Yet another routing issue in OpenVPN - Cannot access local machines while on VPN

Question

This is probably going to be quite a lengthy post because I want to make sure I don't forget anything. This is likely a very trivial issue but I can't figure out what's wrong with my setup.

Scenario

I recently configured a VPN server running OpenVPN, currently running inside a VM in ESXi. I have based the installation on this guide, and everything seems to be working fine: I can connect to my VPN server (through port forwarding on the router) and login with certificate authentication.

What is not working

I cannot access machines on my local network (192.168.0.0) when I am connected through the VPN.

At the moment, after successfully connecting via VPN to my home network, all the machines on my LAN are not accessible (I cannot even ping them).

Network information

The network configuration is very simple:

• My local network: 192.168.0.0
• My OpenVPN IP: 192.168.0.140
• My gateway: 192.168.0.1
• My VPN network: 10.8.0.0
• My OpenVPN VPN IP: 10.8.0.1
• The router has port forwarding configured on port 1194

What I have tried so far (high level)

I have followed three resources to try and fix this issue:

1. The OpenVPN routing guide, specifically the section Using routing and OpenVPN not running on the default gateway
2. This short article on how to set up routing with OpenVPN to connect to hosts on my LAN
3. Another article on how to configure ESXi for this to work, because apparently, in its default configuration, ESXi can cause some problems getting this to work
4. Enabled IP forwarding on the VPN server
5. Enabled all the traffic to go through OpenVPN's firewall

What I have tried so far (detailed)

This is the OpenVPN server.conf:

local 192.168.0.140
topology subnet
dev tun
proto udp
port 1194

ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/vpnserver.crt
key /etc/openvpn/easy-rsa/keys/vpnserver.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem

server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2

# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 192.168.0.0 255.255.255.0"
# Set primary domain name server address to the SOHO Router
# If your router does not do DNS, you can use Google DNS 8.8.8.8
push "dhcp-option DNS 192.168.0.254"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"

client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1

An example client.ovpn:

client
dev tun
proto udp
remote <my_router_ip> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
key-direction 1
cipher AES-128-CBC
comp-lzo
verb 1
mute 20

Since my current router does not support static routes, unfortunately I cannot configure routing once and for all, but I have do so on each device I want to access while I am connected via VPN. So for example, on my Plex server (192.168.0.110), I have done this:

route add -net 10.8.0.0/24 gw 192.168.0.140

So that my OpenVPN machine (192.168.0.140) could connect the machines on the VPN network (10.8.0.0) with those on the local network (192.168.0.0).

I have also made sure that IP forwarding is enabled on the OpenVPN server, but uncommenting the following line from /etc/sysctl.conf:

net.ipv4.ip_forward=1

Finally, I have added the following iptables rules to allow all traffic from the VPN network to reach the local network:

# Allow traffic initiated from VPN to access LAN
iptables -I FORWARD -i tun0 -o eth0 -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT

# Allow established traffic to pass back and forth
iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

Finally, I have configured the virtual switch vSwitch on ESXi not to drop promiscuous packets, as the article linked above states that in its default configuration it would drop these packets, and this could cause issues when using OpenVPN while trying to access machines on the local network.

Unless I have missed something, this should really be all that needs to be done. Unfortunately, after successfully connecting to the VPN, I am still not able to ping the machines on the 192.168.0.0 network.

Again, this is likely something quite trivial, but I am willing to offer some bounty for the correct answer anyway, because one of the reasons I set up the VPN in the first place was to be able to access my other machines without the need to forward more ports on the router.

