OpenVPN routing

johnjohn

Hello,
i need help with OpenVPN config.
I have OpenVPN server configured on Debian. And i am connecting Windows clients.
The configuration is OK, server is started, interfaces are up, clients can connect and have assigned IP.
The problem is that client is not able to see none of the resources on inside network.
It can ping just the IP of the server and none of the others, which are in different subnet.
Here is output of my Debian ifconfig:
eth0 Link encap:Ethernet HWaddr 1c:6f:65:e6:73:ba
inet addr:192.168.2.184 Bcast:192.168.2.255 Mask:255.255.255.0

tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255

Here is routing table on the server:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.2.2 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

default via 192.168.2.2 dev eth0
10.8.0.0/24 via 10.8.0.2 dev tun0
10.8.0.2 dev tun0 proto kernel scope link src 10.8.0.1
192.168.2.0/24 dev eth0 proto kernel scope link src 192.168.2.184

Here is OpenVPN server.conf
port 1194
proto udp
dev tun

ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/OPENVPN.crt
key /etc/openvpn/certs/OPENVPN.key
dh /etc/openvpn/certs/dh2048.pem
tls-auth /etc/openvpn/certs/ta.key 0

server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
#push "redirect-gateway def1 bypass-dhcp"
#push "dhcp-option DNS 192.168.2.1"
push "dhcp-option DNS 192.168.0.9"
push "route 192.168.2.0 255.255.255.0"
client-to-client
keepalive 1800 4000

cipher DES-EDE3-CBC # Triple-DES
comp-lzo

max-clients 10

user nobody
group nogroup

persist-key
persist-tun

log openvpn.log
status openvpn-status.log
verb 5
mute 20

Here is the client.conf
client
proto udp
port 1194
remote server IP 1194
ca ca.crt
cert .crt
key .key
cipher DES-EDE3-CBC
comp-lzo yes
dev tun
proto udp
tls-auth ta.key 1
ns-cert-type server
auth-user-pass
nobind
auth-nocache
script-security 2
persist-key
persist-tun

What i have noticed is that when OpenVPN server is up i dont have ping to default gateway of the Tun0 interface.
Debian is bihand Mikrotik firewall, which interface has 10.8.0.2 IP and is GW for that subnet.
All other resources are in 192.68.0.0 network but i dont have ping to that network.
I can ping from Debin only tun0 ip and client assigned IPs, but not GW for 10.8.0.0 network.
If i stop VPN server ping starts.

maikcat

disable firewall on : mikrotik , lan pcs , openvpn client pcs
and report if tracert works.

if not its routing issue...

Michael.

Traffic

johnjohn wroteWhat i have noticed is that when OpenVPN server is up i dont have ping to default gateway of the Tun0 interface

You are running openvpn in --topology net30 and as such, the tun default gateway is not ping-able (by design).

johnjohn wroteAll other resources are in 192.68.0.0 network but i dont have ping to that network

You must include routing for your extra server side LAN(2)=192.168.0.0/24

See this HOWTO for basic instructions:
HOWTO: Expanding the scope of the VPN to include additional machines

Note: Your server appears to be:

johnjohn wroteeth0 Link encap:Ethernet HWaddr 1c:6f:65:e6:73:ba
inet addr:192.168.2.184 Bcast:192.168.2.255 Mask:255.255.255.0

but you require extra routing for 192.168.0.0/24

Also, make sure NONE of your clients use 192.168.0.0/24 on their private LAN : Or change your server LAN(2) to a different number. IE: 192.168.134.0/24