New route

louarn

Hi all

My server.conf is actually configured like that :

# Network
topology subnet
server 10.8.0.0 255.255.0.0
#ifconfig-pool-persist ipp.txt
keepalive 10 120
### DNS
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 208.67.222.22"
push "dhcp-option DNS 208.67.220.220"

### dev server
push "route 10.9.0.1 255.255.255.255"
### recette server route
push "route 10.10.0.1 255.255.255.255"
### pre-prod server route
push "route 10.7.0.1 255.255.255.255"
### prod server route
push "route 10.6.0.1 255.255.255.255"

# Clients
client-config-dir /etc/openvpn/ccd
ccd-exclusive
### Boss
route 10.8.1.0 255.255.255.0
### dev
route 10.8.2.0 255.255.255.0
### marketing
route 10.8.3.0 255.255.255.0
### Mobile devices
route 10.8.4.0 255.255.255.0
### Admin
route 10.8.10.0 255.255.255.0

But i would like to join several another servers in another private IP's range like 192.168.0.X/24. My openvpn server has 192.168.0.100 on eth1.

Is it possible ?
a simple push "route 192.168.0.0 255.255.255.0" will work ? (I can't test it because he is in prod)

Thanks

louarn

Hi,

Finally, I tested it. It doesn't work

route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         XX.XX.XX.XX      0.0.0.0         UG    0      0        0 eth0
10.6.0.0        10.6.0.5        255.255.255.0   UG    0      0        0 tun1
10.6.0.5        0.0.0.0         255.255.255.255 UH    0      0        0 tun1
10.8.0.0        0.0.0.0         255.255.0.0     U     0      0        0 tun0
10.8.1.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.2.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.3.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.4.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.10.0       10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.10.0.0       10.6.0.5        255.255.0.0     UG    0      0        0 tun1
XX.XX.XX.XX      0.0.0.0         255.255.255.255 UH    0      0        0 eth0
169.254.169.254 192.168.0.6     255.255.255.255 UGH   0      0        0 eth1
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1

Do I have to create a new openvpn service ?

louarn

A little up for help ?

300000

dont understand the question how you want
route 10.8.1.0 255.255.255.0 route 10.8.2.0 255.255.255.0 route 10.8.3.0 255.255.255.0 route 10.8.4.0 255.255.255.0 route 10.8.10.0 255.255.255.0

it mean you want to add that route on openvpn server routing table so from openvpn server lan side all client lan on openvpn server can connet to that route. it mean that route from client side .

push "route 10.9.0.1 255.255.255.255" push "route 10.10.0.1 255.255.255.255" push "route 10.7.0.1 255.255.255.255" push "route 10.6.0.1 255.255.255.255"

that route is from openvpn server push down to client so on client can access to all route in going though openvpn server . it mean that routes from server side.

what kind of route do you want to push and from where to where ?

you just create two instant openvpn server let do one first and then run second one.

louarn

Thank you for reply.

You are right, first vpn before seconde one.

For my vpn in 10.6.0.0, it works. I can reach my dashboard server on 10.6.0.1 via 10.8.0.1.
My aim now is to reach the network on 192.168.0.0/24. I can ping my fw's eth1 on 192.168.0.238 from my pc via 10.8.0.1 but I can't reach the other server in this LAN.

route on my fw/vpn seems good :

# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         57.xx.xx.xx      0.0.0.0         UG    0      0        0 eth0
10.6.0.0        10.6.0.5        255.255.255.0   UG    0      0        0 tun1
10.6.0.5        0.0.0.0         255.255.255.255 UH    0      0        0 tun1
10.8.0.0        0.0.0.0         255.255.0.0     U     0      0        0 tun0
10.8.1.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.2.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.3.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.4.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.10.0       10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.10.0.0       10.6.0.5        255.255.0.0     UG    0      0        0 tun1
57.xx.xx.xx      0.0.0.0         255.255.255.255 UH    0      0        0 eth0
169.254.169.254 192.168.0.6     255.255.255.255 UGH   0      0        0 eth1
192.168.0.0     192.168.0.238   255.255.255.0   UG    0      0        0 eth1            => added this morning for test ....
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1

And in my fw, iptables looks like:

#openVpn
iptables -A INPUT -i eth0 -m state --state NEW -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 1194 -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A FORWARD -o tun+ -j ACCEPT
#iptables -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
#iptables -A FORWARD -i tun+ -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
#iptables -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
#iptables -A FORWARD -i eth1 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
#iptables -I FORWARD -i tun0 -o eth1 -s 10.8.0.0/24 -d 192.168.0.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o eth1 -j MASQUERADE
iptables -t filter -A OUTPUT -p udp --match multiport --dports 1197,1198,1199 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --match multiport --dport 1197,1198,1199 -j ACCEPT
iptables -A OUTPUT -o tun+ -j ACCEPT
echo "OpenVpn ok"

So, I just want to reach any servers in 192.168.0.0/24 LAN. I don't understand why I can't reach them.

Thanks

300000

You need to push the sub net down to client so from server add this line

Push "192.168.0.0/24 255.255.255.0"

On iptables you need check again
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

iptables -t nat -A POSTROUTING -s 10.6.0.0/24 -o eth0 -j MASQUERADE

You create two tunnel so you need two masquerade on firewall to make it work .just try it . It should work for you

louarn

Hi,

Push "192.168.0.0/24 255.255.255.0" was already in my server.conf. (I can ping fw eth 192.168.0.238 from my pc.).

I add nat postrouting rules to eth1 .. But it doesn't work ...no ping to another 192.168.0.x server ...

300000

Why eth1? Your main internet is eth0 so rule shout go from that not eth1 in lan side
You need making the same as 10.8.0.0 and 10.6.0.0 . All of them need NAT and Ipforward to make it work

louarn

I tried also with eth0. It doesn't work too ...

I dont' understand..

iptables -t nat -A PREROUTING -p tcp --dport 3306 -j DNAT --to-destination 192.168.0.100:3306
iptables -t nat -A POSTROUTING -j MASQUERADE

but ping 192.168.0.100 no ... (iptables is off on mysql server)

louarn

all works ... I don't know why 🙂