sinaowolabi
I am very, very sorry if I am asking a question thats been asked before, and I have really searched the forum to see if my case is not unique. My search failed to
identify this, and if I am mistaken, I am sorry.
I have an openvpn server that I can successfully reach from a remote client, and I can ping the openvpn server IP address from the remote client. Trouble is, I cannot reach the IP addresses that are on the same flat network with the openvpn server from the client. There is a router/firewall/UTM device that the openvpn server (and the other IP addresses) sit behind. OpenVPN server is running on Centos 6.6 64-bit kvm guest. Router is also a kvm guest/
Please see my server client configuration:
client.conf:
client
dev tun
proto udp
remote pu.bl.ic.add 1194
pull
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
resolv-retry infinite
ns-cert-type server
comp-lzo
verb 3
server.conf:
local 10.22.0.253
port 1194
proto udp
dev tun
ca ca.crt
cert host.crt
key host.key # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
route 10.22.0.0 255.255.255.0
push "route 10.22.0.0 255.255.255.0"
client-config-dir ccd
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 208.67.220.220"
client-to-client
duplicate-cn
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 3
Server NAT rule: -I POSTROUTING -o eth0 -j SNAT --to 10.22.0.253
Client ccd file: route 10.22.0.0 255.255.255.0
I can reach the openvpn server fine from the internet (10.22.0.253), but I cannot reach any other IP address on that LAN.
Please what am I doing wrong?
Thanks for any help!
sinaowolabi
Fixed it...
by modifying the iptables rules even more:
Forwarding:
-A FORWARD -d 10.8.0.0/24 -i eth0 -o tun0 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -i tun0 -o eth0 -m conntrack --ctstate NEW -j ACCEPT
NAT:
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -o eth0 -j SNAT --to-source 10.22.0.253
Not certain which of these is unnecessary but at least I can ping the other addresses on the network now, not just the VPN server.
