NAGpaulmitchell
We configured OpenVPN on server 1 and everything works as expected. The LAN subnet is 192.156.217.0/24 and the VPN virtual address pool is 10.8.0.0/24 We then cloned server 1, updated the server IP address and VPN virtual address pool (10.9.0.0/24).
The OpenVPN servers and the LAN gateway are separate machines, so we have configured static routes for both subnets on the LAN gateway.
We have machines on a separate subnet, 192.156.100.0/24
The route is pushed to the clients
route 192.156.100.0 255.255.255.0
However, we can’t ping devices on the 192.156.100.0/24 subnet when using server 2, it works fine when using server 1
When I start OpenVPN using server 1 and connect to a machine on the LAN, my ip address is the same as server 1 (192.156.217.50).
When I start OpenVPN using server 2 and connect to a machine on the LAN, my ip address is the same as 10.9.0.4 (my client IP)
[root@csgi2 luser]# iptables -t nat -L -n -v --line-numbers
Chain PREROUTING (policy ACCEPT 211K packets, 40M bytes)
num pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 93123 packets, 18M bytes)
num pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 2016 packets, 164K bytes)
num pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 9513 packets, 691K bytes)
num pkts bytes target prot opt in out source destination
1 2 186 RETURN all -- * * 192.168.122.0/24 224.0.0.0/24
2 0 0 RETURN all -- * * 192.168.122.0/24 255.255.255.255
3 0 0 MASQUERADE tcp -- * * 192.168.122.0/24 !192.168.122.0/24 masq ports: 1024-65535
4 0 0 MASQUERADE udp -- * * 192.168.122.0/24 !192.168.122.0/24 masq ports: 1024-65535
5 0 0 MASQUERADE all -- * * 192.168.122.0/24 !192.168.122.0/24
6 0 0 RETURN all -- * * 192.168.122.0/24 224.0.0.0/24
7 0 0 RETURN all -- * * 192.168.122.0/24 255.255.255.255
8 0 0 MASQUERADE tcp -- * * 192.168.122.0/24 !192.168.122.0/24 masq ports: 1024-65535
9 0 0 MASQUERADE udp -- * * 192.168.122.0/24 !192.168.122.0/24 masq ports: 1024-65535
10 0 0 MASQUERADE all -- * * 192.168.122.0/24 !192.168.122.0/24
11 0 0 MASQUERADE all -- * eth0 10.8.0.0/24 0.0.0.0/0
I assume line 11 should be updated to show 10.9.0.0/24 ?
Do I also need to update the chain FORWORD policy?
[root@csgi2 luser]# iptables -L -v
Chain INPUT (policy ACCEPT 392K packets, 119M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT udp -- virbr0 any anywhere anywhere udp dpt:domain
0 0 ACCEPT tcp -- virbr0 any anywhere anywhere tcp dpt:domain
0 0 ACCEPT udp -- virbr0 any anywhere anywhere udp dpt:bootps
0 0 ACCEPT tcp -- virbr0 any anywhere anywhere tcp dpt:bootps
86739 16M ACCEPT udp -- any any anywhere anywhere udp dpt:openvpn
0 0 ACCEPT udp -- virbr0 any anywhere anywhere udp dpt:domain
0 0 ACCEPT tcp -- virbr0 any anywhere anywhere tcp dpt:domain
0 0 ACCEPT udp -- virbr0 any anywhere anywhere udp dpt:bootps
0 0 ACCEPT tcp -- virbr0 any anywhere anywhere tcp dpt:bootps
Chain FORWARD (policy ACCEPT 8649 packets, 607K bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any virbr0 anywhere 192.168.122.0/24 ctstate RELATED,ESTABLISHED
0 0 ACCEPT all -- virbr0 any 192.168.122.0/24 anywhere
0 0 ACCEPT all -- virbr0 virbr0 anywhere anywhere
0 0 REJECT all -- any virbr0 anywhere anywhere reject-with icmp-port-unreachable
0 0 REJECT all -- virbr0 any anywhere anywhere reject-with icmp-port-unreachable
158K 87M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
0 0 ACCEPT all -- any any 10.8.0.0/24 anywhere
0 0 ACCEPT all -- any virbr0 anywhere 192.168.122.0/24 ctstate RELATED,ESTABLISHED
0 0 ACCEPT all -- virbr0 any 192.168.122.0/24 anywhere
0 0 ACCEPT all -- virbr0 virbr0 anywhere anywhere
0 0 REJECT all -- any virbr0 anywhere anywhere reject-with icmp-port-unreachable
0 0 REJECT all -- virbr0 any anywhere anywhere reject-with icmp-port-unreachable
Chain OUTPUT (policy ACCEPT 275K packets, 115M bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT udp -- any virbr0 anywhere anywhere udp dpt:bootpc
0 0 ACCEPT udp -- any virbr0 anywhere anywhere udp dpt:bootpc
