[help] OpenVPN+Firewall Fermé

Question

Bonjour, 
J'ai configuré un serveur OpenVPN.
J'ai déjà connecté un client et ça fonctionne bien (ping des deux côté, le client et serveur se voient, pas de problèmes).

Avec un deuxième client, le tunnel VPN est bien monté, mais le client ne ping pas serveur, et, inversement. 
 Voici les logs
Wed Jul 20 09:25:13 2016 event_wait : Interrupted system call (code=4)Wed Jul 20 09:25:13 2016 TCP/UDP: Closing socketWed Jul 20 09:25:13 2016 /sbin/route del -net 10.6.66.0 netmask 255.255.255.0Wed Jul 20 09:25:13 2016 /sbin/route del -net 10.10.10.0 netmask 255.255.255.0Wed Jul 20 09:25:13 2016 Closing TUN/TAP interfaceWed Jul 20 09:25:13 2016 /sbin/ifconfig tun0 0.0.0.0Wed Jul 20 09:25:13 2016 SIGTERM[hard,] received, process exitingWed Jul 20 09:25:14 2016 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec  1 2014Wed Jul 20 09:25:14 2016 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.Wed Jul 20 09:25:14 2016 NOTE: the current --script-security setting may allow this configuration to call user-defined scriptsWed Jul 20 09:25:14 2016 WARNING: file '/etc/openvpn/***.***' is group or others accessibleWed Jul 20 09:25:14 2016 LZO compression initializedWed Jul 20 09:25:14 2016 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]Wed Jul 20 09:25:14 2016 Socket Buffers: R=[229376->131072] S=[229376->131072]Wed Jul 20 09:25:14 2016 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]Wed Jul 20 09:25:14 2016 Local Options hash (VER=V4): '66096c33'Wed Jul 20 09:25:14 2016 Expected Remote Options hash (VER=V4): '691e95c7'Wed Jul 20 09:25:14 2016 UDPv4 link local (bound): [undef]Wed Jul 20 09:25:14 2016 UDPv4 link remote: [AF_INET]195.154.***.***:1194Wed Jul 20 09:25:14 2016 TLS: Initial packet from [AF_INET]195.154.***.***:1194, sid=2111b29e 59ff24f2Wed Jul 20 09:25:14 2016 VERIFY OK: depth=1, /C=***.***/ST=***.***/L=***.***/O=***.***/OU=***.***/CN=openvpn-ca/name=openvpn-ca/emailAddress=***.***Wed Jul 20 09:25:14 2016 VERIFY OK: nsCertType=SERVERWed Jul 20 09:25:14 2016 VERIFY OK: depth=0, /C=***.***/ST=***.***/L=***.***/O=***.***/OU=***.***/CN=dev/name=***.***/emailAddress=***.***Wed Jul 20 09:25:14 2016 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit keyWed Jul 20 09:25:14 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authenticationWed Jul 20 09:25:14 2016 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit keyWed Jul 20 09:25:14 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authenticationWed Jul 20 09:25:14 2016 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSAWed Jul 20 09:25:14 2016 [dev] Peer Connection Initiated with [AF_INET]195.154.***.***:1194Wed Jul 20 09:25:16 2016 SENT CONTROL [dev]: 'PUSH_REQUEST' (status=1)Wed Jul 20 09:25:16 2016 PUSH: Received control message: 'PUSH_REPLY,route 10.10.10.0 255.255.255.0,route 10.6.66.0 255.255.255.0,route 10.6.66.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.6.66.118 10.6.66.117'Wed Jul 20 09:25:16 2016 OPTIONS IMPORT: timers and/or timeouts modifiedWed Jul 20 09:25:16 2016 OPTIONS IMPORT: --ifconfig/up options modifiedWed Jul 20 09:25:16 2016 OPTIONS IMPORT: route options modifiedWed Jul 20 09:25:16 2016 ROUTE default_gateway=195.154.***.***Wed Jul 20 09:25:16 2016 TUN/TAP device tun0 openedWed Jul 20 09:25:16 2016 TUN/TAP TX queue length set to 100Wed Jul 20 09:25:16 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0Wed Jul 20 09:25:16 2016 /sbin/ifconfig tun0 10.6.66.118 pointopoint 10.6.66.117 mtu 1500Wed Jul 20 09:25:16 2016 /sbin/route add -net 10.10.10.0 netmask 255.255.255.0 gw 10.6.66.117Wed Jul 20 09:25:16 2016 /sbin/route add -net 10.6.66.0 netmask 255.255.255.0 gw 10.6.66.117Wed Jul 20 09:25:16 2016 /sbin/route add -net 10.6.66.0 netmask 255.255.255.0 gw 10.6.66.117SIOCADDRT: File existsWed Jul 20 09:25:16 2016 ERROR: Linux route add command failed: external program exited with error status: 7Wed Jul 20 09:25:16 2016 Initialization Sequence Completed

