Tutorial: Reach OpenVPN Clients Directly from a Private Network⁠

Overview⁠

This tutorial details how to use Access Server's routing feature to grant access to connected VPN clients.

By default, Access Server uses network address translation (NAT) for packet routing on the VPN. NAT is the easiest way to grant access to resources on the same network as Access Server, such as file or web servers. However, NAT traffic is one-way: OpenVPN clients can reach resources on the private network behind Access Server, but you can't reach clients.

To provide direct contact with connected clients, you set up Access Server's routing.

Routing doesn't use address translation — Access Server forwards traffic coming from a VPN client in the VPN client subnet directly to the target private network. You must make the target network aware of where to reach the VPN client subnet.

You can do this by adding a static route to a gateway or in the target server's operating system.

Follow the steps below to configure routing and add the static route.

Troubleshooting⁠

Whenever you have trouble getting traffic to pass through with Access Server, try to determine the exact spot where things break. To visualize this, we use tools like tcpdump and ping to identify the point where traffic breaks. We describe this in detail on our troubleshooting reaching systems over the VPN tunnel page.