networks behind 2 OpenVPN servers don't see each other

  • Hello,

    I have 2 OpenVPN servers setup:

    1. Site-to-Site
    • Main site is (Server is here)
    • Second site (Client)
    • Connected via intermediate
    1. Remote Access with a couple of clients
    • Server is the same is in (1), running as a second server
    • Clients get an IP in

    I can browse both ways in Site - to -Site setup so <=> so we are good here

    Let's say I connect my phone to the second OpenVPN server and on my phone I have access to everything in but I do not have access to anything on the other side of site-to-site (

    Essentially anything behind first OpenVPN server does not have access to anything behind second OpenVPN server.
    What am I missing here? Any pointers would be appreciated.

  • Rebel Alliance Developer Netgate

    Your description is contradicting itself. You say site-to-site works, but from a remote access client it doesn't, so it sounds like it's mostly working, not that one server can't see behind another.

    Invariably these issues always come down to two things:

    • Routes -- Clients must receive a route for the other network, and the other network must also have a route to send it back over its site-to-site connection. On the remote access server, add the far side as a "local network". On the other side of the site-to-site, add it as a "remote network".
    • Rules -- Firewall rules on the OpenVPN tab must allow the traffic in question to pass.

  • Thank you, You steered me in the right direction to double check all my routes.

    I fixed the problem by replacing push "route" with route on Site-To-Site connection server side. I guess I put it there by mistake.

    For anyone readying this in the future here are additional steps to make this work:


    • server side: add route to "Custom options" field
    • client side: add to "IPv4 Remote network " field (in addition to

    Remote access:

    • server side: add push "route" --> will probably work without this if you route all traffic via this tunnel from the client.

Log in to reply