I have my OpenVPN server running with the subnet 10.8.0.0/8, and connections coming in on eth0 directly from the internet (no router).
Same server is then connected to my LAN via eth1 192.168.1.0/24, and has the internal address of 192.168.1.4.
When on a client that is connected to the server, I can access all other hosts in the 192.168.1.0/24 subnet, except I can't reach services also running on 192.168.1.4.
I haven't added any additional routes anywhere.
My OpenVPN config includes
push "route 192.168.1.0 255.255.255.0"
client-to-client is enabled
I've configured UFW before rules as follows
# START OPENVPN RULES
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
# Allow traffic from OpenVPN client
-A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.8.0.0/8 -o eth1 -j MASQUERADE
COMMIT
# END OPENVPN RULES
A traceroute from an OpenVPN client to another host on the LAN follows the correct route
traceroute to 192.168.1.9 (192.168.1.9) , 5 relative hops max, 52 byte packets
1 10.8.0.1 (10.8.0.1) 10.305 ms 12.072 ms 17.311 ms
2 192.168.1.1 (192.168.1.1) 7.929 ms 9.053 ms 11.336 ms
3 192.168.1.9 (192.168.1.9) 7.775 ms 8.887 ms 9.728 ms
My suspected cause:
Traffic from 10.8.0.0/8 to 192.168.1.4 is happening within the server and thus bypassing 192.168.1.1, and so all the proper routes are not defined. Or, the services I'm trying to reach from 10.8.0.0/8 are only listening on the 192.168.1.4 interface, and thus can't be reached without going out and through 192.168.1.1 first.
