duden00b
Hi,
I have an openvpn site-to-site configuration working. My openvpn server is an Ubuntu Server working into 192.168.69.0/24 lan. The openvpn "site-to-site" client is a 4G moden-router into 192.168.30.0/24 lan. And both lan machines have comunication like they had into the same lan. However, when a second openvpn client (with no site-to-site configuration) is connected to openvpn server, the communication between site-to-site lan is broken. And I need to reboot the openvpn server service to restart this site-to-site conmunication.
I have seen on /var/log/openvpn/openvpn-status.log that the "C" indicator change between 4G router virtual address gateway to the second openvpn client. I dont understand what is the mean, but I think this is related to the problem. ¿Anyone could explain me why is happening and how to solved it?
Client-02 (NO site-to-site client) <==> Server (LAN 192.168.69.0/24) <==> Site-to-site <==> client-01 (LAN 192.168.30.0/24)
port 20301
proto udp4
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
topology subnet
server 20.30.1.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
push "route 192.168.69.0 255.255.255.0"
push "route 192.168.30.0 255.255.255.0"
client-config-dir ccd
route 192.168.30.0 255.255.255.0
client-config-dir ccd
route 20.30.1.11 255.255.255.0
route 20.30.1.12 255.255.255.0
route 20.30.1.101 255.255.255.0
route 20.30.1.102 255.255.255.0
route 20.30.1.103 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
client-to-client
keepalive 10 120
tls-auth ta.key 0 # This file is secret
cipher AES-256-CBC
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
verb 4
client
dev tun
proto udp4
remote XXXXXXXXXXXX 20301
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
remote-cert-tls server
tls-auth ta.key 1
cipher AES-256-CBC
auth SHA256
verb 4
key-direction 1
OpenVPN CLIENT LIST
Updated,Mon Feb 7 14:20:18 2022
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
client-101,XXXXXXXX:28073,166276,150226,Mon Feb 7 13:50:41 2022
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
20.30.1.101,client-01,XXXXXXXX:28073,Mon Feb 7 14:19:48 2022
192.168.30.10C,client-01,XXXXXXXX:28073,Mon Feb 7 14:20:17 2022
192.168.30.0/24,client-01,XXXXXXXX:28073,Mon Feb 7 13:50:42 2022
GLOBAL STATS
Max bcast/mcast queue length,2
END
OpenVPN CLIENT LIST
Updated,Mon Feb 7 14:56:56 2022
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
client-102,XXXXXXXX:50036,31693,16988,Mon Feb 7 14:56:30 2022
client-101,YYYYYYYY:6102,16540,15270,Mon Feb 7 14:54:09 2022
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
20.30.1.101,client-01,YYYYYYYY:6102,Mon Feb 7 14:56:36 2022
20.30.1.102,client-02,XXXXXXXX:50036,Mon Feb 7 14:56:55 2022
192.168.30.0/24,client-02,XXXXXXXX:50036,Mon Feb 7 14:56:31 2022
192.168.30.10C,client-02,XXXXXXXX:50036,Mon Feb 7 14:56:51 2022
GLOBAL STATS
Max bcast/mcast queue length,1
END
192.168.30.10 is the LAN gateway from the side of client-01 site-to-site LAN. And this is see associated to client-02 (other vpn client outside of site-to-site). I suspect that here is the error, but I don't know how to solve it.
duden00b
SOLVED!!! My fail was configure the directive "iroute 192.168.30.0 255.255.255.0" for all my clients into the ccd folder files. Then, when a new client was connected, 192.168.30.0 was routed for it, breaking the route, and therfore, the site-to-site configuration. Noob`s fail. Sorry.
