0

I have along standing openvpn server running locally. It's working fine with many physical clients. I have set up an Amazon EC2 Debian 9 instance and installed openvpn client as I would do normally but I can't get it to answer pings from the server over the VPN. Pinging the Tunnel interface (10.4.90.58) works but pinging the eth0 address (172.31.1.165) does not. The routes all seem to be pushed correctly

Pinging from the client to the server and shared subnets works OK.

client.conf

client
dev tun
proto udp
remote myplace.com.au 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca keys/esca.crt
cert keys/ear1.crt
key keys/ear1.key
remote-cert-tls server
comp-lzo yes 
verb 4
mute 20

Relevant parts of server.conf

port 1194
proto udp
dev tun

# Certs
ca keys/ca.crt
cert keys/server.crt
key keys/server.key  # This file should be kept secret
dh keys/dh1024.pem

# Addresses
server 10.4.90.0 255.255.255.0
client-config-dir ccd   

push "route 192.168.90.0 255.255.255.0"
push "route 192.168.20.0 255.255.255.0"

# Amazon Subnet - Not working
route 172.31.0.0 255.255.240.0
push "route 172.31.0.0 255.255.240.0"

# A Working Client  
route 192.168.50.0 255.255.255.0
push "route 192.168.50.0 255.255.255.0"

ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
status openvpn-status.log
client-to-client
persist-key
persist-tun
unique vpn certs
verb 4

ccd file ccd/ear1

iroute 172.31.0.0 255.255.240.0

Server interfaces

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc cbq state UP qlen 1000
    link/ether 28:92:4a:35:63:d6 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.90/24 brd 10.0.0.255 scope global eth0
    inet6 2001:8000:103f:d600:2a92:4aff:fe35:63d6/64 scope global dynamic 
       valid_lft 3399sec preferred_lft 3399sec
    inet6 fe80::2a92:4aff:fe35:63d6/64 scope link 
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 28:92:4a:35:63:d8 brd ff:ff:ff:ff:ff:ff
    inet 192.168.90.1/24 brd 192.168.90.255 scope global eth1
    inet6 fe80::2a92:4aff:fe35:63d8/64 scope link 
       valid_lft forever preferred_lft forever
12: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
    link/none 
    inet 10.4.90.1 peer 10.4.90.2/32 scope global tun0

Server routes

10.4.90.2 dev tun0  proto kernel  scope link  src 10.4.90.1 
192.168.20.0/24 dev eth2  proto kernel  scope link  src 192.168.20.1 
10.0.0.0/24 dev eth0  proto kernel  scope link  src 10.0.0.90 
192.168.30.0/24 via 10.4.90.2 dev tun0 
10.4.90.0/24 via 10.4.90.2 dev tun0 
192.168.90.0/24 dev eth1  proto kernel  scope link  src 192.168.90.1 
172.31.0.0/20 via 10.4.90.2 dev tun0 
default via 10.0.0.1 dev eth0 

Client interfaces

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 02:91:54:a2:0d:5a brd ff:ff:ff:ff:ff:ff
    inet 172.31.1.165/20 brd 172.31.15.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::91:54ff:fea2:d5a/64 scope link 
       valid_lft forever preferred_lft forever
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
    link/none 
    inet 10.4.90.58 peer 10.4.90.57/32 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::3d1c:f4f4:d17e:b0fc/64 scope link flags 800 
       valid_lft forever preferred_lft forever

Client routes

default via 172.31.0.1 dev eth0 
10.4.90.0/24 via 10.4.90.57 dev tun0 
10.4.90.57 dev tun0 proto kernel scope link src 10.4.90.58 
172.31.0.0/20 dev eth0 proto kernel scope link src 172.31.1.165 
192.168.20.0/24 via 10.4.90.57 dev tun0 
192.168.30.0/24 via 10.4.90.57 dev tun0 
192.168.90.0/24 via 10.4.90.57 dev tun0 
0

The problem was the MTU

Adding the following to the client.conf solved it

link-mtu 1542

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.