Cannot reach 4th hop, pc as router, static routing

Question

I'm trying to set a PC as a Router and somehow it's not working correctly. I have following setting:

CLIENT A
192.168.21.1/28
l
l
192.168.21.5/28
ROUTER X
192.168.21.25/28
l
l
192.168.21.17/28
CLIENT B (with openvpn tunnel to server)
10.29.0.4/22
l
l
10.29.0.1/22
SERVER

The connection from CLIENT B to SERVER is over internet, but it shouldn't matter here.

Now the issue is as following:

• I can ping from ROUTER X the SERVER
• I can ping from CLIENT A the address (CLIENT B) 10.29.0.4 (and with traceroute I can see, that it's going correctly)
• I cannot ping from CLIENT A the SERVER

and the same in opposite direction:

• I can ping from SERVER the address 192.168.21.25 (Router X)
• I cannot ping the address 192.168.21.5

For me it seems like it has something to do with time to live (TTL), because the packets cannot reach 4th hop, but I didn't find anything about it in internet.

route -n on server

192.168.21.16   10.29.0.4       255.255.255.240 UG    17     0        0 tun0
192.168.21.0    10.29.0.4       255.255.255.240 UG    17     0        0 tun0
192.168.20.0    0.0.0.0         255.255.255.0   U     0      0        0 eth1
10.29.0.0       0.0.0.0         255.255.252.0   U     0      0        0 tun0
XXXXXXXX    0.0.0.0         255.255.0.0     U     1002   0        0 eth1
0.0.0.0         YYYYYYYY  0.0.0.0         UG    0      0        0 eth1

On Client B I added two iptables rules:

-A FORWARD -i eth0 -o tun0 -j ACCEPT
-A FORWARD -i tun0 -o eth0 -j ACCEPT

Do you have any idea, what's wrong? Thanks for any input.

Answer 1

It sounds like you are missing a route for 192.168.21.0/28 in one (or both) of two places.

1. If openvpn is running in "server" mode the internal routing table inside openpvn
2. On clientB

Answer 2

The issue is, that OpenVPN in tun-mode manages remote networks internally with iroute parameter.

To resolve this problem, it's necessary to change to tap and add following iptables rules:

iptables -A FORWARD -i eth0 -o tap0 -j ACCEPT
iptables -A FORWARD -i tap0 -o eth0 -j ACCEPT

But then we will get tcp over tcp, what can lead to delays. I don't think there are other solutions for routing with OpenVPN.

The issue was mentioned on https://gitlab.labs.nic.cz/labs/bird/wikis/FAQ#dynamic-routing-issues-with-openvpn