I have an OpenVPN server with the network 172.24.24.0/29 (IP: 172.24.24.1). A Raspberry (172.24.24.2) is connected to this OpenVPN server.
The Raspberry has access to my local network 192.168.2.0/24 and should allow the OpenVPN server access to this network via NAT.
Kernel forwarding is enabled on both.
- Ping from OpenVPN server to Raspberry works vice versa
- Ping from Raspberry to local LAN works vice versa
- Ping from OpenVPN server to local LAN does not work
OpenVPN server:
[root@openvpn ~]# ip route
172.24.24.0/29 dev tun1 proto kernel scope link src 172.24.24.1
192.168.2.0/24 via 172.24.24.2 dev tun1
[root@openvpn ~]# ip route get 192.168.2.101
192.168.2.101 via 172.24.24.2 dev tun1 src 172.24.24.1
Ping 192.168.2.101 from OpenVPN server.
On the Raspberry, however, no packets are displayed at the interface with tcpdump. But tcpdump displays the outgoing packets:
[root@openvpn ~]# tcpdump -ni tun1 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun1, link-type RAW (Raw IP), capture size 65535 bytes
20:10:00.610156 IP 172.24.24.1 > 192.168.2.101: ICMP echo request, id 3413, seq 1, length 64
20:10:01.616216 IP 172.24.24.1 > 192.168.2.101: ICMP echo request, id 3413, seq 2, length 64
Raspberry
- VPN-IP: 172.24.24.2 (tun0)
- Local LAN: 192.168.2.101 (eth0)
iptables: (policy ACCEPT for all chains)
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 172.24.24.0/29 -j ACCEPT
-A FORWARD -s 192.168.2.0/24 -j ACCEPT
-A POSTROUTING -o eth0 -j MASQUERADE
Routing table
default via 192.168.2.1 dev eth0
172.24.24.0/29 dev tun0 proto kernel scope link src 172.24.24.2
192.168.2.0/24 dev eth0 proto kernel scope link src 192.168.2.101
I initially thought that it is due to an iptables rule or to the NAT. That no packages arrive at the tun0 interface of the Raspberry I find very unusual and guess there the mistake.
Where could the mistake be in this setup? I really appreciate any help you can provide.
