Matthew99
April 12, 2018, 9:17am
28
ok i’m thinking the issue is deffo routing between 192.168.100.0 to my lan 192.168.30.x
i can ping my NS Vpn server 192.168.30.19 from client and get reply but nothing else on the lan
is there a route i need to add in shorewall to route between 192.168.100.0 to 192.168.30.0
iptable is as follows:
Kernel IP routing table
firewall.log
Apr 11 15:59:00 TestVPN kernel: Shorewall:loc2fw:REJECT:IN=enp0s29u1u4 OUT= MAC=00:24:9b:28:96:25:00:24:9b:28:96:23:08:00 SRC=192.168.30.195 DST=192.168.30.19 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=10081 DF PROTO=TCP SPT=50654 DPT=62078 WINDOW=64240 RES=0x00 SYN URGP=0
mrmarkuz
April 12, 2018, 10:04am
29
Seems like you didn’t change the subnetmask of the VPN network. You may try 255.255.255.0 instead of 255.255.254.0.
EDIT: I tried different subnet masks and it just works
Matthew99
April 12, 2018, 10:16am
30
sorry yep changed to 255.255.255.0 still no joy, can ping vpn server but nothing else on lan
mrmarkuz
April 12, 2018, 10:27am
31
Routing table seems to be ok.
Are there any errors in /var/log/openvpn/openvpn.log?
Matthew99
April 12, 2018, 10:38am
32
ok no errors in openvpn.log will post just need to redact
mrmarkuz
April 12, 2018, 11:02am
34
I don’t have that entries in firewall.log. Did you customize the firewall?
Matthew99
April 12, 2018, 11:05am
35
i didn’t touch firewall after fresh install
Matthew99
April 12, 2018, 11:58am
36
ok and firewall log now showing this do i need to add a arule?
TTL=128 ID=1298 DF PROTO=TCP SPT=10557 DPT=22 WINDOW=64240 RES=0x00 SYN URGP=0
Matthew99
April 12, 2018, 12:18pm
37
/etc/shorewall/policy
#SOURCE DEST POLICY LOG LIMIT: CONNLIMIT:
# LEVEL BURST MASK
#
# 20policy
#
loc net ACCEPT
# firewall can always connect outside
$FW net ACCEPT
# Traffic from firewall to local network is always allowed
$FW loc ACCEPT
#
# 20policy_openvpn
#
loc ovpn ACCEPT
ovpn loc ACCEPT
ovpn $FW ACCEPT
$FW ovpn ACCEPT
ovpn net ACCEPT
#
# 30policy_extra_zones
#
#
# 40policy_static
#
loc $FW REJECT info
# Drop traffic from external interface to firewall and local network
net $FW DROP info
net loc DROP info
# Drop all other traffic from external interface
net all DROP info
#
# 90reject all
#
# THE FOLLOWING POLICY MUST BE LAST
all all REJECT info
mrmarkuz
April 12, 2018, 12:26pm
38
I use openvpn on nethserver in gateway mode so maybe try to replace the router with nethserver for a test. Another thing you may try is bridged mode VPN.
Matthew99
April 12, 2018, 12:34pm
39
Hi Markus
Bridged mode that’s where this post started trying to get away from bridged Tap mode and using Tun routed.
any other suggestions?
it seems to be a routing issue from me coming in on 192.168.100.x i can ping the vpn server on the lan 192.168.30.x but i can’t see anything else any rule i need to get the two talking?
Matthew99
April 12, 2018, 12:37pm
40
firewall.log
Apr 12 13:26:17 TestVPN kernel: Shorewall:sfilter:DROP:IN=tunrw OUT=tunrw MAC= SRC=192.168.100.6 DST=192.168.100.2 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=8679 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=146
mrmarkuz
April 12, 2018, 12:47pm
41
Matthew99:
any other suggestions?
You may try using Nethserver as router/gateway/firewall instead of your router. This way VPN and routing happens on one machine. It’s the last difference between our setups (except of your vlaned LAN).
Matthew99
April 12, 2018, 3:26pm
42
Thanks Markus, that will rule out Router issue but still won’t solve the issue long term i think i will try a full re install and re post if i still have the issue see if i can’t grab someone who is using the same setup.
mrmarkuz
April 12, 2018, 3:59pm
43
I tried your config with only one interface and had the same problem. Could reach gateway but no other network device.
Matthew99
April 12, 2018, 4:05pm
44
Thanks for Replicating Markus, leaves me feeling slightly better knowing it isn’t just me, where you think i go from here was working on a re post with a recap of everything so far see if i can hook some other takers?
mrmarkuz
April 12, 2018, 4:15pm
45
Yes, that’s a good idea. I’ll give it another try in the evening. I think it’s because of server mode. Maybe some openvpn or shorewall config is different.
EDIT:
It’s openvpn. Seems you need a route…
https://openvpn.net/index.php/open-source/faq/77-server/257-can-an-openvpn-server-be-set-up-on-a-machine-with-a-single-nic.html
Matthew99
April 12, 2018, 4:21pm
46
Awesome thanks Marcus. will post again now let me know how you get on. thanks for your help
mrmarkuz
April 12, 2018, 8:41pm
47
I tested again and as described in the link above all you need is a static route on your Dell sonicwall tz300 to reach the VPN network 192.168.111.0/24 via the VPN server. The sonicwall blocks because it doesn’t know the VPN network.
On a Nethserver it would look like this:
