I have setup a OpenVPN server on a server in the office for people to VPN into. They can hit any host on the office network just fine but if they try to access our datacenter on another subnet nothing happens. I believe it is on the access-list of the cisco router but cannot figure it out.
Office LAN: 192.168.71.0/24
DataCenter Lan: 192.168.100.0/24
OpenVPN Server: 192.168.71.15
VPN LAN: 192.168.61.0/24
Office Router IP: 192.168.71.1
So when a client is connected their routing table looks like
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.61.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.61.1 192.168.61.5 255.255.255.255 UGH 0 0 0 tun0
192.168.100.0 192.168.61.5 255.255.255.0 UG 0 0 0 tun0
192.168.71.0 192.168.61.5 255.255.255.0 UG 0 0 0 tun0
192.168.1.0 0.0.0.0 255.255.255.0 U 2 0 0 wlan0
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 wlan0
A traceroute to the datacenter looks like
traceroute to 192.168.100.52 (192.168.100.52), 30 hops max, 60 byte packets
1 192.168.61.1 (192.168.61.1) 18.851 ms 39.294 ms 39.297 ms
2 192.168.71.1 (192.168.71.1) 39.287 ms 39.278 ms 39.269 ms
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
Here is the route table on the openvpn server
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.61.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.71.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.61.0 192.168.61.2 255.255.255.0 UG 0 0 0 tun0
192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
0.0.0.0 192.168.71.1 0.0.0.0 UG 0 0 0 eth0
0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 eth0
So the packet seems to me to be making it to the office router
Here is my route config for the cisco router
ip route 0.0.0.0 0.0.0.0 216.173.2.217
ip route 10.1.168.0 255.255.255.0 192.168.71.5
ip route 10.100.1.0 255.255.255.0 192.168.72.5
ip route 192.168.61.0 255.255.255.0 192.168.71.15
And here is my access-list
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 192.168.71.0 0.0.0.255
access-list 23 permit 10.10.10.0 0.0.0.7
access-list 100 remark CCP_ACL Category=4
access-list 100 permit ip 192.168.0.0 0.0.255.255 any
access-list 101 deny ip any 192.168.0.0 0.0.255.255
access-list 101 deny ip any 172.16.0.0 0.15.255.255
access-list 101 deny ip any 10.0.0.0 0.255.255.255
access-list 101 permit ip 192.168.71.0 0.0.0.255 any
access-list 102 remark CCP_ACL Category=4
access-list 102 permit ip 192.168.71.0 0.0.0.255 any
access-list 103 remark CCP_ACL Category=4
access-list 103 permit ip 192.168.71.0 0.0.0.255 any
access-list 103 permit ip 192.168.100.0 0.0.0.255 any
access-list 120 permit ip 192.168.71.0 0.0.0.255 192.168.100.0 0.0.0.255
access-list 701 deny 0007.e917.876f 0000.0000.0000
Any help or pointers?