Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've setup TomatoVPN using these settings on the server: TAP UDP 1194

Client address pool 10.10.9.1 -10.10.9.254

LAN clients are configured with 10.10.10.x

I can connect from a remote client, but pinging anything in the 10.10.10.x results in a "Destination Host Unreachable" error.

Here's my client configuration script:

remote x.x.x.x 1194

client

dev tap0

proto udp

resolv-retry infinite

nobind

persist-key

persist-tun

float


ca ca.crt
cert client1.crt
key client1.key


ns-cert-type server

Any suggestions as how I can make this properly bridge the two networks?

share|improve this question
    
How are the ping replies supposed to get from the target machine to the local VPN endpoint? Does the default gateway on their network know to route them to the local VPN endpoint? –  David Schwartz Oct 9 '12 at 0:38
    
Based on your comment, I modified the "custom configuration" to add:--script-security 2 route-up "/sbin/route add -net 10.10.9.0 netmask 255.255.255.0 gw 10.10.10.251" but no luck :( –  David Hamilton Oct 9 '12 at 1:45
    
I don't think you understood my comment. How are the ping replies supposed to get from the target machine to the local VPN endpoint? (If the answer is that you have no idea, then there's no reason it should work. If there is some way this is supposed to work, explain it so we can tell you how it might go wrong.) The machine you are trying to ping has to know to send the replies to those pings to the local VPN endpoint (or to a router that will send them to the local VPN endpoint) -- otherwise, the replies will never get across the VPN. –  David Schwartz Oct 9 '12 at 2:04
    
I am assuming that I'm missing something on the client side -- that I need to add a route on the client to push all traffic for the 10.10.10.x subnet to the vpn connection, but I do not know how to do that. –  David Hamilton Oct 9 '12 at 2:25
    
That's correct. You need to do that as well. You need to tell the client to send traffic over the VPN if it's destination is on the other side of the VPN and you need to tell the target machine to send the reply traffic to the VPN endpoint. There are three ways you can do it: 1) Specific routes on each machine. 2) Routes on the routers that are already the machine's default gateway. 3) Some kind of dynamic routing protocol like RIP or OSPF. –  David Schwartz Oct 9 '12 at 2:27

1 Answer 1

up vote 0 down vote accepted

"I am assuming that I'm missing something on the client side -- that I need to add a route on the client to push all traffic for the 10.10.10.x subnet to the vpn connection, but I do not know how to do that"

You're missing something in the server side that, its the server that need to push the route to the client, so when the client connects it will learn it... or you could set it manually on the client yes, but there no need for that.

I don't know about TomatoVPN but in my tomato-usb, which also has OpenVPN I have the option:

"Push LAN to clients", which is the same has have the line:

push "route my.lan.sub.net 255.255.255.0"

Don't you have that option? If not just add the push route option to the server.conf.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.