*sigh* I have a single openvpn server running on Archlinux using a tun adapter and running internally within my home network. interfaces: pLAN9 - 172.16.16.2, mask 255.255.0.0, gateway 172.16.16.1 tun0 - 10.11.12.1, mask 255.255.255.0 destination 10.11.12.2 clients receive 10.11.12.x from openvpn. for some reason completely unknown to me, clients are able to access 10.11.12.1 just fine, but the server itself cannot ping/access any client (times out.) clients are all Windows 7. no firewall on server, disabled windows 7 firewall completely. still nothing. i'm probably missing something stupid, i'm just getting into routing so my knowledge is likely pitiful. any help would be appreciated. ON THE SERVER /etc/openvpn/server.conf: [code] port 1194 proto udp dev tun ca /etc/openvpn/ca.crt cert /etc/openvpn/pLAN9-Server1.crt key /etc/openvpn/pLAN9-Server1.key # This file should be kept secret dh /etc/openvpn/dh2048.pem server 10.11.12.0 255.255.255.0 ifconfig-pool-persist ipp.txt keepalive 10 120 tls-auth /etc/openvpn/ta.key 0 # This file is secret cipher AES-128-CBC # AES user nobody group nobody persist-key persist-tun status openvpn-status.log verb 5 mute-replay-warnings[/code] route [code] Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 172.16.16.1 0.0.0.0 UG 0 0 0 pLAN9 10.11.12.0 10.11.12.2 255.255.255.0 UG 0 0 0 tun0 10.11.12.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 172.16.0.0 0.0.0.0 255.255.0.0 U 0 0 0 pLAN9 192.168.68.0 0.0.0.0 255.255.255.0 U 0 0 0 wifi [/code] ON THE CLIENT client.conf [code] client dev tun dev-node OPENVPN proto udp remote 76.22.129.200 1194 resolv-retry infinite nobind persist-key persist-tun ca "Z:\\keys\\pLAN9\\ca.crt" cert "Z:\\keys\\pLAN9\\pLAN9-Mobile.crt" key "Z:\\keys\\pLAN9\\pLAN9-Mobile.key" ns-cert-type server tls-auth "Z:\\keys\\pLAN9\\ta.key" 1 cipher AES-128-CBC verb 4 mute-replay-warnings [/code] route [code]IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.43.1 192.168.43.176 25 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 192.168.43.0 255.255.255.0 On-link 192.168.43.176 281 192.168.43.176 255.255.255.255 On-link 192.168.43.176 281 192.168.43.255 255.255.255.255 On-link 192.168.43.176 281 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 192.168.43.176 281 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 192.168.43.176 281 ===========================================================================[/code]

client can connect/ping server, server cannot ping client

train_wreck

*sigh*

I have a single openvpn server running on Archlinux using a tun adapter and running internally within my home network. interfaces:

pLAN9 - 172.16.16.2, mask 255.255.0.0, gateway 172.16.16.1
tun0 - 10.11.12.1, mask 255.255.255.0 destination 10.11.12.2

clients receive 10.11.12.x from openvpn. for some reason completely unknown to me, clients are able to access 10.11.12.1 just fine, but the server itself cannot ping/access any client (times out.) clients are all Windows 7. no firewall on server, disabled windows 7 firewall completely. still nothing.

i'm probably missing something stupid, i'm just getting into routing so my knowledge is likely pitiful. any help would be appreciated.

ON THE SERVER
/etc/openvpn/server.conf:

port 1194
proto udp
dev tun

ca /etc/openvpn/ca.crt
cert /etc/openvpn/pLAN9-Server1.crt
key /etc/openvpn/pLAN9-Server1.key  # This file should be kept secret

dh /etc/openvpn/dh2048.pem

server 10.11.12.0 255.255.255.0

ifconfig-pool-persist ipp.txt

keepalive 10 120

tls-auth /etc/openvpn/ta.key 0 # This file is secret

cipher AES-128-CBC   # AES

user nobody
group nobody


persist-key
persist-tun

status openvpn-status.log

verb 5

mute-replay-warnings

route

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         172.16.16.1     0.0.0.0         UG    0      0        0 pLAN9
10.11.12.0      10.11.12.2      255.255.255.0   UG    0      0        0 tun0
10.11.12.2      0.0.0.0         255.255.255.255 UH    0      0        0 tun0
172.16.0.0      0.0.0.0         255.255.0.0     U     0      0        0 pLAN9
192.168.68.0    0.0.0.0         255.255.255.0   U     0      0        0 wifi

ON THE CLIENT

client.conf

client


dev tun


dev-node OPENVPN


proto udp


remote 76.22.129.200 1194

resolv-retry infinite


nobind


persist-key
persist-tun


ca "Z:\\keys\\pLAN9\\ca.crt"
cert "Z:\\keys\\pLAN9\\pLAN9-Mobile.crt"
key "Z:\\keys\\pLAN9\\pLAN9-Mobile.key"

ns-cert-type server

tls-auth "Z:\\keys\\pLAN9\\ta.key" 1

cipher AES-128-CBC


verb 4

mute-replay-warnings

route

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     192.168.43.1   192.168.43.176     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
     192.168.43.0    255.255.255.0         On-link    192.168.43.176    281
   192.168.43.176  255.255.255.255         On-link    192.168.43.176    281
   192.168.43.255  255.255.255.255         On-link    192.168.43.176    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link    192.168.43.176    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link    192.168.43.176    281
===========================================================================

elpin

Sorry if I'm wrong since I'm pretty much an OpenVPN amateur, but shouldn't the client's route table include a 10.11.12.0 network? At the moment it seems like the server should be able to send an echo to the client but the client doesn't know how to respond back... Are you sure the client is actually able to ping the server?

EDIT: When you connect to the server with the client, is there any error or warning in the log that might suggest some routing issue?

train_wreck

Yes, the clients can most definitely access the server itself. I've got samba running on the same machine and am able to access all the shares when the VPN is connected, even copy files to them no problem. And no, I see nothing in either client or server logs.

See, I eventually would like for clients to be able to access the local server-side LAN (172.16.16.x). For the moment I can't figure out for the life of me why I am not able to access clients but they can access the server. Seems completely illogical... particularly without any software firewalls. I'm willing to post logs or anything else if necessaryy or helpful.

Mimiko

How do you accessing clients? From openvpn server? What does ping and tracrt shows? Does clients have firewalls?

dropje

elpin was right in his comment. You do not have a route on the client. So if you're successfully accessing the server now you're not accessing it through the VPN. Are you on the same LAN (maybe different subnet) as the VPN server?

Post logs from both server and client.

train_wreck

Ah figured it out. I'd thought I'd had the Windows firewall disabled, but it was only disabled for so-called "private" networks, and Windows was thinking the openvpn connection was a public one. D'oh!