Hi
since a picture is worth 1000 words, i start with this quick scetch:
The long term goal is to make all sites able to establish a site2site-connection to each other. Right now, i try to make the connection from site C (client) to site B (server) work, then the other ones should work by changing some names and numbers in the configuration. I did this by using the guide from here:
http://www.smallnetbuilder.com/security/security-howto/30353-how-to-set-up-a-site-to-site-vpn-with-openvpn
At site B, the vpn-gateway is behind a router, so i added a port forwarding and static routes for the other LANs (the 192.168.x.x/24 subnets) to 192.168.1.2.
Here's the config of the server:
local 192.168.1.2
port 1001
proto udp
dev tun0
client-to-client
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/server.crt
key /etc/openvpn/keys/server.key # This file should be kept secret
dh /etc/openvpn/dh2048.pem
server 10.1.0.0 255.255.255.0
ifconfig-pool-persist /etc/openvpn/ipp.txt
push "route 192.168.1.0 255.255.255.0"
client-config-dir client-configs
route 192.168.0.0 255.255.255.0
route 192.168.2.0 255.255.255.0
keepalive 10 120
cipher BF-CBC # Blowfish (default)
max-clients 5
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status-server.log
verb 5
daemon
This is the client's config:
client
dev tun0
remote vpn.example.com
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/remote.crt
key /etc/openvpn/keys/remote.key
ns-cert-type server
cipher BF-CBC
proto udp
port 1001
log-append /var/log/openvpn.log
verb 4
user nobody
group nogroup
daemon
persist-tun
persist-key
*I changed hostnames and ports
According to the logs, the connection is successfully established and i'm able to ping the B-gateway from the site-C gateway (ping from 192.168.2.1 to 192.168.1.2).
Strangely (more or less :lol: ), a ping to the router at site B does not get a response back. I did a tcpdump at the B-gateway and saw this while the router was pinged:
~# tcpdump -i any -n dst host 192.168.1.1
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
20:05:33.384666 IP 10.1.0.6 > 192.168.1.1: ICMP echo request, id 10979, seq 0, length 64
20:05:34.381497 IP 10.1.0.6 > 192.168.1.1: ICMP echo request, id 10979, seq 1, length 64
20:05:35.381783 IP 10.1.0.6 > 192.168.1.1: ICMP echo request, id 10979, seq 2, length 64
20:05:36.382605 IP 10.1.0.6 > 192.168.1.1: ICMP echo request, id 10979, seq 3, length 64
20:05:37.382350 IP 10.1.0.6 > 192.168.1.1: ICMP echo request, id 10979, seq 4, length 64
Pretty clear why this does not work: I guess the ping arrives at the router, but it can't response back because of the source ip. Adding a static route for 10.1.0.0/24 to 192.168.1.2 did not help (this was not neccessary accoring to the guide).
So, where's my mistake? I guess it's not in the config, but in my concept of vpn/routing/bridging. Longterm goal is that the clients at the different sites should be able to establish a connection to each other without having any software installed. I thought routing might be the right choice, because i did not want/need to share the broadcast domains. 3 seperate networks would be fine, i have absolutely no need to share the ethernet layer, IP-Layer is just fine for me.
Also, i thought the server-policy in the configuration is only relevant for the clients who connect to the server, which are only vpn-gateways in my topology so far.
