Access to openvpn client subnet

Question

I have been struggling to access to vpnclient subnet from a vpn server. Both server and client run on a linux box with openvpn.Tunnel is established properly. Firewalls on server and client are disabled.

------------------    --------     -----------------------        -------------
| vpn server     |----| INET |-----| vpn client          |--------|           |
| tun0: 10.8.0.1 |    --------     | tun0: 10.8.0.2      |        | SUBNET    |
|                |                 | eth0: 192.168.1.45  |        |           |
|                |                 | wlan: 10.10.0.1     |        | 10.10.0.0 |
------------------                 -----------------------        -------------

Both linux machines have ip_forward=1

server.conf

local 45.138.196.247
port 1194
proto udp
dev tun
......
topology subnet
client-to-client
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 5
explicit-exit-notify
client-config-dir /etc/openvpn/ccd
ccd-exclusive

client.conf

client
dev tun
proto udp
remote 45.138.196.247 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
.....
ignore-unknown-option block-outside-dns
block-outside-dns
verb 5
auth-nocache
topology subnet

ccd for client:

ifconfig-push 10.8.0.2 255.255.255.0
iroute 10.10.0.0 255.255.255.0

Additionally I added static route on the server:

route add -net 10.10.0.0 netmask 255.255.255.0 gw 10.8.0.1

ping 10.10.0.1 and/or 10.10.0.2 (pc) failed from server. I believe something with the routing is still missing.

Answer 1

By coincidence I found the problem.
I run the following command:

root@vpnServer:/etc/openvpn# iptables -t nat -L -n -v --line-numbers
Chain PREROUTING (policy ACCEPT 81998 packets, 22M bytes)
num   pkts bytes target     prot opt in     out     source               destination


Chain INPUT (policy ACCEPT 9509 packets, 694K bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 99 packets, 7563 bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 183 packets, 13588 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1       57  4281 SNAT       all  --  *      *       10.8.0.0/24         !10.8.0.0/24          to:45.138.196.247

I deleted the Chain POSTROUTING num 1:

root@vpnServer:/etc/openvpn# iptables -t nat -D POSTROUTING 1

root@vpnServer:/etc/openvpn# iptables -t nat -L -n -v --line-numbers
Chain PREROUTING (policy ACCEPT 1 packets, 165 bytes)
num   pkts bytes target     prot opt in     out     source               destination


Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination

Now I can ping subnet behind vpn client !

root@vpnServer:/etc/openvpn# ping 10.8.0.2
PING 10.8.0.2 (10.8.0.2) 56(84) bytes of data.
64 bytes from 10.8.0.2: icmp_seq=1 ttl=64 time=26.4 ms
64 bytes from 10.8.0.2: icmp_seq=2 ttl=64 time=26.6 ms

I used openvpn-install.sh to install and create openvpn configuration files. That script apparently has messed up iptables by adding that entry in the Chain POSTROUTING! I think is better to take the whole configuration process manually step by step. Do not rely on that script. It configures other thing without any control and warning!

Answer 2

client routing table before starting vpn client

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    100    0        0 eth0
10.10.0.0       0.0.0.0         255.255.255.0   U     0      0        0 wlan0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 wlan0
192.168.1.0     0.0.0.0         255.255.255.0   U     100    0        0 eth0

routing table after vpn client starts

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.8.0.1        128.0.0.0       UG    0      0        0 tun0
0.0.0.0         192.168.1.1     0.0.0.0         UG    100    0        0 eth0
10.8.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0
10.10.0.0       0.0.0.0         255.255.255.0   U     0      0        0 wlan0
45.138.196.247  192.168.1.1     255.255.255.255 UGH   0      0        0 eth0
128.0.0.0       10.8.0.1        128.0.0.0       UG    0      0        0 tun0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 wlan0
192.168.1.0     0.0.0.0         255.255.255.0   U     100    0        0 eth0