0

So I am trying to set up an OpenVPN server on a Cloud Virtual Machine running CentOS 7. The client (Windows) can connect to the OpenVPN server, I can ping the server from the client, but the server cannot ping the client.

I used the 'road warrior' setup script from here - https://github.com/Nyr/openvpn-install

which sets up the basic environment for me. I have added some lines in the server.conf file because my ultimate goal is for multiple clients to be able to connect to each other through the server. I have marked the lines that I have added using comments.

My server.conf:

port 1194
proto udp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
route 172.16.0.0 255.255.240.0 #added
client-config-dir ccd #added
client-to-client #added
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 183.60.83.19"
push "dhcp-option DNS 183.60.82.98"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem

my ccd/client file:

iroute 172.16.0.0 255.255.240.0

my client.ovpn file:

client
dev tun
proto udp
sndbuf 0
rcvbuf 0
remote <cloudvm-publicIP> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
setenv opt block-outside-dns
key-direction 1
verb 3
<ca>
-----BEGIN CERTIFICATE-----
some-cert
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
some-cert
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
some-key
-----END PRIVATE KEY-----
</key>
<tls-auth>
-----BEGIN OpenVPN Static key V1-----
some-key
-----END OpenVPN Static key V1-----
</tls-auth>

I also added push "route 172.16.0.0 255.255.240.0" to the server.conf but that didn't help either.

Output from ifconfig:

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.16.0.4  netmask 255.255.240.0  broadcast 172.16.15.255
        ether 52:54:00:8b:c1:c8  txqueuelen 1000  (Ethernet)
        RX packets 54319  bytes 32541424 (31.0 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 39171  bytes 8225587 (7.8 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        loop  txqueuelen 1  (Local Loopback)
        RX packets 12  bytes 1008 (1008.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 12  bytes 1008 (1008.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.8.0.1  netmask 255.255.255.0  destination 10.8.0.1
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 492  bytes 74464 (72.7 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 472  bytes 175631 (171.5 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

And from route -n:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         172.16.0.1      0.0.0.0         UG    0      0        0 eth0
10.8.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0
169.254.0.0     0.0.0.0         255.255.0.0     U     1002   0        0 eth0
172.16.0.0      0.0.0.0         255.255.240.0   U     0      0        0 eth0

iptables --list gives me:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     udp  --  anywhere             anywhere             udp dpt:openvpn
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  10.8.0.0/24          anywhere
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

and the nat table (using iptables -t nat --list)-

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
SNAT       all  --  10.8.0.0/24         !10.8.0.0/24          to:172.16.0.4

I have a feeling it's connected to some rule I have set up, because I cannot even ping my gateway (172.16.0.1) which I get from the route -n command. The request times out.

Is there something that I am missing? It's definitely possible because this is the first time I am trying to set something up of this scale.

This question is a bit similar to this one, I have followed the accepted answer but haven't had my problem resolved yet.

Cheers.

0

This isn't a server issue. By default new versions of windows block incoming ping. To troubleshoot you can run the wireshark on the windows host to see, what icmp echo request packets are delivered. Tune the windows firewall.

1
  • Absolutely amazing. Thanks man. I can't believe I wasted one and a half work days on this. :| – Roy2511 May 22 '19 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.