Hi, I am trying to connect two networks together via OpenVPN. Gateways can ping each other, and each gateway can ping all IPs on the opposing network, but computers on one network cannot ping computers on the other network (neither can they ping the opposing gateways). What am I missing here? Seems like many are having this issue for various reasons, but after 50+ tries I gave up and decided to ask :) [b]Network 1:[/b] [code]dev tun port 1194 ifconfig 10.8.222.40 10.8.222.41 route 10.2.1.0 255.255.255.0 vpn_gateway comp-lzo keepalive 10 60 persist-key persist-tun user nobody group nobody secret /etc/openvpn/static.key [/code] [code]ip route default via 10.0.1.1 dev eth0 10.0.1.0/27 dev eth0 proto kernel scope link src 10.0.1.9 10.2.1.0/24 via 10.8.222.41 dev tun0 10.3.0.0/24 via 10.3.0.2 dev tun2 10.3.0.2 dev tun2 proto kernel scope link src 10.3.0.1 10.8.222.41 dev tun0 proto kernel scope link src 10.8.222.40[/code] [b]Network 2[/b] [code]dev tun port 1194 remote my_ext_ip 1194 ifconfig 10.8.222.41 10.8.222.40 route 10.0.0.0 255.254.0.0 vpn_gateway comp-lzo keepalive 10 60 persist-key persist-tun user nobody group nobody secret /etc/openvpn/static.key[/code] [code]ip route default via 10.2.1.1 dev eth0 10.0.0.0/15 via 10.8.222.40 dev tun0 10.2.1.0/24 dev eth0 proto kernel scope link src 10.2.1.9 10.8.222.40 dev tun0 proto kernel scope link src 10.8.222.41[/code] [b]Here's what I have iptables-wise:[/b] [b]Both networks:[/b] iptables -I FORWARD -i eth0 -o tun0 -m conntrack --ctstate NEW -j ACCEPT iptables -I FORWARD -i tun0 -o eth0 -m conntrack --ctstate NEW -j ACCEPT [b]Network 1:[/b] iptables -t nat -A POSTROUTING -s "10.0.0.0/15" -o "eth0" -j MASQUERADE iptables -A FORWARD -p tcp -s 10.0.0.0/15 -d 0.0.0.0/0 -j ACCEPT iptables -t nat -A POSTROUTING -s "10.8.222.40/32" -o "eth0" -j MASQUERADE iptables -A FORWARD -p tcp -s 10.8.222.40/32 -d 0.0.0.0/0 -j ACCEPT [b]Network 2:[/b] iptables -t nat -A POSTROUTING -s "10.2.1.0/24" -o "eth0" -j MASQUERADE iptables -A FORWARD -p tcp -s 10.2.1.0/24 -d 0.0.0.0/0 -j ACCEPT iptables -t nat -A POSTROUTING -s "10.8.222.41/32" -o "eth0" -j MASQUERADE iptables -A FORWARD -p tcp -s 10.8.222.41/32 -d 0.0.0.0/0 -j ACCEPT My assumption was (since I have separate gateways for internet access) that I now have to add routes to each non-gateway computer on both networks that will route packets destined for the opposite network via the local OpenVPN gateway. I did that for machine 10.0.1.7: [b]ip route add 10.2.1.0/24 via 10.0.1.9[/b] So now I have: [quote]default via 10.0.1.1 dev eth0 10.0.1.0/27 dev eth0 proto kernel scope link src 10.0.1.7 10.2.1.0/24 via 10.0.1.9 dev eth0 172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.42.1 [/quote] but traceroute to 10.2.1.9 (opposing gateway) still doesn't go anywhere... Any help would be highly appreciated!

You have clearly [b]not [/b]read the HOWTO: [list][url=http://openvpn.net/index.php/open-source/documentation/howto.html]HOWTO: For OpenVPN Community Edition[/url][/list] This specific section will help: [list][url=http://openvpn.net/index.php/open-source/documentation/howto.html#scope]HOWTO: Expanding the scope of the VPN to include additional machines[/url][/list] I suggest you start with the sample config files.

Connecting two OpenVPN Networks

jayka

Hi,

I am trying to connect two networks together via OpenVPN.

Gateways can ping each other, and each gateway can ping all IPs on the opposing network, but computers on one network cannot ping computers on the other network (neither can they ping the opposing gateways).

