Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a problem with openvpn. I have Ubuntu server and Windows client. The configuration file on server looks like:

dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
user nobody
group nogroup
verb 3
push "redirect-gateway def1"

And the config file on client machine:

dev tun
proto tcp
remote 1194
resolv-retry infinite
user nobody
group nogroup
ca ca.crt
cert marten.crt
key marten.key
verb 3

When I try to connect, everything seems to be ok. The client is connected and has an IP in the VPN range. The problem is that I'm not able to ping nor connect to the server or other clients. There is nothing suspicious in the log files. Can someone help me or provide me with working config files?

share|improve this question

migrated from Jul 27 '10 at 2:50

This question came from our site for professional and enthusiast programmers.

Maybe its: Your server is proto udp. Your client is proto tcp. – user199587 Feb 15 '13 at 18:08

I too had the same issue last week. It got fixed when I changed the line in the OpenVPN server configuration file from

push "redirect-gateway def1"


push "redirect-gateway def"
share|improve this answer

Seems you have answered your own question:

The client is connected and has an IP in the VPN range.

Normally, the VPN clients has it's own IP range, as in your configuration (10.8.x.x). You should set up the routing on the server, so, for example, the will be masqueraded to or whatever your local intranet range is...

share|improve this answer
Yah, I think that was mentioned in the question... "The client is connected and has an IP in the VPN range" and his client and server configs show this as well... – nicorellius Sep 7 '10 at 22:06

I am 100% sure it is your firewall, because the same exact thing happened to me. If you're connected then everything is fine. It is likely that the firewall is open only for the VPN and it is denying everything else.

share|improve this answer

Check the openvpn.log file on the on server. I found that if one of the 'push "route x.x.x.x"' lines has an invalid mask for the subnet an error will be thrown in the log file and the vpn won't operate at all. The error looks non-fatal but it does indeed appear to be fatal. Try nitially removing all push route lines and see if you can ping the server side of the vpn by default. Once you can do this add in your route push lines gain.


share|improve this answer

Do the following to clear all iptables rules:

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT

Then, try to ping from the client, once it's connected. If it works, your iptables rules are blocking. You need to add rules that allow traffic from tun0 on the server.

Also, note that any services will need to be listening on all IP addresses or to be reachable over the VPN.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .