Hi Mimiko,
Thank you for the tutorial. However, after carefully going through the doc, I'm still not able to get it work. The openvpn provides firewall configuration script which uses masquerade already, that's why I pretty much follows the method-4. I also tried method-2 but I'm in bad luck.
Here is my configuration:
Server:
Default GW: 192.168.1.0
Openvpn server: eth0 - 192.168.1.132, tun0 - 10.168.0.1
OS: Centos 6.2
Client:
Default GW: 192.168.163.0
Client IP: 192.168.163.13 (tun0: 10.168.0.6)
OS: Mac OS X mountain lion
Here is the server configuration file:
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.168.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.1.0 255.255.255.0" #<- pushed server local network
route 192.168.163.0 255.255.255.0
push "route 192.168.163.0 255.255.255.0" #<- pushed remote network
client-config-dir ccd #<- iroute 192.168.163.0 255.255.255.0 added here.
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
comp-lzo
persist-key
persist-tun
log /var/log/openvpn.log
On the client side, I'm using Viscocity vpn client, and here is config file:
remote server-ip 1194 udp
persist-key
tls-client
pull
ca ca.crt
dev tun
persist-tun
comp-lzo yes
cert client.crt
key client.key
nobind
route 192.168.1.0 255.255.255.0
push "route 192.168.163.0 255.255.255.0"
push "route 192.168.1.0 255.255.255.0"
In fact, with or without last three lines in client config file doesn't make any difference.
After connecting to server, the client grants ip for tun0 at 10.168.0.6.
I can ping 192.168.1.132 and 10.168.0.1, but ping 192.168.1.135 has no response.
The route table for server is:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.168.0.2 * 255.255.255.255 UH 0 0 0 tun0
192.168.163.0 10.168.0.2 255.255.255.0 UG 0 0 0 tun0
192.168.1.0 * 255.255.255.0 U 0 0 0 eth0
10.168.0.0 10.168.0.2 255.255.255.0 UG 0 0 0 tun0
link-local * 255.255.0.0 U 1002 0 0 eth0
default 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
The client routing table is:
Internet:
Destination Gateway Flags Refs Use Netif Expire
default 192.168.163.1 UGSc 31 0 en0
10.168.0.1/32 10.168.0.5 UGSc 0 0 tun0
10.168.0.5 10.168.0.6 UH 2 0 tun0
127 127.0.0.1 UCS 0 0 lo0
127.0.0.1 127.0.0.1 UH 6 185461 lo0
169.254 link#4 UCS 0 0 en0
192.168.1 10.168.0.5 UGSc 0 0 tun0
192.168.163 link#4 UCS 3 0 en0
192.168.163.1 0:f:66:82:46:5a UHLWIir 32 23 en0 1199
192.168.163.12 0:7:63:6c:23:84 UHLWIi 0 0 en0 1199
192.168.163.13 127.0.0.1 UHS 0 0 lo0
192.168.163.255 ff:ff:ff:ff:ff:ff UHLWbI 0 9 en0
On client(
192.168.163.13) I do:
ping 192.168.1.32
"tcpdump -i tun0" on server side gave me:
listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
22:34:35.980756 IP 10.168.0.6 > 192.168.1.132: ICMP echo request, id 24364, seq 0, length 64
22:34:35.980811 IP 192.168.1.132 > 10.168.0.6: ICMP echo reply, id 24364, seq 0, length 64
22:34:36.981743 IP 10.168.0.6 > 192.168.1.132: ICMP echo request, id 24364, seq 1, length 64
22:34:36.981764 IP 192.168.1.132 > 10.168.0.6: ICMP echo reply, id 24364, seq 1, length 64
22:34:37.989415 IP 10.168.0.6 > 192.168.1.132: ICMP echo request, id 24364, seq 2, length 64
22:34:37.989434 IP 192.168.1.132 > 10.168.0.6: ICMP echo reply, id 24364, seq 2, length 64
But when I do:
ping 192.168.1.135
I got:
22:37:55.637632 IP 10.168.0.6 > 192.168.1.135: ICMP echo request, id 26156, seq 0, length 64
22:37:56.637432 IP 10.168.0.6 > 192.168.1.135: ICMP echo request, id 26156, seq 1, length 64
22:37:57.642499 IP 10.168.0.6 > 192.168.1.135: ICMP echo request, id 26156, seq 2, length 64
22:37:58.641470 IP 10.168.0.6 > 192.168.1.135: ICMP echo request, id 26156, seq 3, length 64
22:37:59.642439 IP 10.168.0.6 > 192.168.1.135: ICMP echo request, id 26156, seq 4, length 64
22:38:00.651249 IP 10.168.0.6 > 192.168.1.135: ICMP echo request, id 26156, seq 5, length 64
22:38:01.645538 IP 10.168.0.6 > 192.168.1.135: ICMP echo request, id 26156, seq 6, length 64
which exactly same as before. Seems there is no back route from 192.168.1.135 to 10.168.0.6.
Also, I explicitly added routing on router gateway to direct destination 10.168.0.0/255.255.255.0 to 192.168.1.132, so 192.168.1.135 can ping 10.168.0.1. But when ping 10.168.0.6(client), I got:
PING 10.168.0.6 (10.168.0.6) 56(84) bytes of data.
From 192.168.1.1: icmp_seq=2 Redirect Host(New nexthop: 192.168.1.132)
From 192.168.1.1: icmp_seq=3 Redirect Host(New nexthop: 192.168.1.132)
From 192.168.1.1: icmp_seq=4 Redirect Host(New nexthop: 192.168.1.132)
From 192.168.1.1: icmp_seq=5 Redirect Host(New nexthop: 192.168.1.132)
From 192.168.1.1: icmp_seq=6 Redirect Host(New nexthop: 192.168.1.132)
So I really lost here. Is there anything I done wrong?
Thanks
