dann123
Hi,
I have a vpn server which is connected to vpn client having ip 10.30.0.x now. I want it to able to ping another private client connected to vpn server. Please note that other private client is private subnet of vpn server and its not connected to it.
So vpn server is something like 10.20.0.99 and vpn client is 10.30.0.190 and private subnet connected to vpn server is 10.20.0.180. Now 10.30.0.190 can't ping 10.20.0.183 and vice versa. I have enabled client to client in server.conf
Also note that using masquerading it works but then i don't know which exactly is pinging 10.20.0.180. I only see request coming from vpn server.
server.conf
port 1194
proto udp
dev tun
ca ca.crt
cert chicago-vpn.crt
key chicago-vpn.key # This file should be kept secret
dh dh.pem
topology subnet
server 10.10.0.0 255.255.0.0
ifconfig-pool-persist ipp.txt
push "route 10.20.0.0 255.255.0.0"
client-config-dir ccd
ifconfig 10.10.0.1 255.255.255.0
route 10.30.0.0 255.255.0.0 10.10.0.2
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 3
client.conf
client
dev tun
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
comp-lzo
verb 3
route table for vpn server aka 10.20.0.99
0.0.0.0 10.20.0.1 0.0.0.0 UG 0 0 0 eth0
10.10.0.0 0.0.0.0 255.255.0.0 U 0 0 0 tun0
10.20.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
10.30.0.0 10.10.0.2 255.255.0.0 UG 0 0 0 tun0
route table for vpn client aka 10.30.x.x
0.0.0.0 10.30.0.1 0.0.0.0 UG 0 0 0 eth0
10.10.0.0 0.0.0.0 255.255.0.0 U 0 0 0 tun0
10.20.0.0 10.10.0.1 255.255.0.0 UG 0 0 0 tun0
10.30.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
route table for private subnet connected to vpn server
0.0.0.0 10.20.0.1 0.0.0.0 UG 0 0 0 eth0
10.10.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
10.20.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
Also I see following tcpdump when pinging 10.20.0.180 from 10.30.x.x on vpn server
sudo tcpdump -i eth0 'icmp[icmptype] = icmp-echo or icmp[icmptype] = icmp-echoreply'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
21:39:25.264549 IP 10.10.0.2 > 10.20.0.183: ICMP echo request, id 1709, seq 2457, length 64
21:39:25.852635 IP 10.10.0.2 > 10.20.0.183: ICMP echo request, id 1956, seq 70, length 64
21:39:26.264552 IP 10.10.0.2 > 10.20.0.183: ICMP echo request, id 1709, seq 2458, length 64
21:39:26.852661 IP 10.10.0.2 > 10.20.0.183: ICMP echo request, id 1956, seq 71, length 64
While ping 10.30.x.x from 10.20.0.180 on vpn server
sudo tcpdump -i tun0 'icmp[icmptype] = icmp-echo or icmp[icmptype] = icmp-echoreply'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
21:43:56.136264 IP 10.10.0.1 > 10.30.0.194: ICMP echo request, id 6694, seq 1, length 64
21:43:57.135874 IP 10.10.0.1 > 10.30.0.194: ICMP echo request, id 6694, seq 2, length 64
21:43:58.135855 IP 10.10.0.1 > 10.30.0.194: ICMP echo request, id 6694, seq 3, length 64
21:43:59.136256 IP 10.10.0.1 > 10.30.0.194: ICMP echo request, id 6694, seq 4, length 64
21:44:00.135868 IP 10.10.0.1 > 10.30.0.194: ICMP echo request, id 6694, seq 5, length 64
21:44:01.135848 IP 10.10.0.1 > 10.30.0.194: ICMP echo request, id 6694, seq 6, length 64
21:44:02.136093 IP 10.10.0.1 > 10.30.0.194: ICMP echo request, id 6694, seq 7, length 64
Any help will be appreciated.
