gabo
I have had an openvpn server for 10 years, simple config with one subnet behind the server (172.21.210.0/24).
I recently had my server certs expire, that's now I know it's been running for 10 years as that was the cert length. I generated new certs and restarted the server. Clients can now connect again, but they can't access the LAN behind the server. Nothing changed on any of that config.
However, here are the pertinent lines for the server config.
port 1196
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key # This file should be kept secret
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so login
tmp-dir /etc/openvpn/tmp
crl-verify /etc/openvpn/keys/crl.pem
dh /etc/openvpn/keys/dh1024.pem
server 192.168.244.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 172.21.210.0 255.255.255.0"
client-config-dir ccd
push "dhcp-option DNS 172.21.210.1"
client-to-client
duplicate-cn
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
When a client connects, the route 172.21.210.0 is NOT added to the client computer AND if I add it manually I still can't route to the LAN or ping 172.21.210.1 (which IS the openvpn server)
I also get this line in the openvpn.log file.
REMOVE PUSH ROUTE: 'route 172.21.210.0 255.255.255.0'
I don't understand why this is no longer working. Any help would be appreciated.
gabo
Actually I found the problem. It was due to the subnet being in an entry in the txt file in the ccd directory. I have no idea how it got in there, but when I remove it all started to work correctly.
Thanks for the help. For anyone who has this problem, check the ccd directory on your server and make sure everything in there is ok.
gabo
