Tambakoly The vpn network is 10.9.10.0/24 Lan behind server network is 172.16.0.0/24 The vpn server lan IP is 172.16.0.1 IP forwarding is done on vpn server net.ipv4.ip_forward = 1 Iptables rules on the vpn server for NAT are: iptables -A INPUT -p udp --dport 1194 -j ACCEPT iptables -t nat -A POSTROUTING -s 10.9.10.0/24 -o eth0 -j MASQUERADE iptables -A FORWARD -i tun0 -s 10.9.10.0/24 -d 172.16.0.0/24 -j ACCEPT A local server in the same lan has 172.16.0.2 the route in local server is well done dest gateway mask interface 10.9.10.0 172.16.0.1 255.255.255.0 eth1 From my client connected to vpn I can ping vpn server lan address 172.16.0.1 The lan ip 172.16.0.2 can ping well 10.9.10.1 (the vpn tun0 address) BUT I cannot ping 172.16.0.2 from my client Here is my server.conf: mode server proto udp port 1194 dev tun ca keys/ca.crt cert keys/server.crt key keys/server.key dh keys/dh1024.pem tls-auth keys/ta.key 0 cipher AES-128-CBC server 10.9.10.0 255.255.255.0 route 172.16.0.0 255.255.255.0 push "route 172.16.0.0 255.255.255.0" keepalive 10 120 ifconfig-pool-persist ipp.txt client-config-dir ccd client-to-client user nobody group nogroup chroot /etc/openvpn/jail persist-key persist-tun comp-lzo verb 3 mute 20 status openvpn-status.log log-append /var/log/openvpn.log In the ccd/ I have client1 with directive: iroute 172.16.0.0 255.255.255.0 Any help would be appreciated
maikcat Lan behind server network is 172.16.0.0/24 In the ccd/ I have client1 with directive: iroute 172.16.0.0 255.255.255.0 iroute is used when you want to route traffic behind your CLIENTs lan, in your case please remove it. Michael.
