Ok, I've been using OpenVPN on and off for a good many years. Not enough to call myself an expert in any form, but I thought i had good working knowledge, until i ran into this one.
Long story short: Ping works in any direction, but anything else seem to work in one direction only, and it is not a client firewall issue.
Lets start with a diagram:
https://dl.dropboxusercontent.com/u/73783043/Foto%202014-09-13%2014%2021%2002.jpg
Pretty straightforward, yeah?
.8 is a Virtual ubuntu running under Hyper-V 2012R2
.30 is a Virtual ubuntu running under ESX 5.5
The pfsese and mikrotik is forwardind 1194/UDP to each side, and have apropriate routes, since some traffic works.
Basically, any client can ping any client without problem.
This is from 172.25.74.155 -> 192.168.41.20
C:\Users\j2>ping 192.168.41.10
Pinging 192.168.41.10 with 32 bytes of data:
Reply from 192.168.41.10: bytes=32 time=13ms TTL=125
Ping statistics for 192.168.41.10:
Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 13ms, Maximum = 13ms, Average = 13ms
Control-C
^C
C:\Users\j2>tracert -d 192.168.41.20
Tracing route to 192.168.41.20 over a maximum of 30 hops
1 <1 ms <1 ms <1 ms 172.25.74.1
2 <1 ms <1 ms <1 ms 172.25.74.8
3 11 ms 11 ms 10 ms 172.25.85.1
4 11 ms 10 ms 10 ms 192.168.41.20
Trace complete.
C:\Users\j2>
And this is from 192.168.41.20 -> 172.25.74.100
https://dl.dropboxusercontent.com/u/73783043/192.168.41.20%20-%20172.25.74.100.JPG
So, i have some traffic, and as the above screenshot shows, i have no issue accessing web servers in the 172.25.74.0/24 subnet from 192.168.41.20
But, i cannot get anything else to work in that direction. I just get timeouts. I have been dicking around with mssfix/mtu etc without any success
I also have this sneaking feeling that i am missing something dirt simple...
Server config:
root@na01:/etc/openvpn# grep -vE '^#|^;|^$' server.conf
port 1194
proto udp
dev tun
ca ca.crt
cert na01.kontinuitet.local.crt
key na01.kontinuitet.local.key # This file should be kept secret
dh dh1024.pem
server 172.25.85.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.41.0 255.255.255.0"
push "route 172.25.74.0 255.255.255.0"
client-config-dir ccd
client-to-client
keepalive 5 20
cipher aes-256-cbc
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 4
route 172.25.74.0 255.255.255.0
And in the ccd i havce
iroute 172.25.74.0 255.255.255.0
And on the client side
client
dev tun
proto udp
remote PUBLIC.IP.OF.SERVER 1194
resolv-retry infinite
persist-key
persist-tun
ca OrmCert.crt
cert krokobo.crt
key krokobo.key
ns-cert-type server
cipher aes-256-cbc
comp-lzo
verb 3
auth-nocache
verb 4
What the deuce am i missing here?
