Hi, I have a pretty weird problem. I have a vpn server which is in the same subnet as a few clients. (192.168.10.0/24) I also have multiple routers with a host behind them. The routers act as vpn clients. example for a router/host combo: router vpn ip: 10.0.0.5, subnet: 192.168.201.0/24, host ip: 192.168.201.101 I have multiple of those router/host combos with different subnets. The problem I have now is, when I try to ping the host behind the router, it only works from the vpn server. not from other clients. (direct clients, not behind a router) [oconf=Server] local 192.168.10.13 port 1196 proto udp dev tun ca /etc/openvpn/openvpn_certs/server-ca.pem cert /etc/openvpn/openvpn_certs/server-cert.pem key /etc/openvpn/openvpn_certs/server-key.pem dh /etc/openvpn/openvpn_certs/dh2048.pem server 10.0.0.0 255.255.255.0 cipher AES-256-CBC auth SHA512 mode server tls-server tls-auth /etc/openvpn/openvpn_certs/ta.key 0 key-direction 0 topology subnet ifconfig-pool-persist /etc/openvpn/ipp.txt keepalive 10 120 comp-lzo user nobody group nobody persist-key persist-tun status /var/log/openvpn-status.log log-append /var/log/openvpn.log verb 3 client-config-dir /etc/openvpn/ccd [/oconf] [oconf=Client 1] client dev tun proto udp remote 1196 #port is NAT to internal 192.168.10.13:1196 resolv-retry infinite nobind cipher AES-256-CBC auth SHA512 remote-cert-tls server persist-key persist-tun comp-lzo verb 3 key-direction 1 # redacted # redacted # redacted # redacted [/oconf] [oconf=CCD Client 1] ifconfig-push 10.0.0.250 255.255.255.0 [/oconf] [oconf=CCD Router] iroute 192.168.202.0 255.255.255.0 [/oconf] So my setup is: Client 1 [192.168.10.12, 10.0.0.250] Vpn Server [192.168.10.13, 10.0.0.1] Router [192.168.202.1, 10.0.0.9] Host [192.168.202.102] There are also other Router/Client pairs with the same setup (different subnet) I can ping the Router [192.168.202.1, 10.0.0.9] from Client 1 (using either IP). I can ping the Host [192.168.202.102] from the Vpn Server. But I cannot ping the Host [192.168.202.102] from Client 1. Routing table Client 1: [code] default via 192.168.10.1 dev eth0 proto static 10.0.0.0/24 dev tun0 proto kernel scope link src 10.0.0.250 192.168.0.0/16 via 10.0.0.1 dev tun0 192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.12 [/code] Routing table VPN Server: [code] default via 192.168.10.1 dev eth0 10.0.0.0/24 dev tun0 proto kernel scope link src 10.0.0.1 192.168.0.0/16 dev tun0 scope link 192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.13 [/code] Tracepath to Host from Client 1: [code] # tracepath 192.168.202.102 1?: [LOCALHOST] pmtu 1500 1: 10.0.0.1 0.574ms 1: 10.0.0.1 0.518ms 2: 10.0.0.9 63.653ms 3: no reply 4: no reply ^C [/code] Tracepath to Router from Client 1 [code] # tracepath 192.168.202.1 1?: [LOCALHOST] pmtu 1500 1: 10.0.0.1 0.599ms 1: 10.0.0.1 0.480ms 2: 192.168.202.1 75.079ms reached Resume: pmtu 1500 hops 2 back 2 [/code] Tracepath to Host from Vpn Server: [code] # traceroute 192.168.202.102 traceroute to 192.168.202.102 (192.168.202.102), 30 hops max, 46 byte packets 1 10.0.0.9 (10.0.0.9) 58.067 ms 45.941 ms 44.932 ms 2 192.168.202.102 (192.168.202.102) 43.103 ms 48.765 ms 43.028 ms [/code] EDIT: recording which might explain it a bit better: https://asciinema.org/a/U1F94A437zSf8bIFFINPJG98J

