Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have setup a OpenVPN server on a server in the office for people to VPN into. They can hit any host on the office network just fine but if they try to access our datacenter on another subnet nothing happens. I believe it is on the access-list of the cisco router but cannot figure it out.

Office LAN: 192.168.71.0/24
DataCenter Lan: 192.168.100.0/24
OpenVPN Server: 192.168.71.15
VPN LAN: 192.168.61.0/24
Office Router IP: 192.168.71.1

So when a client is connected their routing table looks like

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.61.5    0.0.0.0         255.255.255.255 UH    0      0        0 tun0
192.168.61.1    192.168.61.5    255.255.255.255 UGH   0      0        0 tun0
192.168.100.0   192.168.61.5    255.255.255.0   UG    0      0        0 tun0
192.168.71.0    192.168.61.5    255.255.255.0   UG    0      0        0 tun0
192.168.1.0     0.0.0.0         255.255.255.0   U     2      0        0 wlan0
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 wlan0

A traceroute to the datacenter looks like

traceroute to 192.168.100.52 (192.168.100.52), 30 hops max, 60 byte packets
 1  192.168.61.1 (192.168.61.1)  18.851 ms  39.294 ms  39.297 ms
 2  192.168.71.1 (192.168.71.1)  39.287 ms  39.278 ms  39.269 ms
 3  * * *
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *

Here is the route table on the openvpn server

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.61.2    0.0.0.0         255.255.255.255 UH    0      0        0 tun0
192.168.71.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.61.0    192.168.61.2    255.255.255.0   UG    0      0        0 tun0
192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 virbr0
169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0 eth0
0.0.0.0         192.168.71.1    0.0.0.0         UG    0      0        0 eth0
0.0.0.0         0.0.0.0         0.0.0.0         U     0      0        0 eth0

So the packet seems to me to be making it to the office router

Here is my route config for the cisco router

ip route 0.0.0.0 0.0.0.0 216.173.2.217
ip route 10.1.168.0 255.255.255.0 192.168.71.5
ip route 10.100.1.0 255.255.255.0 192.168.72.5
ip route 192.168.61.0 255.255.255.0 192.168.71.15

And here is my access-list

access-list 1 remark CCP_ACL Category=2
access-list 1 permit 192.168.71.0 0.0.0.255
access-list 23 permit 10.10.10.0 0.0.0.7
access-list 100 remark CCP_ACL Category=4
access-list 100 permit ip 192.168.0.0 0.0.255.255 any
access-list 101 deny   ip any 192.168.0.0 0.0.255.255
access-list 101 deny   ip any 172.16.0.0 0.15.255.255
access-list 101 deny   ip any 10.0.0.0 0.255.255.255
access-list 101 permit ip 192.168.71.0 0.0.0.255 any
access-list 102 remark CCP_ACL Category=4
access-list 102 permit ip 192.168.71.0 0.0.0.255 any
access-list 103 remark CCP_ACL Category=4
access-list 103 permit ip 192.168.71.0 0.0.0.255 any
access-list 103 permit ip 192.168.100.0 0.0.0.255 any
access-list 120 permit ip 192.168.71.0 0.0.0.255 192.168.100.0 0.0.0.255
access-list 701 deny   0007.e917.876f   0000.0000.0000

Any help or pointers?

share|improve this question
    
So based on what I see, if the client on the VPN needs to hit 192.168.100.x, it would be routed from their machine to 192.168.61.5. So what is that .61.5 address and does it know how to get to the 192.168.100.0 subnet? –  Coding Gorilla Sep 10 '10 at 15:29
    
61.5 is the openvpn ip.. that's the thing.. i have no idea how to tell it to get to 100.0 –  Mike Sep 10 '10 at 15:35
    
Sorry, I'm not intimately familiar with the OpenVPN, but can't you just add a static route to it? –  Coding Gorilla Sep 10 '10 at 15:37
    
I have tried.. but 100.0 is a site to site vpn and on the 71.0 side i cannot ping 100.1 –  Mike Sep 10 '10 at 15:44
    
I'm sort of getting lost in the numbers here, if you'd like to contact me via email (mark at warpool . org), I'll be happy to try to help. –  Coding Gorilla Sep 10 '10 at 15:53

1 Answer 1

up vote 0 down vote accepted

I'm guessing that your Cisco router has two "legs": one for the Office LAN and one for the Data Center LAN.

Your packets from your VPN users are getting to your data center but they have no route back because the Cisco doesn't know that the Open VPN server is the router for the VPN LAN.

You need to add a route in the Cisco that tells it to route packets with a destination of 192.168.61.0/24 to 192.168.71.15, which, being the OpenVPN router, has a route to that network, and will in turn forward packets to the VPN host(s).

share|improve this answer
    
I need that on our datacenter side router right? –  Mike Sep 10 '10 at 16:32
    
Whats your "data center side router"? Is there more than one router between the Office and the Data Center? –  gravyface Sep 10 '10 at 16:42
    
its done by rackspace and its a site to site vpn connection. I believe its an ASA on their end 2600 series if I remember –  Mike Sep 10 '10 at 17:06
    
Ok, but your data center has a route to go to your office LAN, correct? i.e. you can hop on a box in the data center and ping a machine in your office LAN? –  gravyface Sep 10 '10 at 17:11
    
yes that is correct –  Mike Sep 10 '10 at 17:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.