LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
LinkBack Search this Thread
Old 10-03-2009, 11:51 PM   #1
deibertine
Member
 
Registered: Mar 2009
Posts: 215

Rep: Reputation: 30
openVPN not routing inside LAN


Not so sure on what's going on, but for some reason my openVPN is not routing inside my LAN. It connects fine but it wont connect to others.
I have setup bridge network.

Here's my server.conf:
mode server
tls-server
#local 10.10.1.2 ## ip/hostname of server
port 1194 ## default openvpn port
proto udp
client-to-client
#bridging directive
dev tap0 ## If you need multiple tap devices, add them here
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"
persist-key
persist-tun
#certificates and encryption
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem
tls-auth ta.key 0 # This file is secret
cipher BF-CBC # Blowfish (default)
comp-lzo
#DHCP Information
ifconfig-pool-persist ipp.txt
server-bridge 10.10.1.0 255.255.255.0 10.10.1.10 10.10.1.70
push "dhcp-option DNS 10.10.6.12"
push "dhcp-option DOMAIN csaa.com"
max-clients 60 ## set this to the max number of clients that should be connected at a time
#log and security
user nobody
group nogroup
keepalive 10 120
status openvpn-status.log
verb 3

I desperately need expert advise on this.
Please kindly someone provide me assistance.

Cheers,
DB
 
Old 10-04-2009, 12:06 AM   #2
wfh
Member
 
Registered: Sep 2009
Location: Northern California
Distribution: Ubuntu Debian CentOS RHEL Suse
Posts: 164

Rep: Reputation: 44
What do you mean by "not routing inside LAN"? Are you going through a firewall, and are connections to port 1194 allowed through the firewall?
 
Old 10-04-2009, 04:17 AM   #3
deibertine
Member
 
Registered: Mar 2009
Posts: 215

Original Poster
Rep: Reputation: 30
Quote:
Originally Posted by wfh View Post
What do you mean by "not routing inside LAN"? Are you going through a firewall, and are connections to port 1194 allowed through the firewall?
Sorry for my wording.
What I meant was when i connect through openvpn, it wont allow me to connect to other subnets inside our corporate network.
Yes 1194 is allowed in our firewall.
Any ideas why this isnt working?
 
Old 10-04-2009, 08:10 AM   #4
deadeyes
Member
 
Registered: Aug 2006
Posts: 491

Rep: Reputation: 47
Quote:
Originally Posted by deibertine View Post
Sorry for my wording.
What I meant was when i connect through openvpn, it wont allow me to connect to other subnets inside our corporate network.
Yes 1194 is allowed in our firewall.
Any ideas why this isnt working?
What is your configuration?
IP/mask, networks, routing?
If I understand you connect in a road warrior setup and you can only connect to the machines in the network that are directly connected to the openvpn server?

Then your problem is probably your routing.
All networks should know where they should send the packet if it is for the tunnel.
 
Old 10-04-2009, 11:00 PM   #5
deibertine
Member
 
Registered: Mar 2009
Posts: 215

Original Poster
Rep: Reputation: 30
Thanks for your response.
My server config is above the post.
Others config files and stats are down below.

Here's my openvpn server interfaces config:
## This is the network bridge declaration
auto lo br0 ## start on boot
iface lo inet loopback

iface br0 inet static
address 10.10.1.2
netmask 255.255.255.0
gateway 10.10.1.1
bridge_ports eth0

iface eth0 inet manual
up ifconfig $IFACE 0.0.0.0 up
up ip link set $IFACE promisc on
down ip link set $IFACE promisc off
down ifconfig $IFACE down

bridge_fd 9 ## from the libvirt docs (forward delay time)
bridge_hello 2 ## from the libvirt docs (hello time)
bridge_maxage 12 ## from the libvirt docs (maximum message age)
bridge_stp off ## from the libvirt docs (spanning tree protocol)

