Hello. I have configured server, I can connect to it, this is working fine. VPN Network is 10.8.0.0/24 VPN server address is 10.8.0.1 My IP is 10.8.0.5 (and second side of tunnel is 10.8.0.6) server-side lan address is 10.10.1.15 I have added to server.conf line: push "route 10.10.1.0 255.255.255.0" Now I'm able to ping with 10.10.1.15 from my laptop but I'm unable to ping for example 10.10.1.10 - this is other server in this network. However I'm able to ping this server from my VPN server, ping is about 0.2 ms so this connection is working well. So what's the problem? Here is server's iptable [code]Chain INPUT (policy DROP) target prot opt source destination ACCEPT all -- localhost anywhere ACCEPT all -- anywhere localhost ACCEPT icmp -- anywhere anywhere icmp echo-request ACCEPT tcp -- anywhere anywhere tcp dpt:http ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ACCEPT udp -- anywhere anywhere udp dpt:openvpn ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere Chain FORWARD (policy DROP) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT all -- 10.8.0.0/24 10.10.1.0/24 [/code]

Thank you for reply. It's look like my nat rules don't exist. [code]iptables -t nat -L -n -v Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination [/code] However I will ask my network administrator, because I think that he must add some rule in our gateway according to "how to". Probably now incoming packets don't know how to get 10.8* network and gateway must show, that this network is avaiable under my server IP. It could be second reason of my problem. [quote]Next, you must set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24) to the OpenVPN server (this is only necessary if the OpenVPN server and the LAN gateway are different machines).[/quote]

Cannot reach server-side lan devices

bbu

Hello. I have configured server, I can connect to it, this is working fine.

VPN Network is 10.8.0.0/24
VPN server address is 10.8.0.1
My IP is 10.8.0.5 (and second side of tunnel is 10.8.0.6)
server-side lan address is 10.10.1.15
I have added to server.conf line:
push "route 10.10.1.0 255.255.255.0"

Now I'm able to ping with 10.10.1.15 from my laptop but I'm unable to ping for example 10.10.1.10 - this is other server in this network. However I'm able to ping this server from my VPN server, ping is about 0.2 ms so this connection is working well. So what's the problem?

Here is server's iptable

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  localhost            anywhere            
ACCEPT     all  --  anywhere             localhost           
ACCEPT     icmp --  anywhere             anywhere             icmp echo-request
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     udp  --  anywhere             anywhere             udp dpt:openvpn
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere                  
ACCEPT     all  --  10.8.0.0/24          10.10.1.0/24

300000

maybe you didnt nat rule on your server , try iptable rule to see how it nat

iptables -t nat -L -n -v

it list all nat rule and check it.

bbu

Thank you for reply. It's look like my nat rules don't exist.

iptables -t nat -L -n -v
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

However I will ask my network administrator, because I think that he must add some rule in our gateway according to "how to". Probably now incoming packets don't know how to get 10.8* network and gateway must show, that this network is avaiable under my server IP. It could be second reason of my problem.

Next, you must set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24) to the OpenVPN server (this is only necessary if the OpenVPN server and the LAN gateway are different machines).

300000

you can try on your openvpn server nat and ipforward doing two command on terninal

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

echo 1 > /proc/sys/net/ipv4/ip_forward =1

try it and test it to see if it work for you.

bbu

Yessss, that works! Thank you so much. I will continue configuring this in my company, probably I will ask you some more questions 🙂
You make my day!