Setting up my VPN

Frankincense

Hi guys, I have just learnt about OpenVPN and I would like to get it working between my Ubuntu 11.10 server and my Windows 7 PC. I have followed many tutorials, and the VPN gui client manages to connect, but I cannot ping my server from the client and vice versa. This unfortunately means I cannot access anything from either side.

This is my server.conf on my Ubuntu server:

                                             #
port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/SERVER.crt
key /etc/openvpn/easy-rsa/keys/SERVER.key  # This file should be kept secret
dh /etc/openvpn/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-to-client
keepalive 10 120
cipher BF-CBC        # Blowfish (default)
comp-lzo
max-clients 2
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
verb 3

Here is my Client.ovpn file on my Windows 7 PC:

client
dev tun
proto udp
remote [my server dynamic IP] 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert Work.crt
key Work.key
ns-cert-type server
comp-lzo
verb 3

The gui states it is connected, but I cannot access any data from either side, or ping each other.
I have also forwarded my port 1194 on my router, which is infront of my server. I have tried running the gui with admin access but it made no difference unfortunately.

Is there anything obvious I have missed?

Many thanks

maikcat

i removed all comments from your configs.

what openvpn version did you installed on win 7?
can you post server logs?
do you run the gui with admin rights?

Michael.

Frankincense

The client is whatever this version is: http://swupdate.openvpn.net/downloads/openvpn-client.msi
I can't see anywhere on the program where the version is listed :?

This is my openvpn.log on my server:

Thu May  3 10:47:16 2012 OpenVPN 2.2.0 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jul  4 2011
Thu May  3 10:47:16 2012 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Thu May  3 10:47:16 2012 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Thu May  3 10:47:16 2012 Diffie-Hellman initialized with 1024 bit key
Thu May  3 10:47:16 2012 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu May  3 10:47:16 2012 Socket Buffers: R=[126976->131072] S=[126976->131072]
Thu May  3 10:47:16 2012 ROUTE default_gateway=192.168.1.254
Thu May  3 10:47:16 2012 TUN/TAP device tun0 opened
Thu May  3 10:47:16 2012 TUN/TAP TX queue length set to 100
Thu May  3 10:47:16 2012 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu May  3 10:47:16 2012 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Thu May  3 10:47:16 2012 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Thu May  3 10:47:16 2012 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu May  3 10:47:16 2012 UDPv4 link local (bound): [undef]
Thu May  3 10:47:16 2012 UDPv4 link remote: [undef]
Thu May  3 10:47:16 2012 MULTI: multi_init called, r=256 v=256
Thu May  3 10:47:16 2012 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Thu May  3 10:47:16 2012 ifconfig_pool_read(), in='Work,10.8.0.4', TODO: IPv6
Thu May  3 10:47:16 2012 succeeded -> ifconfig_pool_set()
Thu May  3 10:47:16 2012 IFCONFIG POOL LIST
Thu May  3 10:47:16 2012 Work,10.8.0.4
Thu May  3 10:47:16 2012 Initialization Sequence Completed
Thu May  3 10:47:31 2012 MULTI: multi_create_instance called
Thu May  3 10:47:31 2012 195.212.29.84:49071 Re-using SSL/TLS context
Thu May  3 10:47:31 2012 195.212.29.84:49071 LZO compression initialized
Thu May  3 10:47:31 2012 195.212.29.84:49071 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu May  3 10:47:31 2012 195.212.29.84:49071 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu May  3 10:47:31 2012 195.212.29.84:49071 Local Options hash (VER=V4): '530fdded'
Thu May  3 10:47:31 2012 195.212.29.84:49071 Expected Remote Options hash (VER=V4): '41690919'
Thu May  3 10:47:31 2012 195.212.29.84:49071 TLS: Initial packet from [AF_INET]195.212.29.84:49071, sid=2c9db3dd 5992163b
Thu May  3 10:47:31 2012 195.212.29.84:49071 VERIFY OK: depth=1, /C=XX/ST=XXXXXXX/L=XXXXXX/O=None/OU=None/CN=XXXXX/name=XXXXXXX/emailAddress=XXXXX
Thu May  3 10:47:31 2012 195.212.29.84:49071 VERIFY OK: depth=0, /C=XX/ST=XXXXXXX/L=XXXXXX/O=None/OU=None/CN=XXXXX/name=XXXXXXX/emailAddress=XXXXX
Thu May  3 10:47:31 2012 195.212.29.84:49071 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May  3 10:47:31 2012 195.212.29.84:49071 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May  3 10:47:31 2012 195.212.29.84:49071 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May  3 10:47:31 2012 195.212.29.84:49071 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May  3 10:47:31 2012 195.212.29.84:49071 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu May  3 10:47:31 2012 195.212.29.84:49071 [Work] Peer Connection Initiated with [AF_INET]195.212.29.84:49071
Thu May  3 10:47:31 2012 Work/195.212.29.84:49071 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=c809:2201::d074:1f01:0:0
Thu May  3 10:47:31 2012 Work/195.212.29.84:49071 MULTI: Learn: 10.8.0.6 -> Work/195.212.29.84:49071
Thu May  3 10:47:31 2012 Work/195.212.29.84:49071 MULTI: primary virtual IP for Work/195.212.29.84:49071: 10.8.0.6
Thu May  3 10:47:33 2012 Work/195.212.29.84:49071 PUSH: Received control message: 'PUSH_REQUEST'
Thu May  3 10:47:33 2012 Work/195.212.29.84:49071 send_push_reply(): safe_cap=960
Thu May  3 10:47:33 2012 Work/195.212.29.84:49071 SENT CONTROL [Work]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Thu May  3 11:10:35 2012 MULTI: multi_create_instance called
Thu May  3 11:10:35 2012 195.212.29.84:7249 Re-using SSL/TLS context
Thu May  3 11:10:35 2012 195.212.29.84:7249 LZO compression initialized
Thu May  3 11:10:35 2012 195.212.29.84:7249 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu May  3 11:10:35 2012 195.212.29.84:7249 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu May  3 11:10:35 2012 195.212.29.84:7249 Local Options hash (VER=V4): '530fdded'
Thu May  3 11:10:35 2012 195.212.29.84:7249 Expected Remote Options hash (VER=V4): '41690919'
Thu May  3 11:10:35 2012 195.212.29.84:7249 TLS: Initial packet from [AF_INET]195.212.29.84:7249, sid=31cf840f e3f3696f
