Estou tentando configurar um site do OpenVPN para site entre o site A (Server-Merlin) e o site B (Client DD-WRT). O túnel aparece e ambos os peers são capazes de pingar uns aos outros, mas quando alguém na sub-rede do cliente (10.1.30.0/24) tenta fazer ping em qualquer host no lado do servidor (10.1.10.0/24), os pacotes estão sendo descartados pelo servidor já que o servidor não sabe como chegar à sub-rede do cliente, mesmo depois de adicionar a rota. Aqui estão as configurações:
Servidor
Automatically generated configuration
daemon
server 172.16.254.0 255.255.255.248
proto udp
port 1198
dev tun21
cipher AES-256-CBC
comp-lzo adaptive
keepalive 15 60
verb 3
push "route 10.1.10.0 255.255.255.0"
client-config-dir ccd
client-to-client
duplicate-cn
ca ca.crt
dh dh.pem
cert server.crt
key server.key
status-version 2
status status
Custom Configuration
ifconfig 172.16.254.1 255.255.255.248M
management 127.0.0.1 5001M
auth none
Firewall - servidor
iptables -I INPUT 2 -p udp --dport 1198 -j ACCEPT
iptables -I FORWARD -i br0 -o tun21 -j ACCEPT
iptables -I FORWARD -i tun21 -o br0 -j ACCEPT
Servidor da tabela de roteamento:
172.16.254.2 dev tun21 proto kernel scope link src 172.16.254.1
x.x.x.x dev eth0 scope link
172.16.254.0/29 via 172.16.254.2 dev tun21
x.x.x.x/28 dev eth0 proto kernel scope link src x.x.x.x
10.1.10.0/24 dev br0 proto kernel scope link src 10.1.10.254
127.0.0.0/8 dev lo scope link
default via x.x.x.x dev eth0
Configuração do cliente:
ca /tmp/openvpncl/ca.crt
cert /tmp/openvpncl/client.crt
key /tmp/openvpncl/client.key
management 127.0.0.1 5001
management-log-cache 50
verb 4
mute 3
log-append /var/log/openvpncl
writepid /var/run/openvpncl.pid
client
resolv-retry infinite
nobind
persist-key
persist-tun
script-security 2
mtu-disc yes
dev tun1
proto udp
cipher aes-256-cbc
auth none
remote x.x.x.x 1198
comp-lzo adaptive
tun-mtu 1500
fast-io
Firewall do cliente
iptables -I INPUT 2 -p udp --dport 1198 -j ACCEPT
iptables -I FORWARD -i br0 -o tun1 -j ACCEPT
iptables -I FORWARD -i tun1 -o br0 -j ACCEPT
Tabela de roteamento do cliente:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.2.253 0.0.0.0 UG 0 0 0 eth1
10.1.10.0 172.16.254.5 255.255.255.0 UG 0 0 0 tun1
10.1.30.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br0
172.16.254.0 172.16.254.5 255.255.255.248 UG 0 0 0 tun1
172.16.254.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun1
192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
239.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 br0
O que é estranho é que no lado do cliente o dispositivo tun tem um IP de 172.16.254.6 enquanto o gateway é 172.16.254.5 e no lado do servidor o IP é 172.16.254.1 e o tun IP é 172.16.254.2. No lado do servidor eu não posso ping 172.16.254.2 mas eu posso pingar o tun IP do cliente (172.16.254.6) e vice-versa no lado do cliente eu não posso ping 172.16.254.5 que é o gateway, mas eu posso ping 172.16.254.1.
