Client connects but cannot ping LAN machines

lhumungus

Server conf:

local 192.168.74.91
port 1198
proto tcp
dev tap0

ca /etc/openvpn/kys/ca.crt
cert /etc/openvpn/kys/server.crt
key /etc/openvpn/kys/server.key  # This file should be kept secret
dh /etc/openvpn/kys/dh2048.pem

ifconfig-pool-persist ipp.txt
server-bridge 192.168.74.91 255.255.255.0 192.168.74.113 192.168.74.118

push "dhcp-option DNS 192.168.74.74"
push "dhcp-option WINS 192.168.74.60"
comp-lzo
keepalive 10 120
user nobody
group nobody
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 4

Client conf:

client
dev tap
proto tcp
remote xx.xx.xx.xx 1198
resolv-retry infinite
nobind

persist-key
persist-tun
ca "C:/Program Files/OpenVPN/kys/ca.crt"
cert "C:/Program Files/OpenVPN/kys/client1.crt"
key "C:/Program Files/OpenVPN/kys/client1.key"

ns-cert-type server
comp-lzo
verb 3

Other settings:

net.ipv4.ip_forward=1
iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT
Site firewall is forwarding packets to the OpenVPN server.
XP Client firewall disabled.

Goal: Have clients connect via OpenVPN and browse windows shares behind the OpenVPN server.
What's happening now: Windows XP client connects to OpenVPN server, a Ubuntu virtual machine. XP client receives IP addresses from server-specified pool, also receives DNS and WINS settings. XP client can ping OpenVPN server; OpenVPN server can ping XP client.
Problems: XP client cannot ping any other machines behind OpenVPN server. Machines behind OpenVPN server cannot ping client (although weirdly, if I leave a client-->server ping going, sometimes the machines will be able to ping the client; this may be red herring but I thought I'd mention it).

I must be close, I'm just not sure what I'm missing. I'd appreciate any help resolving this issue.

Thanks,

LH

lhumungus

debbie10t wroteThis is most likely incorrect, depending on if your OpenVPN server machine is also your server side LAN default gateway .. or not.

I thought as much, so I'd been testing with 192.168.74.1 (the LAN default gateway) as well, but it made no difference.

Also, although this has not been rigorously enforced yet, you should consider using the correct syntax for --proto:
The Manual wrote--proto p

Use protocol p for communicating with remote host. p can be udp, tcp-client, or tcp-server.

So change the server conf to say

proto tcp-server

and the client conf to

proto tcp-client

?

I am able to SSH into the OpenVPN server from the client. And from there I can SSH or ping other machines. But I can't get the client to connect to any other machines directly. Also, pinging the client from the OpenVPN server drops a lot of packets but that's probably another problem entirely.

lhumungus

debbie10t wroteHave you read through this HOWTO:
HOWTO: Expanding the scope of the VPN to include additional machines

Thanks for responding.

Yes I've read the link and it says I should get "multiple machines on the server side when using a bridged VPN" [...] "for free without needing any additional configuration". I'm still not able to connect to any of the server side machines beyond the server itself. That includes changing the aforementioned gateway to the LAN gateway.

Just to be clear in case I'm omitting something obvious, the OpenVPN server is behind a NAT-ed gateway with a firewall which forwards requests to the OpenVPN server IP. The client is behind its own NAT-ed gateway.

The fact the connection is established exclusively with the OpenVPN server and packets going elsewhere are lost makes me think it's a routing issue of some kind. It works up to that point and nowhere past it. On the OpenVPN server I have:

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
192.168.74.0    0.0.0.0         255.255.255.0   U         0 0          0 br0
0.0.0.0         192.168.74.1    0.0.0.0         UG        0 0          0 br0

Should I be adding a route of some kind?

LH