Network topology is like this:
Private IP (eth0): 10.0.4.23/16 Public IP (eth1): 220.127.116.11/24 Routes: default via 18.104.22.168 10.0.0.0/16 (not routable, so no gateway) 10.8.0.0/16 via 10.0.0.65
On same private subnet we have dedicated addresses in range of 10.0.13.0/24 network for clients connected via OpenVPN. So clients see the OpenVPN Server address as 10.0.13.1 as a gateway.
Public IP: 22.214.171.124
Currently, when Client connects to VPN Server, it cannot see subnets in private range. So I've added routes to those networks using OpenVPN Servers tun0 IP (10.0.13.1)
ip r add 10.0.0.0/16 via 10.0.13.1 ip r add 10.8.0.0/16 via 10.0.13.1
It doesn't work. So I've added POSTROUTING iptables rule on OpenVPN Server
iptables -A POSTROUTING -s 10.0.13.0/24 -o eth0 -j MASQUERADE
At that point it worked. But, the problem is, when i connect to a server in that private subnet, for example
10.0.4.20, that server will see originating IP address as OpenVPN Private address
Currently we have Microsoft VPN established and when we use that, all servers can see clients IP addresses that are assigned to by VPN, so it can be done (maybe) but I'm not sure where i got it wrong.
This is OpenVPN Server config file, comments stripped for readers convenience.
port 1194 proto udp dev tun user nobody group nobody persist-key persist-tun keepalive 10 120 topology subnet server 10.0.13.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "dhcp-option DNS 10.0.0.1" push "dhcp-option DNS 10.0.0.2" push "route 10.0.0.0 255.255.0.0" push "route 10.8.0.0 255.255.0.0" dh none ecdh-curve prime256v1 tls-crypt tls-crypt.key 0 crl-verify crl.pem ca ca.crt cert server_oy94rAaIiMtrnvAB.crt key server_oy94rAaIiMtrnvAB.key auth SHA256 cipher AES-128-GCM ncp-ciphers AES-128-GCM tls-server tls-version-min 1.2 tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 status /var/log/openvpn/status.log log /var/log/openvpn/openvpn.log verb 3 plugin /opt/openvpn-ldap-auth/lib/openvpn-auth-ldap.so /etc/openvpn/auth/ldap.conf client-cert-not-required
I've tried setting
server 10.0.13.0 255.255.255.0 to
server 10.0.13.0 255.255.0.0 as that should be the network, but OpenVPN server doesn't like that config and don't want to start if first octet in subnet is not
So to make it simple: How do i make some server that is on 10.0.0.0/16 network, reach VPN Client that is on 10.0.13.0/24. Or better yet, how do i make OpenVPN Server assign to clients IP addresses in range of 10.0.13.0/24 but actually make them belong to 10.0.0.0/16? Do i maybe need a separate DHCP Server on same server?