mhi-ovpn
Hello,
I'm not sure if the post is in the right place, but that's the risk I can take 😉
We've got problems with configuring OpenPVN Access Server using routing mode. The objective is to have a few groups of clients (networks) that are separately treated in the corporate network in terms of access to network resources. For example, first group of clients has access to host A to some of its ports, another to host B, and the third one to host A and B (admin access).
We've found out that this should be possible using routing mode in Access Server - that way all of the clients have their own IP addresses in the whole network, opposing to the NAT mode in which there is only one address that all of the clients are visible in the network. There are a few pre-defined groups available: dynamic, static, default, each one with its own subnet.
Now, a few words about the topology and configuration. OVPN Access server is an ESXi VM. VM is connected to the network via port that is in VLAN 200 (untagged). Clients' addresses are assigned to VLAN 600 that is tagged. When I start openvpnas daemon (UDP), a new interface in the vm is created - it is called as0t0 and I have not found any information in the docs about it which sounds quite weird. This interface is assigned the address from the dynamic group (10.1.60.1/29). If I run two daemons (UDP and TCP), there are two interfaces: as0t0 and as0t1 that splits the dynamic group address space in half and as0t0 has 10.1.60.1 and as0t1 has 10.1.60.5 address.
Address spaces:
Ovpn AS: 10.1.20.5 (vlan 200)
dynamic group: 10.1.60.0/29 (vlan 600 for all groups)
static group: 10.1.60.8/29
default: 10.1.60.16/29
admin (client subnet defined in group permissions): 10.1.60.24/29
When I connect via vpn using admin user credentials I get the right IP (from 10.1.60.24/29 subnet) but the problem is that I cannot reach LAN, that is VLAN 200, 10.1.20.0/24. All the client packets are sent to 10.1.60.1 address which is as0t0 interface. I've tried numerous ways using routes, different configs in GUI but every time the result is the same - no vlan 200 access.
So, is there any way to make it work? I have not find any official tutorial or even one made by community. Or any other ideas? NAT mode is working ok, but as I said in the beginnning, that's not the goal, clients have to be divided into groups (subnets).
