Can't access network remote client network

ToddDTaft

I'm trying to configure OpenVPN so that systems on the server network as well as other clients can access the local network behind one of my clients, but something isn't working correctly.

Both the server and client run run OpenVPN 2.4 on Linux.

This is the main config file on the server:

port 1194
proto udp
dev tun
ca /etc/openvpn/server/unclet_openvpn_ca/pki/ca.crt
cert /etc/openvpn/server/unclet_openvpn_ca/pki/issued/vpn.unclet.net.crt
key /etc/openvpn/server/unclet_openvpn_ca/pki/private/vpn.unclet.net.key
crl-verify /etc/openvpn/server/unclet_openvpn_ca/pki/crl.pem
dh /etc/openvpn/server/unclet_openvpn_ca/pki/dh.pem
topology subnet
server 10.200.200.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.0.0.0 255.255.252.0"
client-config-dir client-config
route 10.0.0.0 255.255.252.0
push "dhcp-option DNS 10.0.0.1"
push "dhcp-option DOMAIN unclet.net"
client-to-client
keepalive 10 120
tls-auth ta-vpn.key 0 # This file is secret
cipher AES-256-CBC
compress lz4-v2
push "compress lz4-v2"
user nobody
group openvpn
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 4
explicit-exit-notify 1

This is the configuration file for this specific client in the client-config-dir on the server machine:

ifconfig-push 10.200.200.201 255.255.255.0
iroute 10.0.0.0 255.255.252.0

The client is running on the machine that has multiple physical NICs, and that machine is functioning as the router/gateway/masquerade host (using firewalld) between the private 10.0.0.0/255.255.252.0 network and public addresses. Systems on that network are able to access public IPs without problems.

This is the config file on the client:

client
dev tun
proto udp
remote vpn.unclet.net 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert kangaroo.unclet.net.crt
key kangaroo.unclet.net.key
remote-cert-tls server
tls-auth ta-vpn.key 1
cipher AES-256-CBC
verb 3

Both the server and client machines can ping the VPN addresses of the server (10.200.200.1) and client (10.200.200.201)
However, the server, and other clients are unable to ping any addresses on the 10.0.0.0/255.255.252.0 network, including the 10.0.0.1 address which is the client's regular address on that network.

What's wrong with this configuration?

openvpn_inc

Hi Todd,

In a word, probably firewalld is the problem. Try adding ACCEPT rules for the traffic you want? Then fix or discard firewalld. Simpler rulesets are possible and much easier to troubleshoot.

Did you enable IP forwarding on the client? Does its gateway/router have a route to the VPN via the client?

Also, here is a client LAN troubleshooting flowchart which might help.

regards, rob0