Client machine networking info

This is the full output of ipconfig of the machine I am using to connect (in order to "fake" connecting from a remote network, I am tethering my phone's 3G connection and connecting via Wi-Fi from Windows):

C:\Windows\System32>ipconfig

Windows IP Configuration


Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::2c0e:13f0:840c:37b4%15
   IPv4 Address. . . . . . . . . . . : 10.8.0.10
   Subnet Mask . . . . . . . . . . . : 255.255.255.252
   Default Gateway . . . . . . . . . :

Wireless LAN adapter Local Area Connection* 2:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Wireless LAN adapter Wi-Fi:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::a5e8:546c:e046:a246%4
   IPv4 Address. . . . . . . . . . . : 192.168.43.220
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.43.1

Ethernet adapter Ethernet:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Ethernet adapter VirtualBox Host-Only Network:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::1d14:52cd:fd6a:2395%10
   IPv4 Address. . . . . . . . . . . : 192.168.56.1
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . :

Tunnel adapter isatap.{75888664-BED0-4908-8984-4DBCF9E9BDDC}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Tunnel adapter isatap.{6F952140-AFCD-46E4-89E3-02CDEF869C50}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Tunnel adapter isatap.{1F6CE10F-8498-4A7B-B647-FAE7422FF030}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Output of route print:

C:\Windows\System32>route print
===========================================================================
Interface List
 15...00 ff 1f 6c e1 0f ......TAP-Windows Adapter V9
  7...12 56 f2 a5 d0 53 ......Microsoft Wi-Fi Direct Virtual Adapter
  4...80 56 f2 a5 d0 53 ......Killer Wireless-N 1202 Network Adapter
  3...80 fa 5b 00 d7 1f ......Realtek PCIe GBE Family Controller
 10...08 00 27 00 68 59 ......VirtualBox Host-Only Ethernet Adapter
  1...........................Software Loopback Interface 1
  8...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
  9...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
 11...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     192.168.43.1   192.168.43.220     25
         10.8.0.4  255.255.255.252         On-link          10.8.0.6    276
         10.8.0.6  255.255.255.255         On-link          10.8.0.6    276
         10.8.0.7  255.255.255.255         On-link          10.8.0.6    276
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
     192.168.43.0    255.255.255.0         On-link    192.168.43.220    281
   192.168.43.220  255.255.255.255         On-link    192.168.43.220    281
   192.168.43.255  255.255.255.255         On-link    192.168.43.220    281
     192.168.56.0    255.255.255.0         On-link      192.168.56.1    276
     192.168.56.1  255.255.255.255         On-link      192.168.56.1    276
   192.168.56.255  255.255.255.255         On-link      192.168.56.1    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      192.168.56.1    276
        224.0.0.0        240.0.0.0         On-link          10.8.0.6    276
        224.0.0.0        240.0.0.0         On-link    192.168.43.220    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      192.168.56.1    276
  255.255.255.255  255.255.255.255         On-link          10.8.0.6    276
  255.255.255.255  255.255.255.255         On-link    192.168.43.220    281
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  1    306 ::1/128                  On-link
 10    276 fe80::/64                On-link
 15    276 fe80::/64                On-link
  4    281 fe80::/64                On-link
 10    276 fe80::1d14:52cd:fd6a:2395/128
                                    On-link
 15    276 fe80::2c0e:13f0:840c:37b4/128
                                    On-link
  4    281 fe80::a5e8:546c:e046:a246/128
                                    On-link
  1    306 ff00::/8                 On-link
 10    276 ff00::/8                 On-link
 15    276 ff00::/8                 On-link
  4    281 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

Answer 1

Ok, the problem was on the client side. I have no idea what the root cause was, but basically my client would not receive the static routes from the OpenVPN server for some reason. Uninstalling and reinstalling the OpenVPN client solved the issue :/

Therefore, the above configuration is perfectly correct.

Answer 2

You are not running your Windows client as an Administrator. This is a known issue where OpenVPN client configures the interface address, but cannot manipulate the routing table. It is deducible from it's logs, by the way.

Go read (for example): https://uwnthesis.wordpress.com/2013/03/25/how-to-run-openvpn-with-administrator-rights-windows-7/

Answer 3

I think what you are asking is called Split Tunneling. If you are using Windows' native VPN client go to Control Panel-> Network and Internet-> Network Connections -> YOUR VPN CONNECTION -> Properties -> Networking -> IPv4 properties -> Advanced -> Uncheck "Use default gateway on remote network"

If you are using another software, just look for split tunneling. You MIGHT need to enable it on the server side too.