Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

There is a network in the office. There are a router powered by FreeBSD in the network and a server powered by CentOS outside.

Task: provide an access from anywhere to the network in the office.

Data: network — behind FreeBSD with bge0( and re0( — in the modem's subnet). Outside server — xx.xx.xx.xx. The FreeBSD in the OpenVPN net is, CentOS server address is

Trouble: there's no access to the inside network from the outside server (I can access FreeBSD router), but I can access outside server from my network. I need to access inside network from the outside server.

Outside CentOS server's OpenVPN config:

dev tun 
port 1194 
proto udp 
mode server 
push "route" 
push "dhcp-option DNS" 
client-config-dir /etc/openvpn/ccd 
ifconfig-pool-persist addr_list 
tun-mtu 1500 
keepalive 10 60 
cipher DES-EDE3-CBC 
ca /etc/openvpn/ca.crt 
cert /etc/openvpn/server.crt 
key /etc/openvpn/server.key 
dh /etc/openvpn/dh1024.pem 
tls-auth /etc/openvpn/ta.key 0 
status openvpn-status.log 
log /var/log/openvpn/openvpn.log 
verb 4

FreeBSD's config:

proto udp 
dev tun 
remote xx.xx.xx.xx 1194 
resolv-retry infinite 
ca /usr/local/etc/openvpn/ca.crt 
cert /usr/local/etc/openvpn/freebsd-client.crt 
key /usr/local/etc/openvpn/freebsd-client.key 
dh /usr/local/etc/openvpn/dh1024.pem 
tls-auth /usr/local/etc/openvpn/ta.key 1 
cipher DES-EDE3-CBC # Triple-DES 
verb 4 
route-method exe 
route-delay 2 
ping 100 
ping-restart 200

/etc/openvpn/ccd/freebsd-client contents:

push "route" 

On FreeBSD:

# ps aux | grep natd
/sbin/natd -n re0 
/sbin/natd -n tun0 -p 8669

# ipfw show 
00039   12203     876046 fwd,80 tcp from to dst-port 80 
00040  322269   40046856 fwd,3128 tcp from to any dst-port 80,433,8080 
00050 2885463 1611968772 divert 8668 ip4 from any to any via re0 
00060    5675    1094008 divert 8669 ip from any to any via tun0 
00100   28440    2126360 allow ip from any to any via lo0 
00200       0          0 deny ip from any to 
00300       0          0 deny ip from to any 
65000 4241769 2426143908 allow ip from any to any 
65535       1         78 deny ip from any to any

# netstat -nr -finet 
Routing tables 

Destination        Gateway            Flags    Refs      Use  Netif Expire 
default          UGS        22  3312575    re0          link#4             UH          0    56564    lo0     link#1             U           3 166750211   bge0      link#1             UHS         0       12    lo0     link#2             U           1   235840    re0        link#2             UHS         0       36    lo0      UGS         0       20   tun0      link#5             UH          0        0   tun0      link#5             UHS         0        0    lo0

On CentOS:

$ route 
Kernel IP routing table 
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface   *      UH    0      0        0 tun0 
xx.xx.xx.0    *        U     0      0        0 eth0 
xx.xx.yy.0    *        U     0      0        0 eth0   UG    0      0        0 tun0   *        U     0      0        0 virbr0   UG    0      0        0 tun0     *          U     0      0        0 eth0 
default         xx.xx.xx.1         UG    0      0        0 eth0

$ ip route get via dev tun0  src 
    cache  mtu 1500 advmss 1460 hoplimit 64

I ping the from CentOS and get this:

On CentOS:

$ tcpdump -i tun0 
tcpdump: WARNING: arptype 65534 not supported by libpcap - falling back to cooked socket 
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode 
listening on tun0, link-type LINUX_SLL (Linux cooked), capture size 96 bytes 
11:34:48.963629 IP > ICMP echo request, id 40524, seq 1, length 64 
11:34:49.973944 IP > ICMP echo request, id 40524, seq 2, length 64 
11:34:50.974007 IP > ICMP echo request, id 40524, seq 3, length 64 
11:34:51.974075 IP > ICMP echo request, id 40524, seq 4, length 64

And silence on FreeBSD:

tcpdump -i tun0 
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode 
listening on tun0, link-type NULL (BSD loopback), capture size 96 bytes

Can anybody help me?

share|improve this question

2 Answers 2

If I was you, I would take a look at ClearOS. It's a CentOS based system with an exceptional web based GUI, it can do what you want it to do in about 15 mins. It doesn't have to be your gateway, and judging by your question, I'm sure you'll be able to configure it as a device on your net. It can provide, PPTP, and OpenVPN, should in case you have windows users who also need to gain access.

share|improve this answer
Thanks a lot for answer, but I can't change the OS :( – OutPunk Aug 13 '10 at 13:55
Ah! I see. Well, feel free to check it out anyway. I run it as an appliance for some clients, and it gives me piece of mind - Have a good weekend, and I hope a BSD expert helps you out. – Mister IT Guru Aug 13 '10 at 15:40
Thanks, have a good weekend. – OutPunk Aug 13 '10 at 16:26

Are you sure that the routing between the interfaces is activate ? /proc/sys/net/ipv4/ip_forward

Try to ping the VPN before trying to go outside of the VPN.

share|improve this answer
There is 1 in the /proc/sys/net/ipv4/ip_forward, and I have no ping to FreeBSD( But I can ping it from client connected to CentOS. – OutPunk Aug 13 '10 at 13:50
Is there a firewall ? Do you have NAT or not ? – Dom Aug 13 '10 at 14:50
There are a firewall with open policy for input, output and forward and no NAT. – OutPunk Aug 13 '10 at 16:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.