Our scenario: We've got an OpenVPN server installed on a GKE pod with VPN clients that want to connect to our VPN. We need to expose to clients a service on another pod in our GKE cluster (an MQTT adapter specifically). Address 10.86.12.209 is a private IP on our GCP VPC, pointing to the MQTT adapter pod (please have a look at the image below).
A snippet of our server conf is:
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.86.12.0 255.255.255.0"
push "route 240.5.0.0 255.255.0.0"
push "route 240.6.0.0 255.255.0.0"
topology subnet
sndbuf 0
rcvbuf 0
push "sndbuf 0"
push "rcvbuf 0"
A route print of a Windows client connecting to our OpenVPN server is
Network address Mask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.178.1 192.168.178.29 35
10.8.0.0 255.255.255.0 On-link 10.8.0.8 281
10.8.0.8 255.255.255.255 On-link 10.8.0.8 281
10.8.0.255 255.255.255.255 On-link 10.8.0.8 281
10.86.12.0 255.255.255.0 10.8.0.1 10.8.0.8 281
127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
127.0.0.1 255.255.255.255 On-link 127.0.0.1 331
127.255.255.255 255.255.255.255 On-link 127.0.0.1 331
172.25.192.0 255.255.240.0 On-link 172.25.192.1 271
172.25.192.1 255.255.255.255 On-link 172.25.192.1 271
172.25.207.255 255.255.255.255 On-link 172.25.192.1 271
192.168.178.0 255.255.255.0 On-link 192.168.178.29 291
192.168.178.29 255.255.255.255 On-link 192.168.178.29 291
192.168.178.255 255.255.255.255 On-link 192.168.178.29 291
224.0.0.0 240.0.0.0 On-link 127.0.0.1 331
224.0.0.0 240.0.0.0 On-link 10.8.0.8 281
224.0.0.0 240.0.0.0 On-link 192.168.178.29 291
224.0.0.0 240.0.0.0 On-link 172.25.192.1 271
240.5.0.0 255.255.0.0 10.8.0.1 10.8.0.8 281
240.6.0.0 255.255.0.0 10.8.0.1 10.8.0.8 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 331
255.255.255.255 255.255.255.255 On-link 10.8.0.8 281
255.255.255.255 255.255.255.255 On-link 192.168.178.29 291
255.255.255.255 255.255.255.255 On-link 172.25.192.1 271
Our issue: client connects to VPN successfully but it can't reach the MQTT pod. We suspect we lack of some config on K8S side to make OpenVPN pod reach MQTT adapter POD