OpenWrt Forum Archive

Topic: OpenVPN route traffic though third router

The content of this topic has been archived on 20 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

I have Router A (at home) connect to a Router B (at a friends house) and also connect to a Router C. All connected with OpenVPN with point to point links.

Router A network 192.168.20.0/24
Router B network 192.168.50.0/24
Router C network 192.168.100.0/24

I can ping from Router A to Router B.
I can ping from Router A to Router C
I can't ping from Router B to Router C

Router B <-----------------> Router A <--------------------> Router C

I have even setup bgpd to automatically setup router on all routers. The routes are been entered correctly.

Routes on Router A:
XXX.XXX.XXX.XXX    *                      255.255.255.255 UH    0      0        0 ppp0
192.168.100.0          10.0.2.2            255.255.255.0   UG    0      0        0 tun2
192.168.20.0            *                      255.255.255.0   U     0      0        0 br-lan
10.0.0.0                   *                      255.255.255.0   U     0      0        0 tun0
192.168.50.0            10.0.0.2            255.255.255.0   UG    0      0        0 tun0
10.0.2.0                   *                      255.255.255.0   U     0      0        0 tun2
default                     XXX.XXX.XXX.XXX 0.0.0.0         UG    0      0        0 ppp0

Can someone please tell me why I can't ping from Router B to Router C ?

bgpd will just be a waste of CPU and RAM on such a simple setup.

What do the routing tables on B and C look like?

Router C
10.0.2.1                    *                              255.255.255.255 UH    0      0        0 tun0
192.168.100.0           *                              255.255.255.0   U     0      0        0 eth0
192.168.20.0             10.0.2.1                    255.255.255.0   UG    0      0        0 tun0
192.168.50.0             10.0.2.1                    255.255.255.0   UG    0      0        0 tun0
XXX.XXX.XXX.XXX     *                              255.255.255.0   U     0      0        0 eth0
default                      XXX.XXX.XXX.XXX     0.0.0.0         UG    0      0        0 eth0


Router B
XXX.XXX.XXX.XXX   *                           255.255.255.255 UH    0      0        0 ppp0
192.168.100.0         10.0.0.1                  255.255.255.0   UG    0      0        0 tun0
192.168.20.0           10.0.0.1                  255.255.255.0   UG    0      0        0 tun0
10.0.0.0                  *                            255.255.255.0   U     0      0        0 tun0
192.168.50.0           *                            255.255.255.0   U     0      0        0 br-lan
default                    XXX.XXX.XXX.XXX   0.0.0.0         UG    0      0        0 ppp0

phoboulinos wrote:

Router C
10.0.2.1                    *                              255.255.255.255 UH    0      0        0 tun0

This netmask does not match the netmask used by router A for this network.

phoboulinos wrote:

192.168.100.0           *                              255.255.255.0   U     0      0        0 eth0
192.168.20.0             10.0.2.1                    255.255.255.0   UG    0      0        0 tun0
192.168.50.0             10.0.2.1                    255.255.255.0   UG    0      0        0 tun0
XXX.XXX.XXX.XXX     *                              255.255.255.0   U     0      0        0 eth0
default                      XXX.XXX.XXX.XXX     0.0.0.0         UG    0      0        0 eth0


Router B
XXX.XXX.XXX.XXX   *                           255.255.255.255 UH    0      0        0 ppp0
192.168.100.0         10.0.0.1                  255.255.255.0   UG    0      0        0 tun0
192.168.20.0           10.0.0.1                  255.255.255.0   UG    0      0        0 tun0
10.0.0.0                  *                            255.255.255.0   U     0      0        0 tun0
192.168.50.0           *                            255.255.255.0   U     0      0        0 br-lan
default                    XXX.XXX.XXX.XXX   0.0.0.0         UG    0      0        0 ppp0

Except for the netmask mismatch mentioned above, the routing looks OK.

I assume you have checked that there is no firewall blocking the traffic.  Another thing to check is:
sysctl -a | grep forward

These variables control whether the kernel will forward IP packets, and which interfaces to forward for.  What are they set to?  (I haven't checked what OpenWrt does with these variables.)

Other things you can do to narrow down the problem:
1. Run tcpdump on the tun0 interface of B and try to ping C from B.  You should see ICMP echo requests.  If you do not, there is something wrong on B.
2. If you do see the packets in step 1, run tcpdump on the tun0 interface of A and ping again.  If you see the packets there, then you know B is sending them to A correctly.
3. If 2 works, run tcpdump on the tun2 interface of A.  Ping again.  If you do not see the packets, there is a problem on A.
4. If 3 works, run tcpdump on the tun0 interface of C.  Ping again.  If you do not see the packets, there is an alien stealing some of the packets between A and C.  (i.e. if the packets were leaving A, they should get to C, but you may as well make sure.)

Do the same tests again in the opposite order and ping from C to B.

So just run tcpdump on each interface between the source and the destination, one at a time, to find out which step is the problem.  Once you know where to look, it will be easier to find the problem.

Ok, I did a ping from Router B to Router C while I had tcpdump running on Router C and this is what I got:

root@localhost:~# tcpdump 'icmp[0] >= 0' -i tun0
tcpdump: WARNING: arptype 65534 not supported by libpcap - falling back to cooked socket
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
05:08:45.916704 IP 10.0.0.2 > 192.168.100.1: ICMP echo request, id 24349, seq 24, length 64
05:08:46.918165 IP 10.0.0.2 > 192.168.100.1: ICMP echo request, id 24349, seq 25, length 64
05:08:47.979623 IP 10.0.0.2 > 192.168.100.1: ICMP echo request, id 24349, seq 26, length 64
05:08:48.914780 IP 10.0.0.2 > 192.168.100.1: ICMP echo request, id 24349, seq 27, length 64
05:08:50.046825 IP 10.0.0.2 > 192.168.100.1: ICMP echo request, id 24349, seq 28, length 64
05:08:50.931263 IP 10.0.0.2 > 192.168.100.1: ICMP echo request, id 24349, seq 29, length 64
05:08:51.915661 IP 10.0.0.2 > 192.168.100.1: ICMP echo request, id 24349, seq 30, length 64
05:08:52.916712 IP 10.0.0.2 > 192.168.100.1: ICMP echo request, id 24349, seq 31, length 64


So packets do get to router c. This is the end of my ideas I dont know what can cause this.

I managed to get it to ping to each other by adding routes for the point-to-point subnets that where missing. Because the ping is coming from 10.0.0.2 I added a route for that subnet and added the corresponding route to the other router as well and it pings smile. Is there a pretier way of doing this ? Should I push routes with openvpn ?

phoboulinos wrote:

I managed to get it to ping to each other by adding routes for the point-to-point subnets that where missing. Because the ping is coming from 10.0.0.2 I added a route for that subnet and added the corresponding route to the other router as well and it pings smile. Is there a pretier way of doing this ? Should I push routes with openvpn ?

Ah yes, of course.

Well, if it's only these three routers you could just do it manually.  Pushing the routes via OpenVPN should also work.

If you're going to have more and more routers connected like this, you could run RIPv2 daemons on each of them, I suppose.  It's much simpler than a BGP daemon.

Thanks very much for all your help mate.

The discussion might have continued from here.