Accessing Clients on Private Subnets

frap

I'm pulling my hair out with this config 🙁 I don't want anything particularly complicated. I have the following setup.

OpenVPN Server with IP Address 192.168.4.3 behind router with IP address 192.168.4.1
Second server with IP address in private LAN 192.168.4.7

I have configured OpenVPN server like so:

port 1194
proto udp
dev tun
ca ca.crt
cert hostname.crt
key hostname.key  # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.4.0 255.255.255.0"
push "redirect-gateway def1"
client-to-client
keepalive 10 120
comp-lzo
max-clients 100
persist-key
persist-tun
status openvpn-status.log
verb 3

client
dev tun
proto udp
www.example.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert Work.crt
key Work.key
ns-cert-type server
comp-lzo
verb 3

I can connect to the server fine and get the IP address 10.8.0.6 and I can ping the server's local IP address (192.168.4.3) without issue. I can see in the log that the route gets pushed fine

Fri Aug 24 11:47:24 2012 86.135.61.68:32896 [Work] Peer Connection Initiated with 86.135.61.68:32896
Fri Aug 24 11:47:24 2012 Work/86.135.61.68:32896 MULTI: Learn: 10.8.0.6 -> Work/86.135.61.68:32896
Fri Aug 24 11:47:24 2012 Work/86.135.61.68:32896 MULTI: primary virtual IP for Work/86.135.61.68:32896: 10.8.0.6
Fri Aug 24 11:47:26 2012 Work/86.135.61.68:32896 PUSH: Received control message: 'PUSH_REQUEST'
Fri Aug 24 11:47:26 2012 Work/86.135.61.68:32896 SENT CONTROL [Work]: 'PUSH_REPLY,route 192.168.4.0 255.255.255.0,redirect-gateway def1,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

I added a static route to the client

route add 10.8.0.0 mask 255.255.255.0 192.168.4.3

I have also disabled iptables and selinux.

What am I missing? Any help gratefully appreciated

maikcat

hi there,

your client ,what OS has?

if you want simple access to remote lan,you dont need redirect-gateway directive on your server config.

Michael.

frap

Client is Win7 running with full admin right.

I've removed redirect gateway from the config, same result

C:\Users\user>ping 192.168.4.3

Pinging 192.168.4.3 with 32 bytes of data:
Reply from 192.168.4.3: bytes=32 time=34ms TTL=64

Ping statistics for 192.168.4.3:
    Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 34ms, Maximum = 34ms, Average = 34ms
Control-C
^C
C:\Users\user>ping 192.168.4.1

Pinging 192.168.4.1 with 32 bytes of data:
C:\Users\user>ping 192.168.4.7

Pinging 192.168.4.7 with 32 bytes of data:

maikcat

did you enabled ip forwarding on openvpn server?

from 192.168.4.7 can you ping 10.8.0.1?

Michael.

frap

Ip forwarding is enabled, but I can't ping 10.8.0.1

[root@hostname]# sysctl -p
net.ipv4.ip_forward = 1

[root@hostname]# cat /proc/sys/net/ipv4/ip_forward
1

Do I need some rules in the iptables FORWARD chain perhaps?

maikcat

hi there,

can you disable ip tables for testing,

first try to setup routing correctly THEN create firewall rules...

one step at a time 😉

Michael.

frap

Sorry, I should have been more clear - iptables is already disabled. I've tried it with iptables on and off.