Dotaz: Linux neroutuje mezi dvemi openvpn.

[OgO]

Ahoj, mam problem s nasledujici konfiguraci openvpn:

       Staticky tunel OVPN     
               |            
srv1---fw1<--------->fw2--srv2---srv3
                           | 
                           |--OpenVPN tunel
                           |
                      Road Warrior

Mezi fw1 a srv2 mam staticky openvpn tunel, ktery bez problemu funguje. Dopingnu se ze srv1 na fw2,srv2 i srv3 a naopak.

Problem nastava kdyz se chci z road warriora dopingnout do site za fw1. Dopingnu se na fw2, srv2 i srv3, ale kdyz si chci pingnout na cokoliv za statickym tunelem, tak pakety skonci na br0(virtualni rozhrani vpn serveru.)

Nejzvlastnejsi je, že ze srv1 se pohodlne dopingnu uplne vsude i na ip adresu road warriora.

Konfigurace fw1:

#mode p2p
port 3194
proto udp
dev tun1
remote ver.jna.ip.srv2 

ifconfig 10.1.1.2 10.1.1.1
route 192.168.2.0 255.255.255.0 10.1.1.1 #sit za fw2

float
secret /etc/openvpn/kl94

#tls-client
#ca /etc/openvpn/ca1.crt
#cert /etc/openvpn/fw1.crt
#key /etc/openvpn/fw1.key
#dh /etc/openvpn/dh1024_1.pem

persist-key
persist-tun
keepalive 10 120
log-append /var/log/openvpn_deu-dde.log
status /var/run/openvpn/vpn_dde-deu.status 10
mute 5

user openvpn
group openvpn
comp-lzo
verb 3

Konfigurace srv2:

#mode p2p
port 3194
proto udp
dev tun1

remote vere.jna.ip.srv2
ifconfig 10.1.1.1 10.1.1.2
route 192.168.3.0 255.255.255.0 10.1.1.2 #sit za fw2

float
secret /etc/openvpn/kl94

#tls-server
#ca /etc/openvpn/ca.crt
#cert /etc/openvpn/server.crt
#key /etc/openvpn/server.key
#dh /etc/openvpn/dh1024.pem

persist-key
#persist-tun
keepalive 10 120

log-append /var/log/openvpn
status /var/run/openvpn/vpn.status 10
mute 15

comp-lzo
verb 3

Konfigurace vpn serveru pro road warriory:

up /etc/openvpn/bridge-start
down /etc/openvpn/bridge-stop
mode server
tls-server
crl-verify crl.pem
port 1194
proto tcp-server
dev tap0
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.3.254 255.255.255.0 192.168.3.50 192.168.3.89
push "route 192.168.2.0 255.255.255.0 vpn_gateway" 
client-config-dir ccd
push "dhcp-option DNS 192.168.3.145"
push "dhcp-option DNS 192.168.3.149"
push "dhcp-option WINS 192.168.3.145"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log-append  /var/log/openvpn.log
verb 3
mute 15

Diky moc za nakopnuti spravnym smerem.

Odpovědi

[houska]

Problem nastava kdyz se chci z road warriora dopingnout do site za fw1. Dopingnu se na fw2, srv2 i srv3, ale kdyz si chci pingnout na cokoliv za statickym tunelem, tak pakety skonci na br0(virtualni rozhrani vpn serveru.)

co takhle iptabes na fw1? mas tam tohle povolene?
co "ebtables"
jeste me napadlo co se stane kdyz nahodis fyzicka rozhrani, pak povolis ip_forward a az pak vpn tunel ... ale to je spis takova glosa ...

[houska]

jeste me napadlo jestli se to na fw1 neNATuje ...

[OgO]

V iptables to povolene je.

Ebtables na fw1:

Bridge chain: INPUT, entries: 4, policy: ACCEPT
-p IPv4 -j ACCEPT
--log-level info --log-prefix "EB_IN" --log-ip -j CONTINUE
-p ARP -j ACCEPT
-p Length -j ACCEPT

Bridge chain: FORWARD, entries: 4, policy: ACCEPT
-p IPv4 -j ACCEPT
-p ARP -j ACCEPT
-p Length -j ACCEPT
--log-level info --log-prefix "EB_FW" --log-ip -j CONTINUE

Bridge chain: OUTPUT, entries: 4, policy: ACCEPT
-p IPv4 -j ACCEPT
-p ARP -j ACCEPT
-p Length -j ACCEPT
--log-level info --log-prefix "EB_OUT" --log-ip --log-arp -j DROP

Na fw1 se to nenatuje.

Problem je v tom, ze ve smeru od road warriora se do site za statickou vpn nepingnu., ale ve smeru opacnem se dopingu uplne vsude.

Problem vidim i v tom, ze na srv2 pakety od roadwariora do srv1 dorazi, ale srv2 je uz neposle do rozhrani tun1 (virtualni vpn rozhrani.). Takze provoz od road warriora do srv1 konci na srv2.

Nemuze deklat problem to ze staticka vpn je na udp a je routovana. A vpn pro Road Warriory je na tcp a bridged ?

[houska]

co routovaci pravidla?

[OgO]

Routovaci tabulka srv2:

root@lnserver /var/log# ip rou
10.1.1.2 dev tun1  proto kernel  scope link  src 10.1.1.1
192.168.3.0/24 via 10.1.1.2 dev tun1
192.168.2.0/24 dev br0  proto kernel  scope link  src 192.168.2.200
127.0.0.0/8 dev lo  scope link
default via 192.168.2.254 dev br0

Routovaci tabulka na fw1:

10.1.1.1 dev tun1  proto kernel  scope link  src 10.1.1.2
10.1.2.1 dev tun0  proto kernel  scope link  src 10.1.2.2
192.168.254.0/29 dev eth0  proto kernel  scope link  src 192.168.254.2
192.168.3.0/24 dev br0  proto kernel  scope link  src 192.168.3.200
192.168.3.0/24 dev eth1  proto kernel  scope link  src 192.168.3.200
192.168.170.0/24 via 10.1.2.1 dev tun0
192.168.2.0/24 via 10.1.1.1 dev tun1
169.254.0.0/16 dev eth1  scope link
default via 192.168.254.1 dev eth0

[Gilhad]

Mozna se pletu, ale nemohl by byt problem v tom, ze RoadWarrior sice vi, ze do site 192.168.2.0/24 se leze prez OpenVPN

push "route 192.168.2.0 255.255.255.0 vpn_gateway"

ale uz nevi, kam posilat packety do site 192.168.3.0/24 (ze prez to same rozhrani)

Co by asi tak udelalo na RW pridat po nahozeni vseho jeste

route 192.168.3.0 255.255.255.0 vpn_gateway

(nevim, ptam se)?

[OgO]

Bohuzel tim to taky nebude, tu routu mu taky nastavuju.

Kdyz road warrior pinga do 192.168.2.0/24 tak ty pakety vidim na rozhrani vpn serveru.