I've used OpenVPN successfully for a few years in a setup where we had topology subnet with all clients and servers connected to the OpenVPN server. After seeking some advice on the IRC channel, I now want to try a different setup where we'd add routes to handle traffic, similar to this diagram:
http://www.gliffy.com/pubdoc/3924247/L.png. I've done a test setup with the configs below, for the client:
client
dev tun
remote backup.kentyde.com
nobind
ca kentyde.crt
cert client.crt
key client.key
mtu-test
mute 3
and for the server:
port 1194
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
topology subnet
server 10.64.0.0 255.255.0.0
push "route 192.168.1.0 255.255.255.0"
keepalive 60 120
persist-key
persist-tun
user openvpn
group openvpn
log-append /var/log/openvpn.kentyde2.log
verb 3
mute 5
so that I end up with these routes:
on 192.168.1.16:
10.64.0.0 * 255.255.0.0 U 0 0 0 tun1
192.168.1.0 * 255.255.255.0 U 0 0 0 eth2
on 192.168.1.15:
10.64.0.0 192.168.1.16 255.255.0.0 UG 0 0 0 eth0
192.168.1.0 * 255.255.255.0 U 0 0 0 eth0
on external client:
10.64.0.0 255.255.0.0 On-link 10.64.0.2 286
10.64.0.2 255.255.255.255 On-link 10.64.0.2 286
10.64.255.255 255.255.255.255 On-link 10.64.0.2 286
192.168.1.0 255.255.255.0 10.64.0.1 10.64.0.2 30
The ideas is that client can just connect to 192.168.1.x (I will change the range of addresses because it's too likely to conflict, but this is just for testing). ping 192.168.1.16 from the client works (192.168.1.16 is where the OpenVPN server runs), however ping 192.168.1.15 doesn't work. From checking tcpdump, it looks like 192.168.1.16 is getting the echo requests, but they aren't getting from there to 192.168.1.15. It seems like the routes on 192.168.1.16 should handle this, so what am I missing?
