Hey Guys, first off let me start by saying thanks to the Devs and anyone who reads this thread - OpenVPN seems like a great software / community pair. I have not used it before in the past but it looks to be exactly what I'm looking for. I've been racking my brain for about a week now trying to get (what I thought would be a simple) VPN session between my LAN and a remote server. I've tried tun and tap, routing and bridging, and while I'm always to get to the point of establishing the VPN connection and pinging across the tunnel, I never seem to be able to route the way I need. I basically have the following set up. [code]LAN - 192.168.0.0/22 (Comprises of multiple Linux, Windows and Other hosts) Router - 192.168.0.1/22 bond0 (eth2 & eth3 - connects to LAN), DHCP WAN (eth0), Spare Unused (eth1) (This is a Gentoo Linux box, firewalled with NAT) Remote Server - Static IP's (eth0:0,eth0:1) (This is also a Gentoo Linux box, firewalled, no LAN or NAT, standalone) [/code] Goal: I want to have the Remote Server literally act as if it's on the 192.168.0.0/22 network via OpenVPN. My reasoning for this is that I'd like to monitor the Remote Server as a host like I do with the rest of my LAN, rather than setting up a separate instance of monitoring just for the remote server, or *shudder*, running things like SNMP over the internet. Now, when I initially started with instructions from fellow Gentoo users, I came up with this: OLD Server Config: [code]port 1194 proto tcp-server dev tap tls-server ca gateway/ca.crt cert gateway/gateway.crt key gateway/gateway.key dh gateway/dh2048.pem tls-auth ta.key 0 mode server duplicate-cn ifconfig 192.168.3.1 255.255.252.0 # openvpn gateway ifconfig-pool 192.168.3.2 192.168.3.3 255.255.252.0 # ip range for openvpn clients push "dhcp-option DNS 192.168.0.1" push "route-gateway 192.168.3.2" tun-mtu 1500 tun-mtu-extra 32 mssfix 1450 ping 10 ping-restart 120 push "ping 10" push "ping-restart 60" push "route 192.168.0.0 255.255.252.0 192.168.3.2" push "route 192.168.3.0 255.255.252.0 192.168.0.1" persist-key persist-tun comp-lzo status openvpn-status.log verb 3 [/code] OLD Client Config: [code]port 1194 proto tcp-client dev tap remote x.x.x.x resolv-retry infinite nobind tls-client ca client/ca.crt cert client/client.crt key client/client.key tls-auth ta.key 1 tun-mtu 1500 tun-mtu-extra 32 mssfix 1450 pull persist-key persist-tun comp-lzo verb 3 [/code] The problem with this, was that I could ping across the VPN tunnel (192.168.3.1 to 192.168.3.2 and vice versa), but as soon as I tried to ping from another host on the LAN (or for example, a different interface, using ping -I bond0 192.168.3.2), it would fail with Destination Host Unreachable. That sounded to me like a routing problem, and I'll save all the routes I tried (upwards of 10), as none of them really worked :). The farthest I got with this was the ability to access both networks on both sides, but bi-directional traffic was flaking. Example, Zabbix (Monitoring Software), reaches to the remote server on port 10050, and I can see that coming in bond0 and out tap0, but on the return route, it comes in tap0 on the same port but has no destination interface and is dropped (if firewall was enabled, it was picked up by generic catch all deny, else it was dropped at the interface level, ifconfig counters were incrementing). As I was stumped, I kept googling for alternatives. I stumbled across [url]http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html[/url] and it looked like a potential solution to my problem. NEW Server Config: [code]port 1194 proto tcp-server dev tap0 tls-server ca gateway/ca.crt cert gateway/gateway.crt key gateway/gateway.key dh gateway/dh2048.pem tls-auth ta.key 0 mode server duplicate-cn server-bridge 192.168.0.1 255.255.252.0 192.168.0.5 192.168.0.6 tun-mtu 1500 tun-mtu-extra 32 mssfix 1450 ping 10 ping-restart 120 push "ping 10" push "ping-restart 60" persist-key persist-tun comp-lzo status openvpn-status.log verb 3 [/code] NEW Client Config: [code]port 1194 proto tcp-client dev tap remote x.x.x.x resolv-retry infinite nobind tls-client ca client/ca.crt cert client/client.crt key client/client.key tls-auth ta.key 1 tun-mtu 1500 tun-mtu-extra 32 mssfix 1450 pull comp-lzo verb 3 persist-key persist-tun [/code] Coupled with a bridge start script: [code]#!/bin/bash br="br0" tap="tap0" eth="bond0" eth_ip="192.168.0.1" eth_netmask="255.255.252.0" eth_broadcast="192.168.3.255" for t in $tap; do openvpn --mktun --dev $t done brctl addbr $br brctl addif $br $eth for t in $tap; do brctl addif $br $t done for t in $tap; do ifconfig $t 0.0.0.0 promisc up done ifconfig $eth 0.0.0.0 promisc up ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast [/code] But now there are two problems with this setup. While I seem to be able to ping the remote server from any LAN host (or as noted above, ping -I bond0 192.168.0.5 in this case), it breaks my LAN (no more NAT). While I could do some things like SSH across the tunnel, the rest of my LAN can no longer access the internet. This also caused a slew of "martian sources" on the bridge interface with the actual source being bond0. For arguments sake, I also took eth1 on my router (spare, unused), wired it up to the network, and used it to bridge, but that also produced similar results. Firewalls were being monitored for dropped / rejected packets during the testing, as well as tap0/br0 allow all traffic rules in place. One of the things I noticed in the notes was the following, however, being a first time OpenVPN user, this note was insanely confusing based off the configuration example in the link above. I'm not sure if this has any weight on my problem or not - perhaps someone could further explain or apply it to my situation? [quote]The addresses used for local and remote should not be part of the bridged subnet -- otherwise you will end up with a routing loop.[/quote] [b]Hoping someone will be able to help me sort out this mess and achieve my goal, with a big thanks in advance for any replies :)[/b]

OpenVPN LAN to Remote Server with Bi-Directional Traffic

Cdub

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

Cdub

I managed to solve this by stripping all the extra stuff out of my config and basically reverting back to the sample configuration, making sure to basically leave it as is, with the exception of remote server address, and this wonderful comment

# Push routes to the client to allow it
# to reach other private subnets behind
# the server.  Remember that these
# private subnets will also need
# to know to route the OpenVPN client
# address pool (10.8.0.0/255.255.255.0)
# back to the OpenVPN server.
push "route 192.168.0.0 255.255.252.0"
;push "route 192.168.20.0 255.255.255.0"

I may have over complicated things in my first config attempts 🙂