le ping vers le seveur vpn renvoie ce message d'erreur:
ping 10.6.66.1PING 10.6.66.1 (10.6.66.1) 56(84) bytes of data.ping: sendmsg: Operation not permittedping: sendmsg: Operation not permittedping: sendmsg: Operation not permitted

D'aprés ce que j'ai vu, cela serait un PB de FW côté client

Voici mes régles actuelles:
Chain INPUT (policy DROP 0 packets, 0 bytes)num   pkts bytes target     prot opt in     out     source               destination1      64M   35G ACCEPT     all  --  lo     any     anywhere             anywhere2    1018K   95M ACCEPT     icmp --  eth0   any     anywhere             anywhere3     245M   47G ACCEPT     all  --  eth0   any     anywhere             anywhere             state RELATED,ESTABLISHED4    42795 2460K ACCEPT     tcp  --  eth0   any     anywhere             anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:ssh5     115K 6831K ACCEPT     tcp  --  eth0   any     anywhere             anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:http6     269K   16M ACCEPT     tcp  --  eth0   any     anywhere             anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:https7     146K 8774K ACCEPT     tcp  --  eth0   any     ***.***  anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:rsync8        0     0 ACCEPT     tcp  --  eth0   any     ***.***                  anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:rsync9        0     0 ACCEPT     tcp  --  eth0   any     ***.***  anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:rsync10       0     0 ACCEPT     tcp  --  eth0   any     ***.***                 anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:rsync11       0     0 ACCEPT     tcp  --  eth0   any     ***.***  anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:rsync12       0     0 ACCEPT     tcp  --  eth0   any     ***.***               anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:rsync13   37441 2246K ACCEPT     tcp  --  eth0   any     ***.***  anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:mysql14   1808K  108M ACCEPT     tcp  --  eth0   any     ***.***  anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:mysql15    127K 7640K ACCEPT     tcp  --  eth0   any     ***.***  anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:mysql16       0     0 ACCEPT     tcp  --  eth0   any     ***.***  anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:mysql17       0     0 ACCEPT     tcp  --  eth0   any     ***.***  anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:mysql18    123K 7351K ACCEPT     tcp  --  eth0   any     ***.***  anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:mysql19    872K   52M ACCEPT     tcp  --  eth0   any     ***.***  anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:mysql20       0     0 ACCEPT     tcp  --  eth0   any     ***.***                 anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:mysql21       0     0 ACCEPT     tcp  --  eth0   any     ***.***  anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:mysql22       0     0 ACCEPT     tcp  --  eth0   any     ***.***        anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:mysql23       0     0 ACCEPT     tcp  --  eth0   any     ***.***        anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:mysql24    7283  437K ACCEPT     tcp  --  eth0   any     ***.***                 anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:mysql25   82939 4976K ACCEPT     tcp  --  eth0   any     ***.***  anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:mysql26       0     0 ACCEPT     tcp  --  eth0   any     ***.***  anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:mysql27       0     0 ACCEPT     tcp  --  eth0   any     ***.***  anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:munin28       0     0 ACCEPT     tcp  --  eth0   any     ***.***  anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:1121129       0     0 ACCEPT     tcp  --  eth0   any     ***.***  anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:1121130       0     0 ACCEPT     tcp  --  eth0   any     ***.***                anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:1121131       0     0 ACCEPT     tcp  --  eth0   any     ***.***  anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:1121132       0     0 ACCEPT     tcp  --  eth0   any     ***.***        anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:1121133       0     0 ACCEPT     tcp  --  eth0   any     ***.***        anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:1121134       0     0 ACCEPT     tcp  --  eth0   any     ***.***  anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:1121135       0     0 ACCEPT     tcp  --  eth0   any     ***.***  anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:1121136       0     0 ACCEPT     tcp  --  eth0   any     ***.***                 anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:1121137   2716K  214M reject-and-log-it  all  --  any    any     anywhere             anywhereChain FORWARD (policy DROP 0 packets, 0 bytes)num   pkts bytes target     prot opt in     out     source               destinationChain OUTPUT (policy DROP 0 packets, 0 bytes)num   pkts bytes target     prot opt in     out     source               destination1       17  9792 DROP       icmp --  any    any     anywhere             anywhere             state INVALID2      64M   35G ACCEPT     all  --  any    lo      anywhere             anywhere3     104M  539G ACCEPT     all  --  any    eth0    ***.***  anywhere4    25826   21M ACCEPT     all  --  any    eth0    ***.***       anywhere5    33815   45M ACCEPT     all  --  any    eth0    ***.***  anywhere6     102K  157M ACCEPT     all  --  any    eth0    ***.***  anywhere7    33719   34M ACCEPT     all  --  any    eth0    ***.***  anywhere8        0     0 ACCEPT     all  --  any    eth0    ***.***  anywhere9     211K  495M ACCEPT     all  --  any    eth0    ***.***  anywhere10       0     0 ACCEPT     all  --  any    eth0    ***.***  anywhere11   25513   11M ACCEPT     all  --  any    eth0    ***.***  anywhere12       0     0 ACCEPT     all  --  any    eth0    ***.***  anywhere13    312K  192M ACCEPT     all  --  any    eth0    ***.***  anywhere14   39063   33M ACCEPT     all  --  any    eth0    ***.***  anywhere15   80914  157M ACCEPT     all  --  any    eth0    ***.***  anywhere16   24222   14M ACCEPT     all  --  any    eth0    ***.***  anywhere17    6129 1910K ACCEPT     all  --  any    eth0    ***.***  anywhere18    502K  127M ACCEPT     all  --  any    eth0    ***.***  anywhere19   27940   66M ACCEPT     all  --  any    eth0    ***.***  anywhere20   67238  199M ACCEPT     all  --  any    eth0    ***.***  anywhere21   2542K 6326M ACCEPT     all  --  any    eth0    ***.***  anywhere22      32  2568 reject-and-log-it  all  --  any    any     anywhere             anywhere

