Access Server: Use the VPN IP Address to Verify OpenVPN Tunnel Status

Overview

OpenVPN Access Server can use multiple VPN client IP address pools, including dynamic, static, and group-specific pools. VPN client addresses can also be distributed across multiple OpenVPN daemons.

Because clients can receive addresses from different VPN subnets, the gateway address for a client’s assigned subnet isn’t a consistent destination for testing VPN tunnel connectivity.

Instead, use the Access Server internal gateway address associated with the Global Dynamic IP Address Network to verify connectivity through the VPN tunnel.

Resolution

The internal gateway address is the first IP address in the Global Dynamic IP Address Network and is associated with the as0t0 interface.

For example, if the Global Dynamic IP Address Network is:

172.27.224.0/20

The internal gateway address is:

172.27.224.1

To allow VPN clients to access services on this address:

1. Sign in to the Admin Web UI.
2. Go to Access Controls > InterClient Communication.
3. Locate Access to the internal gateway address.
4. Select Allow client access to services on the VPN network.
5. Save the changes.

VPN clients can then access services on Access Server using the internal gateway address.

Verification

Connect to Access Server with a VPN client.

Verify the VPN-assigned IP address, then test connectivity to the Access Server internal gateway address.

For example:

ping 172.27.224.1

Replace 172.27.224.1 with the internal gateway address configured on your Access Server.

A successful response confirms that traffic can reach Access Server through the VPN tunnel.

Note: A failed ping doesn’t necessarily mean the VPN tunnel is disconnected. The operating system or other network or security settings may block ICMP traffic. If ICMP isn’t available, test connectivity using a service listening on the internal gateway address instead.

Additional information

Using the internal gateway address provides a consistent destination for testing VPN tunnel connectivity without relying on the gateway address for each VPN client subnet.

If you have additional questions or continue to experience connectivity issues, submit a support ticket.