Hi All,Good day.
I have a Openvpn server running in internet using TCP..I can use it well from 1 PC where I am not inside any LAN.
But when I use it from inside LAN ( 10.x.x.x) where traffic needs to pass through LAN Proxy ( 10.xx.xx.xx )
Can not PING server and can use not Browse Internet through VPN server. Though VPN setup complete successfully.
After investigating what I am trying to understand It can be routing issue in Client side. Client traffic not being passes through VPN and timeout occurs.
For Information:-->
Client machine gets IP..10.x.x.x in LAN
LAN Proxy server is => 10.71.170.5
Pls note that (for some requirement ) we use
--remote 127.0.0.1 25000
in client config.
We run a small TCP port forwarding program ( handle traffic between vpn client and LAN proxy ) in port 25000 in client machine..which talks with Proxy server / handle Proxy HTTP CONNECT method and handle response.
So openvpn client does not know anything about Proxy server.
For that reason we added explicitly
push "route 10.71.170.5 255.255.255.255 net_gateway"
in server config.
So that traffic towards 10.71.170.5 does not use VPN tunnel.
Following are details.
If any expert please focus what I am doing wrong.
Aslo secondly , I wanted ot do following in server config
push "route 10.0.0.0 255.0.0.0 net_gateway"
But at that case I get following error in client
<<potential route subnet conflict between local LAN [10.106.149.162/255.255.255.255] and remote VPN [10.0.0.0/255.0.0.0]>>
So for now I removed it. But I will be needing it. I do not want any LAN traffic pass through VPN tunnel.
Details
=========
Ping Result From client
=============
Pinging 192.168.0.1 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 192.168.0.1:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
Firewall Config
================
iptables -A FORWARD -s 192.168.0.0/24 -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE
Client Config:
=================
"C:\Users\AES\Documents\tmp\misc\openvpn.exe" --client --dev tun --status "C:\Users\AES\Documents\tmp\misc\vpn_bandwidthUsage.txt" --resolv-retry infinite --persist-key --persist-tun --auth-nocache --ns-cert-type server --verb 3 --reneg-sec 28800 --ca "C:\Users\AES\Documents\tmp\misc\ca.crt" --cipher none --auth-user-pass "C:\Users\AES\Documents\tmp\misc\vpn_password.txt" --script-security 2 --remote 127.0.0.1 25000 --nobind --route-method exe --route-delay 2 --mssfix 1400 --proto tcp --sndbuf 131072 --rcvbuf 131072
Server.conf
==================
local xx.xx.x.xx # This is the IP address of the real network interface on the server connected to the router
port 80
proto tcp
dev tun2
dev-node /dev/net/tun2
dev-type tun
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "redirect-gateway def1 bypass-dhcp"
#push "dhcp-option DNS 10.8.0.1"
#push "dhcp-option DNS 8.8.8.8"
#push "dhcp-option DNS 8.8.4.4"
keepalive 10 100
#comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 4
script-security 3
#auth none
cipher none
#route 10.8.0.1 255.255.255.0
#push "route 10.8.0.2 255.255.255.0"
#route-method exe
#route-delay 2
#duplicate-cn
script-security 3
auth-user-pass-verify /etc/openvpn/auth.sh via-env
client-cert-not-required
username-as-common-name
push "route 10.71.170.5 255.255.255.255 net_gateway" # 10.71.170.5 is the main proxy server in client LAN
#push "route 224.0.0.0 240.0.0.0 net_gateway"
#push "route 10.0.0.0 255.0.0.0 net_gateway"
#push "route 172.16.0.0 255.240.0.0 net_gateway"
push "route 192.168.0.0 255.255.0.0 net_gateway"
push "route 127.0.0.0 255.0.0.0 net_gateway"
max-clients 50
client-connect /etc/openvpn/conn.sh
client-disconnect /etc/openvpn/disconn.sh
server 192.168.0.0 255.255.255.0
#server 11.8.0.0 255.255.255.0
#fragment 1400
#mssfix 1400
sndbuf 131072
rcvbuf 131072
tcp-nodelay
