What's the problem?
I have 2 clients (clients are represented by 2 cellular gateways, which use Vodafone SIM cards to reach the public IP of the OpenVPN Server) both connected to this OpenVPN server (I have received IP's on their tun interfaces) and for one of them, its eth0 isn't accessible by the server.
Seems like a routing issue on the OpenVPN server, but I don't know what I can do anymore, so I kindly ask you for help.
There's no firewall on clients, nor on the server.
Ping from OpenVPN server eth0 to Client1 eth0 = OK
Ping from OpenVPN server eth0 to Client2 eth0 = FAIL!
Traceroute from Client1 to Client2 eth0: OK
[root /etc/openvpn]#traceroute -v 192.168.0.250
traceroute to 192.168.0.250 (192.168.0.250), 30 hops max, 38 byte packets
1 192.168.0.250 (192.168.0.250) 46 bytes to (null) 222.647 ms 1830.521 ms 284.259 ms
Traceroute from Client2 to Client1 eth0: FAIL - This is the problem, somehow, it can't reach behind the server, although Client1 can reach him.
[root]#traceroute -v 10.0.0.250
traceroute to 10.0.0.250 (10.0.0.250), 30 hops max, 38 byte packets
1 10.8.0.1 (10.8.0.1) 46 bytes to (null) 186.197 ms 254.320 ms 43.960 ms
Clients can ping both local and public IP addresses of the Server.
Server can only ping Client1 (192.168.0.250). Server cannot ping Client2 (10.0.0.250)
---
Details of the OpenVPN server and clients below:
OpenVPN local server IP: 172.30.23.35
OpenVPN public server IP: 185.89.242.35
OpenVPN Server:
eth0 inet addr:172.30.23.35 Bcast:172.30.23.255 Mask:255.255.255.0
tun0 inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255
root:~# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 172.30.23.1 0.0.0.0 UG 0 0 0 eth0
10.0.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 eth0
172.30.23.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
root:~# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 1123 packets, 76601 bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 38 packets, 11993 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 11 packets, 876 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 114 packets, 5020 bytes)
pkts bytes target prot opt in out source destination
943 57782 MASQUERADE all -- * eth0 10.8.0.0/24 0.0.0.0/0
OpenVPN Server log:
root@lc-PSFTEmbeddedA:/etc/openvpn# tail -F /var/log/syslog | grep ovpn
Apr 18 13:37:47 lc-PSFTEmbeddedA ovpn-server[2150]: /sbin/ip route add 192.168.0.0/24 via 10.8.0.2
Apr 18 13:37:47 lc-PSFTEmbeddedA ovpn-server[2150]: /sbin/ip route add 10.0.0.0/24 via 10.8.0.2
Apr 18 13:37:47 lc-PSFTEmbeddedA ovpn-server[2150]: /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Apr 18 13:37:47 lc-PSFTEmbeddedA ovpn-server[2150]: Data Channel MTU parms [ L:1557 D:1450 EF:57 EB:4 ET:0 EL:0 ]
Apr 18 13:37:47 lc-PSFTEmbeddedA ovpn-server[2159]: UDPv4 link local (bound): [undef]
Apr 18 13:37:47 lc-PSFTEmbeddedA ovpn-server[2159]: UDPv4 link remote: [undef]
Apr 18 13:37:47 lc-PSFTEmbeddedA ovpn-server[2159]: MULTI: multi_init called, r=256 v=256
Apr 18 13:37:47 lc-PSFTEmbeddedA ovpn-server[2159]: IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Apr 18 13:37:47 lc-PSFTEmbeddedA ovpn-server[2159]: IFCONFIG POOL LIST
Apr 18 13:37:47 lc-PSFTEmbeddedA ovpn-server[2159]: Initialization Sequence Completed
Apr 18 13:38:28 lc-PSFTEmbeddedA ovpn-server[2159]: MULTI: multi_create_instance called
Apr 18 13:38:28 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.28:1194 Re-using SSL/TLS context
Apr 18 13:38:28 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.28:1194 Control Channel MTU parms [ L:1557 D:138 EF:38 EB:0 ET:0 EL:0 ]
Apr 18 13:38:28 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.28:1194 Data Channel MTU parms [ L:1557 D:1450 EF:57 EB:4 ET:0 EL:0 ]
Apr 18 13:38:28 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.28:1194 Local Options String: 'V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Apr 18 13:38:28 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.28:1194 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Apr 18 13:38:28 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.28:1194 Local Options hash (VER=V4): 'b7f67de4'
Apr 18 13:38:28 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.28:1194 Expected Remote Options hash (VER=V4): '8326dbaa'
Apr 18 13:38:28 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.28:1194 TLS: Initial packet from [AF_INET]46.97.221.28:1194, sid=16c3f8b7 9db49a9d
Apr 18 13:38:29 lc-PSFTEmbeddedA ovpn-server[2159]: MULTI: multi_create_instance called
