[LARTC] OpenVPN routing

[LARTC] OpenVPN routing

[Daniel L. Miller]

Hi!

I'm trying to create a routed VPN using OpenVPN - and having trouble 
with the routing concepts involved.  Let me see if I can properly 
describe my current topology:

Server -
LAN, with both local workstations and remote bridged workstations on the
    192.168.0.0/24 network (this works without reservation).
    Server located at 192.168.0.71, 192.168.0.72, 192.168.0.222, and few 
others.
Routed VPN, 172.27.0.0/16 network.  Server is located at 172.27.0.1.
    Server can talk to clients, and clients can talk to server.

My 1st goal is to allow selected server-side LAN workstations to reach 
the routed VPN workstations.  The LAN should be invisible to the routed VPN.

My 2nd goal is to allow selected server-side LAN workstations to reach 
networks server by routed VPN workstations as gateways [this involves 
OpenVPN more, I believe].  The LAN should still be invisible to the 
routed VPN.

My server routing table is:
172.27.0.2 dev tun0  proto kernel  scope link  src 172.27.0.1
192.168.20.0/24 dev vmnet8  proto kernel  scope link  src 192.168.20.1
10.4.1.0/24 via 172.27.0.2 dev tun0
192.168.0.0/24 dev eth0  proto kernel  scope link  src 192.168.0.71
192.168.0.0/24 dev br1  proto kernel  scope link  src 192.168.0.72
192.168.30.0/24 dev vmnet1  proto kernel  scope link  src 192.168.30.1
172.27.0.0/16 via 172.27.0.2 dev tun0
default via 192.168.0.1 dev eth0

IP forwarding is enabled on all interfaces, and iptables (by way of 
firehol) has rules to allow all forwarding between all interfaces.

If I create a 172.27.0.0/16 route on a LAN workstation, I can ping the 
server at 172.27.0.1.  But I cannot reach any VPN workstation.  At one 
time, by playing with some NAT rules, I was able to - but it didn't seem 
right.

What am I missing?

Daniel
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] OpenVPN routing

[Alex Samad]

[-- Attachment #1.1: Type: text/plain, Size: 2963 bytes --]

On Sun, Sep 09, 2007 at 11:36:18PM -0700, Daniel L. Miller wrote:
> Hi!
>
> I'm trying to create a routed VPN using OpenVPN - and having trouble with 
> the routing concepts involved.  Let me see if I can properly describe my 
> current topology:
>
> Server -
> LAN, with both local workstations and remote bridged workstations on the
>    192.168.0.0/24 network (this works without reservation).
>    Server located at 192.168.0.71, 192.168.0.72, 192.168.0.222, and few 
> others.
> Routed VPN, 172.27.0.0/16 network.  Server is located at 172.27.0.1.
>    Server can talk to clients, and clients can talk to server.
>
> My 1st goal is to allow selected server-side LAN workstations to reach the 
> routed VPN workstations.  The LAN should be invisible to the routed VPN.
>
> My 2nd goal is to allow selected server-side LAN workstations to reach 
> networks server by routed VPN workstations as gateways [this involves 
> OpenVPN more, I believe].  The LAN should still be invisible to the routed 
> VPN.
>
> My server routing table is:
> 172.27.0.2 dev tun0  proto kernel  scope link  src 172.27.0.1
> 192.168.20.0/24 dev vmnet8  proto kernel  scope link  src 192.168.20.1
> 10.4.1.0/24 via 172.27.0.2 dev tun0
> 192.168.0.0/24 dev eth0  proto kernel  scope link  src 192.168.0.71
> 192.168.0.0/24 dev br1  proto kernel  scope link  src 192.168.0.72
> 192.168.30.0/24 dev vmnet1  proto kernel  scope link  src 192.168.30.1
> 172.27.0.0/16 via 172.27.0.2 dev tun0
> default via 192.168.0.1 dev eth0

I think you need to use a tap device (I currently have a similar setup, but I 
do not hide the LAN - infact I use openvpn to do site to site WAN)

By hide the LAN you don't want to the openvpn clients to see the 192.168 
addresses if that is the case this is more a iptables question you will need to 
nat the lan network going out, if you want in bound traffic you will need to 
setup natting on the way back in as well - static though.

why do you want to hide the network - ?

unless your server is the default gateway for the network you will have to do 1 
of 2 things, either setup routing on each client or update the default gateway 
how to route the packet (ie via the server). 

