Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to setup an OpenVPN server on Debian 6.0.5 (installed via apt) but I'm stuck with routing problem.

This my network configuration:

Client   <-> Router+Firewall <-> OVPN Server  <-> Subnet A       AND Subnet B 
172.17.17.6                      197.174.211.77   197.174.211.0/27   197.174.211.64/27

I can connect to the server and get an IP but I can't access to servers on both subnets. I made sure that the OpenVPN can ping, wget etc to servers in Subnet A and B.

Here is my server configuration:

port 1194
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
server 172.17.17.0 255.255.255.0
ifconfig-pool-persist ipp.txt
route 197.174.211.0 255.255.255.224
route 197.174.211.64 255.255.255.224
push "route 197.174.211.0  255.255.255.224"
push "route 197.174.211.64  255.255.255.224"
client-to-client

duplicate-cn

keepalive 10 120
comp-lzo
max-clients 20
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status-tcp.log
log-append /var/log/openvpn-tcp.log
verb 5

My server route table:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
172.17.17.2     *               255.255.255.255 UH    0      0        0 tun0
197.174.211.64  172.17.17.2     255.255.255.224 UG    0      0        0 tun0
197.174.211.64  *               255.255.255.224 U     0      0        0 eth0
172.17.17.0     172.17.17.2     255.255.255.0   UG    0      0        0 tun0
default         197.174.211.65  0.0.0.0         UG    0      0        0 eth0

When I do

cat /proc/sys/net/ipv4/ip_forward
1

So I guess ip_forward is activated...

I see that OpenVPN receives traffic from the tunnel but doesn't forward it...

**root@vpn:/etc/openvpn# tcpdump -i tun0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
15:24:42.913610 IP 172.17.17.6 > : ICMP echo request, id 1, seq 729,   length 40
15:24:47.743495 IP 172.17.17.6 > 197.174.211.11: ICMP echo request, id 1, seq 730, length 40

But I got no response in my client :-(

I'm not using iptables or any firewall on my server...

Does anyone have an idea?

share|improve this question

1 Answer 1

Client(172.17.17.6)<->Router+Firewall<->OVPN Srv(WAN:197.174.211.77)<->Subnet A 197.174.211.0/255.255.255.224 AND Subnet B 197.174.211.64/255.255.255.224

So your OpenVPN server locates in Subnet B. I assume your servers in Subnet A can route to Subnet B.

route 197.174.211.0 255.255.255.224         <---- You don't need this, remove it
route 197.174.211.64 255.255.255.224        <---- You don't need this, remove it
push "route 197.174.211.0  255.255.255.224"
push "route 197.174.211.64  255.255.255.224"

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
172.17.17.2     *               255.255.255.255 UH    0      0        0 tun0
197.174.211.64  172.17.17.2     255.255.255.224 UG    0      0        0 tun0  <-- Bad
197.174.211.64  *               255.255.255.224 U     0      0        0 eth0
172.17.17.0     172.17.17.2     255.255.255.0   UG    0      0        0 tun0
default         197.174.211.65  0.0.0.0         UG    0      0        0 eth0

Now 197.174.211.65 is your default router. You need to configure it for routing 172.17.17.0/24 to 197.174.211.77. You also need to configure router in Subnet A for this.

Another solution (with iptables installed):

iptables -t nat -A POSTROUTING -s 172.17.17.0/24 -o eth0 -j MASQUERADE
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.