Windows – openvpn windows routes ip forwarding enabled but not working

ip-forwardingopenvpnroutingwindowswindows-server-2012

I have setup an openvpn network, I have in my client windows two interfaces, one public with IP 1.2.3.4 and the openvpn interface, with ip 192.168.244.10

I am able to ping from windows to the server's interface IP 2.3.4.5 and wireshark says that the source IP address is correctly 192.168.244.10, the destination 2.3.4.5 and this works. But when I try to ping from the openvpn server to 1.2.3.4 (client public interface), wireshark in the client side says that is receiving the request (source IP 2.3.4.5 and destination 1.2.3.4), but no reply is sent.

So as far as I can understand there is no openvpn problem, openvpn normally is sending the icmp packet from server to the openvpn client IP but windows is not sending back a reply. So, why windows is not forwarding from interface 1.2.3.4 to the windows openvpn client interface 192.168.244.10, in order to send reply back to the openvpn server?? I have already enabled this in the registry, firewall also is disabled.

Best Answer

Ok, I found the problem. I am running windows server 2012 and turning on IP forwarding was not enough.. I had to enable LAN routing in "Routing and remote access" in server manager by right - clicking "configure and enable routing and remote access" and following the steps in the wizard..

Related Solutions

VPN Network Ping Issues – Why Pings from VPN Network to Client Work but Not Vice Versa?

The root cause of this problem were some implicit default routes that were not visible in the tables displayed by /sbin/route but were visible in tables displayed by /sbin/ip route and /sbin/ip rule.

Then these tables were displayed it became apparent that a rule of this kind:

default table route_eth0 via 10.11.11.1  dev eth0

was overriding this rule:

10.8.0.0        10.11.11.2      255.255.255.0   UG    0      0        0 eth0

By editing /etc/sysconfig/network-scripts/route-eth0 (presumably with /sbin/ip route, though did it manually in this case), I was able to fix the issue.

So, what I learnt from this is that /sbin/route can't be relied upon to give you an accurate picture of Linux's effective routing rules and that it is better to use /sbin/ip for this purpose.

Thanks to ptman whose answer to this question helped me see the light. Thank you ptman!

Windows – openVPN: Changing Windows 7 firewall settings

To open a port on the Windows Firewall:

Open Windows Firewall by clicking the Start button Picture of the Start button, and then clicking Control Panel. In the search box, type firewall, and then click Windows Firewall.
In the left pane, click Advanced settings. Administrator permission required If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
In the Windows Firewall with Advanced Security dialog box, in the left pane, click Inbound Rules, and then, in the right pane, click New Rule.
Follow the instructions in the New Inbound Rule wizard.

ICMP rules will just need to be enabled:

enter image description here

Best Answer

Related Solutions

VPN Network Ping Issues – Why Pings from VPN Network to Client Work but Not Vice Versa?

Windows – openVPN: Changing Windows 7 firewall settings

Related Topic