Hi all,
shortly my situation:
linux server (ubuntu 10.04)
2 network interfaces: eth0 with a bridge (br0, 192.168.2.190) and eth1 (192.168.101.X, dhcp)
traffic is masquerated with this rules:
iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -o eth1 -j MASQUERADE
server is behind a firewall (192.168.2.1) and has port 4911 udp (yes, not standard) forwarded correctly.
this is the server config:
mode server
tls-server
local 192.168.2.190
port 4911
proto udp
dev tap0
up "/etc/openvpn/up.sh br0 tap0 1500"
down "/etc/openvpn/down.sh br0 tap0"
persist-key
persist-tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem
tls-auth ta.key 0 # This file is secret
cipher BF-CBC # Blowfish (default)
comp-lzo
ifconfig-pool-persist ipp.txt
server-bridge 192.168.2.190 255.255.255.0 192.168.2.180 192.168.2.189
push "dhcp-option DNS 192.168.2.190 8.8.8.8"
push "dhcp-option DOMAIN my.domain.com"
push "route 192.168.101.1 255.255.255.255"
max-clients 9
user nobody
group nogroup
keepalive 10 120
status openvpn-status.log
verb 3
connection from remote works perfectly, the (relevant) routes i get are the following:
0.0.0.0 192.168.17.1 0.0.0.0 UG 0 0 0 eth0
vpn_public_ip_address 192.168.17.1 255.255.255.255 UGH 0 0 0 eth0
192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0 tap0
192.168.17.0 0.0.0.0 255.255.255.0 U 1 0 0 eth0
192.168.101.1 192.168.2.190 255.255.255.255 UGH 0 0 0 tap0
of course 192.168.17.0/24 is my home's local network
everythins seems good, but here's the problem:
$ ping -c 1 192.168.2.190
PING 192.168.2.190 (192.168.2.190) 56(84) bytes of data.
64 bytes from 192.168.2.190: icmp_req=1 ttl=64 time=102 ms
--- 192.168.2.190 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 102.758/102.758/102.758/0.000 ms
Works, good. But:
$ ping -c 1 192.168.2.140
PING 192.168.2.140 (192.168.2.140) 56(84) bytes of data.
From 192.168.2.180 icmp_seq=1 Destination Host Unreachable
--- 192.168.2.140 ping statistics ---
1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms
does not...(and the same for every other resource of that subnet).
resources on the other subnet (192.168.101.0) works quite well.
to make the traffic on the 192.168.2.0 network i need to manually push a route on the client like this:
route add -net 192.168.2.0 netmask 255.255.255.0 gw 192.168.2.190
i think things should work without the above route (and i cannot ask my vpn clients to set this route manually) so i guess i'm doing something wrong but can't understand what.
can anybody explain?