[quote=TinCanTech post_id=84247 time=1551966384 user_id=37053] [quote=belst post_id=84239 time=1551956992 user_id=46590] I have a vpn server which is in the same subnet as a few clients. (192.168.10.0/24) [/quote]That is a [i]Notwork[/i] not a [i]Network[/i] -- Use unique subnets. [/quote] The vpn subnet is 10.0.0.0/24. the 192.168.10.0/24 subnet is just the local subnet (no vpn) where the vpn server and a few clients are.

ah no. The subnets behind the clients are unique. (192.168.1xx.0/24 or 192.168.2xx.0/24) the iroutes are all different subnets. as seen in my ccd config in the original post: [quote=belst] [oconf=CCD Router] iroute 192.168.202.0 255.255.255.0 [/oconf] [/quote] edit: 192.168.10.0/24 uses eth0 interface. 192.168.0.0/16 should use tun0 see routing table [code] default via 192.168.10.1 dev eth0 10.0.0.0/24 dev tun0 proto kernel scope link src 10.0.0.1 192.168.0.0/16 via 10.0.0.2 dev tun0 192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.13 [/code]

[quote=belst post_id=84250 time=1551968232 user_id=46590] ah no. The subnets behind the clients are unique. (192.168.1xx.0/24 or 192.168.2xx.0/24) the iroutes are all different subnets [/quote]Which is not what you said in your opening statement: [quote=belst post_id=84239 time=1551956992 user_id=46590] I have a vpn server [b]which is in the same subnet[/b] as a few clients. (192.168.10.0/24) [/quote]So .. what ever .. As for the other problems, try --client-to-client in tbe server config. Also, check your client side routing and go through your CCD settings carefully.

Cannot reach specific subnets from other clients

belst

Hi,

I have a pretty weird problem.

I have a vpn server which is in the same subnet as a few clients. (192.168.10.0/24)

I also have multiple routers with a host behind them. The routers act as vpn clients.

example for a router/host combo: router vpn ip: 10.0.0.5, subnet: 192.168.201.0/24, host ip: 192.168.201.101

I have multiple of those router/host combos with different subnets.

The problem I have now is, when I try to ping the host behind the router, it only works from the vpn server. not from other clients. (direct clients, not behind a router)

local 192.168.10.13
port 1196
proto udp
dev tun
ca /etc/openvpn/openvpn_certs/server-ca.pem
cert /etc/openvpn/openvpn_certs/server-cert.pem
key /etc/openvpn/openvpn_certs/server-key.pem
dh /etc/openvpn/openvpn_certs/dh2048.pem
server 10.0.0.0 255.255.255.0
cipher AES-256-CBC
auth SHA512
mode server
tls-server
tls-auth /etc/openvpn/openvpn_certs/ta.key 0
key-direction 0
topology subnet
ifconfig-pool-persist /etc/openvpn/ipp.txt
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 3
client-config-dir /etc/openvpn/ccd

client
dev tun
proto udp
remote <public ip> 1196 #port is NAT to internal 192.168.10.13:1196
resolv-retry infinite
nobind
cipher AES-256-CBC
auth SHA512
remote-cert-tls server
persist-key
persist-tun
comp-lzo
verb 3
key-direction 1

<tls-auth>
# redacted
</tls-auth>
<ca>
# redacted
</ca>
<cert>
# redacted
</cert>
<key>
# redacted
</key>

ifconfig-push 10.0.0.250 255.255.255.0

iroute 192.168.202.0 255.255.255.0

So my setup is:

Client 1 [192.168.10.12, 10.0.0.250] <--> Vpn Server [192.168.10.13, 10.0.0.1] <--> Router [192.168.202.1, 10.0.0.9] <--> Host [192.168.202.102]

There are also other Router/Client pairs with the same setup (different subnet)

I can ping the Router [192.168.202.1, 10.0.0.9] from Client 1 (using either IP).
I can ping the Host [192.168.202.102] from the Vpn Server.

