Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I am trying to finish setting up an OpenVPN server on my Ubuntu 10.04.2 server. But I seemed to have hit a snag.

The OpenVPN installation went fine, I was able to make configuration files for both the server and the client and the client can connect to the server over the internet. The problem I am having is routing related.

The server side (LAN) is able to ping the OpenVPN gateway (10.8.0.1) and the test host I have which is (10.8.0.6) I believe this is able to be done because I set a static route in my m0n0wall that routes all traffic bound for 10.8.0.0/24 through the gateway 10.0.0.6 which is the LAN address for the OpenVPN server.

This is where the problem occurs, when I sit at the client side which on a completely separate internet connection, I am not able to ping anything inside the LAN hosted by the VPN except for 10.8.0.1 and 10.0.0.6. I tried several other internal addresses and nothing went through. What am I missing, do I need a route on the OpenVPN server or something? As per a few Google searches I enabled IP forwarding on the OpenVPN server and that is when the description in the paragraph above started to work. But thats just it, only half of it works.

share|improve this question

2 Answers

up vote 1 down vote accepted

First, Here's a howto about setting up openvpn that I just wrote.

Second, have you set up firewall rules on your server to allow forwarding? Sounds like maybe you haven't, and that's where packets are being blocked. Something like this would allow forwarded traffic from your vpn to your internal network.

/sbin/iptables -I FORWARD 1 -s 10.8.0/24 -j ACCEPT

It would be useful if you posted the output of /sbin/iptables -nvL here as well.

Also are you setting routes manually on your client, or pushing them from the server? If you are pushing from the server you want something like this in your server config file (assuming your server internal network is 192.168.10/24):

# give clients access to the whole work network, not just the server.
push "route 192.168.10.0 255.255.255.0"

If you are pushing them from the server, verify n the client the route is actually getting set. For example, windows 7 and vista reject routes pushed by the server unless you start the openvpn client via right click->run as administrator. you can confirm this is working on the client by inspecting the client logs.

share|improve this answer
I know very little about iptables, any idea what my forwarding rules would look like. because I am pretty sure that is it because when I look at the syslog OpenVPN is pushing the correct route to the client – Solignis Mar 8 '11 at 10:08
Yep iptables was the issue, I found an example of the rule needed to forward OpenVPN. Thanks for point me in the right direction. Now I can get some sleep. As far as route are concerned I checked the rouing tables on the client before I made my post I just did not include it in my question. Still thanks for your help considering the time. Oh yeah and I was pushing routes from the server. – Solignis Mar 8 '11 at 10:48
up vote 0 down vote

In the server config, you can set routes that your clients should take. For example:

push "route 10.8.0.0 255.255.255.0"

Both the pool and the server and the push route command must specify the same subnet outside the subnet of your LAN. Some more info an Routing and OpenVPN is to be found here: http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing

Could you post the output of iptables -l?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.