Client Routing table Before VPN connects
===========================================
IPv4 Route Table
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 On-link 10.91.97.206 31
10.91.97.206 255.255.255.255 On-link 10.91.97.206 286
127.0.0.0 255.0.0.0 On-link 127.0.0.1 4531
127.0.0.1 255.255.255.255 On-link 127.0.0.1 4531
127.255.255.255 255.255.255.255 On-link 127.0.0.1 4531
224.0.0.0 240.0.0.0 On-link 127.0.0.1 4531
224.0.0.0 240.0.0.0 On-link 10.91.97.206 31
255.255.255.255 255.255.255.255 On-link 127.0.0.1 4531
255.255.255.255 255.255.255.255 On-link 10.91.97.206 286
Client Routing table After VPN connects
===========================================
IPv4 Route Table
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 On-link 10.91.97.206 31
0.0.0.0 128.0.0.0 11.8.0.9 192.168.0.18 4256
0.0.0.0 128.0.0.0 192.168.0.17 192.168.0.18 4256
10.71.170.5 255.255.255.255 On-link 10.91.97.206 31
10.91.97.206 255.255.255.255 On-link 10.91.97.206 286
11.8.0.1 255.255.255.255 11.8.0.9 192.168.0.18 4256
127.0.0.0 255.0.0.0 On-link 127.0.0.1 4531
127.0.0.0 255.0.0.0 On-link 10.91.97.206 31
127.0.0.1 255.255.255.255 On-link 127.0.0.1 4531
127.0.0.1 255.255.255.255 On-link 10.91.97.206 31
127.255.255.255 255.255.255.255 On-link 127.0.0.1 4531
127.255.255.255 255.255.255.255 On-link 10.91.97.206 286
128.0.0.0 128.0.0.0 11.8.0.9 192.168.0.18 4256
128.0.0.0 128.0.0.0 192.168.0.17 192.168.0.18 4256
192.168.0.0 255.255.0.0 On-link 10.91.97.206 31
192.168.0.1 255.255.255.255 192.168.0.17 192.168.0.18 4256
192.168.0.16 255.255.255.252 On-link 192.168.0.18 4511
192.168.0.18 255.255.255.255 On-link 192.168.0.18 4511
192.168.0.19 255.255.255.255 On-link 192.168.0.18 4511
192.168.255.255 255.255.255.255 On-link 10.91.97.206 286
224.0.0.0 240.0.0.0 On-link 127.0.0.1 4531
224.0.0.0 240.0.0.0 On-link 192.168.0.18 4511
224.0.0.0 240.0.0.0 On-link 10.91.97.206 31
255.255.255.255 255.255.255.255 On-link 127.0.0.1 4531
255.255.255.255 255.255.255.255 On-link 192.168.0.18 4511
255.255.255.255 255.255.255.255 On-link 10.91.97.206 286
Client Log
===============
.....
......
Wed Jun 06 21:48:56 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Jun 06 21:48:56 2012 [xxx.com] Peer Connection Initiated with 127.0.0.1:25000
Wed Jun 06 21:48:58 2012 SENT CONTROL [xxx.com]: 'PUSH_REQUEST' (status=1)
Wed Jun 06 21:49:00 2012 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,redirect-gateway def1 bypass-dhcp,route 10.71.170.5 255.255.255.255 net_gateway,route 127.0.0.0 255.0.0.0 net_gateway,route 192.168.0.0 255.255.0.0 net_gateway,route 192.168.0.1,topology net30,ping 10,ping-restart 100,socket-flags TCP_NODELAY,ifconfig 192.168.0.18 192.168.0.17'
Wed Jun 06 21:49:00 2012 OPTIONS IMPORT: timers and/or timeouts modified
Wed Jun 06 21:49:00 2012 OPTIONS IMPORT: --socket-flags option modified
Wed Jun 06 21:49:00 2012 Socket flags: TCP_NODELAY=1 succeeded
Wed Jun 06 21:49:00 2012 OPTIONS IMPORT: --ifconfig/up options modified
Wed Jun 06 21:49:00 2012 OPTIONS IMPORT: route options modified
Wed Jun 06 21:49:00 2012 ROUTE default_gateway=10.91.97.206
Wed Jun 06 21:49:00 2012 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{7FFBE2A9-5E86-47FB-BC75-11D7BA228991}.tap
Wed Jun 06 21:49:00 2012 TAP-Win32 Driver Version 9.9
Wed Jun 06 21:49:00 2012 TAP-Win32 MTU=1500
Wed Jun 06 21:49:00 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.0.18/255.255.255.252 on interface {7FFBE2A9-5E86-47FB-BC75-11D7BA228991} [DHCP-serv: 192.168.0.17, lease-time: 31536000]
Wed Jun 06 21:49:00 2012 Successful ARP Flush on interface [14] {7FFBE2A9-5E86-47FB-BC75-11D7BA228991}
Wed Jun 06 21:49:02 2012 TEST ROUTES: 5/5 succeeded len=4 ret=1 a=0 u/d=up
Wed Jun 06 21:49:02 2012 C:\WINDOWS\system32\route.exe ADD 127.0.0.1 MASK 255.255.255.255 10.91.97.206
OK!
