0

I'm using openvpn (with webmin and ubuntu 18.10) and the traffic is not forwarding between subnets =[ Openvpn is creating a route table with a wrong (i think) gateway

I need 2 (or more) subnets with forwarding traffic, but only one (the admin-server subnet) can create the request.

The clientes-server subnet cannot see other devices in the same subnet... but can connect only the devices on admin-server

The clients can connect (i tested with tcpdump and ping)... iptables dont block any forward traffic

Is the vpn server config ok? I need add "route" command in each config?

admin-server.conf

port 1195
proto udp
dev tun0
ca keys/admin/ca.crt
cert keys/admin/admin-server.crt
key keys/admin/admin-server.key
dh keys/admin/dh2048.pem
topology subnet
server 172.20.0.0 255.255.255.0
crl-verify keys/admin/crl.pem
cipher AES-256-CFB
user nobody
group nogroup
status servers/admin-server/logs/openvpn-status.log
log-append servers/admin-server/logs/openvpn.log
verb 2
mute 20
max-clients 100
management 127.0.0.1 7506
keepalive 10 120
client-config-dir /etc/openvpn/servers/admin-server/ccd
comp-lzo
persist-key
persist-tun
ccd-exclusive
route 172.21.0.0 255.255.255.0
push "route 172.21.0.0 255.255.255.0"

clientes-server.conf

port 1194
proto udp
dev tun1
ca keys/clientes/ca.crt
cert keys/clientes/clientes-server.crt
key keys/clientes/clientes-server.key
dh keys/clientes/dh2048.pem
topology subnet
server 172.21.0.0 255.255.255.0
crl-verify keys/clientes/crl.pem
cipher AES-256-CBC
user nobody
group nogroup
status servers/clientes-server/logs/openvpn-status.log
log-append servers/clientes-server/logs/openvpn.log
verb 2
mute 20
max-clients 100
management 127.0.0.1 7505
keepalive 10 120
client-config-dir /etc/openvpn/servers/clientes-network/ccd
comp-lzo
persist-key
persist-tun
ccd-exclusive
topology subnet
route 172.20.0.0 255.255.255.0
push "route 172.20.0.0 255.255.255.0"

clientes-joao.ovpn (clients config to clientes.server)

client
proto udp
dev tun
ca ca.crt
dh dh2048.pem
cert clientes-joao.crt
key clientes-joao.key
remote xx.xx.xx 1194
cipher AES-256-CBC
verb 2
mute 20
keepalive 10 120
comp-lzo
persist-key
persist-tun
resolv-retry infinite
nobind

routes

$ route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.0.0.1        0.0.0.0         UG    100    0        0 eth0
10.0.0.0        0.0.0.0         255.255.255.0   U     0      0        0 eth0
10.0.0.1        0.0.0.0         255.255.255.255 UH    100    0        0 eth0
172.20.0.0      172.21.0.2      255.255.255.0   UG    0      0        0 tun1
172.20.0.0      0.0.0.0         255.255.255.0   U     0      0        0 tun0
172.21.0.0      0.0.0.0         255.255.255.0   U     0      0        0 tun1

iptables

$ iptables -S

-P INPUT ACCEPT
-P FORWARD DROP
-P OUTPUT ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
-A INPUT -p udp -m udp --dport 1195 -j ACCEPT
-A FORWARD -i tun0 -o tun+ -j ACCEPT
-A FORWARD -i tun+ -o tun0 -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 10000 -j ACCEPT
-A OUTPUT -p udp -m udp --sport 1195 -j LOG

ifconfig

$ ifconfig

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 172.20.0.1  netmask 255.255.255.0  destination 172.20.0.1
        inet6 fe80::2b43:ffe6:df7f:33f  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 10  bytes 480 (480.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun1: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 172.21.0.1  netmask 255.255.255.0  destination 172.21.0.1
        inet6 fe80::326:a44b:6bf3:f10b  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 46  bytes 5861 (5.8 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 98  bytes 8117 (8.1 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

