Openvpn – Network behind OpenVPN client

Good day, i have a problem with OpenVPN networking. Main idea is as illustrated, remote OpenVPN server, 2 clients, MyPC and OpenWRT client with its own network with Client_1 and Client_2. I need to be able to reach Client_1 from MyPC and vice versa. It looks like a routing or forwarding problem.


|-----------------------|           |-----------------------------------|
|Ubuntu 14.04           |           |OpenWRT router                     |
|OpenVPN Server         |  <----->  |Acts as OpenVPN client             |
|WAN 192.168.1.197      |           |LAN: 192.168.0.1, WAN:192.168.1.1  |
|OpenVPN IP: 172.20.2.1 |           |OpenVPN IP:172.20.1.100            |
|-----------------------|           |-----------------------------------|
            ^                               ^                   ^
            |                               |                   |
            |                               |                   |
            v                               v                   v
|-----------------------|           |-------------------| |------------------|
|MyPC, OpenVPN client   |   (1)     |Network client_1   | |Network client_2  |
|LAN: 192.168.1.205     | <-------> |LAN: 192.168.0.213 | |LAN: 192.168.1.101|
|OpenVPN IP:172.20.2.101|           |-------------------| |------------------|
|-----------------------|

The ping result

Ping MyPC -> OpenVPN server         OK
Ping MyPC -> OpenWRT                OK
Ping MyPC -> client_1               Reply from 192.168.1.205: Destination host unreachable.

Ping OpenVPN server -> MyPC         OK
Ping OpenVPN server -> OpenWRT      OK
Ping OpenVPN server -> client_1     From 192.168.1.197 icmp_seq=1 Destination Host Unreachable

Ping OpenWRT -> OpenVPN server      OK
Ping OpenWRT -> MyPC                OK
Ping OpenWRT -> client_1            OK

Ping client_1 -> OpenVPN server     From 192.168.0.1 icmp_seq=1 Destination Port Unreachable
Ping client_1 -> MyPC               From 192.168.0.1 icmp_seq=1 Destination Port Unreachable
Ping client_1 -> OpenWRT            OK

OpenVPN configurations, Server and clients

======OpenVPN configuration ===================================================================
port 1198
proto udp
dev tap2
ca keys/remote_management/ca.crt
cert keys/remote_management/remote_man.crt
key keys/remote_management/remote_man.key
dh keys/remote_management/dh4096.pem
server-bridge 172.20.2.1 255.255.255.0 172.20.2.100 172.20.2.253 #@@ br1 eth2
crl-verify keys/remote_management/crl.pem
ifconfig-pool-persist servers/remote_man/logs/ipp.txt
tls-auth servers/remote_man/ta.key 0
cipher AES-128-CBC
user nobody
group nogroup
status servers/remote_man/logs/openvpn-status.log
log-append servers/remote_man/logs/openvpn.log
verb 2
mute 20
max-clients 10
management 127.0.0.1 7507
keepalive 10 120
client-config-dir /etc/openvpn/servers/remote_man/ccd
tls-server
client-to-client
comp-lzo
persist-key
persist-tun
ccd-exclusive
push "route 172.20.2.0 255.255.255.0"
route 192.168.0.0 255.255.255.0

======OpenVPN client MyPC configuration ======================================================
client
proto udp
dev tap
ca ca.crt
dh dh4096.pem
cert ***.crt
key ***.key
remote *** 1198
tls-auth ta.key 1
cipher AES-128-CBC
verb 2
mute 20
keepalive 10 120
comp-lzo
persist-key
persist-tun
float
resolv-retry infinite
nobind

======OpenVPN client OpenWRT configuration ===================================================
client
proto udp
dev tap
ca /etc/openvpn/sol102/ca.crt
dh /etc/openvpn/sol102/dh4096.pem
cert /etc/openvpn/sol102/sol102.crt
key /etc/openvpn/sol102/sol102.key
remote *** 1198
tls-auth /etc/openvpn/sol102/ta.key 1
cipher AES-128-CBC
verb 2
mute 20
keepalive 10 120
comp-lzo
persist-key
persist-tun
float
resolv-retry infinite
nobind

OpenWRT configurations

======OpenWRT Network Configuration===========================================================
config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdf2:d4ae:ecd5::/48'

config interface 'lan'
        option ifname 'eth0.1'
        option force_link '1'
        option type 'bridge'
        option proto 'static'
        option netmask '255.255.255.0'
        option ip6assign '60'
        option ipaddr '192.168.0.1'

config interface 'wan'
        option ifname 'eth0.2'
        option proto 'dhcp'

config interface 'wan6'
        option ifname '@wan'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '1 2 3 4 5t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '0 5t'

config interface 'OVPN'
        option proto 'none'
        option delegate '0'
        option ifname 'tap0'

