networks behind 2 OpenVPN servers don't see each other



  • Hello,

    I have 2 OpenVPN servers setup:

    1. Site-to-Site
    • Main site is 192.168.1.0/24 (Server is here)
    • Second site 10.10.0.0/24 (Client)
    • Connected via 10.0.8.0/24 intermediate
    1. Remote Access with a couple of clients
    • Server is the same is in (1), running as a second server 192.168.1.0/24
    • Clients get an IP in 10.0.9.0/24

    I can browse both ways in Site - to -Site setup so 192.168.1.0 <=> 10.10.0.0 so we are good here

    Let's say I connect my phone to the second OpenVPN server and on my phone I have access to everything in 192.168.1.0 but I do not have access to anything on the other side of site-to-site (10.10.0.0)

    Essentially anything behind first OpenVPN server does not have access to anything behind second OpenVPN server.
    What am I missing here? Any pointers would be appreciated.


  • Rebel Alliance Developer Netgate

    Your description is contradicting itself. You say site-to-site works, but from a remote access client it doesn't, so it sounds like it's mostly working, not that one server can't see behind another.

    Invariably these issues always come down to two things:

    • Routes -- Clients must receive a route for the other network, and the other network must also have a route to send it back over its site-to-site connection. On the remote access server, add the far side as a "local network". On the other side of the site-to-site, add it as a "remote network".
    • Rules -- Firewall rules on the OpenVPN tab must allow the traffic in question to pass.


  • Thank you, You steered me in the right direction to double check all my routes.

    I fixed the problem by replacing push "route 10.0.9.0 255.255.255.0" with route 10.0.9.0 255.255.255.0 on Site-To-Site connection server side. I guess I put it there by mistake.

    For anyone readying this in the future here are additional steps to make this work:

    Site-to-Site:

    • server side: add route 10.0.9.0 255.255.255.0 to "Custom options" field
    • client side: add 10.0.9.0/24 to "IPv4 Remote network " field (in addition to 192.168.1.0/24)

    Remote access:

    • server side: add push "route 10.10.0.0 255.255.255.0" --> will probably work without this if you route all traffic via this tunnel from the client.

Log in to reply