Hi there!
I'm currently struggling with a configuration for full site-to-site accross 3 locations. This intended result is that on any of the subnets, you can access all other subnets.
This is the intended configuration:
--------- ---------
| Site 1: | | Site 2: |
---------------------------- ----------------------------
| IP range: 192.168.1.0/24 |-----------------------------------------| IP range: 192.168.2.0/24 |
| OpenVPN Server behind NAT | | OpenVPN client behind NAT |
| Server IP: 192.168.1.210 | | Client IP: 192.168.1.210 |
--------------------------- ----------------------------
|
|
|
| ---------
| | Site 3: |
| ----------------------------
| -------------------------------------------------------| IP range: 192.168.3.0/24 |
| OpenVPN client behind NAT |
| Client IP: 192.168.3.210 |
----------------------------
I currently have the server (site 1) and 1 client (site 2), setup. This is a list of the things I'm able to do with that setup:
- Run the server.
- Connect to the server from the client on site 2.
- Access every IP address from the 192.168.1.0/24 subnet from the client on site 2.
I'm currently not able to:
- Access every IP address from the 192.168.1.0/24 subnet from every device in the 192.168.2.0/24 subnet.
- Access every IP address from the 192.168.2.0/24 subnet from every device in the 192.168.1.0/24 subnet.
Below is my current configuration.
Site 1 OpenVPN configuration:
port 1194
proto udp
dev tun
topology subnet
ca keys/company/ca.crt
cert keys/company/serverkey.crt
key keys/company/serverkey.key
dh keys/company/dh1024.pem
server 10.8.0.0 255.255.255.0
crl-verify keys/company/crl.pem
cipher AES-128-CBC
#user nobody
#group nogroup
status servers/company/logs/openvpn-status.log
log-append servers/company/logs/openvpn.log
verb 1
mute 0
local 192.168.1.210
keepalive 10 120
client-config-dir /etc/openvpn/servers/company/ccd
client-to-client
duplicate-cn
comp-lzo
persist-key
persist-tun
ccd-exclusive
ifconfig 10.8.0.1 10.8.0.2
push "route 10.8.0.1 255.255.255.255"
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 192.168.1.210"
push "redirect-gateway def1"
Site 1 IPtables:
# Generated by iptables-save v1.4.14 on Mon Mar 9 14:43:49 2015
*mangle
:PREROUTING ACCEPT [48:6243]
:INPUT ACCEPT [48:6243]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [41:9801]
:POSTROUTING ACCEPT [41:9801]
COMMIT
# Completed on Mon Mar 9 14:43:49 2015
# Generated by iptables-save v1.4.14 on Mon Mar 9 14:43:49 2015
*filter
:INPUT ACCEPT [148:110597]
:FORWARD ACCEPT [0:0]
# Allow established traffic to pass back and forth
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow traffic initiated from VPN to access LAN
-A FORWARD -m state -i tun0 -o eth0 --state NEW -j ACCEPT
# Allow traffic initiated from LAN to access the VPN
-A FORWARD -m state -i eth0 -o tun0 --state NEW -j ACCEPT
:OUTPUT ACCEPT [111:14168]
COMMIT
# Completed on Mon Mar 9 14:43:49 2015
# Generated by iptables-save v1.4.14 on Mon Mar 9 14:43:49 2015
*nat
:PREROUTING ACCEPT [341281:26627940]
:INPUT ACCEPT [314484:24536051]
:OUTPUT ACCEPT [185250:13291223]
:POSTROUTING ACCEPT [185256:13291583]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.210
COMMIT
# Completed on Mon Mar 9 14:43:49 2015
Site 2 OpenVPN configuration:
client
proto udp
dev tun
ca ca.crt
dh dh1024.pem
cert site2.crt
key site2.key
remote site1.company.com 1194
cipher AES-128-CBC
verb 4
mute 20
keepalive 10 120
comp-lzo
persist-key
persist-tun
float
resolv-retry infinite
nobind
Site 2 IPtables:
# Generated by iptables-save v1.4.14 on Mon Mar 9 13:44:18 2015
*mangle
:PREROUTING ACCEPT [41:4254]
:INPUT ACCEPT [27:3550]
:FORWARD ACCEPT [14:704]
:OUTPUT ACCEPT [39:6571]
:POSTROUTING ACCEPT [53:7275]
COMMIT
# Completed on Mon Mar 9 13:44:18 2015
# Generated by iptables-save v1.4.14 on Mon Mar 9 13:44:18 2015
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
# Allow established traffic to pass back and forth
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow traffic initiated from VPN to access LAN
-A FORWARD -m state -i tun0 -o eth0 --state NEW -j ACCEPT
# Allow traffic initiated from LAN to access the VPN
-A FORWARD -m state -i eth0 -o tun0 --state NEW -j ACCEPT
COMMIT
# Completed on Mon Mar 9 13:44:18 2015
# Generated by iptables-save v1.4.14 on Mon Mar 9 13:44:18 2015
*nat
:FORWARD - [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.1.210
COMMIT
# Completed on Mon Mar 9 13:44:18 2015
Any help would be greatly appreciated.
Thanks!
