Roquefort
Hi guys,
I'm almost finished with my OpenVPN setup, but I'm running into a particular issue that I don't know how to fix.
Currently my users authenticate using LDAP and group permissions. This works great.
However, I need the ability to contact or "ping" these clients on their private subnet from my internal network, and can't do that without creating a local user account and turning on the option to "Allow Access from all server-side private subnets".
I don't want to create local accounts. I want to keep using LDAP, but still enable this option. Can it be done by adding a directive or modifying the client/server configs?
Roquefort
I think so, but I'll admit that this is all rather confusing given my limited Linux background.
Through the Access Server interface I've been able to specify the necessary "push routes", and my clients can contact everything within my internal network without a problem.
The problem comes from my internal network trying to access VPN clients; the requests hit the internal NIC of the Access Server, and stop there. My assumption is that the Access Server isn't routing back to the clients properly.
But my internal network CAN ping the OpenVPN clients when it's a locally created user, and the option for "Allow access from all server-side private subnets" is enabled.
I guess my question is: what does enabling that option do behind the scenes? If I could figure that out, I could probably manually specify it in the client or server config.
Roquefort
I'm not using local user accounts, I'm using LDAP, so I can't apply any user settings to my users. LDAP users aren't created locally, so I'm utilizing group permissions.
I'm also not trying to access the client-side subnets. I'm only trying to connect with the OpenVPN client IP. That IP responds but only when I'm using local user accounts with the aforementioned option enabled.
Thank you for the input though, I appreciate the help.
Roquefort
I GOT IT!
Unfortunately, this problem was PEBKAC...
For anyone that finds this thread years from now, there was an option under "Routing" that says "Should VPN clients have access to private subnets (non-public networks on the server side)?"
I had it set to "Yes, using NAT" as opposed to "Yes, using Routing". Checking the latter opened up a hidden option to "Allow access from these private subnets to all VPN client IP addresses and subnets". Checking that worked like a charm.
jahaninteractive
Hi Roquefort,
I just created right now so I can post and give you my sincerest thanks for posting your solution to this problem. Been tearing my hair out the past few days to work this out and I applied your fix and it worked straight away.
Thank you again - I will be toasting you whilst having a beer tonight!
Cheers mate!
