working openvpn client as router?

newuser44

hi,

ive got a machine that connects to a server with "redirect gateway". all traffic goes over the server and its working.
now i would like to make this client a router for some other machines, so all traffic goes over this client(router) -> openvpn server -> inet

when the client is connected to the openvpn the routing table looks like this:

0.0.0.0         10.8.33.25      128.0.0.0       UG    0      0        0 tun0
0.0.0.0         192.168.11.1    0.0.0.0         UG    0      0        0 eth0
10.8.33.0       10.8.33.25      255.255.255.0   UG    0      0        0 tun0
10.8.33.25      0.0.0.0         255.255.255.255 UH    0      0        0 tun0
88.198.127.82   192.168.11.1    255.255.255.255 UGH   0      0        0 eth0
128.0.0.0       10.8.33.25      128.0.0.0       UG    0      0        0 tun0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 eth0
192.168.11.0    0.0.0.0         255.255.255.0   U     1      0        0 eth0

to enable routing i use these commmands:

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE 
echo '1' > /proc/sys/net/ipv4/conf/eth0/forwarding

network setup looks like this:

machine1 -> openvpn client -> openwrt router -> openvpn server -> inet
machine2
machine3

openvpn client can use the internet if its connected to the vpn.
i am aware that openwrt can handle openvpn, but for testing purposes i would like to have a full blown linux box.

what do i need to add to get it to route other machines?

newuser44

forgot to mention that

machine1 -> openvpn client -> openwrt router
machine2
machine3

are in the same lan segment
on openvpn client i also run:

echo 0 | tee /proc/sys/net/ipv4/conf/*/send_redirects

so that the clients use this as router and not switch to the real router.

so network looks like:
machine1 -> openvpn client -> openwrt router -> internet -> openvpn server -> internet
machine2
machine3

newuser44

someone from #networking@freenode was very helpfull and now with these two lines:

in openvpn server conf:

route 192.168.11.0 255.255.255.0

in ccd file:

iroute 192.168.11.0 255.255.255.0

icmp traffic comes back to the lan router, but there it is stuck:

tcpdump -ni tun0 icmp

15:22:25.004361 IP 192.168.11.118 > 10.8.33.1: ICMP echo request, id 1175, seq 321, length 64
15:22:25.061658 IP 10.8.33.1 > 192.168.11.118: ICMP echo reply, id 1175, seq 321, length 64
15:22:26.012445 IP 192.168.11.118 > 10.8.33.1: ICMP echo request, id 1175, seq 322, length 64
15:22:26.069665 IP 10.8.33.1 > 192.168.11.118: ICMP echo reply, id 1175, seq 322, length 64

it shows up over the vpn connection, but:

tcpdump -ni eth0 icmp

15:23:14.398100 IP 192.168.11.118 > 10.8.33.1: ICMP echo request, id 1175, seq 370, length 64
15:23:15.406124 IP 192.168.11.118 > 10.8.33.1: ICMP echo request, id 1175, seq 371, length 64
15:23:16.414119 IP 192.168.11.118 > 10.8.33.1: ICMP echo request, id 1175, seq 372, length 64

shows only request, but no replys....why is that?

reverse path filtering was disabled:

for i in /proc/sys/net/ipv4/conf/*/rp_filter ; do echo 0 > $i ; done

newuser44

...oh my, thank you very much.