tyler
I am in the middle of trying to upgrade my openvpn server from 2.1.1 on a physcial redhat server to 2.2.1 on a vmare redhat guest host. The other difference is that I am now trying to run the 64 bit version of all code.
I copied over the configurations including the certs, ipp.txt, and dh1024.pem files. The only modification I needed for the config file was to point to the ldap 64 bit module instead of the old 32 bit version. Can I assume that it is ok to copy over those files?
Currently, clients using openvpn 2.1 client can connect to the server just fine. The server can ping them back and they can ping the openvpn server. But they can't route to any servers or services on the lan. I am confused, because if I am using the same IP addresses and configurations, I woudn't think I would need to make any routing changes. I am wondering if maybe vmware guests need me to do something special?
The vpn client pool is 192.168.251.0/24. I can actually ping 192.168.251.1 from the core switch and any lan server. So anything can route to 192.168.251.1. But those same lan servers cannot route to any of the vpn clients at any of the other 192.168.251.x addresses except from the vpn server itself. Because I can route to 192.168.251.1 it feels like routing should be working for all 192.168.251 addresses, but it is not for vpn clients. Note: my core router does have 192.168.251.0 pointing to 144.89.40.216 (vpn server). I should also mention that the vpn server routes just fine to any lan. I also do not have a firewall running on the vpn server at this point.
Below is the server.conf:
local 144.89.40.216
port 1194
proto udp
dev tun
ca /etc/pki/tls/certs/cacert.pem
cert /etc/pki/tls/certs/cert.pem
key /etc/pki/tls/private/server.key
dh dh1024.pem
server 192.168.251.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 144.89.40.1"
push "dhcp-option DOMAIN beloit.edu"
push "route 144.89.40.216 255.255.255.255 net_gateway"
push "route 144.89.40.0 255.255.255.0"
push "route 144.89.0.0 255.255.0.0"
keepalive 10 120
tls-auth shared.key 0
comp-lzo
persist-key
persist-tun
status openvpn-status.log
Below is the client vpn conf:
client
dev tun
proto udp
remote 144.89.40.216 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca cacert.cer
tls-auth shared.key 1
comp-lzo
verb 3
auth-user-pass
Any thoughts on why vpn clients might not be able to route beyond the vpn server?
Tim
