I'm trying to setup OpenVPN between a private network and home clients that connect to it. (The clients don't need to connect to each other). The network topology is a little interesting. There is a public/University network on 10.7.42.0/24. We have some IPs on that network that have public ports forwarded to them, but we're limited on those so we're putting a lot on a private network at 192.168.203.0/24. All machines have at least a private IP and some have both public and private IPs (two adapters. This is all done in VMs but it's like there are two physically separate networks)The OpenVPN server is also the gateway between the public/private networks. It has a 10.7.42.x address, a default gateway of 10.7.42.1 (university gateway), it masquerades/IP forwards any-to-any, and it has an internal address of 192.168.203.1. It successfully works for NAT/gateway. My open VPN Server config looks like this:local 10.42.7.226port 443proto tcpdev tunca /etc/openvpn/easy-rsa-2.0/keys/ca.crtcert /etc/openvpn/easy-rsa-2.0/keys/server.crtkey /etc/openvpn/easy-rsa-2.0/keys/server.key  # This file should be kept secretdh /etc/openvpn/easy-rsa-2.0/keys/dh1024.pemserver 192.168.137.0 255.255.255.0ifconfig-pool-persist /etc/openvpn/ipp.txtroute 192.168.203.0 255.255.255.0push route 192.168.203.0 255.255.255.0push dhcp-option DNS 192.168.203.100keepalive 10 120cipher BF-CBC        # Blowfish (default)comp-lzoplugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-pam.so loginclient-cert-not-requiredusername-as-common-namemax-clients 201user nobodygroup nobodypersist-keypersist-tunstatus /var/log/openvpn-status.loglog-append  /var/log/openvpn.logThe ifconfig looks like this:eth0      Link encap:Ethernet  HWaddr XX:XX:XX:XX:XX:XX            inet addr:192.168.203.1  Bcast:192.168.203.255  Mask:255.255.255.0          inet6 addr: fe80::8c2c:6bff:fe5b:5406/64 Scope:Link          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1          RX packets:183488 errors:0 dropped:4 overruns:0 frame:0          TX packets:198145 errors:0 dropped:0 overruns:0 carrier:0          collisions:0 txqueuelen:1000           RX bytes:15024794 (14.3 Mb)  TX bytes:186885934 (178.2 Mb)          Interrupt:32 Base address:0xa000 eth1      Link encap:Ethernet  HWaddr XX:XX:XX:XX:XX:XX            inet addr:10.42.7.226  Bcast:10.42.7.255  Mask:255.255.255.0          inet6 addr: fe80::a011:59ff:fe3e:c3aa/64 Scope:Link          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1          RX packets:436236 errors:0 dropped:99041 overruns:0 frame:0          TX packets:202673 errors:0 dropped:0 overruns:0 carrier:0          collisions:0 txqueuelen:1000           RX bytes:239838327 (228.7 Mb)  TX bytes:20537299 (19.5 Mb)          Interrupt:36 Base address:0xe100 lo        Link encap:Local Loopback            inet addr:127.0.0.1  Mask:255.0.0.0          inet6 addr: ::1/128 Scope:Host          UP LOOPBACK RUNNING  MTU:16436  Metric:1          RX packets:2 errors:0 dropped:0 overruns:0 frame:0          TX packets:2 errors:0 dropped:0 overruns:0 carrier:0          collisions:0 txqueuelen:0           RX bytes:100 (100.0 b)  TX bytes:100 (100.0 b)tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00            inet addr:192.168.137.1  P-t-P:192.168.173.2  Mask:255.255.255.255          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1          RX packets:631 errors:0 dropped:0 overruns:0 frame:0          TX packets:88 errors:0 dropped:0 overruns:0 carrier:0          collisions:0 txqueuelen:100           RX bytes:48118 (46.9 Kb)  TX bytes:13725 (13.4 Kb)My routes look like this:192.168.137.2     *               255.255.255.255 UH    0      0        0 tun010.42.7.0       *               255.255.255.0   U     0      0        0 eth1192.168.203.0   *               255.255.255.0   U     0      0        0 eth0192.168.137.0     192.168.137.2     255.255.255.0   UG    0      0        0 tun0link-local      *               255.255.0.0     U     0      0        0 eth0loopback        *               255.0.0.0       U     0      0        0 lodefault         10.42.7.1       0.0.0.0         UG    0      0        0 eth1The client looks like this:dev tunremote vpn.mydomain.comca ca.crtclientport 443proto tcptls-clientauth-user-passcomp-lzoping 15verb 9log-append  /tmp/openvpn.log The problem is I can only get to the OpenVPN server if I ssh to 192.168.137.1. I can't connect to any of the 192.168.203.0/24 addresses. If I do a trace route, it only goes one hop, and it takes 30 seconds to do that across the VPN to the remote tun adapter. The private machines use the 192.168.203.1 (OpenVPN server) as their gateway, so the packets should make their way back fine for at least those machines (really they would be NATed on their way out, so it should make it to machines with both public and private adapters too)I've set these OpenVPN networks up before and I know I've run into this exact problem before, but I can't remember the solution. 
Routing in OpenVPN between a private network and a client
routing;vpn;openvpn