Route ip range traffic through openvpn

[bzg]

Hello All,

I have a strange problem I can't resolve since two weeks, almost everything is working well, just one thing that I can imagine, why. Let's see the details:

• site A subnet: 10.0.0.0/22

• site A Client Group A: 10.0.0.10 - 10.0.0.200

• site A Client Group B: 10.0.0.201 - 10.0.0.250

• site A public IP: x.x.x.65/24

• site B subnet: 10.0.100.0/22

• site B public IP1: y.y.y.1/24

• site B public IP2: y.y.y.25/28

• OpenVPN Site to site VPN Server (Site A): 192.168.100.1

• OpenVPN Site to site VPN Client (Site B): 192.168.100.2

I have to configure the following:

• a) Site A: all traffic from Client Group B must be routed through OpenVPN - site B public IP2 (y.y.y.25/28)

• b) Site A: all traffic from Client Group A must be routed through site A public IP (x.x.x.65/24)

• c) Site B: all traffic from Client Group C must be routed through site B public IP1 (y.y.y.1/24)

I'm done with:

• c) Done: simple NAT on site B public IP1 (y.y.y.1/24)

• b) Done: simple NAT on site A public IP (x.x.x.65/24)

• a) I did the followings:

  • OpenVPN Site to site VPN: Done

  • Site A: create IP Alias IPRANGE1 with IP range 10.0.0.201 - 10.0.0.250

  • Site A: assign interface OPT1 to OpenVPN interface ovpn1

  • Site A: create Firewall Rule on LAN interface:

  • Action: pass

  • Interface: LAN

  • Source: Single host or alias: IPRANGE1

  • Protocol: any

  • Advanced - Gateway: OPT1_VPNV4 (name assigned automatically)

  • Site B: create Virtual IP:

  • Name: VIP1

  • Type: IP Alias

  • Address: y.y.y.25/28

  • Site B: create Outbound NAT rule

  • Interface: WAN

  • Source: site A Client Group A

  • NAT Address: WAN Address

Up to this point everything is working, if I check the http://www.whatsmyip.org/ the result is what is expected: y.y.y.1/24, as well in case of SSH and FTP the remote site returns IP: y.y.y.1/24.

But if I change the step "Site B: create Outbound NAT rule" and replace the NAT Address to VIP1, then the result is not clear:

• if I use SSH then the remote site returns the VIP1 adress: y.y.y.25/28

• if I use HTTP with a very basic (no ADS, no JS, etc…) site then the remote site returns the VIP1 address: y.y.y.25/28

• but if I try again the http://www.whatsmyip.org/ then the page is not loaded, I see in statusbar the message connecting. Sometimes the IP is okay, but no stylesheet is loaded, etc…

Any idea what am I wrong? Howto resolve this issue?

Kind Regards,