Problem with internal openvpn address

clonic

Hello,
I have the following configuration in my system.

I have a openvpn server with ubuntu server using tunneling and a openvpn client with dd-wrt.

Ip address of my server is 192.168.0.85.
The internal Lan of my openvpn is 192.168.9.0/24
And a computer of my external Lan is 192.168.29.2

The vpn connection works excellent but when I connect the external computer (192.168.29.2) to a service in my network (for example a cifs server, 192.168.0.5) the cifs server detect the openvpn internal lan (192.168.9.26) and I would like that the cifs would detect the external ip lan (192.168.29.2).

Are there any instruction that when vpn encapsulating packet I could put the external lan ip? (I have other vpn client with ubuntu and it's work fine)

I put the configuration files here.

Thank you for your help!!

Server.conf

# SmallNetBuilder OpenVPN Network Server Config File
#

# Local address to listen on. i.e. the OpenVPN server's LAN address
local 192.168.0.85

# The default OpenVPN port
port 1195

#topology subnet

# Protocol used to transmit between OpenVPN nodes
proto udp

# Interface for the OpevVPN tunnel
dev tun0

# Required keys and certificates
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/vpn-server.crt
key /etc/openvpn/keys/vpn-server.key # This file should be kept secret
dh /etc/openvpn/dh2048.pem

# The server directive instructs this OpenVPN instance to act as the central node.
# The network IP address and netmask are used for the point-to-point connections
# between the OpenVPN server and the client nodes. Only the server and the client
# need to know about this subnet.
server 192.168.9.0 255.255.255.0

# Create a file for persistent IP addresses. Helpful for intermittent connections.
ifconfig-pool-persist /etc/openvpn/ipp.txt

# Advertise the server's network to connecting clients
push "route 192.168.0.0 255.255.255.0"
# Specific client configurations
client-config-dir /etc/openvpn/client-configs

route 192.168.29.0 255.255.255.0 #vpn-camaraagraria
# Periodically check connectivity through the tunnel and restart if connectivity
# is lost
keepalive 10 120

# Cipher to use for encryption
cipher BF-CBC # Blowfish (default)
max-clients 30 #OJO

# Downgrade to an unpriviledged user for security after initialization
user nobody
group nobody

# Use a persistent key and tunnel interface. Helpful if running as an
# unpriviledged user and the connection goes down.
persist-key
persist-tun

# Log location and verbosity level
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 5

# Fork to the backgroud on successful initialization
daemon

Client.conf DDWRT- WRT54GL

client
dev tun
proto udp
remote xxx.xxx.xxx.xxx 1195
resolv-retry infinite
nobind
persist-key
persist-tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ca /tmp/openvpncl/ca.crt
cert /tmp/openvpncl/client.crt
key /tmp/openvpncl/client.key

clonic

The version of DDWRT is DD-WRT v24-sp2 (08/07/10) vpn (SVN revision 14896)

The version openvpn 2.2.0-2ubuntu1

janjust

The vpn connection works excellent but when I connect the external computer (192.168.29.2) to a service in my network (for example a cifs server, 192.168.0.5) the cifs server detect the openvpn internal lan (192.168.9.26) and I would like that the cifs would detect the external ip lan (192.168.29.2).

Are there any instruction that when vpn encapsulating packet I could put the external lan ip? (I have other vpn client with ubuntu and it's work fine)

I'm not 100% sure I understand this: so if an external computer connects via the dd-wrt VPN connection the VPN IP is seen, not the "external" IP ? that's most likely a masquerading thing on either the dd-wrt router or the vpn server.

What does the client config on the working ubuntu vpn client look like?

clonic

It is very extrange,
I atach a Image that explain the network

When I say openvpn private ip address is 192.168.9.0/24 not private address (192.168.X.X)

In the picture, if I run ping command PC1 to PC2

ping 192.168.29.2

The ip address in the log firewall is correct (192.168.29.2)

But if I run ping command PC2 to PC1

ping PC1 192.168.0.189

The ip address in the log firewall is not correct (192.168.9.6, internal openvpn address network)

And if i have a cifs server in NET 192.168.0.0 (for example 192.168.0.5) and I wanna connect 2 pcs in the other LAN (for example 192.168.29.2 and 192.168.29.3) I cannot connect 2 computers at the same time because in the cifs server there are two 192.168.9.6 connections and this is not possible.