But I cannot ping the Host [192.168.202.102] from Client 1.

Routing table Client 1:

default via 192.168.10.1 dev eth0 proto static 
10.0.0.0/24 dev tun0 proto kernel scope link src 10.0.0.250 
192.168.0.0/16 via 10.0.0.1 dev tun0 
192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.12

Routing table VPN Server:

default via 192.168.10.1 dev eth0 
10.0.0.0/24 dev tun0 proto kernel scope link src 10.0.0.1 
192.168.0.0/16 dev tun0 scope link 
192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.13

Tracepath to Host from Client 1:

# tracepath 192.168.202.102
 1?: [LOCALHOST]                      pmtu 1500
 1:  10.0.0.1                                              0.574ms 
 1:  10.0.0.1                                              0.518ms 
 2:  10.0.0.9                                             63.653ms 
 3:  no reply
 4:  no reply
^C

Tracepath to Router from Client 1

# tracepath 192.168.202.1  
 1?: [LOCALHOST]                      pmtu 1500
 1:  10.0.0.1                                              0.599ms 
 1:  10.0.0.1                                              0.480ms 
 2:  192.168.202.1                                        75.079ms reached
     Resume: pmtu 1500 hops 2 back 2

Tracepath to Host from Vpn Server:

# traceroute 192.168.202.102
traceroute to 192.168.202.102 (192.168.202.102), 30 hops max, 46 byte packets
 1  10.0.0.9 (10.0.0.9)  58.067 ms  45.941 ms  44.932 ms
 2  192.168.202.102 (192.168.202.102)  43.103 ms  48.765 ms  43.028 ms

EDIT: recording which might explain it a bit better: https://asciinema.org/a/U1F94A437zSf8bIFFINPJG98J

TinCanTech

belst wrote I have a vpn server which is in the same subnet as a few clients. (192.168.10.0/24)

That is a Notwork not a Network -- Use unique subnets.

belst

TinCanTech wrote
belst wrote I have a vpn server which is in the same subnet as a few clients. (192.168.10.0/24)
That is a Notwork not a Network -- Use unique subnets.

The vpn subnet is 10.0.0.0/24. the 192.168.10.0/24 subnet is just the local subnet (no vpn) where the vpn server and a few clients are.

TinCanTech

I do not believe you understand ..

If the subnets behind the clients are all 192.168.10.0/24 (or even only some of them are)
then the --iroutes for those clients (defined in the CCD file) will all be --iroute 192.168.10.0 255.255.255.0

Which means the server does not know where to send to and probably (not sure) selects the first one.

belst

ah no. The subnets behind the clients are unique. (192.168.1xx.0/24 or 192.168.2xx.0/24) the iroutes are all different subnets.

as seen in my ccd config in the original post:

belst wrote
iroute 192.168.202.0 255.255.255.0

edit: 192.168.10.0/24 uses eth0 interface. 192.168.0.0/16 should use tun0

see routing table

default via 192.168.10.1 dev eth0 
10.0.0.0/24 dev tun0 proto kernel scope link src 10.0.0.1 
192.168.0.0/16 via 10.0.0.2 dev tun0 
192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.13

TinCanTech

belst wrote ah no. The subnets behind the clients are unique. (192.168.1xx.0/24 or 192.168.2xx.0/24) the iroutes are all different subnets

Which is not what you said in your opening statement:

belst wrote I have a vpn server which is in the same subnet as a few clients. (192.168.10.0/24)

So .. what ever ..

As for the other problems, try --client-to-client in tbe server config.
Also, check your client side routing and go through your CCD settings carefully.

belst

the server is hosted in my local subnets, where also a few clients will be. that is what I meant with my opening statement.

eg, I can connect to the vpn via 192.168.10.13 and will receive 10.0.0.250. but I do not have an iroute for those clients.