I've a simple client-server configuration, the connection is established correctly and works fine but now I need to reach the devices placed on client subnet from the server machine.
server (launch from cmd on windows):
--port 443
--dev tun
--proto tcp-server
--server 10.1.0.0 255.255.255.248
--comp-lzo
--verb 1
--dh "path_to_keys\dh1024.pem"
--ca "path_to_keys\ca.crt"
--cert "path_to_keys\server.crt"
--key "path_to_keys\server.key"
--client-cert-not-required
--auth-user-pass-verify "path_to_auth\auth.exe\" via-env
--auth-nocache
--script-security 3 system
--connect-retry-max 3
--inactive 10
--ping 3
--ping-exit 5
--remap-usr1 SIGTERM
--client-connect "cscript path_to_script\connect.vbs //Nologo"
--client-disconnect "cscript path_to_script\disconnect.vbs //Nologo"
--client-config-dir "path_to_ccd\ccd\"
--route 100.100.100.0 255.255.255.0
--push "route 100.100.100.0 255.255.255.0"
--username-as-common-name
--client-to-client
ccd file (named "DEFAULT"):
iroute 100.100.100.0 255.255.255.0
client (router/switch with openwrt):
dev tun
resolv_retry infinite
nobind
persist_key
ca "path_to_ca/ca.crt"
comp_lzo
verb 3
proto tcp
script_security 2 system
ns_cert_type server
inactive 10
ping 3
ping_exit 5
remap_user1 SIGTERM
auth_user_pass "path_to_credentials_file"
status "/tmp/openvpn.log"
connect_retry 15
up "path_to_script/forward set"
down "path_to_script/forward unset"
remote server_address 443
forward script (set):
#iptables -t nat -D POSTROUTING -o $VPN -j MASQUERADE
iptables -t nat -A POSTROUTING -o $VPN -j MASQUERADE
# some port forwarding and firewall rules
#
# foreach item in port forwarding list:
# iptables -t nat -A prerouting_rule -i tun0 -p $2 --dport $3 -j DNAT --to $5:$4 2> /dev/null
# iptables -A forwarding_rule -i tun0 -p $2 --dport $4 -d $5 -j ACCEPT 2> /dev/null
The "ip_forwarding" is setted on both sides. Common scenario could be:
+----------------------+ +----------------------+
| AAA.AAA.AAA.0/24 | | BBB.BBB.BBB.0/24 |
| |------------- INTERNET -------------| |
| OVN SERVER (PC) | | OVN CLIENT (ROUTER) |
+----------------------+ |----------------------| +----------------------+
| 100.100.100.0/24 | | SUBNET WITH |
| |-------------| OTHER DEVICES |
| | | |
+----------------------+ +----------------------+
any idea on which is the mistake?
thanks in advance
