Good afternoon, this is the topology I need to put into operation and I'm having difficulties: [img]https://i.ibb.co/KV87Jhq/Untitled-Diagram.png[/img] I made this topology with TAP interface, but now I need to provide access to this network through smartphones, so I'm changing it to the TUN interface. Here are the server and client configuration files: Server: [code]dev tun0 ifconfig 192.168.200.1 255.255.255.0 ifconfig-pool 192.168.200.200 192.168.200.254 255.255.255.0 push "route-gateway 192.168.200.1" #Old config: #dev tap0 #server-bridge 192.168.200.1 255.255.255.0 192.168.200.200 192.168.200.254 #routes push "route 10.100.1.0 255.255.255.0 192.168.200.11" push "route 10.100.2.0 255.255.255.0 192.168.200.12" #push many others .... topology subnet mode server client-to-client tls-server proto udp port 1194 client-config-dir /etc/openvpn/per/config dh /etc/openvpn/per/keys/dh2048.pem ca /etc/openvpn/per/keys/ca.crt cert /etc/openvpn/per/keys/per_server.crt key /etc/openvpn/per/keys/per_server.key log /etc/openvpn/per/logs/per.log status /etc/openvpn/per/logs/per-status.log keepalive 10 60 tun-mtu 1500 fragment 1300 mssfix mute 3 compress lzo [/code] client-config-dir files content: [code]ifconfig-push 192.168.200.11 255.255.255.0[/code] Router VPN1: [code]proto udp topology subnet client remote server123.com 1194 dev tun0 nobind compress lzo tun-mtu 1500 fragment 1300 mssfix route-nopull mute 3 resolv-retry infinite connect-retry 15 60 ca /scripts/keys/ca.crt cert /scripts/keys/teste.crt key /scripts/keys/teste.key askpass pass.txt log openvpn.log [/code] Result of the route command on the Client VPN: [code]Tabela de Roteamento IP do Kernel Destino Roteador MáscaraGen. Opções Métrica Ref Uso Iface default _gateway 0.0.0.0 UG 50 0 0 tun1 default per.localdomain 0.0.0.0 UG 600 0 0 wlp7s0 10.100.1.0 192.168.200.11 255.255.255.0 UG 50 0 0 tun1 link-local 0.0.0.0 255.255.0.0 U 1000 0 0 wlp7s0 cpro43149.publi per.localdomain 255.255.255.255 UGH 600 0 0 wlp7s0 192.168.0.0 0.0.0.0 255.255.255.0 U 600 0 0 wlp7s0 per.localdomain 0.0.0.0 255.255.255.255 UH 600 0 0 wlp7s0 192.168.200.0 0.0.0.0 255.255.255.0 U 50 0 0 tun1 [/code] Ifconfig on Client VPN: [code] tun1: flags=4305 mtu 1500 inet 192.168.200.200 netmask 255.255.255.0 destination 192.168.200.200 inet6 fe80::f93e:ee3f:85a:7471 prefixlen 64 scopeid 0x20 unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (Não Especificado) RX packets 6 bytes 504 (504.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 319 bytes 25314 (25.3 KB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 [/code] ifconfig on Router VPN1: [code] eth1: flags=4099 mtu 1500 inet 10.100.1.1 netmask 255.255.255.0 broadcast 10.100.1.255 inet6 fe80::2e0:4cff:fe68:5e prefixlen 64 scopeid 0x20 ether 00:e0:4c:68:00:5e txqueuelen 1000 (Ethernet) RX packets 3639 bytes 255105 (249.1 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 723 bytes 102554 (100.1 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 tun0: flags=4305 mtu 1500 inet 192.168.200.11 netmask 255.255.255.0 destination 192.168.200.11 inet6 fe80::f3bf:2fea:7231:73f6 prefixlen 64 scopeid 0x20 unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC) RX packets 1443 bytes 98929 (96.6 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 1296 bytes 85623 (83.6 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 [/code] In the server: [code]tun0: flags=4305 mtu 1500 inet 192.168.200.1 netmask 255.255.255.0 destination 192.168.200.1 inet6 fe80::5aa4:80b0:2ea3:b889 prefixlen 64 scopeid 0x20 unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC) RX packets 323 bytes 41133 (40.1 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 297 bytes 17892 (17.4 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0[/code] Ping tests between server and clients: Server to router VPN1: [code]root@server123:~# ping 192.168.200.11 PING 192.168.200.11 (192.168.200.11) 56(84) bytes of data. 64 bytes from 192.168.200.11: icmp_seq=1 ttl=64 time=21.7 ms 64 bytes from 192.168.200.11: icmp_seq=2 ttl=64 time=20.9 ms [/code] Server to client: [code]root@server123:~# ping 192.168.200.200 PING 192.168.200.200 (192.168.200.200) 56(84) bytes of data. 64 bytes from 192.168.200.200: icmp_seq=1 ttl=64 time=21.7 ms 64 bytes from 192.168.200.200: icmp_seq=2 ttl=64 time=37.8 ms 64 bytes from 192.168.200.200: icmp_seq=3 ttl=64 time=70.9 ms [/code] Between Router VPN1 and server: [code]root@router_vpn1:/home/administrador# ping 192.168.200.1 PING 192.168.200.1 (192.168.200.1) 56(84) bytes of data. 64 bytes from 192.168.200.1: icmp_seq=1 ttl=64 time=20.9 ms 64 bytes from 192.168.200.1: icmp_seq=2 ttl=64 time=21.6 ms [/code] From client to client: [code]jonatas@vpn_client:~$ ping 192.168.200.11 PING 192.168.200.11 (192.168.200.11) 56(84) bytes of data. 64 bytes from 192.168.200.11: icmp_seq=1 ttl=64 time=42.1 ms 64 bytes from 192.168.200.11: icmp_seq=2 ttl=64 time=42.7 ms [/code] But i cannot ping from vpn_client to router_vpn lan interface, and routing is enabled on router. I added a route on server to make a test without sucess: [code]route add -net 10.100.1.0 netmask 255.255.255.0 gw 192.168.200.11 [/code] I still can not reach the 10.100.1.0 network I'll be waiting for a light.

