I have two sites running ER-X with EdgeOS 1.9.1 with openVPN connecting to one site (site A). I can ping both sides of the vtun0 interface at either site and can ping from Site B the subnet at site A that are routed via a static route, but not the other way around
Site A:
$ show ip route
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2> - selected route, * - FIB route, p - stale info
IP Route Table for VRF "default"
S *> 0.0.0.0/0 [210/0] via 24.235.144.1, eth0
S *> 10.249.16.0/23 [1/0] via 10.249.48.9 (recursive via 24.235.144.1 )
*> [1/0] via 10.249.47.9, tun0
*> [1/0] via 10.249.47.2, vtun0
C *> 10.249.32.0/24 is directly connected, switch0
C *> 10.249.33.0/24 is directly connected, eth4
K *> 10.249.47.0/29 [0/0] via 10.249.47.2, vtun0
C *> 10.249.47.1/32 is directly connected, vtun0
C *> 10.249.47.2/32 is directly connected, vtun0
C *> 10.249.47.8/31 is directly connected, tun0
C *> 24.235.144.0/20 is directly connected, eth0
C *> 127.0.0.0/8 is directly connected, lo~$ ping 10.249.47.9 PING 10.249.47.9 (10.249.47.9) 56(84) bytes of data. 64 bytes from 10.249.47.9: icmp_req=1 ttl=64 time=34.7 ms 64 bytes from 10.249.47.9: icmp_req=2 ttl=64 time=31.1 ms 64 bytes from 10.249.47.9: icmp_req=3 ttl=64 time=39.3 ms 64 bytes from 10.249.47.9: icmp_req=4 ttl=64 time=29.7 ms ^C --- 10.249.47.9 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3003ms rtt min/avg/max/mdev = 29.785/33.748/39.366/3.712 ms ~$ ping 10.249.47.9 PING 10.249.47.9 (10.249.47.9) 56(84) bytes of data. 64 bytes from 10.249.47.9: icmp_req=1 ttl=64 time=37.9 ms 64 bytes from 10.249.47.9: icmp_req=2 ttl=64 time=30.1 ms 64 bytes from 10.249.47.9: icmp_req=3 ttl=64 time=27.5 ms 64 bytes from 10.249.47.9: icmp_req=4 ttl=64 time=30.2 ms 64 bytes from 10.249.47.9: icmp_req=5 ttl=64 time=31.2 ms ^C --- 10.249.47.9 ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4005ms rtt min/avg/max/mdev = 27.563/31.430/37.926/3.476 ms
Can't ping anything on Site B subnet (ex 10.249.16.5)
Site B:
$ show ip route
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2> - selected route, * - FIB route, p - stale info
IP Route Table for VRF "default"
K *> 0.0.0.0/0 [0/0] via pppoe0
S 0.0.0.0/0 [210/0] via 192.168.250.254, eth1
C *> 10.249.16.0/24 is directly connected, switch0.1
C *> 10.249.17.0/24 is directly connected, switch0.11
S *> 10.249.32.0/23 [1/0] via 10.249.48.8 (recursive is directly connected, pppoe0) )
*> [1/0] via 10.249.47.8, tun0
*> [1/0] via 10.249.47.1, vtun0
C *> 10.249.47.1/32 is directly connected, vtun0
C *> 10.249.47.2/32 is directly connected, vtun0
C *> 10.249.47.8/31 is directly connected, tun0
C *> 76.75.100.30/32 is directly connected, pppoe0
C *> 98.124.13.99/32 is directly connected, pppoe0
C *> 127.0.0.0/8 is directly connected, lo
C *> 192.168.250.0/24 is directly connected, eth1
$ ping 10.249.47.1
PING 10.249.47.1 (10.249.47.1) 56(84) bytes of data.
