OpenVPN Routing between two networks

openvpn

I have two OpenVPN server instances running on a WRT54GL (Tomato f/w 1.27vpn), one uses 10.10.10.0/24 and has 3 of my virtual servers, with this being used to backup these servers nightly thru the vpn. I also connect to this instance via laptop when I'm out and about. This is working fine. Now to the problem.. I have the second OpenVPN instance configured on 10.10.11.0/24 and a virtual server connected there with a couple more to follow. I want to keep the networks separate since one is my personal stuff and the
others are for clients. Both OpenVPN instances are configured for client-to-client. My problem is when I'm out on the laptop, I get to the 10.10.10.0/24 subnet, since I get ifconfig-pushed a 10.10.10.0 addresss, but cannot figure out how/where to configure routing to allow me to get to/from the 10.10.11.0 network. I kind of expect that to be in the WRT54GL/Tomato routing table since that's the gateway for both networks, but I've tried all sorts of combinations and get no connection between the two networks..
It's gotta be simple, but I'm missing it…

Dave

Best Answer

Not sure if you can edit the openvpn.conf file on a WRT, but if you can; this is how to push a route to the client:

push "route 10.10.11.0 255.255.255.0"

Related Solutions

OpenVPN Site-to-Site Routing Woes

The behaviour you're seeing is by design. A host on a network will by default use the IP address of the interface where the traffic is exiting as the source IP.

A client machine on one of the LANs will use for example 192.168.178.10 as its source IP because it's not multihomed. The gateway will then route the packet to your OpenVPN box and it will pass over the tunnel with no problems.

However, if you're going from the OpenVPN box itself, it will use the IP address of the OpenVPN interface since that's where the packet would exit.

Which is fine. It reaches the remote site. But then the remote site wants to send packets for the ping response to 192.168.0.6. The response goes to the gateway, but since the gateway (I'm assuming, since you didn't post the routing tables of the gateway on the network) doesn't have a route for that network, it doesn't know how to proceed.

The easiest way to solve this would be simply to add a route for 192.168.0.0/24 (your OpenVPN network) to the gateways of both networks.

Another option, if your operating system supports it (you didn't specify what OS you're running OpenVPN on) would be to see if you can use the "src" parameter of a route to override this default behavior of chosing the IP address of the egress interface. Please refer to the question titled How to set a custom route source in openvpn for more information.

Openvpn – Bridging Two VPNs With Routing Tables and OpenVPN

If I understand you correctly, you want to achieve routed (L3) connectivity between the two VPN subnets. Without adding any additional routes, Servers 1 and 2 should already know how to route packets between the two networks, since they have interfaces attached to both networks. All that is missing is to inform their respective VPN clients about how to reach the other network.

Specifically, clients of Server 1 (on 10.19.1.0/24) need to be informed that network 10.19.2.0/24 is reachable via 10.19.1.1, and clients of Server 2 (on 10.19.2.0/24) need to be informed that network 10.19.1.0/24 is reachable via 10.19.2.1. There should be no need to configure a NAT masquerade on either server.

OpenVPN server allows you to push routing commands to clients. I believe the command to put into the OpenVPN server config file on Server 1 would be:

push "route 10.19.2.0 255.255.255.0"

And the corresponding config on Server 2 would be:

push "route 10.19.1.0 255.255.255.0"

Related Topic