Hello,
I need help with one particular OpenVPN setup.
I have two OpenWRT based routers.
So, here's my setup:
My goal is to reach the lan 192.168.88.0/24 form 10.20.30.0/24
Here is my setup on the server side:
modprobe tun
openvpn --mktun --dev tap11
ifconfig tap11 172.16.15.1 netmask 255.255.255.0 broadcast 172.16.15.255 up
openvpn --daemon --config /etc/openvpn/config.ovpn
sleep 60
iptables -A FORWARD -o tap11 -m state -s 10.20.30.0/24 -d 0/0 --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i tap11 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o tap11 -s 10.20.30.0/24 -d 0/0 -j MASQUERADE
and config.ovpn
local xxx.xxx.xxx.xxx
port 1194
proto udp
dev tap11
ca "/etc/openvpn/ca.crt"
cert "/etc/openvpn/server.crt"
key "/etc/openvpn/server.key"
dh "/etc/openvpn/dh1024.pem"
server-bridge 172.16.15.1 255.255.255.0 172.16.15.2 172.16.15.6
route 192.168.88.0/24 255.255.255.0 172.16.15.2
push "route 172.16.15.0 255.255.255.0 172.16.15.1"
push "ping 10"
push "ping-restart 120"
keepalive 10 120
cipher AES-128-CBC
comp-lzo
max-clients 5
persist-key
persist-tun
mute-replay-warnings
verb 3
Here is my Client Setup:
ip route add default via 192.168.88.1
echo "nameserver 192.168.88.1" 1>/etc/resolv.conf
modprobe tun
openvpn --mktun --dev tap11
openvpn --daemon --config /etc/openvpn/config.ovpn
sleep 60
iptables -A FORWARD -o br0 -m state -s 172.16.15.0/24 -d 0/0 --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i br0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o br0 -s 172.16.15.0/24 -d 0/0 -j MASQUERADE
and config.ovpn
client
dev tap11
proto udp
remote xxx.xxx.xxx.xxx 1194
nobind
persist-key
persist-tun
mute-replay-warnings
ca "/etc/openvpn/ca.crt"
cert "/etc/openvpn/client.crt"
key "/etc/openvpn/client.key"
ns-cert-type server
cipher AES-128-CBC
comp-lzo
verb 3
So as you can see I do MASQUERADE-ing on both routers. I want 172.16.15.0/24 as a "buffer" network between 10.20.30.0/24 and 192.168.88.0/24, because i don't want other clients connected to the server to have access to 10.20.30.0/24 or it's resources i don't care if they reach 192.168.88.0/24. The important for me is 10.20.30.0/24 to access 192.168.88.0/24 and remains "behind nat".
Now this is working, but there is a strange problem.
If the client looses connection to the server (lets say power failure) after reconnecting the hosts on 10.20.30.0/24 can not reach 192.168.88.0/24 anymore. There is no ping no nothing. This behavior is (for me at least) random, because sometimes after reconnect everything is working just fine.
Can someone please help me with this?
I'm testing and reading four days now :cry: and I can't resolve this one.
Please help.
