Здравствуйте. Есть у меня сервер openvpn на centos. Есть клиенты которые отлично работают через кабель rj45, принесли мне маршрутизатор RB951Ui-2HnD и 3г свисток МТС E3372 с симкой от мтс. Настроил два порта для работы с интернетом это ether1 и ppp-out2, объединил в одну группу, сменил композицию модема, интернет заработал. Подключил к openvpn и обнаружил что клиент не может пинговать других клиентов, только сервер. Если переключить интернет на кабель, все клиенты друг-друга начинают радостно пинговать. В чём может быть подвох?
ppp-out2 (3г интернет)
name="ppp-out2" max-mtu=1500 max-mru=1500 mrru=disabled port=usb2 data-channel=0
info-channel=1 apn="internet.mts.ru" pin="" user="" password="" profile=default phone="*99#"
dial-command="ATDT" modem-init="" null-modem=no
dial-on-demand=no add-default-route=yes default-route-distance=0
use-peer-dns=yes keepalive-timeout=0 allow=pap,chap,mschap1,mschap2
ovpn-out1 (впн соединение)
name="ovpn-out1" mac-address=02:8F:B8:46:3F:BF max-mtu=1500
connect-to=sd.example.ru port=1185 mode=ip
user="client21" password="" profile=default
certificate=client21.crt_0 auth=sha1 cipher=aes128 add-default-route=no
Файрволл клиента
/ip firewall filter print
0 D ;;; special dummy rule to show fasttrack counters
chain=forward action=passthrough
1 chain=input action=accept protocol=icmp log=no log-prefix=""
2 chain=input action=accept protocol=tcp src-address-list=AllowConnect dst-port=8291 log=no log-prefix=""
3 chain=input action=accept protocol=tcp src-address-list=AllowConnect dst-port=22 log=no log-prefix=""
4 chain=input action=accept connection-state=established,related log=no log-prefix=""
5 chain=input action=drop in-interface-list=Internet log=no log-prefix=""
6 chain=forward action=fasttrack-connection connection-state=established,related log=no log-prefix=""
7 chain=forward action=accept connection-state=established,related log=no log-prefix=""
8 X chain=forward action=accept protocol=tcp in-interface=ether1 dst-port=5050 log=no log-prefix=""
9 chain=forward action=accept in-interface=ovpn-out1 out-interface=bridge log=no log-prefix=""
10 chain=forward action=accept in-interface=bridge out-interface=ovpn-out1 log=no log-prefix=""
11 chain=forward action=drop connection-state=invalid log=no log-prefix=""
12 chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=Internet log=no log-prefix=""
/ip firewall nat print
0 chain=srcnat action=masquerade out-interface-list=Internet log=no log-prefix=""
1 chain=srcnat action=masquerade out-interface=ovpn-out1 log=no log-prefix=""
Конфиг сервера openvpn
port 1185
proto tcp
dev tun
ca keys/ca.crt
cert keys/srv-crm.crt
dh keys/dh2048.pem
server 10.8.1.0 255.255.255.0
topology subnet
push "topology subnet"
ifconfig-pool-persist ipp.txt
keepalive 10 120
client-to-client
persist-key
persist-tun
cipher AES-128-CBC
status openvpn-status.log
log openvpn.log
log-append openvpn.log
verb 6
push "dhcp-option DNS 8.8.8.8"
client-config-dir /etc/openvpn/ccd
route 192.168.20.0 255.255.255.0
tun-mtu 1500
mssfix 1450
auth sha1
Файрволл сервера openvpn
iptables-save
# Generated by iptables-save v1.4.7 on Tue Jun 27 14:36:49 2017
*nat
:PREROUTING ACCEPT [22703:2395507]
:POSTROUTING ACCEPT [247:15880]
:OUTPUT ACCEPT [258:16780]
:DOCKER - [0:0]
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A POSTROUTING -o tun0 -j MASQUERADE
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
COMMIT
# Completed on Tue Jun 27 14:36:49 2017
# Generated by iptables-save v1.4.7 on Tue Jun 27 14:36:49 2017
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [62118:14087321]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 1185 -j ACCEPT
-A INPUT -i tun0 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Tue Jun 27 14:36:49 2017
