I am trying to enable routing between two hosts each behind separate gateways with openvpn tunnel between the gateways. The subnets behind both gateways are the same (192.168.0.x). One host is behind the OVPN client gateway with IP of 192.168.0.101 and the other host is behind the OVPN server gateway with IP of 192.168.0.10. eth1 on the client gateway has IP of 192.168.0.1 while eth1 on server gateway has IP of 192.168.0.2. From each gateway, I'm able to ping both of the hosts sitting on the 192.168.0.x subnets, but cannot ping between the two hosts sitting on the 192.168.0.x subnet. I'm hoping this can be resolved. Thanks in advance for your assistance! Jeff [b]OpenVPN Client config:[/b] remote 192.168.10.62 3350 proto udp dev tun0 ifconfig 10.8.0.2 10.8.0.1 route 192.168.0.10 255.255.255.255 secret /etc/openvpn/server.key [b]OpenVPN Server config:[/b] port 3350 proto udp dev tun0 ifconfig 10.8.0.1 10.8.0.2 route 192.168.0.101 255.255.255.255 secret /etc/openvpn/server.key [b]Client gateway iptables Config:[/b] *filter -A policy_out -o eth0 -p udp -d 192.168.10.62 --dport 3350 -j ACCEPT -A FORWARD -i tun0 -o eth1-s 10.8.0.0/24 -d 192.168.0.0/24 -m conntrack --ctstate NEW -j ACCEPT -A FORWARD -i tun0 -o eth0 -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT -A FORWARD -i eth1 -o eth0 -s 192.168.0.0/24 -m conntrack --ctstate NEW -j ACCEPT -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT COMMIT *nat -A POSTROUTING -s 192.168.0.0/24 -o tun0 -j MASQUERADE -A POSTROUTING -s 10.8.0.0/24 -o eth1 -j MASQUERADE [b]Server gateway iptables Config:[/b] *filter -A policy_out -o eth0 -p udp -d 192.168.10.61 --dport 3350 -j ACCEPT -A FORWARD -i tun0 -o eth1-s 10.8.0.0/24 -d 192.168.0.0/24 -m conntrack --ctstate NEW -j ACCEPT -A FORWARD -i tun0 -o eth0 -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT -A FORWARD -i eth1 -o eth0 -s 192.168.0.0/24 -m conntrack --ctstate NEW -j ACCEPT -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT COMMIT *nat -A POSTROUTING -s 192.168.0.0/24 -o tun0 -j MASQUERADE -A POSTROUTING -s 10.8.0.0/24 -o eth1 -j MASQUERADE

See [b]--client-nat[/b] in [url=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage]The Manual v23x[/url]

Tunnel between gateways with same LAN subnets

jeffhuckins

I am trying to enable routing between two hosts each behind separate gateways with openvpn tunnel between the gateways. The subnets behind both gateways are the same (192.168.0.x). One host is behind the OVPN client gateway with IP of 192.168.0.101 and the other host is behind the OVPN server gateway with IP of 192.168.0.10. eth1 on the client gateway has IP of 192.168.0.1 while eth1 on server gateway has IP of 192.168.0.2.

From each gateway, I'm able to ping both of the hosts sitting on the 192.168.0.x subnets, but cannot ping between the two hosts sitting on the 192.168.0.x subnet.

I'm hoping this can be resolved.

Thanks in advance for your assistance!
Jeff

OpenVPN Client config:
remote 192.168.10.62 3350
proto udp
dev tun0
ifconfig 10.8.0.2 10.8.0.1
route 192.168.0.10 255.255.255.255
secret /etc/openvpn/server.key

OpenVPN Server config:
port 3350
proto udp
dev tun0
ifconfig 10.8.0.1 10.8.0.2
route 192.168.0.101 255.255.255.255
secret /etc/openvpn/server.key

Client gateway iptables Config:
*filter
-A policy_out -o eth0 -p udp -d 192.168.10.62 --dport 3350 -j ACCEPT
-A FORWARD -i tun0 -o eth1-s 10.8.0.0/24 -d 192.168.0.0/24 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -i tun0 -o eth0 -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -i eth1 -o eth0 -s 192.168.0.0/24 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
COMMIT

*nat
-A POSTROUTING -s 192.168.0.0/24 -o tun0 -j MASQUERADE
-A POSTROUTING -s 10.8.0.0/24 -o eth1 -j MASQUERADE

Server gateway iptables Config:
*filter
-A policy_out -o eth0 -p udp -d 192.168.10.61 --dport 3350 -j ACCEPT
-A FORWARD -i tun0 -o eth1-s 10.8.0.0/24 -d 192.168.0.0/24 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -i tun0 -o eth0 -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -i eth1 -o eth0 -s 192.168.0.0/24 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
COMMIT

*nat
-A POSTROUTING -s 192.168.0.0/24 -o tun0 -j MASQUERADE
-A POSTROUTING -s 10.8.0.0/24 -o eth1 -j MASQUERADE

Traffic

See --client-nat in The Manual v23x

jeffhuckins

Hey, Traffic,
I found the reference to --client-nat in the manual, but it provides no examples. For my example, can somebody provide me with what the entries in the client and server config files need to look like?

Thanks!
Jeff