1

I have a vpn server which is connected to vpn client having ip 10.30.0.x now. I want it to able to ping another private client connected to vpn server. Please note that other private client is private subnet of vpn server and its not connected to it.

So vpn server is something like 10.20.0.95 and vpn client is 10.30.0.190 and private subnet connected to vpn server is 10.20.0.180. Now 10.30.0.190 can't ping 10.20.0.180 and vice versa. I have enabled client to client in server.conf

Also note that using masquerading it works but then i don't know which exactly is pinging 10.20.0.180. I only see request coming from vpn server.

server.conf
port 1190
proto udp
dev tun
ca ca.crt
dh dh.pem
topology subnet
server 10.10.0.0 255.255.0.0
ifconfig-pool-persist ipp.txt
push "route 10.20.0.0 255.255.0.0"
client-config-dir ccd
ifconfig 10.10.0.1 255.255.255.0
route 10.30.0.0 255.255.0.0 10.10.0.2
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log-append  openvpn.log
verb 3

client.conf
client
dev tun
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
comp-lzo
verb 3

route table for vpn server aka 10.20.0.95
0.0.0.0         10.20.0.1       0.0.0.0         UG    0      0        0 eth0
10.10.0.0       0.0.0.0         255.255.0.0     U     0      0        0 tun0
10.20.0.0       0.0.0.0         255.255.255.0   U     0      0        0 eth0
10.30.0.0       10.10.0.2       255.255.0.0     UG    0      0        0 tun0

route table for vpn client aka 10.30.x.x
0.0.0.0         10.30.0.1       0.0.0.0         UG    0      0        0 eth0
10.10.0.0       0.0.0.0         255.255.0.0     U     0      0        0 tun0
10.20.0.0       10.10.0.1       255.255.0.0     UG    0      0        0 tun0
10.30.0.0       0.0.0.0         255.255.255.0   U     0      0        0 eth0

route table for private subnet connected to vpn server
0.0.0.0         10.20.0.1       0.0.0.0         UG    0      0        0 eth0
10.10.0.0       0.0.0.0         255.255.255.0   U     0      0        0 eth0
10.20.0.0       0.0.0.0         255.255.255.0   U     0      0        0 eth0

Also I see following tcpdump when pinging 10.20.0.180 from 10.30.x.x on vpn server

sudo tcpdump -i eth0 'icmp[icmptype] = icmp-echo or icmp[icmptype] = icmp-echoreply'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
21:39:25.264549 IP 10.10.0.2 > 10.20.0.180: ICMP echo request, id 1709, seq 2457, length 64
21:39:25.852635 IP 10.10.0.2 > 10.20.0.180: ICMP echo request, id 1956, seq 70, length 64
21:39:26.264552 IP 10.10.0.2 > 10.20.0.180: ICMP echo request, id 1709, seq 2458, length 64
21:39:26.852661 IP 10.10.0.2 > 10.20.0.180: ICMP echo request, id 1956, seq 71, length 64

While ping 10.30.x.x from 10.20.0.180 on vpn server

sudo tcpdump -i tun0 'icmp[icmptype] = icmp-echo or icmp[icmptype] = icmp-echoreply'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
21:43:56.136264 IP 10.10.0.1 > 10.30.0.190: ICMP echo request, id 6694, seq 1, length 64
21:43:57.135874 IP 10.10.0.1 > 10.30.0.190: ICMP echo request, id 6694, seq 2, length 64
21:43:58.135855 IP 10.10.0.1 > 10.30.0.190: ICMP echo request, id 6694, seq 3, length 64
21:43:59.136256 IP 10.10.0.1 > 10.30.0.190: ICMP echo request, id 6694, seq 4, length 64
21:44:00.135868 IP 10.10.0.1 > 10.30.0.190: ICMP echo request, id 6694, seq 5, length 64
21:44:01.135848 IP 10.10.0.1 > 10.30.0.190: ICMP echo request, id 6694, seq 6, length 64
21:44:02.136093 IP 10.10.0.1 > 10.30.0.190: ICMP echo request, id 6694, seq 7, length 64

Any help will be appreciated. Thanks

2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.