The setup
I have the following topology:
Router
172.25.214.1
|
|
|
SiteB
172.25.214.0/24
|
|
|
LAN: 172.25.214.3
OpenVPN server+client B
TUN0: 172.25.215.1 TUN1: 10.1.2.2
| |
| |
| |
VpnSiteB VpnSiteA
172.25.215.0/24 10.1.2.0/24
| |
| |
| |
TUN1: 172.25.215.2 TUN0: 10.1.2.1
OpenVPN server+client A
LAN: 10.1.1.3
|
|
|
SiteA
10.1.1.0/24
|
|
|
Router
10.1.1.1
On each site the OpenVPN server+client is a Raspberry Pi running one server instance of OpenVPN, and one client instance of OpenVPN.
The kernel routing table on OpenVPN host SiteA:
Destination Gateway Genmask Flags Metric Ref Use Iface
default 10.1.1.1 0.0.0.0 UG 0 0 0 eth0
10.1.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
10.1.2.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
172.25.214.0 172.25.215.1 255.255.255.0 UG 20 0 0 tun1
172.25.214.0 10.1.2.2 255.255.255.0 UG 30 0 0 tun0
172.25.215.0 0.0.0.0 255.255.255.0 U 0 0 0 tun1
and that of the OpenVPN host on SiteB:
Destination Gateway Genmask Flags Metric Ref Use Iface
default 172.25.214.1 0.0.0.0 UG 0 0 0 eth0
10.1.1.0 10.1.2.1 255.255.255.0 UG 20 0 0 tun1
10.1.1.0 172.25.215.2 255.255.255.0 UG 30 0 0 tun0
10.1.2.0 0.0.0.0 255.255.255.0 U 0 0 0 tun1
172.25.214.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
172.25.215.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
As you see, the only networks that have multiple routes is SiteA and SiteB. The OpenVPN hosts both prefer to route to the other site via its client interface/OpenVPN network.
The problem
Most routing work fine. Any host on SiteA can communicate bidirectionally with
- Any host interface on SiteB
- Any host interface on VpnSiteA
- Any host interface on VpnSiteB except TUN0 / 172.25.215.1
I.e. a host on SiteA can ping
- 10.1.1.3
- 10.1.2.1
- 172.25.215.2
- 172.25.214.3
- 10.1.2.2
- But not 172.25.215.1
That is what I want to solve.
Troubleshooting I've done
Test 1
On a host on SiteA, I ping 172.25.215.1 and traced what happened with TCPDUMP on both OpenVPN hosts.
- Echo request arrived at OpenVPN host SiteA on its LAN interface
- Echo request left OpenVPN host SiteA on its TUN1 interface
- Echo request arrived at OpenVPN host SiteB on its TUN0 interface
- Echo reply left OpenVPN host SiteB on its TUN1 interface
- No Echo reply arrived at OpenVPN host SiteA on any of its interfaces.
So its here something goes wrong.
Test 2
I disabled the OpenVPN server on the OpenVPN host of SiteA, and disabled the OpenVPN client on the OpenVPN host if SiteB. In other words, there is now only one tunnel. This time, I was successful on pinging 172.25.215.1 from a host on SiteA.
So its when I have two tunnels something goes wrong.
Background
Why not just one tunnel? Every now and then, my ISP at both sites stops assigning me a public IP address, putting me behind CGN. If this happens on the site hosting the OpenVPN server, connectivity between the sites goes down. But if both sites each run an OpenVPN server, if one site gets behind CGN, no problem.
Appendix
server.conf of OpenVPN host SiteA:
; General
; ---------------------------------------------------------
dev tun0
proto udp
port xxxx
client-config-dir /etc/openvpn/ccd
keepalive 10 120
max-clients 20
tls-server
verb 2
; Network
; ---------------------------------------------------------
topology subnet
client-to-client
server 10.1.2.0 255.255.255.0
route 172.25.214.0 255.255.255.0 10.1.2.2 30
client.conf of OpenVPN host SiteA:
; General
; ---------------------------------------------------------
client
dev tun1
proto udp
remote xxxx
resolv-retry infinite
connect-retry 5 1800
explicit-exit-notify
nobind
tls-client
verb 2
; Network
; ---------------------------------------------------------
script-security 2
up /etc/openvpn/uppe.sh
down /etc/openvpn/nere.sh
up-restart
up-delay
iproute /usr/local/sbin/unpriv-ip
Note: security related settings are removed.
uppe.sh:
#!/bin/bash
/usr/local/sbin/unpriv-ip route add 172.25.214.0/24 via 172.25.215.1 dev tun1 metric 20
exit 0
nere.sh
#!/bin/bash
/usr/local/sbin/unpriv-ip route del 172.25.214.0/24 via 172.25.215.1 dev tun1 metric 20
exit 0
These two relate to the CGN mitigation.
The files for the OpenVPN host on SiteB is identical except that the network addresses differ.
