1
I have three machines I am trying to coordinate through a TUN connection.
FREEBSD
box running OpenVPN server (tun)
10.0.200.21/24 on local subnet
10.0.202.1/24 on VPN
REMOTE
Public IP
10.0.202.6/24 on VPN
WEBSERVER
10.0.200.31/24 on local subnet
I can get REMOTE
to VPN to FREEBSD
via OpenVPN and the connection is fine, but it is configured incorrectly. When I try to connect from REMOTE
to WEBSERVER
via typing WEBSERVER
's ip address into REMOTE
's browser, WEBSERVER
is unreachable. It is reachable if I attach REMOTE
to the local subnet directly.
I learned the following while troubleshooting.
REMOTE
can pingFREEBSD
and even SSH to it.- A packet capture set up on
FREEBSD
's ethernet port captures no packets from or toREMOTE
's VPN IP of 10.0.202.6. So REMOTE's packets are not making it to the local subnet. - The openvpn.log file on
FREEBSD
has the following line:GET INST BY VIRT: 10.0.200.31 [failed]
So, it seems that OpenVPN is not forwarding packets received on the TUN device to FREEBSD
's ethernet adapter and out to the local subnet.
I do have the following line in my server.conf file.
push "route 10.0.200.0 255.255.255.0"
I tried adding this line but it didn't help.
route 10.0.200.0 255.255.255.0
Here's the routing table on FREEBSD
Routing tables Internet: Destination Gateway Flags Refs Use Netif Expire default 10.0.200.1 UGS 0 4306 re0 10.0.200.0 link#9 U 0 61582 re0 10.0.200.21 link#9 UHS 0 41 lo0 10.0.201.0 10.0.200.1 UGS 0 0 re0 10.0.202.0 10.0.202.2 UGS 0 0 tun0 10.0.202.1 link#12 UHS 0 0 lo0 10.0.202.2 link#12 UH 0 0 tun0 localhost link#11 UH 0 193743 lo0
I have read online about the GET INST BY VIRT: 10.0.200.31 [failed]
message and it was recommended for Linux machines to run the following command.
echo 1 > /proc/sys/net/ipv4/ip_forward
I am afraid to run it because I don't understand it and don't want to get FREEBSD
into a strange configuration. I also strongly prefer a solution that modifies the server.conf file to automatically create the necessary configuration so it is properly managed and torn down when OpenVPN is closed.
What is the solution to this problem?
Thanks for your help! I'll look into a tcpdump tomorrow. But I would have thought those packets should have appeared in my Wireshark capture. Also, I do have a static route set up on the local subnet's default gateway (my internet router) to direct packets for 10.0.202.0/24 to
FREEBSD
. – Shaun – 2014-01-26T04:31:03.843