up vote 0 down vote favorite
share [g+] share [fb]

We're using OpenVPN at a branch office to connect remote users and it's working very well for internal resources, but recently we've added a permanent VPN connection between the branch office and head office, and I can't for the life of me get any OpenVPN remote users to see the servers at the head office across the permanent VPN. Here's a brief diagram:

diagram

To explain, the branch office is on 10.0.0.x, when the VPN to the head office was put in, it was assigned a different subnet of 10.100.0.0 and I created an IPFire VM that is used by workstations on the 10.0.0.x network as a gateway to the 10.100 network. I then added a permanent route to the workstations on 10.0.0.x for the head office server resources on the 10.200.x.x subnet as follows:

route add -p 10.200.0.0 mask 255.255.0.0 10.0.0.245

And all the internal workstations can see the head office resources perfectly. Any OpenVPN clients cannot, however. The OpenVPN clients can see resources on the 10.0.0.x subnet perfectly, and can ping the IPFire gateway that's being used by the internal workstations, but adding a route to the OpenVPN clients does not allow them to see any head office network resources. Any ideas what to check on the OpenVPN installation?

link|improve this question
Can you define "see"? Is there zero connectivity at all between the two? – MDMarra Feb 1 at 19:50
Correct, zero connectivity between the VPN user and the head office resources. The VPN user can branch office servers, workstations and the IPfire gateway, but not anything at head office. The workstations in the branch office can ping both local resources and workstations and the servers at head office. – barc0001 Feb 1 at 20:12
feedback

1 Answer

up vote 1 down vote

Have you considered setting up NAT on the OpenVPN box, so that any connections coming from the OpenVPN connection simply appear to be coming from the OpenVPN box? If not, then have you setup routes so that all the other routers in the network know that 10.8.0.0/? should be forwarded to the OpenVPN host?

link|improve this answer
OpenVPN is operating in NAT mode, yes. I've also set a route up on the IPFire machine to 10.8.0.0 just in case, though I didn't believe that to be required since the OpenVPN clients are NATted – barc0001 Feb 1 at 20:10
1  
So can the OpenVPN server itself access systems at the head office? – Zoredache Feb 1 at 20:14
No, it can't, despite having the same route added as the office workstations: root@localhost:~# route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.0.0.0 * 255.255.255.0 U 0 0 0 eth0 10.8.0.0 * 255.255.255.0 U 0 0 0 as0t0 10.200.0.0 10.0.0.245 255.255.0.0 UG 0 0 0 eth0 – barc0001 Feb 1 at 20:22
Well you almost certainly need to start there then. If the OpenVPN server cannot reach systems, then devices connecting too it, will almost certainly fail. – Zoredache Feb 1 at 21:26
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.