4

I have setup an OpenVPN connection between a Windows 2012 Server and an Debian Linux machine. The windows machine is the server and the linux machine is running openvpn as client. I can ping and connect to each other within the VPN network without problem.

My problem is that I cannot access the client's network from the server machine. E.g. Ping from 10.10.0.2 & .1 is working without problems. Ping from Server to 192.168.1.X is not working.

Setup:

OpenVPN Server (Windows 2012 Server) IP: 172.16.1.10/24 VPN IP: 10.10.0.1

OpenVPN Client (Debian V6 Linux) IP: 192.168.1.5/24 VPN IP: 10.10.0.2

I tried to add a route in Windows but still no traffic is being routed to the VPN network. E.g. route add 192.168.1.0 mask 255.255.255.0 10.10.0.2

What do I need to configure in Windows/Linux to get access to the internal network of the client side?

UPDATE 23/04/2015:

After adding route and iroute to the OpenVPN server configuration I can access the eth0 interface (192.168.1.5) from the Windows Server.

Added to server.ovpn:

    client-config-dir ccd
    route 192.168.1.0 255.255.255.0

Inside the ccd folder, created a simple text file "client" with the following content:

    iroute 192.168.1.0 255.255.255.0

The access to other clients in the network is possible but only by adding a static route to each of the client (e.g. route add 10.10.0.0 mask 255.255.255.0 192.168.1.5)

How can I accomplish the same without the need of adding static route or changes to the clients in the local network?

2

Sound like you have successfully setup a remote-access vpn. http://en.wikipedia.org/wiki/Virtual_private_network

Q: What do I need to configure in Windows/Linux to get access to the internal network of the client side?

A: You need to use a site-to-site VPN tunnel.

https://openvpn.net/vpn-server-resources/site-to-site-routing-explained-in-detail/

  • This will help for future questions catb.org/esr/faqs/smart-questions.html – asysadminboss Apr 22 '15 at 3:09
  • Thanks. I could get it working by adding route and iroute on the server configuration. I can now ping the ethernet interface of the client. Problem is that to get access to a device in the client network, I need to add a static route to every device I want to access... Is there a way to get access without adding static routes on all devices? – user797717 Apr 22 '15 at 10:48
0

As asysadminboss said, you are describing the difference between a remote access VPN and a site to site VPN.

If a user needs to be able to use network resources behind the firewall they need to use a remote access VPN. This type of VPN creates route statements on the remote system (client) to access internal network devices.

If you need both sides of the VPN (client and server) you need to use a site a site VPN. A site to site VPN is where each side of the tunnel operates as a server and a client. This results in both devices providing route statements for their local network to the other device.

Generally you configure site to site VPNs using a router or VPN server as the site to site VPN peer on both sides of the link. If you have a single remote user that needs to access an internal network device remotely you would use a remote access VPN. If you have two offices where each office has systems that need to talk to systems on the other side of the tunnel you would use a site to site VPN.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.