Hi Douglas,
On 01/05/15 05:06, Douglas D Germann Sr wrote:
Friends--
My first post, and by reading this you will see how new I am to
openvpn. So please be gentle. <grin>
I have one vpn set up and trying to get a second vpn set up. The two
seem to be conflicting with each other. There is so far only one
client machine, but we will be adding another in a few days.
The problem: Each of the VPNs connect with the client. That's good.
But when I have them both running, I cannot ping nor ssh to the client
from machines on the server's lan. I want to be able to ssh to the
client so I can perform maintenance on that machine. (I will soon add
another remote machine and need to do the same on it.) I am thinking
that my routing commands may be conflicting with one another.
Production environment. Both servers at the same physical location.
Server1: earth, running Ubuntu 12.04 lts; local address 192.168.0.201
Server2: mariah, on Synology ds 513 j nas; local address 192.168.0.202
Client: air, at a remote location.
(Not sure if testing is a problem, since for trouble shooting this, I
have the client machine physically in the same building behind the
same router as the two servers. Client's address for now is
192.168.0.211, although normally it is at 192.168.1.16 at the remote
location.)
(((((tun0)))))
This tunnel has been running reliably for 18 months or so.
Server1/earth server.conf:
===============
port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/earth.crt
key /etc/openvpn/earth.key # This file should be kept secret
dh /etc/openvpn/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir /etc/openvpn/ccd
route 192.168.1.0 255.255.255.0
client-to-client
keepalive 10 120
comp-lzo
max-clients 2
persist-key
persist-tun
status openvpn-status.log
verb 3
###########added 20150426
push “route 10.8.0.0 255.255.255.0”
push “route 192.168.1.0 255.255.255.0”
================
Its ccd/air file reads:
==========
iroute 192.168.1.0 255.255.255.0
ifconfig-push 10.8.0.42 10.8.0.41
==========
client/air's client.conf for this connection:
===============
client
dev tun
proto udp
remote [blanked] 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/air.crt
key /etc/openvpn/air.key
remote-cert-tls server
comp-lzo
verb 3
================
(((((tun1)))))
This is the new tunnel. Client has been able to connect and access and
edit files on mariah, but I cannot ssh into the client using this vpn.
server2/mariah's server.conf:
=================
push "route 10.8.1.0 255.255.255.0"
route 192.168.1.0 255.255.255.0
route 10.8.1.0 255.255.255.0
client-config-dir /usr/syno/etc/packages/VPNCenter/openvpn/ccd
dev tun
management 127.0.0.1 1195
server 10.8.1.0 255.255.255.0
dh /usr/syno/etc/packages/VPNCenter/openvpn/dh2048.pem
ca /usr/syno/etc/packages/VPNCenter/openvpn/ca.crt
cert /usr/syno/etc/packages/VPNCenter/openvpn/server.crt
key /usr/syno/etc/packages/VPNCenter/openvpn/server.key
max-clients 3
comp-lzo
persist-tun
persist-key
verb 3
log-append /var/log/openvpn.log
keepalive 10 60
reneg-sec 0
status-version 2
proto udp6
port [blanked]
user nobody
group nobody
===============
Its ccd/air2 file reads:
=======
iroute 192.168.1.0 255.255.255.0
ifconfig-push 10.8.1.6 10.8.1.5
=======
client/air's client.conf file for this connection reads:
===========
client
dev tun1
proto udp
remote [blanked]
#remote 192.168.0.201
resolv-retry infinite
nobind
persist-key
persist-tun
dh dh2048.pem
ca /etc/openvpn/synca.crt
cert /etc/openvpn/air2.crt
key /etc/openvpn/air2.key
remote-cert-tls server
comp-lzo
verb 3
===========
The router behind which the two servers live has these static routes:
10.8.0.1 255.255.255.255 gw192.168.0.201
192.168.1.0 255.255.255.0 gw192.168.0.201
10.8.0.0 255.255.255.0 gw192.168.0.201
10.8.1.1 255.255.255.255 gw192.168.0.202
10.8.1.0 255.255.255.0 gw192.168.0.202
And the ports are forwarded 1194 to internal 1194 on 192.168.0.201
(UDP) and the correct port on 192.168.0.202 (ALL).
Besides the routing commands, I am wondering whether these two things
might be issues:
1. The ccd file on server2/mariah is named air2. Ought it be named air?
2. The air2.crt file on the client (air) has a couple of entries that
say CN=[address of the dynamic dns I am using], but not air nor air2.
Ought I edit this or recreate the keys?
So: how do I get both of these working and playing well together?
the name of a CCD file is very important - it needs to match the exact
name of the CN=.... part of the client-side certificate. An easy way to
verify whether the server picks up the CCD file is by adding the option
ccd-exclusive
to the server config and restart it - if the client is no longer able to
connect then you're not using the right name.
Whether it's a routing issue or not is hard to tell - things look OK at
first sight, but it is much more important to see the routing tables on
both the OpenVPN server and client after the VPN has come up. Is it
possible for you to get those?
HTH,
JJK
------------------------------------------------------------------------------
One dashboard for servers and applications across Physical-Virtual-Cloud
Widest out-of-the-box monitoring support with 50+ applications
Performance metrics, stats and reports that give you Actionable Insights
Deep dive visibility with transaction tracing using APM Insight.
http://ad.doubleclick.net/ddm/clk/290420510;117567292;y
_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users