Apr 18 13:38:29 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.254:1194 Re-using SSL/TLS context
Apr 18 13:38:29 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.254:1194 Control Channel MTU parms [ L:1557 D:138 EF:38 EB:0 ET:0 EL:0 ]
Apr 18 13:38:29 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.254:1194 Data Channel MTU parms [ L:1557 D:1450 EF:57 EB:4 ET:0 EL:0 ]
Apr 18 13:38:29 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.254:1194 Local Options String: 'V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Apr 18 13:38:29 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.254:1194 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Apr 18 13:38:29 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.254:1194 Local Options hash (VER=V4): 'b7f67de4'
Apr 18 13:38:29 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.254:1194 Expected Remote Options hash (VER=V4): '8326dbaa'
Apr 18 13:38:29 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.254:1194 TLS: Initial packet from [AF_INET]46.97.221.254:1194, sid=237eee2d e015c7be
Apr 18 13:38:30 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.28:1194 VERIFY OK: depth=1, C=US, ST=CA, L=Bakersfield, O=Prosoft Technology, OU=Prosoft OU, CN=OpenVPN, name=EasyRSA, emailAddress=CAcertificate@prosoft.com
Apr 18 13:38:30 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.28:1194 VERIFY OK: depth=0, C=US, ST=CA, L=Bakersfield, O=Prosoft Technology, OU=Prosoft OU, CN=icx35, name=EasyRSA, emailAddress=icx35@prosoft.com
Apr 18 13:38:31 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.28:1194 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Apr 18 13:38:31 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.28:1194 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Apr 18 13:38:31 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.28:1194 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Apr 18 13:38:31 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.28:1194 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Apr 18 13:38:31 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.28:1194 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Apr 18 13:38:31 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.28:1194 [icx35] Peer Connection Initiated with [AF_INET]46.97.221.28:1194
Apr 18 13:38:31 lc-PSFTEmbeddedA ovpn-server[2159]: icx35/46.97.221.28:1194 OPTIONS IMPORT: reading client specific options from: ccd/icx35
Apr 18 13:38:31 lc-PSFTEmbeddedA ovpn-server[2159]: icx35/46.97.221.28:1194 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Apr 18 13:38:31 lc-PSFTEmbeddedA ovpn-server[2159]: icx35/46.97.221.28:1194 MULTI: Learn: 10.8.0.6 -> icx35/46.97.221.28:1194
Apr 18 13:38:31 lc-PSFTEmbeddedA ovpn-server[2159]: icx35/46.97.221.28:1194 MULTI: primary virtual IP for icx35/46.97.221.28:1194: 10.8.0.6
Apr 18 13:38:31 lc-PSFTEmbeddedA ovpn-server[2159]: icx35/46.97.221.28:1194 MULTI: internal route 192.168.0.0/24 -> icx35/46.97.221.28:1194
Apr 18 13:38:31 lc-PSFTEmbeddedA ovpn-server[2159]: icx35/46.97.221.28:1194 MULTI: Learn: 192.168.0.0/24 -> icx35/46.97.221.28:1194
Apr 18 13:38:33 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.254:1194 VERIFY OK: depth=1, C=US, ST=CA, L=Bakersfield, O=Prosoft Technology, OU=Prosoft OU, CN=OpenVPN, name=EasyRSA, emailAddress=CAcertificate@prosoft.com
Apr 18 13:38:33 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.254:1194 VERIFY OK: depth=0, C=US, ST=CA, L=Bakersfield, O=Prosoft Technology, OU=Prosoft OU, CN=icx100, name=EasyRSA, emailAddress=CAcertificate@prosoft.com
Apr 18 13:38:33 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.254:1194 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Apr 18 13:38:33 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.254:1194 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Apr 18 13:38:33 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.254:1194 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Apr 18 13:38:33 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.254:1194 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Apr 18 13:38:33 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.254:1194 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Apr 18 13:38:33 lc-PSFTEmbeddedA ovpn-server[2159]: 46.97.221.254:1194 [icx100] Peer Connection Initiated with [AF_INET]46.97.221.254:1194
