OpenVPN ssh/ping client to client

Question

I am wondering how I should do this. I can reach both clients (nielswork en nielsnet from the OpenVPN server (Ubuntu 18.04 LTS): nielsserver) but I would also like to reach nielsnet from nielswork and vice versa, via the VPN. All the machines are in the same network (10.8.0.0/24) and IP forwarding is turned on on the server. The weird thing is that they all have different gateways, although I'm not sure this is the problem. I am not pushing any routes to clients (yet) and I'm not using the VPN for all my traffic, just NFS/SSH. Here is the output of route for the tun0 devices.

ON NIELSWORK (CLIENT1):

10.8.0.1        10.8.0.9        255.255.255.255 UGH   50     0        0 tun0
10.8.0.9        *               255.255.255.255 UH    50     0        0 tun0

ON NIELSSERVER (OPENVPN SERVER)

10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0

ON NIELSNET (CLIENT2):

10.8.0.1        10.8.0.5        255.255.255.255 UGH   50     0        0 tun0
10.8.0.5        *               255.255.255.255 UH    50     0        0 tun0

Answer 1

The whole thing seems to be properly solved by uncommenting

;client-to-client

in /etc/openvpn/server.conf

which states in the file itself:

# Uncomment this directive to allow different
# clients to be able to "see" each other.
# By default, clients will only see the server.
# To force clients to only see the server, you
# will also need to appropriately firewall the
# server's TUN/TAP interface.

Although the weird thing that all the clients and the server have a different gateway in routing table, they can now happily communicate with eachother.

Answer 2

If you are using openvpn-as as VPN server, you just need to allow routing in private subnets.

This can be achieved in "VPN settings" section of admin webgui:

1. at the question "Should VPN clients have access to private subnets", set "yes using routing" or "yes using NAT"
2. then add the private subnet in list below (e.g. 172.27.224.0/20)
3. save and apply on running server, this is done.