Static Route issue

danboyd

I have inherited a network that has an existing site-to-site VPN which is being managed by a FortiNet appliance.

The existing network topology works like this:

Office A  <----------FortiNet VPN------> Office B
192.168.0.0/24                           192.168.41.0/24

I added an OpenVPN server in Office B and I would like to use it to connect a few remote users.

Office A  <----------FortiNet VPN------> Office B
192.168.0.0/24                           192.168.41.0/24
                                             |
                                             |
                                         OpenVPN Server
                                         192.168.41.100
                                         10.8.0.1
                                             |
                                             |
                                         Remote User
                                         10.8.0.10

So now, I have OpenVPN running on 10.8.0.0/24. I set up a static route on Office B's router pushing 10.8.0.0/24 to the OpenVPN server which is at 192.168.41.100. In my OpenVPN server config, I am pushing 192.168.0.0/24 and 192.168.41.0/24.

On the remote OpenVPN client, I am able to see all of the machines in Office B, but not in Office A. I haven't run TCPDump yet, but I'm assuming packets can get *to* Office A, but don't know how to get back. So, I went to Office A's router and was going to add the same static route, but it wouldn't let me because the gateway (192.168.41.100) is on a different subnet. How do I set this up so the remote OpenVPN client can see Office A?

TinCanTech

HOWTO: Expanding the scope of the VPN to include additional machines

danboyd

Yes -- I understand that. I am able to see every machine in Office B, so my routes are working there.

Per those instructions:

Next, you must set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24) to the OpenVPN server (this is only necessary if the OpenVPN server and the LAN gateway are different machines).

I set up a static route on the Office B gateway which directs 10.8.0.0/24 to my OpenVPN server which is 192.168.41.100.

However, I cannot access any of the machines in Office A. I assume I need to set up some kind of static route on the Office A gateway as well...? I just don't know to do that because it won't let me add a static route that points to a machine on a different subnet. (I.e. Office A subnet is 192.168.0.0/24 and the OpenVPN server is 192.168.41.100)

MikeRobinson

Yes, the problem is undoubtedly that Office-A doesn't know what to do with the 10.8.0.x addresses. They just need to get to Office-B, and static routing rules already on Office-B will know how to take it from there. The only "gateway" that Office-A needs to know about is ... Office-B.