VPN clients cannot ping to each other

muiz

Dear all, I'm a new vpn user, I download the last OpenVPN source and installed it to a Linux server(SL6). After start vpn server, clients can get DHCP ips from server, but they cannot pint to each oter, and also canont ping to server, I think the server.conf has problem (E.g.g route ...). Can you help me check? The below information FYI:

Network1: (office)
Linux server: (OpenVPN server)
eth0: 192.168.1.250 (Lan IP)
eth1: 203.169.3.3 (External IP)
gateway: 203.169.3.2
DNS: 203.169.8.8

Client PC: (vpn client 1)
eth0: 192.168.1.10
gateway: 192.168.1.254
DNS: 192.168.1.253

Network 2: (my home, vpn client2)
router: DHCP
laptop: WINDOWS 7, IP: 192.168.0.100

----------------------------------
iptables :
[root@Bermuda 2.0]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:http
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:openvpn
ACCEPT udp -- anywhere anywhere state NEW udp dpt:openvpn
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:cvspserver
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:hbci
ACCEPT udp -- anywhere anywhere state NEW udp dpt:sentinel-lm
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:webcache
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT udp -- anywhere 192.168.1.14 state NEW udp dpt:sentinel-lm
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
---------------------------------
server.conf:
port 1194
proto udp
dev tun

ca /etc/openvpn/2.0/keys/ca.crt
cert /etc/openvpn/2.0/keys/server.crt
key /etc/openvpn/2.0/keys/server.key # This file should be kept secret
dh /etc/openvpn/2.0/keys/dh1024.pem

server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt

client-to-client
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 3

push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.8.0.1"
push "route 192.168.1.0 255.255.255.0"
push "route 192.168.0.0 255.255.255.0"

------------------------------------
vpn clients can get the IPs from server:
client 1: 10.8.0.10
client 2: 10.8.0.6

but my laptop 10.8.0.10, cannot ping to server 10.8.0.1 and 10.8.0.6, same as others.

what's wrong?

maikcat

hi there,

is selinux enabled?

also for testing purposes can you disable firewall on your server?

your config seems ok..

your clients are windows? what version are you using?

Michael.

muiz

Thanks maikcat,

I disabled SELinux already, the windows client is windows 7 pro.

janjust

this is a firewalling issue on the windows side - make sure the tap-win32 adapter is part of a public network ; by default Windows 7 makes the tap-win32 / VPN connection an 'Unidentified' network, which it does not trust - therefore pings are not allowed.

muiz

janjust wrotethis is a firewalling issue on the windows side - make sure the tap-win32 adapter is part of a public network ; by default Windows 7 makes the tap-win32 / VPN connection are 'Unidentified' network, which it does not trust - therefore pings are not allowed.

I check the network settings, it seems no problem, and I also test in a windows xp system, and also close the firewall, but still the same problem.