1

I'm currently working on a homelab project and built a home server using VMWare ESXI 7. On this Hypervisor i run two ubuntu 22.04 server images, one for file sharing and one to serve as a vpn server.

My goal is to be able to remotely access my homenetwork from my laptop. That's why I tried to setup a vpn server using openvpn.

In order to set-up my vpn I used the following script I found on github : https://github.com/angristan/openvpn-install

Despite the script working completely fine I'm unable to establish a connection between my client and the server.

Client log :

client log(coudn't post those in text format because of the spam warning)

And server logs :

Fragment of server logs (coudn't post those in text format because of the spam warning)

I've tried connecting both from within and from outside (phone network sharing) my home network and got those exact same result each time.

Since my vpn server is behind a NAT I have two ipv4 addresses :

here is the $ ip result :

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:6a:f0:7c brd ff:ff:ff:ff:ff:ff
    altname enp3s0
    inet 192.168.1.30/24 metric 100 brd 192.168.1.255 scope global dynamic ens160
       valid_lft 82561sec preferred_lft 82561sec
    inet6 2a01:cb10:590:cb00:20c:29ff:fe6a:f07c/64 scope global dynamic mngtmpaddr noprefixroute 
       valid_lft 86378sec preferred_lft 578sec
    inet6 fe80::20c:29ff:fe6a:f07c/64 scope link 
       valid_lft forever preferred_lft forever
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500
    link/none 
    inet 10.8.0.1/24 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fd42:42:42:42::1/112 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::3fb6:59d8:f6a4:278d/64 scope link stable-privacy 
       valid_lft forever preferred_lft forever

And when I interrogate the opendns i get this :

Using domain server:
Name: resolver1.opendns.com
Address: 208.67.222.222#53
Aliases: 

myip.opendns.com has address A.B.C.D

However this parameter seemed to have been taken into account in the script aforementionned and all config files look Ok.

My openvpn server config looks liks this :

port 1194
proto udp6
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 94.140.14.14"
push "dhcp-option DNS 94.140.15.15"
push "redirect-gateway def1 bypass-dhcp"
server-ipv6 fd42:42:42:42::/112
tun-ipv6
push tun-ipv6
push "route-ipv6 2000::/3"
push "redirect-gateway ipv6"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key
crl-verify crl.pem
ca ca.crt
cert server_G6hxio5CQJ6lKNV4.crt
key server_G6hxio5CQJ6lKNV4.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
client-config-dir /etc/openvpn/ccd
status /var/log/openvpn/status.log
verb 3

Iptables :

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  all  --  *      ens160  10.8.0.0/24          0.0.0.0/0           

and

#!/bin/sh
iptables -t nat -I POSTROUTING 1 -s 10.8.0.0/24 -o ens160 -j MASQUERADE
iptables -I INPUT 1 -i tun0 -j ACCEPT
iptables -I FORWARD 1 -i ens160 -o tun0 -j ACCEPT
iptables -I FORWARD 1 -i tun0 -o ens160 -j ACCEPT
iptables -I INPUT 1 -i ens160 -p udp --dport 1194 -j ACCEPT
ip6tables -t nat -I POSTROUTING 1 -s fd42:42:42:42::/112 -o ens160 -j MASQUERADE
ip6tables -I INPUT 1 -i tun0 -j ACCEPT
ip6tables -I FORWARD 1 -i ens160 -o tun0 -j ACCEPT
ip6tables -I FORWARD 1 -i tun0 -o ens160 -j ACCEPT
ip6tables -I INPUT 1 -i ens160 -p udp --dport 1194 -j ACCEPT

I checked the ip forwarding and it seems to be properly enabled.

The server status is ok :

● openvpn@server.service - OpenVPN connection to server
     Loaded: loaded (/etc/systemd/system/openvpn@.service; enabled; vendor preset: enabled)
     Active: active (running) since Fri 2022-08-05 23:26:08 UTC; 59min left
       Docs: man:openvpn(8)
             https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
             https://community.openvpn.net/openvpn/wiki/HOWTO
   Main PID: 887 (openvpn)
     Status: "Initialization Sequence Completed"
      Tasks: 1 (limit: 1033)
     Memory: 3.1M
        CPU: 77ms
     CGroup: /system.slice/system-openvpn.slice/openvpn@server.service
             └─887 /usr/sbin/openvpn --daemon ovpn-server --status /run/openvpn/server.status 10 --cd /etc/openvpn --script-security 2 --config /etc/openvpn/server.conf --writepid /run/openvpn/server.pid

 UDPv6 link local (bound): [AF_INET6][undef]:1194
 UDPv6 link remote: [AF_UNSPEC]
 GID set to nogroup
 UID set to nobody
 MULTI: multi_init called, r=256 v=256
 IFCONFIG POOL IPv4: base=10.8.0.2 size=253
 IFCONFIG POOL IPv6: base=fd42:42:42:42::2 size=65534 netbits=112
 NOTE: IPv4 pool size is 253, IPv6 pool size is 65534. IPv4 pool size limits the number of clients 
 that can be served from the pool
 IFCONFIG POOL LIST
Initialization Sequence Completed

I did find quite a few anomalies (blocked home network requests) in the ufw log however whitelisting the homenetwork ip addresses did nothing.

In addition I tried connecting whith all firewalls disabled (client server and isp box) but it didn't solved the problem.

Supprisingly when I used nmap on my public ip address using the port 1194 and it worked :

Starting Nmap 7.80 ( https://nmap.org ) at 2022-08-06 00:35 CEST
Nmap scan report for areims-XXX-X-XX-XXX.wXX-XXX.abo.wanadoo.fr (A.B.C.D)
Host is up (0.0048s latency).

PORT     STATE         SERVICE
1194/udp open|filtered openvpn

Nmap done: 1 IP address (1 host up) scanned in 0.38 seconds

The nmap result is the same from within and outside the home network.

So yeah, I tried quite a few things to troubleshoot this vpn with no luck. I didn't managed to get a connection. So if you have an idea or if you need some further information let me know.

Thanks a lot!

2
  • Almost everything seems fine to me, but to make sure, is your OpenVPN machine on the same network with your router or does your VMWare ESXI machine add another virtual network layer?
    – Emre Talha
    Aug 6 at 11:13
  • Thanks for your comment. Yes all machines are on the same network (192.168.1.XX). The issue lied at the router level. The router firewall 1194 port was open but I forgot to setup the NAT rules to forward inbound connections to my vpn server. Aug 6 at 11:40

1 Answer 1

2

I did further testing this morning by installing the vpn on a baremetal ubuntu machine to see if ESXI was causing the issue. It was not. Results were the same.

So I checked my ISP router to verify the configuration and the issue lied there. I did open the 1194 port on my ISP router firewall however I didn't configure the NAT to forward the connections to my vpn server. So I added a new rule and now everthing works fine, I'm able to access my ESXI administration panel from outside my home network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.