I have been playing with openvpn. Works great to establish a connection to a remote firewalled host.
Problem:
I have a rip IPIP gateway. I have subnets 44.92.20.0/24 and 44.92.21.0/24 set in the portal
44.92.20.1 is my ampr gateway address. That is working, pingable.
tunl0 Link encap:IPIP Tunnel HWaddr inet addr:44.92.21.1 Mask:255.0.0.0 UP RUNNING NOARP MULTICAST MTU:1480 Metric:1 RX packets:138952 errors:0 dropped:0 overruns:0 frame:0 TX packets:89710 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:37916347 (36.1 MiB) TX bytes:15979452 (15.2 MiB)
I have a openvpn server also running on this box. It's address is 44.92.20.1. The client connecting is: 44.92.20.6
The server can ping the client, the client can ping the server.
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:44.92.20.1 P-t-P:44.92.20.2 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:12 errors:0 dropped:0 overruns:0 frame:0 TX packets:9 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:1184 (1.1 KiB) TX bytes:756 (756.0 B)
I don't understand why 44.92.20.6 is not reachable from the outside world?
(If nothing else, you'd think some simple route add command would make is so)
And yes I have these routes for the IPIP gateway:
/sbin/ip route add default via 169.228.66.251 dev tunl0 proto static onlink table 10
/sbin/ip rule add from 44.92.21.0/24 table 10 /sbin/ip rule add from 44.92.20.0/24 table 10
Can anyone see anything I am overlooking?
Hi,
The first obvious thing is to check if ip forwarding is enabled, cat /proc/sys/net/ipv4/ip_forward - I usually forget that. It's disabled by default, the proper way to enable it is to have net.ipv4.ip_forward=1 in /etc/sysctl.conf.
Next thing to check is iptables forwarding rules.
- Hessu
On Mon, May 13, 2013 at 9:29 PM, kb9mwr@gmail.com wrote:
(Please trim inclusions from previous messages) _______________________________________________ I have been playing with openvpn. Works great to establish a connection to a remote firewalled host.
Problem:
I have a rip IPIP gateway. I have subnets 44.92.20.0/24 and 44.92.21.0/24 set in the portal
44.92.20.1 is my ampr gateway address. That is working, pingable.
tunl0 Link encap:IPIP Tunnel HWaddr inet addr:44.92.21.1 Mask:255.0.0.0 UP RUNNING NOARP MULTICAST MTU:1480 Metric:1 RX packets:138952 errors:0 dropped:0 overruns:0 frame:0 TX packets:89710 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:37916347 (36.1 MiB) TX bytes:15979452 (15.2 MiB)
I have a openvpn server also running on this box. It's address is 44.92.20.1. The client connecting is: 44.92.20.6
The server can ping the client, the client can ping the server.
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:44.92.20.1 P-t-P:44.92.20.2 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:12 errors:0 dropped:0 overruns:0 frame:0 TX packets:9 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:1184 (1.1 KiB) TX bytes:756 (756.0 B)
I don't understand why 44.92.20.6 is not reachable from the outside world?
(If nothing else, you'd think some simple route add command would make is so)
And yes I have these routes for the IPIP gateway:
/sbin/ip route add default via 169.228.66.251 dev tunl0 proto static onlink table 10
/sbin/ip rule add from 44.92.21.0/24 table 10 /sbin/ip rule add from 44.92.20.0/24 table 10
Can anyone see anything I am overlooking? _________________________________________ 44Net mailing list 44Net@hamradio.ucsd.edu http://hamradio.ucsd.edu/mailman/listinfo/44net http://www.ampr.org/donate.html
the ip rule commands have use the interface IP, not a network/mask pair.
Something like /sbin/ip rule add from 44.92.20.1 table 10 meaning traffic from interface with IP 44.92.20.1 will be handled by table 10
73 de Marius, YO2LOJ
-----Original Message----- From: 44net-bounces+marius=yo2loj.ro@hamradio.ucsd.edu [mailto:44net-bounces+marius=yo2loj.ro@hamradio.ucsd.edu] On Behalf Of kb9mwr@gmail.com Sent: Monday, May 13, 2013 21:30 To: 44net@hamradio.ucsd.edu Subject: Re: [44net] private tunnel?
(Please trim inclusions from previous messages) _______________________________________________ I have been playing with openvpn. Works great to establish a connection to a remote firewalled host.
Problem:
I have a rip IPIP gateway. I have subnets 44.92.20.0/24 and 44.92.21.0/24 set in the portal
44.92.20.1 is my ampr gateway address. That is working, pingable.
tunl0 Link encap:IPIP Tunnel HWaddr inet addr:44.92.21.1 Mask:255.0.0.0 UP RUNNING NOARP MULTICAST MTU:1480 Metric:1 RX packets:138952 errors:0 dropped:0 overruns:0 frame:0 TX packets:89710 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:37916347 (36.1 MiB) TX bytes:15979452 (15.2 MiB)
I have a openvpn server also running on this box. It's address is 44.92.20.1. The client connecting is: 44.92.20.6
The server can ping the client, the client can ping the server.
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:44.92.20.1 P-t-P:44.92.20.2 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:12 errors:0 dropped:0 overruns:0 frame:0 TX packets:9 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:1184 (1.1 KiB) TX bytes:756 (756.0 B)
I don't understand why 44.92.20.6 is not reachable from the outside world?
(If nothing else, you'd think some simple route add command would make is so)
And yes I have these routes for the IPIP gateway:
/sbin/ip route add default via 169.228.66.251 dev tunl0 proto static onlink table 10
/sbin/ip rule add from 44.92.21.0/24 table 10 /sbin/ip rule add from 44.92.20.0/24 table 10
Can anyone see anything I am overlooking? _________________________________________ 44Net mailing list 44Net@hamradio.ucsd.edu http://hamradio.ucsd.edu/mailman/listinfo/44net http://www.ampr.org/donate.html
Ok. I am not sure anymore about that... I could be wrong.
-----Original Message----- From: 44net-bounces+marius=yo2loj.ro@hamradio.ucsd.edu [mailto:44net-bounces+marius=yo2loj.ro@hamradio.ucsd.edu] On Behalf Of Marius Petrescu Sent: Monday, May 13, 2013 21:44 To: 'AMPRNet working group' Subject: Re: [44net] private tunnel?
(Please trim inclusions from previous messages) _______________________________________________ the ip rule commands have use the interface IP, not a network/mask pair.
Something like /sbin/ip rule add from 44.92.20.1 table 10 meaning traffic from interface with IP 44.92.20.1 will be handled by table 10
73 de Marius, YO2LOJ
-
Heikki Hannikainen -
kb9mwr＠gmail.com -
Marius Petrescu