O OpenVPN Server não responde ao ping do cliente

Question

Um cliente OpenVPN parece inicializar em uma máquina virtual cliente do CentOS 7. No entanto, a resposta do servidor não está clara quando o cliente envia um ping.

Especificamente,

ping 10.8.0.0 do cliente NÃO obtém nenhuma resposta do servidor.
ping 10.8.0.1 do cliente faz obter uma resposta, mas é do server?
ping 10.0.2.2 do cliente faz obter uma resposta, mas é do servidor?

Como interpreto essas respostas ping ? O servidor está respondendo às solicitações ping ? E, em caso negativo, que alterações específicas precisam ser feitas ao abaixo para que o servidor responda a um ping do cliente?

A CONFIGURAÇÃO ATUAL: No servidor , server.conf é:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  
dh dh2048.pem
server 10.8.0.0 255.255.255.0
route 10.8.1.0 255.255.255.0 
route 10.8.2.0 255.255.255.0 
client-config-dir ccd 
client-to-client 
ifconfig-pool-persist ipp.txt
keepalive 10 120
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3

Além disso, no servidor, os dois arquivos no diretório /etc/openvpn/ccd referenciados no server.conf acima são:

/etc/openvpn/ccd/administrators , que contém apenas a seguinte linha:

ifconfig-push 10.8.1.1 10.8.1.2

E /etc/openvpn/ccd/otherorgs , que contém apenas a seguinte linha:

ifconfig-push 10.8.2.1 10.8.2.2

O firewalld config para o servidor é:

[root@hostname easy-rsa]# firewall-cmd --get-default-zone
public
[root@hostname easy-rsa]# firewall-cmd --get-active-zones
internal
  interfaces: tun0
public
  interfaces: enp3s0
[root@hostname easy-rsa]# firewall-cmd --list-all
public (default, active)
  interfaces: enp3s0
  sources: 
  services: dhcpv6-client http imaps openvpn smtp ssh
  ports: 
  masquerade: yes
  forward-ports: 
  icmp-blocks: 
  rich rules: 
[root@hostname easy-rsa]# firewall-cmd --zone=internal --list-all
internal (active)
  interfaces: tun0
  sources: 
  services: dhcpv6-client ipp-client mdns samba-client ssh
  ports: 
  masquerade: no
  forward-ports: 
  icmp-blocks: 
  rich rules: 
    rule family="ipv4" source address="10.8.1.0/24" service name="https_others" accept
    rule family="ipv4" source address="10.8.1.0/24" service name="https" accept
    rule family="ipv4" source address="10.8.0.0/24" service name="https" accept
    rule family="ipv4" source NOT address="10.8.1.1" service name="ssh" reject
    rule family="ipv4" source address="10.8.2.0/24" service name="https_others" accept
[root@hostname easy-rsa]# 

No cliente , client.ovpn é:

client
dev tun
proto udp
remote ip.addr.of.server 1194
resolv-retry infinite
nobind
persist-key
persist-tun
verb 3
ca /etc/openvpn/ca.crt
cert /etc/openvpn/centos_vm1_client.crt
key /etc/openvpn/centos_vm1_client.key

O cliente parece iniciar, porque o terminal do cliente fornece os seguintes logs:

