We're using OpenVPN at a branch office to connect remote users and it's working very well for internal resources, but recently we've added a permanent VPN connection between the branch office and head office, and I can't for the life of me get any OpenVPN remote users to see the servers at the head office across the permanent VPN. Here's a brief diagram:


To explain, the branch office is on 10.0.0.x, when the VPN to the head office was put in, it was assigned a different subnet of and I created an IPFire VM that is used by workstations on the 10.0.0.x network as a gateway to the 10.100 network. I then added a permanent route to the workstations on 10.0.0.x for the head office server resources on the 10.200.x.x subnet as follows:

route add -p mask

And all the internal workstations can see the head office resources perfectly. Any OpenVPN clients cannot, however. The OpenVPN clients can see resources on the 10.0.0.x subnet perfectly, and can ping the IPFire gateway that's being used by the internal workstations, but adding a route to the OpenVPN clients does not allow them to see any head office network resources. Any ideas what to check on the OpenVPN installation?

  • Can you define "see"? Is there zero connectivity at all between the two? – MDMarra Feb 1 '12 at 19:50
  • Correct, zero connectivity between the VPN user and the head office resources. The VPN user can branch office servers, workstations and the IPfire gateway, but not anything at head office. The workstations in the branch office can ping both local resources and workstations and the servers at head office. – barc0001 Feb 1 '12 at 20:12

Have you considered setting up NAT on the OpenVPN box, so that any connections coming from the OpenVPN connection simply appear to be coming from the OpenVPN box? If not, then have you setup routes so that all the other routers in the network know that should be forwarded to the OpenVPN host?

| improve this answer | |
  • OpenVPN is operating in NAT mode, yes. I've also set a route up on the IPFire machine to just in case, though I didn't believe that to be required since the OpenVPN clients are NATted – barc0001 Feb 1 '12 at 20:10
  • 1
    So can the OpenVPN server itself access systems at the head office? – Zoredache Feb 1 '12 at 20:14
  • No, it can't, despite having the same route added as the office workstations: root@localhost:~# route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface * U 0 0 0 eth0 * U 0 0 0 as0t0 UG 0 0 0 eth0 – barc0001 Feb 1 '12 at 20:22
  • Well you almost certainly need to start there then. If the OpenVPN server cannot reach systems, then devices connecting too it, will almost certainly fail. – Zoredache Feb 1 '12 at 21:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.