Why do the client (openvpn client) not respond to pings, I would guess again 
routing usual problem, can you run tcpdump on these machines ?

>
> IP forwarding is enabled on all interfaces, and iptables (by way of 
> firehol) has rules to allow all forwarding between all interfaces.
>
> If I create a 172.27.0.0/16 route on a LAN workstation, I can ping the 
> server at 172.27.0.1.  But I cannot reach any VPN workstation.  At one 
> time, by playing with some NAT rules, I was able to - but it didn't seem 
> right.
>
> What am I missing?
>
> Daniel
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>

[-- Attachment #1.2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

[-- Attachment #2: Type: text/plain, Size: 143 bytes --]

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] OpenVPN routing

[Daniel L. Miller]

Alex Samad wrote:
> On Sun, Sep 09, 2007 at 11:36:18PM -0700, Daniel L. Miller wrote:
>   
>> Hi!
>>
>> I'm trying to create a routed VPN using OpenVPN - and having trouble with 
>> the routing concepts involved.  Let me see if I can properly describe my 
>> current topology:
>>
>> Server -
>> LAN, with both local workstations and remote bridged workstations on the
>>    192.168.0.0/24 network (this works without reservation).
>>    Server located at 192.168.0.71, 192.168.0.72, 192.168.0.222, and few 
>> others.
>> Routed VPN, 172.27.0.0/16 network.  Server is located at 172.27.0.1.
>>    Server can talk to clients, and clients can talk to server.
>>
>> My 1st goal is to allow selected server-side LAN workstations to reach the 
>> routed VPN workstations.  The LAN should be invisible to the routed VPN.
>>
>> My 2nd goal is to allow selected server-side LAN workstations to reach 
>> networks server by routed VPN workstations as gateways [this involves 
>> OpenVPN more, I believe].  The LAN should still be invisible to the routed 
>> VPN.
>>
>> My server routing table is:
>> 172.27.0.2 dev tun0  proto kernel  scope link  src 172.27.0.1
>> 192.168.20.0/24 dev vmnet8  proto kernel  scope link  src 192.168.20.1
>> 10.4.1.0/24 via 172.27.0.2 dev tun0
>> 192.168.0.0/24 dev eth0  proto kernel  scope link  src 192.168.0.71
>> 192.168.0.0/24 dev br1  proto kernel  scope link  src 192.168.0.72
>> 192.168.30.0/24 dev vmnet1  proto kernel  scope link  src 192.168.30.1
>> 172.27.0.0/16 via 172.27.0.2 dev tun0
>> default via 192.168.0.1 dev eth0
>>     
>
> I think you need to use a tap device (I currently have a similar setup, but I 
> do not hide the LAN - infact I use openvpn to do site to site WAN)
>
> By hide the LAN you don't want to the openvpn clients to see the 192.168 
> addresses if that is the case this is more a iptables question you will need to 
> nat the lan network going out, if you want in bound traffic you will need to 
> setup natting on the way back in as well - static though.
>   
So do I need a source NAT directing all traffic intended for 
172.27.0.0/16 from 192.168.0.0/24 to come from 172.27.0.1?
> why do you want to hide the network - ?
>   
The VPN is to provide me a secure static connection to customer's 
sites.  However, those customers should be able to see neither each 
other, nor reach our internal LAN - unless the connection is initiated 
from our side.
-- 
Daniel
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] OpenVPN routing

[Alex Samad]

