1

I'm using openVPN to access the cluster from outside the campus. But I only want a few ssh clients(Putty, WinSCP) to go through the VPN traffic.

By reading several posts and wiki, I know there is a technique called splitting tunnel for openVPN. Specifically the "route" command in the .ovpn configuration file will create a row in the routing table and only the ip addresses matching the pattern will be directed to the VPN tunnel.

I got the solution from this post and added the ip address of one the login node

route-nopull
route 128.111.123.456 255.255.255.255

and it worked.

In fact openVPN can parse the hostname every time after connecting

route-nopull
allow-pull-fqdn
route xxx.xxx.edu 255.255.255.255

I checked the log file and it was basically a "route add" and the login node ip address appears in route print output.

Now I want to add a subnet to VPN traffic(there are several servers within a subnet),

route-nopull
route 128.111.0.0 255.255.0.0

but then I can't ssh to the login node. Putty prompted the error message: server unexpectedly closed connection, which is the same as VPN is down. The log shows the "route add" command is executed successfully, and the "route print" command shows the "128.111.0.0" entry is there with the correct vpn gateway.

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway     Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.100     20
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      128.111.0.0      255.255.0.0     128.111.61.1   128.111.61.143     30
     128.111.61.0    255.255.255.0         On-link    128.111.61.143    286
   128.111.61.143  255.255.255.255         On-link    128.111.61.143    286
   128.111.61.255  255.255.255.255         On-link    128.111.61.143    286
      192.168.1.0    255.255.255.0         On-link     192.168.1.100    276
    192.168.1.100  255.255.255.255         On-link     192.168.1.100    276
    192.168.1.255  255.255.255.255         On-link     192.168.1.100    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     192.168.1.100    276
        224.0.0.0        240.0.0.0         On-link    128.111.61.143    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     192.168.1.100    276
  255.255.255.255  255.255.255.255         On-link    128.111.61.143    286
===========================================================================

Where am I wrong in the configuration file?

Thanks.

EDIT

There is a post for the same problem. But in that case, the "route add" command was not successfully executed because of the incorrect netmask. I did not made the same mistake, the ip address with the netmask was shown in "route print".

1 Answer 1

0

If the error message says "Server closed the connection", it means the client had successfully opened one. This should mean that the routing is fine (you can communicate with the server in both directions), but the server's sshd configuration does not accept your login.

1
  • No that's the Putty(ssh) error message, not the openVPN log. "Server closed the connection" also shows up when VPN is down, so I think the setting for the subnet somehow doesn't work.
    – anecdote
    Sep 2, 2016 at 19:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .