[resolved] Route Between Different Istances

GrG

Hello,

i'll briefly describe my use case. My VPN is divided in 2 "rings": the main one, where there are all "services", and another one, with "clients".

The first ring, is based on TAP tunnels. The second is based on TUN tunnels. Of couse, I want 2 rings to be able to reach each other. I think to achieve that I could use 2 physically separated OpenVPN servers, each running its istance and connected (as a client) to the other server. Then I could use route, route push and iroute lines in config files to make all subnets reachable.

But, i'd prefer to have a single server, running 2 OpenVPN istances. I've installed that, and configured it like this:

Istance1:

port 1194
dev tap
server 10.11.12.0 255.255.255.0
push "route 192.168.12.0 255.255.255.0"
route 192.168.12.0 255.255.255.0

Istance2:

port 1294
dev tun
server 192.168.12.0 255.255.255.0
push "route 10.11.12.0 255.255.255.0"
;route 10.11.12.0 255.255.255.0

Please notice the last disabled line in the Istance2's configuration file. If I leave it enabled I get an inconsitent routing table:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
...
10.11.12.0      192.168.12.2    255.255.255.0   UG    0      0        0 tun0
10.11.12.0      0.0.0.0         255.255.255.0   U     0      0        0 tap0
...

Enabling or disabling it in Istance1's configuration, doesn't actually change anything.

Ok. With this setup routes are correctly pused to both istance's clients. From every client I can ping the server on its 2 IPs. But, from a client, I can't ping another client.

Can you please give me any advice? I've been debugging and looking for solutions in the internet for the last 2 days but without results.

Thankyou.

janjust

by default, clients within a VPN cannot ping/reach each other; add

client-to-client

to the server config to allow clients to see each other within one ring.

To allow clients between different rings to see each other some more routing info is needed. Also, do the clients know where to route stuff back to?

GrG

Janjust: yes that line actually exists. I've only posted relevant lines to keep the topic clean (posting hundreads of lines makes topics almost impossible to read).

Anyway, we are a bunch of idiots. A coworker had disabled ip_forward tonight and i've just noticed that. Re-enabling it this works perfectly.

Just a clarification: am i supposed to put the "route" config directive if I am willing my clients to be able to reach subnets hosted directly behind the server? As said in the tap setup this breaks things, in the tun setup doesn't make any difference.

Thankyou so much for your help!