Community discussions

MikroTik App
 
Pilgrim
Member Candidate
Member Candidate
Topic Author
Posts: 265
Joined: Sun Mar 30, 2008 1:04 pm

OpenVPN routing

Wed Mar 04, 2015 11:10 am

We have set up an OpenVPN access to our internal file server, but is struggling to get the routing right. For testing purpose we just have one client access for now.
We finally got the certificates right with the help of the posting from boen-robot and the client connects to the OpenVPN fine.

The LAN / subnet we are trying to connect to is 10.0.0.0 and the Open VPN is established using 192.168.100.1 and 192.168.100.2 as remote and local address.

For now we are just using the standard OpenVPN port 1194 (TCP) IP/TUN.

The file server we want to connect to is on 10.0.0.51 and the server works fine and is accessible from LAN side.
After the first attempt to ping the server over the vpn connection we could see in the log that packets was dropped icm 192.168.100.001 -> 10.0.0.51 forward chain. We added a rule in top of the firewall to open for all traffic from 192.168.100.001 and as far as I can see there is nothing that get droppen in the firewall now, but we are still not able to ping / access anything on the lan side through the vpn.

When connecting we see the “OVPN server binding interface” OVPN-Client is being established with status DR and at the same time a default route 192.168.100.1 gateway=OVPN-client, but we are still not able to access anything on the LAN.

Can anyone guide me in the direction to identify the problem?
 
Fabian
just joined
Posts: 8
Joined: Wed Mar 04, 2015 3:23 pm

Re: OpenVPN routing

Wed Mar 04, 2015 4:54 pm

Does the server (10.0.0.51) have a route back to the router for subnet 192.168.100.0/24 (or a default route) ?

Is there a LAN firewall in place which could drop any return traffic ?
 
Pilgrim
Member Candidate
Member Candidate
Topic Author
Posts: 265
Joined: Sun Mar 30, 2008 1:04 pm

Re: OpenVPN routing

Wed Mar 04, 2015 11:22 pm

I been trying if I could mangle the traffic and set up a rule for 10.0.0.51 -> 192.168.0.0/24 but did not find a good way.

The default route in the router providing access to the internet is 0.0.0.0 gw int.1

I want all traffic src IP 10.0.0.51 dest. 192.168.0.0/24 to be routed towards 10.0.1.2 gw 10.0.1.1 and then on to 192.168.0.0 but I am not successful.

In fact I would like all hosts on 10.0.0.0/24 to be able to access 192.168.0.0/24
smb problem.jpg
You do not have the required permissions to view the files attached to this post.

Who is online

Users browsing this forum: RogerWilco and 40 guests