Hi all, looking for some help on routing between the two following networks :- [img]https://i.ibb.co/YPR8j9y/Routing.jpg[/img] Clients on 192.168.8.0/24 can access everything on 192.168.1.0/24 and their internet goes out through 90.252.x.x (which is good) Clients on 192.168.1.0/24 can access everything on 10.8.0.0/24 I have opened ports on ROUTER 1 to forward traffic to clients on 192.168.8.0/24 which allows 192.168.1.0/24 to access resources hosted on the 192.168.8.0/24 subnet by port forwarding 192.168.1.0/24 traffic hitting 10.8.0.4 So essentially I can communicate between the two LANS but I would prefer to be able to communicate directly between 192.168.8.0/24 and 192.168.1.0/24 but I am not sure if this is even possible in the scenario above [oconf=Server Config] local 192.168.1.41 port 1194 proto udp dev tun ca ca.crt cert server.crt key server.key dh dh.pem auth SHA512 tls-crypt tc.key topology subnet client-to-client server 10.8.0.0 255.255.255.0 push "redirect-gateway def1 bypass-dhcp" ifconfig-pool-persist ipp.txt push "dhcp-option DNS 192.168.1.41" keepalive 10 120 cipher AES-256-CBC user nobody group nogroup persist-key persist-tun status openvpn-status.log verb 3 crl-verify crl.pem explicit-exit-notify[/oconf] [oconf=Client Config] client dev tun proto udp remote 90.252.x.x 1194 resolv-retry infinite nobind persist-key persist-tun remote-cert-tls server auth SHA512 cipher AES-256-CBC ignore-unknown-option block-outside-dns block-outside-dns verb 3 [/oconf] Is anyone able to advise, thanks in advance

[quote=Evil1 post_id=97153 time=1611760127 user_id=43478] Does this mean that my openvpn server is using another server.conf file somewhere? [/quote]Very likely.

Routing between networks

Evil1

Hi all, looking for some help on routing between the two following networks :-

Clients on 192.168.8.0/24 can access everything on 192.168.1.0/24 and their internet goes out through 90.252.x.x (which is good)

Clients on 192.168.1.0/24 can access everything on 10.8.0.0/24

I have opened ports on ROUTER 1 to forward traffic to clients on 192.168.8.0/24 which allows 192.168.1.0/24 to access resources hosted on the 192.168.8.0/24 subnet by port forwarding 192.168.1.0/24 traffic hitting 10.8.0.4

So essentially I can communicate between the two LANS but I would prefer to be able to communicate directly between 192.168.8.0/24 <> and 192.168.1.0/24 but I am not sure if this is even possible in the scenario above

local 192.168.1.41
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
client-to-client
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 192.168.1.41"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem
explicit-exit-notify

client
dev tun
proto udp
remote 90.252.x.x 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
ignore-unknown-option block-outside-dns
block-outside-dns
verb 3

Is anyone able to advise, thanks in advance

Evil1

I have made some changes to the server config, namely added the ccd, route and push options :-

local 192.168.1.41
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
client-to-client
server 10.8.0.0 255.255.255.0
push-route 192.168.8.0 255.255.255.0
client-config-dir /etc/openvpn/server/ccd
route 192.168.8.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 192.168.1.41"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem

and I have created a client file in the /etc/openvpn/server/ccd folder that contains iroute 192.168.8.0 255.255.255.0 and have given rights over this folder with chmod -R 777

IP forwarding is also enabled on the server

cat /proc/sys/net/ipv4/ip_forward
1

What am I missing here, other than braincells and RTFM? (been through the manual serveral times)

Evil1

It actually does work. But only if I run openvpn --config server.conf
if a start the service via service openvpn start then the two way routing does not work!

Tracing route to 192.168.8.208 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  my.router [192.168.1.1]
  2    <1 ms    <1 ms    <1 ms  pihole-VM [192.168.1.41]
  3   121 ms   126 ms   131 ms  10.8.0.4
  4   212 ms   126 ms   137 ms  192.168.8.208

Trace complete.

traceroute to 192.168.1.26 (192.168.1.26), 30 hops max, 60 byte packets
 1  192.168.8.1 (192.168.8.1)  2.594 ms  2.662 ms  3.664 ms
 2  10.8.0.1 (10.8.0.1)  184.474 ms  184.978 ms  187.239 ms
 3  192.168.1.26 (192.168.1.26)  190.385 ms * *

Does this mean that my openvpn server is using another server.conf file somewhere?

TinCanTech

Evil1 wrote Does this mean that my openvpn server is using another server.conf file somewhere?

Very likely.