problem including multiple machines on the client side

gilles

Hello, i have 2 windows 2012 hosts with openvpn.
1 server and 1 client.
client connexion is ok.

i'm using "ip forwarding" on these 2 hosts but i got some routing problems with machines on each lan.

<-------------------------- site 1 -------------------------->      <--------------------------- site 2 ---------------------------->

host 1                          openvpn server                                  openvpn client                 host 2
172.22.0.253                 lan : 172.22.1.20                                lan : 172.22.200.2            172.22.200.50
mask 255.255.240.0           mask 255.255.240.0                               mask 255.255.255.0          mask 255.255.255.0
                               tap : 10.8.0.1                                   tap : 10.8.0.200

host 1 have a route for 10.8.0.0 set to 172.22.1.20 (openvpn server) : route add 10.8.0.0 mask 255.255.255.0 172.22.1.20
host 2 have his default route set to 172.22.200.2 (openvpn client)

ping from openvpn client to 10.8.0.1 : OK
ping from openvpn server to 10.8.0.200 : OK
ping from openvpn client to 172.22.1.20 : OK (i'm using for openvpn client : push "route 172.22.0.0 255.255.240.0 10.8.0.1")
ping from openvpn client to host 1 : OK
ping from openvpn server to 172.22.200.2 : NOK !
ping from openvpn server to 172.22.200.50 : NOK !
ping from host 1 to 10.8.0.1 : OK
ping from host 1 to 10.8.0.200 : OK
ping from host 1 to 172.22.200.2 : NOK !
ping from host 1 to host 2 : NOK !
ping from host 2 to 10.8.0.200 : NOK!
ping from host 2 to 10.8.0.1 : NOK !
ping from host 2 to 172.22.1.20 : NOK !
ping from host 2 to host 1 : NOK !

my priority is to make the 2 lans to communicate to each other with their own ips.

server config :

dev tun
dev-node tap-routing
mode server
ifconfig 10.8.0.1 255.255.255.0
topology subnet
push "topology subnet"
ifconfig-pool 10.8.0.201 10.8.0.254 255.255.255.0
route 172.22.200.0 255.255.255.0		<- got an error here when i start server, need to had the gateway 10.8.0.1 or route-gateway 10.8.0.1

and for my client :

ifconfig-push 10.8.0.200 255.255.255.0
push "route 172.22.0.0 255.255.240.0 10.8.0.1"
iroute 172.22.200.0 255.255.255.0

client config :

dev tun
client

I have read http://openvpn.net/index.php/open-source/documentation/howto.html#scope
I tried windows and ubuntu.

gilles

i see your post but i don't understand
i tried to put --route in server and/or client
can you explain me what is "my VPN" (172.22.0.0 or 10.8.0.0) and where i miss this (in server or client) ?
thanks

gilles

yes i read all this (see my first post)
so you think it's a server problem, not client ?

gilles

it doesn't work.
i was using this at starting, since it is the example server.conf
but i read a lot of how-to and tutorials
and it seems --server is newer and better

well, i'm going to test a lot more
do you know if someone put on internet 2 VMs (like wmware player), so i can see what i'm doing wrong.

gilles

i understand no more of this.
i read a lot, and not only on here.
i don't understand --ifconfig, --ifconfig-push, --server, --mode server, --iroute, --route, push "route xxx".
i don't understand what i'm missing, omitting, and what i'm doing wrong

i just made a simple server.conf, no more ccd file for client or --topology change, just a simple config in point to point.
i'm restarting this attempt at a site to site at the begining.
i deleted all routes on all gateways.

server.conf :

dev tun
dev-node tap-routing
server 10.8.0.0 255.255.255.0

client.conf :

dev tun
client

this works :
- client can ping and vnc to 10.8.0.1
- server can ping and vnc 10.8.0.6

now i'm triying to Expanding the scope of the VPN: http://openvpn.net/index.php/open-source/documentation/howto.html#scope

server.conf :

dev tun
dev-node tap-routing
server 10.8.0.0 255.255.255.0
push "route 172.22.0.0 255.255.240.0"

client.conf :

dev tun
client

i verify on client that i have a route for 172.22.0.0

i'm trying to ping the lan interface of the server 172.22.1.20
that does't work

do i need a route on my server ?

EDIT :
i forget to enabled ip forwarding with netsh command (editing registry is not sufficient on 2012 server)
now i can ping and vnc to my openvpn server

gilles

i added a route to 10.8.0.0 on the hosts
and i can ping them from client

now let's go back to Including multiple machines on the client side when using a routed VPN (dev tun)

gilles

"topology subnet" was the problem.