REDACTED]
</cert>
<key>
[REDACTED]
</key>
<tls-auth>
[REDACTED]
</tls-auth>

Server ifconfig -a:

em1       Link encap:Ethernet  HWaddr [REDACTED]  
          inet addr:[REDACTED]  Bcast:[REDACTED]  Mask:[REDACTED]
          inet6 addr: [REDACTED] Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2399844 errors:0 dropped:0 overruns:0 frame:0
          TX packets:530948 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:719766790 (719.7 MB)  TX bytes:435347738 (435.3 MB)
          Interrupt:20 Memory:f7200000-f7220000 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:98881 errors:0 dropped:0 overruns:0 frame:0
          TX packets:98881 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:9737053 (9.7 MB)  TX bytes:9737053 (9.7 MB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:84 errors:0 dropped:0 overruns:0 frame:0
          TX packets:67 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:9634 (9.6 KB)  TX bytes:13102 (13.1 KB)

Server iptables -n -L:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:443

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  10.8.0.0/24          0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Server netstat -nr:

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         [REDACTED]      0.0.0.0         UG        0 0          0 em1
[REDACTED]      0.0.0.0         [REDACTED]      U         0 0          0 em1
10.8.0.0        10.8.0.2        255.255.255.0   UG        0 0          0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH        0 0          0 tun0

Client ifconfig -a:

eno1      Link encap:Ethernet  HWaddr [REDACTED]
          inet addr:[REDACTED]  Bcast:[REDACTED]  Mask:[REDACTED]
          inet6 addr: [REDACTED] Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:241633 errors:0 dropped:0 overruns:0 frame:0
          TX packets:78722 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:224498248 (224.4 MB)  TX bytes:10952745 (10.9 MB)
          Interrupt:20 Memory:fe400000-fe420000 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:779 errors:0 dropped:0 overruns:0 frame:0
          TX packets:779 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:73331 (73.3 KB)  TX bytes:73331 (73.3 KB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.6  P-t-P:10.8.0.5  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:64 errors:0 dropped:0 overruns:0 frame:0
          TX packets:84 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:12922 (12.9 KB)  TX bytes:9634 (9.6 KB)

Client iptables -n -L:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Client netstat -nr

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         [REDACTED]      0.0.0.0         UG        0 0          0 eno1
[REDACTED]      0.0.0.0         [REDACTED]      U         0 0          0 eno1
10.8.0.0        10.8.0.5        255.255.255.0   UG        0 0          0 tun0
10.8.0.5        0.0.0.0         255.255.255.255 UH        0 0          0 tun0
  • Please clarify what exactly you mean by "see the clients"? What exactly you are expecting to happen and what happens instead? – Tero Kilkanen Mar 29 '17 at 6:27
  • By default, each vpn server "can see" - as you say - each client's. Comunication between each client will be restricted unless you specify client-to-client. Probably you are contacting the server on bad address. I can't figure out much more if you don't edit your question adding ifconfig -a and iptables -n -L and netstat -nr from both one client and the server. – Marco Mar 29 '17 at 8:02
  • I have edited my question, and added clarification on "can see" and the required configs. – dlazesz Mar 30 '17 at 11:46
  • tls-auth is optional. As I noted, this is a minimal configuration. – kal3v Mar 30 '17 at 13:25
  • If i omit tls-auth the client can not connect. – dlazesz Mar 30 '17 at 13:33
up vote 1 down vote accepted

The solution was:

Somehow there were the following firewall rule directing the server to the real LAN instead of the VPN for reaching VPN clinents which had to be deleted:

Server iptables -t nat -L -n -v --line-numbers:

Chain PREROUTING (policy ACCEPT 249K packets, 44M bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain INPUT (policy ACCEPT 247K packets, 44M bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 3954 packets, 273K bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 3890 packets, 269K bytes)
num   pkts bytes target     prot opt in     out     source               destination
1      208 15001 SNAT       all  --  *      *       10.8.0.0/24          0.0.0.0/0            to:[REDACTED SERVER_REAL_IP]

On the server: iptables -t nat -D POSTROUTING 1

Et voilà! Everything works...

To make it permanent delete/comment the corresponding line in /etc/rc.local .

Thank you all for your help!

Here's an example of a minimal client-to-client SSL/TLS configuration that works for the following network setup:

+------------------+            |                                                                 
|                  |            |                                                                 
|                  | 10.132.0.2 |                                                                 
|    Client 1      -------------|                                                                 
|                  |            |                                             +------------------+
|                  |            |                                             |                  |
+------------------+            |104.199.78.27                 130.211.80.223 |                  |
                             /- --------------  The Internet   ---------------|    Client 2      |
                           /-   |                                             |                  |
+------------------+     /-     |                                             |                  |
|                  |   /-       |                                             +------------------+
|                  | /-         |                                                                 
|  OpenVPN server  --------------                                                                 
|                  | 10.132.0.3 |                                                                 
|                  |            |                                                                 
+------------------+            |     

104.199.78.27 is NATted to the internal 10.132.0.3 of the OpenVPN server. The 10.8.0.0/24 network will be used for all VPN clients.

