2

I'm trying to add a static route in my VPS to a client that is on the other side of the VPN tunnel to my VPS and forwards it's traffic through the tunnel.

This is the setup of my destination that I'm planning to add a route to. The Raspi acts as a router which itself is connected to an AP and the NAS is connected to Raspi and redirects its traffic through the VPN tunnel:

                                        +--------------------------------+
                                        |            Raspi               |
                      (192.168.0.101/24)|                                |(192.168.1.1/24)
 (192.168.0.1/24) AP<>=================={wlan0                       eth0}================<>NAS (192.168.1.102/24)
                                        |   \                        /   |
                                        |    +----------------------+    |
                                        |    |     iptables and     |    |
                                        |    |    routing engine    |    |
                                        |    +-----------+----------+    |
                                        |                |               |
                                        |             {tun0}             |
                                        |            10.8.0.6            |
                                        +--------------------------------+

I'm trying to do route add -net 192.168.1.0 netmask 255.255.255.0 gw 10.8.0.6, in order to communicate with my NAS behind the Raspi, but it I get SIOCADDRT: Network is unreachable.

These are the server side info:

$ ifconfig -a

eth0      Link encap:Ethernet  HWaddr XX:XX:XX:XX:XX:XX
          inet addr:217.B.C.D  Bcast:217.B.C.D  Mask:255.255.255.255
          inet6 addr: XXXX::XXX:XXXX:XXXX:XXXX/XX Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1598 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1453 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:176137 (176.1 KB)  TX bytes:165179 (165.1 KB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:9 errors:0 dropped:0 overruns:0 frame:0
          TX packets:9 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:460 (460.0 B)  TX bytes:460 (460.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:169 errors:0 dropped:0 overruns:0 frame:0
          TX packets:183 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:14825 (14.8 KB)  TX bytes:15071 (15.0 KB)

$ netstat -anr

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         10.255.255.1    0.0.0.0         UG        0 0          0 eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG        0 0          0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH        0 0          0 tun0
10.255.255.1    0.0.0.0         255.255.255.255 UH        0 0          0 eth0

$ ip route list

default via 10.255.255.1 dev eth0
10.8.0.0/24 via 10.8.0.2 dev tun0
10.8.0.2 dev tun0  proto kernel  scope link  src 10.8.0.1
10.255.255.1 dev eth0  scope link

Additional info:

If you are wondering how I've acheived the traffic redirection between the interfaces, here is my post describing how I've managed everything up to this point using iptables:

https://unix.stackexchange.com/questions/273926/redirect-secondary-network-interface-traffic-along-with-port-forwarding-to-tun0

Client netwrok block (in case of p2p topology):

10.8.0.4 : Network address
10.8.0.5 : Virtual remote endpoint; Non pingable; Only used for routing
10.8.0.6 : Client IP address
10.8.0.7 : Network broadcast address

UPDATE 1:

I've changed my VPN server configuration to topology subnet and ifconfig-push 10.8.0.6 255.255.255.0 in the corresponding ccd file for the VPN client to bring the VPN server and client into the /24 subnet instead of /32 and then add the routes. This time route add -net 192.168.1.0 netmask 255.255.255.0 gw 10.8.0.6 or route add -net 192.168.1.0 netmask 255.255.255.0 dev tun0 returned no errors, however still no ping 192.168.1.102. netstat -anr changed though (in case of route add -net 192.168.1.0 netmask 255.255.255.0 gw 10.8.0.6).

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         10.255.255.1    0.0.0.0         UG        0 0          0 eth0
10.8.0.0        0.0.0.0         255.255.255.0   U         0 0          0 tun0
10.255.255.1    0.0.0.0         255.255.255.255 UH        0 0          0 eth0
192.168.1.0     10.8.0.6        255.255.255.0   UG        0 0          0 tun0
Community
  • 1
Bahador
  • 21
  • 8
  • Why not just add your ascii art as actual text instead of linking to an image?? – Marki Apr 03 '16 at 16:40
  • I lost the ASCII, so I only had a screenshot from it. But I regenerated it again and updated the post... – Bahador Apr 03 '16 at 17:11
  • How about something like `route add 192.168.1.0 netmask 255.255.255.0 dev tun0` – Dan Apr 03 '16 at 18:50
  • If you meant `route add -net 192.168.1.0 netmask 255.255.255.0 dev tun0`, it didn't give me any errors, but I'm still unable to `ping 192.168.1.102`. I've also changed my VPN server configuration to `topology subnet` and `ifconfig-push 10.8.0.6 255.255.255.0` in the corresponding `ccd` file for the VPN client to bring the VPN server and client into the `/24` subnet instead of `/32` and then add the routes. This time `route add -net 192.168.1.0 netmask 255.255.255.0 gw 10.8.0.6` also returns no errors, however still no `ping 192.168.1.102`. `netstat -anr` changed though. I've updated the post. – Bahador Apr 03 '16 at 19:47
  • If the vps gives you 10.8.0.2 as the peer address, why not route 192.168.1.0 via 10.8.0.2? – Marki Apr 03 '16 at 23:18
  • I switched back to p2p topology and tried what you said, but same results. No ping. Traceroute gives * * * from the very beginning. And in the subnet topology, after adding the route, I've tracerouted from my VPS to `192.168.1.102` and I get * * * at the very beginning. Out of curiosity, I've tracerouted this time out of my NAS to `10.8.0.1` and also got * * * right after `192.168.1.1`, however tracerouting to `4.2.2.4` returned the full path passing through `10.8.0.1` without any stars... Firewall? – Bahador Apr 03 '16 at 23:30

1 Answers1

0

I read the instructions on:

https://openvpn.net/index.php/open-source/documentation/howto.html#scope

And I've added route 192.168.1.0 255.255.255.0 to the server.conf on my VPS and also iroute 192.168.1.0 255.255.255.0 to the correspondig ccd file for the client. And then I used the command route add -net 192.168.1.0 netmask 255.255.255.0 gw 10.8.0.6 and that was it! I could ping my 192.168.1.102 client behind my OpenVPN client from my VPS :D

P.S: I'm still in subnet topology mode. I haven't tried it in the normal p2p topology, but I think it should work s well.

Bahador
  • 21
  • 8