Apr 18 13:38:33 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 MULTI_sva: pool returned IPv4=10.8.0.10, IPv6=(Not enabled)
Apr 18 13:38:33 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 MULTI: Learn: 10.8.0.10 -> icx100/46.97.221.254:1194
Apr 18 13:38:33 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 MULTI: primary virtual IP for icx100/46.97.221.254:1194: 10.8.0.10
Apr 18 13:38:34 lc-PSFTEmbeddedA ovpn-server[2159]: icx35/46.97.221.28:1194 PUSH: Received control message: 'PUSH_REQUEST'
Apr 18 13:38:34 lc-PSFTEmbeddedA ovpn-server[2159]: icx35/46.97.221.28:1194 send_push_reply(): safe_cap=940
Apr 18 13:38:34 lc-PSFTEmbeddedA ovpn-server[2159]: icx35/46.97.221.28:1194 SENT CONTROL [icx35]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route 10.8.0.0 255.255.255.0,topology net30,ping 30,ping-restart 60,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Apr 18 13:38:37 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 PUSH: Received control message: 'PUSH_REQUEST'
Apr 18 13:38:37 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 send_push_reply(): safe_cap=940
Apr 18 13:38:37 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 SENT CONTROL [icx100]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route 10.8.0.0 255.255.255.0,topology net30,ping 30,ping-restart 60,ifconfig 10.8.0.10 10.8.0.9' (status=1)
Apr 18 13:40:42 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 TLS: new session incoming connection from [AF_INET]46.97.221.254:1194
Apr 18 13:40:44 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 VERIFY OK: depth=1, C=US, ST=CA, L=Bakersfield, O=Prosoft Technology, OU=Prosoft OU, CN=OpenVPN, name=EasyRSA, emailAddress=CAcertificate@prosoft.com
Apr 18 13:40:44 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 VERIFY OK: depth=0, C=US, ST=CA, L=Bakersfield, O=Prosoft Technology, OU=Prosoft OU, CN=icx100, name=EasyRSA, emailAddress=CAcertificate@prosoft.com
Apr 18 13:40:44 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Apr 18 13:40:44 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Apr 18 13:40:44 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Apr 18 13:40:44 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Apr 18 13:40:44 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Apr 18 13:40:44 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Apr 18 13:40:44 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Apr 18 13:40:48 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 PUSH: Received control message: 'PUSH_REQUEST'
Apr 18 13:40:48 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 send_push_reply(): safe_cap=940
Apr 18 13:40:48 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 SENT CONTROL [icx100]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route 10.8.0.0 255.255.255.0,topology net30,ping 30,ping-restart 60,ifconfig 10.8.0.10 10.8.0.9' (status=1)
Apr 18 13:44:53 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 TLS: new session incoming connection from [AF_INET]46.97.221.254:1194
Apr 18 13:44:55 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 VERIFY OK: depth=1, C=US, ST=CA, L=Bakersfield, O=Prosoft Technology, OU=Prosoft OU, CN=OpenVPN, name=EasyRSA, emailAddress=CAcertificate@prosoft.com
Apr 18 13:44:55 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 VERIFY OK: depth=0, C=US, ST=CA, L=Bakersfield, O=Prosoft Technology, OU=Prosoft OU, CN=icx100, name=EasyRSA, emailAddress=CAcertificate@prosoft.com
Apr 18 13:44:55 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Apr 18 13:44:55 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Apr 18 13:44:55 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Apr 18 13:44:55 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Apr 18 13:44:55 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Apr 18 13:44:55 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Apr 18 13:44:55 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Apr 18 13:44:59 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 PUSH: Received control message: 'PUSH_REQUEST'
Apr 18 13:44:59 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 send_push_reply(): safe_cap=940
Apr 18 13:44:59 lc-PSFTEmbeddedA ovpn-server[2159]: icx100/46.97.221.254:1194 SENT CONTROL [icx100]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route 10.8.0.0 255.255.255.0,topology net30,ping 30,ping-restart 60,ifconfig 10.8.0.10 10.8.0.9' (status=1)
Server config:
