From: "Daniel L. Miller" <dmiller@amfes.com>
To: lartc@vger.kernel.org
Subject: [LARTC] OpenVPN routing
Date: Mon, 10 Sep 2007 06:36:18 +0000 [thread overview]
Message-ID: <46E4E5E2.2070703@amfes.com> (raw)
Hi!
I'm trying to create a routed VPN using OpenVPN - and having trouble
with the routing concepts involved. Let me see if I can properly
describe my current topology:
Server -
LAN, with both local workstations and remote bridged workstations on the
192.168.0.0/24 network (this works without reservation).
Server located at 192.168.0.71, 192.168.0.72, 192.168.0.222, and few
others.
Routed VPN, 172.27.0.0/16 network. Server is located at 172.27.0.1.
Server can talk to clients, and clients can talk to server.
My 1st goal is to allow selected server-side LAN workstations to reach
the routed VPN workstations. The LAN should be invisible to the routed VPN.
My 2nd goal is to allow selected server-side LAN workstations to reach
networks server by routed VPN workstations as gateways [this involves
OpenVPN more, I believe]. The LAN should still be invisible to the
routed VPN.
My server routing table is:
172.27.0.2 dev tun0 proto kernel scope link src 172.27.0.1
192.168.20.0/24 dev vmnet8 proto kernel scope link src 192.168.20.1
10.4.1.0/24 via 172.27.0.2 dev tun0
192.168.0.0/24 dev eth0 proto kernel scope link src 192.168.0.71
192.168.0.0/24 dev br1 proto kernel scope link src 192.168.0.72
192.168.30.0/24 dev vmnet1 proto kernel scope link src 192.168.30.1
172.27.0.0/16 via 172.27.0.2 dev tun0
default via 192.168.0.1 dev eth0
IP forwarding is enabled on all interfaces, and iptables (by way of
firehol) has rules to allow all forwarding between all interfaces.
If I create a 172.27.0.0/16 route on a LAN workstation, I can ping the
server at 172.27.0.1. But I cannot reach any VPN workstation. At one
time, by playing with some NAT rules, I was able to - but it didn't seem
right.
What am I missing?
Daniel
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
next reply other threads:[~2007-09-10 6:36 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-09-10 6:36 Daniel L. Miller [this message]
2007-09-10 9:05 ` [LARTC] OpenVPN routing Alex Samad
2007-09-10 20:40 ` Daniel L. Miller
2007-09-10 22:03 ` Alex Samad
2007-09-10 22:48 ` Daniel L. Miller
2007-09-11 2:14 ` Alex Samad
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=46E4E5E2.2070703@amfes.com \
--to=dmiller@amfes.com \
--cc=lartc@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.