Need a mobile client OpenVPN to reach a site behind another Openvpn site-2-site

sheprador

Openvpn.drawio.png

Hello,
I need to be able to do with OpenVPN something that I used to do with IPSec, which there is called "Hub and spoke": with a laptop I connect to site A and see the LAN, without problems. (all traffic from the client is routed through the VPN as soon as it is established).
Now, Site A is also connected with Site B via a site-to-site VPN.
I would like the client that connects to Site A (192.168.0.0.(24) to also be able to reach the networks of Site B (192.168.30.0/24,10.100.0.0/24 and 10.150.0.0/24).
Do you know if and how it is possible to do this?
Thank you

viragomann

@sheprador said in Need a mobile client OpenVPN to reach a site behind another Openvpn site-2-site:

with a laptop I connect to site A and see the LAN, without problems. (all traffic from the client is routed through the VPN as soon as it is established).

You mean, all upstream traffic is routed through the VPN, i.e. you have checked "redirect gateway" in the server settings.

Then you need to route the remote access server tunnel network from B to A.
How to do this, depends on the site-to-site setup. Assuming A is the server, just add the tunnel road warrior tunnel network to the remote networks at B.

JKnott

@sheprador

You'll have to ensure there's a route from the mobile client to B. Normally, you'd manually configure a route to B from A. The client will use A as the default route and then A will forward packets to B and back.

sheprador

@viragomann

Thank you. It worked following your indication.

For the benefit of others I add that I did this.

On the server - which is Site B in the schema - I added the CIDR of the client remote access VPN tunnel (10.10.10.0/24).

Then in VPN / OpenVPN / edit the VPN Server and
add 10.10.10.0/24 in IPv4 Remote network(s)

Then, in VPN / OpenVPN / Client Specific Overrides I had to add the exact same thing in (10.10.10./24 IPv4 Remote Network/s)

If I had added the tunnel route only in the server configuration or only in Client Specific Overrides I saw that it didn't work.

thank you very much