Why can't my OpenVPN client access machines on same LAN as OpenVPN server?

I finally found out what the problem was. I am using OpenVPN's "routing" option which creates a new subnet for all OpenVPN connections. My client was getting assigned an IP address from this subnet, and so was my server, so they could talk to each other across this network. With IPv4 forwarding enabled on my server, I was also able to send packets out onto my LAN, and was obviously able to talk to the server via it's LAN ip address.

When the client tried to talk to other computers on my LAN, the packets from my client were reaching my LAN hosts (I didn't verify this, but I'm pretty sure they were), but the source address of these packets was the address from the OpenVPN network. The LAN hosts knew this wasn't on their LAN, and the only thing they knew to do in that case was to send them to the default gateway, which was my router. I doubt it did anything with them as sending a packet to a private IP range out onto the internet is pointless.

The solution is to add a static route to all LAN hosts, or use OpenVPN's "bridging" option instead of "routing". I have not done this yet, but am sure this is the way to go.


I don't think you have to add a static route to all LAN hosts. You could just add a static route in your gateway on that LAN, pointing all openvpn-network addresses to the openvpn server "lan-ip address".