trying to route between two openvpn clients

Question

I have two openvpn clients on the 10.0.1.0 (client1) and 192.168.0.0 (client2) subnets with the server's openvpn connection having the ip 192.168.150.1

The server has ip forwarding enabled.

Currently, client1's vpn ip is 192.168.150.10 and the P-t-P ip is 192.168.150.9 I have created the following static route on client1:

route add -net 10.0.1.0 netmask 255.255.255.0 gw 192.168.150.9

The routing table on client1 looks like this:

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
192.168.150.9   0.0.0.0         255.255.255.255 UH        0 0          0 tun0
192.168.150.1   192.168.150.9   255.255.255.255 UGH       0 0          0 tun0
10.0.1.0        192.168.150.9   255.255.255.0   UG        0 0          0 tun0
192.168.0.0     0.0.0.0         255.255.255.0   U         0 0          0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
0.0.0.0         192.168.0.1     0.0.0.0         UG        0 0          0 eth0

I thought this would be correct to allow traffic from client1 to reach computers on client2's network, but it does not work. Is 192.168.150.9 (the P-t-P address) the correct one to be routing through ? I tried using 192.168.150.1 but I couldn't create the route.

I also tried adding this to the server config instead:

push "route 192.168.0.0 255.255.255.0"
push "route 10.0.1.0 255.255.255.0"

It creates the following route on client1:

10.0.1.0        192.168.150.9   255.255.255.0   UG        0 0          0 tun0

But it doesn't work. Surely the "push" route example is correct ? Is there something else I need to do ? Nothing on the server ? Just enable ip forwarding ?

Answer 1

Does anything appear in firewall logs? Can you diagnose exactly where the traffic brakes using tcpdump? What system are you using (linux, freebsd, which version)?

Also try this in the server config (from the OpenVPN documentation):

# Uncomment this directive to allow different
# clients to be able to "see" each other.
# By default, clients will only see the server.
# To force clients to only see the server, you
# will also need to appropriately firewall the
# server's TUN/TAP interface.
;client-to-client

Answer 2

In order to get my clients talking to each other via the OpenVPN server, I needed to uncomment client-to-client in my config as @kyrisu suggests, but I also had to add topology subnet to my server config:

# Configure server mode and supply a VPN subnet
# for OpenVPN to draw client addresses from.
# The server will take 10.8.0.1 for itself,
# the rest will be made available to clients.
# Each client will be able to reach the server
# on 10.8.0.1. Comment this line out if you are
# ethernet bridging. See the man page for more info.
server 10.8.0.0 255.255.255.0
topology subnet