blackstatic42 Our issue: We can connect to the server, but cannot access the infrastructure. Pings fail, except to the host server. We'd like to keep VPN traffic off of our own network if possible. Server OS: CentOS 7 Firewall: Disabled SElinux: Permissive OpenVPN: 2.4.8 (x86_64) running natively (ie, not in a container, on a VM or otherwise complex routing situation) Client (in this case) OS: Fedora 31 Firewall: Disabled SElinux: Permissive OpenVPN: 2.4.8 (x86_64) Server Config push "route 192.168.1.0 255.255.255.0" #our internal ip range push "route 10.8.0.0 255.255.255.0" dev tun management 127.0.0.1 1195 server 10.8.0.0 255.255.255.0 #OpenVPN creates its own network push "dhcp-option DNS 192.168.1.42" #Our Internal DNS server port 1194 tls-server proto udp dev tun comp-lzo keepalive 10 120 persist-key persist-tun status openvpn-status.log verb 3 ca /PATH/TO/OUR/CA.crt cert /PATH/TO/OUR/SERVER.crt key /PATH/TO/OUR/SERVER.key dh /PATH/TO/OUR/DH.pem Client Config client dev tun float redirect-gateway def1 dhcp-option DNS 192.168.1.42 #this is our internal DNS server pull proto udp remote OUR.DNS.NET 8989 #I've obfuscated the FQDN and the port for the sake of security resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert USER_NAME.crt #I've obfuscated the exact name of the cert key USER_NAME.key #and the key comp-lzo verb 3 ns-cert-type server script-security 2 down /etc/openvpn/client.down up /etc/openvpn/client.up
Pippin Please see: https://community.openvpn.net/openvpn/wiki/HOWTO#ExpandingthescopeoftheVPNtoincludeadditionalmachinesoneithertheclientorserversubnet. And: https://forums.openvpn.net/viewtopic.php?t=22603
TinCanTech blackstatic42 wrote Server Config push "route 192.168.1.0 255.255.255.0" Never use 192.168.1.0/24 for your server LAN.
blackstatic42 Is there some kind of configuration error that OpenVPN has, that prevents using that subnet, or is this primarily a "best business practice" suggestion? If in fact, OpenVPN has an issue with the 192.168.1.0/24 subnet, is there an alternative that you suggest? While 192.168.1.0/24, isn't best practice, we're not in a business production environment. Just a couple people who want to safeguard our privacy out in the wild, and have access to our own DNS server, and other network infrastructure.
Pippin out in the wild is where those addresses are used a lot... Also see: https://community.openvpn.net/openvpn/wiki/AvoidRoutingConflicts https://community.openvpn.net/openvpn/wiki/HOWTO#Numberingprivatesubnets
