Route problem

Ohka

I'm having problems with the VPN clients not being able to access my office LAN.

The office LAN is 192.168.170.0/24
The VPN clients are 192.168.171.0/24
The VPN server has LAN ip 192.168.170.50

If I connect the VPN client I can access the VPN IPs and the vpn server ip 192.168.170.50 but no other IPs inside the office LAN.

I think it must be a routing issue because from the VPN server I tried a traceroute using network tun0 and can't access any lan IP, for example:
root@rhel62 /etc/openvpn # traceroute -T -i tun0 192.168.170.47
traceroute to 192.168.170.47 (192.168.170.47), 30 hops max, 60 byte packets
1 * * *
2 * * *
3 * * *
4 * * *
5 * * *
6 *^C

These are the routes I have:
root@rhel62 /etc/init.d # ip route show
192.168.171.2 dev tun0 proto kernel scope link src 192.168.171.1
192.168.170.0/24 dev eth2 proto kernel scope link src 192.168.170.50 metric 1
192.168.171.0/24 via 192.168.171.2 dev tun0
default via 192.168.170.1 dev eth2 proto static

This is my .conf:
root@rhel62 /etc/openvpn # cat server.conf | grep -v '^#' | grep -v ';' | grep -v "^$"
local 192.168.170.50
port 1723
proto tcp
dev tun0
ca ca.crt
cert uxorlab.crt
key uxorlab.key # This file should be kept secret
dh dh2048.pem
server 192.168.171.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.170.0 255.255.255.0"
push "route 192.168.171.0 255.255.255.0"
push "dhcp-option DNS 192.168.170.250"
push "dhcp-option WINS 192.168.170.1"
client-to-client
duplicate-cn
keepalive 10 120
cipher BF-CBC # Blowfish (default)
comp-lzo
max-clients 20
user root
group root
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 3

Any ideas? iptables is stopped.

Thanks in advanced 🙂

Ohka

Forgot to add... tcp forwarding is set to "1" in the openvpn strart script

alexev

Ohka wroteForgot to add... tcp forwarding is set to "1" in the openvpn strart script

Try this thing first, insted of pushing all the lans just puh a few specifics routes to some machines in the 192.168.170.0 (just a few ) and do not push any 192.168.171.0/24, then from a conected cliente try to access them and see what happend

I am not an expert in OpenVPN but i had some similar behaviour, when you push a route via the OpenVPN and the network pushed is allready routed by the client because it is directly conected that error happens (for that error i mean you get no conection at all).

If some other more experienced user want to comment my statement i will be happy 🙂

alexev

I really would like to have a #edit option" so i dont double post

When i said #instead of pushing all the lans" it must be read do not push all the scope but specific hosts