Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to enable split tunneling with my VPN network. I am using OpenVPN to host my VPN network and have follwed the steps to get split tunneling working however my clients still get the: 0.0.0.0 {VPN local address} push

Here is my server.conf file on the OpenVPN server, which has a real public interface with a real IP.

port 1194
proto udp
dev tun
#ssl stuff
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/dh2048.pem
#server statement and subnet for VPN IPs /24 for simplicity
server 10.0.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt # for persistant IPing of VPN clients
push "route-nopull"
push "route 172.16.0.11 255.255.255.255 vpn_gateway" #internal node i want VPN clients to have access to
push "route 172.16.0.3 255.255.255.255 vpn_gateway" #internal node I want VPN clients to have access to
push "dhcp-option DNS 172.16.0.3" # so VPN clients use internal dns for resolution
client-to-client
[rest of config omitted]

Client's Route table where: 172.16.250.10 is the client's VPN address {publicIP} = is the public IP of the client's network {localIP} = is the localIP such as 192.168.x.x of the local network it is on, not the VPN.

Destination      Gateway        Genmask         Flags
0.0.0.0          10.0.0.10      0.0.0.0         UG
{publicIP}       {localIP}      255.255.255.255 UGH
10.0.0.0         10.0.0.10      255.255.255.0   Ug
10.0.0.10        0.0.0.0        255.255.255.255 UH   # don't really understand this statement
172.16.0.3       10.0.0.10      255.255.255.255 UGH  #from push command in server.conf
172.16.0.11      10.0.0.10      255.255.255.255 UGH  #from push command in server.conf
{client's localSubnet}    0.0.0.0        255.255.255.0   U

IPTables on the OpenVPN box, this box has the public interface used to accept incoming OpenVPN requests.

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  10.0.0.0/24      172.16.0.3          /* Allow VPN IPs to connect to the internal DNS for resolution */
ACCEPT     all  --  10.0.0.0/24      172.16.0.11         /* Allows VPN IPs to connect to homeserver */

I believe these are the only configs involved with VPN connectivity in my setup. So I am a little confused since my VPN clients recieve the explicity push statements into their route tables, however client's still cannot use their local gateway for IP requests not destined for the 10.0.0.0/24 or 172.16.0.0/24 networks..

Thank you for the help and time in advanced.

-Jim

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.