VPN Ignorance

[John R. Graham]

I'm setting up a net-vpn/openvpn based VPN server to allow my lab servers to be accessible to me while I'm on the road. It's a UDP/tun server setup roughly based on the OpenVPN Wiki article. I have a fairly robust initial setup (PKI-based bidirectional TLS authentication, certificate key usage verification, encrypted control channel) and have the routes in place such that my first on-the-road machine (a laptop) can ping (and receive responses from) select servers in my lab. Some services work (for example, my laptop can get DNS service from my lab DNS server) but other do not, including SSH, NFS, and HTTP/HTTPS.

As just one initial example, trying to SSH into a lab machine from "outside" begins the handshake, exchanges some information in both directions but hangs (from the client perspective) at

[Hu]

As to whether the tunnel should work, maybe. Routes are necessary, as are appropriate firewall rules. However, per your ssh log, you established a TCP connection to the sshd and managed to exchange cipher preferences. That tells us that both the route and the firewall are fine. You would not have gotten that far with ssh if either of those were wrong. My first guess would be that you ran afoul of an MTU issue. Small packets will work. Large ones will get dropped, and hang the connection. Comparing your failed log with a successful one here, it looks like the next step would be for the sshd to send its host key. That is probably a fairly large packet, and could trigger an MTU problem. A packet capture of the failed connection would confirm. I suggest running it on both ends. I expect to see the server send its ssh key, get no response, and keep retransmitting. I expect the client to not see the server key, ever. If so, then you should check the MTU on the VPN interface.

PermitTunnel is not relevant here. That controls whether ssh/sshd are allowed to set up an ad-hoc VPN of their own, running inside the ssh connection.

[John R. Graham]

Ah. Thank you! I've run into MTU issues in the past; should've thought of it. I'm off to mess with it a bit more. Will do captures if necessary.

- John
_________________
I can confirm that I have received between 0 and 499 National Security Letters.

[John R. Graham]

You called it in one. Thanks again.

- John
_________________
I can confirm that I have received between 0 and 499 National Security Letters.