Here's my client config:
client
dev tap
remote vpnmain.csaa.com 1194
nobind
resolv-retry infinite
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
tls-auth ta.key 1
cipher BF-CBC
comp-lzo
verb 3
route 10.10.1.0 255.255.255.0 vpn_gateway
Here's my iptables:
Chain INPUT
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dptpenvpn
ACCEPT all -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp dptopenvpn
ACCEPT udp -- anywhere anywhere udp dptopenvpn
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp dpt
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain FORWARD
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain OUTPUT
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dptopenvpn
ACCEPT all -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp dptopenvpn
ACCEPT udp -- anywhere anywhere udp dptopenvpn
ACCEPT udp -- anywhere anywhere udp dptopenvpn
ACCEPT all -- anywhere anywhere

Here's my routing in openvpn server:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.10.1.0 0.0.0.0 255.255.255.0 U br0
0.0.0.0 10.10.1.1 0.0.0.0 UG br0

Please advise if you have other questions.
Any help much appreciated.
Cheers!
DB

Last edited by deibertine; 10-04-2009 at 11:02 PM. Reason: added interfaces cfg file
 
Old 10-05-2009, 03:19 AM   #6
deadeyes
Member
 
Registered: Aug 2006
Posts: 491

Rep: Reputation: 47
Quote:
Originally Posted by deibertine View Post
Thanks for your response.
My server config is above the post.
Others config files and stats are down below.

Here's my openvpn server interfaces config:
## This is the network bridge declaration
auto lo br0 ## start on boot
iface lo inet loopback

iface br0 inet static
address 10.10.1.2
netmask 255.255.255.0
gateway 10.10.1.1
bridge_ports eth0

iface eth0 inet manual
up ifconfig $IFACE 0.0.0.0 up
up ip link set $IFACE promisc on
down ip link set $IFACE promisc off
down ifconfig $IFACE down

bridge_fd 9 ## from the libvirt docs (forward delay time)
bridge_hello 2 ## from the libvirt docs (hello time)
bridge_maxage 12 ## from the libvirt docs (maximum message age)
bridge_stp off ## from the libvirt docs (spanning tree protocol)

Here's my client config:
client
dev tap
remote vpnmain.csaa.com 1194
nobind
resolv-retry infinite
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
tls-auth ta.key 1
cipher BF-CBC
comp-lzo
verb 3
route 10.10.1.0 255.255.255.0 vpn_gateway
Here's my iptables:
Chain INPUT
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dptpenvpn
ACCEPT all -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp dptopenvpn
ACCEPT udp -- anywhere anywhere udp dptopenvpn
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp dpt
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain FORWARD
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain OUTPUT
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dptopenvpn
ACCEPT all -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp dptopenvpn
ACCEPT udp -- anywhere anywhere udp dptopenvpn
ACCEPT udp -- anywhere anywhere udp dptopenvpn
ACCEPT all -- anywhere anywhere

Here's my routing in openvpn server:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.10.1.0 0.0.0.0 255.255.255.0 U br0
0.0.0.0 10.10.1.1 0.0.0.0 UG br0

Please advise if you have other questions.
Any help much appreciated.
Cheers!
DB
What is the server config(especially what IP is given to the vpn client)?
What are the routes on a computer on the net you cannot reach. (did you tried pinging it?) Is the vpn server also the gateway for the whole network?
 
  


Reply

Tags
openvpn


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
OpenVPN routing (via one VPN to another) Robsco Linux - Networking 6 04-18-2009 03:16 AM
openvpn routing question watcher69b Linux - Server 3 01-18-2009 11:25 AM
routing using openvpn williebens Linux - Newbie 1 07-11-2008 09:28 PM
OpenVPN and Routing. Eightpock Linux - Networking 2 07-10-2008 06:48 AM
openVPN and routing issues mdkelly069 Linux - Networking 0 07-12-2004 12:19 PM


All times are GMT -5. The time now is 08:33 PM.

Main Menu
 
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: @linuxquestions
Open Source Consulting | Domain Registration