[quote=JonatasP post_id=84366 time=1552505195 user_id=43995] I will bre gratefull if anyone can pay attention here [/quote] :roll: [quote=JonatasP post_id=84340 time=1552417178 user_id=43995] this is the topology I need to put into operation and I'm having difficulties [/quote] [quote=JonatasP post_id=84366 time=1552505195 user_id=43995] client-config-dir files content: Code: Select all ifconfig-push 192.168.200.11 255.255.255.0 [/quote][url=https://community.openvpn.net/openvpn/wiki/HOWTO]HOWTO ![/url] See [i]Expanding the scope[/i].. And [b]only[/b] because of GNU.

Client to client VPN config

[deleted]

Good afternoon, this is the topology I need to put into operation and I'm having difficulties:

I made this topology with TAP interface, but now I need to provide access to this network through smartphones, so I'm changing it to the TUN interface.
Here are the server and client configuration files:
Server:

dev tun0
ifconfig 192.168.200.1 255.255.255.0
ifconfig-pool 192.168.200.200 192.168.200.254 255.255.255.0
push "route-gateway 192.168.200.1"

#Old config:
#dev tap0
#server-bridge 192.168.200.1 255.255.255.0 192.168.200.200 192.168.200.254

#routes
push "route 10.100.1.0 255.255.255.0 192.168.200.11"
push "route 10.100.2.0 255.255.255.0 192.168.200.12"
#push many others ....

