Hi, I have built my first VPN network gathering information posted by other users. I managed to get it working OK, since the clients are able to connect to the server and access the remote PCs and File Server, but I think I have a routing problem that I don’t know how to fix. Any help will be much appreciated! [b][u]Topology:[/u][/b] One main office with several PCS, a File Server and Print Server, Asterisk VoIP Box. This office has a DD-WRT router running OpenVPN Server on it. One remote office with 1 PC with a shared printer, 1 Laptop and a PAP-2 VoiP adapter. This remote office has OpenVPN Client for Windows running in both computers. It also has a DD-WRT router but it is not involved with the VPN stuff. [b][u]Configuration:[/u][/b] [u]OpenVPN Server on DD-WRT (192.168.1.1)[/u] OpenVPN > Enable Start Type > WAN Up Config as > Deamon Additional Config: mode server proto udp port 1194 dev tap0 server-bridge 192.168.1.1 255.255.255.0 192.168.1.250 192.168.1.254 keepalive 10 120 daemon verb 5 client-to-client dh /tmp/openvpn/dh.pem ca /tmp/openvpn/ca.crt cert /tmp/openvpn/cert.pem key /tmp/openvpn/key.pem push "route 192.168.1.0 255.255.255.0" [u]Administration/Commands[/u] [b]Startup:[/b] openvpn --mktun --dev tap0 brctl addif br0 tap0 ifconfig tap0 0.0.0.0 promisc up [b]Firewall:[/b] iptables -A INPUT -i tap0 -j ACCEPT iptables -I INPUT -p udp --dport 1194 -j ACCEPT iptables -t nat -A POSTROUTING -s 192.168.1.1/24 -o eth0 -j MASQUERADE [b][u]OpenVPN Client on Win7 (Config.ovpn)[/u][/b] remote xxxxxxx 1194 client dev tap0 proto udp resolv-retry infinite nobind persist-key persist-tun float ca ca.crt cert client1.crt key client1.key ns-cert-type server [b]Problem:[/b] Once clients connect to the VPN Server, they get assigned the proper IPs (192.168.1.250 and 251) and they can not longer reach any local IP within their LAN. They can’t access their local router (192.168.1.2) or the PAP-2 adapter. This wouldn’t be a big problem for me, but the Laptop can’t access the shared printer in the PC, which is a problem. If I desconnect the VPN on any of the clients (PC or Laptop), that particular computer will regain acces to the local resources in the LAN. I am sure there is something wrong with the routing configuration, but I have no idea what to do since I am not very good ait it. This is my first configuration and I am happy I got it to work this far… If you need more information to be able to help, please let me know and I will be happy to provide it. Thanks in advance for your help! Fabian

[quote="fluttman"]server-bridge 192.168.1.1 255.255.255.0 192.168.1.250 192.168.1.254 [/quote][quote="fluttman"]Once clients connect to the VPN Server, they get assigned the proper IPs (192.168.1.250 and 251) and they can not longer reach any local IP within their LAN. [b]They can’t access their local router (192.168.1.2)[/b][/quote]You have a routing conflict ... [list]NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or [u]192.168.1.x[/u]. Be aware that this might create [b]routing conflicts[/b] if you connect to the VPN server from public locations such as internet cafes that use the same subnet.[/list] :arrow: [u]Never[/u] use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

Help needed with possible routing problem

fluttman

Hi,
I have built my first VPN network gathering information posted by other users.
I managed to get it working OK, since the clients are able to connect to the server and access the remote PCs and File Server, but I think I have a routing problem that I don’t know how to fix.
Any help will be much appreciated!

Topology:
One main office with several PCS, a File Server and Print Server, Asterisk VoIP Box. This office has a DD-WRT router running OpenVPN Server on it.
One remote office with 1 PC with a shared printer, 1 Laptop and a PAP-2 VoiP adapter. This remote office has OpenVPN Client for Windows running in both computers. It also has a DD-WRT router but it is not involved with the VPN stuff.

Configuration:

OpenVPN Server on DD-WRT (192.168.1.1)
OpenVPN > Enable
Start Type > WAN Up
Config as > Deamon
Additional Config:
mode server
proto udp
port 1194
dev tap0
server-bridge 192.168.1.1 255.255.255.0 192.168.1.250 192.168.1.254
keepalive 10 120
daemon
verb 5
client-to-client
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
push "route 192.168.1.0 255.255.255.0"

Administration/Commands
Startup:
openvpn --mktun --dev tap0
brctl addif br0 tap0
ifconfig tap0 0.0.0.0 promisc up

Firewall:
iptables -A INPUT -i tap0 -j ACCEPT
iptables -I INPUT -p udp --dport 1194 -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.1.1/24 -o eth0 -j MASQUERADE

OpenVPN Client on Win7 (Config.ovpn)
remote xxxxxxx 1194
client
dev tap0
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
float
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server

Problem:
Once clients connect to the VPN Server, they get assigned the proper IPs (192.168.1.250 and 251) and they can not longer reach any local IP within their LAN.
They can’t access their local router (192.168.1.2) or the PAP-2 adapter. This wouldn’t be a big problem for me, but the Laptop can’t access the shared printer in the PC, which is a problem.
If I desconnect the VPN on any of the clients (PC or Laptop), that particular computer will regain acces to the local resources in the LAN.
I am sure there is something wrong with the routing configuration, but I have no idea what to do since I am not very good ait it. This is my first configuration and I am happy I got it to work this far…

If you need more information to be able to help, please let me know and I will be happy to provide it.
Thanks in advance for your help!

Fabian

Traffic

fluttman wroteserver-bridge 192.168.1.1 255.255.255.0 192.168.1.250 192.168.1.254

fluttman wroteOnce clients connect to the VPN Server, they get assigned the proper IPs (192.168.1.250 and 251) and they can not longer reach any local IP within their LAN.
They can’t access their local router (192.168.1.2)

You have a routing conflict ...

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!: