OpenVPN: Connecting 2 private networks

Hi Networkers!

We want to connect 2 private networks over a public network using OpenVPN-1.5.0

Network-A 192.168.28.0/24
Host 192.168.28.26 tun0 10.192.168.28/10.192.168.56
routing network 192.168.56.0/24 to gw 10.192.168.56

Network-B 192.168.56.0/24
Host 192.168.56.13 tun0 10.192.168.56/10.192.168.28
routing network 192.168.28.0/24 to gw 10.192.168.28

We can "ping" the tunnel end points, so the connection works in general.

But if 192.168.28.26 does a ssh to 192.168.56.13, the connection is shown at
192.168.56.13 coming from 10.192.168.28. We think this is wrong, the connection
should show up coming from 192.168.28.26.

Given this fact, how to get from any host in Network-A to any host in Network-B
if all connections seem to come from the tunnel end at the destination host?

Kernel IP routing table on 192.168.28.26:
Destination Gateway Genmask Flags Metric Ref Use Iface
10.192.168.56 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.28.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.56.0 10.192.168.56 255.255.255.0 UG 0 0 0 tun0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
0.0.0.0 192.168.28.1 0.0.0.0 UG 0 0 0 eth0

The config file on 192.168.28.26 reads:

# /usr/local/OpenVPN/etc/eyuphuro.cf
# ---------------------------------- VPN with eyuphuro

# daemon eyuphuro
local 192.168.28.26
remote 194.95.226.***
proto udp
port 5000
dev tun0
ifconfig 10.192.168.28 10.192.168.56
route 192.168.56.0 255.255.255.0
disable-occ
ping 15
verb 4
persist-tun
persist-local-ip
persist-remote-ip
comp-lzo

Routing table and configuration file on 192.168.56.13 are nearly identical but
with IP addr settings adopted.

If this is not sufficient more information can be given.


Kind regards, Frank Elsner

Frank Elsner <(E-Mail Removed)> wrote:
> Network-A 192.168.28.0/24
> Host 192.168.28.26 tun0 10.192.168.28/10.192.168.56
> routing network 192.168.56.0/24 to gw 10.192.168.56

> Network-B 192.168.56.0/24
> Host 192.168.56.13 tun0 10.192.168.56/10.192.168.28
> routing network 192.168.28.0/24 to gw 10.192.168.28

> But if 192.168.28.26 does a ssh to 192.168.56.13, the connection is
> shown at 192.168.56.13 coming from 10.192.168.28. We think this is
> wrong, the connection should show up coming from 192.168.28.26.

Host 192.168.28.26 is multihomed, and is also 10.192.168.28. Therefore
when you talk to a node on 192.168.56.0/24 it can be seen as either
interface. Generally you get the interface "nearest" your route, which
is why you see the 10. address rather than your preferred 192. one.

> Given this fact, how to get from any host in Network-A to any host in
> Network-B if all connections seem to come from the tunnel end at the
> destination host?

They shouldn't. Have you tried it?

Chris