peret2000 I am facing a complex architecture, to allow, on one side, clients to connect to a vpn server (called server A) (with all ip traffic from clients going through that server); and also that server is connected to another vpn server (called server B) (for specific purposes; it is not necessary that clients see this last server) Once both servers are configured, if I start openvpn server on server A, clients connect without problem. However, if I connect server A as a openvpn client of server B (with no issues), clients cannot connect to server A. Althogh server A behaves as a server and also as a client of other server; although both processes are running on server A: openvpn as server, and openvpn as client The configuration in both server is more or less generic, I am showing the relevant parts, and excluding the not relevant ones; and, in the clients, it is the vanilla conf, I guess, there are no special conf lines added. This is the conf of server A: port 1194 proto udp dev tun dh dh1024.pem server 10.8.0.0 255.255.255.0 push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 10.8.0.1" tls-auth ta.key 0 # This file is secret key-direction 0 cipher AES-128-CBC # AES auth SHA256 comp-lzo user nobody group nogroup persist-key persist-tun The server B conf: port 1194 proto udp dev tun dh dh1024.pem server 10.6.0.0 255.255.255.0 push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 192.168.1.105" push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4" tls-auth ta.key 0 # This file is secret key-direction 0 auth SHA256 comp-lzo user nobody group nogroup persist-key persist-tun The error that can be seen on server A log is: Fri Mar 20 20:13:53 2020 37.10.x.y:32036 TLS: Initial packet from [AF_INET]37.10.x.y:32036, sid=a29xxx38 ecxxxd28 Fri Mar 20 20:13:54 2020 37.10x.y:32036 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1584731631) Fri Mar 20 20:13:51 2020 ] Fri Mar 20 20:13:54 2020 37.x.y:32036 TLS Error: incoming packet authentication failed from [AF_INET]37.10.x.y:32036 Fri Mar 20 20:13:55 2020 37.10.x.y:32036 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 / time = (1584731631) Fri Mar 20 20:13:51 2020 ] I have tried many configuration changes with no success. I do not understand where the issue is. I thing this design must work under some specific conditions or configuration, but I don't come up with the correct configuration. Thank a lot in advance.
peret2000 richard223 wrote it is impossible with openvpn Thanks a lot, @richard223, that is what I was afraid 😐
peret2000 Is it just a kind of limiting some features or something I could do modifying server configuration file? Or maybe using ipfilters? Thanks anyway. If there is some advice to start with I would be very grateful
