Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I setup an Openvpn server on a centos box and I can get the client to connect (osx) but can't access the internet or even the local network. I thought maybe DNS but couldn't access any sites via IP. Any help would be appreciated. I will list my config files below.


port 1194 #- port
proto udp #- protocol
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
reneg-sec 0
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh2048.pem
plugin /usr/lib64/openvpn/plugins/ /etc/pam.d/login #- Comment this line if you are using FreeRADIUS
#plugin /etc/openvpn/ /etc/openvpn/radiusplugin.cnf #- Uncomment this line if you are using FreeRADIUS
push "redirect-gateway def1"
push "dhcp-option DNS"
push "dhcp-option DNS"
keepalive 5 30
status 1194.log
verb 3


dev tun
proto udp
remote My server IP 1194 # - Your server IP and OpenVPN Port
resolv-retry infinite
tun-mtu 1500
ca ca.crt
cert client1.crt
key client1.key
verb 3

ifconfig (client)::

    lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
    inet netmask 0xff000000 
    inet6 ::1 prefixlen 128 
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
    ether 10:40:f3:88:27:6c 
    inet6 fe80::1240:f3ff:fe88:276c%en0 prefixlen 64 scopeid 0x4 
    inet netmask 0xffffff00 broadcast
    media: autoselect
    status: active
    ether 02:40:f3:88:27:6c 
    media: autoselect
    status: inactive
    inet --> netmask 0xffffffff 
    open (pid 7494)

    ifconfig (server)::

eth0      Link encap:Ethernet  HWaddr 00:23:54:03:F2:BB
          inet addr:  Bcast:  Mask:
          inet6 addr: fe80::223:54ff:fe03:f2bb/64 Scope:Link
          RX packets:113530 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13376 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:25518343 (24.3 MiB)  TX bytes:1310138 (1.2 MiB)
          Interrupt:26 Base address:0xe000

lo        Link encap:Local Loopback
          inet addr:  Mask:
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:6 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:828 (828.0 b)  TX bytes:828 (828.0 b)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:  P-t-P:  Mask:
          RX packets:397 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
share|improve this question
Your client's tun0 says that its remote endpoint it, but the server's tun0 address is I find that odd. – 200_success Aug 26 '13 at 20:16

Firstly check that you can ping the OpenVPN Servers VPN Range IP,, assuming that is successful:

Follow the instructions under Using Routing, it assumes your internet connection is eth0, if it isn't change the value to your internet connections adapter identifier (ppp0, atm0) etc. It also assumes that your OpenVPN server is your main router for the internet connection.

share|improve this answer

In client box, do these testing:

1. Ping, if not ok check client/server firewall let ICMP can pass through, then we can debug deeply.
2. Ping, if not ok check:
    A. Client routing table, where the traffic goes while destination network is, it should go to
    B. Server sysctl net.ipv4.ip_forward, it should be 1.
    C. Server NAT/MASQUERADE with iptables.
3. Traceroute, if not ok check which hop stopped the traffic.
share|improve this answer
You can't just route VPN traffic out it's using an RFC1918 address, it has to be NAT'd or masqueraded, also if you read his config file, you'd know that he has the VPN client pushing the default route (ie everything not otherwise specified) through the VPN. – Aaron Tate Aug 26 '13 at 8:02
Yeah, forget the masquerade. – Sunry Aug 26 '13 at 8:04
1. OK 2. OK 3. doesn't even get 1 hop. – Fr0ntSight Aug 26 '13 at 22:37
Your client doesn't konw where to direct the traffic to, check client's route table, the traffic destination to should route to also. – Sunry Aug 26 '13 at 23:28

Your IPTables are probably wrong. When I can connect to a OpenVPN node but can not access the internet and can ping locally, it is NAT issue.

See this for help:

share|improve this answer

After configuring your OpenVPN server and client, there's one more thing which needs to be done: Add a route on each computer (or in your network's router) in the local network which is supposed to communicate with computers in the vpn network.


My home network is:
OpenVPN network is:

The OpenVPN server physical NIC is configured as:

The OpenVPN server vpn NIC is configured as:

When my client connects to the VPN it gets IP: In order for the other computers on the network (home computers) to be able to communicate with machines which are connected through vpn I had to add a specific route:

route add -net gw metric 1

This enables computers on the home network to communicate with computers on the OpenVPN network and vice versa.

In your case it will enable your network computers to communicate with the vpn computers.

I wrote a very detailed article on How to install and configure OpenVPN server and the above steps are described there, feel free to check it out... it may help you: How To: OpenVPN on CentOS

share|improve this answer

on windows, the client have to run as "Administrator" otherwise the routing will not work. I wonder if there is something similar on mac? what openvpn client (if any) do you use on the mac? have you tried to run with elevated permissions?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.