Access lan behind OpenVPN client

[nieznany]

Hi, I have a problem in setting up VPN for my company.

The network look like this:
- three Windows 7 machines [pc1 (192.168.1.100), pc2 (dhcp), pc3 (dhcp)],
- windows 7 machines are behind Linksys router [192.168.1.1],
- server with Debian Lenny accessible through Internet (srv01).

srv01 run OpenVPN server.
pc1 run OpenVPN client..

I can ping pc1 -> srv01 so this works fine.

Now I wanted to others machines in office can access VPN through pc1.

I changed my config files see below and add this route to my router:
Destination LAN - 10.8.0.0
IP Subnet Mask - 255.255.255.0
Gateway - 192.168.1.100
Interface - LAN & Wireless

And I can't ping from others computers in lan to srv01.

Additionally some road warrior should also have access to office lan.

Here is my client config file

Code: Select all

dev tun
client
remote 94.124.5.34
proto udp
port 17003
nobind
ca cacert.pem
cert usercert.pem
key userkey.pem
comp-lzo
verb 3

Here is my server config file:

Code: Select all

local 94.124.5.34
port 17003
proto udp
dev tun

ca cacert.pem
cert openvpncert.pem
key openvpnkey.pem  # This file should be kept secret
dh dh1024.pem

server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
route 192.168.1.0 255.255.255.0

push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"

client-to-client

keepalive 10 120
comp-lzo

max-clients 20

persist-key
persist-tun

status openvpn-status.log

verb 3

For pc1 client I also defined file ccd/pc1:

Code: Select all

iroute 192.168.1.0 255.255.255.0

I appreciate any help.

Best regards,
Piotr Repetowski

[krzee]

Can they ping the vpn address of the local vpn node?
have you enabled ip forwarding on the local vpn node?
have you read my routing document at: http://www.secure-computing.net/wiki/in ... PN/Routing

Also, any time i run into issues finding a problem in a setup like this, the thing i do first after looking over my configs is break out the packet sniffers on every box in the routing chain and pinging everything i can from every box. Also, often it comes down to firewalls.

To sniff over a vpn, tell tcpdump/wireshark to use tun/tap interface