Как завернуть трафик клиента в OpenVPN тунель?

Question

Максим Шишков @Trumdu

Как завернуть трафик клиента в OpenVPN тунель?

Добрый день. С линуксом не дружу :)
Поднял OpnVPN сервер в режиме моста. Клиент подключается, работает нормально. Сеть сервера - 10.100.100.0
Так же сервер подключен к общей сети с другими отделами. Сетевые папки, пинги, рдп сеансы работают между ними без проблем. Сети 10.16.100.0 и 10.18.100.0
Проблема в том что ВПН клиенты не могут попасть на ресурсы из других сетей.

Конфиг сервера:

mode server
tls-server

local 10.100.100.65 ## ip/hostname of server
port 3392 ## default openvpn port
proto tcp

#bridging directive
dev tap0 ## If you need multiple tap devices, add them here
script-security 2 ## allow calling up.sh and down.sh
up "/etc/openvpn/up.sh br0 eth0"
down "/etc/openvpn/down.sh br0 tap0"

persist-key
persist-tun

#certificates and encryption
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem

cipher BF-CBC # Blowfish (default)
comp-lzo

#DHCP Information
ifconfig-pool-persist ipp.txt
server-bridge 10.100.100.65 255.255.255.0 10.100.100.80 10.100.100.89
push "dhcp-option DNS 10.100.100.7"
max-clients 10 ## set this to the max number of clients that should be connected at a time

#log and security
user nobody
group nogroup
keepalive 10 120
status openvpn-status.log
verb 3

Конфиг клиента:

### Client configuration file for OpenVPN

# SSL/TLS parameters - files created previously
pkcs12 "C:\\Program Files\\OpenVPN\\config\\*РёРјСЏ_СЃРµСЂС‚РёС„РёРєР°С‚Р°*.p12"
remote-cert-tls server

# Specify that this is a client
client

# Bridge device setting
dev tap

proto tcp
# Host name and port for the server (default port is 1194)
# note: replace with the correct values your server set up
remote *.*.*.*3392

# Client does not need to bind to a specific local port
nobind

# Keep trying to resolve the host name of OpenVPN server.
## The windows GUI seems to dislike the following rule.
##You may need to comment it out.
resolv-retry infinite

# Preserve state across restarts
persist-key
persist-tun

# Specify same cipher as server
cipher BF-CBC

# Use compression
comp-lzo

# Log verbosity (to help if there are problems)
verb 3

Вывод таблицы маршрутизации (iptable -L -n) пустой

Вывод ifconfig

br0 Link encap:Ethernet HWaddr 00:15:5d:64:13:0f
inet addr:10.100.100.65 Bcast:10.100.100.255 Mask:255.255.255.0
inet6 addr: fe80::215:5dff:fe64:130f/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:21830 errors:0 dropped:24 overruns:0 frame:0
TX packets:2915 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:6026798 (6.0 MB) TX bytes:1125597 (1.1 MB)

eth0 Link encap:Ethernet HWaddr 00:15:5d:64:13:0f
inet6 addr: fe80::215:5dff:fe64:130f/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:21669 errors:0 dropped:8 overruns:0 frame:0
TX packets:3402 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:6320993 (6.3 MB) TX bytes:1169053 (1.1 MB)

lo Link encap:Локальная петля (Loopback)
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:164 errors:0 dropped:0 overruns:0 frame:0
TX packets:164 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1
RX bytes:12080 (12.0 KB) TX bytes:12080 (12.0 KB)

tap0 Link encap:Ethernet HWaddr 0e:08:0b:1f:47:2f
inet6 addr: fe80::c08:bff:fe1f:472f/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:481 errors:0 dropped:4 overruns:0 frame:0
TX packets:16567 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:42860 (42.8 KB) TX bytes:1183370 (1.1 MB)