2

I have a set up that looks like this:

                                                    +                                      
                                                    |                        +------------+
+---------+                  +---+-----+            |              +---------+ Remote Host|
|Client 1 +--+--------------->Server 1 |            |              |         | 10.19.2.2  |
|10.19.1.2|  +---------------|10.19.1.1|            |              |         +------------+
+---------+  |  +------------v-------+-+            |              |                       
+---------+  |  |                    |            +-----------+    |                       
|Client 2 |  |  |               ^    |        +--------------------+                       
|10.19.1.3+--+  |               |    |        |   |  Switch   |                            
+---------+     |               |    v        |   |           |                            
+---------+     |               |             |   +-+---------+                            
|Client 3 +-----+            +--++-----+      |     |                                      
|10.19.1.4|                  |Server 2 |      |     |                                      
+---------+                  |10.19.2.1| <----+     |                                      
                             +---------+            |                                      
                                                    |                                      
                                                    |                                      
                                                    |                                      
                                                    ++                                     

I'm using OpenVPN. Server one is set up to be at address 10.19.1.1 on a 24 bit subnet leasing IPs to Clients 1-3. Server 1 is also connected to server 2, and has a second IP address on Server 2's 24 bit subnet. Server 2 has the same client/server set up as Server 1. It has IP address 10.19.2.1 on a 24 bit subnet leasing an ip to the Remote Host.

Each server has two Interfaces as such:

+---+--------+                    
|Server 1    +-+tun0  10.19.1.0/24
|            |                    
|            +-+tun1 10.19.2.0/24 
+------------+                    
+------------+                    
|Server 2    +-+tun0 10.19.2.0/24 
|            |                    
|            +-+tun1 10.19.1.0/24 
+------------+                    

Where tun0 is its server interface and tun1 is its client interface. How can I get these two networks to communicate using routing tables to server 1 and server 2? I've been able to get this to work out on Server 1, so that Client 1 could ping remote host, but not the other way around.

I did this by pushing a route to the clients from server 1 so that 10.19.0.0/16 is routed through server 1, then I set up masquerading on tun1 for server 1. I tried to do the same set up with server 2 and it doesn't allow the remote host to ping the individual clients.

1

If I understand you correctly, you want to achieve routed (L3) connectivity between the two VPN subnets. Without adding any additional routes, Servers 1 and 2 should already know how to route packets between the two networks, since they have interfaces attached to both networks. All that is missing is to inform their respective VPN clients about how to reach the other network.

Specifically, clients of Server 1 (on 10.19.1.0/24) need to be informed that network 10.19.2.0/24 is reachable via 10.19.1.1, and clients of Server 2 (on 10.19.2.0/24) need to be informed that network 10.19.1.0/24 is reachable via 10.19.2.1. There should be no need to configure a NAT masquerade on either server.

OpenVPN server allows you to push routing commands to clients. I believe the command to put into the OpenVPN server config file on Server 1 would be:

push "route 10.19.2.0 255.255.255.0"

And the corresponding config on Server 2 would be:

push "route 10.19.1.0 255.255.255.0"
| improve this answer | |
  • This still refused to work without NATing, but I did discover I had IPV4 forwarding turned off on the server that was causing issues. Once I turned NATing back on and enabled IPV4 forwarding everything worked – Jonathon Klem Oct 20 '14 at 15:53
  • @JonathonKlem: Did you actually try turning off NAT masquerading after you had enabled IP forwarding? I am still not convinced that your use-case should require NAT. – Steven Monday Oct 21 '14 at 13:21
  • Yes, I turned off NAT masquerading. I believe it may have something to do with the fact that all the Clients are connected to server 1 via VPN. They're not on an actual subnet. – Jonathon Klem Oct 21 '14 at 13:38
0

It turns out that IPV4 forwarding was turned off on Server2. I still had to use NAT, I believe it's because OpenVPN requires authentication and all the clients are connected to the OpenVPN server. Once IPV4 forwarding was enabled on Server2, everything worked both ways.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.