rubenkku Hello, I have a local LAN on this subnet: 192.168.9.x A OpenVPN server inside the LAN on this IP: 192.168.9.1 Clients can connect through internet to my OpenVPN When a client connects to server they get a IP of this kind: 10.0.100.x When client sends a ping to any host on local LAN, they get response, for example: Client at 10.0.100.10 pings host on LAN 192.168.9.10, the client get responses from 192.168.9.10 normally OpenVPN server is also capable of pinging clients, for example: Server at 10.0.100.1 (also 192.168.9.1) pings Client at 10.0.100.10, the Server get responses from 10.0.100.10 normally The point is that LAN Client on 192.168.9.10 can't ping OpenVPN client at 10.0.100.10 because the system says: NO ROUTE TO HOST How can i tell my LAN clients (192.168.9.x) the path to be able to reach 10.0.100.x Subnet? Can i do it at router level, so all hosts in LAN (192.168.9.x) be able to ping the 10.0.100.x Subnet? I hope that i had been clear in my question. Thank you all in advance.
Traffic rubenkku wroteThe point is that LAN Client on 192.168.9.10 can't ping OpenVPN client at 10.0.100.10 because the system says: NO ROUTE TO HOSTYour LAN client does not have a route for 10.0.100.0/24 .. add a route for it.
rubenkku Hello Traffic, thank you for your answer, I figured out that i have to add routes for 10.0.100.0/24 subnet. I'm not sure how to do it under windows, but this is not a problem. With some research im able to find the command to add routes under various systems. The final point i want to achieve is doing it at router level, so i have not to add routes manually to every machine in local LAN
rubenkku Im glad to announce that i have found the solution. I will explain how i solved the issue gessing to help other people with this nightmare. Is not about the routes but about firewall rules. That was my initial firewall rules for openvpn to work: (they are written in my gateway router running openwrt) iptables -A input_rule -i tun+ -j ACCEPT iptables -A output_rule -o tun+ -j ACCEPT iptables -A forwarding_rule -i tun+ -j ACCEPT This simple rules allow the openvpn traffic generated on tun interface to go in all directions. To allow server-side LAN to reach client-side LAN i had to add this aditional rules: iptables -t nat -A POSTROUTING -o tun+ -j MASQUERADE iptables -A forwarding_rule -i br-lan -o tun+ -j ACCEPT iptables -A forwarding_rule -m state --state RELATED,ESTABLISHED -j ACCEPT Where "input_rule" normally is INPUT on iptables under linux, but is "input_rule" on openwrt systems Same for "forwarding_rule" normally is FORWARD br-lan is the server-side interface for LAN, other systems should be eth0 tun+ is the TUN interface of openwrt, in other systems it should be tun0
