[SOLVED] Configure openvpn at a virtual server

Andreas553

Hello, i am new here and hope you can help me.
I try to set up a openvpn server for a small company in the last few weeks but it still dont work.

Overview: (i masked the IP's)
- Server_1 is a machine working as gateway. ExternIP (eth1: 80.80.80.49 and eth2: 130.130.130.153.
This second one is a direkt interface to another company to share ip-phones) InternIP (eth3: 10.0.0.1).
- Server_2 is a virtual machine at server_1. This one act as openvpn-server. ExternIP (eth3: 80.80.80.53 using server_1 as gw) internIP (eth1: 10.0.0.153).
- Client_1 is a Win7 pc.
- Client_2 is a netgear router with ddwrt.

Configuration per web interface:
- protocol: udp
- vpn mode: layer 3
- Should VPN clients have access to private subnets? Yes using NAT.(no difference if i use routing)
- Specify the private subnets to which all clients should be given access: 10.0.0.0/24

Userconfiguration:
- dynamic IP (no difference if i use static ip 10.0.0.55/56 (c_1/c_2))
- Allow Access To these Networks: Use NAT 10.0.0.0/24 (no difference if i use routing)

Problem:
- I am able to establish a connection from both clients.
- I am able to reach each interface of server_2 from both clients.
- Clients are able to reach the internet if i route hole traffic through tunnel.
- Client_1 is able to reach client_2 and vice versa.
- Server_2 is able to reach anything
- I am not able to reach anything else, neither server_1 nor another pc at 10.0.0.0/130.130.130.0 from clients.

Something left:
- No difference if when activate ip forward on client or server_2.
- First traceroute hop is 5.5.0.1 even if client_vpn_ip is static 10.0.0.55
- route on server_2:
5.5.0.0 * 255.255.240.0 U 0 0 0 as0t0
80.80.80.48 * 255.255.255.248 U 0 0 0 eth3
10.0.0.0 * 255.255.255.0 U 0 0 0 eth1
default 10.0.0.1 0.0.0.0 UG 0 0 0 eth3

Hope i am understandable and you have a clue what i should do next.
My linux knowledge is not that well so please be patient 😉

Thank you.

Mimiko

I am not able to reach anything else, neither server_1 nor another pc at 10.0.0.0/130.130.130.0 from clients

It's a common problem when OpenVPN is not also a GW for the LAN. In order for the LAN to be accesible you must do:
1) On every computer on LAN including GW add a static route for VPN LAN pointing to OpenVPN server.
2) On LAN GW add a satic route to route packets destined for VPN LAN to OpenVPN server.

Andreas553

Hell yeah, that routing entry at LAN-Client works.
Thank you very much. Where is the "solved" button?

janjust

here 🙂

(actually, I'm not sure if you can set it to solved, but the forum admins can)