Unable to reach server's LAN

katalidi

Hello everyone,

I've been setting up OpenVPN servers for a while, but there's one specific scenario that's driving me nuts.
I need the LAN on the VPN server to be fully reachable from the VPN clients.

Here's the scenario:

LAN server IP: 192.168.0.0/24
OpenVPN pool: 10.12.0.0/24
LAN client IP: 192.168.168.0/24

IP on VPN assigned to client: 10.12.0.11
Server LAN IP: 192.168.0.111

Server Config:

port 1190
proto udp
dev tun
ca certs/ca.crt
cert certs/server.crt
key certs/server.key # This file should be kept secret
tls-auth certs/ta.key 0 # This file is secret
dh dh2048.pem
server 10.12.0.0 255.255.255.0
ifconfig-pool-persist ip_pool.txt
push "route 192.168.0.0 255.255.255.0"
client-config-dir ccd
route 10.12.0.0 255.255.255.252
client-to-client
keepalive 10 120
comp-lzo
max-clients 5
user nobody
group nogroup
persist-key
persist-tun
status openvpn-connections.log
log openvpn.log
log-append openvpn.log
verb 4
mute 20

client config:

client
dev tun2
proto udp
remote 80.37.197.165 1190
remote 192.168.0.111 1190
remote unifica.homelinux.org 1190
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
mute-replay-warnings
ca ca.crt
cert tecnico3.crt
key tecnico3.key
ns-cert-type server
tls-auth ta.key 1
comp-lzo
verb 3
mute 20

I also have a static route on the server side gateway 10.12.0.0 mask 255.255.255.0 -> 192.168.0.111

Additional information:

1) When I try to ping the client (10.12.0.11) from any machine on the server LAN (192.168.0.101 for example), the ping works perfectly, as does any ssh or any other port connection

2) If I do a 'tracepath 192.168.0.101' from the client machine, here is the result:
tracepath 192.168.0.100
1: 10.12.0.11 0.219ms pmtu 1500
1: 10.12.0.1 79.237ms
1: 10.12.0.1 76.599ms
2: 192.168.0.100 81.943ms reached
Resume: pmtu 1500 hops 2 back 62

3) But if I try to make a ping to 192.168.0.101, I don't have a reply, neither if I try an ssh or any other connection.

I followed this instructions for the TUN/TAP forwarding on the server:
TUN/TAP forwarding:

Allow TUN interface connections to OpenVPN server
# iptables -A INPUT -i tun+ -j ACCEPT

Allow TUN interface connections to be forwarded through other interfaces
# iptables -A FORWARD -i tun+ -j ACCEPT

Allow TAP interface connections to OpenVPN server
# iptables -A INPUT -i tap+ -j ACCEPT

Allow TAP interface connections to be forwarded through other interfaces
# iptables -A FORWARD -i tap+ -j ACCEPT

I've tried several times with several machines but I've never managed to setup an enviroment where I can reach any local IP from server's LAN.

What could be happening?

Thanks in advance, and let me know if you need any further information

george

Can you post server and client connection logs?

