I'm sure there is answered somewhere, but how to search for it?? Unsuccessful so far.
Here is the configuration. We have a private subnet in a data center 196.168.17.0
We have a subnet at the office 192.168.0.0
These are connected through 2 machines running openVPN over a virtual subnet 10.3.0.0
We (the PCs using DHCP) can connect to the data center no problem. I have had to add static routing to the servers on the datacenter side so that they would communicate back to the servers on the office side that talk to them.
We have another openVPN machine for connecting to the office from on the road/home. That one dishes out IPs in the 192.168.0.100+ range. This works great.
However, I cannot connect to the datacenter from home by connecting to the office vpn. I know there is a routing/bridging issue involved, but I do not have the necessary knowledge of the guts of networking to determine the problem. What little tweak remains in order for me to be able to connect to the datacenter by VPNing into the office and going through the tunnel to the datacenter?
The configs, editted for brevity and to remove external information:
Office tunnel to datacenter:
dev tapashville
port 5000
tls-client
ifconfig 10.3.0.2 255.255.255.0
route 192.168.17.0 255.255.255.0 10.3.0.1
Office firewall items:
-A INPUT -i eth1 -j ACCEPT
-A INPUT -i tap+ -j ACCEPT
*mangle
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
đŸ˜›REROUTING ACCEPT [0:0]
đŸ˜›OSTROUTING ACCEPT [0:0]
COMMIT
Office bridge-start script:
# Define Bridge Interface
br="br0"
# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap1"
# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth0"
eth_ip="192.168.0.220"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.0.255"
for t in $tap; do
/usr/sbin/openvpn --mktun --dev $t
done
/usr/sbin/brctl addbr $br
/usr/sbin/brctl addif $br $eth
for t in $tap; do
/usr/sbin/brctl addif $br $t
done
for t in $tap; do
/sbin/ifconfig $t 0.0.0.0 promisc up
done
/sbin/ifconfig $eth 0.0.0.0 promisc up
/sbin/ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast
Office routing:
192.168.17.0 10.3.0.1 255.255.255.0 UG 0 0 0 tapashville
192.168.0.0 * 255.255.255.0 U 0 0 0 eth1
10.3.0.0 * 255.255.255.0 U 0 0 0 tapashville
169.254.0.0 * 255.255.0.0 U 0 0 0 eth1
Road VPN into office config:
server-bridge 192.168.0.220 255.255.255.0 192.168.0.101 192.168.0.199
dhcp-option DNS 192.168.0.240
Road VPN bridge start
br="br0"
# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap1"
# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth0"
eth_ip="192.168.0.220"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.0.255"
for t in $tap; do
/usr/sbin/openvpn --mktun --dev $t
done
/usr/sbin/brctl addbr $br
/usr/sbin/brctl addif $br $eth
for t in $tap; do
/usr/sbin/brctl addif $br $t
done
for t in $tap; do
/sbin/ifconfig $t 0.0.0.0 promisc up
done
/sbin/ifconfig $eth 0.0.0.0 promisc up
/sbin/ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast
Road VPN routing:
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.17.0 192.168.0.240 255.255.255.0 UG 0 0 0 br0
192.168.0.0 * 255.255.255.0 U 0 0 0 br0
192.168.0.0 * 255.255.255.0 U 0 0 0 eth0
10.3.0.0 192.168.0.240 255.255.255.0 UG 0 0 0 br0
169.254.0.0 * 255.255.0.0 U 0 0 0 eth1
Datacenter routing:
192.168.17.0 * 255.255.255.0 U 0 0 0 eth0
192.168.0.0 10.3.0.2 255.255.255.0 UG 0 0 0 tap-hq
10.3.0.0 * 255.255.255.0 U 0 0 0 tap-hq
link-local * 255.255.0.0 U 1002 0 0 eth0
link-local * 255.255.0.0 U 1003 0 0 eth1
