Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've managed to setup openvpn in a test server, configuring the PKI and distributing certificates to test client machines. I can ssh from the client machines to the openvpn server using the IP of the other end of the tun bridge:

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:  P-t-P:  Mask:
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

which is achieved with this line in the openvpn configuration file:


i'm starting openvpn with the following openvpn-startup.sh script


# load the firewall

# load TUN/TAP kernel module
modprobe tun

# enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
openvpn --script-security 2 --cd $dir --daemon --config tls-office.conf --log $dir/log/vpn.log 

this is tls-office.conf:

dev tun

up ./office.up
# the office.up script has this:
#route add -net netmask gw $5 
#(in the openvpn manual, it says that if the Device is TUN, $5 stands for Remote IP)

dh /home/lurscher/keys/dh1024.pem
ca /home/lurscher/keys/ca.crt
cert /home/lurscher/keys/vpnCh8TestServer.crt
key /home/lurscher/keys/vpnCh8TestServer.key
verb 3

For the client machine, i'm using the following config file:

dev tun
remote my.server.com

# is our local VPN endpoint (home).
# is our remote VPN endpoint (office).

# Our up script will establish routes
# once the VPN is alive.
up ./home.up
#route add -net netmask gw $5 
#(in the openvpn manual, it says that if the Device is TUN, $5 stands for Remote IP)

ca /home/chuckq/keys/ca.crt
cert /home/chuckq/keys/vpnCh8TestClient.crt
key /home/chuckq/keys/vpnCh8TestClient.key
ns-cert-type server
; port 1194
; user nobody
; group nogroup
verb 3

However, i am a bit at a lost how to connect/see the IP pf other machines in the same side of the tunnel where the openvpn server is. I assume they get IP in the 10.1.X.X range, but i don't see any of them. Maybe i just don't know how to see what ip is assigned behind the tunnel because i just use ifconfig to know what local ip a machine has, but each machine reports only the tun IP bridge nodes (the client and the server) but no mention about other machines on either end

So, suppose there is a http server at a machine behind the openvpn server, its not on the same machine; how do i reach it or see it from the openvpn clients?


share|improve this question

1 Answer 1

up vote 1 down vote accepted

The following directive

status /var/log/openvpn-status.log

in the OpenVPN server's config file will maintain a list of endpoint addresses and routed networks of all your OpenVPN clients in the /var/log/openvpn-status.log file, which is updated every 60 seconds as long as OpenVPN is running.

share|improve this answer
no its not creating that file, i've added to the post the commandline used in my openvpn-startup.sh script, do you know what option do i need to pass in order to create a status log? –  lurscher May 17 '11 at 11:57
It is not apparent that "status" is used anywhere - could you post tls-office.conf as well please? –  the-wabbit May 17 '11 at 12:03
just updated the post with the full configuration file –  lurscher May 17 '11 at 12:13
reading the docs, it seems the config you mention is created with ifconfig-pool-persist option, in fact it seems i am not using server mode at all, just that lousy ifconfig line –  lurscher May 17 '11 at 12:37
Indeed you did not specify "mode server", so you are running the default p2p mode. ifconfig-pool-persist is not a mandatory option, but take a look at the sample server config for a reasonable working set of options: openvpn.net/index.php/open-source/documentation/… –  the-wabbit May 17 '11 at 14:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.