I have problem.

elmemis

I configured OpenVPN P t P.

Router-1(LAN1) ---------- wan ---------- Router-2(LAN2)

In Lan1 (192.168.1.0/24) I have:
1 Router-1 Cisco WRT54G (192.168.1.1 gateway)
1 Server with Centos 5 and OpenVPN (192.168.1.250/24 Static) - 1 Ethernet card.
5 Clients Windows (DHCP).

In Lan2 (192.168.7.0/24) I have:
1 Router-2 Cisco WRT54G (192.168.7.1 gateway)
1 Server with Centos 5 and OpenVPN (192.168.7.250/24 Static) - 1 Ethernet card.
2 Clients Windows (DHCP).

Server Centos Lan 1 IP Tunnel (tun): 10.0.1.1
Server Centos Lan 2 IP Tunnel (tun): 10.0.1.2

In server Centos Lan 1 add in config: route 192.168.7.0 255.255.255.0
In server Centos Lan 2 add in config: route 192.168.1.0 255.255.255.0
In two server activate ip_forward=1

From server Centos Lan 1:
ping 10.0.1.2 Work OK.
ping 192.168.7.1 (or any win client) Not work 🙁

From server Centos Lan 2:
ping 10.0.1.1 Work OK.
ping 192.168.1.1 (or any win client) Not work 🙁

I can not find the error. I am newbie.
Can you help me with my problem?

Thanks!

Mimiko

It's a common routing configuration problem when adding computers behind OpenVPN.
Read this: http://www.openvpn.net/index.php/open-source/documentation/howto.html#scope and http://www.openvpn.net/index.php/open-source/faq/77-server/265-how-do-i-enable-ip-forwarding.html.
Also, the clients does not have OpenVPN computer as default gateway, that's why the packets back from pconputers goes to gateway, not the VPN tunnel. You have to:
1) Move OpenVPN to default gateway;
2) Add a route to default gateway, to route packet's for the other LAN to OpenVPN computer;
3) Add a route on each computer to point the other LAN to OpenVPN computer.

elmemis

That is done. Already active ip forward.

What I want to do is to ping from a lan server to the remote centos and I'm not able.

I can not put the vpn server as a gateway.

Does not this working for me that I have only one network card VPN servers?.

I need to resend the servers on the same network card.
So, I have a server:
192.168.1.1 - 10.8.0.1 (Server 1, a single card).
192.168.7.1 - 10.8.0.6 (Server 2, a single card).

The 10.x.x.x IP correspond to the tunnel that runs on the same lan card.

Thanks!

Mimiko

Does not this working for me that I have only one network card VPN servers?.

One network card is enough.

Please use the second and third option. Please describe the IPs of what you whant to do. From what IP you whant access what IP?

elmemis

Config node 1:
IP Lan: 192.168.1.250
IP Wan: node1.sytes.net (example)

dev tun
port 1194

secret pass.key 
ifconfig 10.0.8.1 10.0.8.6
daemon
route 192.168.7.0 255.255.255.0
log-append /tmp/vpnlog.log
status /tmp/vpnstatus.log

In windows client execute this command:

route add 192.168.7.0 mask 255.255.255.0 192.168.1.250

Config node 2:
IP Lan: 192.168.7.250
IP Wan: node2.sytes.net (example)

dev tun
port 1194
remote node1.sytes.net
secret pass.key
ifconfig 10.0.8.6 10.0.8.1
daemon
route 192.168.1.0 255.255.255.0
log-append /tmp/vpnlog.log
status /tmp/vpnstatus.log

In windows client execute this command:

route add 192.168.1.0 mask 255.255.255.0 192.168.7.250

elmemis

From Lan 192.168.1.0 (include 192.168.1.250) can not access Lan 192.168.7.0 (include 192.168.7.250).

From Lan 192.168.7.0 (include 192.168.7.250) can not access Lan 192.168.1.0 (include 192.168.1.250).

From server 1 (192.168.1.250) not can access lan 192.168.7.0, only work ping 10.8.0.6.

From server 2 (192.168.7.250) not can access lan 192.168.1.0, only work ping 10.8.0.1.

In two server execute this command:

sysctl -w net.ipv4.ip_forward = 1

Mimiko

On both servers forwarding rule must be accepted by default.
On every computer in LAN 192.168.1.0 add a static route:

route add 192.168.7.0 mask 255.255.255.0 gw 192.168.1.250

On every computer in LAN 192.168.7.0 add a static route:

route add 192.168.1.0 mask 255.255.255.0 gw 192.168.7.250

elmemis

In both server returns me the same message:

[root]# service network restart
InterrupciÃ³n de la interfaz eth0:                         [  OK  ]
InterrupciÃ³n de la interfaz de loopback:                  [  OK  ]
Deshabilitando el reenvio de paquetes IPv4:  net.ipv4.ip_forward = 0
                                                           [  OK  ]
ActivaciÃ³n de la interfaz de loopback:                    [  OK  ]
Activando interfaz eth0:                                   [  OK  ]

Automatic disable ip_forward, why?.

If I ip_forward active after restart network services, it works correctly.
I leave the ip_forward active by default.

elmemis

In file

 /etc/init.d/network

I found the following code:

if [ -f /proc/sys/net/ipv4/ip_forward ]; then
                if [ `cat /proc/sys/net/ipv4/ip_forward` != 0 ]; then
                        action $"Disabling IPv4 packet forwarding: " sysctl -w net.ipv4.ip_forward=0
                fi
          fi

and repleace for:

if [ -f /proc/sys/net/ipv4/ip_forward ]; then
                if [ `cat /proc/sys/net/ipv4/ip_forward` != 1 ]; then
                        action $"Enable IPv4 packet forwarding: " sysctl -w net.ipv4.ip_forward=1
                fi
          fi

In clients Lan 192.168.1.0 execute this commands:

route add 192.168.7.0 mask 255.255.255.0 192.168.1.250
route add 10.8.0.0 mask 255.255.255.0 192.168.1.250

and
In clients Lan 192.168.7.0 execute this commands::

route add 192.168.1.0 mask 255.255.255.0 192.168.7.250
route add 10.8.0.0 mask 255.255.255.0 192.168.7.250

From clients lan 1 execute this commands (192.168.1.xxx) :

 ping 10.8.0.6

work

 ping 192.168.7.250

work

 ping 192.168.7.1

gateway remote lan | not working

 ping 192.168.7.x

any client this lan | not working

From clients lan 2 execute this commands (192.168.7.xxx) :

 ping 10.8.0.1

work

 ping 192.168.1.250

work

 ping 192.168.1.1

gateway remote lan | not working

 ping 192.168.1.x

any client this lan | not working

🙁 🙁 🙁 🙁 🙁 🙁 🙁

Mimiko

One step further.
You don't need to modify network file, just use

echo 1 > /proc/sys/net/ipv4/ip_forward

on both OpenVPN computers. That's what remote client's are not responding. The remote GW will not respond if you didn't add those rooutes to them too.

elmemis

Thanks for your help!
I have been very useful.
Works fine!.
In all clients create .bat and add in startup:
Lan 1:

 route add 192.168.7.0 mask 255.255.255.0 192.168.1.250

Lan 2:

 route add 192.168.1.0 mask 255.255.255.0 192.168.7.250

I'll keep reading tutorials and manuals openvpn.

THANKS!!!!!!

Mimiko

For a persistent route other start ups, you can use -p switch:

route -p add 192.168.7.0 mask 255.255.255.0 192.168.1.250

so you don't have to use bat files.