0

I have a server which has an OpenVPN client installed and which is connecting to the internet, via the tunnel, just fine. I can also reach the server on the LAN interface (192.168.1.x). However when I try to access the same server from another IP range 10.8.0.x in the LAN it does not work. When I shutdown the VPNClient it again works fine.

Without the VPN client running on the server clients in the 10.8.0.x range can reach the server

root@server:~# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use 
Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    100    0        0 
enp0s31f6
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 
enp0s31f6
192.168.0.0     0.0.0.0         255.255.0.0     U     100    0        0 
enp0s31f6

With the VPN client running on the server clients in the 10.8.0.x range can NOT reach the server

root@server:~# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.23.10.5      128.0.0.0       UG    0      0        0 tun0
0.0.0.0         192.168.1.1     0.0.0.0         UG    100    0        0 enp0s31f6
10.23.10.1      10.23.10.5      255.255.255.255 UGH   0      0        0 tun0
10.23.10.5      0.0.0.0         255.255.255.255 UH    0      0        0 tun0
46.166.188.211  192.168.1.1     255.255.255.255 UGH   0      0        0 enp0s31f6
128.0.0.0       10.23.10.5      128.0.0.0       UG    0      0        0 tun0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 enp0s31f6
192.168.0.0     0.0.0.0         255.255.0.0     U     100    0        0 enp0s31f6

I also tried to add a route for the submit to explicitly tell the network to route 10.8.0.0 traffic over the enp0s31f6 interface.

root@server:~# route add -net 10.8.0.0 netmask 255.255.0.0 dev enp0s31f6

However no luck.

Anyone have an idea why this is?

  • 1
    You should not use route any more. Your command line does not contain the gateway address: ip route add 10.0.0.0/16 via 192.168.1.1 (after removing your manual entry) – Hauke Laging Aug 20 '17 at 17:36
0

You should not have to manually add any routes for the subnet associated with your VPN tun interface. The client should be setting that up for you. Also, adding a route on your Ethernet interface for the tun interface will not work due to the way openvpn routes packets.

It seems you should enable client-to-client in your server config and make sure you have an iptables rule:

iptables -A INPUT -i tun0 -s 10.8.0.0/24 -d 10.8.0.0/24 -j ACCEPT
  • That is not the problem. The problem is that that the VPN configuration may create routing conflicts as it natually doesn not know anything about the local situation. – Hauke Laging Aug 20 '17 at 20:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.