OpenVPN Clients being rejected by server

coopertronic

Hi there All,

Hopefully someone here will be able to help us.

We have been successfully running the OpenVPN server now for well over a year and have been slowly adding clients to it with no problems. However just recently we have been experiencing, what looks like clients rejected from the server.

We have looked at the server config files and are left scratching our heads. In theory we should not be seeing any rejects but when analyzing the log file this error message is popping up:

no dynamic or static remote --ifconfig address is available

We have specified the "server" flag to "172.16.10.0 255.255.255.0". This in theory should give us 254 client hosts. We have not got that many clients out there.

After researching we have found that if the OpenVPN server is set to TCP then Windows OS can put a cap on the number of concurrent client connections however our server is set to UDP so we believe we should not be seeing the 60 client problem.

We have also added the "max-clients" command into the file and set it to 250 but this has not made a difference either.

Here is a copy of our Server .opvn config file with comments removed:

Open VPN Server Config
--------------------------------------------------------------------
server 172.16.10.0 255.255.255.0
ca ca.crt
key SCADAAPP1.key
cert SCADAAPP1.crt
dh dh1024.pem
proto udp
lport 5500
rport 5500
max-clients 250
comp-lzo
cipher BF-CBC
tun-mtu 1500
ping 20
ping-restart 60
verb 3
dev tun
float
client-to-client
client-config-dir CCD
route 172.16.0.0 255.255.0.0
--------------------------------------------------------------------

And here is a copy of the config file for one of our clients:

--------------------------------------------------------------------
Remote 10.109.200.2
ca /etc/openvpn/out/client/ca.crt
key /etc/openvpn/out/client/private.key
cert /etc/openvpn/out/client/cert.crt
proto udp
rport 5501
nobind
comp-lzo
cipher BF-CBC
ns-cert-type server
tun-mtu 1500
reneg-sec 3600
ping 30
ping-restart 60
verb 3
dev tun
float
--------------------------------------------------------------------

If someone would be able to look at this for us that would be a big help. There must be something wrong but we cant see what it is!

Thanks in advance.

maikcat

This in theory should give us 254 client hosts

yes in theory.. 😉

read this pls

--topology mode
Configure virtual addressing topology when running in --dev tun mode. This directive has no meaning in --dev tap mode, which always uses a subnet topology.

If you set this directive on the server, the --server and --server-bridge directives will automatically push your chosen topology setting to clients as well. This directive can also be manually pushed to clients. Like the --dev directive, this directive must always be compatible between client and server.

mode can be one of:

net30 -- Use a point-to-point topology, by allocating one /30 subnet per client. This is designed to allow point-to-point semantics when some or all of the connecting clients might be Windows systems. This is the default on OpenVPN 2.0.

p2p -- Use a point-to-point topology where the remote endpoint of the client's tun interface always points to the local endpoint of the server's tun interface. This mode allocates a single IP address per connecting client. Only use when none of the connecting clients are Windows systems. This mode is functionally equivalent to the --ifconfig-pool-linear directive which is available in OpenVPN 2.0 and is now deprecated.

subnet -- Use a subnet rather than a point-to-point topology by configuring the tun interface with a local IP address and subnet mask, similar to the topology used in --dev tap and ethernet bridging mode. This mode allocates a single IP address per connecting client and works on Windows as well. Only available when server and clients are OpenVPN 2.1 or higher, or OpenVPN 2.0.x which has been manually patched with the --topology directive code. When used on Windows, requires version 8.2 or higher of the TAP-Win32 driver. When used on *nix, requires that the tun driver supports an ifconfig(8) command which sets a subnet instead of a remote endpoint IP address.

Michael

coopertronic

Hi Maikcat,

Thanks for your quick reply!

We have our server setup in "dev tun" mode rather than tap because our sites come online with thier own private VPN subnet and apparently this only works using "dev tun" directives.

