OpenVPN Bridge... Clients cant ping server or network

ligerous · 05-14-2008, 11:41 PM

Hey everyone,
What I am trying to do is configure OpenVPN in Bridge Mode so I can allow clients to connect to play LAN games over the internet and access files on machines on my network from the internet. I would also like all clients to be able to access the internet through the VPN Connection.

I used the script to bridge from OpenVPN to bridge eth0 (192.168.1.151) with tap0 (192.168.10.1).... ifconfig verifies this.

So far I can get the clients to connect to the OpenVPN server but the clients are unable to access the OpenVPN server or any other servers on the Local network for ping or even just file sharing.

IP Address of the local network: 192.168.1.x
IP Address for the Physical Ethernet Card in the OpenVPN Server: 192.168.1.151
IP Address of the OpenVPN Server: 192.168.10.1
IP Address pool for OpenVPN Clients: 192.168.10.2-192.168.1.12
The OpenVPN Server is running on Fedora 8 OS.

Here is my server config:

Code:

port 1195
proto udp
dev tap0
ca keys/ca.crt
cert keys/server.crt
key keys/server.key
dh keys/dh1024.pem
server 192.168.10.0 255.255.255.128
;mode server
tls-server
client-to-client
keepalive 10 120
comp-lzo
max-clients 10
persist-key
persist-tun
status openvpn-status.log
verb 3
push "redirect-gatway def1"
push "dhcp-option DNS 68.105.28.12"

Client Config:

Code:

client
dev tap
proto udp
remote My IP Address 1195
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
comp-lzo
verb 3

Am I missing something in the configuration file or forgetting to do something? I have been trying for a week to get this to work with no luck

TIA

rtspitz · 05-24-2008, 06:59 PM

so you want to span _one_ subnet over 2 physically separated sites right ?

site A (subnet 1) .............server A ---------internet------------ server B ..... site B (subnet 1)

or just let single clients from somewhere gain access to your 192.168.1.x network ?

I think bridged setup only makes sense if all ips are in the same subnet and thus avoid having to set additional routing tables. you should have a look at the routing tables and try which hosts can be pinged from where.