Linux – OpenVPN Problems, connecting with Windows OpenVPC client to Linux OpenVPN

I went through the responses and I think I'm savvy to where you're at with all this.

Lets do some simple checks to narrow down the issue:

From one of the OpenVPN clients that is unable to ping a 192.168.0.x host: netstatn -rn Also give us ifconfig -a for *nix or ipconfig /all ping <openvpn server external 10.21.x address> ping <openvpn 10.15.x address

From the openvpn server: netstatn -rn ping <a 192.168.0.x host> ping <a 10.15.x host> ping <a 10.21.x host>

Also, your current openvpn server config and client config probably at /etc/openvpn/server.conf and on the client machine /etc/openvpn/<hostname>.conf or c:\program files\openvpn\config\<hostname.conf> or .ovpn

I have a similar setup. On my OpenVPN server I have the equiv of this iptables rule (changed hostmask/interface to what your values should be):

# Generated by iptables-save v1.4.4 
*nat
:PREROUTING ACCEPT [5:332]
:POSTROUTING ACCEPT [5:740]
:OUTPUT ACCEPT [5:740]
-A POSTROUTING -s 10.15.119.0/2 -o eth1 -j MASQUERADE
COMMIT

Looks like your problem is most definately because you're missing iptable_nat.

# lsmod | grep nat
iptable_nat             5011  1 
nf_nat                 19101  2 ipt_MASQUERADE,iptable_nat
nf_conntrack_ipv4      12548  3 iptable_nat,nf_nat
nf_conntrack           72270  4 ipt_MASQUERADE,iptable_nat,nf_nat,nf_conntrack_ipv4
ip_tables              17942  2 iptable_nat,iptable_filter
x_tables               21613  3 ipt_MASQUERADE,iptable_nat,ip_tables

modprobe iptable_nat or try with the -a parameter.

You need to do this:

http://openvpn.net/index.php/open-source/documentation/howto.html#redirect

The specific server directive is:

push "redirect-gateway def1"

Basically, the server needs to push routing configuration to the client. This routing configuration will change the default route of the client, so that non-local traffic will go through the VPN tunnel rather than the LAN.

Note that you need to have OpenVPN client run with administrative privileges for this to work. Otherwise, the client program will not be able to change the Windows machine's routing table.