IP address of server as in LAN

Mroj

Hi, I have HW VPN done by Cisco routers with multiple subnets. And there is one Synology NAS in subnet 192.168.100.x with IP address 192.168.100.10 and there is configured OpenVPN server for clients who don't have Cisco router with HW support. I pushed many routes for other subnets and everything works good.

push "route 192.168.100.0 255.255.255.0"
push "route 192.168.101.0 255.255.255.0"
etc...

The VPN subnet is 192.168.200.x.

server 192.168.200.0 255.255.255.0

So clients have IP address like 192.168.200.5 etc. and are able to ping anything in any subnet - routing works good. But Synology NAS is reachable ONLY with IP 192.168.200.1!!! So if I have mapped some shared resources on its original IP 192.168.100.10 I am not able to connect to it with this IP and don't want to change it every time if I switch from LAN to VPN. It is very annoying.

Is there some option to change OpenVPN server's IP to 192.168.100.10 but preserve client's subnet as 192.168.200.x ? I know, that this was definitely working before some updates by pushing route 192.168.100.0 255.255.255.0 which is the subnet of servers's original IP. But now it is not working.

Can someone hlep me?

Thank You

Traffic

Mroj wroteIs there some option to change OpenVPN server's IP to 192.168.100.10 but preserve client's subnet as 192.168.200.x ?

Do you really mean that ?

Anyway .. you should still be able to ping 192.168.100.10 from your client and so reach the resources there.

Mroj

NAS have two eth devices. Virtual tun0 assigned as 192.168.200.1 which is DHCP for VPN, but real eth0 assigned as 192.168.100.10 I don't understand why this IP isn't visible in VPN. I don't want replace 192.168.200.1 - I know that this is main server IP of whole VPN, but what to do to reach also 192.168.100.10? There is something which blocks it.... :-(

Mroj

Any idea? I tried almost everything and I don!t know where is the core of problem. It looks like, that client doesn't know where to route. Even though, there is routing for 192.168.100.0/24 subnet. I tried also specific route 192.168.100.10/32 points to 192.168.100.1 (which is able to ping 192.168.100.10) even points to 192.168.200.1 which (physically) IS 192.168.100.10, but only on different eth device. This whole thing is very strange. Can anyone tell me if it is even possible what I want to achieve?

Traffic

Mroj wroteSo clients have IP address like 192.168.200.5 etc. and are able to ping anything in any subnet - routing works good. But Synology NAS is reachable ONLY with IP 192.168.200.1!!! So if I have mapped some shared resources on its original IP 192.168.100.10 I am not able to connect to it with this IP

This is your actual problem .. can you ping your NAS @ 100.10 from your VPN client ?

Mroj

No, that is what I am saying... I am not able to ping nor tracert 192.168.100.10 from VPN clients. It looks like that problem is with routing! But I can ping 192.168.200.1, strange.

route print on VPN client:

===========================================================================
Seznam rozhraní
 16...00 ff 11 e0 7a 80 ......TAP-Win32 Adapter OAS
 14...f0 bf 97 66 d4 ab ......Marvell Yukon 88E8059 PCI-E Gigabit Ethernet Controller
 10...4c 0f 6e f7 73 fa ......Atheros AR9285 Wireless Network Adapter
  1...........................Software Loopback Interface 1
 17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
 19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
 20...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
 15...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
 18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
===========================================================================