[user@localhost openvpn]$ sudo openvpn --config ~/openvpn_config/client.ovpn
[sudo] password for user: 
Wed Jun 15 16:52:23 2016 OpenVPN 2.3.11 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on May 10 2016
Wed Jun 15 16:52:23 2016 library versions: OpenSSL 1.0.1e-fips 11 Feb 2013, LZO 2.06
Wed Jun 15 16:52:23 2016 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Jun 15 16:52:23 2016 Socket Buffers: R=[212992->212992] S=[212992->212992]
Wed Jun 15 16:52:23 2016 UDPv4 link local: [undef]
Wed Jun 15 16:52:23 2016 UDPv4 link remote: [AF_INET]ip.addr.of.server:1194
Wed Jun 15 16:52:23 2016 TLS: Initial packet from [AF_INET]ip.addr.of.server:1194, sid=40ea5916 7f5543b1
Wed Jun 15 16:52:23 2016 VERIFY OK: depth=1, C=UK, ST=RW, L=SomeCity, O=OrganizationName, OU=MyOrganizationalUnit, CN=somedomain.com, name=server, [email protected]
Wed Jun 15 16:52:23 2016 VERIFY OK: depth=0, C=UK, ST=RW, L=SomeCity, O=OrganizationName, OU=MyOrganizationalUnit, CN=server, name=server, [email protected]
Wed Jun 15 16:52:24 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Jun 15 16:52:24 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jun 15 16:52:24 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Jun 15 16:52:24 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jun 15 16:52:24 2016 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Jun 15 16:52:24 2016 [server] Peer Connection Initiated with [AF_INET]ip.addr.of.server:1194
Wed Jun 15 16:52:26 2016 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Jun 15 16:52:27 2016 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.18 10.8.0.17'
Wed Jun 15 16:52:27 2016 OPTIONS IMPORT: timers and/or timeouts modified
Wed Jun 15 16:52:27 2016 OPTIONS IMPORT: --ifconfig/up options modified
Wed Jun 15 16:52:27 2016 OPTIONS IMPORT: route options modified
Wed Jun 15 16:52:27 2016 ROUTE_GATEWAY 10.0.2.2/255.255.255.0 IFACE=enp0s3 HWADDR=08:00:27:d5:85:a9
Wed Jun 15 16:52:27 2016 TUN/TAP device tun0 opened
Wed Jun 15 16:52:27 2016 TUN/TAP TX queue length set to 100
Wed Jun 15 16:52:27 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Jun 15 16:52:27 2016 /usr/sbin/ip link set dev tun0 up mtu 1500
Wed Jun 15 16:52:27 2016 /usr/sbin/ip addr add dev tun0 local 10.8.0.18 peer 10.8.0.17
Wed Jun 15 16:52:27 2016 /usr/sbin/ip route add 10.8.0.1/32 via 10.8.0.17
Wed Jun 15 16:52:27 2016 Initialization Sequence Completed

RESULTADOS DO PING: Abrir um novo terminal no cliente e pingar para o endereço do servidor fornecido em server.conf acima não fornece resposta

[user@localhost ~]$ ping 10.8.0.0
PING 10.8.0.0 (10.8.0.0) 56(84) bytes of data.  

No entanto, ping para dois dois endereços IP fornecidos nos logs de inicialização do OpenVPN acima gerou respostas:

[user@localhost ~]$ ping 10.8.0.1
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=91.1 ms
64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=93.1 ms
...
^C
--- 10.8.0.1 ping statistics ---
14 packets transmitted, 14 received, 0% packet loss, time 13013ms
rtt min/avg/max/mdev = 89.449/93.387/101.522/2.731 ms
[user@localhost ~]$ ping 10.0.2.2
PING 10.0.2.2 (10.0.2.2) 56(84) bytes of data.
64 bytes from 10.0.2.2: icmp_seq=1 ttl=63 time=0.245 ms
64 bytes from 10.0.2.2: icmp_seq=2 ttl=63 time=0.429 ms
...
^C
--- 10.0.2.2 ping statistics ---
9 packets transmitted, 9 received, 0% packet loss, time 8009ms
rtt min/avg/max/mdev = 0.170/0.410/0.558/0.117 ms
[user@localhost ~]$ 

    

Answer 1

Da página de manual do OpenVPN:

   --server network netmask ['nopool']
          A helper directive designed to  simplify  the  configuration  of
          OpenVPN's  server  mode.   This directive will set up an OpenVPN
          server which will allocate addresses to clients out of the given
          network/netmask.   The  server itself will take the ".1" address
          of the given network for use as the server-side endpoint of  the
          local TUN/TAP interface.

E de openvpn.conf (pelo menos um dos meus CentOS7):

# Configure server mode and supply a VPN subnet
# for OpenVPN to draw client addresses from.
# The server will take 10.8.0.1 for itself,
# the rest will be made available to clients.
# Each client will be able to reach the server
# on 10.8.0.1. Comment this line out if you are
# ethernet bridging. See the man page for more info.
server 10.8.0.0 255.255.255.0

Como você pode ver, você não deve conseguir ping 10.8.0.0 , pois é um endereço de rede - o servidor recebe o primeiro endereço. No seu caso, isso é 10.8.0.1.

Como você descobriu, você pode ping 10.8.0.1 , que leva 90ms. O atraso é porque é o fim remoto da VPN (do seu cliente).

Você também pode ping 10.0.2.2 , o que leva apenas 0,2 ms, então este é o fim local.

Então, a linha de fundo é - tudo está bem.