I am still trying to digest what you have written there but are you are saying that we additionally need to setup a topology mode for our server too?

The version of OpenVPN we are using is "OpenVPN 2.1_rc19" and it is a Windows Server. We do have windows clients that can connect which means the "p2p" flag is out the window. This just leaves "net30" and "subnet"

Im still a little bit unsure and am not clear on why the server is rejecting clients. - Could you treat me like a proverbial 8 year old and explain a little further please?

Again, thanks in advance.

maikcat

The version of OpenVPN we are using is "OpenVPN 2.1_rc19" and it is a Windows Server

good but not neccesary is to update your openvpn (2.2 version is ok).

by default your setup is using net30 (your first client gets .5 or .6 ip the next .9 or .10)
that means your available range is 256 /4 = 64 max clients .

use mode subnet for more ips....

Michael.

coopertronic

Thank you for your advice here.

We will investigate the subnet setting and see if that helps things.

coopertronic

Hi there,

I was wondering if I could ask for your advice again?

We have added this line:

topology subnet

in our config file and restarted the OpenVPN server but it has generated an unfavourable side-effect!!! For some reason we are not able to ping/connect to any of the incomming clients now.

This truly is a voyage of discovery!

coopertronic

We have added this change to our server config file:

topology subnet

However this has generated the unfortunate side-effect whereby we are not able to ping/communicate to any of our sites!

We can see the sites coming in via the openvpn log file but just not able to ping them

The sites are using a CCD directory file to pick up thier ip addresses. Could the CCD directory have a conflict with the "topology subnet" setting?

Thanks again for you input here. This truly is a voyage of discovery.

Could we ask you adiWe have made

maikcat

Could the CCD directory have a conflict with the "topology subnet" setting?

yeap... 🙁

i think you must edit your ccd files...

please check the docs section

also topology subnet needs new openvpn (not 2.0.9)....

stupid question...

have you considered using server 172.16.10.0 255.255.254.0 for your server?

Michael.

coopertronic

stupid question...

have you considered using server 172.16.10.0 255.255.254.0 for your server?

Yes we have considered that but would like to do it right. The "topology subnet" solution you offered seems like it should do the trick but we still cant get it to work. I have found this blog post:

http://none.of-the-above.com/archives/276-openvpn-routing.html

..from a guy who sucessfully setup the topology subnet. We have got the same setup as him but am unable to ping the clients.

maikcat

can you post the contents of your ccd file..?

Michael.

coopertronic

Thank you... Here is our configs.

Server
---------------------------------------------------------------------------------------
server 172.16.100.0 255.255.255.0
topology subnet
management 127.0.0.1 45678
ca ca.crt
key SCADAAPP1.key
cert SCADAAPP1.crt
dh dh1024.pem
proto udp
lport 5501
rport 5501
comp-lzo
cipher BF-CBC
tun-mtu 1500
ping 30
ping-restart 60
verb 3
dev tun
float
client-to-client
client-config-dir CCD
route 172.16.0.0 255.255.0.0 172.16.100.1
route-method exe
route-delay 2

CCD
---------------------------------------------------------------------------------------
iroute 172.16.78.0 255.255.255.0 172.16.100.1

