Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to setup an OpenVPN server but I'm stuck with routing problem...

This my network configuration:

Client(172.17.17.6)<->Router+Firewall<->OVPN Srv(WAN:197.174.211.77)<->Subnet A 197.174.211.0/255.255.255.224 AND Subnet B 197.174.211.64/255.255.255.224

I can connect to the server and get an IP but I can't access to servers on both subnets. I made sure that the OpenVPN can ping, wget etc to servers in Subnet A and B.

Here is my server configuration:

port 1194
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
server 172.17.17.0 255.255.255.0
ifconfig-pool-persist ipp.txt
route 197.174.211.0 255.255.255.224
route 197.174.211.64 255.255.255.224
push "route 197.174.211.0  255.255.255.224"
push "route 197.174.211.64  255.255.255.224"
client-to-client

duplicate-cn

keepalive 10 120
comp-lzo
max-clients 20
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status-tcp.log
log-append /var/log/openvpn-tcp.log
verb 5

My server route table:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
172.17.17.2     *               255.255.255.255 UH    0      0        0 tun0
197.174.211.64  172.17.17.2     255.255.255.224 UG    0      0        0 tun0
197.174.211.64  *               255.255.255.224 U     0      0        0 eth0
172.17.17.0     172.17.17.2     255.255.255.0   UG    0      0        0 tun0
default         197.174.211.65  0.0.0.0         UG    0      0        0 eth0

When I do

cat /proc/sys/net/ipv4/ip_forward
1

So I guess ip_forward is activated...

I see that OpenVPN receives traffic from the tunnel but doesn't forward it...

**root@vpn:/etc/openvpn# tcpdump -i tun0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
15:24:42.913610 IP 172.17.17.6 > : ICMP echo request, id 1, seq 729,   length 40
15:24:47.743495 IP 172.17.17.6 > 197.174.211.11: ICMP echo request, id 1, seq 730, length 40

But I got no response in my client :-(

I'm not using iptables or any firewall on my server...

Does anyone have an idea?

Thank you very much for your help

Phil.

Config : Debian 6.0.5, openvpn from apt

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.