Thu May  3 11:10:35 2012 195.212.29.84:7249 VERIFY OK: depth=1, /C=XX/ST=XXXXXXX/L=XXXXXX/O=None/OU=None/CN=XXXXX/name=XXXXXXX/emailAddress=XXXXX
Thu May  3 11:10:35 2012 195.212.29.84:7249 VERIFY OK: depth=0, /C=XX/ST=XXXXXXX/L=XXXXXX/O=None/OU=None/CN=XXXXX/name=XXXXXXX/emailAddress=XXXXX
Thu May  3 11:10:36 2012 195.212.29.84:7249 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May  3 11:10:36 2012 195.212.29.84:7249 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May  3 11:10:36 2012 195.212.29.84:7249 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May  3 11:10:36 2012 195.212.29.84:7249 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May  3 11:10:36 2012 195.212.29.84:7249 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu May  3 11:10:36 2012 195.212.29.84:7249 [Work] Peer Connection Initiated with [AF_INET]195.212.29.84:7249
Thu May  3 11:10:36 2012 MULTI: new connection by client 'Work' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Thu May  3 11:10:36 2012 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=a0d3:22c8:ff7f:0:30bf:2001::
Thu May  3 11:10:36 2012 MULTI: Learn: 10.8.0.6 -> Work/195.212.29.84:7249
Thu May  3 11:10:36 2012 MULTI: primary virtual IP for Work/195.212.29.84:7249: 10.8.0.6
Thu May  3 11:10:38 2012 Work/195.212.29.84:7249 PUSH: Received control message: 'PUSH_REQUEST'
Thu May  3 11:10:38 2012 Work/195.212.29.84:7249 send_push_reply(): safe_cap=960
Thu May  3 11:10:38 2012 Work/195.212.29.84:7249 SENT CONTROL [Work]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Thu May  3 11:13:08 2012 MULTI: multi_create_instance called
Thu May  3 11:13:08 2012 195.212.29.84:41847 Re-using SSL/TLS context
Thu May  3 11:13:08 2012 195.212.29.84:41847 LZO compression initialized
Thu May  3 11:13:08 2012 195.212.29.84:41847 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu May  3 11:13:08 2012 195.212.29.84:41847 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu May  3 11:13:08 2012 195.212.29.84:41847 Local Options hash (VER=V4): '530fdded'
Thu May  3 11:13:08 2012 195.212.29.84:41847 Expected Remote Options hash (VER=V4): '41690919'
Thu May  3 11:13:08 2012 195.212.29.84:41847 TLS: Initial packet from [AF_INET]195.212.29.84:41847, sid=6cdcb6f8 a3ad133d
Thu May  3 11:13:09 2012 195.212.29.84:41847 VERIFY OK: depth=1, /C=XX/ST=XXXXXXX/L=XXXXXX/O=None/OU=None/CN=XXXXX/name=XXXXXXX/emailAddress=XXXXX
Thu May  3 11:13:09 2012 195.212.29.84:41847 VERIFY OK: depth=0, /C=XX/ST=XXXXXXX/L=XXXXXX/O=None/OU=None/CN=XXXXX/name=XXXXXXX/emailAddress=XXXXX
Thu May  3 11:13:09 2012 195.212.29.84:41847 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May  3 11:13:09 2012 195.212.29.84:41847 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May  3 11:13:09 2012 195.212.29.84:41847 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May  3 11:13:09 2012 195.212.29.84:41847 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May  3 11:13:09 2012 195.212.29.84:41847 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu May  3 11:13:09 2012 195.212.29.84:41847 [Work] Peer Connection Initiated with [AF_INET]195.212.29.84:41847
Thu May  3 11:13:09 2012 MULTI: new connection by client 'Work' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Thu May  3 11:13:09 2012 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=a0d3:22c8:ff7f:0:e0ae:2001::
Thu May  3 11:13:09 2012 MULTI: Learn: 10.8.0.6 -> Work/195.212.29.84:41847
Thu May  3 11:13:09 2012 MULTI: primary virtual IP for Work/195.212.29.84:41847: 10.8.0.6
Thu May  3 11:13:11 2012 Work/195.212.29.84:41847 PUSH: Received control message: 'PUSH_REQUEST'
Thu May  3 11:13:11 2012 Work/195.212.29.84:41847 send_push_reply(): safe_cap=960
Thu May  3 11:13:11 2012 Work/195.212.29.84:41847 SENT CONTROL [Work]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Thu May  3 11:31:42 2012 MULTI: multi_create_instance called
Thu May  3 11:31:42 2012 195.212.29.84:14676 Re-using SSL/TLS context
Thu May  3 11:31:42 2012 195.212.29.84:14676 LZO compression initialized
Thu May  3 11:31:42 2012 195.212.29.84:14676 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu May  3 11:31:42 2012 195.212.29.84:14676 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu May  3 11:31:42 2012 195.212.29.84:14676 Local Options hash (VER=V4): '530fdded'
Thu May  3 11:31:42 2012 195.212.29.84:14676 Expected Remote Options hash (VER=V4): '41690919'
Thu May  3 11:31:42 2012 195.212.29.84:14676 TLS: Initial packet from [AF_INET]195.212.29.84:14676, sid=7cdcf217 115e7c1e
