OpenVPN with 2 networks not reachable

kevinjansen

Dear Community,

I have searched the internet and forums but so far without succes.
This is my situation hopefully someone can give me a tip so i can finish the installation.

I have 1 network 10.100.0.0/255.255.0.0
Servers will get 10.100.1.x
VPN Clients gets 10.100.2.x where 10.100.2.1 is the local vpn server it server. Also 10.100.1.1 is the ip on the vpn server.

If i am connected to my server with ssh i can ping to a other server for example 10.100.1.2 (Samba Server)
Once i am connected with vpn i can ping 10.100.2.6 (my self) 10.100.2.1 (OpenVPN server) 10.100.1.1 (OpenVPN server on other ip) but i can't ping 10.100.1.2 (Samba Server)

This is my configurtion:
Route:

root@VPN:/etc/openvpn# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         externalip    0.0.0.0         UG    0      0        0 eth0
10.100.0.0      *               255.255.0.0     U     0      0        0 eth1
10.100.2.0      10.100.2.2      255.255.255.0   UG    0      0        0 tun0
10.100.2.2      *               255.255.255.255 UH    0      0        0 tun0
localnet        *               255.255.255.0   U     0      0        0 eth0

Server Config:

root@VPN:/etc/openvpn# grep -v '^#' /etc/openvpn/server.conf | grep -v '^;'
port 1194
proto udp
dev tun
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/vpn.crt
key /etc/openvpn/certs/vpn.key  # This file should be kept secret
dh /etc/openvpn/certs/dh2048.pem
server 10.100.2.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.100.1.0 255.255.255.0"
push "route 10.100.2.0 255.255.255.0"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

Client Config:


client
dev tun
;dev-node MyTap
;proto tcp
proto udp
remote remotevpnip 1194
;remote my-server-2 1194
;remote-random
resolv-retry infinite
nobind
;user nobody
;group nobody
persist-key
persist-tun
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
;mute-replay-warnings
ca "c:\\openvpn\\ca.crt"
cert "c:\\openvpn\\kevin.crt"
key "c:\\openvpn\\kevin.key"
ns-cert-type server
;tls-auth ta.key 1
;cipher x
comp-lzo
verb 3
;mute 20

IPforward is enabled.

root@VPN:/etc/openvpn# grep ip.forward /etc/sysctl.conf
net.ipv4.ip_forward=1

I am running:
Server: Debian 7 latest version/updates
Client: Windows 8

Hope that someone can help me. And tackle this problem 🙂

Kind regards,

Kevin

maikcat

you are using a network for your openvpn interface that is already part of your local subnet.

Michael.

kevinjansen

maikcat can u please explain what the best situation is.
Even if i say to OpenVPN give me a range 172.10.10.0 i will get 172.10.10.6 ip can still ping 10.100.1.1 but not 10.100.1.2

I can ping 10.100.1.2 from the server

root@VPN:~# ping 10.100.1.2
PING 10.100.1.2 (10.100.1.2) 56(84) bytes of data.
64 bytes from 10.100.1.2: icmp_req=1 ttl=64 time=0.569 ms
64 bytes from 10.100.1.2: icmp_req=2 ttl=64 time=0.256 ms

it seems more logic for me that it it a routing issue.

kevinjansen

Dear i changed my network but still the same result

ifconfig

eth1      Link encap:Ethernet  HWaddr 0a:99:54:ad:ba:29
          inet addr:10.100.1.1  Bcast:10.100.1.255  Mask:255.255.255.0
          inet6 addr: fe80::899:54ff:fead:ba29/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:20647 errors:0 dropped:0 overruns:0 frame:0
          TX packets:32 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:1306985 (1.2 MiB)  TX bytes:1944 (1.8 KiB)
          Interrupt:25

also changed some configs

port 1194
proto udp
dev tun

ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/vpn.crt
key /etc/openvpn/certs/vpn.key  # This file should be kept secret
dh /etc/openvpn/certs/dh2048.pem


server 10.100.2.0 255.255.255.0

ifconfig-pool-persist ipp.txt

push "route 10.100.1.0 255.255.255.0"

client-config-dir ccd
route 10.100.1.0 255.255.255.0
route 10.100.2.0 255.255.255.0

client-to-client
comp-lzo

also with old config no result. Also tried to use totally different network 172.10.10.x as vpn client range.
I can ping VPN clients/VPN server but not a server in the same ip range as the vpn server.

kevinjansen

sorry i mean 172.16.x.x range.

I think the problem is that the tun0 connection is not sending signals to eth1 interface where my other range is connected on.

kevinjansen

Dear debbie10t thanks for your reply, that --local command is for the client side if i am correct. Since i am not using Unix as client but a windows 8 desktop i am unable to give parameters. Everything is working. only not traffic from/to tun0-eth1 when i am playing with the routing tables i lose sometimes connection from client to 10.100.1.0 range and when i add it again i can ping vpn server again on 10.100.1.1 but not 10.100.1.2 what is connected to trough eth1.

Maybe i need to setup "dev tap" instead of "dev tun" ?