Hello all. I've just joined to clear up some confusion. I have a CCENT going for CCNA and I'd like to completely understand how OpenVPN works re: routing.
First my configs are as follows:
Server
port 1194
proto udp
dev tun
ca "C:\\Program Files (x86)\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files (x86)\\OpenVPN\\config\\VPN-SVR-CA.crt"
key "C:\\Program Files (x86)\\OpenVPN\\config\\VPN-SVR-CA.key" # This file should be kept secret
dh "C:\\Program Files (x86)\\OpenVPN\\config\\dh1024.pem"
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.8.0.0 255.255.255.0 10.8.0.1 1"
push "route 192.168.1.0 255.255.255.0"
keepalive 10 120
cipher AES-256-CBC # AES
comp-lzo
max-clients 4
persist-key
persist-tun
status openvpn-status.log
verb 3
Client
client
dev tun
proto udp
remote <my-public-ip> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files (x86)\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files (x86)\\OpenVPN\\config\\WRATH-LAPTOP.crt"
key "C:\\Program Files (x86)\\OpenVPN\\config\\WRATH-LAPTOP.key"
ns-cert-type server
cipher AES-256-CBC
comp-lzo
verb 3
My goal here is to place an OpenVPN server at a remote location and have 1 or 2 computers connect to the network at the remote location, i.e. a remote access VPN as opposed to a site-to-site setup. This is to allow remote access to the remote office's applications seurity camera feed.
I've been testing the feasibility of using OpenVPN with the actual physical server and a VMWare VM as the client. They're both on the same network so I've had to tether my phones data connection to have two separate LANs for testing purposes. I've been able to successfully ping between server (VPN-SVR, 10.8.0.1) and client (WRATH-LAPTOP, 10.8.0.6).
That's enough exposition, I hope. Now I've realized that the TAP adapters on each machine (client & server) use a /30 subnet mask which confuses me, because 10.8.0.1 and 10.8.0.6 would then be in different subnets thus not allowing a ping without a router being present. I was under the impression that a point-to-point connection (VPN-SVR, 10.8.0.1 <--> WRATH-LAPTOP, 10.8.0.2) would have occurred but the client machine gets an IP address of 10.8.0.6 instead, and pings work! How is that possible?
So I check the routing tables on each machine:
Server
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.124 10
10.8.0.0 255.255.255.0 10.8.0.6 10.8.0.1 31
10.8.0.0 255.255.255.0 10.8.0.2 10.8.0.1 30
10.8.0.0 255.255.255.252 On-link 10.8.0.1 286
10.8.0.1 255.255.255.255 On-link 10.8.0.1 286
10.8.0.3 255.255.255.255 On-link 10.8.0.1 286
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.1.0 255.255.255.0 On-link 192.168.1.124 266
192.168.1.124 255.255.255.255 On-link 192.168.1.124 266
192.168.1.255 255.255.255.255 On-link 192.168.1.124 266
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.8.0.1 286
224.0.0.0 240.0.0.0 On-link 192.168.1.124 266
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.8.0.1 286
255.255.255.255 255.255.255.255 On-link 192.168.1.124 266
===========================================================================
Persistent Routes:
None
Client
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.137.1 192.168.137.132 10
10.8.0.1 255.255.255.255 10.8.0.5 10.8.0.6 30
10.8.0.4 255.255.255.252 On-link 10.8.0.6 286
10.8.0.6 255.255.255.255 On-link 10.8.0.6 286
10.8.0.7 255.255.255.255 On-link 10.8.0.6 286
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.1.0 255.255.255.0 10.8.0.1 192.168.137.132 11
192.168.137.0 255.255.255.0 On-link 192.168.137.132 266
192.168.137.132 255.255.255.255 On-link 192.168.137.132 266
192.168.137.255 255.255.255.255 On-link 192.168.137.132 266
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.8.0.6 286
224.0.0.0 240.0.0.0 On-link 192.168.137.132 266
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.8.0.6 286
255.255.255.255 255.255.255.255 On-link 192.168.137.132 266
===========================================================================
Persistent Routes:
None
The routes on each machine seem to send traffic meant for the VPN to IP addresses that aren't even assigned, i.e. 10.8.0.2 gets traffic meant for 10.8.0.0/24 on server, and 10.8.0.5 does the same on the client. Why is that?
Last question for now, I've pushed a route from the server for 192.168.1.0/24 and it seems to arrive at the client correctly but it uses the IP address of the NIC going to the Internet (192.168.137.132) instead of using the NIC connected to the VPN server (10.8.0.6). Any suggestions why this may happen?
