Any help would be much appreciated Scenario Server Side: Router 192.168.2.1 Computer 1 VPN server (192.168.2.50) (10.8.5.0) (255.255.255.0) Computer 2 192.168.2.40 (no ip given by vpn) Computer 3 192.168.2.101 (no ip given by VPN) Server Side: only Computer 1 can ping the clients [code] local 192.168.2.50 port 1195 proto udp dev tun mode server tls-server persist-key persist-tun server 10.8.5.0 255.255.255.0 push "route 192.168.2.0 255.255.255.0" #push "redirect-gateway def1" ca /etc/openvpn/keys/ca.crt cert /etc/openvpn/keys/aaa.crt key /etc/openvpn/keys/bbb.key dh /etc/openvpn/keys/dh1024.pem tls-auth /etc/openvpn/keys/ta.key 0 ifconfig-pool-persist /etc/openvpn/ipp.txt keepalive 20 180 reneg-sec 0 cipher AES-128-CBC # AES status openvpn-stauts.log log /etc/openvpn/openvpn.log verb 5 [/code] -------------------------------------------------------------------------------------------------- Client Side: 5 users all given ip from vpn 10.8.5.6 ,10,14,etc Client side can ping 10.8.5.0 192.168.2.1 192.168.2.50 192.168.2.40 192.168.2.101 -------------------------------------------------------------------------------------------------- Question How can i ping all clients from the server side Computer 2 & Computer 3 as well? I have tried these in server config one by one (seperatley not at the same time) push "route 10.8.5.0 255.255.255.0" route add -net 10.8.5.0/24 gw 192.168.2.0 route add -net 10.8.5.0/24 gw 192.168.2.50 None of them fixed my problem :( Any suggestions?

hi there, if openvpn client can ping pcs inside your lan that means that your routing is ok and works... maybe your client has a firewall and drops connections from 192.168.2.0 net? what OS is it? Michael

Hi Thanks for the reply all clients connected to VPN can ping these: Computer 2 192.168.2.40 [color=#0040FF]Debian[/color] Computer 3 192.168.2.101 [color=#0040FF]Windows server 2003[/color] The problem is that from these 2 pc s which are on the server side cannot ping the clients on the 10.8.5.* network Maybe this helps: computer 2 & 3 don't get an open vpn ip (10.8.5.*) i need to connect to the vpn clients via the ips assigned by the openvpn server from computer 2 and 3 Any idea how this can be done? Thanks for you help

hi there, if openvpn clients can ping both pcs (computer 2 &3 ) means that ip routing is correct.. if these both computers cant ping your clients then something on your clients maybe blocking traffic (firewall maybe) your clients what os they use? Michael.

I am having the same issue over here. I have a client which is connected to my VPN Server. My client is using a Dreambox. I am trying to access the user using the vpn ip from a windows xp which is found on the vpn server network to no avail. Do you think the problem is about a firewall on the dreambox because if i'm not mistaken there is no firewall on the dreambox by default. like hulky said, i can ping the windows xp from the client side but not from the windows xp to the client

hi there, AFAIK dreambox doesnt have firewall enabled (just a busybox) which image are you using? please post configs and details about your setup to help you.. Michael.

Thanks for your fast reply. Please find below the configuration I have VPN Server - server.conf [code]local 192.168.10.100 port 1194 proto udp dev tun mode server tls-server client-to-client max-clients 300 persist-key persist-tun server 10.8.0.0 255.255.0.0 push "route 192.168.10.0 255.255.255.0" ca /etc/openvpn/keys/ca.crt cert /etc/openvpn/keys/server.crt key /etc/openvpn/keys/server.key dh /etc/openvpn/keys/dh1024.pem tls-auth /etc/openvpn/keys/ta.key 0 ifconfig-pool-persist /etc/openvpn/ipp.txt keepalive 20 180 reneg-sec 0 cipher AES-128-CBC # AES status openvpn-stauts.log log /etc/openvpn/openvpn.log verb 3[/code] client.conf - found on dreambox [code]client proto udp remote dnsname.dyndns.com 1194 resolv-retry infinite nobind dev tun ca /var/etc/openvpn/keys/ca.crt cert /var/etc/openvpn/keys/xxxxx.crt key /var/etc/openvpn/keys/xxxxx.key tls-auth /var/etc/openvpn/keys/ta.key 1 ns-cert-type server cipher AES-128-CBC # AES reneg-sec 0 ping-timer-rem[/code]

is ip forwarding enabled on openvpn server? just curious,what image you use on dm? which model? Michael.

in rc.local i have the below [code]iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT iptables -A FORWARD -j REJECT iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE[/code] The image I am using is Gemini2 v5.1 OE1.6

hi there, >iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE why are you using nat? also for tests disable ip tables... Michael.

I am going to remove the below from rc.local [code]iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE[/code] I will also disable the iptables and will post again.

Multiple PC s on server side but not all can ping clients

maikcat

you need to add a static route to your debian...

route add -net 10.8.5.0 nemask 255.255.255.0 gw 192.168.2.50

Michael.

hulky

Hi again

I put these line in server.conf tested one after the other
route add -net 10.8.5.0 255.255.255.0 gw 192.168.2.50
or
route add -net 10.8.5.0 255.255.255.0 gw 192.168.2.40

both no sucess

got this in openvpn log:

Wed Jul 6 10:18:16 2011 ROUTE default_gateway=192.168.2.1
Wed Jul 6 10:18:16 2011 RESOLVE: Cannot resolve host address: add: [HOST_NOT_FOUND] The specified host is unknown.
Wed Jul 6 10:18:16 2011 OpenVPN ROUTE: failed to parse/resolve route for host/network: add
Wed Jul 6 10:18:16 2011 TUN/TAP device tun0 opened
Wed Jul 6 10:18:16 2011 TUN/TAP TX queue length set to 100
Wed Jul 6 10:18:16 2011 /sbin/ifconfig tun0 10.8.5.1 pointopoint 10.8.5.2 mtu 1500
Wed Jul 6 10:18:16 2011 /sbin/route add -net 10.8.5.0 netmask 255.255.0.0 gw 192.168.2.50
Wed Jul 6 10:18:16 2011 /sbin/route add -net 10.8.5.0 netmask 255.255.0.0 gw 10.8.5.2

maikcat

you got it wrong,

route add -net 10.8.5.0 255.255.255.0 gw 192.168.2.50

this is NOT for openvpn config but execute it in a shell on debian

Michael

hulky

Hi

still nothing

got this output

Usage: inet_route [-vF] del {-host|-net} Target[/prefix] [gw Gw] [metric M] [[de v] If]
inet_route [-vF] add {-host|-net} Target[/prefix] [gw Gw] [metric M]
[netmask N] [mss Mss] [window W] [irtt I]
[mod] [dyn] [reinstate] [[dev] If]
inet_route [-vF] add {-host|-net} Target[/prefix] [metric M] reject
inet_route [-FC] flush NOT supported

maikcat

typo error...

route add -net 10.8.5.0 netmask 255.255.255.0 gw 192.168.2.50

Michael

hulky

GREAT!!!! looks like it worked

I need to put this in rc.local of the .40 server not the .50(vpn)

Correct me if I'm wrong

And thanks very much for your patience and help

maikcat

>I need to put this in rc.local of the .40 server

yeap..

glad to helped

closing topic.

Michael.

« Previous Page