gfunkdave
For a few years now I have had an OpenVPN connection between multiple EdgeRouters. It works fine. One ER is the OpenVPN server, and three others connect to it as clients. From any ER, or the devices on its LAN, I can access any other ER or the devices on its LAN.
Now, I am trying to implement policy based routing for a specific device (my Apple TV) so that all its connections exit to the internet via one of the client OpenVPN routers. The AppleTV claims it doesn't have an internet connection, so I set the policy to include my laptop for testing purposes.
Traceroutes from my laptop to the internet go to my local ER (the OpenVPN server) and disappear. I can still traceroute to the client router I'm trying to exit through, as well as anything on its LAN.
Running tcpdump shows incoming packets hit the OpenVPN interface and then disappear. The client router never sees them. This leads me to believe that OpenVPN needs to be configured to do something difference.
nobody 22544 1 1 14:50 ? 00:00:03 /usr/sbin/openvpn --daemon --verb 3 --writepid /var/run/openvpn-vtun0.pid --status /var/run/openvpn/status/vtun0.status 30 --dev-type tun --dev vtun0 --mode server --tls-server --topology subnet --keepalive 10 60 --proto udp --cipher aes-256-cbc --auth sha256 --ca /config/auth/openvpn/DaveServer/ca.crt --cert /config/auth/openvpn/DaveServer/RoutyMcRouterson.crt --key /config/auth/openvpn/DaveServer/RoutyMcRouterson.key --dh /config/auth/openvpn/DaveServer/dh.pem --management /tmp/openvpn-mgmt-intf unix --push dhcp-option DNS 192.168.4.1 --push route 192.168.4.0 255.255.255.0 --push route 192.168.15.0 255.255.255.0 --server 10.8.0.0 255.255.255.0 --client-config-dir /var/run/openvpn/ccd/vtun0 --client-to-client --keepalive 10 60 --comp-lzo adaptive --verb 1 --user nobody --group nogroup
And here is on the client:
david@router:~$ sudo ps -ef | grep openvpn
root 6769 1 0 14:02 ? 00:00:03 /usr/sbin/openvpn --daemon --verb 3 --writepid /var/run/openvpn-vtun0.pid --status /var/run/openvpn/status/vtun0.status 30 --dev-type tun --dev vtun0 --client --nobind --rport 1194 --proto udp --remote xxx --cipher aes-256-cbc --auth sha256 --ca /config/auth/ca.crt --cert /config/auth/rena.crt --key /config/auth/rena.key --comp-lzo adaptive --keepalive 10 60 --verb 1 --remote-cert-tls server
Any ideas appreciated.
gfunkdave
Should have added, it's almost like I need an iroute directive for 0.0.0.0/0 to that client, but I tried that and it doesn't work.
Also adding: I added an iroute for 8.8.8.0/24 just to see if I could ping 8.8.8.8, and it worked. So that must be the issue.
Does an iroute not in /24 space just not work?