======OpenWRT Firewall Configuration===========================================================
config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option network 'wan wan6'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fe80::/10'
        option src_port '547'
        option dest_ip 'fe80::/10'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'

config zone
        option output 'ACCEPT'
        option name 'OVPN_FW'
        option masq '1'
        option input 'ACCEPT'
        option forward 'REJECT'
        option network 'OVPN'
        option mtu_fix '1'

config forwarding
        option dest 'OVPN_FW'
        option src 'lan'

config forwarding
        option dest 'wan'
        option src 'lan'

config forwarding
        option dest 'lan'
        option src 'OVPN_FW'

I have some tcpdump

======OpenVPN server tcpdump icmp filtered ====================================================  
12:46:11.654580 IP 172.20.2.101 > 192.168.0.213: ICMP echo request, id 1, seq 83, length 40
12:46:11.654580 IP 172.20.2.101 > 192.168.0.213: ICMP echo request, id 1, seq 83, length 40
12:46:14.652217 IP 172.20.2.1 > 172.20.2.101: ICMP host 192.168.0.213 unreachable, length 68
12:46:14.652244 IP 172.20.2.1 > 172.20.2.101: ICMP host 192.168.0.213 unreachable, length 68
12:46:14.657835 IP 172.20.2.101 > 192.168.0.213: ICMP echo request, id 1, seq 84, length 40
12:46:14.657835 IP 172.20.2.101 > 192.168.0.213: ICMP echo request, id 1, seq 84, length 40
12:46:17.656214 IP 172.20.2.1 > 172.20.2.101: ICMP host 192.168.0.213 unreachable, length 68
12:46:17.656241 IP 172.20.2.1 > 172.20.2.101: ICMP host 192.168.0.213 unreachable, length 68
12:46:17.661768 IP 172.20.2.101 > 192.168.0.213: ICMP echo request, id 1, seq 85, length 40
12:46:17.661768 IP 172.20.2.101 > 192.168.0.213: ICMP echo request, id 1, seq 85, length 40
12:46:20.660206 IP 172.20.2.1 > 172.20.2.101: ICMP host 192.168.0.213 unreachable, length 68
12:46:20.660233 IP 172.20.2.1 > 172.20.2.101: ICMP host 192.168.0.213 unreachable, length 68
12:46:20.665362 IP 172.20.2.101 > 192.168.0.213: ICMP echo request, id 1, seq 86, length 40
12:46:20.665362 IP 172.20.2.101 > 192.168.0.213: ICMP echo request, id 1, seq 86, length 40
12:46:23.666797 IP 172.20.2.1 > 172.20.2.101: ICMP host 192.168.0.213 unreachable, length 68
12:46:23.666824 IP 172.20.2.1 > 172.20.2.101: ICMP host 192.168.0.213 unreachable, length 68


======OpenWRT client tcpdump icmp filtered ==================================================== 
12:44:17.299404 IP 172.20.2.1 > 172.20.2.100: ICMP redirect 172.20.2.101 to host 172.20.2.101, length 48
12:44:18.461809 IP 172.20.2.1 > 172.20.2.100: ICMP redirect 172.20.2.101 to host 172.20.2.101, length 196
12:44:19.464258 IP 172.20.2.1 > 172.20.2.100: ICMP redirect 172.20.2.101 to host 172.20.2.101, length 196
12:44:20.466652 IP 172.20.2.1 > 172.20.2.100: ICMP redirect 172.20.2.101 to host 172.20.2.101, length 196
12:44:20.944332 IP 172.20.2.1 > 172.20.2.100: ICMP redirect 172.20.2.101 to host 172.20.2.101, length 48
12:44:32.311732 IP 172.20.2.1 > 172.20.2.100: ICMP redirect 172.20.2.101 to host 172.20.2.101, length 308

Edit: Can't put that much code, so ~~http://pastebin.com/ThgqBUgM~~ (Link is no longer valid)

Best Answer

Your problem is probably routing, Ubuntu server has to know where to find 192.168.0.0/24 - route add -net 192.168.0.0/24 gw 172.20.1.100, without that this route matches at default gateway and packets are routed using wrong interface. Every device that forwards packets (OpenWRT and Ubuntu) has to know about 3 networks: 192.168.0.0/24, 192.168.1.0/24 and 172.20.1.0/24.

Best Answer

Related Solutions

Iptables – Route traffic to some host in Internet via VPN server

Openvpn – How to route traffic from private network to openvpn subnet (and back)

Related Topic