Win 2003 Server to D-Link Router Connection Issues

fturner

I am having some trouble getting OpenVPN to connect properly from my Windows 2003 Server to my D-Link DSR-500 Router. The D-Link router just recently had a firmware upgrade with the option of OpenVPN being available, so I figured I would give it a whirl and set it up. Unfortunately it's been close but no cigar.

I want to be able to connect the router as a client (as the router has client and server options available) so it will automatically connect once in place. I have the Server configured and it seems to connect alright but I think I may have some routing issues or something is not being pushed properly, because I cannot ping in either direction. My server is in the cloud and my router is at my local office.

OpenVPN Server Side
Server WAN: x.x.x.a
Server LAN: 10.181.3.95
Server OpenVPN IP: 10.8.0.1 (default)

OpenVPN Client Side (D-Link DSR-500 Router)
Router WAN: x.x.x.b
Router LAN: 192.168.0.1
Router OpenVPN IP: 10.8.0.6 ? (not really sure if this is right or not)

Here is the OpenVPN Server Config File:
local 184.106.106.110
port 1194
proto udp
dev tun

ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

push "route 10.8.0.1 255.255.255.255"
push "route 10.181.3.95 255.255.224.0"

client-config-dir "C:\\Program Files\\OpenVPN\\config\\ccd"
route 192.168.0.1 255.255.255.255

;push "redirect-gateway def1 bypass-dhcp"
;push "dhcp-option DNS 208.67.222.222"
;push "dhcp-option DNS 208.67.220.220"

client-to-client

keepalive 10 120
cipher BF-CBC # Blowfish (default)
max-clients 10
persist-key
persist-tun
status openvpn-status.log
verb 4

Here is the status log from the server, the last line is a result of when I tried to ping from a client machine on the Client side of the VPN (Side with D-Link Router):