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
route 192.168.0.0 255.255.255.0
route 10.0.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
client-to-client
duplicate-cn
keepalive 30 60
cipher AES-128-CBC
auth SHA1
persist-key
persist-tun
status /etc/openvpn/openvpn-status.log
verb 4
--
Clients config:
tls-client
ca "/etc/openvpn/ca.crt"
cert "/etc/openvpn/icx35.crt"
key "/etc/openvpn/icx35.key"
reneg-sec 3600
remote 185.89.242.35
port 1194
daemon openvpn
verb 3
cipher AES-128-CBC
auth SHA1
proto udp
dev tun
redirect-gateway def1
#mtu-disc maybe
#comp-lzo adaptive
keepalive 30 60
#explicit-exit-notify 1
up-restart
mute-replay-warnings
mute 2
script-security 2 execve
pull
down /etc/openvpn/scripts/client/down
ipchange /etc/openvpn/scripts/client/ipchange
route-pre-down /etc/openvpn/scripts/client/route-pre-down
route-up /etc/openvpn/scripts/client/route-up
tls-verify /etc/openvpn/scripts/client/tls-verify
up /etc/openvpn/scripts/client/up
Client1:
eth0 inet addr:192.168.0.250 Bcast:192.168.0.255 Mask:255.255.255.0
tun0 inet addr:10.8.0.10 P-t-P:10.8.0.9 Mask:255.255.255.255
inet addr:46.97.221.28 Bcast:0.0.0.0 Mask:255.255.255.248
[root]#route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.8.0.9 128.0.0.0 UG 0 0 0 tun0
0.0.0.0 46.97.221.29 0.0.0.0 UG 0 0 0 wwan0
10.8.0.0 10.8.0.9 255.255.255.0 UG 0 0 0 tun0
10.8.0.9 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
46.97.221.24 0.0.0.0 255.255.255.248 U 0 0 0 wwan0
128.0.0.0 10.8.0.9 128.0.0.0 UG 0 0 0 tun0
185.89.242.35 46.97.221.29 255.255.255.255 UGH 0 0 0 wwan0
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
[root /etc/openvpn]#iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 124 packets, 16331 bytes)
pkts bytes target prot opt in out source destination
0 0 DNAT tcp -- tun0 * 0.0.0.0/0 10.8.0.10 multiport dports !21,8080,50000,6223,53,1194 /* DNAT inbound WAN packets to LAN device IP */ to:192.168.0.100 persistent
0 0 DNAT udp -- tun0 * 0.0.0.0/0 10.8.0.10 multiport dports !21,8080,50000,6223,53,1194 /* DNAT inbound WAN packets to LAN device IP */ to:192.168.0.100 persistent
Chain INPUT (policy ACCEPT 11 packets, 1380 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 1 packets, 84 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 SNAT tcp -- * tun0 192.168.0.100 0.0.0.0/0 multiport dports !21,8080,50000,6223,53,1194 /* SNAT inbound LAN packets to WAN device IP */ to:10.8.0.10 persistent
0 0 SNAT udp -- * tun0 192.168.0.100 0.0.0.0/0 multiport dports !21,8080,50000,6223,53,1194 /* SNAT inbound LAN packets to WAN device IP */ to:10.8.0.10 persistent
1 84 SNAT all -- * tun0 0.0.0.0/0 0.0.0.0/0 /* SNAT outbound packets originaing on LAN device */ to:10.8.0.10 persistent
--
Client 2:
eth0 inet addr:10.0.0.250 Bcast:10.0.0.255 Mask:255.255.255.0
tun0 inet addr:10.8.0.6 P-t-P:10.8.0.5 Mask:255.255.255.255
wwan0 inet addr:46.97.221.254 Bcast:0.0.0.0 Mask:255.255.255.252
[root]#route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.8.0.5 128.0.0.0 UG 0 0 0 tun0
0.0.0.0 46.97.221.253 0.0.0.0 UG 0 0 0 wwan0
10.0.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
10.8.0.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun0
10.8.0.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
46.97.221.252 0.0.0.0 255.255.255.252 U 0 0 0 wwan0
128.0.0.0 10.8.0.5 128.0.0.0 UG 0 0 0 tun0
185.89.242.35 46.97.221.253 255.255.255.255 UGH 0 0 0 wwan0
[root /etc/openvpn]#iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 63 packets, 9510 bytes)
pkts bytes target prot opt in out source destination
0 0 DNAT tcp -- tun0 * 0.0.0.0/0 10.8.0.14 multiport dports !21,8080,50000,6223,53,1194 /* DNAT inbound WAN packets to LAN device IP */ to:10.0.0.100 persistent
0 0 DNAT udp -- tun0 * 0.0.0.0/0 10.8.0.14 multiport dports !21,8080,50000,6223,53,1194 /* DNAT inbound WAN packets to LAN device IP */ to:10.0.0.100 persistent
Chain INPUT (policy ACCEPT 2 packets, 656 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 11 packets, 600 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 SNAT tcp -- * tun0 10.0.0.100 0.0.0.0/0 multiport dports !21,8080,50000,6223,53,1194 /* SNAT inbound LAN packets to WAN device IP */ to:10.8.0.14 persistent
0 0 SNAT udp -- * tun0 10.0.0.100 0.0.0.0/0 multiport dports !21,8080,50000,6223,53,1194 /* SNAT inbound LAN packets to WAN device IP */ to:10.8.0.14 persistent
11 600 SNAT all -- * tun0 0.0.0.0/0 0.0.0.0/0 /* SNAT outbound packets originaing on LAN device */ to:10.8.0.14 persistent
