I have OpenVPN server and client. Server parameters: virtual VPN IP 10.1.1.1 Internet interface is eth0 with IP 192.168.0.2/24 Local network interface is usb0 with IP 10.0.0.1/24 Behind the server I have one Ubuntu machine with IP 10.0.0.2/24 Client parameters: virtual VPN IP 10.1.1.10 (is obtained after clients start) Internet interface is eth0 with IP 192.168.0.1/24 Local netwotk interface is usb0 with IP 192.168.4.1/24 Behind the client is one Windows XP machine with IP 192.168.4.2/24 I CAN'T ping neither 192.168.4.1 interface nor 192.168.4.2 interface from VPN server machine and from server subnet machine (Ubuntu machine). In the same time I can ping from server machine VPN client interface by 10.1.1.10 IP. Also I can ping 10.0.0.1 interface and Ubuntu machine by 10.0.0.2 IP from VPN client machine and from client subnet machine (Windows XP). Can you give me advice where are misstakes in my configurations? Server config: [color=#FF0000]ifconfig 10.1.1.1 10.1.1.2 port 1194 proto udp dev tun ca ca.crt cert server.crt key server.key dh dh1024.pem server 10.1.1.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "route 10.0.0.0 255.255.255.0" push "redirect-gateway def1" client-config-dir ccd route 192.168.4.0 255.255.255.0 keepalive 10 120 comp-lzo status /etc/openvpn/openvpn-status.log log /etc/openvpn/openvpn.log verb 4 [/color] Client config: [color=#FF0000]ifconfig 10.1.1.2 10.1.1.1 client pull dev tun proto udp remote 192.168.0.2 1194 resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert client.crt key client.key ns-cert-type server comp-lzo verb 3 log /etc/openvpn/client.log route 10.0.0.0 255.255.255.0[/color] There is server routing table: [color=#0000FF]Destination Gateway Genmask Flags Metric Ref Use Iface 10.1.1.2 * 255.255.255.255 UH 0 0 0 tun0 192.168.4.0 10.1.1.2 255.255.255.0 UG 0 0 0 tun0 10.0.0.0 * 255.255.255.0 U 0 0 0 usb0 192.168.0.0 * 255.255.255.0 U 0 0 0 eth0 10.1.1.0 10.1.1.2 255.255.255.0 UG 0 0 0 tun0[/color] There is client routing table: [color=#0000FF]Destination Gateway Genmask Flags Metric Ref Use Iface 10.1.1.9 * 255.255.255.255 UH 0 0 0 tun0 10.1.1.1 10.1.1.9 255.255.255.255 UGH 0 0 0 tun0 192.168.4.0 * 255.255.255.0 U 0 0 0 usb0 10.0.0.0 10.1.1.9 255.255.255.0 UG 0 0 0 tun0 192.168.0.0 * 255.255.255.0 U 0 0 0 eth0[/color] Also I represent iptables rules. This rules are little redundant because of default polycies are ACCEPT. But NATing as I understand is correct. For server: [color=#BF8000]*nat :PREROUTING ACCEPT [8:500] :POSTROUTING ACCEPT [5:372] :OUTPUT ACCEPT [3:252] -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE -A POSTROUTING -s 10.0.0.0/24 -o tun0 -j MASQUERADE COMMIT # Completed on Thu Feb 16 19:09:57 2012 # Generated by iptables-save v1.4.9.1 on Thu Feb 16 19:09:57 2012 *mangle :PREROUTING ACCEPT [3019:273710] :INPUT ACCEPT [2884:259320] :FORWARD ACCEPT [49:3276] :OUTPUT ACCEPT [2877:263569] :POSTROUTING ACCEPT [2988:278502] COMMIT # Completed on Thu Feb 16 19:09:57 2012 # Generated by iptables-save v1.4.9.1 on Thu Feb 16 19:09:57 2012 *filter :INPUT ACCEPT [231:19524] :FORWARD ACCEPT [4:240] :OUTPUT ACCEPT [231:20985] -A INPUT -i lo -j ACCEPT -A FORWARD -i usb0 -o tun+ -j ACCEPT -A FORWARD -i tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT [/color] For client: [color=#BF8000]*nat :PREROUTING ACCEPT [15:1796] :POSTROUTING ACCEPT [12:788] :OUTPUT ACCEPT [12:788] -A POSTROUTING -s 192.168.4.0/24 -o eth0 -j MASQUERADE -A POSTROUTING -s 192.168.4.0/24 -o tun0 -j MASQUERADE COMMIT # Completed on Thu Feb 16 15:53:30 2012 # Generated by iptables-save v1.4.9.1 on Thu Feb 16 15:53:30 2012 *mangle :PREROUTING ACCEPT [1496:152526] :INPUT ACCEPT [1372:141157] :FORWARD ACCEPT [71:4680] :OUTPUT ACCEPT [1338:129281] :POSTROUTING ACCEPT [1548:161276] COMMIT # Completed on Thu Feb 16 15:53:30 2012 # Generated by iptables-save v1.4.9.1 on Thu Feb 16 15:53:30 2012 *filter :INPUT ACCEPT [408:38367] :FORWARD ACCEPT [26:1672] :OUTPUT ACCEPT [414:35164] -A INPUT -i lo -j ACCEPT -A FORWARD -i usb0 -o eth0 -j ACCEPT -A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT [/color]

