Let me start this by saying I'm not a network guru, I know enough to be dangerous, and this is the first time I've set up OpenVPN. I got roped into helping on this project, this was supposed to be setting up a Netgear router that would handle the OpenVPN server tasks and everything would work perfect. Now that that's failed we're trying to get something running ASAP.
So I'm currently setting up openvpn server on my home server (a box running Ubuntu 15.10), but I'm hoping to transfer (most of) the configuration over to their Windows Server machine once it's working correctly. The main purpose of this VPN is to allow Remote Desktop access to virtual machines running on the same server OpenVPN will most likely be on, and also remote desktop between the various clients (both local and remote) as needed (not mission critical). General internet access does NOT want to go through the VPN.
I'm using 10.31.12.0/24 as my server-side lan, with a dd-wrt gateway at .1 and the server at .15. OpenVPN is set for 10.31.11.0/24 as the network. The client is a windows 7 laptop tethered to my cell phone on 192.168.1.x. Currently I can log in to the VPN and ping/access the vpn server at 10.31.11.1, but not 10.31.12.x. I have enabled IP forwarding on the server and I think I got iptables configured right, and windows firewall is down on the client. Can you take a look and see if you can spot my problem?
Here is the routing table from my server:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default Recalculating 0.0.0.0 UG 100 0 0 eth0
10.31.11.0 * 255.255.255.0 U 0 0 0 tun0
10.31.12.0 * 255.255.255.0 U 100 0 0 eth0
client:
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.2 25
10.31.11.0 255.255.255.0 On-link 10.31.11.2 276
10.31.11.2 255.255.255.255 On-link 10.31.11.2 276
10.31.11.255 255.255.255.255 On-link 10.31.11.2 276
10.32.12.0 255.255.255.0 10.31.11.1 10.31.11.2 21 <- shouldn't this work?
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.1.0 255.255.255.0 On-link 192.168.1.2 281
192.168.1.2 255.255.255.255 On-link 192.168.1.2 281
192.168.1.255 255.255.255.255 On-link 192.168.1.2 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.1.2 281
224.0.0.0 240.0.0.0 On-link 10.31.11.2 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.1.2 281
255.255.255.255 255.255.255.255 On-link 10.31.11.2 276
and the dd-wrt router:
10.21.1.1 255.255.255.255 0.0.0.0 UH 0 ppp0
10.31.11.0 255.255.255.0 10.31.12.15 UG 0 LAN & WLAN
10.31.12.0 255.255.255.0 0.0.0.0 U 0 LAN & WLAN
169.254.0.0 255.255.0.0 0.0.0.0 U 0 LAN & WLAN
0.0.0.0 0.0.0.0 10.21.1.1 UG 0 ppp0
Also server config:
port 1194
proto udp
dev tun
ca xxxx
cert xxx
key xxxx
dh xxx
topology subnet
server 10.31.11.0 255.255.255.0
push "route 10.32.12.0 255.255.255.0"
client-to-client
ifconfig-pool-persist ipp.txt
keepalive 10 120
tls-auth xxx 0
cipher AES-256-CBC # AES
comp-lzo
max-clients 20
persist-key
persist-tun
status openvpn-status.log
verb 3
and client config:
client
dev tun
proto udp
remote xxx.duckdns.org 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca xxxx
cert xxxx
key xxxx
remote-cert-tls server
tls-auth xxx 1
cipher AES-256-CBC
comp-lzo
verb 3
route-method exe
route-delay 2
