Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have flashed a router at two separate sites with DD-WRT firmware and setup OpenVPN on both. once connected the client can ping computers on the servers LAN however the server cannot ping IPs on the clients lan. I am executing the ping command in the shell for the routers (so i don't have to remote into local machines etc.)

I disabled the firewall at both sites (this is being done on a test config). Am I still missing something here? The config I used is below. id really appreciate any help/guidance.

Do I need to also push a route to the VPN server ips?

192.168.2.0 is client subnet

192.168.4.0 is server subnet

Thank you

Sever.conf

server 192.168.5.0 255.255.255.0
client-config-dir /tmp/openvpn/ccd
route 192.168.2.0 255.255.255.0
push "route 192.168.4.0 255.255.255.0"
push "route 192.168.2.0 255.255.255.0"
client-to-client

dev tun0
proto udp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
management port
management localhost 5001

Startup Command

mkdir -p /tmp/openvpn/ccd
echo "iroute 192.168.2.0 255.255.255.0" > /tmp/openvpn/ccd/client1

Server Router Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.5.2     *               255.255.255.255 UH    0      0        0 tun0
192.168.5.0     192.168.5.2     255.255.255.0   UG    0      0        0 tun0
192.168.4.0     *               255.255.255.0   U     0      0        0 br0
192.168.2.0     192.168.5.2     255.255.255.0   UG    0      0        0 tun0
192.168.1.0     *               255.255.255.0   U     0      0        0 vlan1
169.254.0.0     *               255.255.0.0     U     0      0        0 br0
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
default         192.168.1.1     0.0.0.0         UG    0      0        0 vlan1

Client router Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.5.5     *               255.255.255.255 UH    0      0        0 tun0
192.168.5.0     192.168.5.5     255.255.255.0   UG    0      0        0 tun0
192.168.4.0     192.168.5.5     255.255.255.0   UG    0      0        0 tun0
192.168.2.0     *               255.255.255.0   U     0      0        0 br0
74.21X.XX.0     *               255.255.255.0   U     0      0        0 vlan1
169.254.0.0     *               255.255.0.0     U     0      0        0 br0
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
default         static-74-21X-X 0.0.0.0         UG    0      0        0 vlan1

Client setup (just in case)

Client Setup

share|improve this question
    
It may be helpful if you could share the route tables on both the VPN systems. –  Zoredache Sep 16 '11 at 23:49
    
sure here ya go –  Maurycy_was_userxxxxxx Sep 18 '11 at 18:46
    
I added pretty much all the info I could think of. Let me know if anything else is needed. Id appreciate any sort of help. Thanks again –  Maurycy_was_userxxxxxx Sep 18 '11 at 19:01
    
any ideas please? –  Maurycy_was_userxxxxxx Sep 19 '11 at 14:46
    
I have se same problem... have you solved it? –  user114319 Mar 16 '12 at 13:04

1 Answer 1

You need to remove one of your "push" statements.

The server needs to push the announcement of its own subnets to the client so the client knows to route all 192.168.4.0 traffice through the VPN tunnel.

But you are also telling the client "if you see packets destined for 192.168.2.0, send them over the VPN". This will cause the server-to-client traffic to get lost in the VPN and never make it out onto the client network.

Remove that second push line, and you should be OK.

share|improve this answer
    
Thank you I am trying this right now and will get right back to you. Havent had time to get online since friday night. –  Maurycy_was_userxxxxxx Sep 18 '11 at 18:37
    
The connection remains one directional :(. Thank you very much tho. my understanding was that openvpn was "smart" and would not push the routes if the subnet was the same. Regardless it sadly didn't work. I wanted to give u that checkmark badly!!! –  Maurycy_was_userxxxxxx Sep 18 '11 at 18:57
    
any ideas? Sorry not trying to overload this, just really would appreciate some help. –  Maurycy_was_userxxxxxx Sep 19 '11 at 3:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.