Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have two openvpn clients on the (client1) and (client2) subnets with the server's openvpn connection having the ip

The server has ip forwarding enabled.

Currently, client1's vpn ip is and the P-t-P ip is I have created the following static route on client1:

route add -net netmask gw

The routing table on client1 looks like this:

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface UH        0 0          0 tun0 UGH       0 0          0 tun0   UG        0 0          0 tun0   U         0 0          0 eth0       U         0 0          0 lo         UG        0 0          0 eth0

I thought this would be correct to allow traffic from client1 to reach computers on client2's network, but it does not work. Is (the P-t-P address) the correct one to be routing through ? I tried using but I couldn't create the route.

I also tried adding this to the server config instead:

push "route"
push "route"

It creates the following route on client1:   UG        0 0          0 tun0

But it doesn't work. Surely the "push" route example is correct ? Is there something else I need to do ? Nothing on the server ? Just enable ip forwarding ?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

Does anything appear in firewall logs? Can you diagnose exactly where the traffic brakes using tcpdump? What system are you using (linux, freebsd, which version)?

Also try this in the server config (from the OpenVPN documentation):

# Uncomment this directive to allow different
# clients to be able to "see" each other.
# By default, clients will only see the server.
# To force clients to only see the server, you
# will also need to appropriately firewall the
# server's TUN/TAP interface.
share|improve this answer
somehow i missed this option in the config because I'm blind or something. What a relief. I've been at this for days banging my head against a brick wall and that's all that was required ! – Pawz May 3 '10 at 12:26

In order to get my clients talking to each other via the OpenVPN server, I needed to uncomment client-to-client in my config as @kyrisu suggests, but I also had to add topology subnet to my server config:

# Configure server mode and supply a VPN subnet
# for OpenVPN to draw client addresses from.
# The server will take for itself,
# the rest will be made available to clients.
# Each client will be able to reach the server
# on Comment this line out if you are
# ethernet bridging. See the man page for more info.
topology subnet
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.