Hello,
first of all it is possible that I have got bit crazy, because have read too many documents, howtos and stuff, so please if it is possible help me get my mind back to right way.
Situation:
I have LAN 10.1.1.0/24
VPN 10.71.67.0/24
VPN server is located outside LAN environment.
I need to route VPN clients into LAN.
for LAN clients default gw is 10.1.1.1
VPN client and gw for VPN is 10.1.1.5 there are several other systems who are VPN clients as well in same LAN, but gw should be 10.1.1.5
Or course all local systems needed to have access via VPN have static route 10.71.67.0/24 nexthop 10.1.1.5
Currently can't get access from client in completely different environment to even 10.1.1.5, but VPN addresses of course can be accessed.
On 10.1.1.5:
cat /proc/sys/net/ipv4/ip_forward
1
iptables isn't even installed on 10.1.1.5
root@server:~# dpkg -l | grep iptab
root@server:~#
VPN server.conf (ubuntu):
mode server
tls-server
local <server hostname> ## ip/hostname of server
port <port>
proto udp
dev tun
persist-key
persist-tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
tls-auth ta.key 0 # This file is secret
cipher BF-CBC # Blowfish (default)
comp-lzo
ifconfig-pool-persist ipp.txt
server 10.71.67.0 255.255.255.0
#log and security
user nobody
group nogroup
keepalive 10 120
status openvpn-status.log
verb 3
client-to-client
route 10.1.1.0 255.255.255.0
push "route 10.1.1.0 255.255.255.0"
#route 10.99.99.0 255.255.255.0
#push "route 10.99.99.0 255.255.255.0"
#route 10.88.88.0 255.255.255.0
#push "route 10.88.88.0 255.255.255.0"
#
push "route 10.71.67.0 255.255.255.0"
client-config-dir /etc/openvpn/ccd
mute-replay-warnings
mute 20
VPN client same for every client, except cert files.
client
dev tun
proto udp
remote <server hostname> <port>
resolv-retry infinite
persist-key
persist-tun
mute-replay-warnings
ca ca.crt
cert serveris.crt
key serveris.key
ns-cert-type server
tls-auth ta.key 1
cipher BF-CBC
comp-lzo
verb 3
mute 20
VPN client gw inside LAN ccd:
ifconfig-push 10.71.67.5 10.71.67.6
iroute 10.1.1.0 255.255.255.0
Routing table for LAN server without VPN:
ernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.71.67.0 10.1.1.5 255.255.255.0 UG 0 0 0 eth0
10.1.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
0.0.0.0 10.1.1.1 0.0.0.0 UG 100 0 0 eth0
Routing table for external client (win7), currently located in 10.99.99.0/24 network NATed but can connect to VPN smoothly, this network is outside my control.
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.99.99.1 10.99.99.36 276
10.1.1.0 255.255.255.0 10.71.67.18 10.71.67.17 30
10.71.67.0 255.255.255.0 10.71.67.18 10.71.67.17 30
10.71.67.16 255.255.255.252 On-link 10.71.67.17 286
10.71.67.17 255.255.255.255 On-link 10.71.67.17 286
10.71.67.19 255.255.255.255 On-link 10.71.67.17 286
10.99.99.0 255.255.255.0 On-link 10.99.99.36 276
10.99.99.36 255.255.255.255 On-link 10.99.99.36 276
10.99.99.255 255.255.255.255 On-link 10.99.99.36 276
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
169.254.0.0 255.255.0.0 On-link 169.254.71.66 276
169.254.71.66 255.255.255.255 On-link 169.254.71.66 276
169.254.255.255 255.255.255.255 On-link 169.254.71.66 276
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 169.254.71.66 276
224.0.0.0 240.0.0.0 On-link 10.71.67.17 286
224.0.0.0 240.0.0.0 On-link 10.99.99.36 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 169.254.71.66 276
255.255.255.255 255.255.255.255 On-link 10.71.67.17 286
255.255.255.255 255.255.255.255 On-link 10.99.99.36 276
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 10.99.99.1 Default
===========================================================================
ping from remote client:
C:\>ping 10.1.1.5
Pinging 10.1.1.5 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 10.1.1.5:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
C:\>ping 10.71.67.5
Pinging 10.71.67.5 with 32 bytes of data:
Reply from 10.71.67.5: bytes=32 time=15ms TTL=64
Reply from 10.71.67.5: bytes=32 time=13ms TTL=64
Reply from 10.71.67.5: bytes=32 time=122ms TTL=64
Reply from 10.71.67.5: bytes=32 time=63ms TTL=64
Ping statistics for 10.71.67.5:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 13ms, Maximum = 122ms, Average = 53ms
C:\>
