Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am having trouble with a site to site tunnel. Both routers are centos based routers. Router A is the server, and router B is the client.

The VPN tunnel is established. From router B, I can ping anything on the network of router A. From router A (and the network behind it),

I cannot ping anything on the network behind router B, or behind router A.

So basically, router B is the only node that can ping anything on the opposite network.

Any idea where I should look? They are both running iptables. IP Forwarding is enabled.

I am guessing that router B can access anything on router A's network because it is using the tunnel interface, and not the interface of the local network.

There is no route on the server (router A) for my destination network. What should the default gateway of this be? The P-t-P address of router B?

Sorry if none of this makes sense!

Server config:

local 113.192.xx,xx
port 1194
proto tcp
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
push "route"
client-config-dir client-configs
keepalive 5 30
status 1194.log
verb 5


dev tun
proto tcp
remote 113.192.xx.xx 1194
resolv-retry infinite
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/remote.crt
key /etc/openvpn/keys/remote.key
verb 3

When the tunnel is up, the rounting table looks like this:


Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface UH        0 0          0 tun0 UGH       0 0          0 tun0   U         0 0          0 eth2   UG        0 0          0 tun0         UG        0 0          0 eth2


Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface UH        0 0          0 tun0
113.192.xx.xx U         0 0          0 eth1   UG        0 0          0 tun0   UG        0 0          0 tun0   U         0 0          0 eth0     U         0 0          0 eth1         UG        0 0          0 eth1

As you can probably guess, the network behind the VPN server is the network, and the network behind the client is the network

share|improve this question
Since they are both running iptables have you tried clearing your rules to rule-out a firewalling issue? Can you post the network configuration and routing configuration for the two systems? – Zoredache Aug 11 '12 at 5:44
I've turned iptables off on both ends to rule that out. I'm sure the problem is at the server end. I'll update my original post – Lock Aug 11 '12 at 6:09
up vote 0 down vote accepted

What you're missing is that the OpenVPN server doesn't know which client has access to the network. You need to tell it this with an iroute directive in the appropriate client config. Assuming that the CN of the client's certificate is "", add this to /etc/openvpn/client-configs/

share|improve this answer
Thankyou. I actually worked it out before reading your post, but that was kind of what the issue was. My config file was referencing the client-configs directory, but not as an absolute path. I changed this and it worked. I also had the wrong name for the CN of the certificate. I checked my persistent ipp file and got the CN from there – Lock Aug 12 '12 at 6:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.