I have OpenVPN set up on my router (running IPFire) and am able to connect to it from off-site with Tunnelblick on OS X 10.7. Once connected I'm unable to properly access any of the systems behind the router. Here's a relevant portion of how the IPs are currently distributed:
- 192.168.1.1 - router
- 192.168.1.115 - OS X server
- 192.168.1.117 - Linux server
- 172.16.1.33 - client computer running OS X
As mentioned before, I can connect via OpenVPN from off-site without issue. I can ping both 192.168.1.1 and (what appears to be) 192.168.1.117, but not 192.168.1.115 (although I can ping it on-site). I discovered that SSH-ing to 192.168.1.117 actually logs me in to the router (which should only live at 192.168.1.1), so I'm a little confused how that's even possible.
Here is my
server.conf file for OpenVPN:
daemon openvpnserver writepid /var/run/openvpn.pid #DAN prepare OpenVPN for listening on blue and orange ;local 192.168.1.1 dev tun tun-mtu 1400 proto udp port 1194 script-security 3 system ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600 tls-server ca /var/ipfire/ovpn/ca/cacert.pem cert /var/ipfire/ovpn/certs/servercert.pem key /var/ipfire/ovpn/certs/serverkey.pem dh /var/ipfire/ovpn/ca/dh1024.pem server 10.219.213.0 255.255.255.0 push "route 192.168.1.0 255.255.255.0" status-version 1 status /var/log/ovpnserver.log 30 cipher AES-256-CBC comp-lzo max-clients 100 tls-verify /var/ipfire/ovpn/verify crl-verify /var/ipfire/ovpn/crls/cacrl.pem user nobody group nobody persist-key persist-tun verb 3
Here's my client config:
tls-client client dev tun proto udp tun-mtu 1400 remote [redacted] 1194 pkcs12 [redacted].p12 cipher AES-256-CBC comp-lzo verb 3 ns-cert-type server tls-remote [redacted]
netstat -nr on the client yields the following output while connected with OpenVPN:
Routing tables Internet: Destination Gateway Flags Refs Use Netif Expire default 172.16.0.1 UGSc 17 5 en0 10.219.213.1/32 10.219.213.5 UGSc 0 0 tun0 10.219.213.5 10.219.213.6 UH 2 0 tun0 127 127.0.0.1 UCS 0 0 lo0 127.0.0.1 127.0.0.1 UH 9 45124 lo0 169.254 link#4 UCS 0 0 en0 172.16 link#4 UCS 3 0 en0 172.16.0.1 98:2c:be:a5:a7:99 UHLWIi 18 1689 en0 1199 172.16.1.33 127.0.0.1 UHS 0 0 lo0 172.16.1.36 0:25:4b:b3:cf:84 UHLWIi 4 695688 en0 1122 172.16.255.255 ff:ff:ff:ff:ff:ff UHLWbI 0 38 en0 192.168.1 10.219.213.5 UGSc 0 0 tun0 Internet6: Destination Gateway Flags Netif Expire ::1 link#1 UHL lo0 fe80::%lo0/64 fe80::1%lo0 UcI lo0 fe80::1%lo0 link#1 UHLI lo0 fe80::%en0/64 link#4 UCI en0 fe80::21e:c2ff:fe01:6f1b%en0 0:1e:c2:1:6f:1b UHLI lo0 ff01::%lo0/32 fe80::1%lo0 UmCI lo0 ff01::%en0/32 link#4 UmCI en0 ff02::%lo0/32 fe80::1%lo0 UmCI lo0 ff02::%en0/32 link#4 UmCI en0
Does anyone have any suggestions on how to get everything properly routed from the client to the on-site network?