[-- Attachment #1.1: Type: text/plain, Size: 3976 bytes --]

On Mon, Sep 10, 2007 at 01:40:29PM -0700, Daniel L. Miller wrote:
> Alex Samad wrote:
>> On Sun, Sep 09, 2007 at 11:36:18PM -0700, Daniel L. Miller wrote:
>>   
>>> Hi!
>>>
>>> I'm trying to create a routed VPN using OpenVPN - and having trouble with 
>>> the routing concepts involved.  Let me see if I can properly describe my 
>>> current topology:
>>>
>>> Server -
>>> LAN, with both local workstations and remote bridged workstations on the
>>>    192.168.0.0/24 network (this works without reservation).
>>>    Server located at 192.168.0.71, 192.168.0.72, 192.168.0.222, and few 
>>> others.
>>> Routed VPN, 172.27.0.0/16 network.  Server is located at 172.27.0.1.
>>>    Server can talk to clients, and clients can talk to server.
>>>
>>> My 1st goal is to allow selected server-side LAN workstations to reach 
>>> the routed VPN workstations.  The LAN should be invisible to the routed 
>>> VPN.
>>>
>>> My 2nd goal is to allow selected server-side LAN workstations to reach 
>>> networks server by routed VPN workstations as gateways [this involves 
>>> OpenVPN more, I believe].  The LAN should still be invisible to the 
>>> routed VPN.
>>>
>>> My server routing table is:
>>> 172.27.0.2 dev tun0  proto kernel  scope link  src 172.27.0.1
>>> 192.168.20.0/24 dev vmnet8  proto kernel  scope link  src 192.168.20.1
>>> 10.4.1.0/24 via 172.27.0.2 dev tun0
>>> 192.168.0.0/24 dev eth0  proto kernel  scope link  src 192.168.0.71
>>> 192.168.0.0/24 dev br1  proto kernel  scope link  src 192.168.0.72
>>> 192.168.30.0/24 dev vmnet1  proto kernel  scope link  src 192.168.30.1
>>> 172.27.0.0/16 via 172.27.0.2 dev tun0
>>> default via 192.168.0.1 dev eth0
>>>     
>>
>> I think you need to use a tap device (I currently have a similar setup, 
>> but I do not hide the LAN - infact I use openvpn to do site to site WAN)
>>
>> By hide the LAN you don't want to the openvpn clients to see the 192.168 
>> addresses if that is the case this is more a iptables question you will 
>> need to nat the lan network going out, if you want in bound traffic you 
>> will need to setup natting on the way back in as well - static though.
>>   
> So do I need a source NAT directing all traffic intended for 172.27.0.0/16 
> from 192.168.0.0/24 to come from 172.27.0.1?
>> why do you want to hide the network - ?
>>   
> The VPN is to provide me a secure static connection to customer's sites.  
> However, those customers should be able to see neither each other, nor 
> reach our internal LAN - unless the connection is initiated from our side.
Okay then you just want out bound, pretend the customers site is the internet, 
SNAT should do it (and a firewall just to be safe), you should only need one on 
the client's openvpn side, but because that is not in direct controll of you 
(physcially), I would probably suggest snat'ting again on your openpvn server 
or the firewall rules



So 

At your site

* Set routing either fix up the default route or add routing to each client 
 machine (the former being the easier of the 2)
* Set up a firewall
* setup SNAT or push a route through to the client 'push "route 192.168.8.0 
 255.255.252.0"' - done in the openvpn server config (the later is probably the 
better - stay away from the double natting )


one the customer site
* Set up SNAT hide everything coming from your site being the local lan address
* set up a firewall 


So all traffic coming from your site will end up on the customer site with a 
local lan address.

There is no routing back into your lan, because of a) routing b) firewall on 
the customer site c) firewall on the server.

a & b are easy to get around because they are at the customer site. C is where 
you protection is.

