0

I have 2 networks and I want to build a VPN tunnel between these networks. Currently this is how it looks like:

network topology

On the main side, the vpn server is on its own linux device separate from the router! On the secondary side, the vpn client is on the router itself. The router is an OpenWRT router and is intended only for the purpose as a VPN router. I'm having trouble configuring the server and server lan to build a full site to site connection between the two.

Every client in the main network should reach every client in the secondary network and vice versa.

The OpenWRT/openWRT router connects to the main site and it reaches each device in the network (via SSH on the OpenWRT router a ping on for example 10.0.254.254 successful), but no client of this site reaches the main site, no matter which static routes I set. EXCEPT I configure the client that all requests will be redirected to the destination network (redirect-gateway def1).

In this way each connection is forwarded (which is not optimal, because I want to use the local internet connection) and I reach all clients of the secondary network, BUT, Unfortunately, it does not work the other way around. Main Site -> Secondary Site.

No matter what I've tested, a connection from the main site to the sec site I did not manage in the last few days.

many write about how to use iroute, push route and route. I can not find a suitable scenario which does the routing properly. Some say I have to write this into /etc/openvpn/ccd/clientname and some say that it is not needed.

I am getting confused now. I hope for answers that help me to solve this issues. That should not be that hard - although i've already read that wireguard is better on that subject, i would still like to try ovpn

what do I have to do to make it work?

I have already tried this:

https://openwrt.org/docs/guide-user/services/vpn/openvpn/extra#site-to-site https://forum.openwrt.org/t/openvpn-site-to-site-vpn/37259 https://openwrt.org/docs/guide-user/services/vpn/openvpn/client

Improve this question

1 Answer 1

Reset to default
0

You need to add a 10.0.0.0/16 route on the second router, and a 10.10.0.0/16 route on the main router. So:

route 10.10.0.0 255.255.0.0
push "route 10.0.0.0 255.255.0.0"

in the server conf should do. The former is for the server (main router), the latter is for the client (second router).

You do need iroute as well (for 10.10.0.0/16), unless you are not using mode server (which is implied by server), as that assumes there will be multiple clients, and the iroute tells the server which client should be receiving the specific traffics. Make sure you have client-config-dir in the server conf pointing the directory that consists of the file with the iroute (and the file itself needs to be named with the client's "Common Name").

Improve this answer
11
  • Now i can ping from sec site router to main side, but my sec site clients can not ping to main site. I am still not able to get this working. I am sure that i am missing some route on my main router and my sec router for the clients. how should the router on the main site know that he should direct certain packages to 10.0.254.1?
    – 0xPYTHONIC
    Commented Dec 7, 2019 at 6:50
  • server.conf(main site vpn machine): pastebin.com/raw/JYFXhhC4 ccd/Administartor(main site vpn machine): pastebin.com/raw/1q1kvgJQ client.conf (sec site router): pastebin.com/raw/6WMJdwhh
    – 0xPYTHONIC
    Commented Dec 7, 2019 at 7:21
  • Oh actually I missed the fact that the VPN server is not on the main router. In that case you need to make sure IP Forwarding is enabled on the server, so that traffics can go back and forth from the tunnel to the LAN. You should also add static route for 10.10.0.0/16 on the main router (with the VPN server's LAN IP as gateway). (Or add it on every host in the main side LAN)
    – Tom Yan
    Commented Dec 7, 2019 at 7:21
  • Static route: i think it should be better to use the vpn server lan as gateway 10.0.254.1 IP. when i try to use the 10.101.0.6 as gateway in static route the packets will be forwardet in to the internet. this is how it looks like from a client in main site with static route in router (It looks like the route stops at my vpn server): 1 <1 ms <1 ms <1 ms [10.0.254.254] 2 <1 ms <1 ms <1 ms [10.0.254.1] 3 * ^C
    – 0xPYTHONIC
    Commented Dec 7, 2019 at 7:53
  • IP Forwarding: sysctl -w net.ipv4.ip_forward=1
    – 0xPYTHONIC
    Commented Dec 7, 2019 at 7:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .