[Solved] Routing: other computers in the target network are not reachable

snugger

Hi,

my configuration is a client network with IP subnet 192.168.0.0/24 and a target network with IP 192.168.10.0/24 which is reached over a no-ip DynDNS-account. The OpenVPN-network is 192.168.30.0/24.

On both sides is a Fritzbox 7490 as router and the Fritzbox 7490 of the target network with IP 192.168.10.1 has a forwarded port 1194/UDP to address 192.168.10.2 on which the OPENVPN-server is running. In the Fritzbox of the target network is a IPv4-Route configured with

network=192.168.30.0/24
gateway=192.168.10.2 (the open VPN server)

There is no problem to connect to the OPENVPN-server and to establish a VPN-connection. But I have a routing problem:

With the established VPN-connection, I can reach the router (192.168.10.1), other devices like network printers and the OpenVPN server (192.168.10.2) by PING, http, RDP. But it is not possible to reach other computers in the target network!
Because of testing I disabled the firewalls of these computers and I added the registry key

HKEY_LOCAL_MACHINE\ System\ CurrentControlSet\ Services\ Tcpip\ Parameters
IPEnableRouter => REG_DWORD => 1

But the problem stills exists.

Any suggestions to solve the problem?

Best wishes
😃

Here are my config files

SERVER
ca "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\MeinServer.crt"
key "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\MeinServer.key"
dh "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\dh1024.pem"

local 192.168.10.2
port 1194
proto udp
dev tun
server 192.168.30.0 255.255.255.0
ifconfig-pool-persist ipp.txt
comp-lzo
persist-key
persist-tun
keepalive 10 120
push "route 192.168.10.0 255.255.255.0"

client
ca "C:\\program files\\openvpn\\config\\ca.crt"
cert "C:\\program files\\openvpn\\config\\meinclient.crt"
key "C:\\program files\\openvpn\\config\\meinclient.key"

client
dev tun
proto udp
remote *****.no-ip.biz 1194
resolv-retry infinite
nobind
persist-key
persist-tun
route-metric 512
route 0.0.0.0 0.0.0.0
comp-lzo

TinCanTech

snugger wroteWith the established VPN-connection, I can reach the router (192.168.10.1), other devices like network printers and the OpenVPN server (192.168.10.2) by PING, http, RDP. But it is not possible to reach other computers in the target network!

Every computer in the 192.168.10.0/24 network need a static route to the VPN subnet via the VPN server.

This is a bad idea:

snugger wroteclient
route 0.0.0.0 0.0.0.0

Instead use --redirect-gateway .. See the HOWTO:
HOWTO: Routing all client traffic (including web-traffic) through the VPN

snugger

Every computer in the 192.168.10.0/24 network need a static route to the VPN subnet via the VPN server.

GREAT!!! Many thanks! 😃 Now it works 😛

I wonder because I didn`t get this information from the tutorials but maybe I am blind 😉

I don`t understand why computers need the route-command to the VPN-network but devices don`t in order to be reachable by the client. If you want, you can give me the background information.

Many thanks again
:mrgreen: