VPN subnet routing: Destination Port Unreachable

Question

I am connected via VPN to a Ubuntu server acting as a hypervisor, running 1 VM. I can ping the VM from command-line on the server, but am unable to ping the VM via my VPN connection on my computer. All ping's return "Destination Port Unreachable"

I have a virbr1 like this: virbr1 Link encap:Ethernet HWaddr 52:54:00:cb:4d:9b inet addr:10.0.100.1 Bcast:10.0.100.31 Mask:255.255.255.224 (created by Libvirt)

I have 1 VM running on the hypervisor with IP 10.0.100.16 which I can ping from the hypervisor, but not via VPN.

My openvpn server.conf has: server 10.0.1.0 255.255.255.240 push "route 10.0.100.0 255.255.255.224"

on my client, I can ping 10.0.100.1 but I can't ping 10.0.100.16: PING 10.0.100.16 (10.0.100.16) 56(84) bytes of data. From 10.0.1.1 icmp_seq=1 Destination Port Unreachable

It appears that instead of 10.0.100.16 the ping response contains 10.0.1.1.

When I tcpdump tun1 on the hypervisor, I see: IP 10.0.1.6 > 10.0.100.16: ICMP echo request, id 26073, seq 1, length 64 IP 10.0.1.1 > 10.0.1.6: ICMP 10.0.100.16 protocol 1 port 43991 unreachable, length 92

for some reason 10.0.1.1 is used instead of 10.0.100.16 for the ICMP reply.

Any ideas what might be wrong? Incorrect routing, missing iptables?

Answer 1

You don't mention what configuration you have for the libvirt virtual network associated with the virbr0 device. The default configuration libvirt makes is to setup NAT based connectivity. In such a setup, libvirt has firewall rules that apply NAT to the outbound connections. Inbound connections are only accepted from the host OS itself - there's no routing from networks off-host, which I think will probably include your VPN connection.