Site2Site works between gateways, not for other systems

Octa

Hi,

i need to create a new thread as this issue was not resolved.

My goal is to create a site2site connection using 2 OpenWRT-Boxes. At the Server-Side, this is a separate machine on the LAN, in the Client LAN, this Box is also the router.
I just had another look at the config and tried to set it up again, but there were no changes in status:

From the Clients OpenWRT-Box, i'm able to establish a connection. I'm able to Ping the VPN-Server, but no other clients on this LAN.

Is it even possible to establish a vpn-connection that does not change the IPs? When performing the ping with a tcpdump, i see the source IP from the client (192.168.2.1) is changed to something from the server vpn-net.
I imagined that there's a way to keep the adresses, so the systems on each side of the connection only see the "real" addresses from the 192.168.0.0/16 block, no the server vpn network from 10.0.0.0/8.

Regards,
Octa

Here's the config from the server side:

Server config

local 192.168.1.2
port 1001
proto udp
dev tun0
client-to-client
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/server_wimmental.crt
key /etc/openvpn/keys/server_wimmental.key  # This file should be kept secret
dh /etc/openvpn/dh2048.pem
server 10.1.0.0 255.255.255.0
ifconfig-pool-persist /etc/openvpn/ipp.txt
push "route 192.168.1.0 255.255.255.0"
client-config-dir /etc/openvpn/client-configs
ccd-exclusive
route 192.168.0.0 255.255.255.0
route 192.168.2.0 255.255.255.0
keepalive 10 120
cipher BF-CBC        # Blowfish (default)
max-clients 5
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status-server-wimmental.log
verb 5
daemon

Client config of server:

root@OpenWrt:~# cat /etc/openvpn/client-configs/remote-weinsberg
iroute 192.168.2.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0 vpn_gateway"

Config from Client side:

client
dev tun0
remote vpn.example.com
ca /etc/openvpn/certs/ca-wimmental.crt
cert /etc/openvpn/certs/remote-weinsberg-wimmental.crt
key /etc/openvpn/keys/remote-weinsberg-wimmental.key
ns-cert-type server
cipher BF-CBC
proto udp
port 1001
log-append /var/log/openvpn.log
verb 4
user nobody
group nogroup
daemon
persist-tun
persist-key

Certificate header (client):

root@OpenWrt:~# head /etc/openvpn/certs/remote-weinsberg-wimmental.crt | grep Subject
        Subject: [...] CN=remote-weinsberg/name=EasyRSA/emailAddress=webmaster@example.com
root@OpenWrt:~#

Traffic

Octa wroteIs it even possible to establish a vpn-connection that does not change the IPs?

Probably Not ...

Octa

Ok, as long as the servers are reachable via hostname, that shouldn't be a problem. I guess i can accomplish this via DNS, but i initially thought that it is possible to make the connection fully "abstract" to the clients so that it seems that 192.168.1.0/24 and 192.168.2.0/24 are on the same site.

Still the issue with the reachability, though.

What else is needed to make this work? The client which established the connection is also the router itself. The VPN-Server is behind a router. Static routes to the client's network and the vpn-network are already added and point to the vpn-server

Traffic

This:

Octa wroteClient config of server:
Code:
root@OpenWrt:~# cat /etc/openvpn/client-configs/remote-weinsberg
iroute 192.168.2.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0 vpn_gateway"

could do with this:

ifconfig-push 10.1.0.6 10.1.0.5

that way you know that the client always gets the same IP address ..

Have you read this carefully:
HOWTO: Expanding the scope of the VPN to include additional machines