I don't know how to set up routing.

jopeme

I have set up OpenVPN 2.7.8 on a Windows Server 2019 machine. From a client outside the server's network, I am able to connect and successfully ping the IP address 10.90.90.1. The server is located on a network using the 192.168.1.0/24 address range. By entering \10.90.90.1, I can access the server's shared folders; however, I am unable to ping any addresses within the 192.168.1.0 range, which prevents me from accessing other devices on that network. I read that adding the line push "route 192.168.1.0 255.255.255.0" to the OpenVPN server configuration file should help, but that has not resolved the issue. How can I fix this?
Thank you.

jopeme

jopeme I’ve answered my own question: I commented out the line that says route-nopull in the client configuration file, and it works.

jopeme

jopeme ohhh! I thought it was working, but I can only ping the server's IP; it doesn't reach the rest of the devices.
This is my .ovpn file of server:
local 192.168.1.54
port 1196
proto udp4
dev tun
topology subnet
server 10.90.90.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"
ca "C:/Program Files/OpenVPN/config/ca.crt"
cert "C:/Program Files/OpenVPN/config/CA_OVPN_UNICAP_SRV.crt"
key "C:/Program Files/OpenVPN/config/CA_OVPN_UNICAP_SRV.key"
dh none
verify-client-cert require
remote-cert-tls client
crl-verify "C:/Program Files/OpenVPN/config/crl.pem"
ifconfig-pool-persist "C:/Program Files/OpenVPN/config/ipp.txt"
tls-crypt-v2 "C:/Program Files/OpenVPN/config/tls-crypt-v2-server.key" force-cookie
tls-crypt-v2-max-age 825
tls-version-min 1.3
tls-cert-profile preferred
data-ciphers CHACHA20-POLY1305:AES-128-GCM
data-ciphers-fallback AES-256-GCM
allow-compression no
keepalive 10 60
explicit-exit-notify 1
max-clients 2
status "C:/ProgramData/OpenVPN/log/servidor-status.log" 10
verb 3

And this is my .ovpn file of client:

============================================================

client
dev tun
proto udp4

remote fqdn 1196

remote IP-Publica 1196

remote xxxxxxx 1196
nobind
resolv-retry infinite
ca "C:\Program Files\OpenVPN\easy-rsa\pki\ca.crt"
cert "C:\Program Files\OpenVPN\easy-rsa\pki\issued\nacho.crt"
key "C:\Program Files\OpenVPN\easy-rsa\pki\private\nacho.key"
remote-cert-tls server
verify-x509-name CA_OVPN_UNICAP_SRV name
tls-crypt-v2 "C:\Program Files\OpenVPN\easy-rsa\nacho-tls-crypt-v2.key"
tls-version-min 1.3
tls-cert-profile preferred
data-ciphers CHACHA20-POLY1305
data-ciphers-fallback AES-256-GCM
allow-compression no
explicit-exit-notify 1

------------------------------------------------------------

Rutas y DNS

------------------------------------------------------------

No aceptar rutas ni DNS enviados por el servidor.

En este laboratorio se evita que el servidor modifique la tabla de rutas

del cliente.

#route-nopull
auth-nocache
verb 3

Mohammad Montazeri

Removing route-nopull lets the client accept the pushed route, but reaching 10.90.90.1 only tests the VPN server itself.

Is 192.168.1.54 also the LAN devices’ default gateway? If not, the LAN gateway needs a return route for 10.90.90.0/24 via 192.168.1.54, alongside forwarding on the VPN server. This is the case covered in the official routing guide: https://openvpn.net/community-docs/setting-up-routing/

Before changing more settings, check that the connected client actually has the 192.168.1.0/24 route and that its local LAN does not use the same subnet. Then test one specific LAN host from the server and from the VPN client. That helps separate client routing, server forwarding, return routing, and host firewall policy. Keep the firewalls enabled; inspect the relevant traffic rather than disabling them.

AI-assisted technical feedback.