Hi everybody,
I configured a site to site vpn, the server and client openvpn can ping any ip in server's subnet and client's subnet. But pc in client's subnet can't ping any ip in server's subnet.
please help me troubleshooting this problems, thank you very much.
Topology network: server---sw(access)---sw(core-l3)---modem--------modem---clien----lan
Server site: ubuntu 12.04LTS
port 1194
proto tcp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/vpnvpcg.crt
key /etc/openvpn/vpnvpcg.key # This file should be kept secret
dh /etc/openvpn/dh1024.pem
server 172.25.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.3.10.0 255.255.255.0"
push "route 10.2.0.0 255.255.0.0"
client-config-dir ccd
route 192.168.1.0 255.255.255.0
route 172.30.0.0 255.255.0.0
push "dhcp-option DNS 10.3.10.251"
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 4
Cat vpnttt:
iroute 192.168.1.0 255.255.255.0
iroute 172.30.0.0 255.255.255.0
Routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.2.24.1 0.0.0.0 UG 100 0 0 eth0
10.2.24.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
30.30.30.0 172.10.0.5 255.255.255.0 UG 0 0 0 tun1
172.10.0.1 172.10.0.5 255.255.255.255 UGH 0 0 0 tun1
172.10.0.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun1
172.20.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
172.25.0.0 172.25.0.2 255.255.255.0 UG 0 0 0 tun0
172.25.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
172.30.0.0 172.25.0.2 255.255.0.0 UG 0 0 0 tun0
192.168.1.0 172.25.0.2 255.255.255.0 UG 0 0 0 tun0
Sw Core:
ip route 172.25.0.0 255.255.0.0 10.2.24.12
ip route 192.168.1.0 255.255.255.0 10.2.24.12
ip route 172.30.0.0 255.255.255.0 10.2.24.12
Client site: ubuntu 12.04LTS
client
dev tun
proto tcp
remote ippublic 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/vpnttt.crt
key /etc/openvpn/vpnttt.key
ns-cert-type server
log /etc/openvpn/openvpn.log
comp-lzo
verb 4
Routing table
root@vpnttt:~# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.1.1 0.0.0.0 UG 100 0 0 eth0
10.2.0.0 172.25.0.5 255.255.0.0 UG 0 0 0 tun0
10.3.10.0 172.25.0.5 255.255.255.0 UG 0 0 0 tun0
172.25.0.1 172.25.0.5 255.255.255.255 UGH 0 0 0 tun0
172.25.0.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
172.30.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth1
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
Client can ping any ip in server's lan
ping 10.3.10.151
PING 10.3.10.151 (10.3.10.151) 56(84) bytes of data.
64 bytes from 10.3.10.151: icmp_req=1 ttl=126 time=4.02 ms
64 bytes from 10.3.10.151: icmp_req=2 ttl=126 time=7.57 ms
PC in client's lan can ping to 172.25.0.1 but can't ping any ip in server's lan.
