On Fri, Jul 15, 2016 at 11:22 AM, Tobi <[email protected]> wrote:
> Hi
>
> I'm trying to expand the scope of openvpn on the client side to allow
> traffic from this client LAN to the OVPN network. It works everywhere
> except on one system (subnet). The openvpn client can ping the openvpn
> gateway (openvpn server) without any problem. But no client behind that
> system can reach the ovpn network.
> The local lan in question is 10.66.66.0/25 so I ensured that on the ovpn
> server the clients ccd file contains (the ovpn net is 10.66.88.0/24 and
> tries to reach 10.66.99.129)
>
> ifconfig-push 10.66.88.9 255.255.255.0
> iroute 10.66.66.0 255.255.255.128
>
Where does 10.66.99.129 fit in all these? Is it a machine behind the server?
>
> on the client itself I do set routing via the up parameter in the ovpn
> client conf and a shell script. Resulting route looks okay
>
> 10.66.99.0 10.66.88.1 255.255.255.0 UG 0 0 0
> tun0
>
While this should work, no scripting is actually necessary. Just add the
route command to the config
or push it from the server.
> A ping to 10.66.99.129 work fine from the ovpn client. So I guess the
> routing should be okay.
> But if a client behind that ovpn client (ip 10.66.66.5) tries to reach
> 10.66.99.129 nothing happens.
>
On the ovpn client I can see via tcpdump
> that the packets from 10.66.66.5 come in, but they do not leave the
> client on ANY interface. Especially not on tun0 where they should
> according to routing.
>
To ensure that this is not a firewall issue I disabled the firewall but
> the result does not change. Same for selinux. Disabled but nothing
> changed. I further ensured that ipv4 forwarding is active
>
> /sbin/sysctl net.ipv4.ip_forward
> net.ipv4.ip_forward = 1
>
> I'm running ovpn on a Centos7
>
> cat /etc/redhat-release
> CentOS Linux release 7.2.1511 (Core)
>
> I have no idea why this happens as I have several servers (which act a
> ovpn clients) and there is not problem to bring the traffic from
> networks behind those systems to the ovpn network.
>
> Any idea what else I could check?
>
If the client machine is gobbling up the packets this may be unrelated to
the VPN configuration, but please post your server and client configs and
clarify the network topology -- especially the 10.66.99.0 network and its
gateway: how do those machines know how to route back to 10.66.66.0/24?
That would help rule out any issues in there.
Selva
------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are
consuming the most bandwidth. Provides multi-vendor support for NetFlow,
J-Flow, sFlow and other flows. Make informed decisions using capacity planning
reports.http://sdm.link/zohodev2dev
_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users
