I am trying to set up openvpn between two Edgerouters.
One ER is set up as the openvpn server and is running openvpn like this:
/usr/sbin/openvpn --daemon --verb 3 --writepid /var/run/openvpn-vtun1.pid --status /var/run/openvpn/status/vtun1.status 30 --dev-type tun --dev vtun1 --mode server --tls-server --topology subnet --keepalive 10 60 --lport 1194 --proto tcp-server --cipher aes-128-cbc --auth md5 --ca /config/auth/cacert.pem --cert /config/auth/server.pem --key /config/auth/server.key --dh /config/auth/dhp.pem --management /tmp/openvpn-mgmt-intf unix --push route 192.168.0.0 255.255.255.0 --server 10.101.1.0 255.255.255.0 --client-config-dir /var/run/openvpn/ccd/vtun1
The other ER is connecting as the client and on that one, I put the config in an ovpn file which looks like this minus the certs:
client
dev tun
proto tcp
remote 1.2.3.4
port 1194
push "route 192.168.2.0 255.255.255.0"
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verb 3
keepalive 10 120
If I ssh into the ERs, I can ping in both directions. I see routes on both sides to each other's LANs.
What I can't do is ping from my desktop to a device on the other LAN.
I can use tcpdump and I see the icmp packets going into the vtun on the near side but if I tcpdump -i vtun1 on the other side, I don't see anything. But I am pretty sure the packets are arriving. If I tcpdump the internet connection and look at port 1194, I see packets that correspond to the pings arrive. So it seems like the server side openvpn gets them but for some reason just drops them on the floor.
As an experiment, I created a source NAT rule in the client router. With this rule, I can get to hosts on the server's network. But the reverse is not true. I really do not want a source NAT. There needs to be proper routing between the two LANs.
I tried 'iroute 192.168.2.0 255.255.255.0' but all I get is "Options error: option 'iroute' cannot be used in this context" when I add it to either the server's or the client's config.
Oddly I feel like I have run up against this situation before but each time it feels I fight a different issue. Is there something I can do to get openvpn to tell me why it's dropping the packets?
