Using OpenVPN on Two Linux Machines *not on the gateways* to link the networks over the internet

Question

I am running OpenVPN linking two linux machines on two networks. These machines are not the networks' gateways. There are also separate DD-WRT routers which are acting as the gateways on both networks.

I would like to use this setup to make both networks completely visible and usable to each other over the internet. What types of routes would I need to set up on each box/router to make this possible? Do I need to use any kind of iptables rules (not thinking I would).

Also, just couple points-

• The link works fine between the two boxes. They are able to ping each other and transmit traffic.
• I do not want any of the normal internet traffic passed across the VPN- only the traffic intended to go to the specific site.
• The networks have separate IP ranges and both netmask 255.255.255.0

I'm stuck and I've tried adding all kinds of static routes on both my linux boxes and the routers and I can't seem to get anything pingable outside of the VPN link. Any help would be greatly appreciated!

---

UPDATE

I have added the routes on my VPN boxes and DD-WRT routers, but i'm not able to ping anything outside of the machines. I can ping 172.16.130.2 from the VPN client, and vice-versa I'm able to ping 172.16.120.2 from the VPN server, but still nothing else.

I have also enabled IP forwarding in the kernels of both VPN boxes.

Adding Current Routes:

VPN Server: nonpublished static IP eth0 / 172.16.130.2 eth1 / 10.9.8.1 tun0

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.9.8.2        *               255.255.255.255 UH    0      0        0 tun0
24.249.108.192  *               255.255.255.224 U     0      0        0 eth0
172.16.130.0    172.16.130.1    255.255.255.0   UG    0      0        0 eth1
172.16.130.0    *               255.255.255.0   U     0      0        0 eth1
172.16.120.0    10.9.8.2        255.255.255.0   UG    0      0        0 tun0
default         wsip-24-249-108 0.0.0.0         UG    0      0        0 eth0

VPN Client: 172.16.120.2 eth0 / 10.9.8.2 tun0

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.9.8.1        *               255.255.255.255 UH    0      0        0 tun0
172.16.130.0    10.9.8.1        255.255.255.0   UG    0      0        0 tun0
172.16.120.0    *               255.255.255.0   U     0      0        0 eth0
default         munch-router    0.0.0.0         UG    0      0        0 eth0

Answer 1

You will need to add routes to the DD-WRT boxes for the opposite VPN segment pointing at the linux VPN 'gateways'. You will also need routes on those VPN gateways to the other site via the tap/tun interface to the other site.

DD_WRT_SITE_A# route add SITEB/24 gw SITEA_VPN_GATEWAY_IP
VPN_GATEWAY_SITE_A# route add SITEB/24 gw tap_ip_of_SITE_B_VPN_GATEWAY

DD_WRT_SITE_B# route add SITEA/24 gw SITEB_VPN_GATEWAY_IP
VPN_GATEWAY_SITE_B# route add SITEA/24 gw tap_ip_of_SITE_A_VPN_GATEWAY

Unless you've already done so you will also need to enable routing on the new linux VPN gateway boxes:

http://www.ducea.com/2006/08/01/how-to-enable-ip-forwarding-in-linux/

# sysctl -w net.ipv4.ip_forward=1