OpenVPN - can connect but can't ping or access the server

Question

I have a problem with openvpn. I have Ubuntu server and Windows client. The configuration file on server looks like:

dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
user nobody
group nogroup
server 10.8.0.0 255.255.255.0
persist-key
persist-tun
verb 3
client-to-client
push "redirect-gateway def1"

And the config file on client machine:

dev tun
client
proto tcp
remote vpn.domain.com 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert marten.crt
key marten.key
verb 3

When I try to connect, everything seems to be ok. The client is connected and has an IP in the VPN range. The problem is that I'm not able to ping nor connect to the server or other clients. There is nothing suspicious in the log files. Can someone help me or provide me with working config files?

Answer 1

I too had the same issue last week. It got fixed when I changed the line in the OpenVPN server configuration file from

push "redirect-gateway def1"

to

push "redirect-gateway def"

Answer 2

Seems you have answered your own question:

The client is connected and has an IP in the VPN range.

Normally, the VPN clients has it's own IP range, as in your configuration (10.8.x.x). You should set up the routing on the server, so, for example, the 10.8.0.1 will be masqueraded to 10.10.0.100 or whatever your local intranet range is...

Answer 3

I am 100% sure it is your firewall, because the same exact thing happened to me. If you're connected then everything is fine. It is likely that the firewall is open only for the VPN and it is denying everything else.

Answer 4

While changing def1 to def worked (because now the option doesn't do anything), in my case the fix was to uncomment topology subnet:

# Network topology
# Should be subnet (addressing via IP)
# unless Windows clients v2.0.9 and lower have to
# be supported (then net30, i.e. a /30 per client)
# Defaults to net30 (not recommended)
topology subnet

Note that it says the default is net30, and the recommendation is subnet.

Answer 5

Check the openvpn.log file on the on server. I found that if one of the 'push "route x.x.x.x 255.255.0.0"' lines has an invalid mask for the subnet an error will be thrown in the log file and the vpn won't operate at all. The error looks non-fatal but it does indeed appear to be fatal. Try nitially removing all push route lines and see if you can ping the server side of the vpn 10.8.0.1 by default. Once you can do this add in your route push lines gain.

-Chris

Answer 6

Do the following to clear all iptables rules:

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

Then, try to ping 10.8.0.1 from the client, once it's connected. If it works, your iptables rules are blocking. You need to add rules that allow traffic from tun0 on the server.

Also, note that any services will need to be listening on all IP addresses or 10.8.0.1 to be reachable over the VPN.

Answer 7

Had the same issue, however linux -> linux. After I enabled lzo compression on client worked. You may also try to comment comp-lzo line on server.

Answer 8

Always check the firewalls ! I was caught out for days by windows 10 firewall. Whilst I opened all the windows, router, modem, linux firewall ports and could get an openvpn connection, I could only ping one way from a windows 10 server to a public Linux client, and not from client to server. Only after a lunchtime chat with an expert colleague (thanks Tony!) did I learn that windows 10 firewall blocks ping requests from public networks by default. To unblock go into windows 10 firewall advanced settings and enable

File and Printer Sharing (Echo Request - ICMPv4-In)

solved my problem immediately, so I post here incase anyone else gets caught out !