Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am trying to find some relevant documentation or what directives I need in either the OpenVPN server configuration or client configuration to accommodate for this use case.

I have an OpenVPN server that clients connect to. The OpenVPN server can communicate directly with any of the clients already, this is not an issue. The client is able to reach any machine on the private subnet where OpenVPN resides, this is also not an issue. My issue is that the reverse is currently not possible - I have servers on the same subnet as the OpenVPN box that cannot reach any of the connecting clients. I'd like to be able to SSH to them and more, the same way the client can reach the servers behind the OpenVPN subnet.

What do I need to do to make this possible? I already have masquerading rules set on the OpenVPN box:

iptables -t nat -A POSTROUTING -s 192.168.50.0/24 -o eth0 -j MASQUERADE

IP Forwarding is enabled:

echo 1 >/proc/sys/net/ipv4/ip_forward

I added a route on the server behind the private subnet to be aware of the route:

192.168.50.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

What am I missing?

share|improve this question
    
Why are you using masquerading? If you are masquerading the VPN clients, how are you expecting to connect to them? That route you posted sure looks weird, what command did you use to produce that? Can you show your OpenVPN config for the server, and the full route table of the OpenVPN box? –  Zoredache Nov 10 '11 at 20:05
    

2 Answers 2

up vote 0 down vote accepted

Is the OpenVPN server the same as your router?

If this isn't the case, you have to set static routes to use the OpenVPN server to get to the VPN clients.

So, if the OpenVPN server has IP 192.168.1.100, and the OpenVPN clients are 192.168.50.0/24, then your router will need something like:

route add -net 192.168.50.0 netmask 255.255.255.0 gw 192.168.1.100

or whatever is the appropriate syntax.

share|improve this answer

The client is able to reach any machine on the private subnet where OpenVPN resides, this is also not an issue. My issue is that the reverse is currently not possible - I have servers on the same subnet as the OpenVPN box that cannot reach any of the connecting clients.

If that is true it means that the routing is all correct. I would suspect that a firewall (probably on the OpenVPN server) is blocking traffic in that direction. What does iptables -nvL and iptables -nvL -t nat look like on the VPN server?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.