Client.conf Openvpn Linux client that works good
#
# SmallNetBuilder OpenVPN Client Configuration
#

# Instructs OpenVPN to run in client mode, requests IP address and
# special instructions (like routes) from the server.
client

# Interface for tunnel
dev tun0

# Remote server to connect to. Can be domain name or IP address.
remote 62.43.202.117 1195

# Certificates and keys required for connection
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/vpn-viapublica.crt
key /etc/openvpn/keys/vpn-viapublica.key

# Symmetric cipher - Must be the same as the server's
cipher BF-CBC

# Protocol and Port - Must be the same on both server and client.
proto udp
port 1195

# Log to file instead of syslog
log-append /var/log/openvpn.log
verb 1

# Since the OpenVPN client is acting as a gateway for other machines
# on the client-side network, run as a daemon and downgrade user
# priviledges.
user nobody
group nobody
daemon

# Use a persistent key and tunnel interface.
persist-tun
persist-key

keepalive 20 120

Thank you,

janjust

there must be some form of NATting/masquerading taking place; what happens if you ping 192.168.29.1 (and vice versa) ?
check the openvpn server and client to see if there are any iptables rules

iptables -t nat -L -n -v

clonic

If I ping from 192.168.29.1 to 192.168.0.85 I take the internal openvpn ip address (192.168.9.6), the firewall or the cifs system shows me that there is a client with 192.168.9.6 direction (the correct would be 192.168.29.1).

If I ping from 192.168.0.85 to 192.168.29.1 I take the correct ip address (192.168.29.1)

The 10.10.10.2 is the ip of my internet router ( I use wan port in ddwrt)

when I put iptables commands in ddwrt openvpn client

Chain PREROUTING (policy ACCEPT 89936 packets, 9118K bytes)
pkts bytes target prot opt in out source destination
263 12624 DNAT tcp -- * * 0.0.0.0/0 10.10.10.2 tcp dpt:4040 to:192.168.29.1:443
0 0 DNAT icmp -- * * 0.0.0.0/0 10.10.10.2 to:192.168.17.2
45 2308 DNAT tcp -- * * 0.0.0.0/0 10.10.10.2 tcp dpt:80 to:192.168.29.2:80
0 0 DNAT udp -- * * 0.0.0.0/0 10.10.10.2 udp dpt:80 to:192.168.29.2:80
0 0 DNAT tcp -- * * 0.0.0.0/0 10.10.10.2 tcp dpt:4040 to:192.168.29.1:4040
0 0 DNAT udp -- * * 0.0.0.0/0 10.10.10.2 udp dpt:4040 to:192.168.29.1:4040
0 0 DNAT udp -- * * 0.0.0.0/0 10.10.10.2 udp dpt:1195 to:192.168.29.1:1195
35 20656 TRIGGER 0 -- * * 0.0.0.0/0 10.10.10.2 TRIGGER type:dnat match:0 relate:0

Chain POSTROUTING (policy ACCEPT 452K packets, 30M bytes)
pkts bytes target prot opt in out source destination
109K 6210K SNAT 0 -- * vlan1 0.0.0.0/0 0.0.0.0/0 to:10.10.10.2
0 0 RETURN 0 -- * br0 0.0.0.0/0 0.0.0.0/0 PKTTYPE = broadcast
14 4602 MASQUERADE 0 -- * br0 192.168.29.0/24 192.168.29.0/24
3954 361K MASQUERADE 0 -- * tun0 0.0.0.0/0 0.0.0.0/0

Chain OUTPUT (policy ACCEPT 504K packets, 34M bytes)
pkts bytes target prot opt in out source destination

Thank you for your help,