Hi,
I've been using OpenVPN for years successfully but this time I'm stumbled.
One client (client1) on OSX
Server on RPi (OpenVPN 2.4.7)
- Pushes redirect gateway
- ipv4 forwarding enabled
Issue: client unable to access (ping) server's second subnet (192.168.11.0/24) but can access server's 192.168.2.0/24
Server routes:
pi@raspberrypi:~ $ route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default funbox.home 0.0.0.0 UG 202 0 0 eth0
10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
192.168.2.0 0.0.0.0 255.255.255.0 U 202 0 0 eth0
192.168.11.0 0.0.0.0 255.255.255.0 U 303 0 0 wlan0
pi@raspberrypi:~ $
dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/raspberrypi_83467457-bff3-4679-8ca4-8aa05d505887.crt
key /etc/openvpn/easy-rsa/pki/private/raspberrypi_83467457-bff3-4679-8ca4-8aa05d505887.key
dh none
topology subnet
server 10.8.0.0 255.255.255.0
# Set your primary domain name server address for clients
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
# Prevent DNS leaks on Windows
push "block-outside-dns"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
keepalive 1800 3600
remote-cert-tls client
tls-version-min 1.2
tls-crypt /etc/openvpn/easy-rsa/pki/ta.key
cipher AES-256-CBC
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
syslog
verb 3
#DuplicateCNs allow access control on a less-granular, per user basis.
#Remove # if you will manage access by user instead of device.
duplicate-cn
# Generated for use by PiVPN.io
client-config-dir ccd
client's traceroute 192.168.11.1
~ traceroute 192.168.11.1
traceroute to 192.168.11.1 (192.168.11.1), 64 hops max, 52 byte packets
1 10.8.0.1 (10.8.0.1) 88.385 ms 85.074 ms 87.895 ms
2 * * *
^C
What am I missing in here?
Thanks
