OpenVPN and two gateways

RET80

Alright, so I have a toughie for you guys...

I already have a fully configured and functioning OpenVPN server, and now I have configured two wireless gateways that support 3G signal with OpenVPN clients (so each one has OpenVPN running)

and attached to these two wireless gateways are PCs communicating through the ethernet port in these gateways with DHCP enabled.

The two devices can see each other on the OpenVPN network, but the devices attached to them cannot.
and the PCs cannot have OpenVPN clients running on them and can only talk to each other through the OpenVPN connection on the gateway devices.

As some would say, "WHAT DO?"

maikcat

so you want lan to lan connectivity...?

post a network diagram (with ip ranges used) and your current configs

Michael.

RET80

Correct.

So each gateway has DHCP enabled and within that, their own private DHCP network

on Gateway 1, DHCP for just one LAN object connected to it is: 192.168.0.1
on Gateway 2, DHCP for just one LAN object connected to it is: 10.1.3.1

I can't divulge specific IP addresses since its for a company project but here is a rough diagram the setup at the moment. As you can see the gateways are 3G enabled and they also have DCHP enabled for a single LAN client (or multiple if I so choose). The Gateways are linux enabled so I can SSH into them if necessary.

And the two gateways can communicate with each other and see each other on the OVPN network at an IP address of 192.168.160.x

but nothing connected to the LAN port (DHCP) can see the other device.

mwandelaar

Have you added the routes to the other network to the gateway-machines?
There's a very good manual for that on the wiki which explains it in detail.
Can you post client and server configs here?

If you have implemented this and checked no firewall or NAT is in between, it works.

RET80

mwandelaar wroteHave you added the routes to the other network to the gateway-machines?
There's a very good manual for that on the wiki which explains it in detail.
Can you post client and server configs here?

If you have implemented this and checked no firewall or NAT is in between, it works.

Excellent, I'm just about done with it, but I do have a question, what is a 'ccd entry'? and how do I go about applying one. As for the client/server conf, I will not be able to put them on here since they're company specific and have extra information on them, which is a bummer for me, but I think I'll be fine as long as I know what a ccd entry is and how to execute an iroute, everything else is setup.

mwandelaar

Maybe you can leave the company-specific entries (we don't need your servername or anything) and post the remaining here. If this still doesn't work for you and need help, PM me.

The "ccd entry" is the Client-Config-Dir, which stands for the directory where client-specific configfiles are stored:

client-config-dir /etc/openvpn/ccd

When a client connects, openvpn looks in that directory if there's a file which name matches the common-name of the client-certificate. If so, it uses the content of that file as a specific config for that client.

Let me show you an example:
My client connects and the common name of the cert is "tester1". I have created a ccd-entry for that client:

vpn-server:/etc/openvpn/ccd# cat tester1
ifconfig-push 10.8.0.22 255.255.255.0
push "route-gateway 10.8.0.1"

(This assumes "topology subnet" on the server)

Upon connection, the client "tester1" will always get ip-address 10.8.0.22
As you can read in the manpage in the section "--client-config-dir", you can see which other options can be used in the ccd-entry.