Hi,
I stuck with the problem, I successfully can establish VPN connection between client and server but that's it - I can't reach anything further, even the IP's in the same range.
Here is my setup.
DataCenter
Server is a linux machine with 3 interfaces (eth0, eth1, eth2). Eth0 is a management VLAN so it is not important here. NOTE! This is just the server and the gateway for him is dedicated hw Firewall.
eth2 is used to get connections from the internet clients wanted to VPN 'inside' , it is NATed to external IP on firewall.
eth2 inet addr:172.16.11.26 Bcast:172.16.11.255 Mask:255.255.255.0
eth1 is used as a TAP interface mapped to br0, and is one of IPs in subnet dedicated for VPN clients. Also GW for this subnet 172.16.101.1 is on HW FIREWALL.
br0 inet addr:172.16.101.11 Bcast:172.16.101.255 Mask:255.255.255.0
Now
SERVER CONFIG /I ommited lines related to authentication because this works just fine/
local 172.16.11.26
port 1194
proto tcp
dev tap0
ifconfig-pool-persist ipp.txt
server-bridge 172.16.101.11 255.255.255.0 172.16.101.40 172.16.101.250
push "route 172.16.11.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 172.16.11.100"
push "dhcp-option DNS 172.16.11.101"
client-to-client
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
Client is a Windows 7 Pro machine with the internet IP address
CLIENT CONFIG /also I don't include lines related to CA and auth/
client
dev tap
proto tcp
remote ************ 1194
resolv-retry infinite
nobind
comp-lzo
persist-key
persist-tun
ROUTING TABLE OF SERVER
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
172.16.101.0 * 255.255.255.0 U 0 0 0 br0
172.16.11.0 * 255.255.255.0 U 0 0 0 eth2
172.16.22.0 * 255.255.254.0 U 0 0 0 eth0
link-local * 255.255.0.0 U 1002 0 0 eth0
link-local * 255.255.0.0 U 1004 0 0 eth2
default 172.16.11.1 0.0.0.0 UG 0 0 0 eth2
Also on CLIENT (which in this case is getting IP 172.16.101.40)
I can see he is getting routes BUT the gateway for CLIENT is there 172.16.101.11
I can't understand one thing
there is a route in CLIENT
172.16.101.0/24 On-link 172.16.101.40 but he cannot reach 172.16.101.1 (firewall port), but he CAN reach 172.16.101.11 (VPN server)
From VPN server I CAN ping 172.16.101.11
Also I cannot reach internal DNS servers which are in 172.16.11.0/24 subnet.
From VPN server of course I can.
PLEASE help 🙁