LOG FILE CONTENTS
---------------------------------------------------------------------------------------

Thu May 24 09:41:38 2012 OpenVPN 2.1.3 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Aug 20 2010
Thu May 24 09:41:38 2012 MANAGEMENT: TCP Socket listening on 127.0.0.1:45678
Thu May 24 09:41:38 2012 WARNING: --keepalive option is missing from server config
Thu May 24 09:41:38 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu May 24 09:41:38 2012 Diffie-Hellman initialized with 1024 bit key
Thu May 24 09:41:38 2012 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu May 24 09:41:38 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu May 24 09:41:38 2012 ROUTE default_gateway=10.97.10.1
Thu May 24 09:41:38 2012 TAP-WIN32 device [Local Area Connection 4] opened: \\.\Global\{6299E4C3-7319-4401-BE7A-F98E2CE8AB25}.tap
Thu May 24 09:41:38 2012 TAP-Win32 Driver Version 9.7
Thu May 24 09:41:38 2012 TAP-Win32 MTU=1500
Thu May 24 09:41:38 2012 Set TAP-Win32 TUN subnet mode network/local/netmask = 172.16.100.0/172.16.100.1/255.255.255.0 [SUCCEEDED]
Thu May 24 09:41:38 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 172.16.100.1/255.255.255.0 on interface {6299E4C3-7319-4401-BE7A-F98E2CE8AB25} [DHCP-serv: 172.16.100.254, lease-time: 31536000]
Thu May 24 09:41:38 2012 Sleeping for 2 seconds...
Thu May 24 09:41:40 2012 Successful ARP Flush on interface [2] {6299E4C3-7319-4401-BE7A-F98E2CE8AB25}
Thu May 24 09:41:40 2012 C:\WINDOWS\system32\route.exe ADD 172.16.0.0 MASK 255.255.0.0 172.16.100.1
Thu May 24 09:41:40 2012 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu May 24 09:41:40 2012 UDPv4 link local (bound): [undef]:5501
Thu May 24 09:41:40 2012 UDPv4 link remote: [undef]
Thu May 24 09:41:40 2012 MULTI: multi_init called, r=256 v=256
Thu May 24 09:41:40 2012 IFCONFIG POOL: base=172.16.100.2 size=252
Thu May 24 09:41:40 2012 Initialization Sequence Completed
Thu May 24 09:42:06 2012 MULTI: multi_create_instance called
Thu May 24 09:42:06 2012 10.113.202.182:3080 Re-using SSL/TLS context
Thu May 24 09:42:06 2012 10.113.202.182:3080 LZO compression initialized
Thu May 24 09:42:06 2012 10.113.202.182:3080 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu May 24 09:42:06 2012 10.113.202.182:3080 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu May 24 09:42:06 2012 10.113.202.182:3080 Local Options hash (VER=V4): '530fdded'
Thu May 24 09:42:06 2012 10.113.202.182:3080 Expected Remote Options hash (VER=V4): '41690919'
Thu May 24 09:42:06 2012 10.113.202.182:3080 TLS: Initial packet from 10.113.202.182:3080, sid=58e67362 958e1afd
Thu May 24 09:42:16 2012 10.113.202.182:3080 VERIFY OK: depth=1, /C=UK/ST=Hatton/L=Warwickshire/O=CompanyName/OU=SCADA/CN=SCADAAPP1/emailAddress=scadateam@CompanyName.co.uk
Thu May 24 09:42:16 2012 10.113.202.182:3080 VERIFY OK: depth=0, /C=UK/ST=Hatton/O=CompanyName/CN=SpencersSwingBridge/emailAddress=scadateam@CompanyName.co.uk
Thu May 24 09:42:19 2012 10.113.202.182:3080 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May 24 09:42:19 2012 10.113.202.182:3080 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May 24 09:42:19 2012 10.113.202.182:3080 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May 24 09:42:19 2012 10.113.202.182:3080 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May 24 09:42:19 2012 10.113.202.182:3080 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu May 24 09:42:19 2012 10.113.202.182:3080 [SpencersSwingBridge] Peer Connection Initiated with 10.113.202.182:3080
Thu May 24 09:42:19 2012 SpencersSwingBridge/10.113.202.182:3080 OPTIONS IMPORT: reading client specific options from: CCD\SpencersSwingBridge
Thu May 24 09:42:19 2012 SpencersSwingBridge/10.113.202.182:3080 MULTI: Learn: 172.16.100.2 -> SpencersSwingBridge/10.113.202.182:3080
Thu May 24 09:42:19 2012 SpencersSwingBridge/10.113.202.182:3080 MULTI: primary virtual IP for SpencersSwingBridge/10.113.202.182:3080: 172.16.100.2
Thu May 24 09:42:19 2012 SpencersSwingBridge/10.113.202.182:3080 MULTI: internal route 172.16.78.0/24 -> SpencersSwingBridge/10.113.202.182:3080
Thu May 24 09:42:19 2012 SpencersSwingBridge/10.113.202.182:3080 MULTI: Learn: 172.16.78.0/24 -> SpencersSwingBridge/10.113.202.182:3080
Thu May 24 09:42:22 2012 SpencersSwingBridge/10.113.202.182:3080 PUSH: Received control message: 'PUSH_REQUEST'
Thu May 24 09:42:22 2012 SpencersSwingBridge/10.113.202.182:3080 SENT CONTROL [SpencersSwingBridge]: 'PUSH_REPLY,route-gateway 172.16.100.1,topology subnet,ifconfig 172.16.100.2 255.255.255.0' (status=1)

