A bit of trouble configuring client-to-client connectivity

Haran

Hi there,
I'm trying to setup a OpenVPN connection among 3 machines but have been having trouble making clients see each other:

OpenVPN server
OS: Windows Server 2012
Not in a LAN
Public IP: 1.2.3.4
OpenVPN private IP: 172.20.0.1

OpenVPN client 2
OS: Windows 10
Behind Router (172.16.0.1)
LAN IP: 172.16.0.3

OpenVPN client 2
OS: Windows Server 2012
Behind Router (172.18.0.1)
LAN IP: 172.18.0.3

This is my server.ovpn

port 51194
proto udp
dev tun
dev-node OpenVPN-TAP
ca server_config\\ca.crt
cert server_config\\server.crt
key server_config\\server.key
dh server_config\\dh2048.pem
topology subnet
server 172.20.0.0 255.255.255.0
ifconfig-pool-persist server_config\\ipp.txt
route 172.16.0.0 255.255.255.0
route 172.18.0.0 255.255.255.0
push "route 172.16.0.0 255.255.255.0"
push "route 172.18.0.0 255.255.255.0"
push "route 172.20.0.0 255.255.255.0"
client-config-dir server_config\\ccd
client-to-client
keepalive 10 120
tls-auth server_config\\ta.key 0
cipher AES-128-CBC
comp-lzo
max-clients 10
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 3

and here is the clients config:

client
dev tun
dev-node OpenVPN-TAP
proto udp
remote 1.2.3.4 51194
resolv-retry infinite
nobind
persist-key
persist-tun
ca clientX_config\\ca.crt
cert clientX_config\\clientX.crt
key clientX_config\\clientX.key
remote-cert-tls server
tls-auth clientX_config\\ta.key 1
cipher AES-128-CBC
comp-lzo
verb 3
push "route 0.0.0.0 mask 0.0.0.0 172.20.0.1 metric 999 if 16"

Both clients can connect to the server
Both clients can access resources on the server (including SMB shares)
Server can access resources on both clients

Client 1 does not see Client 2 and vice versa.

There must be something obvious that I am missing but what?

Thanks,
Haran

Traffic

Haran wroteand here is the clients config:
Quote:
client
<..>
push "route 0.0.0.0 mask 0.0.0.0 172.20.0.1 metric 999 if 16"

You cannot --push from the client :ugeek:

Haran

whops! that was a test 😛

Even removing it clients cannot see each other 🙁

Haran

Traffic

Can the clients ping the server .. can the server ping the clients .. can the clients ping each other ?

Haran

Hi Traffic,
Server can ping clients.
Clients can ping server.
Clients cannot ping each other. Packets from each client are correctly sent to the server so I suppose it's then server not routing them correctly.

H.

Traffic

Check your windows clients firewalls ..

Haran

firewalls are down on both clients. Can't you see anything wrong in my configs?

Thanks,
H.

Traffic

What IP addresses are you trying to ping ?

Using --client-to-client configures the server such that client to client packets are routed internally
to the openvpn process .. not even hitting the server tap device or firewall.
I believe this also applies to client subnet to client subnet via ccd --iroutes ..

Please set --verb 4 and then check your logs .. post them here for further advice.