-1

I have installed SSL OpenVPN on CentOS 8.  The client connects successfully and is able to ping the remote LAN but unable to access web server on remote LAN.  Here is my configuration:

Server

port 1194
proto udp
dev tun
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/My.crt
key /etc/openvpn/server/My.key
dh /etc/openvpn/server/dh.pem
server 10.8.0.0 255.255.255.0
#push "redirect-gateway def1"
push "route 200.200.200.0 255.255.255.0"

push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
duplicate-cn
cipher AES-256-CBC
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-    RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256
auth SHA512
auth-nocache
keepalive 20 60
persist-key
persist-tun
compress lz4
daemon
user nobody
group nobody
log-append /var/log/openvpn.log
verb 3

Client

client
dev tun
proto udp
remote my-public-ip 1194
ca ca.crt
cert client.crt
key client.key
cipher AES-256-CBC
auth SHA512
auth-nocache
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-   RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256
resolv-retry infinite
compress lz4
nobind
persist-key
persist-tun
mute-replay-warnings
verb 3

IP Routes

default via 200.200.200.1 dev eno1 proto dhcp metric 100 
10.8.0.0/24 via 10.8.0.2 dev tun0 
10.8.0.2 dev tun0 proto kernel scope link src 10.8.0.1 
200.200.200.0/24 dev eno1 proto kernel scope link src 200.200.200.3 metric 100 
192.168.122.0/24 dev virbr0 proto kernel scope link src 192.168.122.1 linkdown 
2
1

If I understand correctly you are trying to get a client to access a web-server like this:

(Client) --- VPN --> (VPN Server) --- LAN ---> (Webserver)

Suspect your problem is that IPv4 forwarding is not enabled or there is a firewall rule blocking the packets. Of the two IPv4 packet forwarding is the more common problem.

Note that "pinging the lan" might still work if you are pinging the VPN server's LAN IP since those packets don't need to be forwarded to another machine.


At the command line type:

sysctl net.ipv4.ip_forward

If this is set to net.ipv4.ip_forward = 0 then you will need to enable it. Edit /etc/sysctl.conf and find the matching line and edit it to say (remove any #):

net.ipv4.ip_forward = 1

Then at the command line type:

sysctl --system

If it's not that then I'd next look at your iptables (firewall) settings:

iptables -L
1
  • Thank you for your response i have tried everything what you recomend however the here is below the iptables i think the problem in iptables iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination – Rizwan Saleem Feb 11 at 12:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.