Package: openvpn
Version: 2.3.4-5
Severity: normal
Dear Maintainer,
after upgrading an OpenVPN server to Jessie, the VPN tunnels appear to come up
normally, but no traffic is being passed over the tunnels.
It seems that there is a routing entry missing on the jessie-setup:
- my server is 192.168.20.4 (eth0) and 10.11.0.1 (tun0)
- vpn client is 10.11.0.10
On Wheezy, the routing table looks like this with a client connection active:
root@vvpn:~# uname -a
Linux vvpn 3.2.0-4-amd64 #1 SMP Debian 3.2.65-1+deb7u2 x86_64 GNU/Linux
root@vvpn:~# ip route get 10.11.0.10
10.11.0.10 via 10.11.0.2 dev tun0 src 10.11.0.1
cache
root@vvpn:~# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.20.1 0.0.0.0 UG 0 0 0 eth0
10.11.0.0 10.11.0.2 255.255.255.0 UG 0 0 0 tun0
10.11.0.0 192.168.20.4 255.255.255.0 UG 0 0 0 eth0
10.11.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.20.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
On Jessie it is like this:
root@vvpn:/etc/default# ip route flush cache
root@vvpn:/etc/default# ip route get 10.11.0.10
10.11.0.10 dev eth0 src 192.168.20.4
cache
Note that this is now routed via eth0/192.168.20.4 instead of the tunnel
interface.
root@vvpn:/etc/default# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.20.1 0.0.0.0 UG 0 0 0 eth0
10.11.0.0 192.168.20.4 255.255.255.0 UG 0 0 0 eth0
10.11.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.20.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
Note that the route for 10.11.0.0/24 via 10.11.0.2 is missing.
I can see packets coming in over the VPN link - running a ping from the client
against
the vpn server itself gives:
root@vvpn:/etc/default# tcpdump -i tun0 -n proto 1
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
19:30:02.217293 IP 10.11.0.10 > 192.168.20.4: ICMP echo request, id 24141, seq
30, length 64
19:30:03.217465 IP 10.11.0.10 > 192.168.20.4: ICMP echo request, id 24141, seq
31, length 64
19:30:04.215826 IP 10.11.0.10 > 192.168.20.4: ICMP echo request, id 24141, seq
32, length 64
A final note: I tested the setup after doing only the "apt-get upgrade" first
step of the
upgrade process, and at that point the setup was working. Only after the
dist-upgrade did it
fail.
openvpn server configuration:
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
crl-verify crl.pem
dh dh2048.pem
server 10.11.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.20.0 255.255.255.0"
client-to-client
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
openvpn client configuration:
client
dev tun
proto udp
remote vpn.hswn.dk 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca xen-ca.crt
cert xen-client.crt
key xen-client.key
remote-cert-tls server
comp-lzo
verb 3
-- System Information:
Debian Release: 8.0
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 3.16.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=da_DK.UTF-8, LC_CTYPE=da_DK.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages openvpn depends on:
ii debconf [debconf-2.0] 1.5.56
ii init-system-helpers 1.22
ii initscripts 2.88dsf-59
ii iproute2 3.16.0-2
ii libc6 2.19-18
ii liblzo2-2 2.08-1.2
ii libpam0g 1.1.8-3.1
ii libpkcs11-helper1 1.11-2
ii libssl1.0.0 1.0.1k-3
Versions of packages openvpn recommends:
ii easy-rsa 2.2.2-1
Versions of packages openvpn suggests:
ii openssl 1.0.1k-3
pn resolvconf <none>
-- debconf information excluded
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
