Server Configuration For Site-To-Site + Road Warrior

RERobbins

I am running an OpenVPN Server in an Amazon Web Service Virtual Private Cloud on LAN A and a Centos 7 virtual machine on LAN B with an openvpn client.

I followed these instructions https://docs.openvpn.net/how-to-tutorialsguides/virtual-platforms/site-to-site-layer-3-routin-using-openvpn-access-server/ and have a well running site-to-site connection between LAN A and LAN B.

The OpenVPN Server has a routable, static IP address. The OpenVPN client sits behind an Untangle firewall.

The server is assigning addresses to clients from 192.168.3.0/24. LAN A is using 10.0.0.0/16 for its address space. LAB B is using 198.183.xxx.0/24 for its address space.

I have now started to add other individual clients to the server and while they can communicate with hosts on LAN A they are unable to communicate with hosts on LAN B. I am unsure what I need to do to get individual clients to access LAN B hosts.

I keep fussing with the server VPN settings tab as well as the User permissions tab for both the site-to-site user id and the individual user id. I had hoped that by configuring the site-to-site user id as a VPN gateway for the LAN B private net that would suffice to permit individual clients to access that private net once I had entered settings to allow them to access that network.

In the VPN settings tab I route VPN clients using NAT giving all clients access to 10.0.0.0/16.

In the advanced VPN settings tab I disable clients from communicating with each other unless explicitly allowed by user permissions.

My "bridge" user uses NAT for access control and is set to allow access to LAN B and to allow access from all server-side private subnets and all other VPN clients. That user is also configured as a VPN gateway for the LAN B client subnet.

My road warrior user is set to use NAT addressing and is allowed access to LAN B. I have also enable allow access from all server-side subnets and all other VPN clients for this user.

I thought that by enabling the bridge user as a VPN gateway for the LAN B subnet that packets coming from the road warrior destined for LAN B would be routed correctly to the bridge user established tunnel.

Do I need to add a push command somewhere to tell the road warrior user client how to route packets destined for LAN B?

RERobbins

I can now answer my own question.

I needed to add a static route on the LAN B gateway device to route back to the OpenVPN private address space.

Until I used tpcdump to watch the packets flow it never would have occurred to me that a ping request from a remote client in the 192.168.3.0/24 net to a host on LAN B would be routed all the way through to LAN B as a 192.168.3.0/24 address. I assumed that since since I use NAT throughout and don't route private OpenVPN addresses the request would appear to the LAN B host as having come from the 10.0.0.0/16 network. I was wrong.

So, in addition to the needing a route on the LAN B gateway for 10.0.0.0/16 traffic I added a route for 192.168.3.0/24 traffic.