I wondered if someone can give me a bit of a hand with some routing.
I have a simple OpenVPN server on a VM up in the cloudy sky thing. Static IP with one network interface.
I have a Pi that I am using as a VPN client with a private network behind it. The Pi Wan interface connects to a standard internet router.
Layout is vaguely like this
OpenVPN Server
<internet>
ADSL router
192.168.10.x
/ \
Normal clients Pi OpenVPN Client
|
192.168.51.x
Pi VPN Clients
So the ADSL router hands out DHCP to clients. The Pi Client has a static 192.168.10.x IP as its WAN IP. It then server IPs to its own LAN clients on 192.168.51.x
The Pi happily connects to the OpenVPN server, and then on to the internet via the Openvpn server, so all the certificates etc work and outbound routing seems OK.
What I can't do is ping or connect back to the Pi from the OpenVPN server. Yup, I know, it is a routing issue for OpenVPN, but having removed all my teeth without anaesthetic and read til my eyes bled, and tried all sorts of configs I got myself totally lost :-)
I'm sure the solution is stupidly simple. But.... !
I can ping the Pi 'WAN' IP and ssh in from other 192.168.10.x clients so it doesn't seem to be the Pi blocking packets on the WAN interface.
Relevant config sections (I have removed all the cert stuff)
Server config
server 192.168.91.0 255.255.255.0
push "dhcp-option DNS 192.168.91.1"
push "redirect-gateway def1"
push "route 192.168.10.0 255.255.255.0"
route 192.168.10.0 255.255.255.0
Client Config
client
nobind
persist-key
persist-tun
pull
compress lzo
dev tun
keepalive 10 60
proto udp
remote 1.2.3.250 1194
resolv-retry infinite
CCD
iroute 192.168.10.0 255.255.255.0
OpenVPN server
tun 0 inet addr:192.168.91.1 P-t-P:192.168.91.2 Mask:255.255.255.255
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 1.2.3.1 0.0.0.0 UG 0 0 0 eth0
1.2.3.0 * 255.255.252.0 U 0 0 0 eth0
169.254.169.254 1.2.3.250 255.255.255.255 UGH 0 0 0 eth0
192.168.10.0 192.168.91.2 255.255.255.0 UG 0 0 0 tun0
192.168.91.0 192.168.91.2 255.255.255.0 UG 0 0 0 tun0
192.168.91.2 * 255.255.255.255 UH 0 0 0 tun0
Pi Client
tun 0 inet addr:192.168.91.6 P-t-P:192.168.91.5 Mask 255.255.255.255
root@PiClient:/etc# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 192.168.91.5 128.0.0.0 UG 0 0 0 tun0
default 192.168.10.250 0.0.0.0 UG 0 0 0 wlan0 # ADSL router internal IP
1.2.3.250 192.168.10.250 255.255.255.255 UGH 0 0 0 wlan0 # OpenVPN server IP
128.0.0.0 192.168.91.5 128.0.0.0 UG 0 0 0 tun0 # Not sure why the Pi assigns this
192.168.10.0 * 255.255.255.0 U 0 0 0 wlan0
192.168.10.250 * 255.255.255.255 UH 0 0 0 wlan0
192.168.91.1 192.168.91.5 255.255.255.255 UGH 0 0 0 tun0
192.168.91.5 * 255.255.255.255 UH 0 0 0 tun0
The only reason I need to do this is to be able to connect to the OpenVPN server form a different location and be able to login to the PI for maintenance.
Any help or suggestions gratefully appreciated.
B. Rgds
John
