I am trying to set up a Site-to-Site VPN using Openvpn , Initial setup has been completed , My openvpn Client side nodes (201.100.0.x) are able to communicate to the openvpn Server side nodes (192.0.0.x) .
But If I ping to any client node (188.8.131.52) from a server side node (184.108.40.206) , I am not getting reply , (I have proper route added on the endpoints) . And I can see the ping replays reaching up to my openvpn server by analysing with TCP dump .
Serverside node: 220.127.116.11 (eth0)
Server: 18.104.22.168 (eth0) ; 10.8.0.1 (tun0)
Clientside node : 22.214.171.124 (eth0)
OpenvpnClient :126.96.36.199 (eth0) ; 10.8.0.6 (tun0)
server node> ping 188.8.131.52 -c 1 PING 184.108.40.206 (220.127.116.11) 56(84) bytes of data. --- 18.104.22.168 ping statistics --- 1 packets transmitted, 0 received, 100% packet loss, time 10000ms
Here is the TCP dump form eth0 of openvpn server
vpnserver> tcpdump -nni eth0 icmp tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes 09:41:00.796021 IP 22.214.171.124 > 126.96.36.199: ICMP echo request, id 47432, seq 1, length 64 09:41:00.836637 IP 188.8.131.52 > 184.108.40.206: ICMP echo reply, id 47432, seq 1, length 64
Ping reply came back till 220.127.116.11 but it is not getting forwarded to 18.104.22.168 ; need to know why
IP forwarding already enabled And you can see existing firewall rules below
*filter :INPUT ACCEPT [397:39519] :FORWARD ACCEPT [6:504] :OUTPUT ACCEPT [362:40521] -A FORWARD -i tun0 -j ACCEPT -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i tun0 -o eth0 -j ACCEPT COMMIT # Completed on Thu Nov 3 09:45:05 2016 # Generated by iptables-save v1.4.7 on Thu Nov 3 09:45:05 2016 *nat :PREROUTING ACCEPT [31:3889] :POSTROUTING ACCEPT [22:1848] :OUTPUT ACCEPT [6:504] -A POSTROUTING -o eth0 -j MASQUERADE << before adding this rule client sides nodes were not able to access server side nodes COMMIT