Can't connect to subnet behind the VPN server

stancheva

Hi All,

I am struggling for a while now with the following problem. I managed to establish connection between VPN server and VPN clients. But I cannot reach the two subnets behind the VPN server.
My VPN network is 10.8.0.1\24. The local network that the VPN server belongs to is 192.168.1.0/24 and at the same time the VPN server has access to 192.168.2.0/24.
I want to be able to access both subnets from the VPN clients. The first subnet 192.168.1.0/24 belongs to one router R1 to which the VPN server is connected and the second subnet 192.168.2.0/24 belongs to a second router R2, which is connected to R1 via a wifi link.
R1's local ip is 192.168.1.1 and R2 is connected to R1 via 192.168.1.155. R2's local ip is 192.168.2.99.
I set up the following forwarding routes on R1:
Dest.: 192.168.2.0\24
GW: 192.168.1.155 (Local IP of R2)
Dest.:10.8.0.0\24
GW: 192.168.1.121 (Local IP of the VPN server)

On R2 I set up:
Dest: 10.8.0.0\24
GW: 192.168.1.155

I also enabled IP forwarding on the VPN server.
I have the following config files:

# Port
port 1194

# Protocol
proto tcp

#The IP address of the real network interface of the server
#Which local IP address should OpenVPN listen on?
local 192.168.1.121

#Device
# - tun: Routing
dev tun


#Paths
# - Certificate
# - Keys
# - Diffie-Dellmann

ca "ca.crt"
cert "server.crt"
key "server.key"  
dh "dh1024.pem"

# Server-Confid
# - Subnet: 10.8.0.0 255.255.255.0
# - Server-IP: 10.8.0.1
server 10.8.0.0 255.255.255.0

# Maintain a record of client <-> virtual IP address
# associations in this file.  If OpenVPN goes down or
# is restarted, reconnecting clients can be assigned
# the same virtual IP address from the pool that was
# previously assigned.
ifconfig-pool-persist ipp.txt



# Push routes to the client to allow it
# to reach other private subnets behind
# the server.  
push "route 192.168.2.0 255.255.255.0"
push "route 192.168.1.0 255.255.255.0"

#Keepalive
# - serves to maintain the connection
# Ping every 10 seconds, assume that remote
# peer is down if no ping received during
# a 120 second time period.
keepalive 10 120


# Enable compression on the VPN link.
comp-lzo

#Authentication
#- AES
#- 512 Bit
#- "openvpn --show-digests" for Testing
auth SHA512


# Enable compression on the VPN link.
comp-lzo

# The persist options will try to avoid
# accessing certain resources on restart
# that may no longer be accessible because
# of the privilege downgrade.
persist-key
persist-tun

# Output a short status file showing
# current connections, truncated
# and rewritten every minute.
status openvpn-status.log


# Set the appropriate level of log
# file verbosity.
#
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 6

Client:

client

# Device
# - tun: Routing 
dev tun

#Protocol
proto tcp


# The hostname/IP and port of the server.
remote XXX.XXX.XXX.XXX 1194


# Keep trying indefinitely to resolve the
# host name of the OpenVPN server.  
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Try to preserve some state across restarts.
persist-key
persist-tun


# Paths
# - Certificate
# - Keys
# - Diffie-Dellman

ca   ca.crt
cert client.crt
key  client.key
# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server".  This is an
# important precaution to protect against
# a potential attack discussed here:
#  http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server".  The build-key-server
# script in the easy-rsa folder will do this.
ns-cert-type server


# Enable compression on the VPN link.
comp-lzo

# Set log file verbosity.
verb 6


#Authentication
#auth-user-pass 
auth SHA512

I have the following routing table in the VPN server:

Aktive Routen:
     Netzwerkziel    Netzwerkmaske          Gateway   Schnittstelle  Anzahl
          0.0.0.0          0.0.0.0      192.168.1.1   192.168.1.121       10
         10.8.0.0  255.255.255.252         10.8.0.1        10.8.0.1       30
         10.8.0.0    255.255.255.0         10.8.0.2        10.8.0.1       1
         10.8.0.1  255.255.255.255        127.0.0.1       127.0.0.1       30
   10.255.255.255  255.255.255.255         10.8.0.1        10.8.0.1       30
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      192.168.1.0    255.255.255.0    192.168.1.121   192.168.1.121       10
    192.168.1.121  255.255.255.255        127.0.0.1       127.0.0.1       10
    192.168.1.255  255.255.255.255    192.168.1.121   192.168.1.121       10
      192.168.2.0    255.255.255.0    192.168.1.155   192.168.1.121       1
        224.0.0.0        240.0.0.0         10.8.0.1        10.8.0.1       30
        224.0.0.0        240.0.0.0    192.168.1.121   192.168.1.121       10
  255.255.255.255  255.255.255.255         10.8.0.1        10.8.0.1       1
  255.255.255.255  255.255.255.255    192.168.1.121               2       1
  255.255.255.255  255.255.255.255    192.168.1.121   192.168.1.121       1
Standardgateway:       192.168.1.1

I can ping successfully my VPN server, but once I try to ping a machine from 192.168.2.0 or 192.168.1.0 it does not work.
When I perform tracert with a machine from both subnets, the packets manage to reach 10.8.0.1 (VPN server), but then they get dropped.
I am out of ideas towards how I can fix that issue and I will really appreciate any help and advice.

Thank you

stancheva

In the tutorial it is saying that I need to enable IP and TUN forwarding on the OpenVPN server. I have enabled IP forwarding , but how can I enable tun forwarding?