I have an OpenVPN server with the network 172.24.24.0/29 (IP: 172.24.24.1). A Raspberry (172.24.24.2) is connected to this OpenVPN server.
The Raspberry has access to my local network 192.168.2.0/24 and should allow the OpenVPN server access to this network via NAT.
Kernel forwarding is enabled on both.
- Ping from OpenVPN server to Raspberry works vice versa
- Ping from Raspberry to local LAN works vice versa
- Ping from OpenVPN server to local LAN does not work
OpenVPN server:
[root@openvpn ~]# ip route
172.24.24.0/29 dev tun1 proto kernel scope link src 172.24.24.1
192.168.2.0/24 via 172.24.24.2 dev tun1
[root@openvpn ~]# ip route get 192.168.2.101
192.168.2.101 via 172.24.24.2 dev tun1 src 172.24.24.1
Ping 192.168.2.101 from OpenVPN server.
On the Raspberry, however, no packets are displayed at the interface with tcpdump
. But tcpdump
displays the outgoing packets:
[root@openvpn ~]# tcpdump -ni tun1 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun1, link-type RAW (Raw IP), capture size 65535 bytes
20:10:00.610156 IP 172.24.24.1 > 192.168.2.101: ICMP echo request, id 3413, seq 1, length 64
20:10:01.616216 IP 172.24.24.1 > 192.168.2.101: ICMP echo request, id 3413, seq 2, length 64
Raspberry
- VPN-IP: 172.24.24.2 (tun0)
- Local LAN: 192.168.2.101 (eth0)
iptables: (policy ACCEPT for all chains)
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 172.24.24.0/29 -j ACCEPT
-A FORWARD -s 192.168.2.0/24 -j ACCEPT
-A POSTROUTING -o eth0 -j MASQUERADE
Routing table
default via 192.168.2.1 dev eth0
172.24.24.0/29 dev tun0 proto kernel scope link src 172.24.24.2
192.168.2.0/24 dev eth0 proto kernel scope link src 192.168.2.101
I initially thought that it is due to an iptables rule or to the NAT. That no packages arrive at the tun0 interface of the Raspberry I find very unusual and guess there the mistake.
Where could the mistake be in this setup? I really appreciate any help you can provide.