I am having an issue with building a static route that spans 2 different subnets and a vpn connection. My topology looks like this:
- Host-A:
inet 10.0.28.45
netmask255.255.224.0
broadcast10.0.31.255
Host-B:
inet 10.0.47.160
netmask255.255.240.0
broadcast10.0.47.255
Host-C:
inet 172.16.254.133
netmask255.255.255.0
broadcast172.16.254.255
I have an OpenVPN connection that is initiated from Host-C to Host-B. The OpenVPN connection is on tun0 with a subnet of 192.168.100.0/24 so Host-B has a tun0 address of 192.168.100.2 and Host-C has an address of 192.168.100.5
Host-B has ip forwarding enabled and is doing ip-masquerading on firewalld.
I initiate my vpn connection and can reach Host-A from Host-C without issue. I want to be able to have Host-A reach Host-C as well. To my knowledge to add a static route, you need to have a host on the same subnet as your gateway. Since Host-A and Host-B are on different subnets I added a the 10.0.32.0 subnet to my routing table on Host-A.
My routing table on Host-A looks as follows:
# ip route list
default via 10.0.0.1 dev eth0
10.0.0.0/19 dev eth0 proto kernel scope link src 10.0.28.45
10.0.32.0/20 via 10.0.0.1 dev eth0
169.254.0.0/16 dev eth0 scope link metric 1002
I then tried to add a route to Host-B which is on 10.0.32.0/20 subnet as:
ip route add 192.168.100.0/24 via 10.0.47.160
But I get the error: RTNETLINK answers: Network is unreachable
I understand that the gateway I'm trying to use here is outside the scope of the subnet that Host-A is in. I added the 10.0.32.0/20 subnet via 10.0.0.1 above to provide the route that that subnet should take which 10.0.47.160 is inside of but I'm not sure if this is the correct way to handle this case.
My routing table on Host-B looks as follows:
$ ip route list
default via 10.0.32.1 dev eth0
10.0.32.0/20 dev eth0 proto kernel scope link src 10.0.47.160
169.254.0.0/16 dev eth0 scope link metric 1002
192.168.100.0/24 via 192.168.199.2 dev tun0
192.168.100.2 dev tun0 proto kernel scope link src 192.168.199.1
I want all traffic except traffic destined for 192.168.100.0 to continue to exit eth0 via 10.0.0.1.
I feel like part of my issue here is I am missing something in my routing table on Host-A which is why I am getting the Network unreachable error when I try to add a route to 192.168.100.0/24.
What am I missing here?
tcpdump
is your friend. ;-) Even if you're not getting a response from Host-B that doesn't mean that the packets aren't getting there, they may just be unable to get back. – tu-Reinstate Monica-dor duh Jun 26 '19 at 4:48