Hello,
For a long time I'm using ovpn with TAP interfaces and everything was ok, but now size of networks grow and a lot of multicast and other non essential traffic start to go through tunnel and I decided to switch to TUN configuration
Connection works, from server side I can access vpn clients and vice versus, vpn client can access any hosts via vpn tunnel, BUT I unable to pass transit traffic via vpn tunnel, where src address not belongs to vpn client tunnel side.
From client side tcpdump shows that packets are send via tun interface, but on server side nothing is shown by tcpdump...
server configuration is:
port 1194
proto tcp-server
dev-type tun
dev tun10
mode server
client-to-client
tls-server
ca /etc/openvpn/server/keys/ca.crt
cert /etc/openvpn/server/keys/server.crt
key /etc/openvpn/server/keys/server.key
dh /etc/openvpn/server/keys/dh1024.pem
tls-auth /etc/openvpn/server/keys/ta.key 0
client-config-dir /etc/openvpn/server
mssfix
tun-mtu 1500
tcp-nodelay
tcp-queue-limit 64
topology subnet
push "topology subnet"
ifconfig 10.10.50.191 255.255.255.0
status-version 1
tls-timeout 2
cipher AES-256-GCM
cipher AES-256-CBC
auth SHA256
tls-cipher TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256:TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256:TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-256-GCM-SHA384
tls-version-min 1.2
max-clients 10
keepalive 30 60
persist-key
persist-tun
persist-local-ip
push "persist-tun"
reneg-sec 3600
daemon
verb 3
push "route 10.10.10.0 255.255.255.0"
CCD config for client
ifconfig-push 10.10.50.188 255.255.255.0
on client side config:
daemon
server-poll-timeout 15
nobind
ignore-unknown-option block-outside-dns dhcp-renew register-dns tap-sleep dhcp-release dhcp-option fragment
mssfix
tun-mtu 1500
client
dev tun10
cipher AES-256-GCM
cipher AES-256-CBC
auth SHA256
esolv-retry infinite
remote-cert-tls server
reneg-sec 0
verb 3
mute-replay-warnings
persist-key
persist-tun
persist-remote-ip
auth-nocache
<connection>
remote host 1194 tcp4
</connection>
<ca>
..
</ca>
<cert>
..
</cert>
<key>
..
</key>
key-direction 1
<tls-auth>
..
</tls-auth>
so, client gets ip 10.10.50.188
client can access 10.10.10.0/24 and and any other host if packet is send with src ip = 10.10.50.188
as well 10.10.10.0/24 can access 10.10.50.188
but, on client side there are other interfaces with other subnets (clients acts as router with net.ipv4.ip_forward=1) and if there is packet from other net (e.g. 192.168.100.110) addressed to 10.10.10.0/24 I see with packets as outgoing on client side on tun interface and nothing on server side...
what can be wrong here?
