[SOLVED] access server from lan behind client in routing mod

rafaurl

Hi! I've been reading and tried some things but can't find a solution for my problem. I've installed openvpn in routing mode:

VPN Server (Windows server 2003) Client A (W Server 2003) LAN Computer B
Lan: 192.168.1.2/24 192.168.10.90/24 192.168.10.20/24
GW: 192.168.1.1 192.168.10.254 192.168.10.254
VPN: 10.100.0.1/24 10.100.0.200/24 no vpn client

I would like to access VPN server from other computers in same LAN than Client A. To do so, I've tried the following:
First, configure Client A for IP forwarding by setting IPEnableRouter=1 in registry (I've set its IP as gateway in one computer and it works fine).

Second, added a static route in LAN computers (for testing purpose):

route add 10.100.0.0 mask 255.255.255.0 192.168.10.90 metric 5

As it didn't work, I added a static route in default router (192.168.10.254) and tracert says it's ok, as pinging from Lan Computer B to 10.100.0.1 goes throught 192.168.10.90 instead of 192.168.10.254, but ping don't reply.

Maybe it isn't possible, but I thought that Client A could forward packets to VPN from other computers in same LAN just enabling it for routing. I'm I wrong?

Thanks in advance and I apologize for my poor english.

#server config
port 1194
proto udp
dev tun
persist-tun

ca ca.crt
cert server.crt
key server.key
dh dh1024.pem

server 10.100.0.0 255.255.255.0
topology subnet

client-config-dir ccd
client-to-client

keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

#client config
client
dev tun
remote x.x.x.x 1194
proto udp

ca ca.crt
cert client_acrt
key client_a.key

ns-cert-type server

resolv-retry infinite
comp-lzo

script-security 2
route-method exe
route-delay 0 5
dhcp-renew
dhcp-release

maikcat

for your openvpn server to access pcs into your clients lan you have to:

add this to your server config

route 192.168.10.0 255.255.255.0

create a ccd file named client_a with the following contents:

iroute 192.168.10.0 255.255.255.0

enable ip forwarding in both client/server
configure firewalls (if any) on both server/client accordingly.

Michael.

rafaurl

thanks for your reply. I've follow your instructions but when I tried, server log says:

OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.10.0

so I tried by changing it to:

route 192.168.10.0 255.255.255.0 10.100.0.1

so log says now:

MULTI: internal route 192.168.10.0/24 -> adn/client.public.ip:59142
MULTI: Learn: 192.168.10.0/24 -> adn/client.public.ip:59142

Then I tried ping from LAN side to openvpn server (10.100.0.1) from two computers (.5 and .20 ) and log shows:

MULTI: Learn: 192.168.10.20 -> adn/client.public.ip:59142
MULTI: Learn: 192.168.10.5 -> adn/client.public.ip:59142

but ping times out.

Same from server side: if I ping to 192.169.10.90 (client A IP) but it also times out.

Any suggestion? Thanks in advance.

(I repost schema as I didn't notice spaces didn't work)

VPN Server (Windows server 2003) ----- Client A (W Server 2003) ----- LAN Computer B
Lan: 192.168.1.2/24 ------------------- 192.168.10.90/24 -------------192.168.10.20/24
GW: 192.168.1.1 -----------------------192.168.10.254 ---------------192.168.10.254
VPN: 10.100.0.1/24 --------------------10.100.0.200/24 --------------no vpn client

maikcat

remove topology subnet from your server config
and place the route directive as i gave you before,

now into ccd file client_a add

ifconfig-push 10.100.1.10 10.100.1.9

reconnect your client then check if he gets 10.100.1.10 ip
if not the ccd file is ignored...

Michael.

rafaurl

Hi! I removed topology subnet (server config is bellow) and added ifconfig-push 10.100.0.10 10.100.0.9 to client_a ccd file. Restarted both and client now takes 10.100.0.10, ping to .1 reply fine, but it didn't work yet from other computers in same lan. So ccd works but ping doesn't yet.

Thanks for your help 🙂

#server config
port 1194
proto udp
dev tun
persist-tun
persist-key

ca ca.crt
cert server.crt
key server.key
dh dh1024.pem

server 10.100.0.0 255.255.255.0
#topology subnet
route 192.168.10.0 255.255.255.0 10.100.0.1

client-config-dir ccd
client-to-client

keepalive 10 120
comp-lzo
user nobody
group nogroup
status openvpn-status.log
verb 3

Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.100.0.10/255.255.255.252 on interface {F1B19FAF-616D-45ED-A9AA-C20B357F9C0F} [DHCP-serv: 10.100.0.9, lease-time: 31536000]

rafaurl

ok, I suppose I made something wrong before, because I've tried again what you told me first and it works fine:

setting IPEnableRouter=1 in both and checking firewall if any.

#server without topology subnet:
server 10.100.0.0 255.255.255.0
route 192.168.10.0 255.255.255.0

ccd:
ifconfig-push 10.100.0.10 10.100.0.9
iroute 192.168.10.0 255.255.255.0

ping from 192.168.10.x computers to 10.100.0.1 reply ok, so I checked routing tables and I saw that there was a route to 10.100.0.0/24 gw 10.100.0.2 on interface 10.100.0.1 with metric 1 so I tried the following:

#server WITH topology subnet
server 10.100.0.0 255.255.255.0
topology subnet
route 192.168.10.0 255.255.255.0 10.100.0.2  
#adding above gw .2 instead of .1 is the key in order to make route works with topology subnet

ccd:
ifconfig-push 10.100.0.200 255.255.255.0
iroute 192.168.10.0 255.255.255.0

and it also works fine 🙂

thanks a million for your help!!