Ping accept only on GW

corsairetc

Hello,
I try figure out why I can ping from to vpn only on gateway not the clients.
I have vpn network 192.168.44.0/24
I have DMZ network 172.100.200.0/27

If I ping from vpn network to dmz network on gateway 172.100.200.30 ping work but if I want to ping to some client in this network ping stop and there is no such messages like host unreachable...
Same situation is when I try to ping from dmz to vpn network ping on vpn gateway 192.168.44.1 work but on vpn client 192.168.44.30 nothing.
Iptables says Accept in log.

RULE 11 -- ACCEPT IN=eth1 OUT=tun1 MAC=50:65:f3:XX:XX:c5:XX:23:54:18:b5:XX:XX:XX SRC=172.100.200.14 DST=192.168.44.30 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=9333 DF PROTO=ICMP TYPE=8 CODE=0 ID=1886 SEQ=7

I have rule in iptables for dmz to vpn any allow ;and vpn to dmz any allow
Thank you for any help.
PS: In sysctl.conf I have enabled ipv4 forward

TinCanTech

Please see the Forum rules (top of this page)

corsairetc

corsairetc wroteHello,
I try figure out why I can ping from to vpn only on gateway not the clients.
I have vpn network 192.168.44.0/24
I have DMZ network 172.100.200.0/27

If I ping from vpn network to dmz network on gateway 172.100.200.30 ping work but if I want to ping to some client in this network ping stop and there is no such messages like host unreachable...
Same situation is when I try to ping from dmz to vpn network ping on vpn gateway 192.168.44.1 work but on vpn client 192.168.44.30 nothing.
Iptables says Accept in log.
RULE 11 -- ACCEPT IN=eth1 OUT=tun1 MAC=50:65:f3:XX:XX:c5:XX:23:54:18:b5:XX:XX:XX SRC=172.100.200.14 DST=192.168.44.30 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=9333 DF PROTO=ICMP TYPE=8 CODE=0 ID=1886 SEQ=7
I have rule in iptables for dmz to vpn any allow ;and vpn to dmz any allow
Thank you for any help.
PS: In sysctl.conf I have enabled ipv4 forward

Here is server config:

local 192.168.18.8
port 1194
proto udp
dev tun1
tun-mtu 1500
mssfix 1360
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 192.168.44.0 255.255.255.0
ifconfig-pool-persist ipp.txt
#ifconfig-push 192.168.44.22 192.168.44.21
#push "route 192.168.2.0 255.255.255.0"
push "route 172.200.100.0 255.255.255.224"
push "route 192.168.0.0 255.255.255.0"
#push "dhcp-option DNS 192.168.0.254"
push "dhcp-option DOMAIN filipnet.cz"
#route 192.168.10.0 255.255.255.0
#route 192.168.3.0 255.255.255.224
client-to-client
#client-config-dir /etc/openvpn/ccd
keepalive 10 120
#tls-auth /etc/openvpn/easy-rsa/ta.key 0
cipher AES-256-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /etc/openvpn/openvpn-status.log
log /etc/openvpn/vpn.log
verb 3
script-security 2

Here is the client conf:

client
dev tun0
proto udp
remote my ip 1194
nobind
user nobody
group nogroup
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/vlinux.crt
key /etc/openvpn/vlinux.key
cipher AES-256-CBC
comp-lzo
verb 5
script-security 2
log /etc/openvpn/vpn.log

TinCanTech

corsairetc wroteIf I ping from vpn network to dmz network on gateway 172.100.200.30 ping work but if I want to ping to some client in this network ping stop

Add a route to those clients pointing to your vpn gateway.

corsairetc

I pushing route
push "route 172.200.100.0 255.255.255.224"
I ping from vpn clinet with ip 192.168.44.30 to dmz client 172.10.200.14 and ping not reply. Ping on DMZ gateway 172.100.200.30 work.

corsairetc

corsairetc wroteI pushing route
push "route 172.200.100.0 255.255.255.224"
I ping from vpn clinet with ip 192.168.44.30 to dmz client 172.10.200.14 and ping not reply. Ping on DMZ gateway 172.100.200.30 work.

Here is the client routing table:

root@vlinux2:/etc/openvpn# ip r
default via 192.168.3.62 dev eth0 
172.16.167.0/24 dev vmnet1  proto kernel  scope link  src 172.16.167.1 
172.200.100.0/27 via 192.168.44.29 dev tun0 
192.168.0.0/24 via 192.168.44.29 dev tun0 
192.168.3.0/26 dev eth0  proto kernel  scope link  src 192.168.3.61 
192.168.44.0/24 via 192.168.44.29 dev tun0 
192.168.44.29 dev tun0  proto kernel  scope link  src 192.168.44.30 
192.168.255.0/24 dev vmnet8  proto kernel  scope link  src 192.168.255.1

corsairetc

Sorry to all.
I need to create topic and paste client routing table and realize how big idiot I am :-)
172.200.100.0/27 via 192.168.44.29 dev tun0
but I have:
172.100.200.0/27
Now is ping work.

TinCanTech

We all make mistakes .. thanks for letting us know you solved this 8-)