Connecting two clients on different tun devices

macdis

Hi,

I am having trouble getting two clients to communicate in the following setup.

My router (10.1.1.1) is running an OpenVPN server (tun21).

My router is also running an OpenVPN client to connect to an external VPN provider (tun11).

A client (let's call it CLIENT_1) in the outside world can connect to the OpenVPN server on my router, no problem. Let's say it's assigned 10.8.0.2 by the OpenVPN server. I've set up the configuration so that this outside client can access the LAN. (This works, except for what I mention below.)

Another client (let's call it CLIENT_2 with local IP 10.1.1.150) on my LAN connects to the outside world via the router's OpenVPN client. In fact, all local clients in the DHCP range 10.1.1.128/26 are automatically put into this OpenVPN client zone. Let's say this second client is assigned 10.3.0.2.

So far everything works like a charm.

However, CLIENT_1 can ping any machine on my LAN except those belonging to 10.1.1.128/26, i.e., machines in the OpenVPN client zone.

In other words, what doesn't work is CLIENT_1 trying to reach (ping, whatever) CLIENT_2 (because CLIENT_2 with local IP 10.1.1.150 is in the 10.1.1.128/26 range and in the OpenVPN client zone).

What can I do to allow CLIENT_1 to reach CLIENT_2? In other words, how can a client on tun21 and another on tun11 talk to each other?

Thanks for any help. I'm sorry in advance if I've said or done something stupid with this setup. I'm a total amateur.

macdis

I initially thought this was a routing problem, but it turned out to be an iptables issue stemming from my having previously limited all outbound traffic from DHCP clients to tun11 (and then forgetting that I'd done so :roll: ). The client was trying to respond to connection requests, but the packets were being blocked by that rule. I kept my existing rules and got ssh connectivity back by allowing the client in question access to the other OpenVPN subnet by adding this rule:

iptables -I FORWARD -p tcp --sport 22 -s 10.1.1.150 -d 10.8.0.0/24 -j ACCEPT