The goal is to use remote desktop over OpenVPN to access server IP (either 10.8.0.1 or 192.168.1.101, I don't really care which)
All nodes on network are Windows (some 64-bit) using OpenVPN 2.2.2. Clients seem to connect as best I can tell, but I'm unable to reach the server's subnet using
push "route 192.168.1.0 255.255.255.0" using either subnet address (192.168.1.101 or 10.8.0.1)
The server subnet is 192.168.1.0/24
The OpenVPN subnet is 10.8.0.0/24
I think
route print is ok, but I'm not 100%--client receives 10.8.0.10 IP address, so why the 10.8.0.8/30 route?
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.69 276
10.8.0.0 255.255.255.0 10.8.0.9 10.8.0.10 30
10.8.0.8 255.255.255.252 On-link 10.8.0.10 286
10.8.0.10 255.255.255.255 On-link 10.8.0.10 286
10.8.0.11 255.255.255.255 On-link 10.8.0.10 286
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.1.0 255.255.255.0 On-link 192.168.1.69 276
192.168.1.0 255.255.255.0 10.8.0.9 10.8.0.10 30
192.168.1.69 255.255.255.255 On-link 192.168.1.69 276
192.168.1.255 255.255.255.255 On-link 192.168.1.69 276
192.168.56.0 255.255.255.0 On-link 192.168.56.1 276
192.168.56.1 255.255.255.255 On-link 192.168.56.1 276
192.168.56.255 255.255.255.255 On-link 192.168.56.1 276
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.56.1 276
224.0.0.0 240.0.0.0 On-link 172.172.10.34 256
224.0.0.0 240.0.0.0 On-link 192.168.1.69 276
224.0.0.0 240.0.0.0 On-link 10.8.0.10 286
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.56.1 276
255.255.255.255 255.255.255.255 On-link 172.172.10.34 256
255.255.255.255 255.255.255.255 On-link 192.168.1.69 276
255.255.255.255 255.255.255.255 On-link 10.8.0.10 286
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 192.168.1.1 Default
===========================================================================
Still can't ping 10.8.0.1 (server OpenVPN IP) or 192.168.1.101 (server LAN IP) or use remote desktop.
Here is the connection log from the client--it looks like on successive connects, some of the 10.8.0.X routes already exist. Is that expected?
OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
LZO compression initialized
Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Socket Buffers: R=[8192->8192] S=[8192->8192]
Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Local Options hash (VER=V4): '00000000'
Expected Remote Options hash (VER=V4): 'a1a1a1a1'
UDPv4 link local: [undef]
UDPv4 link remote: 0.0.0.0:1194
TLS: Initial packet from 0.0.0.0:1194, sid=5ad2ed5f 10cf887c
VERIFY OK: depth=1, /C=US/ST=XX/L=Locality/O=Office/OU=changeme/CN=OpenVPN-CA/name=changeme/emailAddress=email@domain.com
VERIFY OK: depth=0, /C=US/ST=XX/L=Locality/O=Office/OU=changeme/CN=server/name=changeme/emailAddress=email@domain.com
Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
[server] Peer Connection Initiated with 0.0.0.0:1194
SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 10.8.0.0 255.255.255.0,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9'
OPTIONS IMPORT: timers and/or timeouts modified
OPTIONS IMPORT: --ifconfig/up options modified
OPTIONS IMPORT: route options modified
ROUTE default_gateway=192.168.1.1
TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{0EBCACDA-48EE-44EB-8219-FF09A5EDE622}.tap
TAP-Win32 Driver Version 9.9
TAP-Win32 MTU=1500
Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.10/255.255.255.252 on interface {0EBCACDA-48EE-44EB-8219-FF09A5EDE622} [DHCP-serv: 10.8.0.9, lease-time: 31536000]
Successful ARP Flush on interface [16] {0EBCACDA-48EE-44EB-8219-FF09A5EDE622}
TEST ROUTES: 3/3 succeeded len=3 ret=1 a=0 u/d=up
WARNING: potential route subnet conflict between local LAN [192.168.1.0/255.255.255.0] and remote VPN [192.168.1.0/255.255.255.0]
C:\WINDOWS\system32\route.exe ADD 192.168.1.0 MASK 255.255.255.0 10.8.0.9
ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Route addition via IPAPI succeeded [adaptive]
C:\WINDOWS\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.9
ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Route addition via IPAPI succeeded [adaptive]
C:\WINDOWS\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.9
ROUTE: route addition failed using CreateIpForwardEntry: The object already exists. [status=5010 if_index=16]
Route addition via IPAPI failed [adaptive]
Route addition fallback to route.exe
The route addition failed: The object already exists.
Initialization Sequence Completed
Server config is default (sample) except I added the push route and client-to-client commands:
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh4096.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.1.0 255.255.255.0"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
Client config is also default, but with the remote server IP configured (0.0.0.0, below)
client
dev tun
proto udp
remote 0.0.0.0 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
comp-lzo
verb 3
