An OpenVPN client seems to initialize on a CentOS 7 client virtual machine.  However, the response from the server is not clear when the client sends a ping.Specifically, ping 10.8.0.0 from the client does NOT get any response from server.ping 10.8.0.1 from the client does get a response, but is it from the server?ping 10.0.2.2 from the client does get a response, but is it from the server?  How do I interpret these ping responses?  Is the server respondng to the ping requests?  And if not, what specific changes need to be made to the below in order to get the server to reply to a ping from the client?THE CURRENT SETUP:On the server, server.conf is:  port 1194proto udpdev tunca ca.crtcert server.crtkey server.key  dh dh2048.pemserver 10.8.0.0 255.255.255.0route 10.8.1.0 255.255.255.0 route 10.8.2.0 255.255.255.0 client-config-dir ccd client-to-client ifconfig-pool-persist ipp.txtkeepalive 10 120user nobodygroup nobodypersist-keypersist-tunstatus openvpn-status.logverb 3Also, in the server, the two files in the /etc/openvpn/ccd directory referred to in the server.conf above are:  /etc/openvpn/ccd/administrators, which contains only the following one line:  ifconfig-push 10.8.1.1 10.8.1.2And /etc/openvpn/ccd/otherorgs, which contains only the following one line:  ifconfig-push 10.8.2.1 10.8.2.2The firewalld config for the server is:  [root@hostname easy-rsa]# firewall-cmd --get-default-zonepublic[root@hostname easy-rsa]# firewall-cmd --get-active-zonesinternal  interfaces: tun0public  interfaces: enp3s0[root@hostname easy-rsa]# firewall-cmd --list-allpublic (default, active)  interfaces: enp3s0  sources:   services: dhcpv6-client http imaps openvpn smtp ssh  ports:   masquerade: yes  forward-ports:   icmp-blocks:   rich rules: [root@hostname easy-rsa]# firewall-cmd --zone=internal --list-allinternal (active)  interfaces: tun0  sources:   services: dhcpv6-client ipp-client mdns samba-client ssh  ports:   masquerade: no  forward-ports:   icmp-blocks:   rich rules:     rule family=ipv4 source address=10.8.1.0/24 service name=https_others accept    rule family=ipv4 source address=10.8.1.0/24 service name=https accept    rule family=ipv4 source address=10.8.0.0/24 service name=https accept    rule family=ipv4 source NOT address=10.8.1.1 service name=ssh reject    rule family=ipv4 source address=10.8.2.0/24 service name=https_others accept[root@hostname easy-rsa]# On the client, client.ovpn is:clientdev tunproto udpremote ip.addr.of.server 1194resolv-retry infinitenobindpersist-keypersist-tunverb 3ca /etc/openvpn/ca.crtcert /etc/openvpn/centos_vm1_client.crtkey /etc/openvpn/centos_vm1_client.keyThe client seems to start, because the client terminal gives the following logs:  [user@localhost openvpn]$ sudo openvpn --config ~/openvpn_config/client.ovpn[sudo] password for user: Wed Jun 15 16:52:23 2016 OpenVPN 2.3.11 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on May 10 2016Wed Jun 15 16:52:23 2016 library versions: OpenSSL 1.0.1e-fips 11 Feb 2013, LZO 2.06Wed Jun 15 16:52:23 2016 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.Wed Jun 15 16:52:23 2016 Socket Buffers: R=[212992->212992] S=[212992->212992]Wed Jun 15 16:52:23 2016 UDPv4 link local: [undef]Wed Jun 15 16:52:23 2016 UDPv4 link remote: [AF_INET]ip.addr.of.server:1194Wed Jun 15 16:52:23 2016 TLS: Initial packet from [AF_INET]ip.addr.of.server:1194, sid=40ea5916 7f5543b1Wed Jun 15 16:52:23 2016 VERIFY OK: depth=1, C=UK, ST=RW, L=SomeCity, O=OrganizationName, OU=MyOrganizationalUnit, CN=somedomain.com, name=server, emailAddress=some@domain.comWed Jun 15 16:52:23 2016 VERIFY OK: depth=0, C=UK, ST=RW, L=SomeCity, O=OrganizationName, OU=MyOrganizationalUnit, CN=server, name=server, emailAddress=some@domain.comWed Jun 15 