hypermoose
Hi, I have a working OpenVPN server running on a RaspberryPi on my home network. 192.168.1.0/24. The Pi is 192.168.1.50 and my router is 192.168.1.1. I've setup OpenVPN to issue out 192.168.5.0/24 ip addresses to the clients.
My client is a DD-WRT router running openvpn. That router has a bridged network with its LAN and wireless devices called br0 on the subnet 192.168.11.0/24. Testing just on the raspberry pi and the DD-WRT router I can ping from the DD-WRT router to all of my devices on the 192.168.1.0 network. However I can only ping the DD-WRT client ip issued by OpenVPN. Which is usually 192.168.5.6 or .10. I can't ping any of the 192.168.11.0/24 ips including the DD-WRT routers 192.168.11.0. I have routes setup to route all the networks correctly.
On the DD-WRT router:
Destination Gateway Genmask Flags Metric Ref Use Iface
default 10.104.188.1 0.0.0.0 UG 0 0 0 ath0
10.104.188.0 * 255.255.252.0 U 0 0 0 ath0
127.0.0.0 * 255.0.0.0 U 0 0 0 lo
169.254.0.0 * 255.255.0.0 U 0 0 0 br0
192.168.1.0 192.168.5.9 255.255.255.0 UG 0 0 0 tun1
192.168.5.0 192.168.5.9 255.255.255.0 UG 0 0 0 tun1
192.168.5.9 * 255.255.255.255 UH 0 0 0 tun1
192.168.11.0 * 255.255.255.0 U 0 0 0 br0
On my Raspberry Pi I have:
Destination Gateway Genmask Flags Metric Ref Use Iface
default D104N2.hsd1.wa. 0.0.0.0 UG 212 0 0 br0
192.168.1.0 * 255.255.255.0 U 212 0 0 br0
192.168.5.0 192.168.5.2 255.255.255.0 UG 0 0 0 tun0
192.168.5.2 * 255.255.255.255 UH 0 0 0 tun0
192.168.11.0 192.168.5.2 255.255.255.0 UG 0 0 0 tun0
I suspect iptables on DD-WRT but I can't find anything useful. If i run tcpdump -i tun1 icmp on the DD-WRT router I see nothing when I ping 192.168.11.1 from the Raspberry Pi. However if I run tcppdump -i tun0 icmp on the RaspberryPi I see the request going out over the tun0 interface.
Any suggestions?
SomeGuy
If traffic from the OpenVPN clients only needs to be able to connect to internal resources beyond the vpn server, and internal resources do NOT need to initiate connections to OpenVPN clients, then you could look into using NAT on the OpenVPN Server, and NAT traffic from its tun* interface through the interface to the other networks. Then you could look into --redirect-gateway options in the server config.
If you want "real" routing between hosts one one subnet through to clients on the VPN and back again without using NAT so internal subnets can reach VPN Clients, and the other way around, look into "--iroute" to notify OpenVPN of internal routing it will be expected to perform *after* the system routing is setup to use the tunnel interface(s).
Also look to push routes to clients with --push and "route" options, from the openvpn server config.
See man page for details on all of these.
