Hi, I'm currently trying to set up an environment where I want to link several separate servers on the internet. Each of these servers has several internal lan bridges (vm networks)
As I want all severs to be able to connect to each other, even if one fails i have set up each server as a openvpn server and each sever has client configs to connect to all the other servers. from each server I can ping all the internal subnets on each other server and connect to vms on them. What I am struggling with though is allowing vm's to talk to each other across servers I can see the traffic leaving the vm, hitting the internal gateway for the bridge, hit the correct tunnel to the destination server and arrive on tun0 on the destination server, but for some reason the packets arent then passed to the internal bridge network, I have been able to get it workign by adding random reverse routes to the subnets via tun0 but this seems a wrong way to do it, but it does seem to point to the issue being reverse routing as the traffic comes in on tun0 and goes out of tun1 with the default routing. server 1 has networks 10.1.20.0/24 10.1.30.0/24 10.1.40.0/24 10.1.50.0/24 10.1.100.0/24 server 2 has networks 10.2.20.0/24 10.2.30.0/24 10.2.40.0/24 10.2.50.0/24 10.2.100.0/24 >From sever 1, ping 10.2.100.1 PING 10.2.100.1 (10.2.100.1) 56(84) bytes of data. 64 bytes from 10.2.100.1: icmp_seq=1 ttl=64 time=0.736 ms >From server 2 ping 10.1.100.1 PING 10.1.100.1 (10.1.100.1) 56(84) bytes of data. 64 bytes from 10.1.100.1: icmp_seq=1 ttl=64 time=0.693 ms >From vm on server 1 to server 2 vm ip, 10.1.100.250 ping 10.2.100.1 PING 10.2.100.1 (10.2.100.1) 56(84) bytes of data. --- 10.2.100.1 ping statistics --- 2 packets transmitted, 0 received, 100% packet loss, time 1607ms server 2 openvpn log show Wed Aug 6 13:34:29 2014 us=958823 GET INST BY REAL: #.#.#.#:60953 [succeeded] Wed Aug 6 13:34:29 2014 us=958854 ##/#.#.#.#:60953 UDPv4 READ [125] from [AF_INET]#.#.#.#:60953: P_DATA_V1 kid=0 DATA len=124 Wed Aug 6 13:34:29 2014 us=958884 ##/#.#.#.#:60953 TLS: tls_pre_decrypt, key_id=0, IP=[AF_INET]#.#.#.#:60953 Wed Aug 6 13:34:29 2014 us=958917 ##/#.#.#.#:60953 PID_TEST [0] [SSL-0] [19EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE] 0:1831 0:1832 t=1407324869[0] r=[-1,64,15,0,1] sl=[25,64,64,528] Wed Aug 6 13:34:29 2014 us=958940 ##/#.#.#.#:60953 GET INST BY VIRT: 10.1.100.250 -> ##/#.#.#.#:60953 via 10.1.100.250 Wed Aug 6 13:34:29 2014 us=958959 ##/#.#.#.#:60953 TUN WRITE [84] tcpdump on server 2 (tun0) shows the packets hitting the far side sudo tcpdump -i tun0 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes 13:35:29.728691 IP 10.1.100.250 > ##: ICMP echo request, id 32263, seq 4, length 64 13:35:30.721311 IP 10.1.100.250 > ##: ICMP echo request, id 32263, seq 5, length 64 Any ideas why the traffic isn't being routed to the internal 10.2.100.0/24 lan? server 1 server config port 1194 proto udp dev tun ca keys/## cert keys/## key keys/## dh keys/## server 10.255.1.0 255.255.255.0 ifconfig-pool-persist ipp.txt client-config-dir /etc/openvpn/ccd push "route 10.1.20.0 255.255.255.0" push "route 10.1.30.0 255.255.255.0" push "route 10.1.40.0 255.255.255.0" push "route 10.1.50.0 255.255.255.0" push "route 10.1.100.0 255.255.255.0" keepalive 10 120 tls-auth keys/0 cipher BF-CBC comp-lzo persist-key persist-tun status openvpn-status.log log openvpn.log verb 7 server 2 server