katalidi

Client log: ( I assumed it's the connection log it appears runnning 'sudo openvpn client.ovpn')
sudo openvpn client.ovpn Thu Mar 15 19:37:42 2012 OpenVPN 2.1.3 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Mar 11 2011
Thu Mar 15 19:37:42 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Enter Private Key Password:
Thu Mar 15 19:37:44 2012 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Mar 15 19:37:44 2012 WARNING: file 'tecnico3.key' is group or others accessible
Thu Mar 15 19:37:44 2012 /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Thu Mar 15 19:37:44 2012 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Thu Mar 15 19:37:44 2012 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 15 19:37:44 2012 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 15 19:37:44 2012 LZO compression initialized
Thu Mar 15 19:37:44 2012 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Thu Mar 15 19:37:44 2012 Socket Buffers: R=[126976->131072] S=[126976->131072]
Thu Mar 15 19:37:44 2012 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Mar 15 19:37:44 2012 Local Options hash (VER=V4): '504e774e'
Thu Mar 15 19:37:44 2012 Expected Remote Options hash (VER=V4): '14168603'
Thu Mar 15 19:37:44 2012 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Thu Mar 15 19:37:44 2012 UDPv4 link local: [undef]
Thu Mar 15 19:37:44 2012 UDPv4 link remote: [AF_INET]80.37.197.165:1190
Thu Mar 15 19:37:44 2012 TLS: Initial packet from [AF_INET]80.37.197.165:1190, sid=7cd6418d 7594da69
Thu Mar 15 19:37:45 2012 VERIFY OK: depth=1, /C=ES/ST=MA/L=Madrid/O=Katal-fidi/CN=VPNUNIFICA/emailAddress=certificados@cooperativakatal.org
Thu Mar 15 19:37:45 2012 VERIFY OK: nsCertType=SERVER
Thu Mar 15 19:37:45 2012 VERIFY OK: depth=0, /C=ES/ST=MA/L=Madrid/O=Katal-fidi/CN=VPNTECNICOS/emailAddress=certificados@cooperativakatal.org
Thu Mar 15 19:37:46 2012 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Mar 15 19:37:46 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 15 19:37:46 2012 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Mar 15 19:37:46 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 15 19:37:46 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Mar 15 19:37:46 2012 [VPNTECNICOS] Peer Connection Initiated with [AF_INET]80.37.197.165:1190
Thu Mar 15 19:37:48 2012 SENT CONTROL [VPNTECNICOS]: 'PUSH_REQUEST' (status=1)
Thu Mar 15 19:37:50 2012 PUSH: Received control message: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,route 10.12.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.12.0.11 10.12.0.12'
Thu Mar 15 19:37:50 2012 OPTIONS IMPORT: timers and/or timeouts modified
Thu Mar 15 19:37:50 2012 OPTIONS IMPORT: --ifconfig/up options modified
Thu Mar 15 19:37:50 2012 OPTIONS IMPORT: route options modified
Thu Mar 15 19:37:50 2012 ROUTE default_gateway=192.168.1.1
Thu Mar 15 19:37:50 2012 TUN/TAP device tun2 opened
Thu Mar 15 19:37:50 2012 TUN/TAP TX queue length set to 100
Thu Mar 15 19:37:50 2012 /sbin/ifconfig tun2 10.12.0.11 pointopoint 10.12.0.12 mtu 1500
Thu Mar 15 19:37:50 2012 /sbin/route add -net 192.168.0.0 netmask 255.255.255.0 gw 10.12.0.12
Thu Mar 15 19:37:50 2012 /sbin/route add -net 10.12.0.0 netmask 255.255.255.0 gw 10.12.0.12
Thu Mar 15 19:37:50 2012 GID set to nogroup
Thu Mar 15 19:37:50 2012 UID set to nobody
Thu Mar 15 19:37:50 2012 Initialization Sequence Completed
Thu Mar 15 19:48:55 2012 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
^CThu Mar 15 19:49:00 2012 event_wait : Interrupted system call (code=4)
Thu Mar 15 19:49:00 2012 TCP/UDP: Closing socket
Thu Mar 15 19:49:00 2012 /sbin/route del -net 10.12.0.0 netmask 255.255.255.0
SIOCDELRT: Operation not permitted
Thu Mar 15 19:49:00 2012 ERROR: Linux route delete command failed: external program exited with error status: 7
Thu Mar 15 19:49:00 2012 /sbin/route del -net 192.168.0.0 netmask 255.255.255.0
