Troubleshoot Reaching Destinations over the VPN Tunnel
This page covers troubleshooting issues related to reaching a destination through an OpenVPN tunnel. For problems establishing the VPN tunnel, refer to Client-Server Connectivity. Specifically, we address connection path problems here, meaning the issues encountered between the OpenVPN client and the target server you're trying to reach.
This is distinct from problems related to establishing the OpenVPN tunnel itself. Connectivity issues along this path can be challenging, especially if they impact your business operations. Multiple variables and the invisible nature of network traffic can make these problems seem insurmountable. However, with the right diagnostic tools, troubleshooting is manageable.
Most issues aren't rooted in the Access Server or OpenVPN Connect configurations but are typically found in the target network or the target system itself. This topic will guide you through tests that help eliminate possibilities until you find the cause of the issue.
Tools for diagnosing connection problems
To diagnose connectivity issues between the VPN client and the target system, use the following tools:
TCPdump: Linux command-line tool for visualizing network packets.
WireShark: Windows GUI tool for visualizing network packets.
ping: Testing tool to check message exchange between source and destination.
traceroute: Determines every hop between the source and target destination.
These tools help visualize traffic paths and identify where traffic flow stops.
Before you begin
Check these common issues:
Ensure proper access is delegated in Access Server:
Ensure local subnets are listed under Configuration > VPN Settings > Routing.
If you're using routing, add static routes on your local router.
If you're using NAT, ensure you are not listing subnets in Advanced VPN > Private Routed Subnets.
Verify that the dynamic IP address range in Layer 3 operating mode does not conflict with the remote network.
On ESXi platforms, use VMXNET3 as the NIC type instead of Flexible. To change, you must shut down the virtual machine, remove the NIC, and add a new one.
Disable Jumbo Frames on all network nodes.
Configure firewalls to allow ICMP Destination Unreachable: Fragmentation Needed (ICMP Type 3, Code 4). Windows Firewall configures this rule by default.
Use UDP or multi-daemon mode over TCP for VPN connections.
Ensure reliable internet connections for VPN clients.
Test and replace any defective Ethernet cables.
Keep firewall software/firmware up to date.
Turn off antivirus and internet security products during testing.
