[resolved] tun setup help

kurt2439

I have a CentOS5 machine with 1 NIC that I want to be my OpenVPN server. I would like to have it setup to route from the VPN subnet to my private LAN. Right now, I can connect remotely (forwarded from WAN Router) and I get an IP address in the VPN subnet (10.8.0.6) but I cannot ping the OpenVPN Server (10.8.0.1). I can't ping the client from the openvpn server either.

I tried this setup using tap instead of tun and I could ping the OpenVPN server no problem but couldn't get out from there to the remote private LAN. But I saw that tun is highly recommended for IP traffic so I'll try to get this to work...

I'm missing something here, probably something simple -- but I cannot figure it out =o(

server.conf
-----
port 1194
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key # This file should be kept secret
dh /etc/openvpn/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"
duplicate-cn
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3

client.conf
-------
client
dev tun
proto udp
remote a-real-host.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
comp-lzo
verb 3

Here is the windows (client) route list
--------------
===========================================================================
Interface List
37...00 ff 02 ad 21 e7 ......TeamViewer VPN Adapter
36...00 ff f7 ff 69 c2 ......TAP-Win32 Adapter V9
25...00 ff 09 1d 4e bf ......XCETAP0 Adapter
14...1c 6f 65 d1 dd 41 ......Realtek PCIe GBE Family Controller #2
32...00 50 56 c0 00 01 ......VMware Virtual Ethernet Adapter for VMnet1
33...00 50 56 c0 00 08 ......VMware Virtual Ethernet Adapter for VMnet8
27...00 09 0f fe 00 01 ......Fortinet virtual adapter
1...........................Software Loopback Interface 1
12...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
38...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
31...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
20...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #6
34...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #5
35...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #7
26...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #8
28...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #9
30...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #10
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.10.1 192.168.10.12 10
10.8.0.4 255.255.255.252 On-link 10.8.0.6 286
10.8.0.6 255.255.255.255 On-link 10.8.0.6 286
10.8.0.7 255.255.255.255 On-link 10.8.0.6 286
10.67.101.0 255.255.255.0 On-link 10.67.101.1 286
10.67.101.1 255.255.255.255 On-link 10.67.101.1 286
10.67.101.255 255.255.255.255 On-link 10.67.101.1 286
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.10.0 255.255.255.0 On-link 192.168.10.12 266
192.168.10.12 255.255.255.255 On-link 192.168.10.12 266
192.168.10.255 255.255.255.255 On-link 192.168.10.12 266
192.168.80.0 255.255.255.0 On-link 192.168.80.1 276
192.168.80.1 255.255.255.255 On-link 192.168.80.1 276
192.168.80.255 255.255.255.255 On-link 192.168.80.1 276
192.168.111.0 255.255.255.0 On-link 192.168.111.1 276
192.168.111.1 255.255.255.255 On-link 192.168.111.1 276
192.168.111.255 255.255.255.255 On-link 192.168.111.1 276
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.10.12 266
224.0.0.0 240.0.0.0 On-link 10.8.0.6 286
224.0.0.0 240.0.0.0 On-link 10.67.101.1 286
224.0.0.0 240.0.0.0 On-link 192.168.80.1 276
224.0.0.0 240.0.0.0 On-link 192.168.111.1 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.10.12 266
255.255.255.255 255.255.255.255 On-link 10.8.0.6 286
255.255.255.255 255.255.255.255 On-link 10.67.101.1 286
255.255.255.255 255.255.255.255 On-link 192.168.80.1 276
255.255.255.255 255.255.255.255 On-link 192.168.111.1 276
===========================================================================
Persistent Routes:
None

Mimiko

In your CentOS did you enabled forwarding? Read this: https://forums.openvpn.net/topic9465.html

maikcat

also disable for testing any firewall rules on centos.

what version of windows & openvpn are you using on your client?

Michael.

kurt2439

IP Forwarding was already on. IPtables was already off

Here is the output from the Windows client ( version 2.2.2 ) connection. I noticed it was failing to flush ARP and set some settings so I re-ran openvpn as administrator and it seems to work better.

Now I can ping my OpenVPN server at 10.8.0.1 but nothing outside of the VPN LAN. Interestingly, my OpenVPN server still can't ping the client.

