Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two openvpn clients on the 10.0.1.0 (client1) and 192.168.0.0 (client2) subnets with the server's openvpn connection having the ip 192.168.150.1

The server has ip forwarding enabled.

Currently, client1's vpn ip is 192.168.150.10 and the P-t-P ip is 192.168.150.9 I have created the following static route on client1:

route add -net 10.0.1.0 netmask 255.255.255.0 gw 192.168.150.9

The routing table on client1 looks like this:

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
192.168.150.9   0.0.0.0         255.255.255.255 UH        0 0          0 tun0
192.168.150.1   192.168.150.9   255.255.255.255 UGH       0 0          0 tun0
10.0.1.0        192.168.150.9   255.255.255.0   UG        0 0          0 tun0
192.168.0.0     0.0.0.0         255.255.255.0   U         0 0          0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
0.0.0.0         192.168.0.1     0.0.0.0         UG        0 0          0 eth0

I thought this would be correct to allow traffic from client1 to reach computers on client2's network, but it does not work. Is 192.168.150.9 (the P-t-P address) the correct one to be routing through ? I tried using 192.168.150.1 but I couldn't create the route.

I also tried adding this to the server config instead:

push "route 192.168.0.0 255.255.255.0"
push "route 10.0.1.0 255.255.255.0"

It creates the following route on client1:

10.0.1.0        192.168.150.9   255.255.255.0   UG        0 0          0 tun0

But it doesn't work. Surely the "push" route example is correct ? Is there something else I need to do ? Nothing on the server ? Just enable ip forwarding ?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

Does anything appear in firewall logs? Can you diagnose exactly where the traffic brakes using tcpdump? What system are you using (linux, freebsd, which version)?

Also try this in the server config (from the OpenVPN documentation):

# Uncomment this directive to allow different
# clients to be able to "see" each other.
# By default, clients will only see the server.
# To force clients to only see the server, you
# will also need to appropriately firewall the
# server's TUN/TAP interface.
;client-to-client
share|improve this answer
    
somehow i missed this option in the config because I'm blind or something. What a relief. I've been at this for days banging my head against a brick wall and that's all that was required ! –  Pawz May 3 '10 at 12:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.