[deleted] Hello, Im running into an issue where the LAN subnet where the OpenVPN server resides cannot reach devices/networks that are connected via OpenVPN. The OpenVPN server is standalone (not the same device as the gateway) Details: LAN: 192.168.0.0/24 OpenVPN Server: 192.168.0.109 Other devices on the same LAN can reach 192.168.0.109 but cannot go further reach devices that are connected to VPN (the 192.168.3.X and 192.168.4.x networks). Devices that are connected via OpenVPN can reach each other fine and the other networks without issue. I suspected it's a missing static route on the LAN gateway, I added 10.8.0.0/24 into my ASUS router but no change. Server Config: server 10.8.0.0 255.255.255.0 proto udp port 1194 dev tun cipher BF-CBC comp-lzo adaptive keepalive 15 60 verb 3 push "route 192.168.0.0 255.255.255.0" client-config-dir ccd client-to-client #duplicate-cn route 192.168.3.0 255.255.255.0 push "route 192.168.3.0 255.255.255.0" route 192.168.4.0 255.255.255.0 push "route 192.168.4.0 255.255.255.0" tls-auth static.key 0 ca ca.crt dh dh.pem cert server.crt key server.key status-version 2 status status route-delay 5 route-method exe Any ideas? Windows firewall is disabled, I also performed the registry edit to enable routing on Windows 7 as well as right clicking the LAN network and sharing it with the TAP adapter. Thanks
maikcat if you use your openvpn server as default gateway , do you access vpn clients? if not check win7 firewall (if any) Michael.
[deleted] Thanks for the reply - my gateway (192.168.0.254) is a different device on the network. I also have the Windows 7 firewall disabled. Any other suggestions I could try? Thanks
maikcat my gateway (192.168.0.254) is a different device on the network ok, can you for testing switch your default gateway to point to your openvpns servers lan ip? Michael.
[deleted] Sure Michael - I changed the default gateway on one of the workstations and pointed it towards the OpenVPN server. Once that was performed, I could then access the other networks and devices without issue (the 192.168.3.x and 192.168.4.x networks) Once I reverted the workstation back to its normal gateway (192.168.0.254) I could no longer ping or access those networks. Seems like a routing issue between the default gateway - but a static route doesn't seem to resolve it either. Network: 10.8.0.0 Subnet: 255.255.255.0 Metric: 1 Gateway: 192.168.0.109 (VPN Server) Thats the static route I tried, but no change.
maikcat but a static route doesn't seem to resolve it either. your static route looks ok,where exactly did you add it? Michael.
maikcat try adding it to a pc on your lan. also disable any firewall running on your router while testing. Michael.
[deleted] Adding the static route directly on the workstation? I've also cobbled together a diagram which may help explain the issue. Thanks again Larger Image: http://i58.tinypic.com/2ebwns0.png
[deleted] FYI - I did add a static route directly on the workstation (192.168.0.1) and now it works 😃 : C:\Users\test>route add 192.168.4.0 mask 255.255.255.0 192.168.0.109 metric 1 Can you help me understand why that worked and how I can work to have it resolved without adding manual routes to all the other devices which are currently disconnected from the switch? Thanks
Traffic @ jprez1980 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
[deleted] Thanks Traffic - I'm aware of that and I wish it was the issue here - in this case, Site A and Site B are using different subnets which do not overlap. Good info to know tho regardless =) Thanks
[deleted] Good point about the mobile devices- no telling what public hotspots will be used. For the CCD files: Site A: iroute 192.168.3.0 255.255.255.0 Site B: iroute 192.168.4.0 255.255.255.0
Traffic Try adding static routes to one /client and one /server subnet host and use those two machines for testing ... Also, use a packet sniffer on the two chosen victims to monitor packets. tracert may help you as always .. check your firewalls
[deleted] Thanks for the suggestion - the connected clients are fine - they can reach each other and resources on the 192.168.0.X network fine. The issue appears to be that the 192.168.0.X resources with the exception of the VPN server itself (192.168.0.109) cannot ping or reach them at all. I did add a static route to the 192.168.0.1 workstation and was able to then reach everything but it doesn't explain why the static routes in the upstream gateway don't work (in the image from above)
Traffic Traffic wroteTry adding static routes to one /client and one /server subnet host and use those two machines for testing jprez1980 wroteThanks for the suggestion - the connected clients are fine - they can reach each other Are you saying that hosts with the correct routing work .. but others do not ?
[deleted] Correct - I'm 99% sure I figured it out. I removed the Asus N66U device (192.168.0.254) and replaced it with a WatchGuard XTM25 and added the same custom static routes..and so far all is well.
Traffic jprez1980 wrote removed the Asus N66U device (192.168.0.254) and replaced itbad news for As(s)us .. thanks for the tip ! jprez1980 wroteso far all is well.So OpenVPN worked all along .. just your rank network router not so good ?
[deleted] Yeah - that's what it was - all is working on this particular business class firewall/router. I would have thought a more upscale Asus would have handled static routes better... Thanks to all for suggestions
