Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to finish setting up an OpenVPN server on my Ubuntu 10.04.2 server. But I seemed to have hit a snag.

The OpenVPN installation went fine, I was able to make configuration files for both the server and the client and the client can connect to the server over the internet. The problem I am having is routing related.

The server side (LAN) is able to ping the OpenVPN gateway ( and the test host I have which is ( I believe this is able to be done because I set a static route in my m0n0wall that routes all traffic bound for through the gateway which is the LAN address for the OpenVPN server.

This is where the problem occurs, when I sit at the client side which on a completely separate internet connection, I am not able to ping anything inside the LAN hosted by the VPN except for and I tried several other internal addresses and nothing went through. What am I missing, do I need a route on the OpenVPN server or something? As per a few Google searches I enabled IP forwarding on the OpenVPN server and that is when the description in the paragraph above started to work. But thats just it, only half of it works.

share|improve this question
up vote 1 down vote accepted

First, Here's a howto about setting up openvpn that I just wrote.

Second, have you set up firewall rules on your server to allow forwarding? Sounds like maybe you haven't, and that's where packets are being blocked. Something like this would allow forwarded traffic from your vpn to your internal network.

/sbin/iptables -I FORWARD 1 -s 10.8.0/24 -j ACCEPT        

It would be useful if you posted the output of /sbin/iptables -nvL here as well.

Also are you setting routes manually on your client, or pushing them from the server? If you are pushing from the server you want something like this in your server config file (assuming your server internal network is 192.168.10/24):

# give clients access to the whole work network, not just the server.
push "route"

If you are pushing them from the server, verify n the client the route is actually getting set. For example, windows 7 and vista reject routes pushed by the server unless you start the openvpn client via right click->run as administrator. you can confirm this is working on the client by inspecting the client logs.

share|improve this answer
I know very little about iptables, any idea what my forwarding rules would look like. because I am pretty sure that is it because when I look at the syslog OpenVPN is pushing the correct route to the client – ianc1215 Mar 8 '11 at 10:08
Yep iptables was the issue, I found an example of the rule needed to forward OpenVPN. Thanks for point me in the right direction. Now I can get some sleep. As far as route are concerned I checked the rouing tables on the client before I made my post I just did not include it in my question. Still thanks for your help considering the time. Oh yeah and I was pushing routes from the server. – ianc1215 Mar 8 '11 at 10:48

In the server config, you can set routes that your clients should take. For example:

push "route"

Both the pool and the server and the push route command must specify the same subnet outside the subnet of your LAN. Some more info an Routing and OpenVPN is to be found here:

Could you post the output of iptables -l?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.