Client IP address assigned but client can't ping/be pinged

Gordon1M

I have had to rebuild my WinXP SP3 machine that is running OpenVPN and I am now trying to get OpenVPN to work again, currently without success.

I am using TAP and TCP.

The server is running on 192.168.17.101.

To avoid the inconvenience of having to go to another location to connect the client, I have set it up on a separate sub-net. I think that this is ok for testing. The client ip address is 192.168.0.100. To establish the subnet, I have connected the WAN port of an additional router to one of the LAN ports of the existing router.

I have tried turning off Windows Firewall on both server and client machines .... this doesn't help.

This is my server.ovpn

port 443
dev tap
ca "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\server.crt"
key "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\server.key"
dh "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\dh1024.pem"
ifconfig-pool-persist ipp.txt
server-bridge 192.168.17.101 255.255.255.0 192.168.17.240 192.168.17.250
keepalive 10 120
comp-lzo
persist-key
status openvpn-status.log
verb 3

This is the client1.ovpn

client
dev tap
proto tcp
remote mydomain.com 443
resolv-retry infinite
nobind
persist-key
persist-tun
ca "E:\\Program files\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "E:\\Program Files\\OpenVPN\\easy-rsa\\keys\\client1.crt"
key "E:\\Program files\\OpenVPN\\easy-rsa\\keys\\client1.key"
comp-lzo
verb 3

The client obtains a correct IP address from the server pool, but I cannot ping anything on the LAN from the client. The client can't be pinged from any other machine on the LAN either.

Any help would be apprecaite.

Thank you
GordonM

janjust

you're using 'server-bridge' . any reason to do so? can you try it using just 'server' ? did you actually bridge the server-side tap-win32 adapter to another network adapter?

which hosts can you not ping? can you ping the server VPN IP (192.168.17.101 in your setup).

Gordon1M

I don't know what happened, but my reply just disappeared. The follow are ipconfig /all on the client side and the server and (anonymized) client logs respectively. I wonder if they provide any clues. I had forgotten to bridge the server but doing so didn't help. I used server-bridge because I want to use TAP. My impression is that this is needed for TAP.

Thank you
Gordon1M

Windows IP Configuration
Host Name . . . . . . . . . . . . : eeepc701
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Mixed
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection 9:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TAP-Win32 Adapter V9
Physical Address. . . . . . . . . : 00-FF-0A-F7-35-86
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.17.240
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : EMPTY. MAYBE THIS IS NOT RIGHT.
DHCP Server . . . . . . . . . . . : 192.168.17.0 ..... NOT SURE THIS IS RIGHT.
Lease Obtained. . . . . . . . . . : June 5, 2012 5:35:29 PM
Lease Expires . . . . . . . . . . : June 5, 2013 5:35:29 PM

Ethernet adapter Local Area Connection 2:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Atheros L2 Fast Ethernet 10/100 Base-T Controller

Physical Address. . . . . . . . . : 00-1E-8C-72-AE-E9
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.0.100
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DNS Servers . . . . . . . . . . . : 192.168.0.1
Lease Obtained . . . . . . . . . . : June 5, 2012 5:34:32 PM
Lease Expires . . . . . . . . . . : June 6, 2012 5:34:32 PM

Tue Jun 05 22:16:16 2012 OpenVPN 2.0.9 Win32-MinGW [SSL] [LZO] built on Oct 1 2006
Tue Jun 05 22:16:16 2012 Diffie-Hellman initialized with 1024 bit key
Tue Jun 05 22:16:16 2012 TLS-Auth MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue Jun 05 22:16:16 2012 TAP-WIN32 device [Local Area Connection 7] opened: \\.\Global\{9CAB8083-D9E8-40CD-A7AF-234C32F98261}.tap
Tue Jun 05 22:16:16 2012 TAP-Win32 Driver Version 8.4
Tue Jun 05 22:16:16 2012 TAP-Win32 MTU=1500
Tue Jun 05 22:16:16 2012 Sleeping for 10 seconds...
Tue Jun 05 22:16:26 2012 Successful ARP Flush on interface [524290] {9CAB8083-D9E8-40CD-A7AF-234C32F98261}
Tue Jun 05 22:16:26 2012 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Jun 05 22:16:26 2012 Listening for incoming TCP connection on [undef]:443
Tue Jun 05 22:16:26 2012 TCPv4_SERVER link local (bound): [undef]:443
Tue Jun 05 22:16:26 2012 TCPv4_SERVER link remote: [undef]
Tue Jun 05 22:16:26 2012 MULTI: multi_init called, r=256 v=256
Tue Jun 05 22:16:26 2012 IFCONFIG POOL: base=192.168.17.240 size=11
Tue Jun 05 22:16:26 2012 IFCONFIG POOL LIST
Tue Jun 05 22:16:26 2012 client1,192.168.17.240
Tue Jun 05 22:16:26 2012 client2,192.168.17.241
Tue Jun 05 22:16:26 2012 MULTI: TCP INIT maxclients=60 maxevents=64
Tue Jun 05 22:16:26 2012 Initialization Sequence Completed

Tue Jun 05 21:28:12 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Tue Jun 05 21:28:12 2012 WARNING: No server certificate verification method has been enabled .......
Tue Jun 05 21:28:12 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call .......
Tue Jun 05 21:28:13 2012 LZO compression initialized
Tue Jun 05 21:28:13 2012 Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue Jun 05 21:28:13 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Jun 05 21:28:13 2012 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Jun 05 21:28:13 2012 Local Options hash (VER=V4): '.......'
Tue Jun 05 21:28:13 2012 Expected Remote Options hash (VER=V4): '.......'
Tue Jun 05 21:28:13 2012 Attempting to establish TCP connection with XXX.XXX.XXX.XXX:443
Tue Jun 05 21:28:13 2012 TCP connection established with XXX.XXX.XXX.XXX:443
Tue Jun 05 21:28:13 2012 TCPv4_CLIENT link local: [undef]
Tue Jun 05 21:28:13 2012 TCPv4_CLIENT link remote: XXX.XXX.XXX.XXX:443
Tue Jun 05 21:28:13 2012 TLS: Initial packet from 184.175.21.136:443, sid=29923d54 31e6e8b0
Tue Jun 05 21:28:13 2012 VERIFY OK: depth=1, /C=CA/ST=XXXXX/L=XXXXX/O=XXXXX/OU=XXXXX/CN=XXXXX/emailAddress=XXXXX@XXXXX.com
Tue Jun 05 21:28:13 2012 VERIFY OK: depth=0, /C=CA/ST=XXXXX/O=XXXXX/OU=XXXXX/CN=XXXXX/emailAddress=XXXXX@XXXXX.com
Tue Jun 05 21:28:14 2012 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jun 05 21:28:14 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jun 05 21:28:14 2012 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jun 05 21:28:14 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jun 05 21:28:14 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Jun 05 21:28:14 2012 [XXXXX] Peer Connection Initiated with XXX.XXX.XXX.XXX:443
Tue Jun 05 21:28:16 2012 SENT CONTROL [gordonmarwood.com]: 'PUSH_REQUEST' (status=1)
Tue Jun 05 21:28:16 2012 PUSH: Received control message: 'PUSH_REPLY,route-gateway 192.168.17.101,ping 10,ping-restart 120,ifconfig 192.168.17.240 255.255.255.0'
Tue Jun 05 21:28:16 2012 OPTIONS IMPORT: timers and/or timeouts modified
Tue Jun 05 21:28:16 2012 OPTIONS IMPORT: --ifconfig/up options modified
Tue Jun 05 21:28:16 2012 OPTIONS IMPORT: route-related options modified
Tue Jun 05 21:28:16 2012 TAP-WIN32 device [Local Area Connection 9] opened: \\.\Global\{0AF73586-1794-4DFF-942A-CF0430C0D6E5}.tap
Tue Jun 05 21:28:16 2012 TAP-Win32 Driver Version 9.9
Tue Jun 05 21:28:16 2012 TAP-Win32 MTU=1500
Tue Jun 05 21:28:16 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.17.240/255.255.255.0 on interface {0AF73586-1794-4DFF-942A-CF0430C0D6E5} [DHCP-serv: 192.168.17.0, lease-time: 31536000]
Tue Jun 05 21:28:16 2012 Successful ARP Flush on interface [917506] {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXX}
Tue Jun 05 21:28:21 2012 TEST ROUTES: 0/0 succeeded len=-1 ret=1 a=0 u/d=up
Tue Jun 05 21:28:21 2012 Initialization Sequence Completed

janjust

server bridging is not required in order to use TAP; it's the other way round: if you need bridging then you must use TAP. The main other reasons for using TAP is to route non-IP traffic over the VPN.

As for your setup: the VPN server does not do IP forwarding; this might cause routing problems to your server side LAN
The 'ipconfig /all' output does not look strange - there is no default gateway for the tap-win32 adapter because you did not specify one (and perhaps don't need one). Try pinging the VPN IP of the server from the client - does that work?

Gordon1M

Janjust, thank you for your continuing help. I have discovered what is clearly a problem on the server side. The TAP adapter is showing a link local address of 169.254 .....

When you say "Try pinging the VPN IP of the server from the client", I am not clear what this address is in my current set up. With the server-bridge directive that I am using, the first IP address in the pool is beng allocatied to the first client, not the server.

Maybe, as you implied earlier, I should be using "server" rather than "server-bridge". If so, if I use "server 10.8.0.0 255.255.255.0", does this mean that I have to forward port 443 (in my case) in the router to 10.8.0.1 rather than to the "real" address of the server of 192.168.17.101?

Also, would I be correct in thinking that, if I don't use "server-bridge", I shouldn't use network bridging at either the server or client end?

I have to say that I have yet to find instructions that are foolproof and complete. It seems that these instructions are written by experts and newbies don't understand what experts understand!

Thank you.

Gordon1M

janjust

if you use 'server-bridge' then you have to set the IP address of the bridged adapter manually (this is a Windows thing, not per se OpenVPN related). If you switch to 'server' and keep everything else the same then the server should be assigned the first available IP from the pool. In that case you will have to set up proper routing to ensure that traffic from the VPN clients reaches the server-side LAN and vice versa.

The client log you posted showed that the client was assigned the right address.

Gordon1M

Thank you again. I now have things working, at least through my isolated sub-net.

In fact it was the bridge where the IP address information had to be entered manually, not the "bridged adapter". Maybe you meant the bridge.

I am going to test the connection from a truly external connection, but I suspect that it will work.

Thank you
Gordon1M