Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
Configure routes in OpenVPN

I am trying to figure out how to setup routing on OpenVPN.

I have successful connection between client (OS X Snow Leopard) and server (OS X Leopard Server), and each can ping the other. However, I am wanting the connecting client to be able to access other machines on the network.

Here is how my network is laid out. On the server side there is a Verizon Fios router that has a public dynamic IP address (which I know through, and an internal address of The router is configured with a machine in the DMZ of

This machine ( is hosting OpenVPN and all other machines I want to connect to are on the 10.50.60.x network.

The client is connecting in from different locations (although the one I am testing from right now has assigned me the address of

OpenVPN is configured to work on the network and assigns IP addresses successfully to the client machine. I have done it this way because of what I have read. I am fine changing this anyway that is needed to work. I have attached the server config file below, as you can probably see from the ‘push’ and ifconfig entries I am not quite sure what I am doing. Can you let me know how I would configure this so that once the VPN is connected I can ping and access and my other machines on the 10.50.60.x network?

My server config file is as follows:

dev tun
ca /etc/openvpn/openvpn2/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/openvpn2/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/openvpn2/easy-rsa/2.0/keys/server.key  # This file should be kept secret
dh /etc/openvpn/openvpn2/easy-rsa/2.0/keys/dh1024.pem
verb 3
keepalive 10 60
push "route"
push "ifconfig"
max-clients 5
ifconfig-pool-persist /etc/openvpn/ipp.txt

Any help would be really appreciated.



share|improve this question

migrated from Mar 1 '10 at 19:14

This question came from our site for professional and enthusiast programmers.

marked as duplicate by sysadmin1138 Nov 19 '11 at 19:46

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer 1

Based on your description, it sounds like this is a routing problem. OpenVPN clients (on the subnet) can route packets to your local network (on, but packets from the local network don't know how to go back in the reverse direction (to Just to be perfectly clear, this is not an OpenVPN problem.

The simplest fix is: Add a static route on the subnet's default gateway (the FIOS router, I think) that forwards any traffic destined for the subnet to the OpenVPN server ( Hosts on the subnet already send all of their non-local traffic (everything besides to the default gateway. Once you tell that default gateway that it can reach the OpenVPN subnet via, those packets should just start flowing.

You'll have to look at your FiOS router documentation for specific instructions on how to set up a static route. Usually, you need to supply 3 parameters for to define the new static route: a gateway (or router) IP address; a destination network IP address; and a destination network subnet mask. In your case:

  • The gateway will just be '', the IP of the OpenVPN server.
  • The destination network address will be the OpenVPN subnet IP, ''.
  • The destination network subnet mask will be ''.

The FiOS router's user interface might expect the destination network address and subnet mask together, like '', in CIDR notation as ''. If you can't figure it out from the docs, and if Verizon tech support fails you, I would suggest trying Google.

You can confirm my diagnosis with a 'tcpdump' session on the OpenVPN server ( Assuming that the address is on the device named 'eth0', you would run:

tcpdump -n -e -i eth0 -s0 icmp

with root privileges. Then, start a 'ping' session from your OpenVPN client to another host on the subnet (the FIOS router,, should work fine). You should see the ICMP ECHO REQUEST packets from the OpenVPN client to (or whatever target you chose), but not the ICMP ECHO REPLY packets in the reverse direction.

If you have another host on the subnet (besides the FiOS router) with 'tcpdump' installed, you might also want to try running that same command line on it, while pinging from your OpenVPN client. If I'm correct, you'll see the client's ICMP ECHO REQUEST packets arriving, as before, plus some outbound ICMP ECHO REPLY packets with the OpenVPN client's IP and the FiOS router's MAC address.

share|improve this answer