0

I can connect to the firewall but cannot get to the lan. The lan can ping the interface of the open vpn gateway. My workstation cannot ping the interface of the openvpn gateway. I tried setting a route on my workstation but no change. I have tried both UDP and TCP connections and have added explicit rules to the LAN interface.

0

1 Answer 1

0

The "server-side" of OpenVPN creates a virtual network interface on that end, usually tun0. So, on the system that you are connecting to, that system will have an eth0, lo, and then a tun0.

However, if nothing on the "server-side" is telling that system to forward packets coming in from tun0 to anywhere else, it won't. Linux systems are usually not set to "promiscuously route" by default.

If you are the one operating OpenVPN on the "server-side," you need to look into setting up basic routing, first by echo 1 > /proc/sys/net/ipv4/ip_forward (I think), and then setting it up some basic firewall/access control rules with iptables since, after all, you just turned that machine into a router. This must be done if you want to reach hosts other than the one the openvpn instance is running on. Alternatively you can cobble up some quick "static port address translation" with rinetd, nc or similar tools.

Again, all this must be done on the "server-side." You can't do anything on your end, the "client" end.

8
  • There is the 'push' server configuration directive that will do that very easily, assuming that is what the problem is. Also, how do you know he's using Linux?
    – paradroid
    Mar 15, 2012 at 19:40
  • This is the standalone version of pfsense. Not sure if that is an option. I can't find any info on doing that. Mar 15, 2012 at 19:48
  • its running on FreeBSD Mar 15, 2012 at 19:50
  • I went ahead and made this addition to the sysctl.conf net.ipv4.ip_forward = 1 and rebooted. Behavior didn't change Mar 15, 2012 at 20:00
  • The push server configuration will push routes to the client. On the server side, you need to set up routing manually. I've never set up routing on FreeBSD, but you might need to do more than the sysctl you did.
    – LawrenceC
    Mar 15, 2012 at 20:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .