can connect to vpn server, but not other remote hosts on net

minektur

I have a new openvpn server I'm configuring. Client can connect, and can ping/ssh to server after connection. The client gets a IP on the network that the openvpn server hands it... The client can not h owever see any other hosts on the remote network.

client->wifi->router->lan/wan/internet->firewall/router->server

Client:

The client is a mac- it's IP (on wifi) is 192.168.200.55, gets assigned a remote ip of 192.168.233.6

ifconfig | grep 192
inet 192.168.200.55 netmask 0xffffff00 broadcast 192.168.200.255
inet 192.168.233.6 --> 192.168.233.5 netmask 0xffffffff

Firewall has a hole poked through to server for openvpn, has multiple "internal" ports with different vlans - vlan 3 has server and a few other hosts...

client config:
client
dev tun
proto udp
remote host.mydomain.com 1194
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
comp-lzo
verb 3

Server is centos 6 with ip of 192.168.3.251, default gateway 192.168.3.1 running openvpn 2.3.7 from centos package...
----
config: port 1194
proto udp
dev tun
ca keys/ca.crt
cert keys/server.crt
key keys/server.key # This file should be kept secret
dh keys/dh2048.pem
server 192.168.233.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.3.0 255.255.255.0"
client-to-client
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 6
---

(server temporarily has iptables disabled, and net.ipv4.ip_forward = 1)

The router has a static route for 192.168.233.0/24 to 192.168.3.251(the server)

An unrelated computer on the .3/24 network is 3.116 - I can't ping that from the client, and on the client (which gets an address of 233.6) it has a static route for that ip of 233.5. 3.116 can ping 233.5 but not 233.6.

Any ideas of what might be wrong here?

Thanks in advance.

maikcat

is ip forwarding enabled on server?
for testing use the static route for vpn network directly on testing pc inside your lan.

Michael.

Traffic

maikcat wroteis ip forwarding enabled on server?

minektur wroteand net.ipv4.ip_forward = 1

minektur wrotethe client (which gets an address of 233.6) it has a static route for that ip of 233.5. 3.116 can ping 233.5 but not 233.6.

You should double check that ..

In --topology net30 (openvpn default, in use here) 192.168.233.5 is not ping-able by design.

Traffic

Due to double posts this thread has moved here:
https://forums.openvpn.net/topic19448.html

minektur

wouldn't have been a double post if it didn't take 30+ hours for a mod to look at it.... I wasn't even sure what happened to my original post and thought it somehow didn't get posted...

anything we can do to make replies work faster here?

maikcat

anything we can do to make replies work faster here?

you are right to complaining especially after purchasing the gold support package.... 😉

Michael.