IPv4 Směrovací tabulka
===========================================================================
Aktivní směrování:
         Cíl v síti   Síťová maska            Brána        Rozhraní Metrika
          0.0.0.0          0.0.0.0      192.168.0.1    192.168.0.101     25
        127.0.0.0        255.0.0.0       Propojené         127.0.0.1    306
        127.0.0.1  255.255.255.255       Propojené         127.0.0.1    306
  127.255.255.255  255.255.255.255       Propojené         127.0.0.1    306
      192.168.0.0    255.255.255.0       Propojené     192.168.0.101    281
    192.168.0.101  255.255.255.255       Propojené     192.168.0.101    281
    192.168.0.255  255.255.255.255       Propojené     192.168.0.101    281
    192.168.100.0    255.255.255.0    192.168.200.9   192.168.200.10     30
    192.168.101.0    255.255.255.0    192.168.200.9   192.168.200.10     30
    192.168.102.0    255.255.255.0    192.168.200.9   192.168.200.10     30
    192.168.103.0    255.255.255.0    192.168.200.9   192.168.200.10     30
    192.168.104.0    255.255.255.0    192.168.200.9   192.168.200.10     30
    192.168.105.0    255.255.255.0    192.168.200.9   192.168.200.10     30
    192.168.200.0    255.255.255.0    192.168.200.9   192.168.200.10     30
    192.168.200.8  255.255.255.252       Propojené    192.168.200.10    286
   192.168.200.10  255.255.255.255       Propojené    192.168.200.10    286
   192.168.200.11  255.255.255.255       Propojené    192.168.200.10    286
        224.0.0.0        240.0.0.0       Propojené         127.0.0.1    306
        224.0.0.0        240.0.0.0       Propojené    192.168.200.10    286
        224.0.0.0        240.0.0.0       Propojené     192.168.0.101    281
  255.255.255.255  255.255.255.255       Propojené         127.0.0.1    306
  255.255.255.255  255.255.255.255       Propojené    192.168.200.10    286
  255.255.255.255  255.255.255.255       Propojené     192.168.0.101    281
===========================================================================
Trvalé trasy:
  Žádné

IPv6 Směrovací tabulka
===========================================================================
Aktivní směrování:
 Rozhraní Metrika Cíl v síti      Brána
  1    306 ::1/128                  Propojené
 16    286 fe80::/64                Propojené
 10    281 fe80::/64                Propojené
 10    281 fe80::8be:b2ad:eae5:5dc0/128
                                    Propojené
 16    286 fe80::bd5c:3246:d0ed:cb36/128
                                    Propojené
  1    306 ff00::/8                 Propojené
 16    286 ff00::/8                 Propojené
 10    281 ff00::/8                 Propojené
===========================================================================
Trvalé trasy:
  Žádné

For explanation: I am using CCD profiles and this client is connected with profile:

ifconfig-push 192.168.200.10 192.168.200.9

This is because I want to have static IP on clients. But I must admit, that I don't fully understand of it. I searched, that Win32 TAP driver works only with /30 subnets so client and remote addresses must be in pairs but I don't understand how VPN server handle it and traverse between 192.168.200.9 and 192.168.200.1, there isn't any 192.168.200.9 device so I am not able to ping it. But it is shown after ipconfig /all as DHCP server of my Win32 TAP connection...

Tracert to 192.168.200.1 shows only 1 hop. Tracert to 192.168.100.10 is infinite.

I don't know where to push some route but I think that this is OpenVPN's mechanism problem not routing. This must be purpose that original 192.168.100.10 is not accessible through VPN.

I am totally lost. Maybe I will use DNS name of NAS but it means start VPN's DNS server on NAS... DNS server only for request "Hey, 192.168.200.1, who is NASShared?" with response "That's me." Silly.

Traffic

As I do not know anything about your NAS you will have to find out for yourself but:
I presume you have enabled IP Forwarding on your NAS ?

Mroj

I have Synology DS213+ and I also contacted their support, but I am waiting...
Yes, IP forwarding was manually enabled by SSH.
So you say, that this is not problem of OpenVPN configuration?

Traffic

Mroj wrotethis is not problem of OpenVPN configuration?

If your client 192.168.200.10 can ping your server 192.168.200.1 then OpenVPN is basically working.

You also appear to have the correct routing in place to reach 192.168.100.1 from 192.168.200.10

As you do not appear to be comfortable with net30 subnets you can try using --topology subnet (See --topology in The Manual v23x) you may find this easier to manage.

Also, I notice your client IP appears to be 192.168.0.101/24 .. I would advise you to make sure there are no other networks using the same subnet 192.168.0.0/24 .. even go so far as to change it to something more unique e.g 192.168.57.0/24