Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running OpenVPN linking two linux machines on two networks. These machines are not the networks' gateways. There are also separate DD-WRT routers which are acting as the gateways on both networks.

I would like to use this setup to make both networks completely visible and usable to each other over the internet. What types of routes would I need to set up on each box/router to make this possible? Do I need to use any kind of iptables rules (not thinking I would).

Also, just couple points-

  • The link works fine between the two boxes. They are able to ping each other and transmit traffic.
  • I do not want any of the normal internet traffic passed across the VPN- only the traffic intended to go to the specific site.
  • The networks have separate IP ranges and both netmask 255.255.255.0

I'm stuck and I've tried adding all kinds of static routes on both my linux boxes and the routers and I can't seem to get anything pingable outside of the VPN link. Any help would be greatly appreciated!


UPDATE

I have added the routes on my VPN boxes and DD-WRT routers, but i'm not able to ping anything outside of the machines. I can ping 172.16.130.2 from the VPN client, and vice-versa I'm able to ping 172.16.120.2 from the VPN server, but still nothing else.

I have also enabled IP forwarding in the kernels of both VPN boxes.

Adding Current Routes:

VPN Server: nonpublished static IP eth0 / 172.16.130.2 eth1 / 10.9.8.1 tun0

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.9.8.2        *               255.255.255.255 UH    0      0        0 tun0
24.249.108.192  *               255.255.255.224 U     0      0        0 eth0
172.16.130.0    172.16.130.1    255.255.255.0   UG    0      0        0 eth1
172.16.130.0    *               255.255.255.0   U     0      0        0 eth1
172.16.120.0    10.9.8.2        255.255.255.0   UG    0      0        0 tun0
default         wsip-24-249-108 0.0.0.0         UG    0      0        0 eth0

VPN Client: 172.16.120.2 eth0 / 10.9.8.2 tun0

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.9.8.1        *               255.255.255.255 UH    0      0        0 tun0
172.16.130.0    10.9.8.1        255.255.255.0   UG    0      0        0 tun0
172.16.120.0    *               255.255.255.0   U     0      0        0 eth0
default         munch-router    0.0.0.0         UG    0      0        0 eth0
share|improve this question
    
Trying to solve a similar problem I've found a link that I hope it help you: community.openvpn.net/openvpn/wiki/BridgingAndRouting Take a look at the end:Using routing and OpenVPN not running on the default gateway –  sebelk Oct 23 '12 at 22:40
add comment

1 Answer 1

up vote 3 down vote accepted

You will need to add routes to the DD-WRT boxes for the opposite VPN segment pointing at the linux VPN 'gateways'. You will also need routes on those VPN gateways to the other site via the tap/tun interface to the other site.

DD_WRT_SITE_A# route add SITEB/24 gw SITEA_VPN_GATEWAY_IP
VPN_GATEWAY_SITE_A# route add SITEB/24 gw tap_ip_of_SITE_B_VPN_GATEWAY

DD_WRT_SITE_B# route add SITEA/24 gw SITEB_VPN_GATEWAY_IP
VPN_GATEWAY_SITE_B# route add SITEA/24 gw tap_ip_of_SITE_A_VPN_GATEWAY

Unless you've already done so you will also need to enable routing on the new linux VPN gateway boxes:

http://www.ducea.com/2006/08/01/how-to-enable-ip-forwarding-in-linux/

# sysctl -w net.ipv4.ip_forward=1
share|improve this answer
    
Ah- I think maybe the IP forwarding could be the culprit... I am trying that now! –  muncherelli Aug 29 '11 at 1:56
    
Still no dice. I have added my routes above if those help at all. I can now ping the internal LAN addresses of the VPN boxes across the internet, but nothing outside of the machines. –  muncherelli Aug 29 '11 at 2:22
    
But not the DD-WRT boxes? If you can't ping the DD-WRT box in SITE B from the VPN gateway in SITE A something is still broken in the routing or firewall setup (most likely on the DD-WRT side). The best next step is to get out tcpdump on the LAN interface of SITE B's VPN gateway and see if you see ping packets leaving for the DD-WRT and if you see no response try testing from the DD-WRT next. –  polynomial Aug 29 '11 at 2:29
    
I should also add I'm not sure if you can do that with tun interfaces, I've only done this using taps with openvpn. –  polynomial Aug 29 '11 at 2:32
    
Well I am 98% there. It looks like I am able to hit everything on both networks from any PC except for on the actual VPN routers. The VPN routers can only see the other respective internal IP address, but not anything else within the other networks. –  muncherelli Aug 29 '11 at 3:35
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.