Thu May  3 11:31:42 2012 195.212.29.84:14676 VERIFY OK: depth=1, /C=XX/ST=XXXXXXX/L=XXXXXX/O=None/OU=None/CN=XXXXX/name=XXXXXXX/emailAddress=XXXXX
Thu May  3 11:31:42 2012 195.212.29.84:14676 VERIFY OK: depth=0, /C=XX/ST=XXXXXXX/L=XXXXXX/O=None/OU=None/CN=XXXXX/name=XXXXXXX/emailAddress=XXXXX
Thu May  3 11:31:42 2012 195.212.29.84:14676 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May  3 11:31:42 2012 195.212.29.84:14676 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May  3 11:31:42 2012 195.212.29.84:14676 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May  3 11:31:42 2012 195.212.29.84:14676 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May  3 11:31:42 2012 195.212.29.84:14676 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu May  3 11:31:42 2012 195.212.29.84:14676 [Work] Peer Connection Initiated with [AF_INET]195.212.29.84:14676
Thu May  3 11:31:42 2012 MULTI: new connection by client 'Work' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Thu May  3 11:31:42 2012 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=a0d3:22c8:ff7f:0:d019:2301::
Thu May  3 11:31:42 2012 MULTI: Learn: 10.8.0.6 -> Work/195.212.29.84:14676
Thu May  3 11:31:42 2012 MULTI: primary virtual IP for Work/195.212.29.84:14676: 10.8.0.6
Thu May  3 11:31:45 2012 Work/195.212.29.84:14676 PUSH: Received control message: 'PUSH_REQUEST'
Thu May  3 11:31:45 2012 Work/195.212.29.84:14676 send_push_reply(): safe_cap=960
Thu May  3 11:31:45 2012 Work/195.212.29.84:14676 SENT CONTROL [Work]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Thu May  3 11:37:12 2012 MULTI: multi_create_instance called
Thu May  3 11:37:12 2012 195.212.29.84:20694 Re-using SSL/TLS context
Thu May  3 11:37:12 2012 195.212.29.84:20694 LZO compression initialized
Thu May  3 11:37:12 2012 195.212.29.84:20694 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu May  3 11:37:12 2012 195.212.29.84:20694 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu May  3 11:37:12 2012 195.212.29.84:20694 Local Options hash (VER=V4): '530fdded'
Thu May  3 11:37:12 2012 195.212.29.84:20694 Expected Remote Options hash (VER=V4): '41690919'
Thu May  3 11:37:12 2012 195.212.29.84:20694 TLS: Initial packet from [AF_INET]195.212.29.84:20694, sid=af278935 fe3a3ed1
Thu May  3 11:37:13 2012 195.212.29.84:20694 VERIFY OK: depth=1, /C=XX/ST=XXXXXXX/L=XXXXXX/O=None/OU=None/CN=XXXXX/name=XXXXXXX/emailAddress=XXXXX
Thu May  3 11:37:13 2012 195.212.29.84:20694 VERIFY OK: depth=0, /C=XX/ST=XXXXXXX/L=XXXXXX/O=None/OU=None/CN=XXXXX/name=XXXXXXX/emailAddress=XXXXX
Thu May  3 11:37:13 2012 195.212.29.84:20694 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May  3 11:37:13 2012 195.212.29.84:20694 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May  3 11:37:13 2012 195.212.29.84:20694 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May  3 11:37:13 2012 195.212.29.84:20694 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May  3 11:37:13 2012 195.212.29.84:20694 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu May  3 11:37:13 2012 195.212.29.84:20694 [Work] Peer Connection Initiated with [AF_INET]195.212.29.84:20694
Thu May  3 11:37:13 2012 MULTI: new connection by client 'Work' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Thu May  3 11:37:13 2012 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=a0d3:22c8:ff7f:0:e0ae:2001::
Thu May  3 11:37:13 2012 MULTI: Learn: 10.8.0.6 -> Work/195.212.29.84:20694
Thu May  3 11:37:13 2012 MULTI: primary virtual IP for Work/195.212.29.84:20694: 10.8.0.6
Thu May  3 11:37:16 2012 Work/195.212.29.84:20694 PUSH: Received control message: 'PUSH_REQUEST'
Thu May  3 11:37:16 2012 Work/195.212.29.84:20694 send_push_reply(): safe_cap=960
Thu May  3 11:37:16 2012 Work/195.212.29.84:20694 SENT CONTROL [Work]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

Yes, unfortunately running it with admin rights does not make any difference

janjust

can you try installing and running the open source (community) version of OpenVPN:
http://swupdate.openvpn.org/community/releases/openvpn-2.2.2-install.exe

the link you posted is for the commercial version.

Frankincense

Ok I have it working now, and I can now access my data!

Thanks guys. It seems like the commercial version didn't like me 🙂 As soon as I ran the community version with admin rights it works perfectly.

Thanks again for your prompt help

maikcat

glad to helped you out.

Michael.