Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I tried this solution but it didn't work. Basically, I can connect to my remote network via OpenVPN, but only to one IP on the network. For server-based connections, I employed port forwarding via ssh. This worked and I gained access to some resources but I still cannot connect to some network shares to which I need access.

Any ideas/hints/work-arounds?

EDIT - Here are the configs:


dev tun
proto udp
remote 1194
resolv-retry infinite
ca ca.crt
cert cert.crt
key key.key
verb 3


port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
keepalive 10 120
user nobody
group nogroup
status openvpn-status.log
verb 3

I should note that this configuration has worked for many months. It still works (sort of) in that I can access through the VPN tunnel the server where the VPN is running. I just cannot access the other IPs on the network without work-arounds (this is the new behavior).

The only thing I can think of that has changed is that I reconfigured a Drobo on the same network with samba.

EDIT 2 - Here is some more info on the network setup for this situation:

Where I sit is a local network:

Where I work is another local network:

VPN network:

On the network, there are a couple servers (one of which is the OpenVPN server) and a couple network shares to which I need access. Using ssh port forwarding I can connect to the WRT router ( - which has a port forward for the VPN, through port 1194) and another CRM server I need: The machine running VPN ( is the only accessible IP when I use my existing VPN configuration (see above) that, previously, worked well (this means, I had access to all networks shares, all servers, all local shared machines on the network).

One of the network shares sits on The Drobo I discussed earlier sits on the CRM server ( The Drobo used to be a DroboShare, with its own IP ( This was recently changed. I can mount the network shares discussed here on to (since I can access this machine vis ssh), so technically I have access to everything I need. The problem is, it's is cumbersome to do it this way, especially since I was used to a VPN working as it should.

Hopefully this edit makes things more clear.

share|improve this question
Do you administer the VPN? We'll need some more configuration specifics to solve this. Namely, is a routed VPN, what routes are pushed, and is the client-to-client directive included? At a minimum these are required to be able to talk between VPN clients. – imoatama Sep 16 '10 at 0:30
Yes. Configs to follow... – nicorellius Sep 16 '10 at 17:03
Are the machines you're trying to reach on the VPN subnet? If so you'll need to include the client-to-client server directive. I they're not on the VPN subnet but are instead connected to the server via a physical LAN with eg subnet you'll need to add a push "route" directive to the server config. – imoatama Sep 17 '10 at 1:51
When you say the configuration worked for several months, was that with or without tunnelling through the server? You seem to imply that not even tunnneling works for you now for some services. – imoatama Sep 17 '10 at 1:53
The EDIT 2 above should clear up the network(s) configuration. @ imoatama - I don't think I need a client-to-client directive. But perhaps a push "route". – nicorellius Sep 17 '10 at 16:30
up vote 1 down vote accepted

My guess is that the other machines on your network don't know how to route to the IP range that the OpenVPN clients are using (in your case, If the box running the OpenVPN server is not also the default router, then the network hosts are probably sending their packets to 10.8.0.x to the router instead of the OpenVPN server.

The easiest workaround is to add a static route on your router for where the gateway is your OpenVPN server's LAN IP address. If that's not possible, you can also add the same static route to each server or host that the clients need to talk to.

It's also possible to configure OpenVPN to work in a bridged mode, such that the clients appear to be on the same LAN subnet as the OpenVPN server. This is trickier to set up; on Linux you need to create a tap interface and bridge it to an ethernet interface.

share|improve this answer
Your suggestions are very good. I have used bridged mode before. I have a pfSense firewall setup on my local ( network). I ended up not using this mode ultimately, but I see how this may work. My main issue is why in the heck was it working and then not, just because I added a network share to a samba configuration? – nicorellius Sep 17 '10 at 16:32
Thanks for the answer – nicorellius Sep 21 '10 at 22:32

Depending on the VPN design, you'll probably need to include the following server config directives:

  • server
  • dev tun
  • push route <network>
  • client-to-client (this will depent on architecture - it's needed if everyone connects to the server via the VPN, rather than the server being on the same network as some machines with other gaining access to them via the VPN)

There are lots of places this could be going wrong eg

  • No route being pushed for the address(es) of the servers
  • Servers are only connected to VPN server via VPN as opposed to physical LAN, and client-to-client is not turned on
  • Obscure bugs in OpenVPN (hopefully not this one!)

Can you post (redacted) copies of your server and client config files? Otherwise can you give us a basic idea of the network architecture?

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .