OpenVPN - can connect but can't ping or access the server

Question

I have a problem with openvpn. I have Ubuntu server and Windows client. The configuration file on server looks like:

dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
user nobody
group nogroup
server 10.8.0.0 255.255.255.0
persist-key
persist-tun
verb 3
client-to-client
push "redirect-gateway def1"

And the config file on client machine:

dev tun
client
proto tcp
remote vpn.domain.com 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert marten.crt
key marten.key
verb 3

When I try to connect, everything seems to be ok. The client is connected and has an IP in the VPN range. The problem is that I'm not able to ping nor connect to the server or other clients. There is nothing suspicious in the log files. Can someone help me or provide me with working config files?

Answer 1

Seems you have answered your own question:

The client is connected and has an IP in the VPN range.

Normally, the VPN clients has it's own IP range, as in your configuration (10.8.x.x). You should set up the routing on the server, so, for example, the 10.8.0.1 will be masqueraded to 10.10.0.100 or whatever your local intranet range is...

Answer 2

Check the openvpn.log file on the on server. I found that if one of the 'push "route x.x.x.x 255.255.0.0"' lines has an invalid mask for the subnet an error will be thrown in the log file and the vpn won't operate at all. The error looks non-fatal but it does indeed appear to be fatal. Try nitially removing all push route lines and see if you can ping the server side of the vpn 10.8.0.1 by default. Once you can do this add in your route push lines gain.

-Chris

Answer 3

I am 100% sure it is your firewall, because the same exact thing happened to me. If you're connected then everything is fine. It is likely that the firewall is open only for the VPN and it is denying everything else.