0

This is basically the problem here but reversed. I have a remote OpenVPN client which connects to my server and registers itself with the address 10.1.0.29. This address is easily accessible from the server, whether through ping, ssh, or the apache web server. However, other machines on the local network of the server cannot access this 10.1.0.29 address in any way.

What could be the issue? The OpenVPN server does have ip_forwarding turned on, and the system works fine when the OpenVPN client is on the same LAN as the OpenVPN server. But as soon as the OpenVPN client is on a remote connection, it is not accessible to any machines on the ovpn server's LAN, only to the server itself.

See photo below: the packet is arriving to server and then even being retransmitted: enter image description here

UPDATE: The client is receiving the packet too, it just refuses to acknowledge or do anything with it.

Routing options on client: enter image description here

8
  • Did you configure your network to route the traffic to 10.1.0.29 over your server? If your router doesn't know about the fact that the device is only reachable over your openvpn server, it won't be able to deliver any packages to it. Jul 27, 2022 at 20:04
  • Yes, my router routes all packets of the subnet 10.1.0.0/16 over to the OVPN server. On Wireshark I can see these packets arriving at my OVPN server, and then a packet from OVPN server to the OVPN client is sent.
    – Cheetaiean
    Jul 27, 2022 at 20:15
  • I have added a wireshark photo for clarity, where 192.168.1.31 is my OVPN server
    – Cheetaiean
    Jul 27, 2022 at 20:17
  • It is being retransmitted because the destination did not acknowledge that it received the package. So it got lost somewhere on the way. Did you configure your server to route the packages correctly? Jul 27, 2022 at 20:38
  • 1

1 Answer 1

0

On the CLIENT machine, using route -n, make sure the local network addresses you want to connect to the client machine from, are being routed through your OpenVPN tun0 gateway. In my case, as the gateway was 10.1.8.29, a simple ip route add 192.168.1.134 via 10.1.8.29 sufficed to allow access.

More holistically, a route 192.168.1.0 255.255.255.0 10.1.8.29 in the client.conf file on the client machine does the trick for any device in my server's local network.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .