hi, i would like to get this setup working: laptop ->router_1 -> router_2 -> router_3 > internet -> openvpn_server laptop: 192.168.55.138 router1: 192.168.55.215 router2: 192.168.55.1 router3: 192.168.178.1 as you can see two routers are not needed in this setup, and they will probably go away after testing. what works: router_1 can connect to the openvpn server (config #2), with config #1 (see below). it works when openvpn is running and when its not. at boot these commands are executed on router_1 [code] sysctl -w net.ipv4.ip_forward=1 iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -o eth0 -j MASQUERADE #disable icmp redirects, because the clients would otherwise not use router_1 echo 0 | tee /proc/sys/net/ipv4/conf/*/send_redirects [/code] on my lan client i got: [code] route -n 0.0.0.0 192.168.55.215 0.0.0.0 UG 1024 0 0 wlan0 192.168.55.0 0.0.0.0 255.255.255.0 U 0 0 0 wlan0 [/code] when openvpn on router_1 is not running i can use the internet from laptop over router_1, when openvpn is running its not workig anymore. for example (openvpn stopped), sending ping packets from laptop like this: [code] ping -c 3 yahoo.com [/code] and receiving them on router_1 works [code] tcpdump -c 3 host yahoo.com 14:30:30.065173 IP 192.168.55.138 > ir2.fp.vip.bf1.yahoo.com: ICMP echo request, id 13250, seq 1, length 64 [/code] now with openvpn running i can still see the packets leaving router_1 [code] tcpdump -i tun0 host yahoo.com 14:38:04.092236 IP 192.168.55.138 > ir1.fp.vip.ne1.yahoo.com: ICMP echo request, id 13325, seq 1, length 64 [/code] but on the openvpn server those packets never show up on tun0 or eth0 config #1 [oconf=client][code] client dev tun proto udp resolv-retry ifinite nobind remote 99.9.90.94 1194 persist-key persist-tun ca ca.crt cert t560.crt key t560.key [/code][/oconf] config #2 [oconf=server][code] proto udp dev tun ca ca.crt cert backup.crt key backup.key dh dh.pem server 10.10.0.0 255.255.255.0 ifconfig-pool-persist ipp keepalive 10 120 status status.log client-to-client push "redirect-gateway def1" push "route 192.168.55.0 255.255.255.0" push "dhcp-option DNS 8.8.8.8" route 192.168.55.0 255.255.255.0 [/code][/oconf] [oconf] and [/oconf] do not seem to work

Please see: [url=http://openvpn.net/index.php/open-source/documentation/howto.html#scope]HOWTO: Expanding the scope of the VPN to include additional machines[/url]

client does not forward packets when it is acting as router

newuser44

hi,

i would like to get this setup working:

laptop ->router_1 -> router_2 -> router_3 > internet -> openvpn_server

laptop: 192.168.55.138
router1: 192.168.55.215
router2: 192.168.55.1
router3: 192.168.178.1

as you can see two routers are not needed in this setup, and they will probably go away after testing.

what works:
router_1 can connect to the openvpn server (config #2), with config #1 (see below).
it works when openvpn is running and when its not.
at boot these commands are executed on router_1

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -o eth0 -j MASQUERADE
#disable icmp redirects, because the clients would otherwise not use router_1
echo 0 | tee /proc/sys/net/ipv4/conf/*/send_redirects

on my lan client i got:

route -n
0.0.0.0         192.168.55.215  0.0.0.0         UG    1024   0        0 wlan0
192.168.55.0    0.0.0.0         255.255.255.0   U     0      0        0 wlan0

when openvpn on router_1 is not running i can use the internet from laptop over router_1, when openvpn is running its not workig anymore.

for example (openvpn stopped), sending ping packets from laptop like this:

ping -c 3 yahoo.com

and receiving them on router_1 works

tcpdump -c 3 host yahoo.com
14:30:30.065173 IP 192.168.55.138 > ir2.fp.vip.bf1.yahoo.com: ICMP echo request, id 13250, seq 1, length 64

now with openvpn running i can still see the packets leaving router_1

tcpdump -i tun0 host yahoo.com
14:38:04.092236 IP 192.168.55.138 > ir1.fp.vip.ne1.yahoo.com: ICMP echo request, id 13325, seq 1, length 64

but on the openvpn server those packets never show up on tun0 or eth0

config #1

client
dev tun
proto udp
resolv-retry ifinite
nobind
remote 99.9.90.94 1194
persist-key
persist-tun
ca ca.crt
cert t560.crt
key t560.key

config #2

proto udp
dev tun
ca ca.crt
cert backup.crt
key backup.key
dh dh.pem
server 10.10.0.0 255.255.255.0
ifconfig-pool-persist ipp
keepalive 10 120
status status.log
client-to-client
push "redirect-gateway def1"
push "route 192.168.55.0 255.255.255.0"

push "dhcp-option DNS 8.8.8.8"
route 192.168.55.0 255.255.255.0

[oconf] and [/oconf] do not seem to work

newuser44

looks like this is the answer:

#1
ip route add 138.201.90.94/32 via 192.168.55.1
#2
ip route replace default dev tun0
#3
iptables -t nat -A POSTROUTING -s 192.168.55.0/24 -o tun0 -j MASQUERADE

#1
why is that one important? after all the openvpn client already got a connection to the server....why would --redirect-gateway break that?

#2
also, just question marks....why is it needed?
does it say: your default output interface is not tun0 instead of eth0?

#3
we want to keep track of the packets we send for other hosts so that answers can be send back to the hosts...right?

TinCanTech

Please see:
HOWTO: Expanding the scope of the VPN to include additional machines

newuser44

youre probably right, but i dont see my questions answered there. could you be a bit more specific?