config port 1194 proto udp dev tun ca keys/## cert keys/## key keys/## dh keys/## server 10.255.2.0 255.255.255.0 ifconfig-pool-persist ipp.txt client-config-dir /etc/openvpn/ccd push "route 10.2.20.0 255.255.255.0" push "route 10.2.30.0 255.255.255.0" push "route 10.2.40.0 255.255.255.0" push "route 10.2.50.0 255.255.255.0" push "route 10.2.100.0 255.255.255.0" keepalive 10 120 tls-auth keys/## 0 cipher BF-CBC comp-lzo persist-key persist-tun status openvpn-status.log log openvpn.log verb 7 cleint 1 ccd config iroute 10.1.20.0 255.255.255.0 iroute 10.1.30.0 255.255.255.0 iroute 10.1.40.0 255.255.255.0 iroute 10.1.50.0 255.255.255.0 iroute 10.1.100.0 255.255.255.0 client 2 ccd config iroute 10.2.20.0 255.255.255.0 iroute 10.2.30.0 255.255.255.0 iroute 10.2.40.0 255.255.255.0 iroute 10.2.50.0 255.255.255.0 iroute 10.2.100.0 255.255.255.0 kernel routing table for server 1 Destination Gateway Genmask Flags Metric Ref Use Iface default ####### 0.0.0.0 UG 0 0 0 eth0 10.1.20.0 0.0.0.0 255.255.255.0 U 0 0 0 lan20 10.1.30.0 0.0.0.0 255.255.255.0 U 0 0 0 lan30 10.1.40.0 0.0.0.0 255.255.255.0 U 0 0 0 lan40 10.1.50.0 0.0.0.0 255.255.255.0 U 0 0 0 lan50 10.1.100.0 0.0.0.0 255.255.255.0 U 0 0 0 lan100 10.2.20.0 10.255.2.25 255.255.255.0 UG 0 0 0 tun2 10.2.30.0 10.255.2.25 255.255.255.0 UG 0 0 0 tun2 10.2.40.0 10.255.2.25 255.255.255.0 UG 0 0 0 tun2 10.2.50.0 10.255.2.25 255.255.255.0 UG 0 0 0 tun2 10.2.100.0 10.255.2.25 255.255.255.0 UG 0 0 0 tun2 10.255.1.0 10.255.1.2 255.255.255.0 UG 0 0 0 tun0 10.255.1.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 10.255.2.1 10.255.2.25 255.255.255.255 UGH 0 0 0 tun2 10.255.2.25 0.0.0.0 255.255.255.255 UH 0 0 0 tun2 static.161.133. 0.0.0.0 255.255.255.255 UH 0 0 0 eth0 link-local 0.0.0.0 255.255.0.0 U 1002 0 0 eth0 link-local 0.0.0.0 255.255.0.0 U 1003 0 0 lan20 link-local 0.0.0.0 255.255.0.0 U 1004 0 0 lan30 link-local 0.0.0.0 255.255.0.0 U 1005 0 0 lan40 link-local 0.0.0.0 255.255.0.0 U 1006 0 0 lan50 link-local 0.0.0.0 255.255.0.0 U 1007 0 0 lan100 kernel routing table for server 2 Destination Gateway Genmask Flags Metric Ref Use Iface default ###### 0.0.0.0 UG 0 0 0 eth0 10.1.20.0 10.255.1.25 255.255.255.0 UG 0 0 0 tun3 10.1.30.0 10.255.1.25 255.255.255.0 UG 0 0 0 tun3 10.1.40.0 10.255.1.25 255.255.255.0 UG 0 0 0 tun3 10.1.50.0 10.255.1.25 255.255.255.0 UG 0 0 0 tun3 10.1.100.0 10.255.1.25 255.255.255.0 UG 0 0 0 tun3 10.2.20.0 0.0.0.0 255.255.255.0 U 0 0 0 lan20 10.2.30.0 0.0.0.0 255.255.255.0 U 0 0 0 lan30 10.2.40.0 0.0.0.0 255.255.255.0 U 0 0 0 lan40 10.2.50.0 0.0.0.0 255.255.255.0 U 0 0 0 lan50 10.2.100.0 0.0.0.0 255.255.255.0 U 0 0 0 lan100 10.255.1.1 10.255.1.25 255.255.255.255 UGH 0 0 0 tun3 10.255.1.25 0.0.0.0 255.255.255.255 UH 0 0 0 tun3 10.255.2.0 10.255.2.2 255.255.255.0 UG 0 0 0 tun0 10.255.2.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 static.161.133. 0.0.0.0 255.255.255.255 UH 0 0 0 eth0 link-local 0.0.0.0 255.255.0.0 U 1002 0 0 eth0 link-local 0.0.0.0 255.255.0.0 U 1003 0 0 lan20 link-local 0.0.0.0 255.255.0.0 U 1004 0 0 lan30 link-local 0.0.0.0 255.255.0.0 U 1005 0 0 lan40 link-local 0.0.0.0 255.255.0.0 U 1006 0 0 lan50 link-local 0.0.0.0 255.255.0.0 U 1007 0 0 lan100 -Ian ------------------------------------------------------------------------------ Slashdot TV. Video for Nerds. Stuff that matters. http://tv.slashdot.org/ _______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users
