Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have setup a OpenVPN server on a server in the office for people to VPN into. They can hit any host on the office network just fine but if they try to access our datacenter on another subnet nothing happens. I believe it is on the access-list of the cisco router but cannot figure it out.

Office LAN:
DataCenter Lan:
OpenVPN Server:
Office Router IP:

So when a client is connected their routing table looks like

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface UH    0      0        0 tun0 UGH   0      0        0 tun0   UG    0      0        0 tun0   UG    0      0        0 tun0   U     2      0        0 wlan0         UG    0      0        0 wlan0

A traceroute to the datacenter looks like

traceroute to (, 30 hops max, 60 byte packets
 1 (  18.851 ms  39.294 ms  39.297 ms
 2 (  39.287 ms  39.278 ms  39.269 ms
 3  * * *
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *

Here is the route table on the openvpn server

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface UH    0      0        0 tun0   U     0      0        0 eth0   UG    0      0        0 tun0   U     0      0        0 virbr0     U     0      0        0 eth0         UG    0      0        0 eth0         U     0      0        0 eth0

So the packet seems to me to be making it to the office router

Here is my route config for the cisco router

ip route
ip route
ip route
ip route

And here is my access-list

access-list 1 remark CCP_ACL Category=2
access-list 1 permit
access-list 23 permit
access-list 100 remark CCP_ACL Category=4
access-list 100 permit ip any
access-list 101 deny   ip any
access-list 101 deny   ip any
access-list 101 deny   ip any
access-list 101 permit ip any
access-list 102 remark CCP_ACL Category=4
access-list 102 permit ip any
access-list 103 remark CCP_ACL Category=4
access-list 103 permit ip any
access-list 103 permit ip any
access-list 120 permit ip
access-list 701 deny   0007.e917.876f   0000.0000.0000

Any help or pointers?

share|improve this question
So based on what I see, if the client on the VPN needs to hit 192.168.100.x, it would be routed from their machine to So what is that .61.5 address and does it know how to get to the subnet? – Coding Gorilla Sep 10 '10 at 15:29
61.5 is the openvpn ip.. that's the thing.. i have no idea how to tell it to get to 100.0 – Mike Sep 10 '10 at 15:35
Sorry, I'm not intimately familiar with the OpenVPN, but can't you just add a static route to it? – Coding Gorilla Sep 10 '10 at 15:37
I have tried.. but 100.0 is a site to site vpn and on the 71.0 side i cannot ping 100.1 – Mike Sep 10 '10 at 15:44
I'm sort of getting lost in the numbers here, if you'd like to contact me via email (mark at warpool . org), I'll be happy to try to help. – Coding Gorilla Sep 10 '10 at 15:53
up vote 0 down vote accepted

I'm guessing that your Cisco router has two "legs": one for the Office LAN and one for the Data Center LAN.

Your packets from your VPN users are getting to your data center but they have no route back because the Cisco doesn't know that the Open VPN server is the router for the VPN LAN.

You need to add a route in the Cisco that tells it to route packets with a destination of to, which, being the OpenVPN router, has a route to that network, and will in turn forward packets to the VPN host(s).

share|improve this answer
I need that on our datacenter side router right? – Mike Sep 10 '10 at 16:32
Whats your "data center side router"? Is there more than one router between the Office and the Data Center? – gravyface Sep 10 '10 at 16:42
its done by rackspace and its a site to site vpn connection. I believe its an ASA on their end 2600 series if I remember – Mike Sep 10 '10 at 17:06
Ok, but your data center has a route to go to your office LAN, correct? i.e. you can hop on a box in the data center and ping a machine in your office LAN? – gravyface Sep 10 '10 at 17:11
yes that is correct – Mike Sep 10 '10 at 17:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.