Can only ping OpenVPN server, not other guests (host-only network) on VPN network

Question

I installed OpenVPN server successfully on a server (X.X.X.X/32). Here is my OpenVPN config file:

port 1194
proto udp6
dev tun

ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh.pem
crl-verify /etc/openvpn/keys
crl-verify /etc/openvpn/keys/ca-crl.pem
tls-auth /etc/openvpn/keys/ta.key 0
tls-server
auth SHA256
cipher AES-256-CBC
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384:TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA384:TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256

server 10.109.0.0 255.255.0.0
ifconfig-pool-persist ipp.txt

push "route 192.168.59.0 255.255.255.0"
keepalive 5 30
compress lzo
persist-key
persist-tun
user nobody
group nogroup


status openvpn-status.log
status-version 1
log-append /var/log/openvpn.log
verb 3

On that server (X.X.X.X/32) I have a vagrant machine running in (host-only network) private network (vm.network 'private_network') with ip 192.168.59.2.

After connecting to OpenVPN from my localhost I would like to ping 192.168.59.2. I can only ping 192.168.59.1. As you can see Vagrant private network, and OpenVPN network is different. Please somebody can help with this issue? I'm also attaching my ovpn (snippet) file:

tls-client
auth SHA256
cipher AES-256-CBC
remote-cert-tls server
tls-version-min 1.2

proto udp
remote X.X.X.X 1194
dev tun
resolv-retry 5
nobind
keepalive 5 30
compress lzo
persist-key
persist-tun
verb 3
route-method exe
route-delay 2
key-direction 1

EDIT1: I'm using 192.168.59.2 because vagrant shows a warning for vagrant up:

guest: You assigned a static IP ending in ".1" to this machine. ==> guest: This is very often used by the router and can cause the ==> guest: network to not work properly. If the network doesn't work ==> guest: properly, try changing this IP.

route -n output on Vagrant machine:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.0.2.2        0.0.0.0         UG    100    0        0 enp0s3
10.0.2.0        0.0.0.0         255.255.255.0   U     0      0        0 enp0s3
10.0.2.2        0.0.0.0         255.255.255.255 UH    100    0        0 enp0s3
172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 docker0
192.168.59.0    0.0.0.0         255.255.255.0   U     0      0        0 enp0s8

EDIT2: Vagrant's machine ip changed to 192.168.59.1. I also added the following line to ovpn file: route 192.168.59.0 255.255.255.0 From localhost I can now ping 192.168.59.1 after connecting to vpn, but I'm still unable to ping 192.168.59.2.

Answer 1

Ok, I found a solution. My vagrant machine (virtualbox provider) is located on private network with ip 192.168.59.2, on server (X.X.X.X/32).

If I would like to ping 192.168.59.2 from my localhost, after connecting to vpn, I need to execute the following command inside of the vagrant machine first:

ip route add 10.109.0.0/16 via 192.168.59.1 dev <VARGRANT_NETWORK_INTERFACE>

Where:

• 10.109.0.0 = openvpn network
• 192.168.59.1 = vboxnet* ip
• VARGRANT_NETWORK_INTERFACE = in my case it was enp0s8

Answer 2

You need to enable IP forwarding (routing) on your VPN server host, if you want your VPN to communicate with other hosts through the VPN server host:

sysctl -w net.ipv4.ip_forward=1

See this answer.