Hi, following my own hints:
ordex wrote
To do routing you must be sure that SRV2 knows how to route packets back to 10.21.0.0/24.
In order to do this, you must configure a route+iroute on SRV2 that instructs SRV2 to sends packet to SRV1 when they want to reach 10.21.0.0/24.
(This is also called "LAN behind a client", because SRV1 is a client and has a LAN - the VPN - behind it).
The point above can be achieved with 1 line to be added to the openvpn conf file on SRV2:
route 10.21.0.0/24
and 1 line in the CCD file reserved for SRV1 on SRV2 (check --client-config-directory in the manpage if you don't know about CCD):
iroute 10.21.0.0/24
Those two lines will make sure that anything directed to 10.21.0.0/24 on SRV2 will be routed towards SRV1.
Then
then on SRV1 you must be sure that packet *from* 10.21.0.0/24 are routed to SRV2.
To do that you can either set SRV2 as default gateway for all traffic from SRV1 or you can use policy routing (mix of "ip rule" and "ip route").
here you have to decide what you want: do you want all traffic generated on SRV1 to go through SRV2? or only traffic coming from clients should be redirected to SRV2?
I presume you want the latter, so I will go that way:
With policy routing you should (on SRV1):
* create another routing table;
echo 100 openvpn >>/etc/iproute2/rp_tables
* use "ip rule" to send all traffic coming from 10.21.0.0/24 to this new routing table;
ip rule add from 10.21.0.0/24 table 111
* use "ip route" to configure a default routing GW in this new routing table.
ip route add default via 10.63.0.1 table 111
I wrote the commands above out of the top of my head, so something may be wrong. But it's a starting point.
Please, try to understand what they are doing, so you can get full control over your setup 😉
