Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 0 down vote favorite

I have setup a PPTP server on a CentOS 6 box.
Several clients (Windows and Linux) connect to this server.
All clients use the same subnet.
All clients (Win or Lin) can surf the Internet using the VPN successfully.
Windows clients can ping any other Windows client (XP/Vista/7) connected to VPN.
Linux clients (KVPNC) can ping any Windows client (XP/Vista/7) connected to VPN.

So far so good. But there's this weird problem and I've been trying to figure it out with no luck:
No client can ping (reach) a Linux client (successfully) connected to VPN. And yes, the firewall is completely disabled.

I'd really appreciate any hint/idea. TIA,

EDIT: The ultimate goal of this is to share services across the VPN, like accessing a HTTPD running on a Linux box from a Windows client.

share|improve this question
Is ping response enabled on the Linux clients, i.e. what is the output of sysctl net.ipv4.icmp_echo_ignore_all? – lupincho Dec 8 '12 at 18:51
@lupincho net.ipv4.icmp_echo_ignore_all = 0 As you may have guessed my main goal is to able to reach some services (like httpd or Tomcat) running on Linux box across the VPN. So the ping problem just denotes that the Linux boxes are not reachable at all. – Bahman M. Dec 9 '12 at 4:35

1 Answer

up vote 1 down vote accepted

On the VPN SERVER, following need to be done:

Enable tcp/ip forwarding

Linux TCP/IP stack by default does not forward packets (either between interfaces or re-routing them between IP network). It has to be enabled

echo 1 > /proc/sys/net/ipv4/ip_forward

Without that, VPN server will accept VPN client packet locally, and route client packet according to NAT rule, but will not route traffic to local network, which include other vPN client.

Iptables

Iptables block all traffic by default. You need rules to allow traffic to get through.

$IPTABLES -A FORWARD -s 192.168.1.0/24 -d 192.168.1.0/24 -j ACCEPT

Change 192.168.1.0/24 to match your vpn network ip addresses. That will allow traffic between your vpn network machines.

/etc/pptp.conf

When vpn client need to talk to each together, the vpn server is acting as a routing point and need to be on the same netowrk.

localip 192.168.1.1
remoteip 192.168.1.2-254

Modify the above according to your network setup.

share|improve this answer
Thanks but I don't get the iptables part. Do you mean I should add that FORWARD rule on the server or on Linux clients? – Bahman M. Dec 11 '12 at 8:56
yes, you can try it from commsnd promt 1st. – John Siu Dec 11 '12 at 13:17
Thanks a lot! Works like a charm! – Bahman M. Dec 11 '12 at 15:08
Oops! My mistake! It didn't work :-S I added the rule to client iptables and it's still the same. – Bahman M. Dec 11 '12 at 15:24
Both tcp/ip forward and iptables rule are to be applied on the vpn server, not the client. – John Siu Dec 11 '12 at 15:36
show 7 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.