[Solved] Accessing client side lan

headhunter942135

I'm trying to set up OpenVPN server but having trouble getting access to the other computers attached to the client network. Here is the scenario :

The OpenVPS server is hosted on a VPS ( with expample IP address 64.255.183.119 ). Clients that connects to the server also uses the server's Internet

Client A ( 192.168.1.10 ) connects to the VPN server and shares it's subnet ( 192.168.1.0/24 ) with all other clients which maybe connected to the VPN

Client B ( 192.168.20.20 ) connects to the VPN and wants to access an IP address in Client A's subnet but client B doesn't want to share the other IP addresses on it's own subnet ( 192.168.20.0/24 ).

I'm not able to ping or access any machines on the Client A ( 192.168.1.0/24 ) aside from Client A's own ip address ( either is 192.168.1.10 or 10.8.0.6 which is the OpenVPN assigned address ). From Client A I can ping the OpenVPN server.

Here is the server configuration file

server.conf
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
route 192.168.235.0 255.255.255.0
client-to-client
push "route 192.168.235.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
key-direction 0
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
persist-key
persist-tun
status openvpn-status.log
verb 3

And here is the file for Client A

iroute 192.168.1.0 255.255.255.0

TinCanTech

headhunter942135 wroteiroute 192.168.1.0 255.255.255.0

The server config needs this route

HOWTO: Expanding the scope of the VPN to include additional machines

headhunter942135

So if the server has an IP subnet of 10.17.15.0/24, I would need to add something like

push "route 10.17.15.0 255.255.255.0 "

TinCanTech

That would allow access from the client to the server LAN ..

headhunter942135

Corrected the server.conf file.

server.conf
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
route 192.168.1.0 255.255.255.0
client-to-client
push "route 192.168.1.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
key-direction 0
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
persist-key
persist-tun
status openvpn-status.log
verb 3

and here is the corresponding ccd for client A

iroute 192.168.1.0 255.255.255.0

With the changes still can't get another computer on the same subnet as client A to access the server ( or the server to recognize the other computer on computer A's subnet ).

Client A has the following IP address 192.168.1.99 ( local address ) and 10.8.0.6 ( the address assigned by OpenVPN ). There is another computer on the same subnet as client A with local address 192.168.1.160.

On 192.168.1.160, I added the route 10.8.0.0/24 via 10.8.0.6

From the server I can ping 192.168.1.99 and 10.8.06 but if I try to ping 192.168.1.160 it times outs.
From 192.168.1.160 I can ping 192.168.1.99 and 10.8.06 but if I try to ping the server ( which is 10.8.0.1, right? ) it also gets timed out.

TinCanTech

headhunter942135 wroteFrom the server I can ping 192.168.1.99 and 10.8.06 but if I try to ping 192.168.1.160 it times outs

Add a permanent route for the vpn subnet to 192.168.1.160

headhunter942135

Tried adding permanent route but still not working. Here are the routing tables for the VPN server and Client A

VPN Server

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         gateway         0.0.0.0         UG    0      0        0 eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        *               255.255.255.255 UH    0      0        0 tun0
10.17.0.0       *               255.255.0.0     U     0      0        0 eth0
55.55.128.0     *               255.255.192.0   U     0      0        0 eth0
192.168.1.0     10.8.0.2        255.255.255.0   UG    0      0        0 tun0
192.168.1.160   10.8.0.2        255.255.255.255 UGH   0      0        0 tun0

Client A

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.8.0.5        128.0.0.0       UG    0      0        0 tun0
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 eth0
10.8.0.0        10.8.0.5        255.255.255.0   UG    0      0        0 tun0
10.8.0.5        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
10.17.0.0       10.8.0.5        255.255.0.0     UG    0      0        0 tun0
55.55.182.157   192.168.1.1     255.255.255.255 UGH   0      0        0 eth0
128.0.0.0       10.8.0.5        128.0.0.0       UG    0      0        0 tun0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0

Here is the routing table for the machine ( 192.168.1.160 ) that is in the same subnet as Client A but doesn't have the OpenVPN client running.

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     192.168.1.1     192.168.1.160    276
         10.8.0.0    255.255.255.0        10.8.0.6     192.168.1.160     21
        10.17.0.0      255.255.0.0    192.168.1.10     192.168.1.160     21
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.1.0  	 255.255.255.0         On-link     192.168.1.160    276
    192.168.1.160  255.255.255.255         On-link     192.168.1.160    276
    192.168.1.255  255.255.255.255         On-link     192.168.1.160    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     192.168.1.160    276
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     192.168.1.160    276
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
          0.0.0.0          0.0.0.0         25.0.0.1  Default
          0.0.0.0          0.0.0.0      192.168.1.1  Default
===========================================================================

TinCanTech

headhunter942135 wroteHere is the routing table for the machine ( 192.168.1.160 ) that is in the same subnet as Client A but doesn't have the OpenVPN client running.

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     192.168.1.1     192.168.1.160    276
          
        This gateway is wrong .. 192.168.1.xxx where openvpn *is* running
         10.8.0.0    255.255.255.0        10.8.0.6     192.168.1.160     21
         
        10.17.0.0      255.255.0.0    192.168.1.10     192.168.1.160     21

headhunter942135

I changed it so that it now reads

10.8.0.0    255.255.255.0   192.168.1.99  192.168.235.160

Still not able to access 192.168.1.160 from either the VPN server or from Client A.

TinCanTech

Have you enabled IP_Forward on the vpn client (as you do on the server) ?

headhunter942135

Just enabled IP_forward on the VPN clients. Still can't access 192.168.1.160

TinCanTech

headhunter942135 wroteJust enabled IP_forward on the VPN clients

Did you enable it on the correct client .. ie: the one running openvpn/client ?

Basically, you have all the steps in place so you will have to determine at which step the packets are dropped or routed incorrectly. Also, make sure your firewalls allow such packets.

headhunter942135

Thanks. I was able to get it working by enabling IP forwarding and by adding a route to the VPN clients.

TinCanTech

Thanks for letting us know you solved this 8-)