Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

This seems to be a general problem, but I couldn't manage to solve it.

I have a very simple configuration which follows. The server is Windows Server 2003 and client is Windows 7 Ultimate. On both, OpenVPN runs as service. I patched the "IPEnableRouter" value to 1 on OpenVPN server machine.

I CAN ping and connect ports on VPNSRV, but I CAN'T connect to any port on FTPSRV from CLIENT. VPNSRV don't have any problems connecting to FTPSRV.

Verbose logging shows that OpenVPN takes packets from CLIENT then writes, but no reply returns when pinging FTPSRV. Things are fine with pinging VPNSRV

CLIENT: LAN(192.168.2.x), OPENVPN(10.10.43.x)


proto tcp
dev tun
dev-node lanvpn
remote vpnserver 10000
resolv-retry infinite
ca ca.crt
ns-cert-type server
cipher BF-CBC
verb 3
cert client.crt
key client.key


port 10000
proto tcp
dev tun
dev-node lanvpn
ca ca.crt
cert server.crt
key server.key
crl-verify crl.pem
dh dh1024.pem
cipher BF-CBC
ifconfig-pool-persist ipp.txt
push "route"
keepalive 30 120
status openvpn-status.log
verb 3
share|improve this question

2 Answers 2

up vote 1 down vote accepted

Check that your FTP server has a route to your VPN network ( My guess is that it doesn't.

share|improve this answer
To be more specific: Your FTP server needs to know where to send packets destined for . Check the routing table on FTPSERV. – Steven Monday Oct 13 '10 at 16:40
In general, if you want your VPN clients to have access to your LAN, you'll need to arrange for your LAN hosts to have routes to your VPN network. On a simple LAN with a single gateway router, an easy way to achieve that is to run your OpenVPN service on the router. That way, hosts on your LAN will automatically send traffic bound for your VPN to the gateway, simply by virtue of it being the default gateway. – Steven Monday Oct 13 '10 at 17:11
Thanks, that is the exact problem, since the gateway is not OpenVPN server. – dereli Oct 13 '10 at 22:24

You may want to do a packet capture on FTPSRV to see if your client's ping is ever getting to the box. If it's not getting to the box, there may be a forwarding or firewall problem on your VPNSRV that isn't sending the traffic to the network behind it. If the traffic is getting to FTPSRV and you see FTPSRV trying to respond, it may be a routing issue of it not knowing how to return the traffic. You can follow up on that by doing a packet capture on the physical interface of VPNSRV and see if you get traffic from FTPSRV -> CLIENT.

share|improve this answer
Thanks for help, previous comment solved it. – dereli Oct 13 '10 at 22:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.