Here's the OpenVPN server configuration:

tls-server
proto tcp
port 443
dev tun

ca ca.crt
cert server.crt
key server.key
dh dh2048.pem

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

client-to-client

keepalive 10 120

comp-lzo

persist-key
persist-tun

status openvpn-status.log
log-append  /var/log/openvpn.log
verb 4
mute 20 

Here's client1 configuration:

client
dev tun
proto tcp-client
remote 10.132.0.3 443
resolv-retry infinite

ca ca.crt
cert client1.crt
key client1.key

nobind
persist-key
persist-tun
comp-lzo

status openvpn-status.log
log-append  /var/log/openvpn.log
verb 4
mute 20      

Here's client2 configuration:

client
dev tun
proto tcp-client
remote 104.199.78.27 443
resolv-retry infinite

ca ca.crt
cert client2.crt
key client2.key

nobind
persist-key
persist-tun
comp-lzo

status openvpn-status.log
log-append  /var/log/openvpn.log
verb 4
mute 20

When everything is up and running we get the following IP and routing configuration:

server% ifconfig tun0
tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:27 errors:0 dropped:0 overruns:0 frame:0
          TX packets:25 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:3971 (3.8 KiB)  TX bytes:3051 (2.9 KiB)

server% ip route show to match 10.8.0.0/24
default via 10.132.0.1 dev eth0 
10.8.0.0/24 via 10.8.0.2 dev tun0     

client1% ifconfig tun0
tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.6  P-t-P:10.8.0.5  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:3 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:252 (252.0 B)  TX bytes:252 (252.0 B)

client1% ip route show to match 10.8.0.1
default via 10.132.0.1 dev eth0 
10.8.0.0/24 via 10.8.0.5 dev tun0 

client2% ifconfig tun0
tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.10  P-t-P:10.8.0.9  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:5 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:420 (420.0 B)  TX bytes:420 (420.0 B)

client2% ip route show to match 10.8.0.1
default via 10.132.0.1 dev eth0 
10.8.0.0/24 via 10.8.0.9 dev tun0

And thus we have client to client connectivity:

server% ping -c 1 10.8.0.6
PING 10.8.0.6 (10.8.0.6) 56(84) bytes of data.
64 bytes from 10.8.0.6: icmp_seq=1 ttl=64 time=1.45 ms

--- 10.8.0.6 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.456/1.456/1.456/0.000 ms
root@server:/etc/openvpn# ping -c 1 10.8.0.10
PING 10.8.0.10 (10.8.0.10) 56(84) bytes of data.
64 bytes from 10.8.0.10: icmp_seq=1 ttl=64 time=0.779 ms

--- 10.8.0.10 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.779/0.779/0.779/0.000 ms

client1% ping -c 1 10.8.0.10
PING 10.8.0.10 (10.8.0.10) 56(84) bytes of data.
64 bytes from 10.8.0.10: icmp_seq=1 ttl=64 time=1.39 ms

--- 10.8.0.10 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.392/1.392/1.392/0.000 ms
root@client1:/etc/openvpn# ping -c 1 10.8.0.1
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=1.54 ms

--- 10.8.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.540/1.540/1.540/0.000 ms

client2% ping -c 1 10.8.0.6
PING 10.8.0.6 (10.8.0.6) 56(84) bytes of data.
64 bytes from 10.8.0.6: icmp_seq=1 ttl=64 time=1.12 ms

--- 10.8.0.6 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.124/1.124/1.124/0.000 ms
root@client2:/etc/openvpn# ping -c 1 10.8.0.1
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=0.584 ms

--- 10.8.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.584/0.584/0.584/0.000 ms
  • Your configs not work for me (the client could not connect with TLS error) without modification. (See the edited question for your sligthly modified config.) And with your modified configs there is no change. Can I see your iptables -n -L and netstat -nr for comparsion? – dlazesz Mar 30 '17 at 11:51
  • Hmmm, I do not have any Netfilter rules. The only thing that I have not included is to enable IP forwarding: echo 1 > /proc/sys/net/ipv4/ip_forward – kal3v Mar 30 '17 at 13:04
  • I have set echo 1 > /proc/sys/net/ipv4/ip_forward on the server already, seting on the clients makes no change. My ping seem to reach the destination machine according to the verbose logs, but somehow lost. – dlazesz Mar 30 '17 at 13:27
  • Can I see your server's related routes? (I found the clients' already.) – dlazesz Mar 30 '17 at 13:38
  • I have edited my answer to show the routes for the 10.8.0.0/24 network on the server. – kal3v Mar 30 '17 at 13:48

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.