Mon Mar 19 21:03:39 2012 us=187000 C:\WINDOWS\system32\route.exe ADD 192.168.0.1 MASK 255.255.255.255 10.8.0.2
Mon Mar 19 21:03:39 2012 us=187000 Route addition via IPAPI succeeded [adaptive]
Mon Mar 19 21:03:39 2012 us=187000 C:\WINDOWS\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.2
Mon Mar 19 21:03:39 2012 us=187000 Route addition via IPAPI succeeded [adaptive]
Mon Mar 19 21:03:39 2012 us=187000 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Mon Mar 19 21:03:39 2012 us=187000 UDPv4 link local (bound): x.x.x.a:1194
Mon Mar 19 21:03:39 2012 us=187000 UDPv4 link remote: [undef]
Mon Mar 19 21:03:39 2012 us=187000 MULTI: multi_init called, r=256 v=256
Mon Mar 19 21:03:39 2012 us=187000 IFCONFIG POOL: base=10.8.0.4 size=62
Mon Mar 19 21:03:39 2012 us=187000 IFCONFIG POOL LIST
Mon Mar 19 21:03:39 2012 us=187000 client1,10.8.0.4
Mon Mar 19 21:03:39 2012 us=187000 Initialization Sequence Completed
Mon Mar 19 21:05:35 2012 us=15000 MULTI: multi_create_instance called
Mon Mar 19 21:05:35 2012 us=15000 x.x.x.b:1194 Re-using SSL/TLS context
Mon Mar 19 21:05:35 2012 us=15000 x.x.x.b:1194 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Mar 19 21:05:35 2012 us=15000 x.x.x.b:1194 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Mon Mar 19 21:05:35 2012 us=15000 x.x.x.b:1194 Local Options String: 'V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Mar 19 21:05:35 2012 us=15000 x.x.x.b:1194 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Mar 19 21:05:35 2012 us=15000 x.x.x.b:1194 Local Options hash (VER=V4): '239669a8'
Mon Mar 19 21:05:35 2012 us=15000 x.x.x.b:1194 Expected Remote Options hash (VER=V4): '3514370b'
Mon Mar 19 21:05:35 2012 us=15000 x.x.x.b:1194 TLS: Initial packet from x.x.x.b:1194, sid=ffc9da99 7b6f0e09
Mon Mar 19 21:05:35 2012 us=953000 x.x.x.b:1194 VERIFY OK: depth=1, /C=US/ST=NY/L=Madison/O=FES/OU=Security/CN=FESIDM/emailAddress=123tech@gmail.com
Mon Mar 19 21:05:35 2012 us=953000 x.x.x.b:1194 VERIFY OK: depth=0, /C=US/ST=NY/O=FES/OU=FESIDM/CN=client1/emailAddress=123tech@gmail.com
Mon Mar 19 21:05:36 2012 us=46000 x.x.x.b:1194 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Mar 19 21:05:36 2012 us=46000 x.x.x.b:1194 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Mar 19 21:05:36 2012 us=46000 x.x.x.b:1194 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Mar 19 21:05:36 2012 us=46000 x.x.x.b:1194 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Mar 19 21:05:36 2012 us=93000 x.x.x.b:1194 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon Mar 19 21:05:36 2012 us=93000 x.x.x.b:1194 [client1] Peer Connection Initiated with x.x.x.b:1194
Mon Mar 19 21:05:36 2012 us=93000 client1/x.x.x.b:1194 OPTIONS IMPORT: reading client specific options from: C:\Program Files\OpenVPN\config\ccd\client1
Mon Mar 19 21:05:36 2012 us=93000 client1/x.x.x.b:1194 MULTI: Learn: 10.8.0.6 -> client1/x.x.x.b:1194
Mon Mar 19 21:05:36 2012 us=93000 client1/x.x.x.b:1194 MULTI: primary virtual IP for client1/x.x.x.b:1194: 10.8.0.6
Mon Mar 19 21:05:36 2012 us=93000 client1/x.x.x.b:1194 MULTI: internal route 192.168.0.0/24 -> client1/x.x.x.b:1194
Mon Mar 19 21:05:36 2012 us=93000 client1/x.x.x.b:1194 MULTI: Learn: 192.168.0.0/24 -> client1/x.x.x.b:1194
Mon Mar 19 21:05:38 2012 us=546000 client1/x.x.x.b:1194 PUSH: Received control message: 'PUSH_REQUEST'
Mon Mar 19 21:05:38 2012 us=546000 client1/x.x.x.b:1194 SENT CONTROL [client1]: 'PUSH_REPLY,route x.x.x.b 255.255.255.0,route 10.8.0.1 255.255.255.255,route 10.181.3.95 255.255.224.0,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Mon Mar 19 21:17:45 2012 us=281000 client1/x.x.x.b:1194 MULTI: Learn: 192.168.0.50 -> client1/x.x.x.b:1194

I have been fighting with this for a few weeks now, here and there and can't seem to figure out what the issue might be. I did notice in some of the other posts that maybe because I am not pushing DNS that this could be a result??

Any help would be greatly appreciated!!
I also have screen shots of the Router setup as well as the routing table for it if those would be helpful in a resolution.....

Thanks in advance....
-Fred

janjust

what would be really helpful is the openvpn log file on the client side - is there any way to get that?

fturner

The router that I have setup as my client doesn't have anything listed in the vpn log files...so I'm not sure what else I could do for that. Should I post the configuration and setup for the router and maybe this may shed some light on the issue??

-Fred

janjust

what is in the vpn client config file? try adding

verb 4

to that and reconnect ; the client config file itself is somewhat useful, but the real clue to the problem is in the log files. can you launch openvpn manually on the router (in a shell) ?

fturner

The router I am using doesn't have the option of inputting a client configuration file. It is just a static configuration page without the option of uploading a configuration for OpenVPN.

Here are some screen shots of the router's configuration for OpenVPN:
[img]E:\OpenVPN%20Troubleshooting\DSR%20500-OpenVPN%20Configuration[/img]
[img]E:\OpenVPN%20Troubleshooting\DSR%20500-OpenVPN%20Conf%20(Site-to-Site)[/img]
[img]E:\OpenVPN%20Troubleshooting\DSR%20500-OpenVPN%20Conf%20Authentication[/img]
[img]E:\OpenVPN%20Troubleshooting\DSR%20500%20routing%20table[/img]

And no it doesn't give the option to launch manually in a shell environment either. It seems like it connects (or tries to) silently...