I have network setup as below. My goal is to connect from client 2 to devices in the same LAN with client 1. [code] +-----------------+ | Router | +-----------------+ | | LAN 192.168.0.0 |---------|--------| | | +----------------+ +---------+ +----------------+ |OpenVPN client 1| | Node 1 | |OpenVPN client 2| +----------------+ +---------+ +----------------+ 10.8.0.11 10.8.0.5 [/code] My server.conf is as below [oconf=Server configuration]client-config-dir ccd port 1194 proto udp dev tun sndbuf 0 rcvbuf 0 ca ca.crt cert server.crt key server.key dh dh.pem auth SHA512 tls-auth ta.key 0 topology subnet server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt route 192.168.0.0 255.255.255.0 push "route 192.168.0.0 255.255.255.0" client-to-client keepalive 10 120 cipher AES-256-CBC user nobody group nogroup persist-key persist-tun status openvpn-status.log verb 5 crl-verify crl.pem[/oconf] There is a ccd file for client 1 in the ccd folder [code]iroute 192.168.0.0 255.255.255.0[/code] I've also edited routing table of the router to redirect requests to 10.8.0.0 - > LAN IP of the client 1. Normally this should be enough to make things work but for some reason route table on OpenVPN doesn't seem to be correct. [code]Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default ip-172-26-0-1.a 0.0.0.0 UG 0 0 0 eth0 10.8.0.0 * 255.255.255.0 U 0 0 0 tun0 172.26.0.0 * 255.255.240.0 U 0 0 0 eth0 192.168.0.0 ip-10-8-0-2.ap- 255.255.255.0 UG 0 0 0 tun0[/code] Here requests to 192.168.0.0 are routed to 10.8.0.2 instead of 10.8.0.11. As of now I can access client 1 both by VPN IP and LAN IP from client 2 but any other device on LAN is not reachable from client 2. What am I doing wrong?

[quote=garretwcox post_id=94632 time=1601233069 user_id=51523] 10.8.0.2 is problematic, in that it's assigned to another client via openvpn. I can ping that client from the os when I ping 10.8.0.2. [/quote]It works just fine. [quote=garretwcox post_id=94632 time=1601233069 user_id=51523] And routing to client subnets aren't working, because the server is trying to send traffic to my client subnets to the wrong client (10.8.0.2) instead of the right one (10.8.0.11) [/quote]Configure your --iroute's and CCD's correctly.

I have. There's no ccd file for the client with the 10.8.0.2 ip. I have a ccd file for the client with the 10.8.0.11 ip that's like this: [quote]iroute 192.168.0.0 255.255.255.0[/quote] I also have the appropriate route line (not iroute) in server.conf

OpenVPN wrong route table?

far33333

I have network setup as below. My goal is to connect from client 2 to devices in the same LAN with client 1.

                                                                            
           +-----------------+                                              
           |     Router      |                                              
           +-----------------+                                              
                    |                                                       
                    |  LAN 192.168.0.0                                      
          |---------|--------|                                              
          |                  |                                              
 +----------------+      +---------+               +----------------+       
 |OpenVPN client 1|      | Node 1  |               |OpenVPN client 2|       
 +----------------+      +---------+               +----------------+       
 10.8.0.11                                         10.8.0.5

My server.conf is as below
client-config-dir ccd
port 1194
proto udp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
route 192.168.0.0 255.255.255.0
push "route 192.168.0.0 255.255.255.0"
client-to-client
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 5
crl-verify crl.pem

There is a ccd file for client 1 in the ccd folder

iroute 192.168.0.0 255.255.255.0

I've also edited routing table of the router to redirect requests to 10.8.0.0 - > LAN IP of the client 1.

Normally this should be enough to make things work but for some reason route table on OpenVPN doesn't seem to be correct.

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         ip-172-26-0-1.a 0.0.0.0         UG    0      0        0 eth0
10.8.0.0        *               255.255.255.0   U     0      0        0 tun0
172.26.0.0      *               255.255.240.0   U     0      0        0 eth0
192.168.0.0     ip-10-8-0-2.ap- 255.255.255.0   UG    0      0        0 tun0

Here requests to 192.168.0.0 are routed to 10.8.0.2 instead of 10.8.0.11. As of now I can access client 1 both by VPN IP and LAN IP from client 2 but any other device on LAN is not reachable from client 2. What am I doing wrong?

garretwcox

I'm having the exact same issue. Does anyone have any ideas of how to get the server to route to the ip of the correct client rather than always going to 10.8.0.2?

TinCanTech

In this case, 10.8.0.2 is the correct route, from the server perspective, for all clients.

OpenVPN handles the internal routing with --iroute.

garretwcox

Reading other documentation, I suspected as much about openvpn handling the routing.
But that still seems odd.
the openvpn ip on the server is 10.8.0.1. If I saw that IP in the route tables, I would have assumed as you said: that linux routes it to openvpn, then openvpn handles it with iroute.

but 10.8.0.2 is problematic, in that it's assigned to another client via openvpn. I can ping that client from the os when I ping 10.8.0.2. And routing to client subnets aren't working, because the server is trying to send traffic to my client subnets to the wrong client (10.8.0.2) instead of the right one (10.8.0.11) or to the server (10.8.0.1)

TinCanTech

garretwcox wrote 10.8.0.2 is problematic, in that it's assigned to another client via openvpn. I can ping that client from the os when I ping 10.8.0.2.

It works just fine.

garretwcox wrote And routing to client subnets aren't working, because the server is trying to send traffic to my client subnets to the wrong client (10.8.0.2) instead of the right one (10.8.0.11)

Configure your --iroute's and CCD's correctly.

garretwcox

I have.
There's no ccd file for the client with the 10.8.0.2 ip.
I have a ccd file for the client with the 10.8.0.11 ip that's like this:

iroute 192.168.0.0 255.255.255.0

I also have the appropriate route line (not iroute) in server.conf

TinCanTech

If Openvpn routed remote subnets through the wrong client then it would break for everyone.

But it is only broken for you.

Not only that but you have hijacked this thread and not provided any of your own details.

https://forums.openvpn.net/viewtopic.php?f=30&t=22603