Using public IP to reach tun device on client

fireless

Hi,
I'm new here and I don't know how to set this up, or even where to look for answers, I've looked everywhere I can think of...but I need help with the following scenario if anyone is feeling kind -

I have a server that has an application running on it that talks to clients, this is bidirectional communication (all linux hosts). All clients are on the same subnet as the server. I have successfully setup the tunnel on the client side to talk with the server however, I cannot get the server to communicate with the clients through the tunnel. This is a bad picture but hopefully it will get the point across ...

This is the way I want it to work:
world <-> server <-> eth0 <-> tun0 .....tun0 <-> eth0 <-> client

but its working like this:
communication from client goes to server through the tunnel but the return goes through the regular device.
server <- eth0 <- tun0 .....tun0 <- eth0 <- client
server -> eth0 ....-> eth0 -> client

I've tried setting up some static routes and tried forwarding through iptables but I can't seem to get it to work. I've also tried bridging the tap/eth devices on the server but that was not successful either.
I've been using tcpdump to inspect the traffic but I only see traffic from the client out, nothing going to the client.

I've also been scouring the internets for any info I can regarding this setup but I'm not even exactly sure how to describe it.

If someone could help and either let me know how to do this or point me in the right direction I would greatly appreciate it.

I'm using CentOS as my base os with openvpn-2.4.6-1.

In this sceanrio my server is 192.168.78.19,
client is 192.168.77.24
tunnel is default 10.8.0.0 subnet
I'm trying to use port 4001 for specific reasons
Basically I want all traffic from my server destined for 192.168.77.24 to go through the tunnel to the appropriate client.

Here's my server config:
port 4001
proto tcp
dev tun
ca ca.crt
cert server.crt
dh dh2048.pem
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
push "redirect-gateway def1 bypass-dhcp"
client-to-client
duplicate-cn
keepalive 10 120
cipher AES-256-CBC
max-clients 150
user nobody
group nobody
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 6
push "route 10.8.0.0 255.255.255.0"
push "route 192.168.78.0 255.255.252.0"

client config:
client
dev tun1
proto tcp
remote 192.168.78.19 4001
topology subnet
resolv-retry infinite
bind
persist-key
persist-tun
verb 3
... the rest of the keys

TinCanTech

fireless wrote its working like this:
communication from client goes to server through the tunnel but the return goes through the regular device

ifconfig

fireless

are you asking for the ifconfig?

TinCanTech

fireless wrote are you asking for the ifconfig?

No .. but you should check yours.

https://forums.openvpn.net/viewtopic.php?f=30&t=22603

fireless

what would the ifconfig have to do with the issue?

TinCanTech

Take a little time to consider this:
https://tools.ietf.org/html/rfc1925

fireless

Are you serious?!?!? There's no reason to be the way you're being. I'm asking for help, if you don't want to help that's fine but posting BS RFC's in an attempt to be "clever" is lame.

TinCanTech

I asked you to read this:

TinCanTech wrote https://forums.openvpn.net/viewtopic.php?f=30&t=22603

but you did not.

I asked you to read this:

TinCanTech wrote Take a little time to consider this:
https://tools.ietf.org/html/rfc1925

which you did.

fireless wrote Are you serious?!?!?

Yes.

Think what ever you want .. but nobody here can actually help
unless you help us to help you ..

Hint: detaloj

fireless

Your disjointed and cryptic comments about "ifconfig" - "no check yours" - "take time to consider this" ... blah blah blah, are not helpful, insightful, useful, clever, or even mildly entertaining. I understand you have a huge ego and that you can't be bothered with making full sentences but once again, if you're not going to be helpful do not comment.
Don't presume to tell people what they read and what they didn't read. I'm following the rules on posting, being polite, responsive, and simply asking for help which is what I thought this was for, not to be harassed by some dude who fancies himself too good for the new people.
Didn't mean to ask a question in YOUR forum. Geez.
I won't be coming back. Thanks for the help.

TinCanTech

I was curious to understand what you meant by this:

fireless wrote its working like this:
communication from client goes to server through the tunnel but the return goes through the regular device

because it does not make sense and ifconfig is a good place to start.

I would also have asked you for your logs at verb 4.