OpenVPN, RRAS. Can't see the network behind the client

Question

openvpn

There is a network. OS Windows Server 2008 r2.


Server 2 has the RRAS role installed. NAT configured.

The problem is that User 1 does not see User 2.

Server 1 configuration (OpenVPN server)

port 1194
proto udp
dev tap
dev-node OpenVPN
ca «C:\\Program Files\\OpenVPN\\keys\\ca.crt»
cert «C:\\Program Files\\OpenVPN\\keys\\s-004.crt»
key «C:\\Program Files\\OpenVPN\\keys\\s-004.key»
dh «C:\\Program Files\\OpenVPN\\keys\\dh1024.pem»
server 172.16.11.0 255.255.255.0
ifconfig-pool-persist ipp.txt
route 172.17.0.0 255.255.0.0
push «route 172.16.11.0 255.255.255.0»
push «route 172.16.12.0 255.255.255.0»
push «dhcp-option DNS 172.16.12.2»
client-config-dir «C:\\Program Files\\OpenVPN\\ccd»
client-to-client
keepalive 10 120
duplicate-cn
persist-key
persist-tun
status openvpn-status.log
verb 3

Server 2 client configuration in ccd folder

ifconfig-push 172.16.11.11 255.255.255.0
iroute 172.17.0.0 255.255.0.0

Server 2 configuration

client
dev tap
dev-node OPENVPN
proto udp
remote [адрес сервера OpenVPN] 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert s-008.crt
key s-008.key
ns-cert-type server
verb 3

The output of the route print User 1 (OpenVPN client) command

IPv4 таблица маршрута
===========================================================================
Активные маршруты:
Сетевой адрес Маска сети Адрес шлюза Интерфейс Метрика
0.0.0.0 0.0.0.0 172.16.12.1 172.16.12.4 261
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
172.16.12.0 255.255.252.0 On-link 172.16.12.4 261
172.16.12.4 255.255.255.255 On-link 172.16.12.4 261
172.16.15.255 255.255.255.255 On-link 172.16.12.4 261
172.17.0.0 255.255.0.0 172.16.11.11 172.16.12.4 6
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 172.16.12.4 261
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 172.16.12.4 261
===========================================================================
Постоянные маршруты:
Сетевой адрес Маска Адрес шлюза Метрика
0.0.0.0 0.0.0.0 172.16.12.1 По умолчанию

Answer 1

The fact of the matter is that there are no typos anywhere. The problem is in the RRAS service on Server 2. It is not clear why he does not want to natit traffic.

Answer 2

tracert where shuts up? Are there pings before 172.16.11.11?

Answer 3

And how is NAT configured on Server 2. If you send traffic from User 2 using RRAS to Server 2, you actually hide the 172.17.0.0/16 network from the 172.16.12.0/24 and 172.16.11.0/24 networks. Those. if you and User 1 will be sent to IP from 172.17.0.0, then the packet will arrive there 172.16.12.2 <-> 172.17.0.2, because routing between servers, and Server 2 knows its network, therefore it will push the packet according to the on-link route. But back, when User 2 answers, Server 2 will intercept his packet and NAT will replace the source address with the server address. And now look at the request 172.16.12.2 <-> 172.17.0.2, and the response 172.16.11.11 <-> 172.16.12.2. Of course, the response request will not be processed, because. User 1 will not understand what it is the answer to.
Total: Neither RRAS nor VPN has anything to do with it. The problem is in the concept. Either you need to do Network<->Network routing, or configure NAT on Server 2 to forward ports, and push them to the client's IP (User 2), well, address accordingly to IP Server 2 (which is the end of the OpenVPN tunnel), but I would do The first option is simpler, more flexible and more logical. The OpenVPN settings here, in general, do not matter, it would be better if they brought the RRAS settings.

Answer 4

why do you need NAT?
1. configure for user2 issuance of a subnet from user1, it is better to do this through ccd.