Hi!
I have one network (192.168.1.0/24) with gateway (192.168.1.242), which has white static IP. A use it for OpenVPN-server.
The second network (192.168.3.0/24) has gateway (192.168.3.3) behind two NAT. So, I use this server for OpenVPN-client.
First gateway has VPN address 172.16.130.1
Second gateway has VPN address 172.16.130.30
There are configs:
Server
port 2000
proto tcp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/gw.crt
key /etc/openvpn/keys/gw.key # This file should be kept secret
dh /etc/openvpn/keys/dh1024.pem
server 172.16.130.0 255.255.255.0 # vpn subnet
route 192.168.3.0 255.255.255.0
ifconfig-pool-persist /etc/openvpn/ipp.txt
push "route 192.168.1.0 255.255.255.0" # home subnet
push "dhcp-option DNS 192.168.1.242" #DNS
push "dhcp-option DOMAIN localnet.antora" #DNS suffix
push "dhcp-option WINS 192.168.1.242" #WINS
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 9
mute 20
client-to-client
client-config-dir /etc/openvpn/ccd
Client:
client
dev tun
proto tcp
remote <ip-address of the first network's gateway> 2000
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/msk-client.crt
key /etc/openvpn/keys/msk-client.key
comp-lzo
verb 3
So, connection is established. First gateway can ping the second gateway. Gateways can ping hosts from other network (192.168.1.242 -> 192.168.3.X and 192.168.3.3 -> 192.168.1.X). Hosts can ping all VPN-addresses (192.168.1.X -> 172.16.130.30 and 192.168.3.X -> 172.16.130.1).
But hosts cannot ping other gateways and other hosts. (192.168.1.X <-> 192.168.3.X).
OS Ubuntu 12.04 server.
Routing is active:
#ip route
192.168.3.0/24 via 172.16.130.2 dev tun0
#ip route
192.168.1.0/24 via 172.16.130.29 dev tun0
tcpdump and iptables logging/debugging shows that packets from hosts lose between filter FORWARD and mangle PREROUTING:
Sep 22 09:59:48 gateway kernel: [658099.434409] TRACE: raw:PREROUTING:policy:2 IN=eth1 OUT= MAC=00:1d:7d:05:ce:57:00:1d:7d:05:ce:a8:08:00 SRC=192.168.1.111 DST=192.168.3.3 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=28563 SEQ=3
Sep 22 09:59:48 gateway kernel: [658099.434423] TRACE: mangle:PREROUTING:rule:1 IN=eth1 OUT= MAC=00:1d:7d:05:ce:57:00:1d:7d:05:ce:a8:08:00 SRC=192.168.1.111 DST=192.168.3.3 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=28563 SEQ=3
Sep 22 09:59:48 gateway kernel: [658099.434433] TRACE: mangle:PREROUTING:policy:5 IN=eth1 OUT= MAC=00:1d:7d:05:ce:57:00:1d:7d:05:ce:a8:08:00 SRC=192.168.1.111 DST=192.168.3.3 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=28563 SEQ=3
Sep 22 09:59:48 gateway kernel: [658099.434445] TRACE: nat:PREROUTING:policy:20 IN=eth1 OUT= MAC=00:1d:7d:05:ce:57:00:1d:7d:05:ce:a8:08:00 SRC=192.168.1.111 DST=192.168.3.3 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=28563 SEQ=3
Sep 22 09:59:48 gateway kernel: [658099.434465] TRACE: mangle:FORWARD:policy:2 IN=eth1 OUT=tun0 MAC=00:1d:7d:05:ce:57:00:1d:7d:05:ce:a8:08:00 SRC=192.168.1.111 DST=192.168.3.3 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=28563 SEQ=3
Sep 22 09:59:48 gateway kernel: [658099.434475] TRACE: filter:FORWARD:policy:1 IN=eth1 OUT=tun0 MAC=00:1d:7d:05:ce:57:00:1d:7d:05:ce:a8:08:00 SRC=192.168.1.111 DST=192.168.3.3 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=28563 SEQ=3
I tried to add ACCESS rules for FORWARD chain, but it didn't work.
What I did wrong?