Comments
------------

In the above config I can ping:

172.16.100.1 ( this is the open vpn server)
172.16.100.2 (This is our client. It should be mapped to 172.16.78.X but for some reason it is not!)

Thanks again.

maikcat

please try the following...

1)update openvpn binary to server (you MUST have tap v8.2 and above for topology subnet to work..)
2)for testing use this on your ccd file:
ifconfig-push 172.16.100.10 255.255.255.0
iroute 172.16.78.0 255.255.255.0

your client must get 172.16.100.10 ip

check routing tables on both server & client (for 172.16.78.0 network)

can you post the output of netstat -nr on both pcs?

Michael.

coopertronic

I will try this.

The version of openvpn we are using is: OpenVPN 2.1.3 however I will get the latest (2.2.2 i believe).

The TAP driver on the server is "TAP-Win32 Driver Version 9.7" so should be okay.

I will install Ver 2.2.2, then make the modifications you suggest and I will get back to you with my findings!

coopertronic

Okay.. Using the command:

ifconfig-push 172.16.100.10 255.255.255.0

in the CCD file has given the client a fixed IP address of 172.16.100.10 when it comes online and I am able to ping this address.

However the routing command (iroute) still does not work in the CCD file:

I have tried these permutations:

iroute 172.16.47.0 255.255.255.0
iroute 172.16.47.0 255.255.255.0 172.16.100.10
iroute 172.16.47.0 255.255.255.0 172.16.100.1

all to no avail.

This is my current setup now:

Server Config
--------------------------------------------
server 172.16.100.0 255.255.255.0
topology subnet
management 127.0.0.1 45678
ca ca.crt
key SCADAAPP1.key
cert SCADAAPP1.crt
dh dh1024.pem
proto udp
lport 5501
rport 5501
comp-lzo
cipher BF-CBC
tun-mtu 1500
ping 30
ping-restart 60
verb 3
dev tun
float
client-to-client
client-config-dir CCD
route-method exe
route-delay 2

CCD File
--------------------------------
ifconfig-push 172.16.100.10 255.255.255.0
iroute 172.16.47.0 255.255.255.0
#iroute 172.16.47.0 255.255.255.0 172.16.100.10
#iroute 172.16.47.0 255.255.255.0 172.16.100.1

