Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to set up OpenVPN to allow me to connect a number of laptops to my network in a way that allows the laptops to connect to specific computers via HTTP (to e.g. a server management page) and windows shares (to access files)

In the test environment my laptops live in a network with a 192.168.1.X address range. The host-network has a 10.66.77.X address range The server hosting the OpenVPN server has address 10.77.10.20. I need to access some application server web pages on this machine, accessible on various ports The server with the windows shares as well as some other web based pages I need to access is on address 10.66.77.20

The config files for server and laptop are attached below. The laptop establishes the VPN connection without problems, but I cannot access any of the machines, even a simple ping fails. Maybe a routing problem? The routing table for the laptop is shown below as well - every idea is appreciated!

Thanks! Maik

Server config file

port 1194
dev tun
tls-server

ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/projects.crt
key /etc/openvpn/keys/projects.key
dh /etc/openvpn/keys/dh1024.pem

server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt

push "route 10.66.77.0 255.255.255.0"

keepalive 10 60
inactive 600

route 10.8.0.1 255.255.255.0
user openvpn
group openvpn

persist-tun
persist-key
verb 4

client config file

dev tun
proto udp
remote SERVERADDR 1194
resolv-retry infinite
nobind
persist-key
persist-tun

ca ca.crt
cert accountingLaptop.crt
key accountingLaptop.key
ns-cert-type server
comp-lzo
verb 3

Resulting routing table on client laptop

C:\Documents and Settings\User>route print
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 23 5a 9b 64 9b ...... Atheros AR8132 PCI-E Fast Ethernet Controller -
Packet Scheduler Miniport
0x3 ...00 24 2c 35 c9 6b ...... Dell Wireless 1395 WLAN Mini-Card - Packet Sched
uler Miniport
0x4 ...00 ff 5e 03 43 9b ...... TAP-Win32 Adapter V9 - Packet Scheduler Miniport

===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1   192.168.1.129       25
         10.8.0.1  255.255.255.255         10.8.0.5        10.8.0.6       1
         10.8.0.4  255.255.255.252         10.8.0.6        10.8.0.6       30
         10.8.0.6  255.255.255.255        127.0.0.1       127.0.0.1       30
       10.66.77.0    255.255.255.0         10.8.0.5        10.8.0.6       1
   10.255.255.255  255.255.255.255         10.8.0.6        10.8.0.6       30
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      192.168.1.0    255.255.255.0    192.168.1.129   192.168.1.129       25
    192.168.1.129  255.255.255.255        127.0.0.1       127.0.0.1       25
    192.168.1.255  255.255.255.255    192.168.1.129   192.168.1.129       25
        224.0.0.0        240.0.0.0         10.8.0.6        10.8.0.6       30
        224.0.0.0        240.0.0.0    192.168.1.129   192.168.1.129       25
  255.255.255.255  255.255.255.255         10.8.0.6               2       1
  255.255.255.255  255.255.255.255         10.8.0.6        10.8.0.6       1
  255.255.255.255  255.255.255.255    192.168.1.129   192.168.1.129       1
Default Gateway:       192.168.1.1
===========================================================================
Persistent Routes:
  None
share|improve this question
add comment

5 Answers

the issue may be that your VPN is not NAT on the vpn server, so that the VPN clients are directly connecting to the server with the 10.8.0.0 ip, which is a network the other servers have no idea about. 2 solutions are to use iptables to masquerade as a nat on the server, or to add the routes static to the other servers.

share|improve this answer
    
Could you maybe provide a little guidance on what filter rules I would have to use to set up the masquerading? Many thanks, M –  Maik Sep 21 '09 at 8:28
    
i don't remember them off the top of my head, but they are in the How To on openvpn's site, this is from their site: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE the site is openvpn.net/index.php/open-source/documentation/howto.html –  Jimsmithkka Sep 21 '09 at 16:26
add comment

As a rule of thumb, you need static routes for every network which is not directly connected to your laptop.

So, assuming your OpenVPN server can talk to 10.66.77.20, you need to do the following

  • on the roaming laptops, add a route to 10.66.77.20 via the OpenVPN server IP
  • on 10.66.77.20, add a route to the 192.168.1.0/24 network via the OpenVPN server IP
share|improve this answer
    
The problem with point II (adding the route to 192.168.....) is, though, that I don't know how where the laptops are connecting from! Could be a wireless hotspot anywhere with unknown address range.... –  Maik Sep 21 '09 at 8:26
    
you need to add a route to the device which is directly connected to the roaming machines - i.e. the ovpn server –  petre Sep 21 '09 at 10:11
add comment

Check the status of IP routing flag on the server:

cat /proc/sys/net/ipv4/ip_forward 

should return "1"

share|improve this answer
add comment

You don't want to NAT vpn connections, that will make all the clients appear to be coming from the vpn box, which makes troubleshooting a pain. You also don't want to add static routes for the vpn addresses to the servers, as that is not where such configuration belongs.

What you want to do is add a route for the vpn subnet on the router. In cisco speak you would just have something like this:

ip route 192.168.1.0 255.255.255.0 10.77.10.20

Any other router will have a similar command.

share|improve this answer
add comment

OpenVPN needs to know about the subnet of your laptop, otherwise will drop the packets from that IP subnet. Check the logs.

Check the documentation for iroute

With that in place, it will add the appropriate ip routes to the server as well.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.