Alex




> -- 
> Daniel
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>

[-- Attachment #1.2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

[-- Attachment #2: Type: text/plain, Size: 143 bytes --]

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] OpenVPN routing

[Daniel L. Miller]

Alex Samad wrote:
> On Mon, Sep 10, 2007 at 01:40:29PM -0700, Daniel L. Miller wrote:
>   
>> Alex Samad wrote:
>>     
>>> On Sun, Sep 09, 2007 at 11:36:18PM -0700, Daniel L. Miller wrote:
>>>   
>>>       
>>>> Hi!
>>>>
>>>> I'm trying to create a routed VPN using OpenVPN - and having trouble with 
>>>> the routing concepts involved.  Let me see if I can properly describe my 
>>>> current topology:
>>>>
>>>> Server -
>>>> LAN, with both local workstations and remote bridged workstations on the
>>>>    192.168.0.0/24 network (this works without reservation).
>>>>    Server located at 192.168.0.71, 192.168.0.72, 192.168.0.222, and few 
>>>> others.
>>>> Routed VPN, 172.27.0.0/16 network.  Server is located at 172.27.0.1.
>>>>    Server can talk to clients, and clients can talk to server.
>>>>
>>>> My 1st goal is to allow selected server-side LAN workstations to reach 
>>>> the routed VPN workstations.  The LAN should be invisible to the routed 
>>>> VPN.
>>>>
>>>> My 2nd goal is to allow selected server-side LAN workstations to reach 
>>>> networks server by routed VPN workstations as gateways [this involves 
>>>> OpenVPN more, I believe].  The LAN should still be invisible to the 
>>>> routed VPN.
>>>>         
>>> I think you need to use a tap device (I currently have a similar setup, 
>>> but I do not hide the LAN - infact I use openvpn to do site to site WAN)
>>>
>>> By hide the LAN you don't want to the openvpn clients to see the 192.168 
>>> addresses if that is the case this is more a iptables question you will 
>>> need to nat the lan network going out, if you want in bound traffic you 
>>> will need to setup natting on the way back in as well - static though.
>>>       
>> So do I need a source NAT directing all traffic intended for 172.27.0.0/16 
>> from 192.168.0.0/24 to come from 172.27.0.1?
>>     
> Okay then you just want out bound, pretend the customers site is the internet, 
> SNAT should do it (and a firewall just to be safe), you should only need one on 
> the client's openvpn side, but because that is not in direct controll of you 
> (physcially), I would probably suggest snat'ting again on your openpvn server 
> or the firewall rules
>   
I've put in a snat on the server side - seems to be working fine.
> So 
>
> At your site
>
> * Set routing either fix up the default route or add routing to each client 
>  machine (the former being the easier of the 2)
> * Set up a firewall
> * setup SNAT or push a route through to the client 'push "route 192.168.8.0 
>  255.255.252.0"' - done in the openvpn server config (the later is probably the 
> better - stay away from the double natting )
>
>
> one the customer site
> * Set up SNAT hide everything coming from your site being the local lan address
> * set up a firewall 
>
>
> So all traffic coming from your site will end up on the customer site with a 
> local lan address.
>
> There is no routing back into your lan, because of a) routing b) firewall on 
> the customer site c) firewall on the server.
>
> a & b are easy to get around because they are at the customer site. C is where 
> you protection is.
>   
Customer's site not under my control - and running Windows so my linux 
options are rather limited <g>.  So I need to do everything within the 
server and OpenVPN.  I CAN push a route to the client - but I still 
don't see why I need to share my LAN information with the clients at all 
- I just need the OpenVPN client to be a gateway for the VPN and forward 
VPN traffic from the remote network.