64 bytes from 10.249.47.1: icmp_req=1 ttl=64 time=48.7 ms
64 bytes from 10.249.47.1: icmp_req=2 ttl=64 time=48.1 ms
64 bytes from 10.249.47.1: icmp_req=3 ttl=64 time=55.3 ms
64 bytes from 10.249.47.1: icmp_req=4 ttl=64 time=54.0 ms
^C
--- 10.249.47.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3003ms
rtt min/avg/max/mdev = 48.197/51.596/55.330/3.138 ms
$ ping 10.249.47.8
PING 10.249.47.8 (10.249.47.8) 56(84) bytes of data.
64 bytes from 10.249.47.8: icmp_req=1 ttl=64 time=58.2 ms
64 bytes from 10.249.47.8: icmp_req=2 ttl=64 time=54.0 ms
64 bytes from 10.249.47.8: icmp_req=3 ttl=64 time=56.6 ms
64 bytes from 10.249.47.8: icmp_req=4 ttl=64 time=56.5 ms
64 bytes from 10.249.47.8: icmp_req=5 ttl=64 time=53.2 ms
64 bytes from 10.249.47.8: icmp_req=6 ttl=64 time=58.1 ms
^C
--- 10.249.47.8 ping statistics ---
6 packets transmitted, 6 received, 0% packet loss, time 5007ms
rtt min/avg/max/mdev = 53.225/56.158/58.262/1.904 ms
$ ping 10.249.32.1
PING 10.249.32.1 (10.249.32.1) 56(84) bytes of data.
64 bytes from 10.249.32.1: icmp_req=1 ttl=64 time=62.4 ms
64 bytes from 10.249.32.1: icmp_req=3 ttl=64 time=60.6 ms
64 bytes from 10.249.32.1: icmp_req=4 ttl=64 time=57.2 ms
64 bytes from 10.249.32.1: icmp_req=6 ttl=64 time=59.5 ms
64 bytes from 10.249.32.1: icmp_req=7 ttl=64 time=63.8 ms
64 bytes from 10.249.32.1: icmp_req=9 ttl=64 time=63.8 ms
64 bytes from 10.249.32.1: icmp_req=10 ttl=64 time=60.7 ms
64 bytes from 10.249.32.1: icmp_req=12 ttl=64 time=60.6 ms
64 bytes from 10.249.32.1: icmp_req=13 ttl=64 time=59.2 ms
^C
--- 10.249.32.1 ping statistics ---
14 packets transmitted, 9 received, 35% packet loss, time 13020ms
rtt min/avg/max/mdev = 57.298/60.928/63.856/2.043 msSo I can ping from Site B to Site A not other way around. Site B has load-balancing setup for switch0.11 interface and IPSEC tunnels work both ways without any issues to other sites.
Also tried tcpdump -i vtun0 at Site B and I don't see any traffic passing through for the Site B subnets. If there something special that needs to be configured for inbound openVPN traffic to pass into the site B network when I'm using load-balancing besides what's already configured to exclude local traffic already.
Load Balance Config:
# show load-balance
group FAILOVER {
interface eth1 {
failover-only
route {
}
route-test {
count {
failure 10
success 3
}
initial-delay 60
interval 300
type {
ping {
target 8.8.4.4
}
}
}
}
interface pppoe0 {
route-test {
count {
failure 4
success 3
}
initial-delay 60
interval 5
type {
ping {
target 8.8.8.8
}
}
}
}
lb-local disable
}
# show firewall modify
modify FAILOVER {
rule 10 {
action modify
description "do not load balance lan to lan"
destination {
group {
network-group LAN_NETS
}
}
modify {
table main
}
}
rule 20 {
action modify
description "Do NOT load-balance LAN to router"
destination {
group {
address-group ADDRv4_pppoe0
}
}
modify {
table main
}
}
rule 30 {
action modify
description "Do NOT load-balance LAN to router"
destination {
group {
address-group ADDRv4_eth1
}
}
modify {
table main
}
}
rule 31 {
action modify
description "Do NOT load-balance LAN to router"
destination {
group {
address-group ADDRv4_eth0
}
}
modify {
table main
}
}
rule 40 {
action modify
modify {
lb-group FAILOVER
}
source {
group {
address-group FAILOVERGROUP
}
}
}
}
Let me know if you need any more details.