So I am having an issue with traffic passing through the server side to the client side. Ping can get through, but when I try to ssh or dns lookup, nothing gets through.
Server conf:
port 11194
proto tcp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 172.19.0.0 255.255.0.0"
client-config-dir ccd
route 192.168.0.0 255.255.0.0
client-to-client
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
Client conf:
client
dev tun
proto tcp
remote $serverip 11194
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
IPTables:
# Generated by iptables-save v1.4.18 on Wed Feb 18 18:05:51 2015
*nat
:PREROUTING ACCEPT [1:84]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [1:76]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 172.19.0.0/16 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.8.0.0/24 -d 172.19.0.0/16 -j MASQUERADE
-A POSTROUTING -o eth0 -j SNAT --to-source 172.19.0.129
COMMIT
# Completed on Wed Feb 18 18:05:51 2015
# Generated by iptables-save v1.4.18 on Wed Feb 18 18:05:51 2015
*filter
:INPUT ACCEPT [120:8633]
:FORWARD ACCEPT [1:84]
:OUTPUT ACCEPT [69:7385]
-A INPUT -i tun+ -j ACCEPT
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -d 172.19.0.0/16 -i tun0 -o eth0 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -d 172.19.0.0/16 -j ACCEPT
COMMIT
# Completed on Wed Feb 18 18:05:51 2015
ssh from 192 to 172 subnet works fine. ssh from 172 to 192 network never finishes.
When I tcpdump tun0 I see this: 17:06:50.497403 IP 192.168.107.210.34727 > 172.19.40.44.ssh: Flags [P.], seq 3053887130:3053887178, ack 516322784, win 83, options [nop,nop,TS val 2902171104 ecr 3190048], length 48
Please let me know if there is any other information you would like
