OpenVPN cannot connect to remote network behind server

csweden · 08-31-2008, 12:44 AM

My OpenVPN client connects fine. I can reach the VPN Server on both the OpenVPN TUN interface and eth0. The router on eth0 192.168.1.1 is aware of the network for OpenVPN (172.16.0.0/24). It forwards all traffic to the OpenVPN server. The OpenVPN server has no firewall and has IPV4 forwarding enabled. TCPDUMP on both the client and the server shows a ping request but no response.

Any ideas?

jschiwal · 08-31-2008, 04:27 AM

Here is the openvpn's howto: http://openvpn.net/howto.html#vpntype

They recommend starting openvpn from the command line instead of a service before the ping test.

Code:

To simplify troubleshooting, it's best to initially start the OpenVPN server from the command line (or right-click on the .ovpn file on Windows), rather than start it as a daemon or service:

    openvpn [server config file] 

A normal server startup should look like this (output will vary across platforms):

    Sun Feb  6 20:46:38 2005 OpenVPN 2.0_rc12 i686-suse-linux [SSL] [LZO] [EPOLL] built on Feb  5 2005
    Sun Feb  6 20:46:38 2005 Diffie-Hellman initialized with 1024 bit key
    Sun Feb  6 20:46:38 2005 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
    Sun Feb  6 20:46:38 2005 TUN/TAP device tun1 opened
    Sun Feb  6 20:46:38 2005 /sbin/ifconfig tun1 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
    Sun Feb  6 20:46:38 2005 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
    Sun Feb  6 20:46:38 2005 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:23 ET:0 EL:0 AF:3/1 ]
    Sun Feb  6 20:46:38 2005 UDPv4 link local (bound): [undef]:1194
    Sun Feb  6 20:46:38 2005 UDPv4 link remote: [undef]
    Sun Feb  6 20:46:38 2005 MULTI: multi_init called, r=256 v=256
    Sun Feb  6 20:46:38 2005 IFCONFIG POOL: base=10.8.0.4 size=62
    Sun Feb  6 20:46:38 2005 IFCONFIG POOL LIST
    Sun Feb  6 20:46:38 2005 Initialization Sequence Completed

Pay particular attention to http://openvpn.net/bridge.html. Since you are using a bridge instead of routing subnets, look at the part where the tun config line is commented out and the comment is removed from the "tap" line when setting up the interface.