Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 0 down vote favorite

I can connect to the firewall but cannot get to the lan. The lan can ping the interface of the open vpn gateway. My workstation cannot ping the interface of the openvpn gateway. I tried setting a route on my workstation but no change. I have tried both UDP and TCP connections and have added explicit rules to the LAN interface.

share|improve this question

1 Answer

up vote 0 down vote

The "server-side" of OpenVPN creates a virtual network interface on that end, usually tun0. So, on the system that you are connecting to, that system will have an eth0, lo, and then a tun0.

However, if nothing on the "server-side" is telling that system to forward packets coming in from tun0 to anywhere else, it won't. Linux systems are usually not set to "promiscuously route" by default.

If you are the one operating OpenVPN on the "server-side," you need to look into setting up basic routing, first by echo 1 > /proc/sys/net/ipv4/ip_forward (I think), and then setting it up some basic firewall/access control rules with iptables since, after all, you just turned that machine into a router. This must be done if you want to reach hosts other than the one the openvpn instance is running on. Alternatively you can cobble up some quick "static port address translation" with rinetd, nc or similar tools.

Again, all this must be done on the "server-side." You can't do anything on your end, the "client" end.

share|improve this answer
There is the 'push' server configuration directive that will do that very easily, assuming that is what the problem is. Also, how do you know he's using Linux? – paradroid Mar 15 '12 at 19:40
This is the standalone version of pfsense. Not sure if that is an option. I can't find any info on doing that. – Sean Kennedy Mar 15 '12 at 19:48
its running on FreeBSD – Sean Kennedy Mar 15 '12 at 19:50
I went ahead and made this addition to the sysctl.conf net.ipv4.ip_forward = 1 and rebooted. Behavior didn't change – Sean Kennedy Mar 15 '12 at 20:00
The push server configuration will push routes to the client. On the server side, you need to set up routing manually. I've never set up routing on FreeBSD, but you might need to do more than the sysctl you did. – ultrasawblade Mar 15 '12 at 20:17
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.