Access Server: Use the VPN IP Address to Verify OpenVPN Tunnel Status

Overview

OpenVPN Access Server can use multiple VPN client IP address pools, including dynamic, static, and group-specific pools. VPN client addresses can also be distributed across multiple OpenVPN daemons.

Because clients can receive addresses from different VPN subnets, the gateway address for a client’s assigned subnet isn’t a consistent destination for testing VPN tunnel connectivity.

Instead, use the Access Server internal gateway address associated with the Global Dynamic IP Address Network to verify connectivity through the VPN tunnel.

Resolution

The internal gateway address is the first usable IP address in the Global Dynamic IP Address Network and is associated with the as0t0 interface.

For example, if the Global Dynamic IP Address Network is 203.0.113.0/20, the internal gateway address is 203.0.113.1.

To allow VPN clients to access services on this address:

1. Sign in to the Admin Web UI.
2. Navigate to Access Controls → InterClient Communication.
3. Locate Access to the internal gateway address.
4. Select Allow client access to services on the VPN network.
5. Save the changes.

VPN clients can then access services on Access Server using the internal gateway address.

Verification

1. Connect to Access Server with a VPN client.
2. Run ping 203.0.113.1, replacing the example address with your Access Server's internal gateway address.
3. Check whether the address responds.

A successful response confirms that the client can reach Access Server through the VPN tunnel.

Note: A failed ping doesn’t necessarily mean the VPN tunnel is disconnected. The operating system or other network or security settings may block ICMP traffic. If ICMP isn’t available, test connectivity using a service listening on the internal gateway address instead.

Additional information

Using the internal gateway address provides a consistent destination for testing VPN tunnel connectivity without relying on the gateway address for each VPN client subnet.

If you have additional questions or continue to experience connectivity issues, submit a support ticket.