SIOCDELRT: Operation not permitted
Thu Mar 15 19:49:00 2012 ERROR: Linux route delete command failed: external program exited with error status: 7
Thu Mar 15 19:49:00 2012 Closing TUN/TAP interface
Thu Mar 15 19:49:00 2012 /sbin/ifconfig tun2 0.0.0.0
SIOCSIFADDR: Permission denied
SIOCSIFFLAGS: Permission denied
Thu Mar 15 19:49:00 2012 Linux ip addr del failed: external program exited with error status: 255
Thu Mar 15 19:49:01 2012 SIGINT[hard,] received, process exiting
guille@guille-ThinkPad-L412:~/VPNs/VPNUnificatecnicos$ sudo openvpn client.ovpn Thu Mar 15 19:49:02 2012 OpenVPN 2.1.3 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Mar 11 2011
Thu Mar 15 19:49:02 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Enter Private Key Password:
Thu Mar 15 19:49:04 2012 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Mar 15 19:49:04 2012 WARNING: file 'tecnico3.key' is group or others accessible
Thu Mar 15 19:49:04 2012 /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Thu Mar 15 19:49:04 2012 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Thu Mar 15 19:49:04 2012 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 15 19:49:04 2012 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 15 19:49:04 2012 LZO compression initialized
Thu Mar 15 19:49:04 2012 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Thu Mar 15 19:49:04 2012 Socket Buffers: R=[126976->131072] S=[126976->131072]
Thu Mar 15 19:49:04 2012 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Mar 15 19:49:04 2012 Local Options hash (VER=V4): '504e774e'
Thu Mar 15 19:49:04 2012 Expected Remote Options hash (VER=V4): '14168603'
Thu Mar 15 19:49:04 2012 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Thu Mar 15 19:49:04 2012 UDPv4 link local: [undef]
Thu Mar 15 19:49:04 2012 UDPv4 link remote: [AF_INET]80.37.197.165:1190
Thu Mar 15 19:49:04 2012 TLS: Initial packet from [AF_INET]80.37.197.165:1190, sid=a55e762f afcfc6d8
Thu Mar 15 19:49:05 2012 VERIFY OK: depth=1, /C=ES/ST=MA/L=Madrid/O=Katal-fidi/CN=VPNUNIFICA/emailAddress=certificados@cooperativakatal.org
Thu Mar 15 19:49:05 2012 VERIFY OK: nsCertType=SERVER
Thu Mar 15 19:49:05 2012 VERIFY OK: depth=0, /C=ES/ST=MA/L=Madrid/O=Katal-fidi/CN=VPNTECNICOS/emailAddress=certificados@cooperativakatal.org
Thu Mar 15 19:49:06 2012 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Mar 15 19:49:06 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 15 19:49:06 2012 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Mar 15 19:49:06 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 15 19:49:06 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Mar 15 19:49:06 2012 [VPNTECNICOS] Peer Connection Initiated with [AF_INET]80.37.197.165:1190
Thu Mar 15 19:49:08 2012 SENT CONTROL [VPNTECNICOS]: 'PUSH_REQUEST' (status=1)
Thu Mar 15 19:49:08 2012 PUSH: Received control message: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,route 10.12.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.12.0.11 10.12.0.12'
Thu Mar 15 19:49:08 2012 OPTIONS IMPORT: timers and/or timeouts modified
Thu Mar 15 19:49:08 2012 OPTIONS IMPORT: --ifconfig/up options modified
Thu Mar 15 19:49:08 2012 OPTIONS IMPORT: route options modified
Thu Mar 15 19:49:08 2012 ROUTE default_gateway=192.168.1.1
Thu Mar 15 19:49:08 2012 TUN/TAP device tun2 opened
Thu Mar 15 19:49:08 2012 TUN/TAP TX queue length set to 100
Thu Mar 15 19:49:08 2012 /sbin/ifconfig tun2 10.12.0.11 pointopoint 10.12.0.12 mtu 1500
Thu Mar 15 19:49:08 2012 /sbin/route add -net 192.168.0.0 netmask 255.255.255.0 gw 10.12.0.12
Thu Mar 15 19:49:08 2012 /sbin/route add -net 10.12.0.0 netmask 255.255.255.0 gw 10.12.0.12
Thu Mar 15 19:49:08 2012 GID set to nogroup
Thu Mar 15 19:49:08 2012 UID set to nobody
Thu Mar 15 19:49:08 2012 Initialization Sequence Completed

