0

I've setup a VPN server within a vlan with an internal subnet. On the VPN server one VPN using IPSec is configured, which can connect to the internal subnet.

Additional I've installed an OpenVPN-Server but the clients can't connect to the internal subnet. The server configuration is:

port 1194
proto udp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "route 10.16.0.0 255.255.0.0"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem

The internal subnet is 10.16.0.0/16.

A traceroute from the connect client to an ip address in the internal subnet shows the following output:

traceroute to 10.16.15.13 (10.16.15.13), 30 hops max, 60 byte packets
 1  10.8.0.1 (10.8.0.1)  1.867 ms  1.757 ms  1.677 ms
 2  * * *
 3  * * *

External connection with the connected client are working.

Output from ip route list:

0.0.0.0/1 via 10.8.0.1 dev tun0 
default via VM-GATEWAY dev ens3 
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.4 
10.16.0.0/16 via 10.8.0.1 dev tun0 
VM-GATEWAY dev ens3 scope link 
128.0.0.0/1 via 10.8.0.1 dev tun0 
VM-IP via VM-GATEWAY dev ens3 

Outfrom from ifconfig on the openvpn server:

ens19: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
    inet OPENVPN-HOST-IP  netmask 255.255.255.248  broadcast OPENVPN-HOST-GATEWAY
    inet6 fe80::9883:beff:fe99:305e  prefixlen 64  scopeid 0x20<link>
    ether 9a:83:be:99:30:5e  txqueuelen 1000  (Ethernet)
    RX packets 6500104  bytes 3982668113 (3.7 GiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 7271114  bytes 4037705401 (3.7 GiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
    inet 127.0.0.1  netmask 255.0.0.0
    inet6 ::1  prefixlen 128  scopeid 0x10<host>
    loop  txqueuelen 1  (Lokale Schleife)
    RX packets 0  bytes 0 (0.0 B)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 0  bytes 0 (0.0 B)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ppp0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1280
    inet 192.168.42.1  netmask 255.255.255.255  destination 192.168.42.10
    ppp  txqueuelen 3  (Punkt-zu-Punkt-Verbindung)
    RX packets 208705  bytes 28271807 (26.9 MiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 189459  bytes 120966692 (115.3 MiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
    inet 10.16.0.1  netmask 255.255.0.0  destination 10.16.0.1
    inet6 fe80::f8ab:a6e:149f:eec4  prefixlen 64  scopeid 0x20<link>
    unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
    RX packets 269  bytes 19394 (18.9 KiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 7  bytes 336 (336.0 B)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Output from iptables -L:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
f2b-sshd   tcp  --  anywhere             anywhere             multiport dports ssh
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            

Output from ip addr list:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens18: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 6e:3e:98:f6:26:2f brd ff:ff:ff:ff:ff:ff
3: ens19: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 9a:83:be:99:30:5e brd ff:ff:ff:ff:ff:ff
    inet OPENVPN-HOST-IP/29 brd OPENVPN-BROADCAST-IP scope global ens19
       valid_lft forever preferred_lft forever
    inet 10.16.0.2/16 scope global ens19
       valid_lft forever preferred_lft forever
    inet6 fe80::9883:beff:fe99:305e/64 scope link 
       valid_lft forever preferred_lft forever
5: ip_vti0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1
    link/ipip 0.0.0.0 brd 0.0.0.0
10: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1280 qdisc pfifo_fast state UNKNOWN group default qlen 3
    link/ppp 
    inet 192.168.42.1 peer 192.168.42.10/32 scope global ppp0
       valid_lft forever preferred_lft forever
13: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
    link/none 
    inet 10.16.0.1/16 brd 10.16.255.255 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::4ef6:f672:4240:6eef/64 scope link flags 800 
       valid_lft forever preferred_lft forever

Content of /etc/openvpn/openvpn-status.log:

OpenVPN CLIENT LIST
Updated,Tue Nov 27 19:38:12 2018
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
vm-monitoring,CLIENT-IP:53718,4883,3650,Tue Nov 27 19:38:05 2018
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
10.16.0.2,vm-monitoring,CLIENT-IP:53718,Tue Nov 27 19:38:07 2018
GLOBAL STATS
Max bcast/mcast queue length,1
END

Do you have an idea how I can fix this issue?

0

Your openvpn server is on different subnet as the 10.16.0.0. Change your openvpn server line

server 10.8.0.0 255.255.255.0

to

server 10.16.0.0 255.255.0.0

and restart openvpn service.

install iptables, enable port 1194 on wan input chain:

iptables -t nat -A PREROUTING -p udp --dport 1194 -j ACCEPT

enable forwarding packets from 10.16.0.0 to lan zone:

iptables -I INPUT -i tun0 -j ACCEPT 
iptables -I FORWARD -i tun0 -j ACCEPT 
iptables -I OUTPUT -o tun0 -j ACCEPT 
iptables -I FORWARD -o tun0 -j ACCEPT

Enable internet access for connected vpn clients:

iptables -t nat -A POSTROUTING -s 10.16.0.0/16 -o ens3 -j MASQUERADE
  • I've changed this configuration for testing purposes now without solving the problem. The first hop in traceroute is now vanished but I still can't reach other servers in this subnet – JanW Nov 27 '18 at 18:03
  • What firewall do you use? Iptables? – kukulo Nov 27 '18 at 18:06
  • Do you have forwarding enabled in the kernel? – kukulo Nov 27 '18 at 18:07
  • No firewall is active at the moment – JanW Nov 27 '18 at 18:07
  • Yes, forwarding is enabled – JanW Nov 27 '18 at 18:07

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.