Client cannot access server lan devices

knowledgem

Hi,

I want to setup simple vpn with client being able to access server lan. I cannot figure this out. Below is my config files. Both are windows 10 computers.

Client network is 192.168.2.0
Server network is 192.168.11.0
VPN network is 10.8.0.0

From client i can ping 192.168.11.199 which is servers ip address i can also ping 10.8.0.1 which is also the servers vpn ip and i can access shares etc..
What i would like to do is ping 192.168.11.100 and 192.168.11.102 and any other device on the servers network. and thats what i cannot get to work.

From server i can ping 10.8.0.10 which is client vpn ip but not 192.168.2.12 which is the clients ip but thats ok in this case because i dont need that.

On server i went HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters and set "1" and rebooted server.

So this is where im stuck, i think maybe im supposed to add static route but i am not familiar with that and dont really know what im doing there. Please help if you can thanks.

port 1194
proto udp
dev tun
ca "C:\\OpenVPN\\config\\ca.crt"
cert "C:\\OpenVPN\\config\\server.crt"
key "C:\\OpenVPN\\config\\server.key"
dh "C:\\OpenVPN\\config\\dh1024.pem"
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-to-client
push "route 192.168.11.0 255.255.255.0"
keepalive 10 120
persist-key
persist-tun
status openvpn-status.log
verb 3

client
dev tun
proto udp
remote 123.123.123.123 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\OpenVPN\\config\\ca.crt"
cert "C:\\OpenVPN\\config\\b-work.crt"
key "C:\\OpenVPN\\config\\b-work.key"
ns-cert-type server
verb 3

TinCanTech

knowledgem wrote maybe im supposed to add static route

Yes you do .. add either a route to each device for the VPN subnet or a route to the default gateway for the VPN subnet.

Your gateway device should have a dialogue/menu to do that.

knowledgem

Thank you for the fast reply.

Could you explain that a bit?

I kinda tried here in the tplink router:
ID Destination Network Subnet Mask Default Gateway Status
1 10.8.0.0 255.255.255.0 192.168.11.199 Enabled

With that in place on the server network router then i can ping 192.168.11.1 but i cannot login into it and i cannot ping 192.168.11.100 or anything else except 192.168.11.199, 192.168.11.1

Could you shed some light?

TinCanTech

knowledgem wrote the tplink router:
ID Destination Network Subnet Mask Default Gateway Status
1 10.8.0.0 255.255.255.0 192.168.11.199 Enabled

That is correct ..

knowledgem wrote With that in place on the server network router then i can ping 192.168.11.1 but i cannot login into it and i cannot ping 192.168.11.100 or anything else except 192.168.11.199, 192.168.11.1

I don't know anything about your router, take a look in the router manual.

If that all does not work then add routes to each device .. google "add static route to device-name" (change device name to whatever device it is .. eg: Windows / printer name (Printer name like bubblejet)

You're almost there though .. 8-)

knowledgem

So in researching this a bit more to me it seems like it should work to do this:
route ADD 10.8.0.0 MASK 255.255.255.0 192.168.11.1 (IP of my router which is default gateway, im a little confused about this. Is my router still the gw or is the vpn server now the gw?)

So i ran that in cmd on the server (windows 10 computer) and it accepted it but made no difference.
I still cannot ping any other devices on the network. I decided not to do it in the router....was not getting anywhere in there either.

when you say add routes to each device do you mean running a command for static route on each device on server lan? I obviously dont really understand this.This would not work because because some are phones and printers and it would not work.

knowledgem

So i have made some progress but not quite consistently. Here is what i had to do on the windows 10 server:

Start -> Right-click My Computer -> Manage
Services
Right-click Routing and Remote Access -> Properties -> Automatic
Right-click Routing and Remote Access -> Start

Next:

Control Panel
Network and Sharing Center
Local Area Connection
Properties
Sharing
Tick the box "Allow other network users to connect through this computer's Internet connection"

Then if i reboot server then it does not work. I then have to disable sharing and turn sharing back on again.....
And it only works for a little while... like 40 seconds then my ping times out when pinging 192.168.11.98 from client.
I am clearly be doing something wrong.

I think enabling the sharing must set some static route that i could not figure out.

Any ideas?

TinCanTech

Bebop's posts may help:
https://forums.openvpn.net/viewforum.php?f=7