How to allow communications with client to client on OpenVPN Server?

Question

Client 1: 192.168.255.3 cannot ping Client 2: 192.168.255.4
How to do it so that Client 1 can communicate with the Client 2?

```

# cat /var/lib/docker/volumes/ovpn-data-example/_data/openvpn.conf

server 192.168.255.0 255.255.255.0
verb 3

key /etc/openvpn/pki/private/vpn.server.key
ca /etc/openvpn/pki/ca.crt
cert /etc/openvpn/pki/issued/vpn.server.crt
dh /etc/openvpn/pki/dh.pem
tls-auth /etc/openvpn/pki/ta.key

key-direction 0
keepalive 10 60
persist-key
persist-tun

proto udp
# Rely on Docker to do port mapping, internally always 1194
port 1194
dev tun0
status /tmp/openvpn-status.log

user nobody
group nogroup

client-to-client
topology subnet

### Route Configurations Below
route 192.168.255.0 255.255.255.0

### Push Configurations Below
push "route 192.168.255.0 255.255.255.0"
push "block-outside-dns"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

I use openvpn on this docker and digital ocean vps.

Every client has no problems with connection to the server, but any client cannot ping another client.

Why do you have `topology subnet` commented out? Also, have you looked at your firewall (iptables) rules to make sure that it is permitted. — Zoredache, Dec 08 '17 at 19:24
So what is the exact error that you get if you attempt to ping between clients? — Zoredache, Dec 08 '17 at 20:17
Well the next test is to try a **traceroute**. And possibly combine that with running `tcpdump -i {{tuninterface}}` (replacing with the actually interface name) on the server. — Zoredache, Dec 08 '17 at 20:55

score 1 · Answer 1 · answered Dec 08 '17 at 19:48

You most likely need to make a firewall rule that allows the clients to communicate with one another. If you just want them to ping, you will need to allow ICMP packets through. If you want more than ping, you will need to specify additional rules. If you use iptables rules to allow cross-client communication, then get rid of the "client-to-client" in your openvpn configuration.

For example:

iptables -I INPUT -m conntrack --cstate ESTABLISHED,RELATED -j ACCEPT
iptables -I OUTPUT -m conntrack --cstate ESTABLISHED,RELATED -j ACCEPT
iptables -I FORWARD -m conntrack --cstate ESTABLISHED,RELATED -j ACCEPT

iptables -I FORWARD -s 192.168.255.3 -d 192.168.255.4 -p ICMP --cstate NEW -j ACCEPT
iptables -I FORWARD -s 192.168.255.4 -d 192.168.255.3 -p ICMP --cstate NEW -j ACCEPT

The first three rules tell the firewall to allow connections that are related to already established connections

The last two allow ICMP (ping) packets to be forwarded from one client to the other.

I typed the first 3 iptables rules on the docker container and does not work, than i typed on the host and it also does not work. ps. --ctstate not --cstate — Sebastian Korotkiewicz, Dec 09 '17 at 18:45

score 1 · Answer 2 · answered Dec 10 '17 at 02:07

How to add a Windows Firewall rule to enable client-to-client communication through OpenVPN

Open PowerShell with Administrator Privileges and type:

New-NetFirewallRule -DisplayName “OpenVPN allow Inbound” -Direction Inbound -Program %ProgramFiles%\OpenVPN\bin\openvpn.exe -RemoteAddress LocalSubnet -Action Allow
New-NetFirewallRule -DisplayName “OpenVPN allow Outbound” -Direction Outbound -Program %ProgramFiles%\OpenVPN\bin\openvpn.exe -RemoteAddress LocalSubnet -Action Allow
Set-NetFirewallProfile Public -DefaultInboundAction Allow -DefaultOutboundAction Allow

from now every connected client should be able to ping you

Optional: To see if it has been added open Windows Defender Firewall: wf.msc.

How to allow communications with client to client on OpenVPN Server?

2 Answers2

How to add a Windows Firewall rule to enable client-to-client communication through OpenVPN

Linked