I have a question about OpenVPN, I had made a "dev tun" connection between my office network and a VPC on Amazon.But....
in few words: Everething work, except: i c'ant ping the client Lan from the server lan.
As you can see on the diagram (link bellow) the Vpn server run on a Synology Nas in the office network. Diagram
The client succesfully connect to server and can access to all the Office network (using 192.168.1.XXX ip). (Yeah!). But, from the office network i can't ping the Client lan (with 10.0.0.XXX) even from the server. Of course, i CAN ping the client with 10.8.0.6 from the server and from the lan.
To know:
- Source/Destination Checks is Disabled on ALL EC2 instance.
- Firewall disabled on VPNServer
- ALL Firewall disabled on VPNClient
I had spend sooo many time to find a solution.. and now adding and deleting route everywhere make me really creazy :/
Can someone help me to clarify the problem? Thank's in advance.
Server config:
push "route 192.168.1.0 255.255.255.0"
push "route 10.8.0.0 255.255.255.0"
route 10.0.0.0 255.255.255.0
#route 192.168.1.0 255.255.255.0
dev tun
management 127.0.0.1 1195
server 10.8.0.0 255.255.255.0
dh /var/packages/VPNCenter/target/etc/openvpn/keys/dh1024.pem
ca /var/packages/VPNCenter/target/etc/openvpn/keys/ca.crt
cert /var/packages/VPNCenter/target/etc/openvpn/keys/server.crt
key /var/packages/VPNCenter/target/etc/openvpn/keys/server.key
max-clients 5
client-to-client
client-config-dir /var/packages/VPNCenter/target/etc/openvpn/ccd
comp-lzo
persist-tun
persist-key
verb 3
#log-append /var/log/openvpn.log
keepalive 10 60
reneg-sec 0
plugin /var/packages/VPNCenter/target/lib/radiusplugin.so /var/packages/VPNCenter/target/etc/openvpn/radiusplugin.cnf
client-cert-not-required
username-as-common-name
duplicate-cn
status /tmp/ovpn_status_2_result 30
status-version 2
proto udp6
port 1194
CCD File:
iroute 10.0.0.0 255.255.255.0
Client config:
dev tun
tls-client
remote XXX.XXX.XXX.XXX 1194
pull
proto udp
script-security 2
ca ca.crt
comp-lzo
reneg-sec 0
auth-user-pass
OPENVPN SERVER ROUTE:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default bbox.lan 0.0.0.0 UG 0 0 0 eth1
10.0.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0
192.168.1.0 * 255.255.255.0 U 0 0 0 eth1
Client Route:
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.0.0.1 10.0.0.171 10
10.0.0.0 255.255.255.0 On-link 10.0.0.171 266
10.0.0.171 255.255.255.255 On-link 10.0.0.171 266
10.0.0.255 255.255.255.255 On-link 10.0.0.171 266
10.8.0.0 255.255.255.0 10.8.0.5 10.8.0.6 20
10.8.0.4 255.255.255.252 On-link 10.8.0.6 276
10.8.0.6 255.255.255.255 On-link 10.8.0.6 276
10.8.0.7 255.255.255.255 On-link 10.8.0.6 276
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
169.254.169.250 255.255.255.255 10.0.0.1 10.0.0.171 10
169.254.169.251 255.255.255.255 10.0.0.1 10.0.0.171 10
169.254.169.254 255.255.255.255 10.0.0.1 10.0.0.171 10
192.168.1.0 255.255.255.0 10.8.0.5 10.8.0.6 20
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.0.0.171 266
224.0.0.0 240.0.0.0 On-link 10.8.0.6 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.0.0.171 266
255.255.255.255 255.255.255.255 On-link 10.8.0.6 276
