Cannot Ping/RDP through OpenVPN Connection

BobbyDigital

Hello All,

I am looking for some assistance with routing through my OpenVPN tunnel. Here is a little back information and configurations to start for my testing environment.

Local Network - 192.168.200.1/24
OPENVPN Local IP - 192.168.200.14/24
VPN Network - 192.168.220.1/24
Client Network - 10.200.0.1/24

Server Config: (the key names were blanked out)

port 1194
proto udp
dev tun
ca ca.crt
cert ''
key ''
dh ''
server 192.168.220.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.200.0 255.255.255.0"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

Client Config: (key names blanked again)

client
dev tun
proto udp
remote *remoteIP* 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ''
cert ''
key ''
remote-cert-tls server
compl-lzo
verb 3

Since I do not have the OPENVPN server sitting in my DMZ, I created a firewall rule to allow port 1194 through my firewall to the local IP of the OPENVPN server(192.168.200.14). I also set a static route on my router to send all VPN traffic (192.168.220.0/24) to the local IP of my OPENVPN server (192.168.200.14).

From my application server :
- I can ping the local IP of the OPENVPN server, 192.168.200.14
- I can ping the gateway IP of the VPN subnet, 192.168.220.1
- I cannot ping the IP of my client VPN client. 192.168.220.6

From my VPN server:
I can ping all Local LAN devices as well as the VPN client device.

From my VPN client:
- I can ping local resources and access the Internet through my local ISP.
- I can ping the VPN server, 192.168.220.1
- I can ping the remote LAN IP of my OPENVPN server, 192.168.200.14
- I cannot ping or RDP to the application server on my remote LAN, 192.168.200.2

Here is the routing table from my OPENVPN server: (Ubuntu 14.04)

:~$ route -v
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 192.168.200.1 0.0.0.0 UG 0 0 0 eth0
192.168.200.0 * 255.255.255.0 U 0 0 0 eth0
192.168.220.0 192.168.220.2 255.255.255.0 UG 0 0 0 tun0
192.168.220.2 * 255.255.255.255 UH 0 0 0 tun0

Here is the routing table from my client:(windows 7 32 bit)

C:\Users\Register>route print
===========================================================================
Interface List
16...00 ff b4 a5 a0 b7 ......TAP-Windows Adapter V9
11...20 cf 30 b2 98 d7 ......Realtek PCIe GBE Family Controller
1...........................Software Loopback Interface 1
15...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
12...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.200.0.1 10.200.0.50 266
10.200.0.0 255.255.255.0 On-link 10.200.0.50 266
10.200.0.50 255.255.255.255 On-link 10.200.0.50 266
10.200.0.255 255.255.255.255 On-link 10.200.0.50 266
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.200.0 255.255.255.0 192.168.220.5 192.168.220.6 20
192.168.220.0 255.255.255.0 192.168.220.5 192.168.220.6 20
192.168.220.4 255.255.255.252 On-link 192.168.220.6 276
192.168.220.6 255.255.255.255 On-link 192.168.220.6 276
192.168.220.7 255.255.255.255 On-link 192.168.220.6 276
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.200.0.50 266
224.0.0.0 240.0.0.0 On-link 192.168.220.6 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.200.0.50 266
255.255.255.255 255.255.255.255 On-link 192.168.220.6 276
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 10.200.0.1 Default
===========================================================================

I have a feeling I am missing a setting or a route somewhere on my OPENVPN server, but all of the routes look correct to me. I also wonder if its because my client gets assigned a /30 IP address. I understand this has to do with establishing the PTP connection across platforms.

Any help is appreciated and I hope I provided enough information.

Traffic

BobbyDigital wroteI provided enough information

You did indeed.

BobbyDigital wroteall of the routes look correct to me

On first glance they do look ok.

BobbyDigital wrotemy client gets assigned a /30 IP address

You could change that with --topology subnet .. see the manual.

BobbyDigital wroteFrom my VPN client:
- I can ping local resources and access the Internet through my local ISP.
- I can ping the VPN server, 192.168.220.1
- I can ping the remote LAN IP of my OPENVPN server, 192.168.200.14
- I cannot ping or RDP to the application server on my remote LAN, 192.168.200.2

Did you enable IP Forwarding on the server ?

BobbyDigital

It ended up being that IP forwarding was enabled on the server.

Thanks for your help sorry its been so long replying to the topic.

Traffic

Actually, I think you need to add a static route to your application server (192.168.200.2) for your VPN network (192.168.220.0/24).

williamjames07

may be its right..