jwmhosting
I have a simple client/server VPN that has been working for several months. The client is on a local LAN. I want to have other clients on the same local LAN as the VPN client be able to access the VPN server using the VPN client as a gateway. BTW, these are all Windows clients on the LAN.
VPNServer VPN IP 10.8.0.1
VPNClient's VPN IP 10.8.0.2, same client's local LAN IP 192.168.0.200
LAN Client wanting to access VPN Server 192.168.0.10 (aka 'client2', no OpenVPN services installed)
Here's the way I understand it is supposed to happen (obviously I likely have flaws in this understanding...) When client2 issues ping to 10.8.0.1 (VPNServer), since the 10.x.x.x address is not part of client2's subnet, it would normally get routed to the LAN's gateway. Instead it needs to get routed to the VPNClient acting as a gateway. I know one way to do this is to tell the LAN gateway to re-route 10.x.x.x to the VPNClient. But I hit a brick wall trying to figure out how to configure my Arris gateway to do that. So instead I set up direct IP routing in client2:
[c:\]route add 10.8.0.1 MASK 255.255.255.255 192.168.0.200
Not sure it was necessary, but just to ensure the routing was working, I added a second route to client2 just to see if I could get the VPNClient's IP address:
[c:\]route add 10.8.0.2 MASK 255.255.255.255 192.168.0.200
Per the How-To/Wiki I went into REGEDIT on the VPNClient and set the bit for IP Forwarding = true
Back on client2, I can ping 10.8.0.2 (the VPNClient's IP) and the ping responds. But when I ping 10.8.0.1 (VPNServer), it doesn't respond. If I go to the VPNClient and issue the ping to the server, it responds.
So, I'm pretty sure the ping from client2 is getting to the VPNClient. But it appears that the VPNClient does not know that it should be acting as a gateway and routing client2's ping on to the server. I'm sure I'm missing something in the VPNClient's config:
client
dev tun
dev-node OpenVPN3
proto tcp
remote xx.xx.xxx.xxx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\config\\keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\keys\\jerry.crt"
key "C:\\Program Files\\OpenVPN\\config\\keys\\jerry.key"
remote-cert-tls server
cipher AES-128-CBC # AES
comp-lzo
verb 3
Thanks so much for any help you can provide. I'm on a deadline to get this working....
Jerry
jwmhosting
I just have one question.... How do you configure a VPN client to make it act as a gateway/router?
Details:
I have definitely isolated the problem to the fact that the VPN client is simply not acting as a gateway, either direction (i.e. forwarding the packets along).
From the VPN Server, I can ping the LAN IP of the client (192.168,0.9) and get a reply. But when I ping another box on the LAN (192.168.0.10), no reply. Wiresharking the VPN interface on the VPN client shows the ping coming in to the client box destined for 192.168.0.10. But it shows no response. Wiresharking the LAN adapter on the VPN client machine shows no ping going out onto the LAN. So it's pretty clear that the VPN client is eating the request.
Likewise, from the VPN Client box, I can ping the VPN server (10.6.0.1). From the second box, I can ping the VPN client (10.6.0.2) but not the VPN server. Again, the VPN client is apparently eating the ping that I was expecting it to forward on to the VPN server.
I have set up a manual route in the 2nd client to send 10.6.0.1 to the VPN client 192.168.0.9. Tracert shows it gets to the box. But again, nothing past that.
These are both Windows 10 boxes. I have set the IPForwardEnable DWORD in the registry on the VPN client machine. I have totally turned off the Windows firewall for now on the VPN client box.
I have looked at tons of examples and posts and articles. And I think I've tried everything once.... In the sample configs I haven't seen any "be a gateway"-type config line or anything else that is significantly different than my VPN client.
What am I missing? How do you make a VPN client act as a gateway? I set verb 99 on the VPN client hoping to get it to dump some sort of trace or hint as to what it is doing. But I could see anything in the log that offered any insight.
Please help!
Thanks.
Jerry
