LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices



Reply
 
Search this Thread
Old 09-01-2005, 12:55 PM   #1
mmarinho
LQ Newbie
 
Registered: Aug 2005
Distribution: fedora, slackware, debian, freebsd
Posts: 12

Rep: Reputation: 0
OpenVPN internal network access


First , Hello to all

I am installing a package called OpenVPN between two sites.

Cenário:
At one site the package was installed in a Iptables+squid Linux Machine.

At other side We have a Cisco Router that was natting udp 5000 to an internal VPN Server.

Well , I can successful ping between the two machines that OpenVPN package was installed .

The problem is I can not reach any off internal machines.

I already add in the linux machines the line
echo 1 > proc/sys/net/ipv4/ip_forward


Any hint

Thanks before hands
 
Old 09-01-2005, 02:13 PM   #2
Matir
Moderator
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Ubuntu
Posts: 8,507

Rep: Reputation: 118Reputation: 118
Are you using OpenVPN bridging on the remote side? More specifically, give details including ips and routing tables. Is the connection correctly established?
 
Old 09-01-2005, 10:12 PM   #3
mmarinho
LQ Newbie
 
Registered: Aug 2005
Distribution: fedora, slackware, debian, freebsd
Posts: 12

Original Poster
Rep: Reputation: 0
Ok, Let me explain .

I am using Site1 ----------Site2

This is the configuration files
======================================
#Site1.conf
# Use interface TUN
dev tun
# 10.0.0.1 Ip for Site 1
# 10.0.0.2 Ip for Site 2
ifconfig 10.0.0.1 10.0.0.2
# Go to directory OpenVPN
cd /etc/openvpn
#Use static key
secret chave
#OpenVPN will use 5000/UDP
port 5000
#Usuer for daemon
user nobody
#Group for daemon
group nogroup
#Use LZO Compact library
comp-lzo
#Keep alive the connectio using ping
ping 15
#Log
verb 3


#Site2.conf
# Use interface TUN
dev tun
# 10.0.0.1 Ip for Site 1
# 10.0.0.2 Ip for Site 2
ifconfig 10.0.0.2 10.0.0.1
#Call the ip for Site 1
remote External_Ip_for_Site_1
# Go to directory OpenVPN
cd /etc/openvpn
#Use static key
secret chave
#OpenVPN will use 5000/UDP
port 5000
#Usuer for daemon
user nobody
#Group for daemon
group nogroup
#Use LZO Compact library
comp-lzo
#Keep alive the connectio using ping
ping 15
#Log
verb 3


#starting the Tunel in site 1
route add -net ip_network_site2/Mask gw 10.0.0.2
openvpn --config /etc/openvpn/site1.conf --daemon

#starting the Tunel in site 2
route add -net ip_network_site1/Mask gw 10.0.0.1
openvpn --config /etc/openvpn/site2.conf --daemon
======================================

I am successfuly ping both machine but no internal machines inside the networks.

In the Site 1 machine there is a Iptables firewall and squid. This machine has a valid ip address

In Site 2 there is a CISCO router doing ip nat iniside to the VPN gateway ( Site 2 Machine).

I hope this will help in solving this.

Thank you before hands
 
Old 09-01-2005, 11:08 PM   #4
Matir
Moderator
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Ubuntu
Posts: 8,507

Rep: Reputation: 118Reputation: 118
You'll need to use ipforwarding to route the packets properly, just like a NAT box.
 
Old 09-02-2005, 07:27 AM   #5
dpajares
LQ Newbie
 
Registered: Apr 2004
Location: uruguay
Distribution: debian
Posts: 25
Blog Entries: 1

Rep: Reputation: 15
dear all.
First of all, I am a really bad writing english.
But I can help you.
For rich the internal network, you must be have a route tables for this.
something like this...
ip route add internal-network/mask via tun-ip.
I am sugestting read ip-rute man.
Please remember enable ping, if nmap is not been used.


regards.
 
Old 09-02-2005, 09:24 AM   #6
mmarinho
LQ Newbie
 
Registered: Aug 2005
Distribution: fedora, slackware, debian, freebsd
Posts: 12

Original Poster
Rep: Reputation: 0
Thanks folks ,

No a problem with your English.

Let me put the VPN Start files complete this time.

#starting the Tunel in site 1
modprobe tun
echo 1 > /proc/sys/net/ipv4/ip_forward
route add -net 172.19.128.0/23 gw 10.0.0.2
openvpn --config /etc/openvpn/site1.conf --daemon

#starting the Tunel in site 2
modprobe tun
echo 1 > /proc/sys/net/ipv4/ip_forward
route add -net 192.168.1.0/24 gw 10.0.0.1
openvpn --config /etc/openvpn/site2.conf --daemon
=========================================

This was in my start vpn files before, sorry to forget to put this here .

I am able to ping from both vpn gateways to other vpn gateway. The tunel is working fine.

But , I already put a ip route to the other network in the start vpn file but it had not worked.

Any hint ?
 
Old 09-02-2005, 10:24 AM   #7
dpajares
LQ Newbie
 
Registered: Apr 2004
Location: uruguay
Distribution: debian
Posts: 25
Blog Entries: 1

Rep: Reputation: 15
very good.
But not have a rute jaja
If you no have a rute not have ping.
After vpn is up.
type (inte the sit1 shell)
$ip route add 10.0.1.0/24 via 192.168.0.1
type (in the sit2 shell)
$ip route add 10.0.2.0/24 via 192.168.0.2
where
10.0.1.0 - internal net sit1
192.168.0.1 - tun0 - sit1

10.0.2.0 - internal net sit2
192.168.0.2 - tun0 sit2

If you need more help, please sen me your two rute tables.
type
$rute >route-sit1
regards

Last edited by dpajares; 09-02-2005 at 10:26 AM.
 