Log File
--------------------------------
Thu May 24 11:58:13 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Thu May 24 11:58:13 2012 MANAGEMENT: TCP Socket listening on 127.0.0.1:45678
Thu May 24 11:58:13 2012 WARNING: --keepalive option is missing from server config
Thu May 24 11:58:13 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu May 24 11:58:13 2012 Diffie-Hellman initialized with 1024 bit key
Thu May 24 11:58:13 2012 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu May 24 11:58:13 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu May 24 11:58:13 2012 TAP-WIN32 device [Local Area Connection 4] opened: \\.\Global\{6299E4C3-7319-4401-BE7A-F98E2CE8AB25}.tap
Thu May 24 11:58:13 2012 TAP-Win32 Driver Version 9.9
Thu May 24 11:58:13 2012 TAP-Win32 MTU=1500
Thu May 24 11:58:13 2012 Set TAP-Win32 TUN subnet mode network/local/netmask = 172.16.100.0/172.16.100.1/255.255.255.0 [SUCCEEDED]
Thu May 24 11:58:13 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 172.16.100.1/255.255.255.0 on interface {6299E4C3-7319-4401-BE7A-F98E2CE8AB25} [DHCP-serv: 172.16.100.254, lease-time: 31536000]
Thu May 24 11:58:13 2012 Sleeping for 2 seconds...
Thu May 24 11:58:15 2012 Successful ARP Flush on interface [131074] {6299E4C3-7319-4401-BE7A-F98E2CE8AB25}
Thu May 24 11:58:15 2012 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu May 24 11:58:15 2012 UDPv4 link local (bound): [undef]:5501
Thu May 24 11:58:15 2012 UDPv4 link remote: [undef]
Thu May 24 11:58:15 2012 MULTI: multi_init called, r=256 v=256
Thu May 24 11:58:15 2012 IFCONFIG POOL: base=172.16.100.2 size=252
Thu May 24 11:58:15 2012 Initialization Sequence Completed
Thu May 24 11:59:06 2012 MULTI: multi_create_instance called
Thu May 24 11:59:06 2012 10.112.202.166:3075 Re-using SSL/TLS context
Thu May 24 11:59:06 2012 10.112.202.166:3075 LZO compression initialized
Thu May 24 11:59:06 2012 10.112.202.166:3075 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu May 24 11:59:06 2012 10.112.202.166:3075 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu May 24 11:59:06 2012 10.112.202.166:3075 Local Options hash (VER=V4): '530fdded'
Thu May 24 11:59:06 2012 10.112.202.166:3075 Expected Remote Options hash (VER=V4): '41690919'
Thu May 24 11:59:06 2012 10.112.202.166:3075 TLS: Initial packet from 10.112.202.166:3075, sid=f2e47ae7 d94e838e
Thu May 24 11:59:13 2012 10.112.202.166:3075 VERIFY OK: depth=1, /C=UK/ST=Hatton/L=Warwickshire/O=companyname/OU=SCADA/CN=SCADAAPP1/emailAddress=scadateam@companyname.co.uk
Thu May 24 11:59:13 2012 10.112.202.166:3075 VERIFY OK: depth=0, /C=UK/ST=Hatton/O=companyname/CN=CityMillsLock/emailAddress=scadateam@companyname.co.uk
Thu May 24 11:59:13 2012 10.112.202.166:3075 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May 24 11:59:13 2012 10.112.202.166:3075 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May 24 11:59:13 2012 10.112.202.166:3075 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May 24 11:59:13 2012 10.112.202.166:3075 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May 24 11:59:14 2012 10.112.202.166:3075 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu May 24 11:59:14 2012 10.112.202.166:3075 [CityMillsLock] Peer Connection Initiated with 10.112.202.166:3075
Thu May 24 11:59:14 2012 CityMillsLock/10.112.202.166:3075 OPTIONS IMPORT: reading client specific options from: CCD\CityMillsLock
Thu May 24 11:59:14 2012 CityMillsLock/10.112.202.166:3075 MULTI: Learn: 172.16.100.10 -> CityMillsLock/10.112.202.166:3075
Thu May 24 11:59:14 2012 CityMillsLock/10.112.202.166:3075 MULTI: primary virtual IP for CityMillsLock/10.112.202.166:3075: 172.16.100.10
Thu May 24 11:59:14 2012 CityMillsLock/10.112.202.166:3075 MULTI: internal route 172.16.47.0/24 -> CityMillsLock/10.112.202.166:3075
Thu May 24 11:59:14 2012 CityMillsLock/10.112.202.166:3075 MULTI: Learn: 172.16.47.0/24 -> CityMillsLock/10.112.202.166:3075
Thu May 24 11:59:15 2012 CityMillsLock/10.112.202.166:3075 PUSH: Received control message: 'PUSH_REQUEST'
Thu May 24 11:59:15 2012 CityMillsLock/10.112.202.166:3075 SENT CONTROL [CityMillsLock]: 'PUSH_REPLY,route-gateway 172.16.100.1,topology subnet,ifconfig 172.16.100.10 255.255.255.0' (status=1)