SERVER LOG (from /etc/openvpn/openvpn.log- It's clean, just started the service and connected the client, then tried to made a ping to local server network)

Thu Mar 15 18:48:39 2012 us=375435 Current Parameter Settings:
Thu Mar 15 18:48:39 2012 us=375508 config = '/etc/openvpn/server.conf'
Thu Mar 15 18:48:39 2012 us=375519 mode = 1
Thu Mar 15 18:48:39 2012 us=375527 persist_config = DISABLED
Thu Mar 15 18:48:39 2012 us=375534 persist_mode = 1
Thu Mar 15 18:48:39 2012 us=375541 show_ciphers = DISABLED
Thu Mar 15 18:48:39 2012 us=375549 show_digests = DISABLED
Thu Mar 15 18:48:39 2012 us=375556 show_engines = DISABLED
Thu Mar 15 18:48:39 2012 us=375563 genkey = DISABLED
Thu Mar 15 18:48:39 2012 us=375570 key_pass_file = '[UNDEF]'
Thu Mar 15 18:48:39 2012 us=375577 show_tls_ciphers = DISABLED
Thu Mar 15 18:48:39 2012 us=375584 Connection profiles [default]:
Thu Mar 15 18:48:39 2012 us=375592 proto = udp
Thu Mar 15 18:48:39 2012 us=375599 local = '[UNDEF]'
Thu Mar 15 18:48:39 2012 us=375607 local_port = 1190
Thu Mar 15 18:48:39 2012 us=375614 remote = '[UNDEF]'
Thu Mar 15 18:48:39 2012 us=375621 remote_port = 1190
Thu Mar 15 18:48:39 2012 us=375628 remote_float = DISABLED
Thu Mar 15 18:48:39 2012 us=375635 bind_defined = DISABLED
Thu Mar 15 18:48:39 2012 us=375642 bind_local = ENABLED
Thu Mar 15 18:48:39 2012 us=375649 NOTE: --mute triggered...
Thu Mar 15 18:48:39 2012 us=375670 248 variation(s) on previous 20 message(s) suppressed by --mute
Thu Mar 15 18:48:39 2012 us=375682 OpenVPN 2.1.3 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Oct 22 2010
Thu Mar 15 18:48:39 2012 us=375824 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Thu Mar 15 18:48:39 2012 us=375839 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Mar 15 18:48:39 2012 us=399177 Diffie-Hellman initialized with 2048 bit key
Thu Mar 15 18:48:39 2012 us=413604 /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Thu Mar 15 18:48:40 2012 us=591513 Control Channel Authentication: using 'certs/ta.key' as a OpenVPN static key file
Thu Mar 15 18:48:40 2012 us=591573 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 15 18:48:40 2012 us=591585 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 15 18:48:40 2012 us=591611 TLS-Auth MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Thu Mar 15 18:48:40 2012 us=591647 Socket Buffers: R=[124928->131072] S=[124928->131072]
Thu Mar 15 18:48:40 2012 us=591787 ROUTE default_gateway=192.168.0.1
Thu Mar 15 18:48:40 2012 us=592897 TUN/TAP device tun0 opened
Thu Mar 15 18:48:40 2012 us=592927 TUN/TAP TX queue length set to 100
Thu Mar 15 18:48:40 2012 us=592954 /sbin/ifconfig tun0 10.12.0.1 pointopoint 10.12.0.2 mtu 1500
Thu Mar 15 18:48:40 2012 us=595366 /sbin/route add -net 10.12.0.0 netmask 255.255.255.252 gw 10.12.0.2
Thu Mar 15 18:48:40 2012 us=596536 /sbin/route add -net 10.12.0.0 netmask 255.255.255.0 gw 10.12.0.2
Thu Mar 15 18:48:40 2012 us=598163 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Mar 15 18:48:40 2012 us=604204 GID set to nogroup
Thu Mar 15 18:48:40 2012 us=604247 UID set to nobody
Thu Mar 15 18:48:40 2012 us=604271 UDPv4 link local (bound): [undef]
Thu Mar 15 18:48:40 2012 us=604280 UDPv4 link remote: [undef]
Thu Mar 15 18:48:40 2012 us=604292 MULTI: multi_init called, r=256 v=256
Thu Mar 15 18:48:40 2012 us=604366 IFCONFIG POOL: base=10.12.0.4 size=62
Thu Mar 15 18:48:40 2012 us=604395 IFCONFIG POOL LIST
Thu Mar 15 18:48:40 2012 us=604405 tecnico2,10.12.0.4
Thu Mar 15 18:48:40 2012 us=604413 tecnico3,10.12.0.8
Thu Mar 15 18:48:40 2012 us=604421 tecnico1,10.12.0.12
Thu Mar 15 18:48:40 2012 us=604445 Initialization Sequence Completed
Thu Mar 15 18:48:47 2012 us=616087 MULTI: multi_create_instance called
Thu Mar 15 18:48:47 2012 us=616141 192.168.1.1:58715 Re-using SSL/TLS context
Thu Mar 15 18:48:47 2012 us=616171 192.168.1.1:58715 LZO compression initialized
Thu Mar 15 18:48:47 2012 us=616321 192.168.1.1:58715 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Thu Mar 15 18:48:47 2012 us=616338 192.168.1.1:58715 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Mar 15 18:48:47 2012 us=616388 192.168.1.1:58715 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Thu Mar 15 18:48:47 2012 us=616400 192.168.1.1:58715 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Thu Mar 15 18:48:47 2012 us=616429 192.168.1.1:58715 Local Options hash (VER=V4): '14168603'
Thu Mar 15 18:48:47 2012 us=616442 192.168.1.1:58715 Expected Remote Options hash (VER=V4): '504e774e'
Thu Mar 15 18:48:47 2012 us=616485 192.168.1.1:58715 TLS: Initial packet from [AF_INET]192.168.1.1:58715, sid=fa0edbda 38c5a9b9
Thu Mar 15 18:48:48 2012 us=662936 192.168.1.1:58715 VERIFY OK: depth=1, /C=ES/ST=MA/L=Madrid/O=Katal-fidi/CN=VPNUNIFICA/emailAddress=certificados@cooperativakatal.org
Thu Mar 15 18:48:48 2012 us=663077 192.168.1.1:58715 VERIFY OK: depth=0, /C=ES/ST=MA/L=Madrid/O=Katal-fidi/CN=tecnico3/emailAddress=certificados@cooperativakatal.org
Thu Mar 15 18:48:49 2012 us=83536 192.168.1.1:58715 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Mar 15 18:48:49 2012 us=83561 192.168.1.1:58715 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 15 18:48:49 2012 us=83618 192.168.1.1:58715 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Mar 15 18:48:49 2012 us=83627 192.168.1.1:58715 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 15 18:48:49 2012 us=170374 192.168.1.1:58715 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Mar 15 18:48:49 2012 us=170402 192.168.1.1:58715 [tecnico3] Peer Connection Initiated with [AF_INET]192.168.1.1:58715
Thu Mar 15 18:48:49 2012 us=170440 tecnico3/192.168.1.1:58715 OPTIONS IMPORT: reading client specific options from: ccd/tecnico3
Thu Mar 15 18:48:49 2012 us=170520 tecnico3/192.168.1.1:58715 MULTI: Learn: 10.12.0.11 -> tecnico3/192.168.1.1:58715
Thu Mar 15 18:48:49 2012 us=170533 tecnico3/192.168.1.1:58715 MULTI: primary virtual IP for tecnico3/192.168.1.1:58715: 10.12.0.11
Thu Mar 15 18:48:51 2012 us=192340 tecnico3/192.168.1.1:58715 PUSH: Received control message: 'PUSH_REQUEST'
Thu Mar 15 18:48:51 2012 us=192419 tecnico3/192.168.1.1:58715 SENT CONTROL [tecnico3]: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,route 10.12.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.12.0.11 10.12.0.12' (status=1)

