0

I've set up a rented root server with KVM and OpenVPN. In order to administrate VMs without a public IP the VM guests are connected to a Host/Guest private network: 10.10.10.0.

Now i want to access a VM guest via OpenVPN, ovpn config is fine (asked already in the ovpn forum). I can connect to the KVM Host/ovpn server and ping 10.10.10.1 (virbr1).

However i can't ping 10.10.10.2 (a vm guest) through the VPN Tunnel, i've added push "route 10.10.10.0 255.255.255.0" to the ovpn config.

In my opinion i have a routing problem, but i'm unable to solve it.

route of the kvm/ovpn server:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         148.251.139.129 0.0.0.0         UG    0      0        0 eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
10.10.10.0      0.0.0.0         255.255.255.0   U     0      0        0 virbr1
148.251.139.128 148.251.139.129 255.255.255.224 UG    0      0        0 eth0
148.251.139.128 0.0.0.0         255.255.255.224 U     0      0        0 eth0
148.251.164.152 0.0.0.0         255.255.255.255 UH    0      0        0 br0
148.251.164.153 0.0.0.0         255.255.255.255 UH    0      0        0 br0
148.251.164.154 0.0.0.0         255.255.255.255 UH    0      0        0 br0
148.251.164.155 0.0.0.0         255.255.255.255 UH    0      0        0 br0
148.251.164.156 0.0.0.0         255.255.255.255 UH    0      0        0 br0
148.251.164.157 0.0.0.0         255.255.255.255 UH    0      0        0 br0
148.251.164.158 0.0.0.0         255.255.255.255 UH    0      0        0 br0
148.251.164.159 0.0.0.0         255.255.255.255 UH    0      0        0 br0
192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 virbr0

route of the vm i'd like to connect to:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.122.1   0.0.0.0         UG    0      0        0 eth0
10.10.10.0      0.0.0.0         255.255.255.0   U     0      0        0 eth1
192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 eth0

ifconfig of the kvm/ovpn server:

br0       Link encap:Ethernet  HWaddr 06:56:c4:f6:f4:75  
          inet addr:148.251.139.133  Bcast:148.251.139.133  Mask:255.255.255.255
          inet6 addr: fe80::456:c4ff:fef6:f475/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:175793 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:7383498 (7.3 MB)

eth0      Link encap:Ethernet  HWaddr 44:8a:5b:9b:a0:7d  
          inet addr:148.251.139.133  Bcast:148.251.139.159  Mask:255.255.255.224
          inet6 addr: 2a01:4f8:210:4384::2/64 Scope:Global
          inet6 addr: fe80::468a:5bff:fe9b:a07d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:285513 errors:0 dropped:0 overruns:0 frame:0
          TX packets:224255 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:87609913 (87.6 MB)  TX bytes:67108015 (67.1 MB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:28895 errors:0 dropped:0 overruns:0 frame:0
          TX packets:28895 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:50248836 (50.2 MB)  TX bytes:50248836 (50.2 MB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:180 errors:0 dropped:0 overruns:0 frame:0
          TX packets:242 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:14408 (14.4 KB)  TX bytes:23872 (23.8 KB)

virbr0    Link encap:Ethernet  HWaddr 52:54:00:76:9b:d5  
          inet addr:192.168.122.1  Bcast:192.168.122.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:233 errors:0 dropped:0 overruns:0 frame:0
          TX packets:218 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:32877 (32.8 KB)  TX bytes:35360 (35.3 KB)

virbr1    Link encap:Ethernet  HWaddr 52:54:00:4c:37:b5  
          inet addr:10.10.10.1  Bcast:10.10.10.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1067 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1414 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:145911 (145.9 KB)  TX bytes:127823 (127.8 KB)

vnet0     Link encap:Ethernet  HWaddr fe:54:00:15:93:50  
          inet6 addr: fe80::fc54:ff:fe15:9350/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:233 errors:0 dropped:0 overruns:0 frame:0
          TX packets:54016 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:36139 (36.1 KB)  TX bytes:2833008 (2.8 MB)

vnet1     Link encap:Ethernet  HWaddr fe:54:00:ff:e6:3e  
          inet6 addr: fe80::fc54:ff:feff:e63e/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1067 errors:0 dropped:0 overruns:0 frame:0
          TX packets:55212 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:160849 (160.8 KB)  TX bytes:2925471 (2.9 MB)

if i ping the vm over the tun0 device, nothing happens:

ping -I tun0 10.10.10.2
PING 10.10.10.2 (10.10.10.2) from 10.8.0.1 tun0: 56(84) bytes of data.

If i ping from my laptop over the vpn tunnel and tcpdump tun0:

15:58:52.723495 IP (tos 0xc0, ttl 64, id 20421, offset 0, flags [none], proto ICMP (1), length 112)
    10.8.0.1 > 10.8.0.6: ICMP 10.10.10.2 protocol 1 port 24859 unreachable, length 92
    IP (tos 0x0, ttl 63, id 53773, offset 0, flags [none], proto ICMP (1), length 84)
    10.8.0.6 > 10.10.10.2: ICMP echo request, id 44339, seq 4, length 64

if tcpdump virbr1 while pinging from the ovpn guest, nothing(icmp) is shown at all

But i can ping 10.8.0.6 (my laptop) from the VM, so the route back seems to be known to the system. I assume i have a missing route somewhere, which connects tun0 to virbr1. But everything i tried changed anything.

Thanks for your help.

edit: ufw was disabled on KVM host and guest during testing

1 Answer 1

0

Ok problem solved:

The problem was a misconfiguration in libvirt. The virtual bridge was configured in isolated mode, after switching to routed virtual network and adding the route: 10.8.0.0/24 gw 10.10.10.1 to the VM guests everything worked as expected.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .