Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two Windows 2003 servers (192.168.1.200, and 192.0.2.2) both connected by an OpenVPN VPN on 192.168.4.0. Both servers route the subnet of the other no problem. i.e. I can get to any workstation on the 192.0.2.0 network from the OpenVPN server at 192.168.1.200 and I can get to any workstation on the 192.168.1.0 network from the OpenVPN server at 192.0.2.2. I cannot, however, get to any workstation on the 192.0.2.0 network from any workstation on the 192.168.1.0 network and vice versa.

I have routed both subnets (192.168.1.0 and 192.0.2.0) on their network's perspective routers. This is the route on my router converted to a windows route command: route add 192.0.2.0 255.255.255.0 gw 192.168.1.200. That should route all traffic from any machine on the 192.168.1.0 network going to the 192.0.2.0 network through the router/gateway at 192.168.1.1 then through the server at 192.168.1.200 and finally through the VPN. That server has a route in place that routes all traffic to 192.0.2.0 through the VPN. I know that works because I can connect/ping any 192.0.2.x IP on the other network from the server at 192.168.1.200. Also, IP forwarding is enabled on both servers. Why doesn't the server at 192.168.1.200 take the traffic from my router and route it through the VPN like it does when I am local on the server? I have to be missing something.

Thanks in advance.

---Edit--- Routing Tables

Windows 7 Workstation on 192.168.1.0

Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1      192.168.1.2     10
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        192.0.2.0    255.255.255.0      192.168.4.1      192.168.4.2     31
      192.168.1.0    255.255.255.0         On-link       192.168.1.2    266
      192.168.1.2  255.255.255.255         On-link       192.168.1.2    266
    192.168.1.255  255.255.255.255         On-link       192.168.1.2    266
      192.168.4.0    255.255.255.0         On-link       192.168.4.2    286
      192.168.4.2  255.255.255.255         On-link       192.168.4.2    286
    192.168.4.255  255.255.255.255         On-link       192.168.4.2    286
     192.168.56.0    255.255.255.0         On-link      192.168.56.1    276
     192.168.56.1  255.255.255.255         On-link      192.168.56.1    276
   192.168.56.255  255.255.255.255         On-link      192.168.56.1    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      192.168.56.1    276
        224.0.0.0        240.0.0.0         On-link       192.168.4.2    286
        224.0.0.0        240.0.0.0         On-link       192.168.1.2    266
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      192.168.56.1    276
  255.255.255.255  255.255.255.255         On-link       192.168.4.2    286
  255.255.255.255  255.255.255.255         On-link       192.168.1.2    266

Windows 2003 (standard) OpenVPN Server on 192.168.1.0

Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.200     10
        127.0.0.0        255.0.0.0        127.0.0.1        127.0.0.1      1
        192.0.2.0    255.255.255.0      192.168.4.1      192.168.4.3      1
      192.168.1.0    255.255.255.0    192.168.1.200    192.168.1.200     10
    192.168.1.200  255.255.255.255        127.0.0.1        127.0.0.1     10
    192.168.1.255  255.255.255.255    192.168.1.200    192.168.1.200     10
      192.168.4.0    255.255.255.0      192.168.4.3      192.168.4.3     30
      192.168.4.3  255.255.255.255        127.0.0.1        127.0.0.1     30
    192.168.4.255  255.255.255.255      192.168.4.3      192.168.4.3     30
        224.0.0.0        240.0.0.0    192.168.1.200    192.168.1.200     10
        224.0.0.0        240.0.0.0      192.168.4.3      192.168.4.3     30
  255.255.255.255  255.255.255.255    192.168.1.200    192.168.1.200      1
  255.255.255.255  255.255.255.255      192.168.4.3      192.168.4.3      1
Default Gateway:       192.168.1.1

Netgear Router on 192.168.1.0

#   Active  Name        Destination Gateway
1   Yes OpenVPN     192.0.2.0   192.168.1.200

Windows 2003 R2 (standard) OpenVPN Server on 192.0.2.0

Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0        192.0.2.1        192.0.2.2     10
        127.0.0.0        255.0.0.0        127.0.0.1        127.0.0.1      1
        192.0.2.0    255.255.255.0        192.0.2.2        192.0.2.2     10
        192.0.2.2  255.255.255.255        127.0.0.1        127.0.0.1     10
      192.0.2.255  255.255.255.255        192.0.2.2        192.0.2.2     10
      192.168.2.0    255.255.255.0      192.168.2.1      192.168.2.1     10
      192.168.2.1  255.255.255.255        127.0.0.1        127.0.0.1     10
    192.168.2.255  255.255.255.255      192.168.2.1      192.168.2.1     10
      192.168.4.0    255.255.255.0      192.168.4.1      192.168.4.1     30
      192.168.4.1  255.255.255.255        127.0.0.1        127.0.0.1     30
    192.168.4.255  255.255.255.255      192.168.4.1      192.168.4.1     30
        224.0.0.0        240.0.0.0        192.0.2.2        192.0.2.2     10
        224.0.0.0        240.0.0.0      192.168.2.1      192.168.2.1     10
        224.0.0.0        240.0.0.0      192.168.4.1      192.168.4.1     30
  255.255.255.255  255.255.255.255        192.0.2.2        192.0.2.2      1
  255.255.255.255  255.255.255.255      192.168.2.1      192.168.2.1      1
  255.255.255.255  255.255.255.255      192.168.4.1      192.168.4.1      1
Default Gateway:         192.0.2.1

Linux Router on 192.0.2.0

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
xx.yy.zz.ww     *               255.255.255.248 U     0      0        0 eth1
192.168.4.0     192.0.2.2       255.255.255.0   UG    0      0        0 eth0
192.0.2.0       *               255.255.255.0   U     0      0        0 eth0
169.254.0.0     *               255.255.0.0     U     0      0        0 eth1
default         hxx-yy-zz-ww.   0.0.0.0         UG    0      0        0 eth1

OpenVPN config file from 192.168.1.0

client
dev tap
dev-node OpenVPN
proto tcp
remote www.xxx.yyy.zzz 5100
resolv-retry infinite
nobind
persist-key
persist-tun

ca ca.crt
cert remote_server.crt
key remote_server.key

comp-lzo
verb 6
mute 20

route 192.0.2.0 255.255.255.0

OpenVPN config from 192.0.2.0

mode server
port 5100
proto tcp
dev tap
dev-node OpenVPN

ca ca.crt
cert server.crt
key server.key

dh dh1024.pem
server 192.168.4.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.0.2.0 255.255.255.0"
push "dhcp-option DNS 192.0.2.2"
push "dhcp-option DNS 192.0.2.3"
client-to-client
duplicate-cn
keepalive 10 120
comp-lzo
max-clients 10
persist-key
persist-tun
status openvpn-status.log
verb 6
mute 20
share|improve this question
1  
Is 192.0.2 your public address space? You know that isn't a private address right? Can you show us the route tables from both servers? Can you show us your OpenVPN configurations. –  Zoredache May 24 '11 at 17:08
    
It will take me a little bit to gather it up to post. But I will get that information. –  Albion May 24 '11 at 19:15
    
Ignore the last comment. This system has too many 5 second rules. lol When I first came to this company, some 15 years, ago their network was a bunch of Irix boxes talking to an RS6000 server. The original installer of the network used 192.0.2 for the internal network. I had to make it all work with windows without production interruption. I was young and far less experienced, so I'm stuck with it.:) IANA still claims the range is for Test-Net-1, not public. I could be wrong though. Anyway, I'll get that information. It will take a little bit for me to gather the information to post. Thanks –  Albion May 24 '11 at 19:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.