lkee168 Hi , I hv set up 3 cliente s A B and C in VPN server . Client A need to access LAN behind B and C . I managed to get Client A access LAN behind B but Not C. Below is my config client A IP = 192.168.1.16 client B IP = 10.82.20.80 client C IP = 10.112.10.30 ip forwarding enable on client B and C VPN server config # Tip - if you are using this as a template for configuring other VPNs: # - the ifconfig-pool-persist file must be unique # - the port/protocol combination must be unique # - different server IPs are recommended # - don't forget about the firewall port 1194 proto udp dev tun ca /etc/pki/CA/ca-cert.pem cert /etc/pki/CA/sys-0-cert.pem key /etc/pki/CA/private/sys-0-key.pem dh /etc/openvpn/ssl/dh1024.pem ## Sub network for VPN Clients ## server 10.8.0.0 255.255.255.0 ## Setting or Assign Clients Static IP Tunnel from Server.## client-config-dir /etc/openvpn/ccd keepalive 10 120 comp-lzo user nobody group nobody multihome persist-key persist-tun ifconfig-pool-persist /etc/openvpn/ipp.txt 120 plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn verb 3 status /etc/openvpn/openvpn-status.log ## Allow clients to communicate with each others.## client-to-client push "dhcp-option DNS 192.168.1.1" push "dhcp-option WINS 192.168.1.1" push "route 192.168.1.0 255.255.255.0" push "route 192.168.2.0 255.255.255.0" route 192.168.1.0 255.255.255.0 route 10.82.20.0 255.255.255.0 route 10.112.10.0 255.255.255.224 ---------- Client A ccd file ifconfig-push 10.8.0.138 10.8.0.137 push "route 10.82.20.64 255.255.255.224" push "route 10.112.10.0 255.255.255.224" iroute 192.168.1.0 255.255.255.0 client B ccd file ifconfig-push 10.8.0.122 10.8.0.121 push "route 192.168.1.0 255.255.255.0" iroute 10.82.20.0 255.255.255.0 client C ccd file ifconfig-push 10.8.0.124 10.8.0.123 push "route 192.168.1.0 255.255.255.0" iroute 10.112.10.0 255.255.255.0
lkee168 ping and traceroute between client A an B Client A #ping 10.82.20.80 PING 10.82.20.80 (10.82.20.80) 56(84) bytes of data. 64 bytes from 10.82.20.80: icmp_seq=1 ttl=64 time=84.5 ms 64 bytes from 10.82.20.80: icmp_seq=2 ttl=64 time=127 ms 64 bytes from 10.82.20.80: icmp_seq=3 ttl=64 time=49.8 ms 64 bytes from 10.82.20.80: icmp_seq=4 ttl=64 time=54.2 ms Client A# traceroute 10.82.20.80 traceroute to 10.82.20.80 (10.82.20.80), 30 hops max, 60 byte packets 1 client B (10.82.20.80) 70.928 ms 74.128 ms 74.134 ms ping and traceroute between client A and C Client A # ping -c 1 10.112.10.30 PING 10.112.10.30 (10.112.10.30) 56(84) bytes of data. --- 10.112.10.30 ping statistics --- 1 packets transmitted, 0 received, 100% packet loss, time 10000ms Client A # trecaroute 10.112.10.30 traceroute to 10.112.10.30 (10.112.10.30), 30 hops max, 60 byte packets 1 10.8.0.1 (10.8.0.1) 1.403 ms 1.391 ms 1.401 ms 2 * * * 3 * * * 4 * * * 5 * * * 6 * * * 7 * * * 8 * * *
TinCanTech lkee168 wrotepush "route 10.82.20.64 255.255.255.224" push "route 10.112.10.0 255.255.255.224"lkee168 wroteclient C ccd file <s> iroute 10.112.10.0 255.255.255.0 :mrgreen:
lkee168 Hi , Thanks for your valuable input . Do you meant to put all push "route " at the global server.conf file and leave only the vpn client with iroute in ccd ? If this is the case , routing table will be populated to all clients ? If I hv 100 clients , all of them will see 100 entry of routing table as well , right ? Is putting push "route" at the ccd file supported ? Many Thanks , chong
TinCanTech My first comment was in regard to the different netmasks you are using .. As for your routing, I cannot tell what is happening without log files.
