I've been working through Jan Just's really helpful cookbook and learnt a great deal but I've run into a problem that has me stumped. I'm trying to create an OpenVPN link that will permit subnets of both the client and server mutually to reach each other - though I don't need a full bridging solution.
The OpenVPN link is up and running with no problem. The client can reach the server and behind to the subnet which the server lives on. Similarly, the server can reach the client and the client's subnet. An arbitrary member of the client subnet can reach the OpenVPN address for the server, but not the server's LAN address (and vice versa). Consequently, I can't get arbitrary computers on te two subnets to talk to each other.
Server network: Server 10.231.0.100, Server OpenVPN address 192.168.200.1, Router/Gateway 10.231.0.1 (I have static routes for 192.168.200.0/24 and 10.231.1.0/24 back to 10.231.0.100)
Client network: Client 10.231.1.100, Server OpenVPN address 192.168.200.2, Router/Gateway 10.231.1.1 (I have static routes for 192.168.200.0/24 and 10.231.0.0/24 back to 10.231.1.100)
So I can ping/http 10.231.0.0/24 from the client and 10.231.1.0/24 from the server. Pinging 192.168.200.1 from 10.231.1.0/24 is OK but not 10.231.0.100; similarly pinging 192.168.200.2 from 10.231.0.0/24 is OK but not 10.231.1.100
Has anyone any pointers as to what I should examine next?
Cheers
Martin
[b]server.conf file:[/b]
proto udp
port 443
dev tun
server 192.168.200.0 255.255.255.0
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/dh2048.pem
client-config-dir /etc/openvpn/ccd
persist-key
persist-tun
keepalive 10 60
push "route 10.231.0.0 255.255.255.0"
route 10.231.1.0 255.255.255.0 192.168.200.1
# client-to-client (don't think this is relevant at this stage - but may be later)
topology subnet
user nobody
group nogroup
daemon
[b]client config file:[/b]
iroute 10.231.1.0 255.255.255.0
[b]client.conf file:[/b]
client
proto udp
remote server.address.org
port 443
dev tun
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/client.crt
key /etc/openvpn/keys/client.key
status /etc/openvpn/openvpn-status.log
log-append /var/log/openvpn.log
[b]Lots of this is all I see from server OpenVPN log at the time of the pinging - other entries look normal:[/b]
Sat May 11 15:44:01 2013 us=233831 client.address.org/78.145.23.76:443 UDPv4 WRITE [53] to [AF_INET]78.145.23.76:443: P_DATA_V1 kid=0 DATA len=52
Sat May 11 15:44:01 2013 us=269384 client.address.org/78.145.23.76:443 UDPv4 READ [53] from [AF_INET]78.145.23.76:443: P_DATA_V1 kid=0 DATA len=52
Sat May 11 15:44:11 2013 us=315979 client.address.org/78.145.23.76:443 UDPv4 WRITE [53] to [AF_INET]78.145.23.76:443: P_DATA_V1 kid=0 DATA len=52
Sat May 11 15:44:11 2013 us=351738 client.address.org/78.145.23.76:443 UDPv4 READ [53] from [AF_INET]78.145.23.76:443: P_DATA_V1 kid=0 DATA len=52
[b]The client log has corresponding entries:[/b]
Sat May 11 15:44:01 2013 us=251023 UDPv4 READ [53] from [AF_INET]92.30.*.*:443: P_DATA_V1 kid=0 DATA len=52
Sat May 11 15:44:01 2013 us=251241 UDPv4 WRITE [53] to [AF_INET]92.30.*.*:443: P_DATA_V1 kid=0 DATA len=52
Sat May 11 15:44:11 2013 us=332865 UDPv4 READ [53] from [AF_INET]92.30.*.*:443: P_DATA_V1 kid=0 DATA len=52
Sat May 11 15:44:11 2013 us=333107 UDPv4 WRITE [53] to [AF_INET]92.30.*.*:443: P_DATA_V1 kid=0 DATA len=52
[b]extract from server iptables rules:[/b]
$IPT -A INPUT -i tun0 -j ACCEPT
$IPT -A OUTPUT -o tun0 -j ACCEPT
$IPT -A FORWARD -i tun0 -s 192.168.200.0/24 -o eth0 -j ACCEPT
$IPT -A FORWARD -i eth0 -s 10.231.0.0/24 -o tun0 -j ACCEPT
[b]result of sysctl net.ipv4.ip_forward[/b]
net.ipv4.ip_forward = 1
[b]extract from client iptables rules:[/b]
$IPT -A INPUT -i tun0 -j ACCEPT
$IPT -A OUTPUT -o tun0 -j ACCEPT
$IPT -A FORWARD -i tun0 -s 192.168.200.0/24 -o eth0 -j ACCEPT
$IPT -A FORWARD -i eth0 -s 10.231.1.0/24 -o tun0 -j ACCEPT
[b]result of sysctl net.ipv4.ip_forward[/b]
net.ipv4.ip_forward = 1
