Hello guys.
I've encountered an issue with OpenVPN site-to-site configuration.
My systems are two routers running Debian Linux ( "A" and "B" hosts ), Quagga 0.99.22.4 and OpenVPN 2.3.3.
Routers are connected to the Internet, both are assigned public IP addresses. There are three private nets behind router A ( 192.168.1.0/24, 192.168.2.0/24, 192.168.3.0/24 ), and three private subnets behind router B ( 192.168.101.0/24, 192.168.102.0/24, 192.168.103.0/24 ). I want hosts in networks behind router A to communicate with hosts in networks behind router B. But it doesn't work somewhy.
Routing is okay. Routers are default gateways for private networks behind them. They use BGP to announce routes to each other, all prefixes are sent and got well. Also packet forwarding is enabled.
root@router_A:~# cat /proc/sys/net/ipv4/ip_forward
1
root@router_B:~# cat /proc/sys/net/ipv4/ip_forward
1
Firewall rules are okay. Communications from/to certain networks are allowed, also I've tested it with accept input and forward policies.
So it looks like router A is able to communicate with router B through the tunnel well, and can reach hosts in 101,102,103 networks. Same router B is able to reach hosts in 1,2,3 networks. But hosts from private subnets can't reach hosts in distanced subnets.
As example I do ping from 192.168.1.30 to 192.168.101.30, so:
I see ICMP packets going into the tunnel from router A, but can't see this packets coming from tunnel on router B. I'm going postal trying get figure out how does it happen. Please advise.
P.S.
Using TCP over TCP is a need, and switching to UDP doesn't help.
Router A is OpenVPN server:
mode server
tls-server
local aaa.bbb.ccc.ddd
port pppp
proto tcp-server
dev tun0
topology subnet
client-to-client
ca /etc/openvpn/routera/ca.crt
cert /etc/openvpn/routera/routera.crt
key /etc/openvpn/routera/routera.key
dh /etc/openvpn/routera/dh1024.pem
ifconfig 192.168.10.2 255.255.255.0
ifconfig-pool 192.168.10.10 192.168.72.250
client-config-dir /etc/openvpn/routera/ccd
keepalive 1 5
tls-auth /etc/openvpn/routera/ta.key 0
cipher AES-128-CBC
persist-key
persist-tun
status /var/log/openvpn/routera-status.log
log /var/log/openvpn/routera.log
log-append /var/log/openvpn/routera.log
verb 3
Router B is a client:
client
tls-client
remote aaa.bbb.ccc.ddd
port pppp
proto tcp
dev tun0
topology subnet
cd /etc/openvpn
ca /etc/openvpn/routerb/ca.crt
cert /etc/openvpn/routerb/routerb.crt
key /etc/openvpn/routerb/routerb.key
keepalive 1 5
tls-auth /etc/openvpn/routerb/ta.key 1
cipher AES-128-CBC
persist-key
persist-tun
status /var/log/openvpn/routerb-routera-status.log
log /var/log/openvpn/routerb-routera.log
log-append /var/log/openvpn/routerb-routera.log
verb 3
