I have two isolated home networks. One connected to the internet, and a second one for disconnected IOT devices.
I connected an Ubuntu server to both of these networks using separated network cards.
I verified that I can access data from devices in both networks from this server (using the good old
curl to fetch http requests). An I can also access the internet from it.
I then installed OpenVPN, and set it up using the instructions from serverspace.
Next step I configured a client and was able to connect to this vpn server from the internet.
When the client is connected it can access the internet and one of the internal networks, but not the other.
from the vpn server, executing
route -n I get:
0.0.0.0 184.108.40.206 0.0.0.0 UG 100 0 0 eno1 0.0.0.0 220.127.116.11 0.0.0.0 UG 200 0 0 eno2 10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0 18.104.22.168 0.0.0.0 255.255.255.0 U 100 0 0 eno1 22.214.171.124 0.0.0.0 255.255.255.255 UH 100 0 0 eno1 126.96.36.199 0.0.0.0 255.255.255.0 U 200 0 0 eno2 188.8.131.52 0.0.0.0 255.255.255.255 UH 200 0 0 eno2
The vpn client connects to the network
10.8.0.0 and it is assigned the ip address
The connected vpn client:
- can access the network
- can access the internet.
- cannot access any ipaddress from
What is missing on my configurations to allow the vpn clients to access this second network?
I tried adding the NAT commands from the script for eno2 (13.x), but it still did not work...
I modified the created file
/etc/iptables/add-openvpn-rules.sh with the following content (the part before the space was automatically created by the script):
#!/bin/sh iptables -t nat -I POSTROUTING 1 -s 10.8.0.0/24 -o eno1 -j MASQUERADE iptables -I INPUT 1 -i tun0 -j ACCEPT iptables -I FORWARD 1 -i eno1 -o tun0 -j ACCEPT iptables -I FORWARD 1 -i tun0 -o eno1 -j ACCEPT iptables -I INPUT 1 -i eno1 -p udp --dport 1194 -j ACCEPT iptables -t nat -I POSTROUTING 1 -s 10.8.0.0/24 -o eno2 -j MASQUERADE iptables -I FORWARD 1 -i eno2 -o tun0 -j ACCEPT iptables -I FORWARD 1 -i tun0 -o eno2 -j ACCEPT iptables -I INPUT 1 -i eno2 -p udp --dport 1194 -j ACCEPT
I got the following after a reboot:
-P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -A INPUT -i eno2 -p udp -m udp --dport 1194 -j ACCEPT -A INPUT -i eno1 -p udp -m udp --dport 1194 -j ACCEPT -A INPUT -i tun0 -j ACCEPT -A FORWARD -i tun0 -o eno2 -j ACCEPT -A FORWARD -i eno2 -o tun0 -j ACCEPT -A FORWARD -i tun0 -o eno1 -j ACCEPT -A FORWARD -i eno1 -o tun0 -j ACCEPT