I'm trying to setup OpenVPN between a private network and home clients that connect to it. (The clients don't need to connect to each other). The network topology is a little interesting. There is a public/University network on 10.7.42.0/24. We have some IPs on that network that have public ports forwarded to them, but we're limited on those so we're putting a lot on a private network at 192.168.203.0/24. All machines have at least a private IP and some have both public and private IPs (two adapters. This is all done in VMs but it's like there are two physically separate networks)
The OpenVPN server is also the gateway between the public/private networks. It has a 10.7.42.x address, a default gateway of 10.7.42.1 (university gateway), it masquerades/IP forwards any-to-any, and it has an internal address of 192.168.203.1. It successfully works for NAT/gateway.
My open VPN Server config looks like this:
local 10.42.7.226 port 443 proto tcp dev tun ca /etc/openvpn/easy-rsa-2.0/keys/ca.crt cert /etc/openvpn/easy-rsa-2.0/keys/server.crt key /etc/openvpn/easy-rsa-2.0/keys/server.key # This file should be kept secret dh /etc/openvpn/easy-rsa-2.0/keys/dh1024.pem server 192.168.137.0 255.255.255.0 ifconfig-pool-persist /etc/openvpn/ipp.txt route 192.168.203.0 255.255.255.0 push "route 192.168.203.0 255.255.255.0" push "dhcp-option DNS 192.168.203.100" keepalive 10 120 cipher BF-CBC # Blowfish (default) comp-lzo plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-pam.so login client-cert-not-required username-as-common-name max-clients 201 user nobody group nobody persist-key persist-tun status /var/log/openvpn-status.log log-append /var/log/openvpn.log
The ifconfig looks like this:
eth0 Link encap:Ethernet HWaddr XX:XX:XX:XX:XX:XX inet addr:192.168.203.1 Bcast:192.168.203.255 Mask:255.255.255.0 inet6 addr: fe80::8c2c:6bff:fe5b:5406/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:183488 errors:0 dropped:4 overruns:0 frame:0 TX packets:198145 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:15024794 (14.3 Mb) TX bytes:186885934 (178.2 Mb) Interrupt:32 Base address:0xa000 eth1 Link encap:Ethernet HWaddr XX:XX:XX:XX:XX:XX inet addr:10.42.7.226 Bcast:10.42.7.255 Mask:255.255.255.0 inet6 addr: fe80::a011:59ff:fe3e:c3aa/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:436236 errors:0 dropped:99041 overruns:0 frame:0 TX packets:202673 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:239838327 (228.7 Mb) TX bytes:20537299 (19.5 Mb) Interrupt:36 Base address:0xe100 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:2 errors:0 dropped:0 overruns:0 frame:0 TX packets:2 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:100 (100.0 b) TX bytes:100 (100.0 b) tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:192.168.137.1 P-t-P:192.168.173.2 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:631 errors:0 dropped:0 overruns:0 frame:0 TX packets:88 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:48118 (46.9 Kb) TX bytes:13725 (13.4 Kb)
My routes look like this:
192.168.137.2 * 255.255.255.255 UH 0 0 0 tun0 10.42.7.0 * 255.255.255.0 U 0 0 0 eth1 192.168.203.0 * 255.255.255.0 U 0 0 0 eth0 192.168.137.0 192.168.137.2 255.255.255.0 UG 0 0 0 tun0 link-local * 255.255.0.0 U 0 0 0 eth0 loopback * 255.0.0.0 U 0 0 0 lo default 10.42.7.1 0.0.0.0 UG 0 0 0 eth1
The client looks like this:
dev tun remote vpn.mydomain.com ca ca.crt client port 443 proto tcp tls-client auth-user-pass comp-lzo ping 15 verb 9 log-append /tmp/openvpn.log
The problem is I can only get to the OpenVPN server if I ssh to 192.168.137.1. I can't connect to any of the 192.168.203.0/24 addresses. If I do a trace route, it only goes one hop, and it takes 30 seconds to do that across the VPN to the remote tun adapter.
The private machines use the 192.168.203.1 (OpenVPN server) as their gateway, so the packets should make their way back fine for at least those machines (really they would be NATed on their way out, so it should make it to machines with both public and private adapters too)
I've set these OpenVPN networks up before and I know I've run into this exact problem before, but I can't remember the solution.