Hi everybody,
I use OpenVPN since years without problems in several private and corporate environments.
But I always had something bothering me, and I now want to get rid of it.
I searched into the web, I searched into this forum. I found nothing.
So here is the situation:
Say I connect two remote LANs with OpenVPN, as displayed on the picture above.
Everything is ok between computers (computers = C) to/from each offices. They can connect to each other, thru the OpenVPN routers (routers = R).
The source address is 192.168.10.10
The destination address is 192.168.20.10
OpenVPN handles this nicely.
Everything is ok between two routers, which have OpenVPN link configured with "ifconfig 10.10.10.1 10.10.10.2".
The source address is 10.10.10.1
The destination address is 10.10.10.2
OpenVPN does its job too.
Everything is okay too when a computer contacts the router on the distant LAN (with its LAN address).
The source address is 192.168.10.10
The destination address is 192.168.20.1
The problem is when one router (Linux or Windows. Used both, same result) needs to contact a computer on the distant LAN.
The source address is 10.10.10.1
The destination address is 192.168.20.10
The packet goes to the distant computer. But when the distant computer sends a reply (to 10.10.10.1) it is dropped by the distant router during the return path (I don't know why, this is my problem).
I verified with tcpdump, the reply packet goes into the distant router (10.10.10.2) and is dropped there.
Same problem when a computer contacts the router on the distant LAN with its VPN address.
The source address is 192.168.10.10
The destination address is 10.10.10.2
The packet is droped by OpenVPN on the local router
My conclusion is 10.10.10.x addresses are discarded by OpenVPN when they come from the LAN.
Of course I can cheat. I can use firewall rules to translate addresses (not tested). Or I can configure the desired softwares to use the LAN source address ("ping -I 192.168.10.1 192.168.20.10" will work) but not every softwares allow this, and the goal is to make this work "naturally".
What is the "official" way to solve this problem ?
And/or what can be a nice way to solve it ?