Mimiko

Try to remove this line

route 10.12.0.0 255.255.255.252

from server's config. What is the result of 'traceroute 192.168.0.101'? You showed the trace to 192.168.0.100. Show the resulting routing table on client after a succesfull connection.

katalidi

Sorry for the late response, I've been out of technology for a couple of weeks

Line removed (with #) , and service restarted /etc/init.d/openvpn restart

Now, the client connects, no problem, and the results are:

tracepath 192.168.0.100
1: 10.12.0.11 0.196ms pmtu 1500
1: 10.12.0.1 247.325ms
1: 10.12.0.1 269.055ms
2: 192.168.0.100 137.251ms reached
Resume: pmtu 1500 hops 2 back 62

ping 192.168.0.100
PING 192.168.0.100 (192.168.0.100) 56(84) bytes of data.
^C
--- 192.168.0.100 ping statistics ---
46 packets transmitted, 0 received, 100% packet loss, time 45007ms

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.12.0.12 * 255.255.255.255 UH 0 0 0 tun2
192.168.168.0 * 255.255.255.0 U 0 0 0 wlan0
10.12.0.0 10.12.0.12 255.255.255.0 UG 0 0 0 tun2
192.168.0.0 10.12.0.12 255.255.255.0 UG 0 0 0 tun2
default 192.168.168.1 0.0.0.0 UG 0 0 0 wlan0

Still no ping and/or communication with the local network of the server, although the tracepath works.

frankuit

You've added the iptables forwarding which is good,
But did you check if IP forwarding is enabled in the kernel of your server?

katalidi

cat /proc/sys/net/ipv4/ip_forward = 1

I guess that's enough?

frankuit

Well, is it 1 if you cat it ? i dont see that in your reply
to make it 1, use echo 1 >/proc/sys/net/ipv4/ip_forward

katalidi

Yep, I've already done that. Also I've add a static route to the WAN router (wich is default in dhcp):

Destination IP Subnet Mask Gateway Metric Interface

10.12.0.0 255.255.255.0 192.168.0.111 0 br0

Being 111 the IP of the OpenVPN server of course.

¿Any idea? ¿Any other info that I should gather?

Mimiko

Where did "br0" came?

Your situation is a tipical problem when OpenVPN server does not act al LAN default gateway. See this topic https://forums.openvpn.net/topic9465.html for more information.