Openvpn – trying to route between two openvpn clients

openvpn

I have two openvpn clients on the 10.0.1.0 (client1) and 192.168.0.0 (client2) subnets with the server's openvpn connection having the ip 192.168.150.1

The server has ip forwarding enabled.

Currently, client1's vpn ip is 192.168.150.10 and the P-t-P ip is 192.168.150.9
I have created the following static route on client1:

route add -net 10.0.1.0 netmask 255.255.255.0 gw 192.168.150.9

The routing table on client1 looks like this:

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
192.168.150.9   0.0.0.0         255.255.255.255 UH        0 0          0 tun0
192.168.150.1   192.168.150.9   255.255.255.255 UGH       0 0          0 tun0
10.0.1.0        192.168.150.9   255.255.255.0   UG        0 0          0 tun0
192.168.0.0     0.0.0.0         255.255.255.0   U         0 0          0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
0.0.0.0         192.168.0.1     0.0.0.0         UG        0 0          0 eth0

I thought this would be correct to allow traffic from client1 to reach computers on client2's network, but it does not work. Is 192.168.150.9 (the P-t-P address) the correct one to be routing through ? I tried using 192.168.150.1 but I couldn't create the route.

I also tried adding this to the server config instead:

push "route 192.168.0.0 255.255.255.0"
push "route 10.0.1.0 255.255.255.0"

It creates the following route on client1:

10.0.1.0        192.168.150.9   255.255.255.0   UG        0 0          0 tun0

But it doesn't work. Surely the "push" route example is correct ? Is there something else I need to do ? Nothing on the server ? Just enable ip forwarding ?

Best Answer

Does anything appear in firewall logs? Can you diagnose exactly where the traffic brakes using tcpdump? What system are you using (linux, freebsd, which version)?

Also try this in the server config (from the OpenVPN documentation):

# Uncomment this directive to allow different
# clients to be able to "see" each other.
# By default, clients will only see the server.
# To force clients to only see the server, you
# will also need to appropriately firewall the
# server's TUN/TAP interface.
;client-to-client
Related Topic