Routing in OpenVPN between a private network and a client

Question

I'm trying to setup OpenVPN between a private network and home clients that connect to it. (The clients don't need to connect to each other). The network topology is a little interesting. There is a public/University network on 10.7.42.0/24. We have some IPs on that network that have public ports forwarded to them, but we're limited on those so we're putting a lot on a private network at 192.168.203.0/24. All machines have at least a private IP and some have both public and private IPs (two adapters. This is all done in VMs but it's like there are two physically separate networks)

The OpenVPN server is also the gateway between the public/private networks. It has a 10.7.42.x address, a default gateway of 10.7.42.1 (university gateway), it masquerades/IP forwards any-to-any, and it has an internal address of 192.168.203.1. It successfully works for NAT/gateway.

My open VPN Server config looks like this:

local 10.42.7.226
port 443
proto tcp
dev tun
ca /etc/openvpn/easy-rsa-2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa-2.0/keys/server.crt
key /etc/openvpn/easy-rsa-2.0/keys/server.key  # This file should be kept secret
dh /etc/openvpn/easy-rsa-2.0/keys/dh1024.pem
server 192.168.137.0 255.255.255.0

ifconfig-pool-persist /etc/openvpn/ipp.txt

route 192.168.203.0 255.255.255.0
push "route 192.168.203.0 255.255.255.0"

push "dhcp-option DNS 192.168.203.100"

keepalive 10 120

cipher BF-CBC        # Blowfish (default)


comp-lzo

plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-pam.so login
client-cert-not-required
username-as-common-name

max-clients 201

user nobody
group nobody

persist-key
persist-tun

status /var/log/openvpn-status.log

log-append  /var/log/openvpn.log

The ifconfig looks like this:

eth0      Link encap:Ethernet  HWaddr XX:XX:XX:XX:XX:XX  
          inet addr:192.168.203.1  Bcast:192.168.203.255  Mask:255.255.255.0
          inet6 addr: fe80::8c2c:6bff:fe5b:5406/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:183488 errors:0 dropped:4 overruns:0 frame:0
          TX packets:198145 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:15024794 (14.3 Mb)  TX bytes:186885934 (178.2 Mb)
          Interrupt:32 Base address:0xa000 

eth1      Link encap:Ethernet  HWaddr XX:XX:XX:XX:XX:XX  
          inet addr:10.42.7.226  Bcast:10.42.7.255  Mask:255.255.255.0
          inet6 addr: fe80::a011:59ff:fe3e:c3aa/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:436236 errors:0 dropped:99041 overruns:0 frame:0
          TX packets:202673 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:239838327 (228.7 Mb)  TX bytes:20537299 (19.5 Mb)
          Interrupt:36 Base address:0xe100 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:2 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:100 (100.0 b)  TX bytes:100 (100.0 b)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:192.168.137.1  P-t-P:192.168.173.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:631 errors:0 dropped:0 overruns:0 frame:0
          TX packets:88 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:48118 (46.9 Kb)  TX bytes:13725 (13.4 Kb)

My routes look like this:

192.168.137.2     *               255.255.255.255 UH    0      0        0 tun0
10.42.7.0       *               255.255.255.0   U     0      0        0 eth1
192.168.203.0   *               255.255.255.0   U     0      0        0 eth0
192.168.137.0     192.168.137.2     255.255.255.0   UG    0      0        0 tun0
link-local      *               255.255.0.0     U     0      0        0 eth0
loopback        *               255.0.0.0       U     0      0        0 lo
default         10.42.7.1       0.0.0.0         UG    0      0        0 eth1

The client looks like this:

dev tun
remote vpn.mydomain.com
ca ca.crt

client
port 443
proto tcp
tls-client
auth-user-pass

comp-lzo

ping 15
verb 9
log-append  /tmp/openvpn.log 

The problem is I can only get to the OpenVPN server if I ssh to 192.168.137.1. I can't connect to any of the 192.168.203.0/24 addresses. If I do a trace route, it only goes one hop, and it takes 30 seconds to do that across the VPN to the remote tun adapter.

The private machines use the 192.168.203.1 (OpenVPN server) as their gateway, so the packets should make their way back fine for at least those machines (really they would be NATed on their way out, so it should make it to machines with both public and private adapters too)

I've set these OpenVPN networks up before and I know I've run into this exact problem before, but I can't remember the solution.

Answer 1

I found the issue. It was my Firewall. If I disabled the firewall and manually put in the rules I needed with iptables, it works fine. (The #1 issue people have with OpenVPN is usually firewall based according to the #openvpn chatroom on freenode.net). Then I adjusted the firewall scripts to allow my tun0 traffic and restarted it.