I have an openvpn server running on 10.8.0.0/16 that pushes the subnet 10.10.0.0/16 (a docker network) to the client.
I can ping 10.10.0.0/16 from the client but I cannot curl from the client.
This is my openvpn server config file:
port 1194
proto udp
dev tun
ca ca.crt
cert cert.crt
key key.key
dh dh.pem
crl-verify /etc/openvpn/crl.pem
topology subnet
server 10.8.0.0 255.255.0.0
push "route 10.10.0.0 255.255.0.0"
ifconfig-pool-persist /var/log/openvpn/ipp.txt
keepalive 10 120
tls-auth ta.key 0
cipher AES-256-CBC
data-ciphers AES-256-CBC
max-clients 10000
user openvpn
group openvpn
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 5
explicit-exit-notify 3
This is my iptables configuration:
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:FILTERS - [0:0]
:DOCKER-USER - [0:0]
-F INPUT
-F DOCKER-USER
-F FILTERS
-A INPUT -i lo -j ACCEPT
-A INPUT -j FILTERS
-A DOCKER-USER -i eno1 -j FILTERS
-A FILTERS -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FILTERS -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A FILTERS -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A FILTERS -m state --state NEW -m udp -p udp --dport 1194 -j ACCEPT
-A FILTERS -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A FILTERS -j REJECT --reject-with icmp-host-prohibited
COMMIT
TCP dump on tun0
I get the following dump with a ping from a client to 10.10.0.0/16:
12:32:19.853116 IP 10.8.0.4 > 10.10.0.2: ICMP echo request, id 54816, seq 0, length 64
12:32:19.853195 IP 10.10.0.2 > 10.8.0.4: ICMP echo reply, id 54816, seq 0, length 64
I get the following dump with a curl from a client to 10.10.0.0/16:
12:32:53.055557 IP 10.8.0.4.60325 > 10.10.0.2.http: Flags [SEW], seq 604589721, win 65535, options [mss 1289,nop,wscale 6,nop,nop,TS val 2263745723 ecr 0,sackOK,eol], length 0
Traceroute from a client
traceroute to 10.10.0.2 (10.10.0.2), 64 hops max, 52 byte packets
1 10.8.0.1 (10.8.0.1) 32.141 ms 26.429 ms 28.222 ms
2 *
routel
10.8.0.0/ 16 10.8.0.1 kernel link tun0
10.10.0.0/ 16 10.10.0.1 kernel linkbr-bccab256f527
10.20.0.0/ 16 10.20.0.1 kernel linkdocker0
10.255.255.1 link eth0
10.255.255.1 217.160.195.18 dhcp link eth0
10.8.0.1 local 10.8.0.1 kernel host tun0 local
10.8.255.255 broadcast 10.8.0.1 kernel link tun0 local
10.10.0.1 local 10.10.0.1 kernel hostbr-bccab256f527 local
10.10.255.255 broadcast 10.10.0.1 kernel linkbr-bccab256f527 local
10.20.0.1 local 10.20.0.1 kernel hostdocker0 local
10.20.255.255 broadcast 10.20.0.1 kernel linkdocker0 local
How can I fix this issue and be able to curl 10.10.0.0/16 from a client connected to my openvpn server?
I verified the routes in iptables, I rebooted the system, I deleted and recreated the 10.10.0.0/16 subnet, I tweaked the openvpn server config options, and tried everything else that I read on the internet. Nothing seems to work though.
FYI: Everything was working fine until a few days ago when I partitioned my server to mount my docker containers on a dedicated xfs partition. I did reinstate the default settings for my docker containers since then (I even uninstalled and reinstalled docker).
