The setup is a local router running an OpenVPN client (2.3.11) connected to a remote OpenVPN server that has a subnet behind it. I want to be able to reach any hosts in the remote subnet from my local LAN, behind the local router. This worked flawlessly until I updated the remote OpenVPN server from 2.3 to 2.4.
This is the situation since moving to 2.4:
Remote OpenVPN server: 10.8.0.1
The client on the router: 10.8.0.2
Remote subnet: 10.0.100.0/24
Local subnet: 192.168.0.0/24
- Traffic between the two end points, 10.8.0.1 and 10.8.0.2, flows fine.
- Traffic between 10.8.0.2 (local router) and 10.0.100.0/24 (remote subnet) flows fine.
- Traffic between 192.168.0.0/24 and 10.0.100.0/24 does not traverse the tunnel and stops at the TUN end points: at 10.8.0.1 when source is 10.0.100.0/24, at 10.8.0.2 when source is 192.168.0.0/24.
port 1194
proto udp
dev tun
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist pool
push "route 10.0.100.0 255.255.255.0"
client-config-dir ccd
route 192.168.0.0 255.255.255.0
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
cert /etc/openvpn/server/ovpn-server-longhaul.crt
key /etc/openvpn/server/ovpn-server-longhaul.key
ca /etc/openvpn/server/yorick-pfs.crt
dh /etc/openvpn/server/dh.pem
tls-auth /etc/openvpn/server/ta.key 0
cipher AES-128-CBC
user nobody
group nobody
And
ccd/yorick (for the client):
iroute 192.168.0.0 255.255.255.0
Pertinent parts of the routing table on the remote side (no difference between 2.3 and 2.4):
10.0.100.0/24 dev lxcbr0 proto kernel scope link src 10.0.100.1
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.1
192.168.0.0/24 via 10.8.0.2 dev tun0
So, under 2.4, each side receives the traffic from their respective local subnets in the TUN interface yet it does not traverse the tunnel. Downgrading the remote server to 2.3 immediately remedies the situation. Anyone have any idea what I might be doing wrong here?
