Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have the following situation. I have a root server, which acts as a VPN server for my company network and as a VPN client to multiple customer-networks. Every seperate connection works (I can ping anyone from my root server, and my root server can be pinged from the corresponding networks).

But now I want the clients in my company network to be able to access all the customers computers, but the customers shouldn't be able to access me and each other. Is that possible?

Example:

  • My PC has the IP 10.8.0.11 and is in the net 10.8.0.0/24.
  • My customers server has the IP 10.9.0.11 and is in the net 10.9.0.0/24.

My PC now has the following entry in the routing table:

10.9.0.0 255.255.255.0 10.8.0.1 [...]

And my root server (10.8.0.1) has the following entry:

10.9.0.0 255.255.255.0 10.9.0.1 [...]

The customers VPN server (10.9.0.1) knows nothing about my net. I can ping everyone on my root-server, and everyone can ping my root server (with the according address). But my PC cannot reach my customers server. I have routing installed on my root server (Windows Server 2008 R2) and it is up and running.

What do I need to do to make this work?

share|improve this question
    
From where comes your route 10.9.0.0 255.255.255.0 10.8.0.1 on your PC ? did you setup it by yourself ? seems it is not a valid route because the gateway for subnet 10.9.0.0/24 seems to be 10.9.0.1 –  krisFR Dec 23 '13 at 23:25
    
It comes from OpenVPN push "route 10.9.0.0 255.255.255.0" in the server config. Shouldn't 10.8.0.1 be the gateway for the 10.9.0.0 network, for computers in the 10.8.0.0 network? –  LueTm Dec 23 '13 at 23:28
    
No, to me gateway for 10.9.0.0/24 network should be 10.9.0.1...try this...or ask you this question : is gateway 10.8.0.1 able to route 10.9.0.0/24 subnet (have a look at the routing table of gateway 10.8.0.1) ? –  krisFR Dec 23 '13 at 23:31
    
Yes, 10.8.0.1 is a root server, which has routing installed and should route those two networks. Let me try the other gatweway. –  LueTm Dec 23 '13 at 23:35
    
No, that doens't work either. –  LueTm Dec 23 '13 at 23:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.