I know this is a very common issue, but I have beengoogling this issue off and on for about 3 weeks and I have not gotten anywhere. I am hoping someone here can help. I have openvpn set up on Ubuntu server 11.10 and I *can* connect with a client. The VPN network is 10.8.0.0 and my LAN network is 192.168.1.0 behind the server. Machines on the LAN can ping the server's VPN address, and running a ping from the server can access the LAN machines. HOWEVER, the server cannot ping clients connected to it, and clients cannot ping the LAN behind the server. IP Addresses: 10.8.0.1 - the server IP for VPN 10.8.0.6 The client that cannot access LAN resources 192.168.1.137 - The server LAN IP 192.168.1.127 - the Lan Machine IP I am trying to access Pertinent information: [b]server.conf:[/b] port 1194 proto udp dev tun0 ca ca.crt cert server.crt key server.key dh dh1024.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "route 192.168.1.0 255.255.255.0" keepalive 10 120 user nobody group nogroup status openvpn-status.log verb 3 daemon management localhost 7505 [b]tcpdump -i tun0 -vv[/b] 10.8.0.6 > 192.168.1.127: ICMP echo request, id 1, seq 141, length 40 14:15:54.148343 IP (tos 0x0, ttl 128, id 948, offset 0, flags [DF], proto TCP (6), length 52) 10.8.0.6.51325 > 192.168.1.1.1780: Flags [S], cksum 0xfcaa (correct), seq 3169516204, win 8192, options [mss 1369,nop,wscale 8,nop,nop,sackOK], length 0 14:15:56.746089 IP (tos 0x0, ttl 128, id 949, offset 0, flags [none], proto ICMP (1), length 60) My linksys(cisco) router has a route in it that specifies 10.8.0.0 255.255.255.0 uses gateway 192.168.1.137 (the server). Thanks in advance!

[SOLVED] Unable to access machines behind server

mconway

I know this is a very common issue, but I have beengoogling this issue off and on for about 3 weeks and I have not gotten anywhere. I am hoping someone here can help.

I have openvpn set up on Ubuntu server 11.10 and I *can* connect with a client.

The VPN network is 10.8.0.0 and my LAN network is 192.168.1.0 behind the server.

Machines on the LAN can ping the server's VPN address, and running a ping from the server can access the LAN machines. HOWEVER, the server cannot ping clients connected to it, and clients cannot ping the LAN behind the server.

IP Addresses:
10.8.0.1 - the server IP for VPN
10.8.0.6 The client that cannot access LAN resources
192.168.1.137 - The server LAN IP
192.168.1.127 - the Lan Machine IP I am trying to access

Pertinent information:

server.conf:
port 1194
proto udp
dev tun0
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.1.0 255.255.255.0"
keepalive 10 120
user nobody
group nogroup
status openvpn-status.log
verb 3
daemon
management localhost 7505

tcpdump -i tun0 -vv

10.8.0.6 > 192.168.1.127: ICMP echo request, id 1, seq 141, length 40
14:15:54.148343 IP (tos 0x0, ttl 128, id 948, offset 0, flags [DF], proto TCP (6), length 52)
10.8.0.6.51325 > 192.168.1.1.1780: Flags [S], cksum 0xfcaa (correct), seq 3169516204, win 8192, options [mss 1369,nop,wscale 8,nop,nop,sackOK], length 0
14:15:56.746089 IP (tos 0x0, ttl 128, id 949, offset 0, flags [none], proto ICMP (1), length 60)

My linksys(cisco) router has a route in it that specifies 10.8.0.0 255.255.255.0 uses gateway 192.168.1.137 (the server).

Thanks in advance!

maikcat

did you enable ip forwarding on your server?
did you setup server firewall?
did you setup your lan pcs firewall?

Michael.

mconway

Thanks for the reply.

IP forwarding was enabled, I had also enabled every passthrough and forwarding rule I had come across online in ubuntu openvpn tuturials.

It turns out that there was 1 firewall rule that no one seemed to mention, which occurred to me once I set the firewall on the server to log to syslog - it turns out that the firewall was blocking traffic being forwarded to another port.

This fixed it.
iptables -I FORWARD -i eth0 -o tun0 -j ACCEPT

Thanks!