[SOLVED] access server from lan behind client in routing

rafaurl

regarding problem explained in https://forums.openvpn.net/topic9798.html, I said it worked because I can ping to openvpn server from any computer in LAN behind client A. ok, it works fine, but the main purpose was to ping another vpn clients (e.g.: 10.100.0.208), so I added to this vpn clients in ccd:

route 192.168.10.0 255.255.255.0

but ping from 192.168.10.20 to 10.100.0.208 didn't work (whereas ping to 10.100.0.1 works ok). any suggestion? thanks in advance

janjust

from where to where you trying to ping? which network is 192.168.10.0/24 ? the VPN network seems to be 10.100.0.0/24 ; which IP is trying to which IP?

rafaurl

I solved the problem, but anyway I will explain so it could help anybody. Networks are:

VPN Server (Windows server 2003) ----- Client A (W Server 2003) ----- LAN Computer B
Lan: 192.168.1.2/24 ------------------- 192.168.10.90/24 -------------192.168.10.20/24
GW: 192.168.1.1 -----------------------192.168.10.254 ---------------192.168.10.254
VPN: 10.100.0.1/24 --------------------10.100.0.200/24 --------------no vpn client
|
|Client C (W Server 2003)
lan: 192.168.0.208
gw: 192.168.0.1
vpn: 10.100.0.208

We need to access from computer B (it's a computer in same LAN than Client A) to Client C. By following Maikat suggestions we can access from computer B to VPN Server (routing 10.100.0.0/24 through 192.168.10.90 in Computer B, setting IPEnableRouter=1 in all of the VPN client and server and adding a route in server and iroute in Client A ccd). I thought that enabling "client-to-client" in setup would be enough for givin access from Computer B to Client C, but forgot routing from client C to computer B. I just added in Client C ccd the following route:

route 192.168.10.0 255.255.255.0

and everything works fine now 🙂 thanks for your attention!

#server
port 1194
proto udp
dev tun
persist-tun
persist-key

ca ca.crt
cert HRoldanCA.crt
key HRoldanCA.key
dh dh1024.pem

server 10.100.0.0 255.255.255.0
topology subnet

route 192.168.10.0 255.255.255.0 10.100.0.2 #remove gw if "topology subnet" is not defined

client-config-dir ccd
client-to-client

route-method exe
route-delay 0 5

keepalive 10 120
comp-lzo
user nobody
group nogroup
status openvpn-status.log
verb 3

#client A ccd
ifconfig-push 10.100.0.200 255.255.255.0
iroute 192.168.10.0 255.255.255.0

#client C ccd
ifconfig-push 10.100.0.208 255.255.255.0
route 192.168.10.0 255.255.255.0  #route to LAN begind client A

#Client A
client
dev tun
remote x.x.x.x 1194
proto udp 

ca roldan_ca.crt 
cert roldan_adncentral.crt 
key roldan_adncentral.key 

ns-cert-type server

resolv-retry infinite
comp-lzo

script-security 2
route-method exe
route-delay 0 5

dhcp-renew
dhcp-release

#Client C
client
dev tun
remote x.x.x.x 1194
proto udp 

ca roldan_ca.crt 
cert roldan_tienda08.crt 
key roldan_tienda08.key 

ns-cert-type server

resolv-retry infinite
comp-lzo

script-security 2
route-method exe
route-delay 0 5

dhcp-renew
dhcp-release

janjust

Excellent. Closing topic.