Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an OpenVPN server running on Ubuntu 12.04 in an AWS VPC with 3 subnets. I am able to connect my client and can ping the server ( with no issues, however I cannot reach any other machine in the VPC from my client.

Some background info:

I can ping the server from itself.

I can ping the server from the client.

I CANNOT ping the client from the server.

I can ping machines in the VPC from the server.

I CANNOT ping machines in the VPC (Other than server) from my client.

I have enabled IPV4 forwarding on the server.

I have disabled source/dest checking.

I have setup my route tables in VPC to route traffic to my OpenVPN instance.

VPC Subnets:

The OpenVPN Server is running on and I am able to ping any server on the other subnets from it, its the client that is unable to reach anything on the subnets.

Server Conf:

port 80
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
ifconfig-pool-persist ipp.txt
push "route"
push "dhcp-option DNS"
push "dhcp-option DNS"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
max-clients 100
user nobody
group nogroup
status openvpn-status.log
log         openvpn.log
verb 6
mute 20

Client Config:

dev tun
proto tcp
remote 80
resolv-retry infinite
ca ca.crt
cert olo-imac.crt
key olo-imac.key
tls-auth ta.key 1
verb 3

Server Routes:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         UG    100    0        0 eth0        *        U     0      0        0 eth0     UG    0      0        0 tun0        *      UH    0      0        0 tun0

Client Routes:

Network Destination        Netmask          Gateway       Interface  Metric
     10     30     30         On-link    286         On-link    286         On-link    286         On-link    306         On-link    306         On-link    306         On-link    266         On-link    266         On-link    266         On-link    306         On-link    266         On-link    286         On-link    306         On-link    266         On-link    286
share|improve this question
Would someone like to explain the downvote? I'm happy to revise the question or give more info, but a downvote with no feedback is not constructive. – CIGuy Sep 9 '13 at 14:29
Run TCPDump on your OpenVPN server, you should be able to see if the packets are indeed being forwarded from the server to the other hosts on the remote network – GeoSword Sep 9 '13 at 15:09
@GeoSword Thanks for the tip, that did the trick. I was able to see that packets were not being forwarded, which led me to investigate my forwarding settings. Turns out forwarding settings had not been applied even though I had restarted networking on the machine. Rebooting the machine solved my problem, still not sure why that was necessary. Please add your tip as an answer and I will award you the bounty. I feel pretty dumb for not figuring this out before. :) – CIGuy Sep 10 '13 at 14:17
Glad you cracked it! :D Answer posted below. – GeoSword Sep 10 '13 at 15:05
up vote 0 down vote accepted

In response to CIGuy's comments above.

Run tcpdump on your OpenVPN server. you should be able to see if the packets are indeed being forwarded from the server to the other hosts on the remote network.

Something like:

tcpdump -i any -v host <ip> 

where is the ip you are trying to ping. You can also write the packet capture to file for later analysis in wireshark by adding

-s0 -w somefile.pcap

Keep in mind that some versions of tcpdump will chroot itself, so if somefile.pcap doesn't show where you expect it to be, check /var/lib/tcpdump/

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.