0

I have a (tinc) VPN setup with multiple clients that connect to a VPN server that sits on a LAN behind a firewall. I want to expose that LAN to the VPN that server is serving. I've seen a few examples around the net how to configure iptables, but I'd like to configure this setup using FirewallD, and have not yet succeeded.

The VPN subnet is 10.0.0.0/24 and the local LAN is 192.168.178.0/24 . The VPN server is at 10.0.0.60 and 192.168.178.47 . The test client is at 10.0.0.17 .

I've ran: 

firewall-cmd --permanent --zone=external --add-interface=vpn
firewall-cmd --permanent --zone=internal --add-interface=eth0
firewall-cmd --permanent --zone=external --add-masquerade
systemctl restart firewalld

on the VPN server, and on the client:

route add -net 192.168.178.0 netmask 255.255.255.0 gw 10.0.0.60
ping 192.168.178.1

Which returned 100% packetloss. Is there anything I'm doing wrong?

PS: If I run "ping 192.168.178.47" on the test client I do get replies! Just not the rest of the LAN.

Alex
  • 389
  • 9
  • 23

1 Answers1

2

Your clients on the other end need the routing information as well, so I believe you'll need to have a gateway set for them to talk the other way around unless your VPN server currently acts as the default gateway on the 192.168.178.x network.

(if your firewall is set up right), the machines on the local LAN would need:

route add -net 10.0.0.0 netmask 255.255.255.0 gw 192.168.178.47

It would be BETTER to add this rule to your default gateway if at all possible, otherwise each machine would need the static route in order to communicate.

IceMage
  • 1,336
  • 7
  • 12
  • Of course! It's nice to know the way back too, Stupid me :) thanks a bunch for this! .. There's one problem though- pinging works fine, I can ping everything in my LAN, but I can't reach them with HTTP or SSH, what could be causing that? I managed to get the route into the default gateway by the way, thanks for the tip! – Alex Jan 05 '15 at 23:03
  • I made a new question to resolve that new problem http://serverfault.com/questions/656492/vpn-client-can-ping-lan-machines-but-no-other-tcp-udp-service-works . Thanks for the help with this one! – Alex Jan 05 '15 at 23:38