<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html;charset=X-UNKNOWN" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> OK, this still sounds like a classic routing issue, in this case, on server A's part. >From what I can gather, server A's eth2 must use a cable connection with a static IP, and you're using a static NAT entry to translate that 192.168.x.x IP address to that globally routable static IP. That's the only way that packets of any sort could enter eth2 from the outside, which it sounds like is what's happening here. Actually, the way I'd do it is to eschew trying to connect to server A's eth2 at all and just connect to eth1, which sits on that fractional T1. If you're concerned about bandwidth on that fractional T1, then looks like it's time to upgrade that fractional T1 to maybe a full T1 or possibly another type of connection. My cable modem (with a static IP, no less) has a speed of 5Mbps down, 2Mbps up, which is faster than even full T1 speeds, and much less money. Furthermore, I'd make the default route for server A going out eth1, not eth2--otherwise, there's no point to even having the fractional T1 in the first place. That's just money wasted. If my understanding's off here, then is there any way you could do up a diagram and PM it to me? No sense in cluttering the list with graphics. --TP <div class="moz-signature">_______________________________ Do you <a href="http://www.gnu.org">GNU</a>? <a href="http://www.cmosnetworks.com">Microsoft Free since 2003</a>--the ultimate antivirus protection! </div> Julius Szelagiewicz wrote: <blockquote cite="mid:Pine.GHP.4.43.0810301308410.24756-100000@turtle.turtle.com" type="cite"> <pre wrap="">Terrell, Thank you for the speedy response. I see that I made my usual mess when asking a simple question, so I'll try to to clean it up: server A: eth1 routable public address 74.x.x.x, frac T1, eth2 cable non-routable address 192.168.x.x, fast, default route openvpn run as server and client server B: eth1 cable, non routable 10.10.x.x openvpn run as client only server C: eth1 routable public address 65.x.x.x openvpn run as server and client server D: eth1 routable public address 216.x.x.x openvpn run as server server A connects as openvpn client to server D using default route and to server C on 65.x.x.x using eth2 by the way of a simple ip route add command. server B connects as openvpn client to server C on 65.x.x.x server B needs to connect as openvpn client to server A on 74.x.x.x, this fails because on server A the UDP packets come on eth2, but responses go on eth1. The address of server B is private (ISP provided) and changes dynamically. What do I do to make server B connect to server A using openvpn? I hope that is clearer. Btw, your answer is spot on for the question I asked instead of the question I meant to ask. julius On Thu, 30 Oct 2008, [ISO-8859-1] "Terrell Prud� Jr." wrote: </pre> <blockquote type="cite"> <pre wrap="">Julius Szelagiewicz wrote: </pre> <blockquote type="cite"> <pre wrap="">Dear Folks, I am somewhat stumped with a simple networking scenario: eth0 - internal, eth1 - external fast, dhcp non-routable, default route, eth2 - external public address not very fast. I am using openvpn and for connections to other servers I can easily specify which interface to use. What I need to do is to connect to openvpn server process on eth2. Unfortunately packets come in on eth2 but travel out on eth1 - default. Source based routing is no help, since I am not just passing the packets based on the incoming interface, but I'm trying to push responses on eth2. Essentialy, on receipt on eth2 of an UDP packets on port 1194 I need to answer with UDP packet om port 1194 on eth2. The computers trying to connect have only private addresses from cable ISPs. Any suggestions? Please ... julius </pre> </blockquote> <pre wrap="">What I'd do is make a static route for this OpenVPN server, pointing to eth2's next hop. Something like this: thedude@linuxbox# route add -host w.x.y.z gw a.b.c.d where w.x.y.z is the OpenVPN box that you want to talk to, and a.b.c.d is eth2's next-hop router. Now, if you have a bunch of OpenVPN boxes in the same subnet that you have to talk to--for example, the 44.55.66.0/24 network, I'd do it like this: thedude@linuxbox# route add -net 44.55.66.0 netmask 255.255.255.0 gw a.b.c.d where, again, a.b.c.d is eth2's next hop. --TP _______________________________ Do you GNU <a class="moz-txt-link-rfc2396E" href="http://www.gnu.org"><http://www.gnu.org></a>? Microsoft Free since 2003 <a class="moz-txt-link-rfc2396E" href="http://www.cmosnetworks.com"><http://www.cmosnetworks.com></a>--the ultimate antivirus protection! </pre> </blockquote> <pre wrap=""> _______________________________________________ K12OSN mailing list <a class="moz-txt-link-abbreviated" href="mailto:K12OSN@redhat.com">K12OSN@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/k12osn">https://www.redhat.com/mailman/listinfo/k12osn</a> For more info see <a class="moz-txt-link-rfc2396E" href="http://www.k12os.org"><http://www.k12os.org></a> </pre> </blockquote> </body> </html>