Thu May 31 10:32:31 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Thu May 31 10:32:31 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu May 31 10:32:31 2012 LZO compression initialized
Thu May 31 10:32:31 2012 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu May 31 10:32:31 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu May 31 10:32:31 2012 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu May 31 10:32:31 2012 Local Options hash (VER=V4): '41690919'
Thu May 31 10:32:31 2012 Expected Remote Options hash (VER=V4): '530fdded'
Thu May 31 10:32:31 2012 UDPv4 link local: [undef]
Thu May 31 10:32:31 2012 UDPv4 link remote: 216.195.213.56:1194
Thu May 31 10:32:31 2012 TLS: Initial packet from 216.195.213.56:1194, sid=89f84cf0 574d0e84
Thu May 31 10:32:31 2012 VERIFY OK: depth=1, /C=US/ST=MA/L=Boston/O=SP/OU=Tech/CN=OpenVPN-CA/name=sysadmin@shambhala.com/emailAddress=sysadmin@shambhala.com
Thu May 31 10:32:31 2012 VERIFY OK: nsCertType=SERVER
Thu May 31 10:32:31 2012 VERIFY OK: depth=0, /C=US/ST=MA/L=Boston/O=SP/OU=Tech/CN=server/name=SP_TECH/emailAddress=sysadmin@shambhala.com
Thu May 31 10:32:35 2012 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May 31 10:32:35 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May 31 10:32:35 2012 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu May 31 10:32:35 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May 31 10:32:35 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu May 31 10:32:35 2012 [server] Peer Connection Initiated with 216.195.213.56:1194
Thu May 31 10:32:37 2012 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu May 31 10:32:37 2012 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9'
Thu May 31 10:32:37 2012 OPTIONS IMPORT: timers and/or timeouts modified
Thu May 31 10:32:37 2012 OPTIONS IMPORT: --ifconfig/up options modified
Thu May 31 10:32:37 2012 OPTIONS IMPORT: route options modified
Thu May 31 10:32:37 2012 ROUTE default_gateway=192.168.10.1
Thu May 31 10:32:37 2012 TAP-WIN32 device [Local Area Connection 5] opened: \\.\Global\{F7FF69C2-675E-4DB2-9F23-F98DD0C19131}.tap
Thu May 31 10:32:37 2012 TAP-Win32 Driver Version 9.9
Thu May 31 10:32:37 2012 TAP-Win32 MTU=1500
Thu May 31 10:32:37 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.10/255.255.255.252 on interface {F7FF69C2-675E-4DB2-9F23-F98DD0C19131} [DHCP-serv: 10.8.0.9, lease-time: 31536000]
Thu May 31 10:32:37 2012 Successful ARP Flush on interface [36] {F7FF69C2-675E-4DB2-9F23-F98DD0C19131}
Thu May 31 10:32:42 2012 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Thu May 31 10:32:42 2012 C:\WINDOWS\system32\route.exe ADD 192.168.1.0 MASK 255.255.255.0 10.8.0.9
Thu May 31 10:32:42 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu May 31 10:32:42 2012 Route addition via IPAPI succeeded [adaptive]
Thu May 31 10:32:42 2012 C:\WINDOWS\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.9
Thu May 31 10:32:42 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu May 31 10:32:42 2012 Route addition via IPAPI succeeded [adaptive]
Thu May 31 10:32:42 2012 Initialization Sequence Completed

janjust

the IP address of the client in your setup is 10.8.0.10 ; if you cannot ping this address it is most likely caused by the fact that windows vista/7 do not trust the tap-win32 adapter by default; make the tap-win32 adapter part of your 'home' or 'work' network group and ping traffic should be possible. After that, everything else boils down to routing 😉

kurt2439

Ahh, well yes I know that routing is the issue -- it's trying to figure out what I am missing in the routing that I am looking for help in.

here my openvpn server routes. Not sure why 10.8.0.2 figures in here. At one point my openvpn client had that IP
-------------

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
192.168.1.0 * 255.255.255.0 U 0 0 0 eth0
169.254.0.0 * 255.255.0.0 U 0 0 0 eth0
default 192.168.1.1 0.0.0.0 UG 0 0 0 eth0

kurt2439

OK, I solved this. In the end, it was very simple as I suspected but I got tripped up by initially using the tap0 interface and then not running OpenVPN GUI as Admin in windows.

Once I turned iptables back ON in CentOS (openvpn server) and through in the masquerading rule, it all started working as expected. It was much simpler to troubleshoot once I switched from windows to my fedora laptop since at that point I stopped freaking out about Windows hiding something from me or breaking in some unnatural way and just concentrated on the symptoms.