Cannot Connect to "inside" machine

[deleted]

I am new to OpenVPN and am having an odd issue.

Server is installed / configured (ubuntu 12.04) 192.168.10.22
Client is installed /configured (windows 7 64bit) vpn ip: 10.8.0.6

IP forwarding is turned ON on the OpenVPN box
A route has been placed on the Gateway pointing the VPN network back to the OpenVPN server. (gateway is a RT-N66u wireless router with stock firmware) Gateway address 192.168.10.1

Client connects to and establishes the vpn with the server with no issue.

Here is what I can do:
Once connect client can browser the internet through the VPN.
The client can ping the OpenVPN Server (192.168.10.22)
The client can ping the *inside* gateway (192.168.10.1)
The client can access the gateway web interface (http) 192.168.10.1
The client can ping a printer on the inside (192.168.10.25)
The client can access the print web interface (http) 192.168.10.25

Here is what I can NOT do:
The client can NOT ping a server (linux no firewall) on the inside. 192.168.10.20
The client can NOT access a website on the server. 192.168.10.20

And here is were it gets interesting:
If I go to the inside server (192.168.10.20) and ping the client (10.8.0.6) that works.
After the ping is successful I can then go to the client and access the server (ping, http, etc).
If I just let things sit for several minutes the client will not be able to access the server again until the server pings back.

This scenario is the same for all the servers and workstations on the inside subnet.

Since most things work I am a bit at a loss at were to look for the issue. The timing out of the ping leads me toward a caching type of issue (NAT table, arp, ??) but that does not jive with the fact that I can always ping/acess the the inside gateway, switch, printer.

I did a tcpdump on the inside server and it is receiving the ping and replying but the reply is not making it back through the tunnel.

Thoughts?

Thanks,

smak

Server Config:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.10.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 192.168.10.1"
keepalive 10 120
tls-auth ta.key 0
tls-server
cipher AES-256-CBC
comp-lzo
max-clients 10
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log /var/log/openvpn/openvpn.log
verb 4
mute 20

Client Config:

client
dev tun
proto udp
remote myExternalIP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
tls-auth ta-key 1
cipher AES-256-CBC
comp-lzo
verb3

Mimiko

If a printer in the same lan is pingable, but some server not... Maybe it is server's problem? Also you can flash you router to some opensource firmware. The stock one may not work as expected.

HawkInOz

Had the same issue. Needed to add the OpenVPN subnet as trusted in my firewall settings. By default, I was blocking access and ping responses to untrusted subnets.