cutshaw
I have a Server with a static ip from which I want to be able to connect to a LAN. The TUN Interface is working great so far, but I am not able to reach the LAN of my Client (nor from a Server or a 3rd Client). Maybe anyone of you has an idea. I tested it with pinging a server on the LAN which is pingable by the Client.
port 1194
proto udp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.8.0.1"
push "route 192.168.166.0 255.255.255.0"
push "route 192.168.130.0 255.255.255.0"
push "route 192.168.124.0 255.255.255.0"
route 192.168.166.0 255.255.255.0 10.8.0.2
route 192.168.130.0 255.255.255.0 10.8.0.2
route 192.168.124.0 255.255.255.0 10.8.0.2
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem
client-to-client
client-config-dir /etc/openvpn/ccd/
[oconf=ccd/client]
iroute 192.168.166.0 255.255.255.0
iroute 192.168.130.0 255.255.255.0
iroute 192.168.124.0 255.255.255.0
ifconfig-push 10.8.0.2 255.255.255.0
[/oconf]
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 [Proxmox Gateway] 0.0.0.0 UG 0 0 0 eth0
0.0.0.0 0.0.0.0 0.0.0.0 U 202 0 0 tun0
10.8.0.0 0.0.0.0 255.255.255.0 U 202 0 0 tun0
[Proxmox Gateway] 0.0.0.0 255.255.255.255 UH 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 248 0 0 eth0
192.168.124.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
192.168.130.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
192.168.166.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.166.1 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
192.168.166.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere tcp dpt:domain
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere tcp dpt:openvpn
ACCEPT udp -- anywhere anywhere udp dpt:openvpn
REJECT udp -- anywhere anywhere udp dpt:80 reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp dpt:https reject-with tcp-reset
REJECT udp -- anywhere anywhere udp dpt:443 reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- 10.8.0.0/24 !10.8.0.0/24 to:[SERVER IP]
On the Client i have no Firewall rules, but this one:
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 10.8.0.0/24 anywhere