admin-server log

$ cat servers/admin-server/logs/openvpn.log

Wed Jan 30 19:37:34 2019 OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Sep  5 2018
Wed Jan 30 19:37:34 2019 library versions: OpenSSL 1.1.0g  2 Nov 2017, LZO 2.08
Wed Jan 30 19:37:34 2019 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:7506
Wed Jan 30 19:37:34 2019 Diffie-Hellman initialized with 2048 bit key
Wed Jan 30 19:37:34 2019 TUN/TAP device tun0 opened
Wed Jan 30 19:37:34 2019 TUN/TAP TX queue length set to 100
Wed Jan 30 19:37:34 2019 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Wed Jan 30 19:37:34 2019 /sbin/ip link set dev tun0 up mtu 1500
Wed Jan 30 19:37:34 2019 /sbin/ip addr add dev tun0 172.20.0.1/24 broadcast 172.20.0.255
Wed Jan 30 19:37:34 2019 Could not determine IPv4/IPv6 protocol. Using AF_INET
Wed Jan 30 19:37:34 2019 Socket Buffers: R=[212992->212992] S=[212992->212992]
Wed Jan 30 19:37:34 2019 UDPv4 link local (bound): [AF_INET][undef]:1195
Wed Jan 30 19:37:34 2019 UDPv4 link remote: [AF_UNSPEC]
Wed Jan 30 19:37:34 2019 GID set to nogroup
Wed Jan 30 19:37:34 2019 UID set to nobody
Wed Jan 30 19:37:34 2019 MULTI: multi_init called, r=256 v=256
Wed Jan 30 19:37:34 2019 IFCONFIG POOL: base=172.20.0.2 size=252, ipv6=0
Wed Jan 30 19:37:34 2019 Initialization Sequence Completed

clientes-server log

 $ cat servers/clientes-server/logs/openvpn.log

Wed Jan 30 19:37:40 2019 OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Sep  5 2018
Wed Jan 30 19:37:40 2019 library versions: OpenSSL 1.1.0g  2 Nov 2017, LZO 2.08
Wed Jan 30 19:37:40 2019 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:7505
Wed Jan 30 19:37:40 2019 Diffie-Hellman initialized with 2048 bit key
Wed Jan 30 19:37:40 2019 ROUTE_GATEWAY 10.0.0.1/255.255.255.0 IFACE=eth0 HWADDR=0a:91:77:ec:fd:8c
Wed Jan 30 19:37:40 2019 TUN/TAP device tun1 opened
Wed Jan 30 19:37:40 2019 TUN/TAP TX queue length set to 100
Wed Jan 30 19:37:40 2019 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Wed Jan 30 19:37:40 2019 /sbin/ip link set dev tun1 up mtu 1500
Wed Jan 30 19:37:40 2019 /sbin/ip addr add dev tun1 172.21.0.1/24 broadcast 172.21.0.255
Wed Jan 30 19:37:40 2019 /sbin/ip route add 172.20.0.0/24 via 172.21.0.2
RTNETLINK answers: File exists
Wed Jan 30 19:37:40 2019 ERROR: Linux route add command failed: external program exited with error status: 2
Wed Jan 30 19:37:40 2019 Could not determine IPv4/IPv6 protocol. Using AF_INET
Wed Jan 30 19:37:40 2019 Socket Buffers: R=[212992->212992] S=[212992->212992]
Wed Jan 30 19:37:40 2019 UDPv4 link local (bound): [AF_INET][undef]:1194
Wed Jan 30 19:37:40 2019 UDPv4 link remote: [AF_UNSPEC]
Wed Jan 30 19:37:40 2019 GID set to nogroup
Wed Jan 30 19:37:40 2019 UID set to nobody
Wed Jan 30 19:37:40 2019 MULTI: multi_init called, r=256 v=256
Wed Jan 30 19:37:40 2019 IFCONFIG POOL: base=172.21.0.2 size=252, ipv6=0
Wed Jan 30 19:37:40 2019 Initialization Sequence Completed

Thanks!

  • The route line should be the routes that are reachable via client connections. The push "route ... line should be the routes that need to be set on the clients. It makes no sense to have those the same. – wurtel Jan 31 at 13:56
  • @Torin client-to-client will not forward traffic between 2 subnet ._. only who is connect on "admin-server" can connect other device... who is in "clientes-server" cannot connect other devices in the same subnet – Dollynho Jan 31 at 14:46
  • @wurtel ok, i need remove the "route" from the server configuration? – Dollynho Jan 31 at 14:47
  • @wurtel Still not forwarding the packets... (removed the "route" and restarted openvpn server and clients) server iptables info ``` Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- tun0 tun+ 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- tun+ tun0 0.0.0.0/0 0.0.0.0/0 ctstate ESTABLISHED ``` – Dollynho Jan 31 at 14:54
  • What do you have in the client-config-dir for each client? – wurtel Jan 31 at 15:24

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.