client can ping the VPN sub net but not the home lan

twinclouds

I just recently started trying Openvpn so I totally new in this area. My objective is to connect to my home lan through VPN when I away from home. I set up a server on a arm debian linux box and use a notebook with W7 as the client. Right now, I can ping the openvpn server ip address (10.8.0.1) from the client. After set W7 firewall rules as somebody on this Forum suggested, the server and ping the client as well. However, the client cannot ping the home lan ip addresses (192.168.2.x). I read some where that I need to add a rule 'push "route 192.168.2.0 255.255.255.0"' to server.conf file and I did. However, the client still cannot ping the home lan ips. Can anyone more experienced tell me how to fix this? Thanks in advance.

maikcat

please post:

your server/client configs,
info about your network topology,
firewall rules if used

Michael.

twinclouds

Thanks. Eventually, I figured out how to make it work. As shown in here, I need to excute the following two commands:

sh -c ‘echo 1 > /proc/sys/net/ipv4/ip_forward’
iptables -t nat -A POSTROUTING -s 10.0.0.0/8 ! -d 10.0.0.0/8 -o eth0 -j MASQUERADE

After that everything work as expected.

maikcat

NAT is not always a solution...

if you are happy,then its ok 🙂

Michael.

twinclouds

Michael:
Thanks for your comment. I really don't know too much about networking anyway so it will be o.k. as long as it works (and more secure than PPTP). However, I am interesting to know why you say "NAT is not always a solution." Does it impose any security risk? or in some cases it will not work? I would really appreciate if you can elaborate. Thanks in advance.

maikcat

and more secure than PPTP

no question about it... 🙂

Does it impose any security risk?

security risk in your case...no,limited functionality...yes

n some cases it will not work?

Nat has its drawbacks..
f.e try to use voip over NAT...
also when your clients access resources there requests seem to come from openvpn server itself,
go figure out which one did what without logging iptables...

for internet use,NAT is oneway to go,but in local intranets..no

Michael.

twinclouds

Michael:
Thank you very much for your explanation. My main objective is to have secure connection to my home network while away. From what you said, NAT should be good enough for me. All I care about is if the connection is secure. Thanks again for your help.