Member Avatar for williebens

Hello Team:

I am trying to access a private network. I have openvpn running on a Linux box, and I would like to access the LAN behind that box. I can establish and ping the vpn tunnel, but I cannot ping any of the boxes behind the openvpn. The network behind the vpn is 192.168.1.0. These are my configuration files for the client and for the server:

client configuration file (Linux, Centos 5.0):

client
dev tun
proto udp

remote 1194
ifconfig

route
resolv-retry infinite
nobind

persist-key
persist-tun

ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/client1.crt
key /etc/openvpn/keys/client1.key

tls-auth /etc/openvpn/keys/ta.key 1
cipher BF-CBC

status /var/log/openvpn-status.log
log-append /var/log/openvpn.log

comp-lzo
verb 4
;mute 20

server configuration file (Linux, Centos 5.0):

local
ifconfig

port 1194
proto udp
dev tun
daemon

ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh1024.pem

server
ifconfig-pool-persist ipp.txt
route add -net netmask gw eth1

keepalive 10 120

tls-auth /etc/openvpn/keys/ta.key 0

cipher BF-CBC
comp-lzo
max-clients 25
user nobody
group nobody
persist-key
persist-tun

status /var/log/openvpn-status.log

log-append /var/log/openvpn.log
verb 4
mute 20

Now let me do some explaining:
is the network behind the vpn server that I wan to get access to.
is the gateway for the network.

is the public IP of the box that the openvpn server is running on.
and are the virtual IPs of the openvpn tunnel. These I can ping. However, I cannot ping any box on the network.

Now my routing tables:

routing table for the server:

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
* UH 0 0 0 tun0
* U 0 0 0 eth0
* U 0 0 0 eth1
UG 0 0 0 tun0
* U 0 0 eth1
default UG 0 0 0 eth0


routing table for client:


Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
UGH 0 0 0 tun0
* UH 0 0 0 tun0
* U 0 0 0 eth0
* U 0 0 0 eth0
default UG 0 0 0 eth0


Please someone help to figure this routing problem out.

Thanks.
--Willie

  • 1 Contributor
  • 1 Reply
  • 226 Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by williebens

Dani AI

Generated

As discovered, the problem is an overlapping subnet: both the client’s LAN and the private LAN behind the OpenVPN server use 192.168.1.0/24. When two sides share the same prefix the client kernel prefers the local interface and ARP behavior/host routing make it effectively impossible to reach the remote hosts without changing addressing or doing address translation.

The clean, recommended fix is to renumber one side to a non‑overlapping subnet (for example 10.8.0.0/24 or 192.168.50.0/24). That eliminates routing ambiguity and lets the server simply push the route to the VPN clients so traffic to the private LAN goes over the tunnel.

If renumbering isn’t possible, two practical workarounds exist:

  • Per‑host route + SNAT: add host (/32) routes on the client for the specific remote machines and NAT their replies on the OpenVPN host so remote machines reply to the server. Example client host route (one line per remote IP):

    ip route add 192.168.1.123/32 via 10.3.0.1 dev tun0

    On the server enable forwarding and SNAT so replies come back through the server:

    sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -s 10.3.0.0/24 -d 192.168.1.0/24 -j SNAT --to-source 192.168.1.1

    This works but is manual and scales poorly.

  • Subnet 1:1 mapping on the server: present the remote LAN to clients as a distinct “mapped” subnet (for example 172.31.100.0/24), push that route to clients, and perform 1:1 translation (NETMAP or DNAT/SNAT) on the OpenVPN host. This preserves per‑host addressing while avoiding overlap; it requires kernel/iptables support and careful conntrack/testing.

Do not use bridging (tap) to “solve” an overlapping address problem — it creates duplicate IP conflicts. Troubleshoot with ip route, iptables -t nat -L -n -v, and tcpdump -i tun0 to confirm packets hit the server and are being translated/forwarded as expected.

Member Avatar for williebens

Hello folks:

This is an update regarding this openvpn thread. Both networks, my local network, and the private network running behind the openvpn server are in the same subnet. This makes is difficult/impossible to send traffic from my local network through the vpn server to the private network.

This is an IP overlap issue.

One solution might be changing one of the two networks to a different subnet of different set of IPs. However, I am not the network administrator, assuming this could be done.

If there is anyone out there who can help me figure this IP overlap out, please let me know.

Thanks.
--Willie

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.