I'm fighting with an openVPN setup for connecting two sites. This is what the scenario looks like
Office 1 (server):
- local network: 192.168.178.0/24
- openvpn server public ip: 192.168.178.2 on br0
- openvpn server internal ip: 192.168.0.1 on tun0
Office 2 (client):
- local network: 192.168.177.0/24
- openvpn client public ip: 192.168.177.2 on p2p1
openvpn client internal ip: 192.168.0.6 on tun0
openvpn internal network: 192.168.0.0/24
Both, the client and the server are behind NAT routers with dynamically assigned IP adresses.
Basically, the involved machines in either office are supposed to "see" each other. After setting up the tunnel and properly configuring the routing tables at both sites, regular hosts on both networks can ping everything on those two networks. Good so far.
However, the endpoints can only see each other, but none of the hosts on their respective far end network. For instance if do a
ping 192.168.178.2
from the VPN endpoint 192.168.177.2, it works just fine, any other address won't work; the hosts will not reply.
Now have a look at the output of tcpdump, when I ping another address, e.g. 192.168.178.3.
11:11:28.104640 IP 192.168.0.6 > 192.168.178.3: ICMP echo request, id 2130, seq 1, length 64
The source IP does not seem quite right. It belongs to OpenVPN's internal net and I get no ICMP reply.
Things start to work when I explicitly instruct ping to use the proper source IP:
ping 192.168.178.3 -I 192.168.177.2
Now, the output of tcpdump is ok, too:
11:20:08.266271 IP 192.168.177.2 > 192.168.178.3: ICMP echo request, id 7883, seq 17, length 64 11:20:08.316037 IP 192.168.178.3 > 192.168.177.2: ICMP echo reply, id 7883, seq 17, length 64
Looking at the critical entry in the client's routing table it's kinda obvious that the source address is from the internal network:
default via 192.168.177.1 dev p2p1 192.168.0.1 via 192.168.0.5 dev tun0 192.168.0.5 dev tun0 proto kernel scope link src 192.168.0.6 192.168.177.0/24 dev p2p1 proto kernel scope link src 192.168.177.2 192.168.178.0/24 via 192.168.0.5 dev tun0
Is there a possibility to make OpenVPN create that entry with an appropriate src ??
Here are my openVPN config files. I'll skip the TLS parts, since the tunnel itself works as expected.
Server at office 1:
local 192.168.178.2 server 192.168.0.0 255.255.255.0 proto tcp-server port 1194 dev tun mssfix user nobody group nogroup keepalive 20 120 ping-timer-rem persist-tun persist-key float comp-lzo push "comp-lzo" push "route 192.168.178.0 255.255.255.0" route 192.168.177.0 255.255.255.0 client-config-dir client-configs
There is one client config, that looks like that:
iroute 192.168.177.0 255.255.255.0 push "route 192.168.178.0 255.255.255.0 vpn_gateway"
Client at Office 2:
client dev tun0 remote <server address> proto tcp-client port 1194 connect-retry 15 comp-lzo user nobody group nogroup persist-tun persist-key
I'm really at a loss here... your help is very much appreciated.