Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am trying to set up OpenVPN to allow me to connect a number of laptops to my network in a way that allows the laptops to connect to specific computers via HTTP (to e.g. a server management page) and windows shares (to access files)

In the test environment my laptops live in a network with a 192.168.1.X address range. The host-network has a 10.66.77.X address range The server hosting the OpenVPN server has address I need to access some application server web pages on this machine, accessible on various ports The server with the windows shares as well as some other web based pages I need to access is on address

The config files for server and laptop are attached below. The laptop establishes the VPN connection without problems, but I cannot access any of the machines, even a simple ping fails. Maybe a routing problem? The routing table for the laptop is shown below as well - every idea is appreciated!

Thanks! Maik

Server config file

port 1194
dev tun

ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/projects.crt
key /etc/openvpn/keys/projects.key
dh /etc/openvpn/keys/dh1024.pem

ifconfig-pool-persist ipp.txt

push "route"

keepalive 10 60
inactive 600

user openvpn
group openvpn

verb 4

client config file

dev tun
proto udp
remote SERVERADDR 1194
resolv-retry infinite

ca ca.crt
cert accountingLaptop.crt
key accountingLaptop.key
ns-cert-type server
verb 3

Resulting routing table on client laptop

C:\Documents and Settings\User>route print
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 23 5a 9b 64 9b ...... Atheros AR8132 PCI-E Fast Ethernet Controller -
Packet Scheduler Miniport
0x3 ...00 24 2c 35 c9 6b ...... Dell Wireless 1395 WLAN Mini-Card - Packet Sched
uler Miniport
0x4 ...00 ff 5e 03 43 9b ...... TAP-Win32 Adapter V9 - Packet Scheduler Miniport

Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
       25       1       30       30       1       30       1       25       25       25       30       25               2       1       1       1
Default Gateway:
Persistent Routes:
share|improve this question

5 Answers 5

You don't want to NAT vpn connections, that will make all the clients appear to be coming from the vpn box, which makes troubleshooting a pain. You also don't want to add static routes for the vpn addresses to the servers, as that is not where such configuration belongs.

What you want to do is add a route for the vpn subnet on the router. In cisco speak you would just have something like this:

ip route

Any other router will have a similar command.

share|improve this answer

the issue may be that your VPN is not NAT on the vpn server, so that the VPN clients are directly connecting to the server with the ip, which is a network the other servers have no idea about. 2 solutions are to use iptables to masquerade as a nat on the server, or to add the routes static to the other servers.

share|improve this answer
Could you maybe provide a little guidance on what filter rules I would have to use to set up the masquerading? Many thanks, M –  Maik Sep 21 '09 at 8:28
i don't remember them off the top of my head, but they are in the How To on openvpn's site, this is from their site: iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE the site is –  Jimsmithkka Sep 21 '09 at 16:26

Check the status of IP routing flag on the server:

cat /proc/sys/net/ipv4/ip_forward 

should return "1"

share|improve this answer

OpenVPN needs to know about the subnet of your laptop, otherwise will drop the packets from that IP subnet. Check the logs.

Check the documentation for iroute

With that in place, it will add the appropriate ip routes to the server as well.

share|improve this answer

As a rule of thumb, you need static routes for every network which is not directly connected to your laptop.

So, assuming your OpenVPN server can talk to, you need to do the following

  • on the roaming laptops, add a route to via the OpenVPN server IP
  • on, add a route to the network via the OpenVPN server IP
share|improve this answer
The problem with point II (adding the route to 192.168.....) is, though, that I don't know how where the laptops are connecting from! Could be a wireless hotspot anywhere with unknown address range.... –  Maik Sep 21 '09 at 8:26
you need to add a route to the device which is directly connected to the roaming machines - i.e. the ovpn server –  petre Sep 21 '09 at 10:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.