You asked for a netstat -nr. Here is the results of the command from the server

netstat from server
----------------------------------------

IPv4 Route Table
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x10004 ...00 11 43 d7 24 62 ...... Intel(R) PRO/1000 MT Network Connection
0x20002 ...00 ff 62 99 e4 c3 ...... TAP-Win32 Adapter V9
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.97.10.1 10.97.200.2 10
10.17.1.239 255.255.255.255 10.97.10.25 10.97.200.2 1
10.17.1.240 255.255.255.255 10.97.10.25 10.97.200.2 1
10.17.10.11 255.255.255.255 10.97.10.25 10.97.200.2 1
10.97.0.0 255.255.0.0 10.97.200.2 10.97.200.2 10
10.97.200.2 255.255.255.255 127.0.0.1 127.0.0.1 10
10.109.50.136 255.255.255.255 10.97.10.25 10.97.200.2 1
10.109.50.145 255.255.255.255 10.97.10.25 10.97.200.2 1
10.109.50.146 255.255.255.255 10.97.10.25 10.97.200.2 1
10.109.50.147 255.255.255.255 10.97.10.25 10.97.200.2 1
10.109.50.148 255.255.255.255 10.97.10.25 10.97.200.2 1
10.109.50.167 255.255.255.255 10.97.10.25 10.97.200.2 1
10.109.50.179 255.255.255.255 10.97.10.25 10.97.200.2 1
10.109.50.181 255.255.255.255 10.97.10.25 10.97.200.2 1
10.109.50.200 255.255.255.255 10.97.10.25 10.97.200.2 1
10.109.200.2 255.255.255.255 10.97.10.25 10.97.200.2 1
10.109.200.3 255.255.255.255 10.97.10.25 10.97.200.2 1
10.109.200.20 255.255.255.255 10.97.10.25 10.97.200.2 1
10.109.200.21 255.255.255.255 10.97.10.25 10.97.200.2 1
10.109.200.72 255.255.255.255 10.97.10.25 10.97.200.2 1
10.255.255.255 255.255.255.255 10.97.200.2 10.97.200.2 10
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
172.16.8.2 255.255.255.255 10.97.10.25 10.97.200.2 1
172.16.9.2 255.255.255.255 10.97.10.25 10.97.200.2 1
172.16.15.2 255.255.255.255 10.97.10.25 10.97.200.2 1
172.16.16.2 255.255.255.255 10.97.10.25 10.97.200.2 1
172.16.18.2 255.255.255.255 10.97.10.25 10.97.200.2 1
172.16.36.2 255.255.255.255 10.97.10.25 10.97.200.2 1
172.16.37.2 255.255.255.255 10.97.10.25 10.97.200.2 1
172.16.39.2 255.255.255.255 10.97.10.25 10.97.200.2 1
172.16.40.2 255.255.255.255 10.97.10.25 10.97.200.2 1
172.16.41.2 255.255.255.255 10.97.10.25 10.97.200.2 1
172.16.42.2 255.255.255.255 10.97.10.25 10.97.200.2 1
172.16.43.2 255.255.255.255 10.97.10.25 10.97.200.2 1
172.16.46.2 255.255.255.255 10.97.10.25 10.97.200.2 1
172.16.47.2 255.255.255.255 10.97.10.25 10.97.200.2 1
172.16.51.2 255.255.255.255 10.97.10.25 10.97.200.2 1
172.16.54.2 255.255.255.255 10.97.10.25 10.97.200.2 1
172.16.100.0 255.255.255.0 172.16.100.1 172.16.100.1 30
172.16.100.1 255.255.255.255 127.0.0.1 127.0.0.1 30
172.16.255.255 255.255.255.255 172.16.100.1 172.16.100.1 30
224.0.0.0 240.0.0.0 10.97.200.2 10.97.200.2 10
224.0.0.0 240.0.0.0 172.16.100.1 172.16.100.1 30
255.255.255.255 255.255.255.255 10.97.200.2 10.97.200.2 1
255.255.255.255 255.255.255.255 172.16.100.1 172.16.100.1 1
Default Gateway: 10.97.10.1
===========================================================================
Persistent Routes:
None

