networks behind 2 OpenVPN servers don't see each other

moonman

Hello,

I have 2 OpenVPN servers setup:

Site-to-Site

Main site is 192.168.1.0/24 (Server is here)
Second site 10.10.0.0/24 (Client)
Connected via 10.0.8.0/24 intermediate

Remote Access with a couple of clients

Server is the same is in (1), running as a second server 192.168.1.0/24
Clients get an IP in 10.0.9.0/24

I can browse both ways in Site - to -Site setup so 192.168.1.0 <=> 10.10.0.0 so we are good here

Let's say I connect my phone to the second OpenVPN server and on my phone I have access to everything in 192.168.1.0 but I do not have access to anything on the other side of site-to-site (10.10.0.0)

Essentially anything behind first OpenVPN server does not have access to anything behind second OpenVPN server.
What am I missing here? Any pointers would be appreciated.

jimp

Your description is contradicting itself. You say site-to-site works, but from a remote access client it doesn't, so it sounds like it's mostly working, not that one server can't see behind another.

Invariably these issues always come down to two things:

Routes -- Clients must receive a route for the other network, and the other network must also have a route to send it back over its site-to-site connection. On the remote access server, add the far side as a "local network". On the other side of the site-to-site, add it as a "remote network".
Rules -- Firewall rules on the OpenVPN tab must allow the traffic in question to pass.

moonman

Thank you, You steered me in the right direction to double check all my routes.

I fixed the problem by replacing push "route 10.0.9.0 255.255.255.0" with route 10.0.9.0 255.255.255.0 on Site-To-Site connection server side. I guess I put it there by mistake.

For anyone readying this in the future here are additional steps to make this work:

Site-to-Site:

server side: add route 10.0.9.0 255.255.255.0 to "Custom options" field
client side: add 10.0.9.0/24 to "IPv4 Remote network " field (in addition to 192.168.1.0/24)

Remote access:

server side: add push "route 10.10.0.0 255.255.255.0" --> will probably work without this if you route all traffic via this tunnel from the client.