topology subnet
mode server
client-to-client
tls-server
proto udp
port 1194
client-config-dir /etc/openvpn/per/config
dh /etc/openvpn/per/keys/dh2048.pem
ca /etc/openvpn/per/keys/ca.crt
cert /etc/openvpn/per/keys/per_server.crt
key /etc/openvpn/per/keys/per_server.key
log /etc/openvpn/per/logs/per.log
status /etc/openvpn/per/logs/per-status.log
keepalive 10 60
tun-mtu 1500
fragment 1300
mssfix
mute 3
compress lzo

client-config-dir files content:

ifconfig-push 192.168.200.11 255.255.255.0

Router VPN1:

proto udp
topology subnet
client
remote server123.com 1194 
dev tun0 
nobind
compress lzo 
tun-mtu 1500 
fragment 1300 
mssfix
route-nopull
mute 3
resolv-retry infinite
connect-retry 15 60
ca /scripts/keys/ca.crt
cert /scripts/keys/teste.crt
key /scripts/keys/teste.key
askpass pass.txt
log openvpn.log

Result of the route command on the Client VPN:

Tabela de Roteamento IP do Kernel
Destino         Roteador        MáscaraGen.    Opções Métrica Ref   Uso Iface
default         _gateway        0.0.0.0         UG    50     0        0 tun1
default         per.localdomain 0.0.0.0         UG    600    0        0 wlp7s0
10.100.1.0      192.168.200.11  255.255.255.0   UG    50     0        0 tun1
link-local      0.0.0.0         255.255.0.0     U     1000   0        0 wlp7s0
cpro43149.publi per.localdomain 255.255.255.255 UGH   600    0        0 wlp7s0
192.168.0.0     0.0.0.0         255.255.255.0   U     600    0        0 wlp7s0
per.localdomain 0.0.0.0         255.255.255.255 UH    600    0        0 wlp7s0
192.168.200.0   0.0.0.0         255.255.255.0   U     50     0        0 tun1

Ifconfig on Client VPN:

tun1: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 192.168.200.200  netmask 255.255.255.0  destination 192.168.200.200
        inet6 fe80::f93e:ee3f:85a:7471  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (Não Especificado)
        RX packets 6  bytes 504 (504.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 319  bytes 25314 (25.3 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ifconfig on Router VPN1:

eth1: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 10.100.1.1  netmask 255.255.255.0  broadcast 10.100.1.255
        inet6 fe80::2e0:4cff:fe68:5e  prefixlen 64  scopeid 0x20<link>
        ether 00:e0:4c:68:00:5e  txqueuelen 1000  (Ethernet)
        RX packets 3639  bytes 255105 (249.1 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 723  bytes 102554 (100.1 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 192.168.200.11  netmask 255.255.255.0  destination 192.168.200.11
        inet6 fe80::f3bf:2fea:7231:73f6  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 1443  bytes 98929 (96.6 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1296  bytes 85623 (83.6 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

In the server:

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 192.168.200.1  netmask 255.255.255.0  destination 192.168.200.1
        inet6 fe80::5aa4:80b0:2ea3:b889  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 323  bytes 41133 (40.1 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 297  bytes 17892 (17.4 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Ping tests between server and clients:
Server to router VPN1:

root@server123:~# ping 192.168.200.11
PING 192.168.200.11 (192.168.200.11) 56(84) bytes of data.
64 bytes from 192.168.200.11: icmp_seq=1 ttl=64 time=21.7 ms
64 bytes from 192.168.200.11: icmp_seq=2 ttl=64 time=20.9 ms

Server to client:

root@server123:~# ping 192.168.200.200
PING 192.168.200.200 (192.168.200.200) 56(84) bytes of data.
64 bytes from 192.168.200.200: icmp_seq=1 ttl=64 time=21.7 ms
64 bytes from 192.168.200.200: icmp_seq=2 ttl=64 time=37.8 ms
64 bytes from 192.168.200.200: icmp_seq=3 ttl=64 time=70.9 ms

Between Router VPN1 and server:

root@router_vpn1:/home/administrador# ping 192.168.200.1
PING 192.168.200.1 (192.168.200.1) 56(84) bytes of data.
64 bytes from 192.168.200.1: icmp_seq=1 ttl=64 time=20.9 ms
64 bytes from 192.168.200.1: icmp_seq=2 ttl=64 time=21.6 ms

From client to client:

jonatas@vpn_client:~$ ping 192.168.200.11
PING 192.168.200.11 (192.168.200.11) 56(84) bytes of data.
64 bytes from 192.168.200.11: icmp_seq=1 ttl=64 time=42.1 ms
64 bytes from 192.168.200.11: icmp_seq=2 ttl=64 time=42.7 ms

But i cannot ping from vpn_client to router_vpn lan interface, and routing is enabled on router.
I added a route on server to make a test without sucess:

route add -net 10.100.1.0 netmask 255.255.255.0 gw 192.168.200.11

I still can not reach the 10.100.1.0 network
I'll be waiting for a light.

[deleted]

Is there any information that might contribute to the diagnosis? I will bre gratefull if anyone can pay attention here.
Here are some additional information:
- Routing enabled on the VPN Router.
- I need to access the "Routers 1,2, etc." from my pc "VPN Client"
- Here's the "Router VPN1" routing table:

default         per.localdomain 0.0.0.0         UG    0      0        0 eth0
10.100.1.0      0.0.0.0         255.255.255.0   U     0      0        0 eth1
link-local      0.0.0.0         255.255.0.0     U     1000   0        0 eth0
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.200.0   0.0.0.0         255.255.255.0   U     0      0        0 tun0

And the openvpn log from "Router VPN1":

Wed Mar 13 16:23:01 2019 OpenVPN 2.4.0 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 18 2017
Wed Mar 13 16:23:01 2019 library versions: OpenSSL 1.0.2q  20 Nov 2018, LZO 2.08
Wed Mar 13 16:23:01 2019 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Mar 13 16:23:01 2019 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Mar 13 16:23:01 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]191.252.56.10:19999
Wed Mar 13 16:23:01 2019 UDP link local: (not bound)
Wed Mar 13 16:23:01 2019 UDP link remote: [AF_INET]191.252.56.10:19999
Wed Mar 13 16:23:01 2019 [per_server] Peer Connection Initiated with [AF_INET]123.123.123.123:1194
Wed Mar 13 16:23:02 2019 Options error: option 'route' cannot be used in this context ([PUSH-OPTIONS])
Wed Mar 13 16:23:02 2019 TUN/TAP device tun0 opened
Wed Mar 13 16:23:02 2019 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Wed Mar 13 16:23:02 2019 /sbin/ip link set dev tun0 up mtu 1500
Wed Mar 13 16:23:02 2019 /sbin/ip addr add dev tun0 192.168.200.11/24 broadcast 192.168.200.255
Wed Mar 13 16:23:02 2019 Initialization Sequence Completed

TinCanTech

JonatasP wrote I will bre gratefull if anyone can pay attention here

:roll:

JonatasP wrote this is the topology I need to put into operation and I'm having difficulties

JonatasP wrote client-config-dir files content:

Code: Select all

ifconfig-push 192.168.200.11 255.255.255.0

HOWTO !

See Expanding the scope..

And only because of GNU.

[deleted]

TinCanTech wrote
JonatasP wrote I will bre gratefull if anyone can pay attention here
:roll:

JonatasP wrote this is the topology I need to put into operation and I'm having difficulties

JonatasP wrote client-config-dir files content:

Code: Select all

ifconfig-push 192.168.200.11 255.255.255.0
HOWTO !

See Expanding the scope..

And only because of GNU.

Your answer was not direct but it helped me a lot.

I was able to reach the LAN of the client router by placing this line in the client-config-dir file on the server:

iroute 10.100.1.0 255.255.255.0

This will tell the OpenVPN server that the 10.100.1.0/24 subnet should be routed to Router VPN1.