client cant see any remote host but server on remote network

minektur

I'm having a problem with a new openvpn setup I'm trying to configure. The client, once it connects can ping the server by remote private IP (e.g. it's remote address, inside the private network). I can even ssh from the client to the server... but I can't see reach any other computers on the remote network (e.g. server is 192.168.3.251 and I can ping it, but I cant reach 192.168.3.116 or 192.168.3.1).

Details below:

server config:
---- snip -----
port 1194
proto udp
dev tun
ca keys/ca.crt
cert keys/server.crt
key keys/server.key # This file should be kept secret
dh keys/dh2048.pem
server 192.168.233.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.3.0 255.255.255.0"
client-to-client
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 6
---- snip -----

client config
---- snip -----
client
dev tun
proto udp
remote host1.mydomain.com 1194
remote host2.mydomain.com 1194
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
comp-lzo
verb 3
---- snip -----

Server is Centos, running centos package openvpn-2.3.7-1.el6.i686
192.168.3.251, default gateway 192.168.3.1 (internal address of firewall/router)

Client is osx yosemite 10.10.3
192.168.200.55

approximate topology (for my testing right now) is this:

mac-client -> wireless router -> (lan/wan/internet) -> multi-homed-firewall --> server

On the same network as server is another computer "othercomp" with address 192.168.3.116

Client connects ok - I can ping and ssh to the server host 192.168.3.251
Client can NOT ping, ssh, etc to other computers on the network. e.g. not othercomp (3.116) or the default gateway 3.1

I push a route for 192.168.3.0/24..... I'm not sure what is wrong.

Anyone?

Fred

Traffic

minektur wroteI push a route for 192.168.3.0/24

You need a little more than just that .. please read carefully through these HOWTOs:

As you are using Linux on your server, your best bet is probably using iptables NAT.

minektur

well, the link you provided for "expanding the scope of the vpn to include additional machines" is what I was following already.

for my case: 1 remote client - want to see all machines on server's network, it says to do a few things: first, push a route to that network, second, "set up a route on the server-side LAN gateway to route VPN client subnet", and third "make sure you've enabled IP and TUN/TAP forwarding on the OpenVPN server machine".

As you pointed out, I am already pushing a route.

for item 2, (I ended up with 2 posts about this subject, and the mods approved the first with less detail...) I have (already) added a static route to my router for 192.168.233.0/24 to be the OpenVPN server - in this case 192.168.3.251. and I have (already) done sysctl -w net.ipv4.ip_forward=1 to turn on IP forwarding. Just to make sure it wasn't the problem, I temporarily disabled iptables on the OpenVPN server...

Shouldn't that be sufficient?

You recommend I use NAT on the OpenVPN server - I will try this - doing a MASQUERADE rule for the client network... but wont this have the side effect of not allowing any of the clients to see each other, and to all the computers on the server's lan, remote access will appear to originate from the OpenVPN server rather than from the remote host's IP? This is somewhat problematic from an ACL standpoint...

Traffic

minektur wrotefor item 2, (I ended up with 2 posts about this subject, and the mods approved the first with less detail...)

That would be this one:
https://forums.openvpn.net/topic19449.html

Traffic

minektur wrotefor item 2,
<..>
I have (already) added a static route to my router for 192.168.233.0/24 to be the OpenVPN server - in this case 192.168.3.251. and I have (already) done sysctl -w net.ipv4.ip_forward=1 to turn on IP forwarding. Just to make sure it wasn't the problem, I temporarily disabled iptables on the OpenVPN server...

Shouldn't that be sufficient?

It is sufficient when it works ..

Try using tcpdump on your server to see where the relevant packets are ..

minektur

(had already used tcpdump - should have included that tidbit..)

In short, icmp requests would go out to 3.116 and return to the server, but would not be forwarded back to the vpn client.

I ended up using a masquerade nat rule which will allow the clients to see everything on the server network (with a push of the 4 routes needed) and is good enough for now. But I can't do different ACLs for different clients (on the client anyway... I guess I could put in a drop rule in iptables on the server... hm...)

Thanks for all your help.

Traffic

How about trying the test from the LAN host to the VPN client ..

Traffic

And:

Maikcat wrotefor testing use the static route for vpn network directly on testing pc inside your lan

Ref:
https://forums.openvpn.net/topic19449.html#p54017

This is slightly odd:

minektur wroteIn short, icmp requests would go out to 3.116 and return to the server, but would not be forwarded back to the vpn client.

is this still the case ?