Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have OpenVPN set up on my router (running IPFire) and am able to connect to it from off-site with Tunnelblick on OS X 10.7. Once connected I'm unable to properly access any of the systems behind the router. Here's a relevant portion of how the IPs are currently distributed:

On-site

  • 192.168.1.1 - router
  • 192.168.1.115 - OS X server
  • 192.168.1.117 - Linux server

Off-site

  • 172.16.1.33 - client computer running OS X

As mentioned before, I can connect via OpenVPN from off-site without issue. I can ping both 192.168.1.1 and (what appears to be) 192.168.1.117, but not 192.168.1.115 (although I can ping it on-site). I discovered that SSH-ing to 192.168.1.117 actually logs me in to the router (which should only live at 192.168.1.1), so I'm a little confused how that's even possible.

Here is my server.conf file for OpenVPN:

daemon openvpnserver
writepid /var/run/openvpn.pid
#DAN prepare OpenVPN for listening on blue and orange
;local 192.168.1.1
dev tun
tun-mtu 1400
proto udp
port 1194
script-security 3 system
ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600
tls-server
ca /var/ipfire/ovpn/ca/cacert.pem
cert /var/ipfire/ovpn/certs/servercert.pem
key /var/ipfire/ovpn/certs/serverkey.pem
dh /var/ipfire/ovpn/ca/dh1024.pem
server 10.219.213.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"
status-version 1
status /var/log/ovpnserver.log 30
cipher AES-256-CBC
comp-lzo
max-clients 100
tls-verify /var/ipfire/ovpn/verify
crl-verify /var/ipfire/ovpn/crls/cacrl.pem
user nobody
group nobody
persist-key
persist-tun
verb 3

Here's my client config:

tls-client
client
dev tun
proto udp
tun-mtu 1400
remote [redacted] 1194
pkcs12 [redacted].p12
cipher AES-256-CBC
comp-lzo
verb 3
ns-cert-type server
tls-remote [redacted]

Running netstat -nr on the client yields the following output while connected with OpenVPN:

Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            172.16.0.1         UGSc           17        5     en0
10.219.213.1/32    10.219.213.5       UGSc            0        0    tun0
10.219.213.5       10.219.213.6       UH              2        0    tun0
127                127.0.0.1          UCS             0        0     lo0
127.0.0.1          127.0.0.1          UH              9    45124     lo0
169.254            link#4             UCS             0        0     en0
172.16             link#4             UCS             3        0     en0
172.16.0.1         98:2c:be:a5:a7:99  UHLWIi         18     1689     en0   1199
172.16.1.33        127.0.0.1          UHS             0        0     lo0
172.16.1.36        0:25:4b:b3:cf:84   UHLWIi          4   695688     en0   1122
172.16.255.255     ff:ff:ff:ff:ff:ff  UHLWbI          0       38     en0
192.168.1          10.219.213.5       UGSc            0        0    tun0

Internet6:
Destination                             Gateway                         Flags         Netif Expire
::1                                     link#1                          UHL             lo0
fe80::%lo0/64                           fe80::1%lo0                     UcI             lo0
fe80::1%lo0                             link#1                          UHLI            lo0
fe80::%en0/64                           link#4                          UCI             en0
fe80::21e:c2ff:fe01:6f1b%en0            0:1e:c2:1:6f:1b                 UHLI            lo0
ff01::%lo0/32                           fe80::1%lo0                     UmCI            lo0
ff01::%en0/32                           link#4                          UmCI            en0
ff02::%lo0/32                           fe80::1%lo0                     UmCI            lo0
ff02::%en0/32                           link#4                          UmCI            en0

Does anyone have any suggestions on how to get everything properly routed from the client to the on-site network?

share|improve this question

1 Answer 1

Your config looks fine:

Destination        Gateway            Flags        Refs      Use   Netif Expire
...
192.168.1          10.219.213.5       UGSc            0        0    tun0

Make sure that you've enabled IP forwarding. I'm not familiar with IPFire, but since it's based on Linux, use this command:

echo 1 > /proc/sys/net/ipv4/ip_forward
share|improve this answer
    
Thanks quanta, I'd seen that mentioned in a few other questions similar to mine. Unfortunately ip_forward was already set to 1. –  kschaller Oct 13 '11 at 3:55
    
Besides the .115 and .117, can you ping the other machine behind the OpenVPN server? What happens if you traceoute -T 192.168.1.115? Please post the routing table on 192.168.1.115? –  quanta Oct 13 '11 at 4:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.