Hello OpenVPN Community!
I am trying to connect the homelab in a remote location to my home network via VPN so that I can use SMB and other functions that my ISP has turned off over the network.
My setup looks like this:
VPN-Server on 10.40.10.0/24 at home. A debian 10 machine also acting as my router. Also has the 10.20.10.0/24 home LAN.
A VPN-client on Debian 9 (The router of my homelab) that connects as a client and gets ip 10.40.10.2 and has the 10.10.10.0/24 LAN.
Due to only wanting to route LAN traffic between the connections I have connected the VPN without pushing any routes, so on the Debian9 machine (homelab) I add the following route:
route add -net 10.20.10.0 netmask 255.255.255.0 gw 10.40.10.1
Which works wonderful:
root@DEBIAN9:~# ping 10.20.10.10
PING 10.20.10.10 (10.20.10.10) 56(84) bytes of data.
64 bytes from 10.20.10.10: icmp_seq=1 ttl=127 time=1.29 ms
And on my Debian10 machine, the router of my home LAN, I add:
route add -net 10.10.10.0 netmask 255.255.255.0 gw 10.40.10.2
However, that doesn't seem to route through.
IPv4 forwarding is turned on on both machines (Since they're acting as routers) so I am not sure what the problem here is.
OpenVPN Server configuration on Debian10 (10.20.10.1)
port 1194
proto udp
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.40.10.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key 0
crl-verify crl.pem
ca ca.crt
cert server_cFlLvRSCasamPVuK.crt
key server_cFlLvRSCasamPVuK.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
status /var/log/openvpn/status.log
verb 3
client-to-client
OpenVPN Client configuration on Debian9 (10.40.10.2 and 10.10.10.1)
client
proto udp
remote 123.123.123.123 1194
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name server_cFlLvRSCasamPVuK name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
setenv opt block-outside-dns # Prevent Windows 10 DNS leak
verb 3
--route-noexec
<ca>
-----BEGIN CERTIFICATE-----
REDACTED
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
REDACTED
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
REDACTED
-----END PRIVATE KEY-----
</key>
<tls-crypt>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
REDACTED
-----END OpenVPN Static key V1-----
</tls-crypt>
Any idea where I am going wrong?
The only IP-table rules I have on both machines are:
Debian9 - HomeLAB Client (10.10.10.1 & 10.40.10.2)
iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
(eth0 being the ISP connection)
and
Debian10 - Home Office OpenVPN-Server (10.20.10.1 and 10.40.10.1)
iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
(eth0 being the ISP connection)
