Good day to you, gentlemen. I have got Windows Server 2003 R2 x64 and OpenVPN 2.3.14 installed on my server. The server is connected to the Internet via a NAT router with 1194UDP forwarded to the server. Here is a map of the network: [url=http://rgho.st/private/68w5kYQnH/099b17fa37ae7fa2ce3b8c2c441b8804.view][img]http://rgho.st/private/68w5kYQnH/099b17fa37ae7fa2ce3b8c2c441b8804/thumb.png[/img][/url] Connection establishes succesfully and 10.8.0.1 is accessible from a client. But 192.168.1.99, however, is not, like the entire 192.168.1.0/24 local network. I want it to be accessible and I also want a client to have an opportunity to connect the Internet through the 192.168.1.1 router. I also have NAT enabled on the server: [url=http://rgho.st/private/7mhwVMmY8/2fbce6c8c51196efa951b9aad8f5d9da.view][img]http://rgho.st/private/7mhwVMmY8/2fbce6c8c51196efa951b9aad8f5d9da/thumb.png[/img][/url] And these statiс routes (not sure whether is's correct or not, I'm not good at routing): [url=http://rgho.st/private/6VVm6cxS7/2fe12e67f9e70134abceb4041384d95b.view][img]http://rgho.st/private/6VVm6cxS7/2fe12e67f9e70134abceb4041384d95b/thumb.png[/img][/url] And this route on the 192.168.1.1 router: [url=http://rgho.st/private/7nFsfSHrC/41eff79efbd001733a14bf8375c8cd62.view][img]http://rgho.st/private/7nFsfSHrC/41eff79efbd001733a14bf8375c8cd62/thumb.png[/img][/url] Here is the server config: [oconf=Server Config]port 1194 proto udp dev tap ca ca.crt cert server.crt key server.key # This file should be kept secret dh dh2048.pem topology subnet server 10.8.0.0 255.255.255.0 push "route 10.8.0.0 255.255.255.0" push "route 192.168.1.0 255.255.255.0" push "redirect-gateway def1" push «route-gateway 10.8.0.1» push «dhcp-option DNS 8.8.8.8» push «dhcp-option DNS 8.8.4.4» client-to-client keepalive 10 120 cipher AES-256-CBC persist-key persist-tun status openvpn-status.log verb 3 mssfix[/oconf] And here is the client config: [oconf=Client Config]client dev tap proto udp remote 92.243.113.58 1194 resolv-retry infinite nobind persist-key persist-tun remote-cert-tls server cipher AES-256-CBC verb 3 pull -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- -----BEGIN PRIVATE KEY----- -----END PRIVATE KEY----- [/oconf] What shall I do?

This, [list]NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or [b]192.168.1.x[/b]. Be aware that this might create [b]routing conflicts[/b] if you connect to the VPN server from public locations such as internet cafes that use the same subnet.[/list] :arrow: [u]Never[/u] use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!: [list]You are advised to change your server LAN to a more unique [url=http://en.wikipedia.org/wiki/Private_network]RFC1918[/url] compliant subnet. For example: 192.168.143.0/24[/list]

[quote="TinCanTech"]This, [list]NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or [b]192.168.1.x[/b]. Be aware that this might create [b]routing conflicts[/b] if you connect to the VPN server from public locations such as internet cafes that use the same subnet. :arrow: [u]Never[/u] use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!: You are advised to change your server LAN to a more unique [url=http://en.wikipedia.org/wiki/Private_network]RFC1918[/url] compliant subnet. For example: 192.168.143.0/24[/list][/quote]This may still be a problem from a remote network which uses the same subnet.

VPN server's LAN is not accessible

gunslinger

Good day to you, gentlemen. I have got Windows Server 2003 R2 x64 and OpenVPN 2.3.14 installed on my server. The server is connected to the Internet via a NAT router with 1194UDP forwarded to the server. Here is a map of the network:

Connection establishes succesfully and 10.8.0.1 is accessible from a client. But 192.168.1.99, however, is not, like the entire 192.168.1.0/24 local network.
I want it to be accessible and I also want a client to have an opportunity to connect the Internet through the 192.168.1.1 router.
I also have NAT enabled on the server:

And these statiс routes (not sure whether is's correct or not, I'm not good at routing):

And this route on the 192.168.1.1 router:

Here is the server config: port 1194
proto udp
dev tap

ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem

topology subnet

server 10.8.0.0 255.255.255.0

push "route 10.8.0.0 255.255.255.0"
push "route 192.168.1.0 255.255.255.0"
push "redirect-gateway def1"
push «route-gateway 10.8.0.1»
push «dhcp-option DNS 8.8.8.8»
push «dhcp-option DNS 8.8.4.4»

client-to-client

keepalive 10 120

cipher AES-256-CBC

persist-key
persist-tun

status openvpn-status.log

verb 3

mssfix And here is the client config: client

dev tap
proto udp

remote 92.243.113.58 1194

resolv-retry infinite

nobind

persist-key
persist-tun

remote-cert-tls server

cipher AES-256-CBC

verb 3

pull

<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
</key> What shall I do?

TinCanTech

This,

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

You are advised to change your server LAN to a more unique RFC1918 compliant subnet.
For example: 192.168.143.0/24

gunslinger

>>if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
My client computer doesn't connected to the same subnet.
>>You are advised to change your server LAN to a more unique RFC1918 compliant subnet.
I'm afraid it's impossible.

gunslinger

I found a mistake in my config: push «route-gateway 10.8.0.1»
push «dhcp-option DNS 8.8.8.8»
push «dhcp-option DNS 8.8.4.4» Changed it to: push "route-gateway 10.8.0.1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4" Now the gateway seems to be accepted by client computer, but things just got worse: now I can't connect neither 10.8.0.1 nor the Internet, nor 192.168.1.99

TinCanTech

gunslinger wrote>>You are advised to change your server LAN to a more unique RFC1918 compliant subnet.
I'm afraid it's impossible.

Then you may not be able to resolve your issue.

gunslinger wroteNow the gateway seems to be accepted by client computer, but things just got worse: now I can't connect neither 10.8.0.1 nor the Internet, nor 192.168.1.99

Please post your client log at --verb 4

Please see:
HOWTO: Request Help !

gunslinger

I've already got it working by setting a bridge (https://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html). Sorry for bothering.

TinCanTech

TinCanTech wroteThis,
NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

You are advised to change your server LAN to a more unique RFC1918 compliant subnet.
For example: 192.168.143.0/24

This may still be a problem from a remote network which uses the same subnet.