I'm using Debian 6 as my server, I have configured OpenVPN server there, and clients are connecting successfully using tap mode. This server is available from the internet, but It's also connected to internal network.

Local LAN: - eth0 on OpenVPN server
OpenVPN clients: - tap0 on OpenVPN server

It would be great if someone could give mi steps I have to follow to allow clients who connect to OpenVPN server to see and be able to connect to each machine within LAN where OpenVPN server is located ( network).
It would be perfect if you could tell me how to setup this routing automatically after client connects.


If you really need a TAP-style connection, you would need to specify the server-bridge option without further parameters - this would enable bridging mode and OpenVPN pass on DHCP requests (DHCP proxy mode). You also would need to bridge your tun interface with whatever your LAN interface is using brctl:

brctl addbr br0
brctl addif br0 eth0
brctl addif br0 tun0
ifconfig br0 inet netmask

see the server-bridge option description in the OpenVPN documentation for details.

But honestly, you should rather route than bridge whenever possible - it allows for better debugging and less unnecessary network noise (broadcasts) transmitted through your VPN.

For this case, a config file containing the push "route" on the server and the accompanying client-style config file (specifying the client option) would do. Example:

local <your public IP address>
port <your OpenVPN port>
proto udp
dev tun0
# reduce MTU if necessary
# tun-mtu 1400

# place your cert/key/DH paths here
ca keys/ca.crt
cert keys/server.crt
key keys/private/server.key
dh keys/dhparm.pem

# OpenVPN client network

# push client route
push "route"

keepalive 10 60

status /var/log/openvpn-status.log


# logging options
verb 4
mute 20

See the documentation for details on option parameters.

  • In addition to this, the OP will need to set up IP forwarding on the OpenVPN server. The default gateway on the LAN will also need to know how to route to the OpenVPN network range. There may also be iptables rules (e.g., permit FORWARD), but there needs to be more information on how your network is set up. – cjc Jul 16 '12 at 14:52
  • @cjc I have more problems with iptables than openvpn at the moment - what details do you have to know? – wlk Jul 16 '12 at 15:13
  • @Wojtek if you have any specific issues, post your ruleset and describe your problem in a new question – the-wabbit Jul 16 '12 at 17:49
  • @cjc as this is an OpenVPN-centered question, I tried to keep most of what is not OpenVPN-related out of the answer. People not knowing how to configure OpenVPN are not necessarily ignorant of routing or netfilter rules. – the-wabbit Jul 16 '12 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.