Take the 2-minute tour ×

I have two openvpn clients on the (client1) and (client2) subnets with the server's openvpn connection having the ip

The server has ip forwarding enabled.

Currently, client1's vpn ip is and the P-t-P ip is I have created the following static route on client1:

route add -net netmask gw

The routing table on client1 looks like this:

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface UH        0 0          0 tun0 UGH       0 0          0 tun0   UG        0 0          0 tun0   U         0 0          0 eth0       U         0 0          0 lo         UG        0 0          0 eth0

I thought this would be correct to allow traffic from client1 to reach computers on client2's network, but it does not work. Is (the P-t-P address) the correct one to be routing through ? I tried using but I couldn't create the route.

I also tried adding this to the server config instead:

push "route"
push "route"

It creates the following route on client1:   UG        0 0          0 tun0

But it doesn't work. Surely the "push" route example is correct ? Is there something else I need to do ? Nothing on the server ? Just enable ip forwarding ?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

Does anything appear in firewall logs? Can you diagnose exactly where the traffic brakes using tcpdump? What system are you using (linux, freebsd, which version)?

Also try this in the server config (from the OpenVPN documentation):

# Uncomment this directive to allow different
# clients to be able to "see" each other.
# By default, clients will only see the server.
# To force clients to only see the server, you
# will also need to appropriately firewall the
# server's TUN/TAP interface.
share|improve this answer
somehow i missed this option in the config because I'm blind or something. What a relief. I've been at this for days banging my head against a brick wall and that's all that was required ! –  Pawz May 3 '10 at 12:26

Your Answer


