Hi there OpenVPN experts! I have what I think is a ‘simple’ problem; I think I’m missing some sort of route declaration.
Scenario: OpenVPN Gateway (own machine) runs server configuration files: server-3000 for tcp port 3000 and server-3001 for tcp port 3001.
Machine A (gx-server) connects to server-3000 and using a CCD configuration file gets a static address of 11.11.0.1.
Server-3000 assigns addresses to all other clients in the 11.10.0.x range.
Server-3001 assigns addresses to all clients in the 12.10.0.x range.
I want the clients who connect to server-3001 (12.10.0.x) to be able to ping/connect to 11.11.0.1 (gx-server ccd static address.)
At this point, Machine A can connect to the VPN 3000 (gets address 11.10.0.x), and see and talk to 11.11.0.1. Machine B can connect to the VPN 3001 (gets address 12.10.0.x) and cannot talk to or ping 11.11.0.1.
What I want is for Machine B @ 12.10.0.x to be able to see and talk to gx-server @ 11.11.0.1. It does not matter (and would be better) if Machine B cannot talk to Machine A (11.10.0.x)
Any ideas of a configuration setup to try? We are trying to not have to have the gx-server client @ 11.11.0.1 have to have multiple instances of OpenVPN running. (I.e. I don't want to have to add another configuration file for every VPN port I set up. I'd like some clients to connect over port 3000 and be assigned from 11.10 and some connect over port 3001 and be assigned from 12.10 and for both groups to be able to talk to client on port 3000 @ 11.11.0.1 (static)
Configuration Files:
Server-3000
port 3000
proto tcp
dev tun
# certs
ca "C:\\Program Files\\OpenVPN\\Config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\Config\\server.crt"
key "C:\\Program Files\\OpenVPN\\Config\\server.key" # This file should be kept secret
dh "C:\\Program Files\\OpenVPN\\Config\\dh1024.pem"
# server route information
server 11.10.0.0 255.255.255.0
push "route 11.10.0.0 255.255.255.0"
push "route 11.11.0.0 255.255.255.0"
# gx-server - static IP of 11.11.0.1 (only needed for port 3000)
client-config-dir ccd
route 11.11.0.0 255.255.255.0
client-to-client
duplicate-cn
keepalive 30 300
cipher AES-128-CBC
comp-lzo
persist-key
persist-tun
status openvpn-status-3000.log
verb 5
mute 5
Server-3001
port 3001
proto tcp
dev tun
# certs
ca "C:\\Program Files\\OpenVPN\\Config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\Config\\server.crt"
key "C:\\Program Files\\OpenVPN\\Config\\server.key" # This file should be kept secret
dh "C:\\Program Files\\OpenVPN\\Config\\dh1024.pem"
# server route information
server 12.10.0.0 255.255.255.0
push "route 12.10.0.0 255.255.255.0"
push "route 11.11.0.0 255.255.255.0"
client-to-client
duplicate-cn
keepalive 30 300
cipher AES-128-CBC
comp-lzo
persist-key
persist-tun
status openvpn-status-3001.log
verb 5
mute 5
CCD/gx-server
ifconfig-push 11.11.0.1 11.11.0.2
iroute 11.11.0.0 255.255.255.0
Machine A (port 3000)
client
dev tun
proto tcp
remote x.x.x.x 3000
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\machinea.crt"
key "C:\\Program Files\\OpenVPN\\config\\machinea.key"
ns-cert-type server
cipher AES-128-CBC
comp-lzo
verb 3
Machine B (port 3001)
client
dev tun
proto tcp
remote x.x.x.x 3001
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\machineb.crt"
key "C:\\Program Files\\OpenVPN\\config\\machineb.key"
ns-cert-type server
cipher AES-128-CBC
comp-lzo
verb 3