Wed Jun 06 21:49:02 2012 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 192.168.0.17
OK!
Wed Jun 06 21:49:02 2012 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 192.168.0.17
OK!
Wed Jun 06 21:49:02 2012 C:\WINDOWS\system32\route.exe ADD 10.71.170.5 MASK 255.255.255.255 10.91.97.206
OK!
Wed Jun 06 21:49:02 2012 C:\WINDOWS\system32\route.exe ADD 127.0.0.0 MASK 255.0.0.0 10.91.97.206
OK!
Wed Jun 06 21:49:02 2012 C:\WINDOWS\system32\route.exe ADD 192.168.0.0 MASK 255.255.0.0 10.91.97.206
OK!
Wed Jun 06 21:49:02 2012 C:\WINDOWS\system32\route.exe ADD 192.168.0.1 MASK 255.255.255.255 192.168.0.17
OK!
Wed Jun 06 21:49:02 2012 Initialization Sequence Completed
Wed Jun 06 21:50:49 2012 [xxx.com] Inactivity timeout (--ping-restart), restarting.
Server Log
======================
10.71.170.5 255.255.255.255 net_gateway,route 127.0.0.0 255.0.0.0 net_gateway,route 192.168.0.0 255.255.0.0 net_gateway,route 192.168.0.1,topology net30,ping 10,ping-restart 100,socket-flags TCP_NODELAY,ifconfig 192.168.0.22 192.168.0.21' (status=1)
xxx MULTI: bad source address from client [10.109.39.28], packet dropped
xxx MULTI: bad source address from client [10.109.39.28], packet dropped
xxx MULTI: bad source address from client [10.109.39.28], packet dropped
xxx MULTI: bad source address from client [10.109.39.28], packet dropped
xxx MULTI: bad source address from client [10.109.39.28], packet dropped
xxx MULTI: bad source address from client [10.109.39.28], packet dropped
xxx MULTI: bad source address from client [10.109.39.28], packet dropped
xxx: bad source address from client [10.109.39.28], packet dropped
xxx: bad source address from client [10.109.39.28], packet dropped
xxx: bad source address from client [10.109.39.28], packet dropped
xxx: bad source address from client [10.109.39.28], packet dropped
xxxMULTI: bad source address from client [10.109.39.28], packet dropped
xxx MULTI: bad source address from client [10.109.39.28], packet dropped
xxx MULTI: bad source address from client [10.109.39.28], packet dropped
xxx MULTI: bad source address from client [10.109.39.28], packet dropped
xxx: bad source address from client [10.109.39.28], packet dropped
xxx MULTI: bad source address from client [10.109.39.28], packet dropped
xxxMULTI: bad source address from client [10.109.39.28], packet dropped
xxx Connection reset, restarting [0]
xxx SIGUSR1[soft,connection-reset] received, client-instance restarting
Wed Jun 6 20:02:55 2012 us=763691 TCP/UDP: Closing socket
Thank you
Pada
