The goal is a plug n play router to router setup to provide remote support access for my hardware, ease of on-site setup (minimal requirements of the customer's LAN ie: B calls out to A) and trusted security to keep the customer's IT folk sleeping well.
The client connects to the server and almost works. I can ping anyone on the server side from the client side. I can not ping, however, anyone on the client subnet save the routers VPN and local IP address from the server side. I made a network sketch hoping a picture is worth a 1000 IP addresses.
The problem appears to be at router "B".
- - What command am I missing in its configuration/routing?
- Do I need an additional ROUTE or an IPTABLES MASQERADE or something on "B"?
My google-fu seems weak - I have yet to find my magic bullet. The only thing I've come up with so far is some client side routing oversight. But what that oversight might be .... arrrggh!
Thanks in advance to anyone taking their time to delve into my world. It's 99% - it's that last 1%, not my age, accelerating my hair loss.
Dave
Network Layout
+-----------------------------------------------------------------------------+
| Site to Site OpenVPN "X" |
| ----------------------------- +---+ +------------------+ |
| to access B and BA,BB,BC from | I | | Customer Network | |
| AA,AB and anyone VPN'd to A. | N | | --------------- | |
| | T | | Outbound Allowed | |
| | E | | - TCP 53,80 | |
| +------------------> | R | <-----------| - UDP 4500 | |
| | | N | | No admin access | |
| | | E | | to this network | |
| | | T | +------------------+ |
| | +---+ | |
| | | |
| "A" | Server Client | "B" |
| +------------------------------+ +-------------------------------+ |
| | Asus RT-N16 Shibby/Tomato | | Asus RT-N16 Shibby/Tomato | |
| | - WAN is PPPoE to ISP | | - WAN is Static from Customer | |
| | - 192.168.3.1/24 Gateway | | - 10.10.23.1/24 Gateway | |
| | - 192.168.3.1/24 DHCP Server | | - 10.10.23.1/24 DHCP Server | |
| | - 172.17.3.1/24 VPN Server | | - 172.17.3.153/24 VPN Client | |
| +------------------------------+ +-------------------------------+ |
| | | / | \ |
| | | / | \ |
| "AA" | "AB" | "BA" / "BB" | "BC" \ |
| +-----------+ +-----------+ +-----------+ +-----------+ +-----------+ |
| | PC | | PC | | PLC | | HMI | | PC | |
| | -- | | -- | | --- | | --- | | -- | |
| |192.168.3.5| |192.168.3.7| |10.10.23.10| |10.10.23.12| |10.10.23.99| |
| +-----------+ +-----------+ +-----------+ +-----------+ +-----------+ |
| |
| Everyone on "A" subnet can Everyone on "B" subnet can ping both |
| ping router "B" but _NOT_ router "A" _AND_ clients AA,AB. |
| clients BA,BB,BC. |
| |
| Customer Network "X": |
| - UDP port 4500 open to internet for OpenVPN |
| - DNS available to resolve server's dyndns hostname |
| - local SMTP server available on TCP 25 to send mail |
| - all other ports and access restricted |
+-----------------------------------------------------------------------------+
Server OVPN Config
server-A.ovpn
-----------------------------------
daemon
proto udp
port 4500
dev tun22
server 172.17.3.0 255.255.255.0
push "route 192.168.3.0 255.255.255.0"
route 10.10.23.0 255.255.255.0
client-to-client
client-config-dir ccd <------------ ccd/client-B
comp-lzo yes ----------------------------------------
keepalive 15 60 ifconfig-push 172.17.3.153 172.17.3.154
verb 3 iroute 10.10.23.0 255.255.255.0
status-version 2
status status
cipher AES-256-CBC
tun-mtu 1500
mssfix 1450
tls-server
tls-verify /opt/openvpn/certs/verify
crl-verify /opt/openvpn/crls/cacrl.pem
ca /opt/openvpn/certs/ca.crt
dh /opt/openvpn/certs/dh1024.pem
cert /opt/openvpn/certs/server.crt
key /opt/openvpn/certs/server.key
script-security 2
persist-key
persist-tun
ping-timer-rem
mute 20
user nobody
group nobody
Client OVPN Config
client-B.ovpn
------------------------------------------------------------------------------
daemon
dev tun11
proto udp
remote server.dyndns.org 4500
resolv-retry 30
nobind
persist-key
persist-tun
comp-lzo adaptive
status-version 2
status status
pkcs12 /opt/openvpn/client-B.p12
tls-client
client
tun-mtu 1500
cipher AES-256-CBC
ns-cert-type server
float
verb 3
Server Side Firewall additions
firewall-A
------------------------------------------------------------------------------
iptables -t nat -I PREROUTING -p udp --dport 4500 -j ACCEPT
iptables -I INPUT -p udp --dport 4500 -j ACCEPT
iptables -I INPUT -i tun22 -j ACCEPT
iptables -I FORWARD -i tun22 -j ACCEPT
Server and Client Route Tables (post connection)
root@server-A #: ip route list
------------------------------------------------------------------------------
127.0.0.0/8 dev lo scope link
10.10.23.0/24 via 172.17.3.2 dev tun22
172.17.2.0/24 via 172.17.2.2 dev tun21
172.17.2.2 dev tun21 proto kernel scope link src 172.17.2.1
172.17.3.0/24 via 172.17.3.2 dev tun22
172.17.3.2 dev tun22 proto kernel scope link src 172.17.3.1
192.168.3.0/24 dev br0 proto kernel scope link src 192.168.3.1
(ISP Gateway) dev ppp0 proto kernel scope link src (WAN IP)
default via (ISP Gateway) dev ppp0
root@client-B #: ip route list
------------------------------------------------------------------------------
127.0.0.0/8 dev lo scope link
4.3.2.0/24 dev vlan2 proto kernel scope link src 4.3.2.99
10.10.23.0/24 dev br0 proto kernel scope link src 10.10.23.1
172.17.3.0/24 via 172.17.3.154 dev tun11
172.17.3.154 dev tun11 proto kernel scope link src 172.17.3.153
192.168.3.0/24 via 172.17.3.154 dev tun11
(ISP Gateway) dev vlan2 scope link
default via (ISP Gateway) dev vlan2