16:52:24 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit keyWed Jun 15 16:52:24 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authenticationWed Jun 15 16:52:24 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit keyWed Jun 15 16:52:24 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authenticationWed Jun 15 16:52:24 2016 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSAWed Jun 15 16:52:24 2016 [server] Peer Connection Initiated with [AF_INET]ip.addr.of.server:1194Wed Jun 15 16:52:26 2016 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)Wed Jun 15 16:52:27 2016 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.18 10.8.0.17'Wed Jun 15 16:52:27 2016 OPTIONS IMPORT: timers and/or timeouts modifiedWed Jun 15 16:52:27 2016 OPTIONS IMPORT: --ifconfig/up options modifiedWed Jun 15 16:52:27 2016 OPTIONS IMPORT: route options modifiedWed Jun 15 16:52:27 2016 ROUTE_GATEWAY 10.0.2.2/255.255.255.0 IFACE=enp0s3 HWADDR=08:00:27:d5:85:a9Wed Jun 15 16:52:27 2016 TUN/TAP device tun0 openedWed Jun 15 16:52:27 2016 TUN/TAP TX queue length set to 100Wed Jun 15 16:52:27 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0Wed Jun 15 16:52:27 2016 /usr/sbin/ip link set dev tun0 up mtu 1500Wed Jun 15 16:52:27 2016 /usr/sbin/ip addr add dev tun0 local 10.8.0.18 peer 10.8.0.17Wed Jun 15 16:52:27 2016 /usr/sbin/ip route add 10.8.0.1/32 via 10.8.0.17Wed Jun 15 16:52:27 2016 Initialization Sequence CompletedPING RESULTS:Opening a new terminal on the client and ping to the server address given in server.conf above gives no response[user@localhost ~]$ ping 10.8.0.0PING 10.8.0.0 (10.8.0.0) 56(84) bytes of data.  However, ping to two two ip addresses given in the OpenVPN startup logs above did produce responses:[user@localhost ~]$ ping 10.8.0.1PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=91.1 ms64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=93.1 ms...^C--- 10.8.0.1 ping statistics ---14 packets transmitted, 14 received, 0% packet loss, time 13013msrtt min/avg/max/mdev = 89.449/93.387/101.522/2.731 ms[user@localhost ~]$ ping 10.0.2.2PING 10.0.2.2 (10.0.2.2) 56(84) bytes of data.64 bytes from 10.0.2.2: icmp_seq=1 ttl=63 time=0.245 ms64 bytes from 10.0.2.2: icmp_seq=2 ttl=63 time=0.429 ms...^C--- 10.0.2.2 ping statistics ---9 packets transmitted, 9 received, 0% packet loss, time 8009msrtt min/avg/max/mdev = 0.170/0.410/0.558/0.117 ms[user@localhost ~]$ 
OpenVPN Server does not reply to Client ping
centos;rhel;openvpn;vpn
From OpenVPN's man page:   --server network netmask ['nopool']          A helper directive designed to  simplify  the  configuration  of          OpenVPN's  server  mode.   This directive will set up an OpenVPN          server which will allocate addresses to clients out of the given          network/netmask.   The  server itself will take the .1 address          of the given network for use as the server-side endpoint of  the          local TUN/TAP interface.And from openvpn.conf (my CentOS7 one at least):# Configure server mode and supply a VPN subnet# for OpenVPN to draw client addresses from.# The server will take 10.8.0.1 for itself,# the rest will be made available to clients.# Each client will be able to reach the server# on 10.8.0.1. Comment this line out if you are# ethernet bridging. See the man page for more info.server 10.8.0.0 255.255.255.0As you can see, you shouldn't be able to ping 10.8.0.0 as it's a network address - the server is allocated the first address.  In your case this is 10.8.0.1.As you found out, you can ping 10.8.0.1 which takes 90ms. The delay is because it is the remote end of the VPN (from your client).You can also ping 10.0.2.2 which takes a mere 0.2ms, so this is the local end.So bottom line is - everything's fine.