Setup description:
- One VPN server called vpn1
- One VPN client called vpn2
- One network behind vpn1 with IP addresses 10.0.0.0/24
- One network behind vpn2 with IP addresses 10.0.2.0/24
- For simplicity right now the VPN boxes are the default gateway for machines in their LANs
Server configuration: vpn1
mode server
tls-server
dev tun
local PUBLIC-IP-HERE
port 1194
proto udp
persist-key
persist-tun
# Certificates and encryption
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher BF-CBC
comp-lzo
push "route 10.0.0.0 255.255.255.0"
push "route 10.0.2.0 255.255.255.0"
push "route 10.255.254.0 255.255.255.0"
route 10.0.2.0 255.255.255.0
client-to-client
max-clients 30
user nobody
group nogroup
keepalive 10 120
status /var/log/openvpn-status.log
verb 3
ifconfig-pool-persist ipp.txt
client-config-dir ccd
server 10.255.254.0 255.255.255.0
push "explicit-exit-notify 3"
In ccd/client I have:
iroute 10.0.2.0 255.255.255.0
ifconfig-push 10.255.254.9 10.255.254.10
How "ip a" looks like:
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
inet 10.0.0.1/24 brd 10.0.0.255 scope global eth1
172: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
link/none
inet 10.255.254.1 peer 10.255.254.2/32 scope global tun0
How "ip r" looks like (I removed default route since it should not be important):
10.0.0.0/24 dev eth1 proto kernel scope link src 10.0.0.1
10.0.2.0/24 via 10.255.254.2 dev tun0
10.255.254.0/24 via 10.255.254.2 dev tun0
10.255.254.2 dev tun0 proto kernel scope link src 10.255.254.1
Client configuration: vpn2
client
dev tun
remote PUBLIC-IP-HERE 1194
nobind
persist-key
persist-tun
proto udp
ca /etc/openvpn/easy-rsa/keys/client/ca.crt
cert /etc/openvpn/easy-rsa/keys/client/client.crt
key /etc/openvpn/easy-rsa/keys/client/client.key
tls-auth /etc/openvpn/easy-rsa/keys/client/ta.key 1
cipher BF-CBC
comp-lzo
ns-cert-type server
verb 3
How "ip a" looks like:
7: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
inet 10.0.2.1/24 brd 10.0.2.255 scope global br0
8: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
link/none
inet 10.255.254.9 peer 10.255.254.10/32 scope global tun0
How "ip r" looks like (again I removed default gateway and related):
10.0.0.0/24 via 10.255.254.10 dev tun0
10.0.2.0/24 dev br0 proto kernel scope link src 10.0.2.1
10.255.254.0/24 via 10.255.254.10 dev tun0
10.255.254.10 dev tun0 proto kernel scope link src 10.255.254.9
General configurations:
- Iptables policy is allow for everything
- IP forwarding is enabled
- RP filter is disabled
What works:
- Ping from any host in lan1 to vpn2 ( 10.0.0.11 -> 10.255.254.9 )
- Ping from any host in lan2 to vpn1 ( 10.0.2.11 -> 10.255.254.1 )
- Ping from vpn1 to lan2 ( 10.255.254.1 -> any host in lan2 10.0.2.0/24 )
- Ping from vpn2 to lan1 ( 10.255.254.9 -> any host in lan2 10.0.0.0/24 )
What does not work:
- Ping from any host in lan1 to lan2
- Ping from any host in lan2 to lan1
With NAT I was able to:
- Ping from any host in lan1 to lan2
- But not from any host in lan2 to lan1But not from any host in lan2 to lan1
I should be able to ping any host in LAN2 from LAN1 without NAT and the other way around. What is wrong here? Something is escaping me and I can't figure out what.