can't ping subnets over VPN

piphonom

I have OpenVPN server and client.
Server parameters:
virtual VPN IP 10.1.1.1
Internet interface is eth0 with IP 192.168.0.2/24
Local network interface is usb0 with IP 10.0.0.1/24
Behind the server I have one Ubuntu machine with IP 10.0.0.2/24

Client parameters:
virtual VPN IP 10.1.1.10 (is obtained after clients start)
Internet interface is eth0 with IP 192.168.0.1/24
Local netwotk interface is usb0 with IP 192.168.4.1/24
Behind the client is one Windows XP machine with IP 192.168.4.2/24

I CAN'T ping neither 192.168.4.1 interface nor 192.168.4.2 interface from VPN server machine and from server subnet machine (Ubuntu machine). In the same time I can ping from server machine VPN client interface by 10.1.1.10 IP. Also I can ping 10.0.0.1 interface and Ubuntu machine by 10.0.0.2 IP from VPN client machine and from client subnet machine (Windows XP).

Can you give me advice where are misstakes in my configurations?

Server config:
ifconfig 10.1.1.1 10.1.1.2
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.1.1.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.0.0.0 255.255.255.0"
push "redirect-gateway def1"
client-config-dir ccd
route 192.168.4.0 255.255.255.0
keepalive 10 120
comp-lzo
status /etc/openvpn/openvpn-status.log
log /etc/openvpn/openvpn.log
verb 4

Client config:
ifconfig 10.1.1.2 10.1.1.1
client
pull
dev tun
proto udp
remote 192.168.0.2 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
comp-lzo
verb 3
log /etc/openvpn/client.log
route 10.0.0.0 255.255.255.0

There is server routing table:
Destination Gateway Genmask Flags Metric Ref Use Iface
10.1.1.2 * 255.255.255.255 UH 0 0 0 tun0
192.168.4.0 10.1.1.2 255.255.255.0 UG 0 0 0 tun0
10.0.0.0 * 255.255.255.0 U 0 0 0 usb0
192.168.0.0 * 255.255.255.0 U 0 0 0 eth0
10.1.1.0 10.1.1.2 255.255.255.0 UG 0 0 0 tun0