Unfortunatly the client is not a windows machine. Even though I can log onto the modem I dont think I am able to issue a netstat command from there.

So just to recap. We are now able to get a fixed IP for our devices but are unable to access the subnet behind that device.

In the above client we are giving it an iroute of 172.16.47.0. I would expect to be able to access:

172.16.47.1
172.16.47.2
172.16.47.X - etc

One thing I did do was to add the following route to the server config:

route 172.16.47.0 255.255.0.0 172.16.100.10

The thinking there to direct any traffic to 172.16.47.X to the gateway 172.16.100.10 which is what the client comes online with now but that gives us an error in the log when I try that:

Thu May 24 12:09:26 2012 C:\WINDOWS\system32\route.exe ADD 172.16.47.0 MASK 255.255.0.0 172.16.100.10
The route addition failed: The specified mask parameter is invalid. (Destination & Mask) != Destination.

maikcat

if you use this into server config,

route 172.16.47.0 255.255.255.0 172.16.100.10

any change?

Michael.

coopertronic

Just to add to this, from the command line I have just tried adding the route manually:

route.exe ADD 172.16.47.0 MASK 255.255.255.0 172.16.100.10

This command succeeds but still does not let me ping the subnet

D:\Program Files\Microsoft Visual Studio 10.0\VC>tracert 172.16.47.2

Tracing route to 172.16.47.2 over a maximum of 30 hops

1 <1 ms <1 ms <1 ms 10.97.10.25
2 * * * Request timed out.
3 * ^C
D:\Program Files\Microsoft Visual Studio 10.0\VC>route.exe ADD 172.16.47.0 MASK
255.255.255.0 172.16.100.10

D:\Program Files\Microsoft Visual Studio 10.0\VC>tracert 172.16.47.2

Tracing route to 172.16.47.2 over a maximum of 30 hops

1 <1 ms <1 ms <1 ms 10.97.10.25
2 * * * Request timed out.
3 * * * Request timed out.
4 * * * Request timed out.

coopertronic

if you use this into server config,

route 172.16.47.0 255.255.255.0 172.16.100.10

any change?

I will try this now Maikcat

coopertronic

Quote:

if you use this into server config,

route 172.16.47.0 255.255.255.0 172.16.100.10

any change?

I will try this now Maikcat

OMG!!!! That looks like it..... works!!! 😃 😃 😃

So.... The difference between your route and mine is the 2nd octet of the subnet mask

Mine = route 172.16.47.0 255.255.0.0 172.16.100.10
Yours = route 172.16.47.0 255.255.255.0 172.16.100.10

maikcat

So.... The difference between your route and mine is the 2nd octet of the subnet mask

Mine = route 172.16.47.0 255.255.0.0 172.16.100.10
Yours = route 172.16.47.0 255.255.255.0 172.16.100.10

yeap....

its

172.16.0.0 255.255.0.0 (16bit mask) or
172.16.47.0 255.255.255.0 (24bit mask)

🙂

glad to solve this out.

closing topic.

Michael.