Can't route to private network once connected to VPN tunnel

Need help configuring your VPN? Just post here and you'll get that help.
Forum rules
Please use the [oconf] BB tag for openvpn Configurations. See viewtopic.php?f=30&t=21589 for an example.
Post Reply
mjones
OpenVpn Newbie
Posts: 2
Joined: Tue Oct 26, 2021 7:22 pm

Can't route to private network once connected to VPN tunnel

Post by mjones » Tue Oct 26, 2021 7:27 pm

Hi,

I'm trying to setup an OpenVPN server to allow tunnelling to a private network (192.168.0.0/16) but when my VPN client is connected it cannot reach hosts on this network. No firewall is currently setup for the network/all ports are open. The server running OpenVPN is assigned the IP 192.168.0.2 on the private network

server.conf

local 1.2.3.4
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
server-ipv6 fddd:1194:1194:1194::/64
push "redirect-gateway def1 ipv6 bypass-dhcp"
push "route 192.168.0.0 255.255.0.0"
push "dhcp-option DNS 10.8.0.1"
ifconfig-pool-persist ipp.txt
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
verb 3
crl-verify crl.pem
explicit-exit-notify


client.ovpn

client
dev tun
proto udp
remote 1.2.3.4 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
ignore-unknown-option block-outside-dns
block-outside-dns
verb 3
<ca>
REDACTED
</ca>
<cert>
REDACTED
</cert>
<key>
REDACTED
</key>
<tls-crypt>
REDACTED
</tls-crypt>


Client connected to the OpenVPN server can ping the OpenVPN gateway as well as using its IP on the other subnet. However it can't ping a different host on the same network...

Code: Select all

[26/10/21 19:58:32] user@client:~$ ping 10.8.0.1
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=27.3 ms
^C
--- 10.8.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 27.276/27.276/27.276/0.000 ms
[26/10/21 19:58:49] user@client:~$ ping 192.168.0.2
PING 192.168.0.2 (192.168.0.2) 56(84) bytes of data.
64 bytes from 192.168.0.2: icmp_seq=1 ttl=64 time=27.3 ms
^C
--- 192.168.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 27.271/27.271/27.271/0.000 ms
[26/10/21 19:58:52] user@client:~$ ping 192.168.0.3
PING 192.168.0.3 (192.168.0.3) 56(84) bytes of data.
^C
--- 192.168.0.3 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms
OpenVPN server can ping a different host on the same network...

Code: Select all

root@server:~# ping 192.168.0.3
PING 192.168.0.3 (192.168.0.3) 56(84) bytes of data.
64 bytes from 192.168.0.3: icmp_seq=1 ttl=63 time=1.26 ms
^C
--- 192.168.0.3 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.262/1.262/1.262/0.000 ms
OpenVPN server route table...

Code: Select all

root@server:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         172.31.1.1      0.0.0.0         UG    100    0        0 eth0
10.8.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0
172.31.1.1      0.0.0.0         255.255.255.255 UH    100    0        0 eth0
192.168.0.0     192.168.0.1     255.255.255.0   UG    0      0        0 ens10
192.168.0.1     0.0.0.0         255.255.255.255 UH    0      0        0 ens10
192.168.0.3 routing table...

Code: Select all

root@server:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         _gateway        0.0.0.0         UG    100    0        0 eth0
172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 docker0
_gateway        0.0.0.0         255.255.255.255 UH    100    0        0 eth0
192.168.0.0     192.168.0.1     255.255.0.0     UG    0      0        0 ens10
192.168.0.1     0.0.0.0         255.255.255.255 UH    0      0        0 ens10
Any help is appreciated.

Thanks.
Last edited by mjones on Wed Oct 27, 2021 8:48 am, edited 2 times in total.

User avatar
TinCanTech
Forum Team
Posts: 9942
Joined: Fri Jun 03, 2016 1:17 pm

Re: Can't route to private network once connected to VPN tunnel

Post by TinCanTech » Tue Oct 26, 2021 7:53 pm

https://community.openvpn.net/openvpn/w ... atesubnets

If you check your log file, you will find something like this:
Quoth The Source wrote:tun.c: msg(M_WARN, "NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.");

mjones
OpenVpn Newbie
Posts: 2
Joined: Tue Oct 26, 2021 7:22 pm

Re: Can't route to private network once connected to VPN tunnel

Post by mjones » Wed Oct 27, 2021 8:47 am

Thanks TinCanTech, I have changed the subnet to 10.66.0.0 but the issue remains. I believe it is to do with routing from hosts on the LAN back to the OpenVPN gateway.

300000
OpenVPN Expert
Posts: 639
Joined: Tue May 01, 2012 9:30 pm

Re: Can't route to private network once connected to VPN tunnel

Post by 300000 » Wed Oct 27, 2021 4:30 pm

You need to check NAT and ipforward at server. At the moment you only connect to virtual of openvpn as 10.66.0.1 but not real ip so at server need nat to make it work.

Post Reply