Solved FIB routing Issue

S

sandeep266

Hello All,

I have set up two routing tables on my FreeBSD 10 stable router.
  • On fib0, I have OpenVPN server for access to my local network (10.10.10.0/24).
  • On fib1, I have transmission daemon listening on 10.10.10.10:9091.
My problem is that I am unable to access transmission web UI on fib1 through OpenVPN server. I can access it through local lan which is on the same fib as the vpn server. I've configure OpenVPN server to push route 10.10.10.0/24 to connecting clients. VPN server allocates addresses from 10.10.11.0/24 pool to clients. Any pointers will be helpful. netstat -r4 outputs below

Code: 
Routing tables

Internet:
Destination        Gateway            Flags      Netif Expire
default            10.20.21.93        UGS        tun0
10.10.10.0         link#6             U         lagg0
bnx                link#6             UHS         lo0
10.10.11.0         10.10.11.2         UGS        tun1
10.10.11.1         link#9             UHS         lo0
10.10.11.2         link#9             UH         tun1
10.10.12.0         link#7             U         vlan0
10.20.21.93        link#8             UHS        tun0
10.138.1.5         link#10            UH         tun2
10.138.1.6         link#10            UHS         lo0
xx.xx.xx.xx        link#8             UHS         lo0
localhost          link#5             UH          lo0

Code: 
Routing tables (fib: 1)

Internet:
Destination        Gateway            Flags      Netif Expire
default            10.138.1.5         UGS        tun2
10.10.10.0         link#6             U         lagg0
10.10.11.2         link#9             UH         tun1
10.10.12.0         link#7             U         vlan0
10.10.12.10        link#7             UHS         lo0
10.20.21.93        link#8             UH         tun0
10.138.1.5         link#10            UH         tun2
localhost          link#5             UH          lo0

cat /etc/pf.conf output

Code: 
## Macros
# Interfaces
ext = "tun0"
int = "lagg0"
vpn = "tun1"
v2p = "tun2"
localnet = $int:network
vpnnet = "10.10.11.0/24"
broken="224.0.0.22 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 169.254.0.0/16, 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, 169.254.0.0/16, 240.0.0.0/4, 255.255.255.255/32"

## Tables
# Open ports
tcps = "{22}"
udps = "{1194}"
p2p = "{4662,4665,4672,51413,60595}"
table <fail2ban> persist

## Options
set block-policy drop
set state-policy if-bound
set loginterface $ext
set skip on lo

## Traffic Normalization
scrub in all no-df max-mss 1440

## Translation
# NAT
nat on $ext from $localnet to any -> ($ext)
nat on $ext from $vpnnet to any -> ($ext)

# Filters
antispoof quick for $ext
block out quick inet6 all
block in quick inet6 all
block in quick from {$broken no-route} to any
block in quick on $ext from <fail2ban> to any
block in log all
pass inet proto icmp icmp-type echoreq keep state
pass in on $ext inet proto tcp from any to any port $tcps
pass in on $ext inet proto udp from any to any port $udps
pass in on $v2p inet proto {tcp, udp} from any to any port $p2p rtable 1
pass in on $int all
pass in on $vpn all
pass out all

My openvpn server.conf
Code: 
port 1194
proto udp
dev tun1
ca ./keys/ca.crt
cert ./keys/server.crt
key ./keys/server.key
dh ./keys/dh2048.pem
server 10.10.11.0 255.255.255.0
route 10.10.10.0 255.255.255.0
push "route 10.10.10.0 255.255.255.0"
route 10.10.12.0 255.255.255.0
push "route 10.10.12.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.10.10.10"
push "dhcp-option DOMAIN blabla.hehe"
client-to-client
keepalive 10 120
tls-auth ./keys/ta.key 0
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log-append  /var/log/openvpn.log
plugin /usr/local/lib/openvpn/plugins/openvpn-plugin-auth-pam.so login
verb 3

All the help is appreciated.

Thanks guys
 
So FIB stuff can get pretty confusing. When OpenVPN starts it will assign the address on the tunnel interface as a point to point interface. It also adds a route for the network. That route for the 10.10.11.0/24 is getting added by OpenVPN but only to the default FIB. Currently your traffic travels through the VPN and touches the service while replies from Transmission travel out the default route on FIB 1 to 10.138.1.5 rather than back out the VPN like you had hoped.

I would think something like this might work in your /etc/rc.conf
Code: 
static_routes="vpnnetwork"
route_vpnnetwork="-net 10.10.11.0/24 -interface tun0 -fib 1"

Alternately, something very similar in an up script for OpenVPN might work as long as you accommodate FIB 1 knowing about the network of your VPN subnet.
 
Thank you so much junovitch.

I've added this route on the fly over 10 times using the route command, but I neglected -net all the time for some reason. Once I looked at your post I realized what I was doing wrong. Thanks for the superb explanation!
 
You must log in or register to reply here.
Back
Top