0

I'm trying to set a PC as a Router and somehow it's not working correctly. I have following setting:

CLIENT A
192.168.21.1/28
l
l
192.168.21.5/28
ROUTER X
192.168.21.25/28
l
l
192.168.21.17/28
CLIENT B (with openvpn tunnel to server)
10.29.0.4/22
l
l
10.29.0.1/22
SERVER

The connection from CLIENT B to SERVER is over internet, but it shouldn't matter here.

Now the issue is as following:

  • I can ping from ROUTER X the SERVER
  • I can ping from CLIENT A the address (CLIENT B) 10.29.0.4 (and with traceroute I can see, that it's going correctly)
  • I cannot ping from CLIENT A the SERVER

and the same in opposite direction:

  • I can ping from SERVER the address 192.168.21.25 (Router X)
  • I cannot ping the address 192.168.21.5

For me it seems like it has something to do with time to live (TTL), because the packets cannot reach 4th hop, but I didn't find anything about it in internet.

route -n on server

192.168.21.16   10.29.0.4       255.255.255.240 UG    17     0        0 tun0
192.168.21.0    10.29.0.4       255.255.255.240 UG    17     0        0 tun0
192.168.20.0    0.0.0.0         255.255.255.0   U     0      0        0 eth1
10.29.0.0       0.0.0.0         255.255.252.0   U     0      0        0 tun0
XXXXXXXX    0.0.0.0         255.255.0.0     U     1002   0        0 eth1
0.0.0.0         YYYYYYYY  0.0.0.0         UG    0      0        0 eth1

On Client B I added two iptables rules:

-A FORWARD -i eth0 -o tun0 -j ACCEPT
-A FORWARD -i tun0 -o eth0 -j ACCEPT

Do you have any idea, what's wrong? Thanks for any input.

1
  • You need to provide a lot more information inorder for us to help you. Please include your router x and client b configurations. – Ron Trunk Aug 13 '18 at 12:11
0

It sounds like you are missing a route for 192.168.21.0/28 in one (or both) of two places.

  1. If openvpn is running in "server" mode the internal routing table inside openpvn
  2. On clientB
0

The issue is, that OpenVPN in tun-mode manages remote networks internally with iroute parameter.

To resolve this problem, it's necessary to change to tap and add following iptables rules:

iptables -A FORWARD -i eth0 -o tap0 -j ACCEPT
iptables -A FORWARD -i tap0 -o eth0 -j ACCEPT

But then we will get tcp over tcp, what can lead to delays. I don't think there are other solutions for routing with OpenVPN.

The issue was mentioned on https://gitlab.labs.nic.cz/labs/bird/wikis/FAQ#dynamic-routing-issues-with-openvpn

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.