I set up a OpenVPN server for subnet 10.8.0.0/24 which has limited access to the internal network. Additionally I want to configure 10.8.1.0/24 manually with static IPs for selected clients to give them additional permission (e.g. SSH access).
Access control is done via iptables and works as expected.
Now I push a route to an external IP (in this example 10.10.10.10) with a webserver running on port 80 & 443.
When connecting to the VPN without a client specific configuration and thus getting an 10.8.0.0/24 IP I have no problems accessing the webserver on 10.10.10.10. I can see packages coming in on tun0 and leaving the server on p4p1 (external interface). When connecting to the VPN with a client specific configuraiton and thus getting an 10.8.1.0/24 IP I am able to ping all internal servers, but packages designated for 10.10.10.10 won't be relayed to any physical interface on the VPN server (checked in TCP dumps).
Regarding this an excerpt from the OpenVPN server configuration:
server 10.8.0.0 255.255.255.0 push "route 10.10.10.10 255.255.255.255" client-config-dir /etc/openvpn/ccd route 10.8.1.0 255.255.255.0 client-to-client comp-lzo persist-key persist-tun
ifconfig-push 10.8.1.133 10.8.1.134
As traffic is working via any specific route listed to the internal interface (p1p1) I guess that OpenVPN is not correctly redirecting traffic towards the default route going onto interface p4p1, but I don't know why it would do that and how it can be fixed.