Interfaces de servidor
ip addr
1: lo: mtu 16436 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
2: eth0: mtu 1500 qdisc pfifo_fast qlen 1000
link/ether d8:50:e6:cb:f5:f0 brd ff:ff:ff:ff:ff:ff
inet x.x.x.x/28 brd x.x.x.x scope global eth0
3: eth1: mtu 1500 qdisc pfifo_fast qlen 1000
link/ether d8:50:e6:cb:f5:f0 brd ff:ff:ff:ff:ff:ff
4: eth2: mtu 1500 qdisc pfifo_fast qlen 1000
link/ether d8:50:e6:cb:f5:f4 brd ff:ff:ff:ff:ff:ff
5: vlan1@eth0: mtu 1500 qdisc noqueue
link/ether d8:50:e6:cb:f5:f0 brd ff:ff:ff:ff:ff:ff
6: vlan2@eth0: mtu 1500 qdisc noop
link/ether d8:50:e6:cb:f5:f0 brd ff:ff:ff:ff:ff:ff
7: br0: mtu 1500 qdisc noqueue
link/ether d8:50:e6:cb:f5:f0 brd ff:ff:ff:ff:ff:ff
inet 10.1.10.254/24 brd 10.1.10.255 scope global br0
8: tun21: mtu 1500 qdisc
pfifo_fast qlen 100
link/[65534]
inet 172.16.254.1 peer 172.16.254.2/32 scope global tun21
Interfaces do cliente:
ath0 Link encap:Ethernet HWaddr B0:C7:45:75:1C:F6
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:2528056 errors:0 dropped:0 overruns:0 frame:0 TX packets:3317121 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:32 RX bytes:177453174 (169.2 MiB) TX bytes:539912763 (514.9 MiB)ath1 Link encap:Ethernet HWaddr B0:C7:45:75:1C:F7
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:12502 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:32 RX bytes:0 (0.0 B) TX bytes:1688459 (1.6 MiB)br0 Link encap:Ethernet HWaddr B0:C7:45:75:1C:F6
inet addr:10.1.30.251 Bcast:10.1.30.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:3715741 errors:0 dropped:3772 overruns:0 frame:0 TX packets:5006361 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:415672171 (396.4 MiB) TX bytes:6820174338 (6.3 GiB)br0:0 Link encap:Ethernet HWaddr B0:C7:45:75:1C:F6
inet addr:169.254.255.1 Bcast:169.254.255.255 Mask:255.255.0.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1eth0 Link encap:Ethernet HWaddr B0:C7:45:75:1C:F6 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:610099 errors:0 dropped:4 overruns:18 frame:0 TX packets:931175 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:263258272 (251.0 MiB) TX bytes:833541212 (794.9 MiB) Interrupt:4eth1 Link encap:Ethernet HWaddr B0:C7:45:75:1C:F6
inet addr:192.168.2.254 Bcast:192.168.2.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1492 Metric:1 RX packets:5071499 errors:0 dropped:787 overruns:0 frame:0 TX packets:3681042 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:2519572372 (2.3 GiB) TX bytes:462892303 (441.4 MiB) Interrupt:5lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MULTICAST MTU:16436 Metric:1 RX packets:421 errors:0 dropped:0 overruns:0 frame:0 TX packets:421 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:37100 (36.2 KiB) TX bytes:37100 (36.2 KiB)mon.ath0 Link encap:UNSPEC HWaddr B0-C7-45-75-1C-F6-00-00-00-00-00-00-00-00-00-00 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:462186 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:32 RX bytes:105722162 (100.8 MiB) TX bytes:0 (0.0 B)mon.ath1 Link encap:UNSPEC HWaddr B0-C7-45-75-1C-F7-00-00-00-00-00-00-00-00-00-00
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:3114 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:32 RX bytes:377428 (368.5 KiB) TX bytes:0 (0.0 B)tun1 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:172.16.254.6 P-t-P:172.16.254.5 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:268 errors:0 dropped:0 overruns:0 frame:0 TX packets:14279 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:22488 (21.9 KiB) TX bytes:775355 (757.1 KiB)
Ping IP do servidor:
