Network design

buksy

Hello, could you help me design my network?

My home lan is
192.168.1.0/24
GW - 192.168.1.254
Server (vpn) ip - 192.168.1.1

My ip from isp is 10.32.229.30
And I have also public ip assigned

How should I design my server vpn settings so that, ips to vpn clients would be from pool 192.168.200.1 - 192.168.200.31 and clients could reach each other.

This my current settings on server:

mode server
port 1194
proto udp
dev tap0
persist-key
persist-tun
ca keys/ca.crt
cert keys/server.crt
key keys/server.key  # This file should be kept secret
dh keys/dh1024.pem

cipher BF-CBC   # Blowfish (default)
comp-lzo        # compression
client-to-client

ifconfig-pool-persist ipp.txt
#local 192.168.200.1
server-bridge 192.168.200.1 255.255.255.0 192.168.200.2 192.168.200.31

max-clients 10
user nobody
group nogroup
keepalive 10 120
status openvpn-status.log
verb 3
script-security 3 system

I'm able to connect to my vpn network, I can ping server from clients, but I cant ping any client from server neither ping client to client. How to fix it?
Do I need to push any route to clients? Isnt problem that when client connects, it got for example ip 192.168.200.3 but server ip is from different network 192.168.1.1?
Is it possible to set servers ip to "192.168.200.1" even though its real local ip is 192.168.1.1?

Thank you 🙂

janjust

why are you using bridging. Instead of

dev tap0
server-bridge 192.168.200.1 255.255.255.0 192.168.200.2 192.168.200.31

try using

dev tun
server 192.168.200.1 255.255.255.0 
topology subnet

(and use 'dev tun' on the client as well)

buksy

Because I read everywhere its better for gaming 🙂 ... I gues in tun only L3 traffic is forwarded and in tap L2+L3 is forwarded? ...

But thank you for reply, I will try if tun is suitable for my needs...

buksy

I've just tried tun settings

dev tun
server 192.168.200.0 255.255.255.0
topology subnet

but Im still unable to ping any client from server or ping client to clieng

janjust

yes , in 'tap' mode L2+L3 is forwarded; bridging is an extension of this, where your local network adapter is bridged to the tap adapter: this means that all traffic that hits the local network adapter is copied over to the tap0 adapter and vice versa. There are several drawbacks to using bridging - if your games work without it, then don't use bridging. If your games require L2 forwarding (e.g. IPX) then use 'dev tap' (with 'server ....')

Can the VPN client ping the VPN IP of the server (192.168.200.1) ?
Is 'client-to-client' still present? in that case the clients should be able to see each other; however, Vista/Win7 block ping access to the tap-win32 adapter by default - which OS are you using client side? Try temporarily disabling the firewalls on the clients to see if that helps.

buksy

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.