Trying to connect two remote routers, traffic one way only.

miodzicho

Hi All

I'm trying to connect together two remote routers, ide is to have access from both sides to internal machines.
Router 1 - IP network 10.36.90.x / 23
Router 2 - IP network 192.168.1.x / 24

Router 1 as server with configuration :

# OpenVPN 2.3.18 mips-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [IPv6] built on Jan 23 2018
# library versions: OpenSSL 1.0.2n  7 Dec 2017, LZO 2.10
#  Config date: Wed Feb 21 12:23:04 CET 2018
proto udp
dev tun
ca /tmp/flash/openvpn/ca.crt
cert /tmp/flash/openvpn/box.crt
key /tmp/flash/openvpn/box.key
dh /tmp/flash/openvpn/dh.pem
tls-server
port 1194
ifconfig 10.10.10.1 10.10.10.2
route 192.168.1.0 255.255.255.0
push "route 10.36.90.0 255.255.254.0"
mode server
ifconfig-pool 172.16.90.1 172.16.90.2
push "route 172.16.90.0 255.255.255.0"
route 172.16.90.0 255.255.255.0
client-to-client
push "dhcp-option DOMAIN xxxxx.removed"
push "dhcp-option DNS 10.36.90.1"
tun-mtu 1500
mssfix
verb 3
cipher AES-128-CBC
comp-lzo
keepalive 10 120
cd /var/tmp/openvpn
chroot /var/tmp/openvpn
user openvpn
group openvpn
persist-tun
persist-key

Router 2 as client :

client
proto udp
remote server.router.address 1194
resolv-retry infinite
nobind
dev tun0
ca /etc/storage/openvpn/client/ca.crt
cert /etc/storage/openvpn/client/client.crt
key /etc/storage/openvpn/client/client.key
auth SHA1
cipher AES-128-CBC
comp-lzo adaptive
persist-key
script-security 2
writepid /var/run/openvpn_cli.pid
up ovpnc.script
down ovpnc.script

### User params:
auth-nocache
nice 0
verb 0
mute 10

Routing on the server router

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         *               0.0.0.0         U     2      0        0 dsl
10.10.10.2      *               255.255.255.255 UH    0      0        0 tun0
10.36.90.0      *               255.255.254.0   U     0      0        0 lan
10.36.91.0      *               255.255.255.255 UH    2      0        0 dsl
169.254.0.0     *               255.255.0.0     U     0      0        0 lan
172.16.90.0     10.10.10.2      255.255.255.0   UG    0      0        0 tun0
192.168.1.0     10.10.10.2      255.255.255.0   UG    0      0        0 tun0
192.168.179.0   *               255.255.255.0   U     0      0        0 guest
192.168.180.1   *               255.255.255.255 UH    2      0        0 dsl
192.168.180.2   *               255.255.255.255 UH    2      0        0 dsl
x.x.x.x  *               255.255.255.255 UH    2      0        0 dsl

Routing on client :

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         public.ip.in 0.0.0.0         UG    1      0        0 eth3
10.8.0.0        *               255.255.255.0   U     0      0        0 tun1
10.36.90.0      172.16.90.1     255.255.254.0   UG    0      0        0 tun0
public.ip.0    *               255.255.254.0   U     0      0        0 eth3
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
172.16.90.0     172.16.90.1     255.255.255.0   UG    0      0        0 tun0
172.16.90.1     *               255.255.255.255 UH    0      0        0 tun0
192.168.1.0     *               255.255.255.0   U     0      0        0 br0

And now from client I can ping everything in network 10.36.90.x, but from server I cannot ping anything in network 192.168.1.x

How I can fix this please ?

TinCanTech

What instructions did you follow to come up with your strange config ?

miodzicho

Finally it is working. I can ping both remote networks (192.168.1.x on one side and 10.36.90.x on other).
Could you tell me what is strange here to fix ?
I'm looking now how to route one Public IP via tunnel.

Client trying to access public IP x.x.x.x -> TUN -> client -> WAN -> Internet x.x.x.x
But all other traffic should go out using Client WAN, not tunnel. If that's makes sense...

TinCanTech

Compare your server config to the example server config ..

For a start you have no --server option and your server tunnel IP is not in your client pool subnet.

miodzicho

Ok. so I changed server to, taking instructions from https://freetz.org/wiki/packages/openvpn

mode server
tls-server
port 1194
proto udp
ca /tmp/flash/openvpn/ca.crt
cert /tmp/flash/openvpn/box.crt
key /tmp/flash/openvpn/box.key
dh /tmp/flash/openvpn/dh.pem
dev tun
topology subnet
push "topology subnet"
ifconfig 10.10.10.1 255.255.255.0
push "route-gateway 10.10.10.1"
#network behind OpenVPN server
push "route 10.36.90.0 255.255.254.0"
push "dhcp-option DOMAIN local_domain_server_side.me"
push "dhcp-option DNS 10.36.90.1"
tun-mtu 1500
mssfix
verb 3
cipher AES-128-CBC
comp-lzo
keepalive 10 120
script-security 2
client-connect "/bin/sh /tmp/flash/openvpn/script1"
daemon

and then script1 :

#!/bin/sh
CLIENTS='name:ip maske:netz1 maske1; netz2 maske2
piasty:10.10.10.2 255.255.255.0:192.168.1.0 255.255.255.0
# env will give name of connected client in variable "common_name" 
X=$(echo "$CLIENTS" | sed -n "/^${common_name}:/ s/^${common_name}:// p")
CLIENTCONFIG=$1

# if found info on common name, generate client-config
if [ -n "$X" -a -n "$CLIENTCONFIG" ]; then
IP=${X%%:*}
NETS=${X##*:}
[ -n "$IP" ] && echo "ifconfig-push $IP" > $CLIENTCONFIG
[ -n "$NETS" -a "$NETS" != "$IP" ] &&  echo -e "iroute $NETS" | \
	sed "s/[[:space:]]*;[[:space:]]*/\niroute /g" >> $CLIENTCONFIG
fi

from client network I can ping 10.36.90.x , but after establishing connection there is no routing to network 192.168.1.x
When added manualy

ip route add 192.168.1.0/24 via 10.10.10.2

I can ping both directions.
Now struggling how to add this route durring connection establishment, and how to route public IP via client (from server via client out to Internet, then back to PC behind server).

On other hand, I have feeling I'm overcomplicating things...