Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This seems to be a general problem, but I couldn't manage to solve it.

I have a very simple configuration which follows. The server is Windows Server 2003 and client is Windows 7 Ultimate. On both, OpenVPN runs as service. I patched the "IPEnableRouter" value to 1 on OpenVPN server machine.

I CAN ping and connect ports on VPNSRV, but I CAN'T connect to any port on FTPSRV from CLIENT. VPNSRV don't have any problems connecting to FTPSRV.

Verbose logging shows that OpenVPN takes packets from CLIENT then writes, but no reply returns when pinging FTPSRV. Things are fine with pinging VPNSRV

CLIENT: LAN(192.168.2.x), OPENVPN(10.10.43.x)
VPNSRV: LAN(10.10.0.3),   OPENVPN(10.10.43.1)
FTPSRV: LAN(10.10.0.6)

client.ovpn

client
proto tcp
dev tun
dev-node lanvpn
remote vpnserver 10000
resolv-retry infinite
nobind
mute-replay-warnings
ca ca.crt
ns-cert-type server
cipher BF-CBC
comp-lzo
verb 3
cert client.crt
key client.key

server.ovpn

port 10000
proto tcp
dev tun
dev-node lanvpn
ca ca.crt
cert server.crt
key server.key
crl-verify crl.pem
dh dh1024.pem
cipher BF-CBC
comp-lzo
ifconfig-pool-persist ipp.txt
server 10.10.43.0 255.255.255.0
push "route 10.10.0.0 255.255.255.0"
keepalive 30 120
status openvpn-status.log
verb 3
share|improve this question

2 Answers 2

up vote 1 down vote accepted

Check that your FTP server has a route to your VPN network (10.10.43.0/24). My guess is that it doesn't.

share|improve this answer
    
To be more specific: Your FTP server needs to know where to send packets destined for 10.10.43.0/24 . Check the routing table on FTPSERV. –  Steven Monday Oct 13 '10 at 16:40
1  
In general, if you want your VPN clients to have access to your LAN, you'll need to arrange for your LAN hosts to have routes to your VPN network. On a simple LAN with a single gateway router, an easy way to achieve that is to run your OpenVPN service on the router. That way, hosts on your LAN will automatically send traffic bound for your VPN to the gateway, simply by virtue of it being the default gateway. –  Steven Monday Oct 13 '10 at 17:11
    
Thanks, that is the exact problem, since the gateway is not OpenVPN server. –  dereli Oct 13 '10 at 22:24

You may want to do a packet capture on FTPSRV to see if your client's ping is ever getting to the box. If it's not getting to the box, there may be a forwarding or firewall problem on your VPNSRV that isn't sending the traffic to the network behind it. If the traffic is getting to FTPSRV and you see FTPSRV trying to respond, it may be a routing issue of it not knowing how to return the traffic. You can follow up on that by doing a packet capture on the physical interface of VPNSRV and see if you get traffic from FTPSRV -> CLIENT.

share|improve this answer
    
Thanks for help, previous comment solved it. –  dereli Oct 13 '10 at 22:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.