Hi!
I play for this some time...
i have a vpn server:
port 10501
tls-server
proto udp
dev bolt-tun
dev-type tun
mode server.
ifconfig 10.250.250.1 255.255.255.0
client-config-dir ccd-bolt
ca /etc/ssl/ca.crt
cert /etc/ssl/server.crt
key /etc/ssl/server.key # This file should be kept secret
dh /etc/ssl/dh1024.pem
keepalive 10 120
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/bolt-status.log
log /var/log/openvpn/bolt.log
verb 3
ifconfig-pool 10.250.250.2 10.250.250.199 255.255.255.0
ifconfig-pool-persist ipp.txt
topology subnet
route 10.150.65.0 255.255.255.0
push "route 10.250.251.0 255.255.255.252 10.250.250.1"
push "route 10.250.251.4 255.255.255.252 10.250.250.1"
And i have a client:
port 10501
#tls-client
client
resolv-retry infinite
topology subnet
proto udp
dev ns1-tun
dev-type tun
ca /etc/ssl/ca.crt
cert /etc/ssl/bolt.crt
key /etc/ssl/bolt.key # This file should be kept secret
remote 91.120.21.66
keepalive 10 120
user nobody
group nogroup
persist-key
persist-tun
status /var/log/bolt-status.log
log /var/log/bolt.log
verb 5
i have a ccd for the client:
ifconfig-push 10.250.250.2 255.255.255.0
iroute 10.150.65.0 255.255.255.0
push "route 10.250.251.0 255.255.255.252"
push "route 10.250.251.4 255.255.255.252"
the connection succesful, i can ping the clients's VPN address, but nothing else (eg a clients internal ethernet card.)
i run tcpdump. and i look a weird thing. On the server the icmp ereq go in the vpn tunnel but not going out the client's vpn interface. i ping from the server. BUT if i ping from client to the server's internal ethernet interface the ping working...
client internal ip: 10.150.65.10
client vpn ip: 10.250.250.2
server internal ip: 10.255.253.13
server vpn ip: 10.250.250.1
i can ping from 10.250.250.2 to 10.250.250.1
i can ping from 10.250.250.2 to 10.255.253.13
i can ping from 10.250.250.1 to 10.250.250.2
i can't ping from 10.250.250.1 to 10.150.65.10
No any traffic on client's tun interface. but has traffic on servers's tun interface.
server routing table:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 xxx.xxx.xxx.xxx 0.0.0.0 UG 0 0 0 eth0
10.250.250.0 0.0.0.0 255.255.255.0 U 0 0 0 bolt-tun
10.250.251.0 10.250.251.2 255.255.255.0 UG 0 0 0 pos-tun
10.250.251.2 0.0.0.0 255.255.255.255 UH 0 0 0 pos-tun
10.255.253.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
xxx.xxx.xxx.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
Client routing table:
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.1.100 0.0.0.0 UG 0 0 0 eth4
10.250.250.0 0.0.0.0 255.255.255.0 U 0 0 0 ns1-tun
10.250.251.0 10.250.250.1 255.255.255.252 UG 0 0 0 ns1-tun
10.250.251.4 10.250.250.1 255.255.255.252 UG 0 0 0 ns1-tun
Iptables on both side:
:OUTPUT ACCEPT
This stuff working on debian 4.x, then i upgrade the server and this VPN is gone... the another VPN (pos-tun) working proper...
What missed?
