I'm using openVPN to access the cluster from outside the campus. But I only want a few ssh clients(Putty, WinSCP) to go through the VPN traffic.
By reading several posts and wiki, I know there is a technique called splitting tunnel for openVPN. Specifically the "route" command in the .ovpn configuration file will create a row in the routing table and only the ip addresses matching the pattern will be directed to the VPN tunnel.
I got the solution from this post and added the ip address of one the login node
route-nopull
route 128.111.123.456 255.255.255.255
and it worked.
In fact openVPN can parse the hostname every time after connecting
route-nopull
allow-pull-fqdn
route xxx.xxx.edu 255.255.255.255
I checked the log file and it was basically a "route add" and the login node ip address appears in route print output.
Now I want to add a subnet to VPN traffic(there are several servers within a subnet),
route-nopull
route 128.111.0.0 255.255.0.0
but then I can't ssh to the login node. Putty prompted the error message: server unexpectedly closed connection, which is the same as VPN is down. The log shows the "route add" command is executed successfully, and the "route print" command shows the "128.111.0.0" entry is there with the correct vpn gateway.
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.100 20
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
128.111.0.0 255.255.0.0 128.111.61.1 128.111.61.143 30
128.111.61.0 255.255.255.0 On-link 128.111.61.143 286
128.111.61.143 255.255.255.255 On-link 128.111.61.143 286
128.111.61.255 255.255.255.255 On-link 128.111.61.143 286
192.168.1.0 255.255.255.0 On-link 192.168.1.100 276
192.168.1.100 255.255.255.255 On-link 192.168.1.100 276
192.168.1.255 255.255.255.255 On-link 192.168.1.100 276
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.1.100 276
224.0.0.0 240.0.0.0 On-link 128.111.61.143 286
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.1.100 276
255.255.255.255 255.255.255.255 On-link 128.111.61.143 286
===========================================================================
Where am I wrong in the configuration file?
Thanks.
EDIT
There is a post for the same problem. But in that case, the "route add" command was not successfully executed because of the incorrect netmask. I did not made the same mistake, the ip address with the netmask was shown in "route print".