Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up a site-to-site OpenVPN,

For now:

Users on the client side can access the subnets on the server side.

accessing the VPN client machine [Its IP on the client subnet] works fine. But i can't access other machines on the same client subnet.

I have used this option in the server configuration: As these are private subnet i will add them as they are:

client-config-dir ccd

And created file the same as client name with the following contents:


The Client machine has this local IP which i can access from the server side.

The issue is that i'm non able to access any other machine on the client side.

Any Suggestions....

share|improve this question

The route statement in your server config and iroute statement should permit your packets to get to the remote site. But the remote site also needs routes knowing about the networks to route back over the VPN. You either need to add some route statements in the client config or add some push "route ..." statements in your ccd file.

In any case like troubleshooting any routing problem, you need traceroute and tcpdump/wireshark.

share|improve this answer
Thanks for advice, the route already added. The issue was that the machine on the client site that i was trying to reach did not have the gateway set properly. I performed source natting to reach and fix it, Thanks Again. – MohyedeenN Dec 4 '13 at 17:50

Actually the problem seems to be an openvpn bug of sorts. It seems that using topology net30 (the default, though that topology is now considered deprecated) somehow breaks openvpn's routing. First step is to add topology subnet to your server config file. The other thing you need to do is to add the vpn server's IP as the route's gateway, as there's ANOTHER OpenVPN bug that will barf at the route as it is. So


should look like


where is the server's IP on the tun0 interface.

If done correctly, you don't need to use any kind of natting at all.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.