Openvpn virtual subnet nat

NETWORKING SOLUTIONS
1

Hello,

I have an RUT301 router and I am trying to establish an OpenVPN connection to my OpenVPN server. There are other routers connected to this server that are working correctly with this setup, such as those running vanilla OpenWrt.

My goal is to access the LAN side of the RUT301 from the OpenVPN server. All of our routers use the 192.168.174.0/24 subnet on the LAN side. To avoid IP address conflicts on the server side, I use a virtual subnet for each router. The router is supposed to perform NAT from the virtual subnet to its actual LAN subnet.

I have a CCD (Client Configuration Directory) file for OpenVPN with the following configuration:

ifconfig-push 10.8.1.33 255.255.252.0
iroute 10.10.33.0 255.255.255.0
push "client-nat snat 192.168.174.0 255.255.255.0 10.10.33.0"

In this setup:

  • The OpenVPN client IP is 10.8.1.33.
  • The virtual subnet is 10.10.33.0/24.

On other routers, this configuration works correctly, and the following directive allows traffic to be NATed as expected:

push "client-nat snat 192.168.174.0 255.255.255.0 10.10.33.0"

From the server, I can successfully ping 10.8.1.33, but I cannot ping 10.10.33.1 or 10.10.33.2 (which is a Siemens PLC). This suggests that the source NAT is not being applied.

I also tried creating SNAT rules manually using POSTROUTING in iptables as well as configuring them through the web UI, but the ping still does not return. It seems that the NAT rules are not working on the RUT301, even though they work fine on other routers.

Does anyone have any idea what could be causing this issue on the RUT301?

Kind regards,

3

Hello,

Apologies for the delay. Could you please confirm whether the issue you described earlier is still unresolved? If the SNAT from the OpenVPN virtual subnet to the LAN subnet still isn’t working on the RUT301, we’ll need to investigate it more in-depth.

However, to troubleshoot it further, we would need to gather some sensitive and non-public information; thus, we’ll need to contact you privately. Please let me know if the issue still persists so I can send you a form to submit and reach out to you in private.

Kind regards,

4

This topic was automatically closed after 60 days. New replies are no longer allowed.