Openvpn ok cannot ssh

taralhoco

Hi

i have a little problem that i cant solve, i have openvpn running in a dedicated server, and im using a openwrt router with client mode, everything works ok.

i can ssh to both vpn server ip and vpn host address from the router ( client ).

but if i connect my computer to openwrt router using lan i can get access to the vpn host address, the only way is using 10.8.0.1 ( vpn server ip )

vpn server ip: 10.8.0.1
openwrt router vpn ip: 10.8.0.2
vpn host : 103.23.23.89

any hint ?

Thanks
Regards

maikcat

if i got this correctly you have a problem to connect via ssh using your openvpn
servers public ip WHILE connected to the vpn?

at least post your configs...

Michael.

taralhoco

hi again

yes Michael thats it.

i cannot connect to any port of VPN public ip after connecting to tun

ssh ====> openvpn ip ( 10.8.0.1 ) => OK
ssh ====> server running vpn => NOK

server.conf

port 64001
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.4.4"
push "dhcp-option DNS 8.8.8.8"
client-to-client
keepalive 8 40
comp-lzo
;max-clients 100
persist-key
persist-tun
status openvpn-status.log
verb 3
;mute 20

client

client
dev tun
proto udp
remote server-ip 64001
resolv-retry infinite
nobind
persist-key
persist-tun
ns-cert-type server
comp-lzo
verb 3
;mute 20

maikcat

what you are facing IS normal behaviour...

this "issue" has been discussed before in this forum and the only solution
is to use policy based routing on your server to route ssh traffic outside the vpn tunnel.

Michael.

Traffic

taralhoco wrotebut if i connect my computer to openwrt router using lan i can get access to the vpn host address, the only way is using 10.8.0.1 ( vpn server ip )

can you explain this clearly ..

taralhoco wrotessh ====> openvpn ip ( 10.8.0.1 ) => OK
ssh ====> server running vpn => NOK

"server running vpn" is vpn host : 103.23.23.89 ?

taralhoco wrotepush "redirect-gateway def1"

this will setup a host route to the public ip address of the server .. so you ought to be able to access services over the internet to the public ip address of the server ..