Openvpn – Routing not working with OpenVPN

ipv4openvpnrouting

I'm trying to setup an OpenVPN server on Debian 6.0.5 (installed via apt) but I'm stuck with routing problem.

This my network configuration:

Client   <-> Router+Firewall <-> OVPN Server  <-> Subnet A       AND Subnet B 
172.17.17.6                      197.174.211.77   197.174.211.0/27   197.174.211.64/27

I can connect to the server and get an IP but I can't access to servers on both subnets.
I made sure that the OpenVPN can ping, wget etc to servers in Subnet A and B.

Here is my server configuration:

port 1194
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
server 172.17.17.0 255.255.255.0
ifconfig-pool-persist ipp.txt
route 197.174.211.0 255.255.255.224
route 197.174.211.64 255.255.255.224
push "route 197.174.211.0  255.255.255.224"
push "route 197.174.211.64  255.255.255.224"
client-to-client

duplicate-cn

keepalive 10 120
comp-lzo
max-clients 20
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status-tcp.log
log-append /var/log/openvpn-tcp.log
verb 5

My server route table:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
172.17.17.2     *               255.255.255.255 UH    0      0        0 tun0
197.174.211.64  172.17.17.2     255.255.255.224 UG    0      0        0 tun0
197.174.211.64  *               255.255.255.224 U     0      0        0 eth0
172.17.17.0     172.17.17.2     255.255.255.0   UG    0      0        0 tun0
default         197.174.211.65  0.0.0.0         UG    0      0        0 eth0

When I do

cat /proc/sys/net/ipv4/ip_forward
1

So I guess ip_forward is activated…

I see that OpenVPN receives traffic from the tunnel but doesn't forward it…

**root@vpn:/etc/openvpn# tcpdump -i tun0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
15:24:42.913610 IP 172.17.17.6 > : ICMP echo request, id 1, seq 729,   length 40
15:24:47.743495 IP 172.17.17.6 > 197.174.211.11: ICMP echo request, id 1, seq 730, length 40

But I got no response in my client 🙁

I'm not using iptables or any firewall on my server…

Does anyone have an idea?

Best Answer

Client(172.17.17.6)<->Router+Firewall<->OVPN Srv(WAN:197.174.211.77)<->Subnet A 197.174.211.0/255.255.255.224 AND Subnet B 197.174.211.64/255.255.255.224

So your OpenVPN server locates in Subnet B. I assume your servers in Subnet A can route to Subnet B.

route 197.174.211.0 255.255.255.224         <---- You don't need this, remove it
route 197.174.211.64 255.255.255.224        <---- You don't need this, remove it
push "route 197.174.211.0  255.255.255.224"
push "route 197.174.211.64  255.255.255.224"

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
172.17.17.2     *               255.255.255.255 UH    0      0        0 tun0
197.174.211.64  172.17.17.2     255.255.255.224 UG    0      0        0 tun0  <-- Bad
197.174.211.64  *               255.255.255.224 U     0      0        0 eth0
172.17.17.0     172.17.17.2     255.255.255.0   UG    0      0        0 tun0
default         197.174.211.65  0.0.0.0         UG    0      0        0 eth0

Now 197.174.211.65 is your default router. You need to configure it for routing 172.17.17.0/24 to 197.174.211.77. You also need to configure router in Subnet A for this.

Another solution (with iptables installed):

iptables -t nat -A POSTROUTING -s 172.17.17.0/24 -o eth0 -j MASQUERADE
Related Topic