There is client routing table:
Destination Gateway Genmask Flags Metric Ref Use Iface
10.1.1.9 * 255.255.255.255 UH 0 0 0 tun0
10.1.1.1 10.1.1.9 255.255.255.255 UGH 0 0 0 tun0
192.168.4.0 * 255.255.255.0 U 0 0 0 usb0
10.0.0.0 10.1.1.9 255.255.255.0 UG 0 0 0 tun0
192.168.0.0 * 255.255.255.0 U 0 0 0 eth0

Also I represent iptables rules. This rules are little redundant because of default polycies are ACCEPT. But NATing as I understand is correct. For server:
*nat
😛REROUTING ACCEPT [8:500]
😛OSTROUTING ACCEPT [5:372]
:OUTPUT ACCEPT [3:252]
-A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.0.0.0/24 -o tun0 -j MASQUERADE
COMMIT
# Completed on Thu Feb 16 19:09:57 2012
# Generated by iptables-save v1.4.9.1 on Thu Feb 16 19:09:57 2012
*mangle
😛REROUTING ACCEPT [3019:273710]
:INPUT ACCEPT [2884:259320]
:FORWARD ACCEPT [49:3276]
:OUTPUT ACCEPT [2877:263569]
😛OSTROUTING ACCEPT [2988:278502]
COMMIT
# Completed on Thu Feb 16 19:09:57 2012
# Generated by iptables-save v1.4.9.1 on Thu Feb 16 19:09:57 2012
*filter
:INPUT ACCEPT [231:19524]
:FORWARD ACCEPT [4:240]
:OUTPUT ACCEPT [231:20985]
-A INPUT -i lo -j ACCEPT
-A FORWARD -i usb0 -o tun+ -j ACCEPT
-A FORWARD -i tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT

For client:
*nat
😛REROUTING ACCEPT [15:1796]
😛OSTROUTING ACCEPT [12:788]
:OUTPUT ACCEPT [12:788]
-A POSTROUTING -s 192.168.4.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 192.168.4.0/24 -o tun0 -j MASQUERADE
COMMIT
# Completed on Thu Feb 16 15:53:30 2012
# Generated by iptables-save v1.4.9.1 on Thu Feb 16 15:53:30 2012
*mangle
😛REROUTING ACCEPT [1496:152526]
:INPUT ACCEPT [1372:141157]
:FORWARD ACCEPT [71:4680]
:OUTPUT ACCEPT [1338:129281]
😛OSTROUTING ACCEPT [1548:161276]
COMMIT
# Completed on Thu Feb 16 15:53:30 2012
# Generated by iptables-save v1.4.9.1 on Thu Feb 16 15:53:30 2012
*filter
:INPUT ACCEPT [408:38367]
:FORWARD ACCEPT [26:1672]
:OUTPUT ACCEPT [414:35164]
-A INPUT -i lo -j ACCEPT
-A FORWARD -i usb0 -o eth0 -j ACCEPT
-A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT

maikcat

hi there,

you cant use ifconfig & server statement on your server config,

there are 2 approaches on your setup

1) use this server config

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.1.1.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.0.0.0 255.255.255.0"
client-config-dir ccd
route 192.168.4.0 255.255.255.0
keepalive 10 120
comp-lzo
status /etc/openvpn/openvpn-status.log
log /etc/openvpn/openvpn.log
verb 4

client config

client
dev tun
proto udp
remote 192.168.0.2 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
comp-lzo
verb 3
log /etc/openvpn/client.log

also you need to create a ccd file named client with the following contents:

iroute 192.168.4.0 255.255.255.0

2)

server config

ifconfig 10.1.1.1 10.1.1.2
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
route 192.168.4.0 255.255.255.0
keepalive 10 120
comp-lzo
status /etc/openvpn/openvpn-status.log
log /etc/openvpn/openvpn.log
verb 4

client config

ifconfig 10.1.1.2 10.1.1.1
client
dev tun
proto udp
remote 192.168.0.2 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
comp-lzo
verb 3
log /etc/openvpn/client.log
route 10.0.0.0 255.255.255.0

Michael.