Configurare retea VPN

Salutare,

am o problema legata de configurarea unei retele VPN:

- server OpenVPN (Debian): IP 192.168.1.50 / 10.8.0.1
- client ddWRT: IP 192.168.7.10 / 10.8.0.4

Am ping de pe 192.168.7.10 catre 192.168.1.x, de pe 10.8.0.4 catre 10.8.0.1
Nu am ping de pe 192.168.1.50 catre 192.168.7.10
Mai exact pot ajunge cu ping pana in 192.168.7.1, dar nu pot ajunge mai departe in lan.
Are cineva idee unde gresesc?

Multumesc.

Edited by nacks, 24 August 2023 - 08:08.

nu gresesti nicaieri, asa functioneaza vpn-ul    

born2lose, on 24 august 2023 - 09:31, said:

Nu cred…

@initiator
E site-to-site din ce vad nu?
O retea e 192.168.1.x/yy si a doua e 192.168.7.x/zz iar vpn-ul 10.8.0.x/qq.
Teoretic iti trebuie o ruta statica adaugata practic pana nu pui config-urile server/client doar ne dam cu presupusul.

@ogo

Config server:
port 1xxx
proto udp
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
# push "dhcp-option DNS 94.140.14.14"
# push "dhcp-option DNS 94.140.15.15"
# push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key
crl-verify crl.pem
ca ca.crt
cert server_xxxxxxxxxxxxxxxxxx.crt
key server_xxxxxxxxxxxxxxxxxx.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
client-config-dir /etc/openvpn/ccd
status /var/log/openvpn/status.log
log /var/log/openvpn.log
verb 3

Config client:
client
proto udp
explicit-exit-notify
remote xx.xx.xx.xx 1xxx
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name server_xxxxxxxxxxxxxxxxxx name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
ignore-unknown-option block-outside-dns
setenv opt block-outside-dns # Prevent Windows 10 DNS leak
verb 3

CCD:
ifconfig-push 10.8.0.6 255.255.255.0
push "route 192.168.1.0 255.255.255.0"

Edited by nacks, 24 August 2023 - 10:15.

Unde ruleaza serverul? Pe router sau pe alt device in spatele lui?
Ce OS are serverul?

ogo, on 24 august 2023 - 10:33, said:

Ruleaza pe un server din spatele lui (router 192.168.1.1 / server 192.168.1.50)
OpenVPN - Debian.

Adica serverul iti raspunde la ping dar clientul nu, pe adresele de vpn ? Altfel nu vad cum sa ai ping pe adrese ip de uz privat in retele diferite.

Edited by Leo2006, 24 August 2023 - 12:55.

De fapt trebuie sa mearga si pe ip privat.
https://superuser.co...to-site-network

e setat site-to-site sau client-only?

[cred ca] iti trebuie push route catre toate subnet-urile precum si o ruta statica in clients.conf catre gateway-ul ce stie subnet-urile tale.

Leo2006, on 24 august 2023 - 12:51, said:

Stii ce-a zis cand a vazut girafa? Ca nu EXISTA...asa si tu acum...
via vpn se poate face orice

Quote

Nu stiu sa spun exact, unde sa verific?

Edited by nacks, 24 August 2023 - 18:47.

nu mi-am mai batut capul de ani cu openvpn de cand am descoperit wireguard...

revenind,
in router-ul din fata clientului ddwrt (care cred ca e 192.168.7.1) iti trebuie o ruta pt 10.8.0.0/255.255.255.0
iar in config-ul de openvpn iti trebuie un pushroute  catre 192.168.7.0 255.255.255.0
posibil ca in ddwrt sa iti mai trebuiasca si ceva de genul  iptables -I FORWARD -s 192.168.0.0/16 -j ACCEPT
regula de iptables e generala sa acopere toate subneturile private 192.168.* dar ar trebui sa o customizezi conform nevoilor tale.

site-to-site e cand contectezi 2 routere la serverul de vpn a.i. clientii din spatele lor (ruterelor) sa comunice intre ei.

PS
uite aici mai multe detalii:
https://github.com/O...les/server.conf

 ogo, on 25 august 2023 - 00:37, said:

Am adaugat "10.8.0.0 255.255.255.0", aveam deja 192.168.7.0 255.255.255.0 si am facut forward in iptables, dar tot nu pot trece mai departe in lan ... ajung cu ping doar pana in 192.168.7.1
Am instalat OpenVPN client pe Windows si functioneaza, dar prin ddwrt / openwrt nu.
Cred ca lipseste o ruta undeva, dar nu imi dau seama unde.

Edited by Ravy, 25 August 2023 - 09:37.