0

I've set up a rented root server with KVM and OpenVPN. In order to administrate VMs without a public IP the VM guests are connected to a Host/Guest private network: 10.10.10.0.

Now i want to access a VM guest via OpenVPN, ovpn config is fine (asked already in the ovpn forum). I can connect to the KVM Host/ovpn server and ping 10.10.10.1 (virbr1).

However i can't ping 10.10.10.2 (a vm guest) through the VPN Tunnel, i've added push "route 10.10.10.0 255.255.255.0" to the ovpn config.

In my opinion i have a routing problem, but i'm unable to solve it.

route of the kvm/ovpn server:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         148.251.139.129 0.0.0.0         UG    0      0        0 eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
10.10.10.0      0.0.0.0         255.255.255.0   U     0      0        0 virbr1
148.251.139.128 148.251.139.129 255.255.255.224 UG    0      0        0 eth0
148.251.139.128 0.0.0.0         255.255.255.224 U     0      0        0 eth0
148.251.164.152 0.0.0.0         255.255.255.255 UH    0      0        0 br0
148.251.164.153 0.0.0.0         255.255.255.255 UH    0      0        0 br0
148.251.164.154 0.0.0.0         255.255.255.255 UH    0      0        0 br0
148.251.164.155 0.0.0.0         255.255.255.255 UH    0      0        0 br0
148.251.164.156 0.0.0.0         255.255.255.255 UH    0      0        0 br0
148.251.164.157 0.0.0.0         255.255.255.255 UH    0      0        0 br0
148.251.164.158 0.0.0.0         255.255.255.255 UH    0      0        0 br0
148.251.164.159 0.0.0.0         255.255.255.255 UH    0      0        0 br0
192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 virbr0

route of the vm i'd like to connect to:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.122.1   0.0.0.0         UG    0      0        0 eth0
10.10.10.0      0.0.0.0         255.255.255.0   U     0      0        0 eth1
192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 eth0

ifconfig of the kvm/ovpn server:

br0       Link encap:Ethernet  HWaddr 06:56:c4:f6:f4:75  
          inet addr:148.251.139.133  Bcast:148.251.139.133  Mask:255.255.255.255
          inet6 addr: fe80::456:c4ff:fef6:f475/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:175793 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:7383498 (7.3 MB)

eth0      Link encap:Ethernet  HWaddr 44:8a:5b:9b:a0:7d  
          inet addr:148.251.139.133  Bcast:148.251.139.159  Mask:255.255.255.224
          inet6 addr: 2a01:4f8:210:4384::2/64 Scope:Global
          inet6 addr: fe80::468a:5bff:fe9b:a07d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:285513 errors:0 dropped:0 overruns:0 frame:0
          TX packets:224255 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:87609913 (87.6 MB)  TX bytes:67108015 (67.1 MB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:28895 errors:0 dropped:0 overruns:0 frame:0
          TX packets:28895 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:50248836 (50.2 MB)  TX bytes:50248836 (50.2 MB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:180 errors:0 dropped:0 overruns:0 frame:0
          TX packets:242 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:14408 (14.4 KB)  TX bytes:23872 (23.8 KB)

virbr0    Link encap:Ethernet  HWaddr 52:54:00:76:9b:d5  
          inet addr:192.168.122.1  Bcast:192.168.122.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:233 errors:0 dropped:0 overruns:0 frame:0
          TX packets:218 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:32877 (32.8 KB)  TX bytes:35360 (35.3 KB)

virbr1    Link encap:Ethernet  HWaddr 52:54:00:4c:37:b5  
          inet addr:10.10.10.1  Bcast:10.10.10.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1067 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1414 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:145911 (145.9 KB)  TX bytes:127823 (127.8 KB)

vnet0     Link encap:Ethernet  HWaddr fe:54:00:15:93:50  
          inet6 addr: fe80::fc54:ff:fe15:9350/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:233 errors:0 dropped:0 overruns:0 frame:0
          TX packets:54016 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:36139 (36.1 KB)  TX bytes:2833008 (2.8 MB)

vnet1     Link encap:Ethernet  HWaddr fe:54:00:ff:e6:3e  
          inet6 addr: fe80::fc54:ff:feff:e63e/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1067 errors:0 dropped:0 overruns:0 frame:0
          TX packets:55212 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:160849 (160.8 KB)  TX bytes:2925471 (2.9 MB)

if i ping the vm over the tun0 device, nothing happens:

ping -I tun0 10.10.10.2
PING 10.10.10.2 (10.10.10.2) from 10.8.0.1 tun0: 56(84) bytes of data.

If i ping from my laptop over the vpn tunnel and tcpdump tun0:

15:58:52.723495 IP (tos 0xc0, ttl 64, id 20421, offset 0, flags [none], proto ICMP (1), length 112)
    10.8.0.1 > 10.8.0.6: ICMP 10.10.10.2 protocol 1 port 24859 unreachable, length 92
    IP (tos 0x0, ttl 63, id 53773, offset 0, flags [none], proto ICMP (1), length 84)
    10.8.0.6 > 10.10.10.2: ICMP echo request, id 44339, seq 4, length 64

if tcpdump virbr1 while pinging from the ovpn guest, nothing(icmp) is shown at all

But i can ping 10.8.0.6 (my laptop) from the VM, so the route back seems to be known to the system. I assume i have a missing route somewhere, which connects tun0 to virbr1. But everything i tried changed anything.

Thanks for your help.

edit: ufw was disabled on KVM host and guest during testing

0

Ok problem solved:

The problem was a misconfiguration in libvirt. The virtual bridge was configured in isolated mode, after switching to routed virtual network and adding the route: 10.8.0.0/24 gw 10.10.10.1 to the VM guests everything worked as expected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.