si demandé:
1/ conf client openvpn:
clientdev tunproto udpremote ***.*** 1194resolv-retry infinite;nobindpersist-keypersist-tunca /etc/openvpn/ca.crtcert /etc/openvpn/***.***.crtkey /etc/openvpn/***.***.keyns-cert-type servercipher AES-128-CBCcomp-lzoverb 3log-append /var/log/openvpn.log

2/ conf serveur OpenVPN
 port 1194proto udpdev tunca /etc/openvpn/easy-rsa/keys/ca.crtcert /etc/openvpn/easy-rsa/keys/dev.crtkey /etc/openvpn/easy-rsa/keys/dev.key  # This file should be kept secretdh /etc/openvpn/easy-rsa/keys/dh1024.pemserver 10.6.66.0 255.255.255.0push "route 10.10.10.0 255.255.255.0"push "route 10.6.66.0 255.255.255.0"client-config-dir /etc/openvpn/ccd#push "route 10.6.66.0 255.255.255.0"route 10.10.10.0 255.255.255.0#push "dhcp-option DNS 10.10.10.254"#push "dhcp-option DNS 8.8.8.8"#push "dhcp-option DNS 8.8.4.4"client-to-clientifconfig-pool-persist ipp.txt#duplicate-cnkeepalive 10 120cipher AES-128-CBC   # AESuser nobodygroup nogroupcomp-lzopersist-keypersist-tunstatus openvpn-status.logverb 3

En vous remerciant pour votre aide 
Configuration: Windows 7 / Firefox 47.0

Luc · Answer

Salut,


C'est pas plutôt ça qu'il faut pinger ?

10.10.10.0


Dans ta chaîne input, je ne vois pas ICMP et echo reply, tu es sûr de tes règles ?

cocoche95 · Answer

Salut,

Luc a raison, dans ta chaine OUTPUT, tu drop l'icmp : tu ne pourras jamais pinger.
De plus, tu n'a aucune règle pour autoriser des flux transitant par ton tunnel : interface tun0 ! Tu ne traite qu'avec eth0 (interface physique) donc ton tunnel monte mais aucun trafic ne sera autorisé à cause de la politique en drop et ta règle de fin en reject.

[help] OpenVPN+Firewall

2 réponses

Discussions similaires