[SOLVED]Make 2 clients c each other subnet w/o client-to-...

Yasso

Hi,

I have 10 clients connected to an OpenVPN server, and I want to make two of them (client A and B) see each other subnet without using client-to-client. I found a similar topic on this forum talking about this kind of needs, but it didn't help much.

Here is my configuration, made with the help of the OpenVPN Cookbook :

- Server VPN address : 192.168.200.1
- Configuration as a routed VPN, TUN using TCP
- Client A VPN adress : 192.168.200.151
- Client A subnet IP : 192.168.251.1/24
- Client B VPN adress : 192.168.200.11
- Client B subnet IP : 192.168.131.1/24

I don't use client-to-client in my server.conf file, because I don't want all the client to see each other.

This is what I have in server.conf regarding the routing :
#Pushing the server's adress
push "route 192.168.200.0 255.255.255.0"
#Internal routes for clients subnets :
[...] --> other clients
route 192.168.131.0 255.255.255.0 192.168.200.1
route 192.168.251.0 255.255.255.0 192.168.200.1

This is the client A ccd file :
ifconfig-push 192.168.200.151 255.255.255.0
iroute 192.168.251.0 255.255.255.0

This is the client B ccd file :
ifconfig-push 192.168.200.11 255.255.255.0
iroute 192.168.131.0 255.255.255.0

Note : the two clients are actually two dd-wrt's routers. Everything is working fine for now. The two client's can ping each other's VPN address.
I would like to make, at least, client B see client's A subnet. I tried with adding push "route 192.168.251.0 255.255.255.0" in the server.conf file, but with no success.

I tried many combinations with SPI firewall disabled on both routers. I'll also say that I can reach client's subnets from the server just fine, I just want to do it from clients.

Do you have any pointers for resolving this issue ? Any help would be much appreciated.

Regards,

Mimiko

The "client-to-client" directive is a must for OpenVPN server in order to be able to route internally packets. The blocket clients may be configured by iptable rules.

Yasso

I actually got some help on the IRC channel last night.

To achieve this, I had to add two push route statements in my server.conf file, for the two clients subnets.

And then tweak server's iptables rules, to allow forwarding. And voilà !! works like a charm.

Thanks to everyone !

Hansiste

To achieve this, I had to add two push route statements in my server.conf file, for the two clients subnets.

And then tweak server's iptables rules, to allow forwarding.

It would be great to have the exact commands/config-lines for your example, to learn from it.
Would you mind sharing them?

Thanks,
Johannes

Yasso

No problem :

In client's A ccd file, I added
push "route 192.168.131.0 255.255.255.0"

Same in client B ccd file :
push "route 192.168.251.0 255.255.255.0"

Then I only added a new server iptable rule (the openvpn server), in the FORWARD chain to allow forwarding on what's comming on the tun interface.

Then everything worked great, these are the only two clients that can see each other subnets, through the dd-wrt's routers. Initially the two push statements were on the server.conf file, but now that I put them into the ccds, it's much better as they are the only two clients that can see each other.

happyrose

I had a similar installation, I read a lot of the info on janjust's cookbook url: http://www.nikhef.nl/~janjust/vpn/OpenVPN2-Cookbook/index.html and was able to get the jist of it. As you mentioned you need to create a tunnel then using iptables you have the ability to route only packets for that specific Ip tunnel. Finding routing software to use with windows looks like a tough road to hoe. If you don't mind, let me know if you were able to achieve this with Windows.