Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to figure out how to setup routing on OpenVPN.

I have successful connection between client (OS X Snow Leopard) and server (OS X Leopard Server), and each can ping the other. However, I am wanting the connecting client to be able to access other machines on the network.

Here is how my network is laid out. On the server side there is a Verizon Fios router that has a public dynamic IP address (which I know through DynDNS.org), and an internal address of 10.50.60.1. The router is configured with a machine in the DMZ of 10.50.60.160.

This machine (10.50.60.160) is hosting OpenVPN and all other machines I want to connect to are on the 10.50.60.x network.

The client is connecting in from different locations (although the one I am testing from right now has assigned me the address of 10.1.5.11.

OpenVPN is configured to work on the 10.8.0.0 network and assigns IP addresses successfully to the client machine. I have done it this way because of what I have read. I am fine changing this anyway that is needed to work. I have attached the server config file below, as you can probably see from the ‘push’ and ifconfig entries I am not quite sure what I am doing. Can you let me know how I would configure this so that once the VPN is connected I can ping and access 10.50.60.160 and my other machines on the 10.50.60.x network?

My server config file is as follows:

dev tun
tls-server
ca /etc/openvpn/openvpn2/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/openvpn2/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/openvpn2/easy-rsa/2.0/keys/server.key  # This file should be kept secret
dh /etc/openvpn/openvpn2/easy-rsa/2.0/keys/dh1024.pem
verb 3
comp-lzo
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
server 10.8.0.0 255.255.255.0
push "route 10.50.60.0 255.255.255.0"
push "ifconfig 10.50.60.0 10.8.0.1"
ifconfig 10.8.0.1 10.50.60.0
duplicate-cn
max-clients 5
ifconfig-pool-persist /etc/openvpn/ipp.txt

Any help would be really appreciated.

Thanks

Pete

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Your config, annotated:

# we're in server mode, server takes 10.8.0.1, everything else is left for clients
server 10.8.0.0 255.255.255.0

# tell clients they can reach 10.50.60.0/24 through 10.8.0.1
push "route 10.50.60.0 255.255.255.0"

# I don't know what this is, commenting it out
#push "ifconfig 10.50.60.0 10.8.0.1"

# I don't know what this is either
#ifconfig 10.8.0.1 10.50.60.0

Everything else looks ok to me.

Two things need to happen: 1) your VPN server needs to be configured to pass traffic LAN <---> remote VPN client. From terminal:

sudo sysctl -w net.inet.ip.forwarding=1

2) the other machines on the LAN need to know how to reach the remote VPN clients. An easy way to do this would to be to add a static route on your FIOS actiontec router, to 10.8.0.0/255.255.255.0 via 10.50.60.160

Hope this helps.

share|improve this answer
    
Thanks for taking the time to help me with this. I followed your directions and was able to figure it out. Much appreciated! –  user36366 Mar 3 '10 at 1:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.