What am I missing here? Seems like many are having this issue for various reasons, but after 50+ tries I gave up and decided to ask 🙂

Network 1:

dev tun
port 1194
ifconfig 10.8.222.40 10.8.222.41
route 10.2.1.0 255.255.255.0 vpn_gateway
comp-lzo
keepalive 10 60
persist-key
persist-tun
user nobody
group nobody
secret /etc/openvpn/static.key

ip route
default via 10.0.1.1 dev eth0
10.0.1.0/27 dev eth0  proto kernel  scope link  src 10.0.1.9
10.2.1.0/24 via 10.8.222.41 dev tun0
10.3.0.0/24 via 10.3.0.2 dev tun2
10.3.0.2 dev tun2  proto kernel  scope link  src 10.3.0.1
10.8.222.41 dev tun0  proto kernel  scope link  src 10.8.222.40

Network 2

dev tun
port 1194
remote my_ext_ip 1194
ifconfig 10.8.222.41 10.8.222.40
route 10.0.0.0 255.254.0.0 vpn_gateway
comp-lzo
keepalive 10 60
persist-key
persist-tun
user nobody
group nobody
secret /etc/openvpn/static.key

ip route
default via 10.2.1.1 dev eth0
10.0.0.0/15 via 10.8.222.40 dev tun0
10.2.1.0/24 dev eth0  proto kernel  scope link  src 10.2.1.9
10.8.222.40 dev tun0  proto kernel  scope link  src 10.8.222.41

Here's what I have iptables-wise:

Both networks: iptables -I FORWARD -i eth0 -o tun0 -m conntrack --ctstate NEW -j ACCEPT
iptables -I FORWARD -i tun0 -o eth0 -m conntrack --ctstate NEW -j ACCEPT

Network 1: iptables -t nat -A POSTROUTING -s "10.0.0.0/15" -o "eth0" -j MASQUERADE
iptables -A FORWARD -p tcp -s 10.0.0.0/15 -d 0.0.0.0/0 -j ACCEPT

iptables -t nat -A POSTROUTING -s "10.8.222.40/32" -o "eth0" -j MASQUERADE
iptables -A FORWARD -p tcp -s 10.8.222.40/32 -d 0.0.0.0/0 -j ACCEPT

Network 2: iptables -t nat -A POSTROUTING -s "10.2.1.0/24" -o "eth0" -j MASQUERADE
iptables -A FORWARD -p tcp -s 10.2.1.0/24 -d 0.0.0.0/0 -j ACCEPT

iptables -t nat -A POSTROUTING -s "10.8.222.41/32" -o "eth0" -j MASQUERADE
iptables -A FORWARD -p tcp -s 10.8.222.41/32 -d 0.0.0.0/0 -j ACCEPT

My assumption was (since I have separate gateways for internet access) that I now have to add routes to each non-gateway computer on both networks that will route packets destined for the opposite network via the local OpenVPN gateway.

I did that for machine 10.0.1.7:

ip route add 10.2.1.0/24 via 10.0.1.9

So now I have:

default via 10.0.1.1 dev eth0
10.0.1.0/27 dev eth0 proto kernel scope link src 10.0.1.7
10.2.1.0/24 via 10.0.1.9 dev eth0
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.42.1

but traceroute to 10.2.1.9 (opposing gateway) still doesn't go anywhere...

Any help would be highly appreciated!

Traffic

You have clearly not read the HOWTO:

HOWTO: For OpenVPN Community Edition

This specific section will help:

HOWTO: Expanding the scope of the VPN to include additional machines

I suggest you start with the sample config files.

jayka

Thank you for your prompt response. I have read all of this documentation and decided to post here as a last resort.

The problem is that one of the networks is on Amazon AWS, the other one is in Microsoft Azure. I therefore have limited control over the routing settings in their respective gateway. So since clients on either side don't know anything about routing particular subnets through OpenVPN, my assumption was that adding routes to those machines would be the solution.

I am trying to establish a mechanism that will allow me to expand to other cloud service providers as well (for added reliability) and therefore would rather have the routing settings done independent of the network gateways. Hope that makes sense.

jayka

I would also appreciate any pointers from anyone who has connected any two/multiple cloud providers into one network. I am sure it has been done before, but I could not find any OpenVPN implementations on the web. Portability is paramount, considering that our infrastructure is already Dockerized and fully movable.

jayka

No one? I've been struggling with this for way too long :?