I am trying to connect two networks together by using a pair of CentOS 7 systems running OpenVPN.I have a server side that has two networks behind it, and a client side that has a single network. The basic openvpn connection is up, but I think I have something wrong with the routing or the firewalld config.The OpenVPN is a pool on 10.8.0.0/24. The server has networks 10.254.1.0/24 and 10.255.1.0/24 behind it; the client has 10.255.0.1 behind it.The server pushes these routing options in server.conf:# Push any routes the client needs to get in# to the local network.push route 10.254.1.0 255.255.255.0push route 10.255.1.0 255.255.255.0These show up correctly in the client's routing table:10.8.0.1 via 10.8.0.5 dev tun010.8.0.5 dev tun0  proto kernel  scope link  src 10.8.0.610.254.1.0/24 via 10.8.0.5 dev tun010.255.0.0/24 dev enp6s4f0  proto kernel  scope link  src 10.255.0.1  metric 10010.255.1.0/24 via 10.8.0.5 dev tun0...and on the server side I have manually set up an appropriate route:10.8.0.0/24 via 10.8.0.2 dev tun010.8.0.2 dev tun0  proto kernel  scope link  src 10.8.0.110.255.0.0/24 via 10.8.0.2 dev tun0...and the client gateway can in fact ping devices deeper in the server's network:[root@sentry openvpn]# ping -c 1 10.254.1.10PING 10.254.1.10 (10.254.1.10) 56(84) bytes of data.64 bytes from 10.254.1.10: icmp_seq=1 ttl=63 time=300 ms...but I can't ssh to it.# ssh dave@10.254.1.10ssh: connect to host 10.254.1.10 port 22: No route to host...so, I think it might be a firewall problem.On both sides I've added the tun interface to my internal zone.On the client side:# firewall-cmd --info-zone=internalinternal (active)  target: default  icmp-block-inversion: no  interfaces: enp6s4f0 tun0  sources:  services: dhcp dhcpv6-client dns http mdns mosh samba-client snmp ssh syslog  ports: 8000/tcp  protocols:  masquerade: no  forward-ports:  sourceports:  icmp-blocks:  rich rules:...and the server:# firewall-cmd --info-zone=internalinternal (active)  target: default  icmp-block-inversion: no  interfaces: ens161 ens256 tun0  sources:  services: dhcpv6-client mdns samba-client snmp ssh  ports:  protocols:  masquerade: no  forward-ports:  sourceports:  icmp-blocks:  rich rules:Now, on the server in order to get the two internal networks to talk to each other, I had to add direct iptables rules:firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i ens256 -o ens161 -j ACCEPTfirewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i ens161 -o ens256 -j ACCEPT...so I've done the same thing for the openvpn network:firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i ens256 -o tun0 -j ACCEPTfirewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -o ens256 -i tun0 -j ACCEPTfirewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i ens161 -o tun0 -j ACCEPTfirewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -o ens161 -i tun0 -j ACCEPT...and on the client:firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i enp6s4f0 -o tun0 -j ACCEPTfirewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -o enp6s4f0 -i tun0 -j ACCEPT...so clearly I either don't understand how the routing is supposed to work, or I'm missing something on the firewalld side.Can anyone tell me what I'm missing?
Connect Networks Together Using OpenVPN on CentOS 7
openvpn;firewalld