0

I have the following situation. I have a root server, which acts as a VPN server for my company network and as a VPN client to multiple customer-networks. Every seperate connection works (I can ping anyone from my root server, and my root server can be pinged from the corresponding networks).

But now I want the clients in my company network to be able to access all the customers computers, but the customers shouldn't be able to access me and each other. Is that possible?

Example:

  • My PC has the IP 10.8.0.11 and is in the net 10.8.0.0/24.
  • My customers server has the IP 10.9.0.11 and is in the net 10.9.0.0/24.

My PC now has the following entry in the routing table:

10.9.0.0 255.255.255.0 10.8.0.1 [...]

And my root server (10.8.0.1) has the following entry:

10.9.0.0 255.255.255.0 10.9.0.1 [...]

The customers VPN server (10.9.0.1) knows nothing about my net. I can ping everyone on my root-server, and everyone can ping my root server (with the according address). But my PC cannot reach my customers server. I have routing installed on my root server (Windows Server 2008 R2) and it is up and running.

What do I need to do to make this work?

9
  • From where comes your route 10.9.0.0 255.255.255.0 10.8.0.1 on your PC ? did you setup it by yourself ? seems it is not a valid route because the gateway for subnet 10.9.0.0/24 seems to be 10.9.0.1
    – krisFR
    Dec 23, 2013 at 23:25
  • It comes from OpenVPN push "route 10.9.0.0 255.255.255.0" in the server config. Shouldn't 10.8.0.1 be the gateway for the 10.9.0.0 network, for computers in the 10.8.0.0 network?
    – LueTm
    Dec 23, 2013 at 23:28
  • No, to me gateway for 10.9.0.0/24 network should be 10.9.0.1...try this...or ask you this question : is gateway 10.8.0.1 able to route 10.9.0.0/24 subnet (have a look at the routing table of gateway 10.8.0.1) ?
    – krisFR
    Dec 23, 2013 at 23:31
  • Yes, 10.8.0.1 is a root server, which has routing installed and should route those two networks. Let me try the other gatweway.
    – LueTm
    Dec 23, 2013 at 23:35
  • No, that doens't work either.
    – LueTm
    Dec 23, 2013 at 23:43

0

You must log in to answer this question.

Browse other questions tagged .