Old 09-02-2005, 11:40 AM   #8
mmarinho
LQ Newbie
 
Registered: Aug 2005
Distribution: fedora, slackware, debian, freebsd
Posts: 12

Original Poster
Rep: Reputation: 0
Sorry I do not understand this solution ...

What is this 10.0.1.0 or 10.0.2.0 for ?

Where is this came from ?,
I am using 10.0.0.1 to site 1 tunnel side and
10.0.0.2 for site 2 tunnel side.

??

My route table for site 1 is :
===============================
root@proxy1:~# route
Tabela de Roteamento IP do Kernel
Destino Roteador MáscaraGen. Opções Métrica Ref Uso Iface
10.0.0.2 * 255.255.255.255 UH 0 0 0 tun0
external_ip * 255.255.255.248 U 0 0 0 eth0
192.168.0.0 * 255.255.255.0 U 0 0 0 eth1
172.19.128.0 10.0.0.2 255.255.254.0 UG 0 0 0 tun0
default * 0.0.0.0 U 0 0 0 eth0
root@proxy1:~#
 
Old 09-02-2005, 12:39 PM   #9
dpajares
LQ Newbie
 
Registered: Apr 2004
Location: uruguay
Distribution: debian
Posts: 25
Blog Entries: 1

Rep: Reputation: 15
you have a semantic problem.
I am explain you how to route internal networks throughput vpn.
Fot this example.
ifaces in sit1
10.0.0.1 tun0
192.168.1.1 eth1
ifaces in sit2
10.0.0.2 tun0
192.168.2.1 eth1
route table in sit1
ip route add 192.168.2.0/24 via 10.0.0.1
route table in sit2
ip route add 192.168.1.0/24 via 10.0.0.2
remember.
Is impossible route two network with the same ip segment.
If you not have a route, no have ping

Have fun
 
Old 09-02-2005, 01:06 PM   #10
mmarinho
LQ Newbie
 
Registered: Aug 2005
Distribution: fedora, slackware, debian, freebsd
Posts: 12

Original Poster
Rep: Reputation: 0
Ok ,

But see my start vpn files
========================
#starting the Tunel in site 1
modprobe tun
echo 1 > /proc/sys/net/ipv4/ip_forward
route add -net 172.19.128.0/23 gw 10.0.0.2
openvpn --config /etc/openvpn/site1.conf --daemon

#starting the Tunel in site 2
modprobe tun
echo 1 > /proc/sys/net/ipv4/ip_forward
route add -net 192.168.0.0/24 gw 10.0.0.1
openvpn --config /etc/openvpn/site2.conf --daemon
=========================================

The ip routes are already in there ...
Sorry I am not understanding you about this route tables.
 
Old 09-02-2005, 02:27 PM   #11
dpajares
LQ Newbie
 
Registered: Apr 2004
Location: uruguay
Distribution: debian
Posts: 25
Blog Entries: 1

Rep: Reputation: 15
your problem is 192.168.0.0 * 255.255.255.0 U 0 0 0 eth1, should be tun0
type in shell.
ip route add 192.168.0.0/24 via 10.0.0.1
if you dont understend, send me a diagram for more info.

regards
 
Old 09-02-2005, 02:34 PM   #12
mmarinho
LQ Newbie
 
Registered: Aug 2005
Distribution: fedora, slackware, debian, freebsd
Posts: 12

Original Poster
Rep: Reputation: 0
Well let me be more clear
Network1--VPN/iptables Site1 ---Cisco/nat--VPN Gateway site2 --Site2 Network



Route table for VPN gateway Site 2

Tabela de Roteamento IP do Kernel
Destino Roteador MáscaraGen. Opções Métrica Ref Uso Iface
10.0.0.1 * 255.255.255.255 UH 0 0 0 tun0
192.168.0.0 10.0.0.1 255.255.255.0 UG 0 0 0 tun0
172.19.128.0 * 255.255.254.0 U 0 0 0 eth0
default 172.19.129.254 0.0.0.0 UG 0 0 0 eth0

============================================
My route table for site 1 is : Remember Site 1 Network is 192.168.0.0/24
===============================
root@proxy1:~# route
Tabela de Roteamento IP do Kernel
Destino Roteador MáscaraGen. Opções Métrica Ref Uso Iface
10.0.0.2 * 255.255.255.255 UH 0 0 0 tun0
external_ip * 255.255.255.248 U 0 0 0 eth0
192.168.0.0 * 255.255.255.0 U 0 0 0 eth1
172.19.128.0 10.0.0.2 255.255.254.0 UG 0 0 0 tun0
default * 0.0.0.0 U 0 0 0 eth0
 
Old 09-02-2005, 03:00 PM   #13
mmarinho
LQ Newbie
 
Registered: Aug 2005
Distribution: fedora, slackware, debian, freebsd
Posts: 12

Original Poster
Rep: Reputation: 0
rede Site 1 192.168.0.0/24

rede Site 2 172.19.128.0/23
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
howto access webserver from internal network? Falafel Linux - Networking 6 11-01-2005 03:18 PM
How to gain access internal LAN Using OpenVPN? ltam68 Linux - Networking 2 06-23-2005 09:32 PM
Poptop server cannot access internal network LJ151 Linux - Software 3 08-05-2004 08:55 AM
Cant access some samba shares from internal network emilioestevezz Linux - Software 2 04-20-2004 10:26 AM
Internal Network access is slow SkullOne Linux - Networking 4 02-07-2003 04:22 AM


All times are GMT -5. The time now is 02:44 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration