Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have OpenVPN set up on my router (running IPFire) and am able to connect to it from off-site with Tunnelblick on OS X 10.7. Once connected I'm unable to properly access any of the systems behind the router. Here's a relevant portion of how the IPs are currently distributed:


  • - router
  • - OS X server
  • - Linux server


  • - client computer running OS X

As mentioned before, I can connect via OpenVPN from off-site without issue. I can ping both and (what appears to be), but not (although I can ping it on-site). I discovered that SSH-ing to actually logs me in to the router (which should only live at, so I'm a little confused how that's even possible.

Here is my server.conf file for OpenVPN:

daemon openvpnserver
writepid /var/run/
#DAN prepare OpenVPN for listening on blue and orange
dev tun
tun-mtu 1400
proto udp
port 1194
script-security 3 system
ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600
ca /var/ipfire/ovpn/ca/cacert.pem
cert /var/ipfire/ovpn/certs/servercert.pem
key /var/ipfire/ovpn/certs/serverkey.pem
dh /var/ipfire/ovpn/ca/dh1024.pem
push "route"
status-version 1
status /var/log/ovpnserver.log 30
cipher AES-256-CBC
max-clients 100
tls-verify /var/ipfire/ovpn/verify
crl-verify /var/ipfire/ovpn/crls/cacrl.pem
user nobody
group nobody
verb 3

Here's my client config:

dev tun
proto udp
tun-mtu 1400
remote [redacted] 1194
pkcs12 [redacted].p12
cipher AES-256-CBC
verb 3
ns-cert-type server
tls-remote [redacted]

Running netstat -nr on the client yields the following output while connected with OpenVPN:

Routing tables

Destination        Gateway            Flags        Refs      Use   Netif Expire
default           UGSc           17        5     en0       UGSc            0        0    tun0       UH              2        0    tun0
127                UCS             0        0     lo0          UH              9    45124     lo0
169.254            link#4             UCS             0        0     en0
172.16             link#4             UCS             3        0     en0         98:2c:be:a5:a7:99  UHLWIi         18     1689     en0   1199          UHS             0        0     lo0        0:25:4b:b3:cf:84   UHLWIi          4   695688     en0   1122     ff:ff:ff:ff:ff:ff  UHLWbI          0       38     en0
192.168.1       UGSc            0        0    tun0

Destination                             Gateway                         Flags         Netif Expire
::1                                     link#1                          UHL             lo0
fe80::%lo0/64                           fe80::1%lo0                     UcI             lo0
fe80::1%lo0                             link#1                          UHLI            lo0
fe80::%en0/64                           link#4                          UCI             en0
fe80::21e:c2ff:fe01:6f1b%en0            0:1e:c2:1:6f:1b                 UHLI            lo0
ff01::%lo0/32                           fe80::1%lo0                     UmCI            lo0
ff01::%en0/32                           link#4                          UmCI            en0
ff02::%lo0/32                           fe80::1%lo0                     UmCI            lo0
ff02::%en0/32                           link#4                          UmCI            en0

Does anyone have any suggestions on how to get everything properly routed from the client to the on-site network?

share|improve this question

Your config looks fine:

Destination        Gateway            Flags        Refs      Use   Netif Expire
192.168.1       UGSc            0        0    tun0

Make sure that you've enabled IP forwarding. I'm not familiar with IPFire, but since it's based on Linux, use this command:

echo 1 > /proc/sys/net/ipv4/ip_forward
share|improve this answer
Thanks quanta, I'd seen that mentioned in a few other questions similar to mine. Unfortunately ip_forward was already set to 1. – kschaller Oct 13 '11 at 3:55
Besides the .115 and .117, can you ping the other machine behind the OpenVPN server? What happens if you traceoute -T Please post the routing table on – quanta Oct 13 '11 at 4:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.