-- 
Daniel
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] OpenVPN routing

[Alex Samad]

[-- Attachment #1.1: Type: text/plain, Size: 4185 bytes --]

On Mon, Sep 10, 2007 at 03:48:13PM -0700, Daniel L. Miller wrote:
> Alex Samad wrote:
>> On Mon, Sep 10, 2007 at 01:40:29PM -0700, Daniel L. Miller wrote:
>>   
>>> Alex Samad wrote:
>>>     
>>>> On Sun, Sep 09, 2007 at 11:36:18PM -0700, Daniel L. Miller wrote:
>>>>         
>>>>> Hi!
>>>>>
>>>>> I'm trying to create a routed VPN using OpenVPN - and having trouble 
>>>>> with the routing concepts involved.  Let me see if I can properly 
>>>>> describe my current topology:
>>>>>
>>>>> Server -
>>>>> LAN, with both local workstations and remote bridged workstations on 
>>>>> the
>>>>>    192.168.0.0/24 network (this works without reservation).
>>>>>    Server located at 192.168.0.71, 192.168.0.72, 192.168.0.222, and few 
>>>>> others.
>>>>> Routed VPN, 172.27.0.0/16 network.  Server is located at 172.27.0.1.
>>>>>    Server can talk to clients, and clients can talk to server.
>>>>>
>>>>> My 1st goal is to allow selected server-side LAN workstations to reach 
>>>>> the routed VPN workstations.  The LAN should be invisible to the routed 
>>>>> VPN.
>>>>>
>>>>> My 2nd goal is to allow selected server-side LAN workstations to reach 
>>>>> networks server by routed VPN workstations as gateways [this involves 
>>>>> OpenVPN more, I believe].  The LAN should still be invisible to the 
>>>>> routed VPN.
>>>>>         
>>>> I think you need to use a tap device (I currently have a similar setup, 
>>>> but I do not hide the LAN - infact I use openvpn to do site to site WAN)
>>>>
>>>> By hide the LAN you don't want to the openvpn clients to see the 192.168 
>>>> addresses if that is the case this is more a iptables question you will 
>>>> need to nat the lan network going out, if you want in bound traffic you 
>>>> will need to setup natting on the way back in as well - static though.
>>>>       
>>> So do I need a source NAT directing all traffic intended for 
>>> 172.27.0.0/16 from 192.168.0.0/24 to come from 172.27.0.1?
>>>     
>> Okay then you just want out bound, pretend the customers site is the 
>> internet, SNAT should do it (and a firewall just to be safe), you should 
>> only need one on the client's openvpn side, but because that is not in 
>> direct controll of you (physcially), I would probably suggest snat'ting 
>> again on your openpvn server or the firewall rules
>>   
> I've put in a snat on the server side - seems to be working fine.
>> So 
>> At your site
>>
>> * Set routing either fix up the default route or add routing to each 
>> client  machine (the former being the easier of the 2)
>> * Set up a firewall
>> * setup SNAT or push a route through to the client 'push "route 
>> 192.168.8.0  255.255.252.0"' - done in the openvpn server config (the 
>> later is probably the better - stay away from the double natting )
>>
>>
>> one the customer site
>> * Set up SNAT hide everything coming from your site being the local lan 
>> address
>> * set up a firewall 
>>
>> So all traffic coming from your site will end up on the customer site with 
>> a local lan address.
>>
>> There is no routing back into your lan, because of a) routing b) firewall 
>> on the customer site c) firewall on the server.
>>
>> a & b are easy to get around because they are at the customer site. C is 
>> where you protection is.
>>   
> Customer's site not under my control - and running Windows so my linux 
> options are rather limited <g>.  So I need to do everything within the 
> server and OpenVPN.  I CAN push a route to the client - but I still don't 
> see why I need to share my LAN information with the clients at all - I just 
> need the OpenVPN client to be a gateway for the VPN and forward VPN traffic 
> from the remote network.
if you are using snat you shouldn't.

if you have setup a ip network for the vpn ie if your server ip address is not 
in the network for the customer you will need snat'ing there else the client 
machine will not know how to get back.




>
> -- 
> Daniel
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>

[-- Attachment #1.2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

[-- Attachment #2: Type: text/plain, Size: 143 bytes --]

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc