Estamos tentando configurar um túnel OpenVPN que permita que dispositivos em nossa LAN se comuniquem com servidores em um Amazon VPC. Estamos usando a instância do servidor de acesso OpenVPN turnkey na Amazon e seguimos a documentação para configurar nosso servidor local como um Gateway.
Imagem da configuração: link
O servidor da Amazon é capaz de se comunicar com o Roteador A em nossa LAN sem problemas (ping, ssh), no entanto, quando tentamos fazer ping do Roteador A para o IP privado do servidor, ele não consegue passar. Usando o tcpdump, vemos a solicitação de eco na interface eth0 do Gateway A, mas não vemos nada na interface tun1. Parece que não está sendo encaminhado corretamente para a interface tun0. Usando a configuração do OpenVPN, fizemos com que os clientes pudessem atuar como um Gateway.
Onde estamos errados? Mais detalhes abaixo.
Gateway do lado esquerdo
netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 10.23.0.1 0.0.0.0 UG 0 0 0 wlan0
10.0.0.2 10.0.2.1 255.255.255.255 UGH 0 0 0 tun1
10.0.1.0 10.0.2.1 255.255.255.0 UG 0 0 0 tun1
10.0.2.0 0.0.0.0 255.255.255.0 U 0 0 0 tun1
10.23.0.0 0.0.0.0 255.255.240.0 U 0 0 0 wlan0
54.208.149.66 10.23.0.1 255.255.255.255 UGH 0 0 0 wlan0
172.16.0.0 172.16.0.1 255.255.0.0 UG 0 0 0 tap0
192.168.0.0 192.168.10.100 255.255.0.0 UG 0 0 0 eth0
sudo iptables --list
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
rota ip
default via 10.23.0.1 dev wlan0 proto static
10.0.0.2 via 10.0.2.1 dev tun1 metric 101
10.0.1.0/24 via 10.0.2.1 dev tun1 metric 101
10.0.2.0/24 dev tun1 proto kernel scope link src 10.0.2.12
10.23.0.0/20 dev wlan0 proto kernel scope link src 10.23.3.197 metric 9
54.208.149.66 via 10.23.0.1 dev wlan0
172.16.0.0/16 via 172.16.0.1 dev tap0
192.168.0.0/16 via 192.168.10.100 dev eth0
OpenVPN Config
setenv FORWARD_COMPATIBLE 1
client
proto tcp
remote vpn.xxx.com
port 3389
dev tun
dev-type tun
ns-cert-type server
reneg-sec 604800
sndbuf 100000
rcvbuf 100000
# NOTE: LZO commands are pushed by the Access Server at connect time.
# NOTE: The below line doesn't disable LZO.
comp-lzo no
verb 3
setenv PUSH_PEER_INFO
regra ip
0: from all lookup local
220: from all lookup 220
32766: from all lookup main
32767: from all lookup default
ifconfig
eth0 Link encap:Ethernet HWaddr 44:8a:5b:57:a7:68
inet addr:192.168.10.100 Bcast:192.168.10.255 Mask:255.255.255.0
inet6 addr: fe80::468a:5bff:fe57:a768/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:96265 errors:0 dropped:103 overruns:0 frame:0
TX packets:42772 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:15112811 (15.1 MB) TX bytes:6396552 (6.3 MB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:1420458 errors:0 dropped:0 overruns:0 frame:0
TX packets:1420458 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:339956597 (339.9 MB) TX bytes:339956597 (339.9 MB)
tap0 Link encap:Ethernet HWaddr a6:0a:3c:76:bd:33
inet addr:172.16.0.1 Bcast:172.16.0.255 Mask:255.255.255.0
inet6 addr: fe80::a40a:3cff:fe76:bd33/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:138694 errors:0 dropped:1155 overruns:0 frame:0
TX packets:118026 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:49993976 (49.9 MB) TX bytes:25231042 (25.2 MB)
tun1 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.0.2.11 P-t-P:10.0.2.11 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:9 errors:0 dropped:0 overruns:0 frame:0
TX packets:9 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:1260 (1.2 KB) TX bytes:1372 (1.3 KB)
wlan0 Link encap:Ethernet HWaddr 40:f0:2f:8f:51:5c
inet addr:10.23.3.197 Bcast:10.23.15.255 Mask:255.255.240.0
inet6 addr: fe80::42f0:2fff:fe8f:515c/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2205804 errors:0 dropped:0 overruns:0 frame:0
TX packets:1773520 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1823901987 (1.8 GB) TX bytes:273830921 (273.8 MB)
Gateway do lado direito
OpenVPN Access Server Version: 2.0.8
Accepting VPN client connections on IP address: all interfaces
Port for VPN client connections: tcp/3389
OSI Layer: 3 (routing/NAT)
Clients access private subnets using: Routing
openvpnas @ openvpnas2: /var/log $ netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 10.0.1.1 0.0.0.0 UG 0 0 0 eth0
10.0.1.0 10.0.1.128 255.255.255.0 UG 0 0 0 eth0
10.0.2.0 0.0.0.0 255.255.255.0 U 0 0 0 as0t0
172.16.0.0 0.0.0.0 255.255.0.0 U 0 0 0 as0t0
192.168.0.0 0.0.0.0 255.255.0.0 U 0 0 0 as0t0