ping 172.16.254.2
PING 172.16.254.2 (172.16.254.2): 56 data bytes
--- 172.16.254.2 ping statistics ---
4 packets transmitted, 0 packets received, 100% packet loss
O endereço IP do cliente do ping tun0 no servidor:
ping 172.16.254.6
PING 172.16.254.6 (172.16.254.6): 56 data bytes
64 bytes from 172.16.254.6: seq=0 ttl=64 time=30.222 ms
64 bytes from 172.16.254.6: seq=1 ttl=64 time=29.536 ms
64 bytes from 172.16.254.6: seq=2 ttl=64 time=30.918 ms
64 bytes from 172.16.254.6: seq=3 ttl=64 time=30.386 ms
64 bytes from 172.16.254.6: seq=4 ttl=64 time=30.788 ms
64 bytes from 172.16.254.6: seq=5 ttl=64 time=31.271 ms
--- 172.16.254.6 ping statistics ---
6 packets transmitted, 6 packets received, 0% packet loss
round-trip min/avg/max = 29.536/30.520/31.271 ms
Ping IP do cliente:
ping 172.16.254.5
PING 172.16.254.5 (172.16.254.5): 56 data bytes
^C --- 172.16.254.5 ping statistics ---
7 packets transmitted, 0 packets received, 100% packet loss
O IP do ping tun21 no servidor do cliente
ping 172.16.254.1
PING 172.16.254.1 (172.16.254.1): 56 data bytes
64 bytes from 172.16.254.1: seq=0 ttl=64 time=29.253 ms
64 bytes from 172.16.254.1: seq=1 ttl=64 time=31.730 ms
64 bytes from 172.16.254.1: seq=2 ttl=64 time=30.010 ms
^C
--- 172.16.254.1 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 29.253/30.331/31.730 ms
Eu tentei adicionar uma rota para 10.1.30.0 (Client LAN) no servidor usando o ip 172.16.254.6, mas ele só me permitirá mapeá-lo para 172.16.254.2
ip route add 10.1.30.0/24 via 172.16.254.6 dev tun21
RTNETLINK answers: No such process
ip route add 10.1.30.0/24 via 172.16.254.2 dev tun21
Fazendo ping de um host na LAN do cliente do servidor - sem dados
PING 10.1.30.100 (10.1.30.100): 56 data bytes
--- 10.1.30.100 ping statistics ---
3 packets transmitted, 0 packets received, 100% packet loss
Faça um ping em um host na LAN do servidor do cliente - sem dados
ping 10.1.10.100
PING 10.1.10.100 (10.1.10.100): 56 data bytes
^C
--- 10.1.10.100 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss
Registros do lado do servidor:
LOG:1432700723,D,Client/x.x.x.x:44820 UDPv4 READ [81] from [AF_INET]x.x.x.x:44820: P_DATA_V1 kid=0 DATA len=80
LOG:1432700723,,Client/x.x.x.x:44820 MULTI: bad source address from client [10.1.30.100], packet dropped
LOG:1432700723,D,Client/x.x.x.x:44820 UDPv4 READ [81] from [AF_INET]x.x.x.x:44820: P_DATA_V1 kid=0 DATA len=80
LOG:1432700723,,Client/x.x.x.x:44820 MULTI: bad source address from client [10.1.30.106], packet dropped
LOG:1432700724,D,Client/x.x.x.x:44820 UDPv4 READ [81] from [AF_INET]x.x.x.x:44820: P_DATA_V1 kid=0 DATA len=80
LOG:1432700724,,Client/x.x.x.x:44820 MULTI: bad source address from client [10.1.30.110], packet dropped
2700729,,Client/x.x.x.x:44820 MULTI: bad source address from client [10.1.30.100], packet dropped
Registros do lado do cliente:
LOG:1432686050,D,UDPv4 WRITE [81] to x.x.x.x:1198: P_DATA_V1 kid=0 DATA len=80
LOG:1432686050,D,UDPv4 WRITE [81] to x.x.x.x:1198: P_DATA_V1 kid=0 DATA len=80
LOG:1432686051,D,UDPv4 WRITE [81] to x.x.x.x:1198: P_DATA_V1 kid=0 DATA len=80
Eu até executei um tcpdump em ambos os roteadores e os pacotes da LAN no lado do servidor não estão nem chegando ao roteador do cliente.
Qualquer ajuda seria apreciada.
Obrigado
Eu resolvi isso adicionando as seguintes linhas na minha configuração
route 10.1.30.0 255.255.255.0
push "route 10.1.10.0 255.255.255.0"
push "route 10.1.30.0 255.255.255.0"
e adicionei as seguintes linhas para o meu cliente na pasta CCD
less /tmp/etc/openvpn/server1/ccd/CALPHA
iroute 10.1.30.0 255.255.255.0
Tags openvpn site-to-site-vpn