This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

OpenVPN pool can't open Webadmin interface

Hi,

I just added our VPN pool network to Webadmin's allowed network section. But it does not work. I also added my user name to that list but it does not work either. Every other items on the allowed network list can open webadmin but Openvpn IPs just timeout. There is nothing wrong about VPN usage as the package filters etc works perfectly.

Is this a known problem?

This thread was automatically locked due to age.

Parents

0 Scott_Klassen over 14 years ago

Actually the way that you have things setup now shouldn't work. For any resources that you want accessible from both internal and external clients, you should have two DNS records. One on internal DNS, pointing to the internal Natted IP address and one with an external DNS provider pointing to your WAN IP address. It's called split-brain DNS (google away). Having an internal client try to access your WAN IP shouldn't work as it would be an undefined loop. It's possible that your ISP has put a route on their router saying that anything coming from your WAN IP address, destined for your WAN IP address, should be turned back around and sent back the way it came from, but that's not common.

From both an internal and VPN client, what is the result when you do an NSLOOKUP for your external URL? Also, what do you have set as local networks for SSL VPN (If you have it set for Internal (Network), then your clients will be setup for split-tunnel. If Any, then it is full tunnel)?
Cancel
Vote Up 0 Vote Down

Cancel
0 rahman over 14 years ago in reply to Scott_Klassen
For any resources that you want accessible from both internal and external clients, you should have two DNS records.  One on internal DNS, pointing to the internal Natted IP address and one with an external DNS provider pointing to your WAN IP address.  It's called split-brain DNS (google away).

I don't get it. This is a university network and we host our DNS server for our domain. Why do I need two DNS records? Internal clients can access any external ip of Astaro without any problem.

Having an internal client try to access your WAN IP shouldn't work as it would be an undefined loop.  It's possible that your ISP has put a route on their router saying that anything coming from your WAN IP address, destined for your WAN IP address, should be turned back around and sent back the way it came from, but that's not common.

Again I don't understand why it shouldn't work. As I say internal clients can access astaros wan interface. And I really wonder what is different in Astaro that should prevent it to work like that. Any L3 switch or router is clever enough to know ip interfaces defined on them. And you can access them with any ip of them. Like our backbone switch; it has +20 vlans defined on it, and you can access it with any of these interface IPs, it doesn't matter which interface you connect from. I think Astaro is no exception. Its just a router and external interface has nothing special; its just a interface on a router that has 0.0.0.0 0.0.0.0 ***.***.***.*** default route.

So if you say internal clients should not/can not access Astaro with external interface ip, I disagree. They can/should perfectly reach Astaro via any interface ip of it as long as they are in UP state. But if you say it doesn't work this way with VPN, I have no objection as I don't know the internals.

From both an internal and VPN client, what is the result when you do an NSLOOKUP for your external URL?

For internal and VPN, same results:
$ nslookup mx1.foo.bar
Server:         7x.***.***.51
Address:        7x.***.***.51#53

Name:   mx1.foo.bar
Address: 7x.***.***.2

as expected.

Also, what do you have set as local networks for SSL VPN (If you have it set for Internal (Network), then your clients will be setup for split-tunnel.  If Any, then it is full tunnel)?

It is predefined Astaro VPN pool network: 10.242.2.0/24 not any of the internal networks.

Thanks.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 rahman over 14 years ago in reply to Scott_Klassen
For any resources that you want accessible from both internal and external clients, you should have two DNS records.  One on internal DNS, pointing to the internal Natted IP address and one with an external DNS provider pointing to your WAN IP address.  It's called split-brain DNS (google away).

I don't get it. This is a university network and we host our DNS server for our domain. Why do I need two DNS records? Internal clients can access any external ip of Astaro without any problem.

Having an internal client try to access your WAN IP shouldn't work as it would be an undefined loop.  It's possible that your ISP has put a route on their router saying that anything coming from your WAN IP address, destined for your WAN IP address, should be turned back around and sent back the way it came from, but that's not common.

Again I don't understand why it shouldn't work. As I say internal clients can access astaros wan interface. And I really wonder what is different in Astaro that should prevent it to work like that. Any L3 switch or router is clever enough to know ip interfaces defined on them. And you can access them with any ip of them. Like our backbone switch; it has +20 vlans defined on it, and you can access it with any of these interface IPs, it doesn't matter which interface you connect from. I think Astaro is no exception. Its just a router and external interface has nothing special; its just a interface on a router that has 0.0.0.0 0.0.0.0 ***.***.***.*** default route.

So if you say internal clients should not/can not access Astaro with external interface ip, I disagree. They can/should perfectly reach Astaro via any interface ip of it as long as they are in UP state. But if you say it doesn't work this way with VPN, I have no objection as I don't know the internals.

From both an internal and VPN client, what is the result when you do an NSLOOKUP for your external URL?

For internal and VPN, same results:
$ nslookup mx1.foo.bar
Server:         7x.***.***.51
Address:        7x.***.***.51#53

Name:   mx1.foo.bar
Address: 7x.***.***.2

as expected.

Also, what do you have set as local networks for SSL VPN (If you have it set for Internal (Network), then your clients will be setup for split-tunnel.  If Any, then it is full tunnel)?

It is predefined Astaro VPN pool network: 10.242.2.0/24 not any of the internal networks.

Thanks.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data