0

I have two networks which I want to connect by an openvpn tunnel (per tun-device).

Server-side network is 10.10.7.0/24,
The vpn gateway runs on a VM with the IP 10.10.7.12,
The vpn tunnel on the vpn gateway side has the IP 10.10.9.1(tun0)
The router is a cable router with IP 10.10.7.1.
The router has a route entry 10.10.10.0/24 to 10.10.7.12
The router does port forwarding from 1194 to 10.10.7.12:1194

Client-side network is 10.10.10.0/24.
The client-side router is a debian raspberry with IP 10.10.10.1
It is connect to a foreign wlan (wlan0) with an IP from a pool (192.168.0.xx)
Clients are (not yet) connected via ethernet (eth0)
The vpn tunnel has the IP 10.10.9.2

I established the vpn connection and now would like to route between the nets.
On the client side I added a route by "route add -net 10.10.7.0/24 tun0"
on the server side I added a route by "route add -net 10.10.10.0/24 tun0"
The firewall on the server side is all set to ACCEPT.
I have no masquerading or snat configured and I do not want to as I run a service that gets confused when the sender IP in the TCP packet is different than the sender IP it gets in the payload.
Other internet connections should not route through the tunnel.

Now I can ping from the client gateway to server and into the net beyond. http works, too. However, I cannot ping from server to the client gateway nor access any services (like [email protected]). What am I missing?

Thank you for your help.

Improve this question
2
  • Please clarify (with sample machine names/numbers) which machines are connected with OpenVPN, which are distinct machines on the two networks, and on which machine your NTP service is to be found. Also indicate whether or not the two OpenVPN-connected machines are also listed as default gateways for their respective networks. Please update your question with this information as if you'd provided it originally (ie do not just add a section called "edit" or "update"), and then I can delete this comment.
    – Chris Davies
    Commented Oct 19, 2017 at 21:18
  • Please edit question with output of ip route and ip route get 10.10.10.9 on the server. If there's nothing suspicious in it, add output of ip rule, too.
    – dirkt
    Commented Oct 23, 2017 at 20:32

1 Answer 1

Reset to default
1

"route add -net 10.10.10.0/24 tun0" sends the traffic to openvpn but you haven't told the openvpn server which client to send it to.

To do this we need to use an iroute directive

iroute 10.10.10.0 255.255.255.0

This should be placed in /etc/openvpn/ccd/<cn> on the server (replace <cn> with the common name on the client's certificate)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .