Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently developing on a system with distributed computers around the country. All of these are sitting behind a NAT and are self-controlled. As a Backup-plan if puppet fails or for other maintenance I thought about a small vpn-network to access the clients by ssh if I need to.

I've already connected the test-client successfully to the server, but I'm not able to ping or ssh to the client or vice versa (which is currently not needed).

The server is also secured by a iptables-setup. I tried couple iptables-entrys which are known for openvpn, but non of them is working.

How do I have to setup the server to get ssh 10.8.0.* or similar working?

Greets, Moritz

UPDATE: I found a false configuration on the client-side. It was configured as tls-client and not client. This made ping and ssh both ways possible.

share|improve this question
I have found that OpenVPN works really well with puppet. Since you can re-use the puppet keys and certificates (pki) issued to the server and clients as your keys within OpenVPN. – Zoredache Oct 16 '13 at 16:31
When you say you cannot ping or ssh, are you saying you can't doing it from your client or from the server? – CIA Oct 16 '13 at 18:48

I was working on something similar today (connecting to IPMI private LAN IPs). I found that a good way of doing it was to use a PPTP VPN as I couldn't get OpenVPN to play ball.

Pressuming you use Linux; Script I made to do it quickly (modify to your needs, make sure the eth interface in the iptable commands are right):

Centos 5:
rpm -i

Centos 6:
rpm -i

yum -y update
sysctl -p /etc/sysctl.conf

iptables -F
iptables -A INPUT -i eth1 -p tcp --dport 1723 -j ACCEPT
iptables -A INPUT -i eth1 -p gre -j ACCEPT
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -A FORWARD -i ppp+ -o eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o ppp+ -j ACCEPT
service iptables save
chkconfig pptpd on

echo "localip" >> /etc/pptpd.conf
echo "remoteip" >> /etc/pptpd.conf

echo "ms-dns" >> /etc/ppp/options.pptpd
echo "ms-dns" >> /etc/ppp/options.pptpd

echo "USERNAME     *       PASSWORD          *" >> /etc/ppp/chap-secrets

service pptpd start

Make sure to enable IP forwarding in /etc/sysctl.conf

Further PPTP Help:

share|improve this answer
Reliably getting PPTP through firewalls you don't control is going to be a lot more difficult then getting OpenVPN through firewalls. Getting GRE through some firewalls is not trivial. – Zoredache Oct 16 '13 at 16:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.