Hello to reader,
I've been working with openvpn for a while and learning how to configure and get it working.
I work with government and military websites and sensitive information. Reason why i rather use openvpn is that i don't know what other services use the logs for an i'm very strict about security and privacy.
I'm using a wifi connection from my uncle, but for some reason i don't have access inside the router.
I'm using the server and client on my laptop, i can get the server running to a certain point and goes in normal, but the client for some reason it will not go through and i have no clue if i did something wrong.
i read this link:
https://forums.openvpn.net/topic7815.html, i can follow the instructions, but the part on sharing the connection is checked, but the droplist is not there, i can't add the network. i understand the idea how it works.
#####################################
#this is the server config:
port 1194
;proto tcp
proto udp
;dev tap
dev tun
;dev-node tap
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
# i don't know what is this for, not sure if it should use this
;client-config-dir ccd
;route 10.8.1.0 255.255.255.0
;route 10.8.2.0 255.255.255.0
;route 10.8.1.2 255.255.255.0
;route 10.8.1.3 255.255.255.0
;route 10.8.1.4 255.255.255.0
;route 10.8.1.5 255.255.255.0
;route 10.8.1.6 255.255.255.0
;ifconfig-pool-persist ipp.txt
;server-bridge 10.8.0.0 255.255.255.0 10.8.0.50 10.8.0.100
;server-bridge
;push "route 192.168.1.10 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"
;push "redirect-gateway def1 bypass-dhcp"
push "redirect-gateway def1"
;push "dhcp-option DNS 208.67.222.222"
;push "dhcp-option DNS 208.67.220.220"
# i have an account on dydns, i tried creating a free web address, but for some reason it will not allow me, i've only been using the filter.
;push "dhcp-option DNS 216.146.35.35"
;push "dhcp-option DNS 216.146.36.36"
;push "dhcp-option DNS 10.8.0.1"
push "dhcp-option DNS 8.8.8.8"
;client-to-client
;duplicate-cn
keepalive 10 120
# SSL/TLS SERVER
;tls-server
# after everything works well i want to implement the aes256
;cipher BF-CBC # Blowfish (default)
;cipher AES-256-CBC # AES
;cipher DES-EDE3-CBC # Triple-DES
;keysize 256
# HASH FUNCTION ALGORYTHM
;auth MD5
comp-lzo
# i'm using widows xp pro, there's only one person using the server and client.
;user nobody
;group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3
;mute 20
#############################
# client config
client
dev tun
;dev-node tap
proto udp
remote 10.8.0.1 1194
resolv-retry infinite
nobind
persist-key
persist-tun
;persist-remote-ip
ca ca.crt
cert client2.crt
key client2.key
ns-cert-type server
comp-lzo
verb 3
# i don't know if this is necesary, i took it from the link i wrote on this post.
explicit-exit-notify 2
ping 10
ping-restart 60
route-method exe
route-delay 2
# same thing as in the server
;auth SHA256
;auth MD5
;cipher AES-256-CBC
;keysize 256
##################################
# this is my network status
Windows IP Configuration
Ethernet adapter Wireless Network Connection 5:
Connection-specific DNS Suffix . : some.connection.com
IP Address. . . . . . . . . . . . : 192.168.1.100
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
Ethernet adapter Local Area Connection 4:
Connection-specific DNS Suffix . :
IP Address. . . . . . . . . . . . : 10.8.0.1
Subnet Mask . . . . . . . . . . . : 255.255.255.252
Default Gateway . . . . . . . . . :
Windows IP Configuration
Host Name . . . . . . . . . . . . : usr
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : Yes
DNS Suffix Search List. . . . . . : some.connection.com
Ethernet adapter Wireless Network Connection 5:
Connection-specific DNS Suffix . : some.connection.com
Description . . . . . . . . . . . : Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter #2
Physical Address. . . . . . . . . : 9C-95-F7-39-D7-3F
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.1.100
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 216.146.35.35
216.146.36.36
NetBIOS over Tcpip. . . . . . . . : Disabled
Lease Obtained. . . . . . . . . . : Sunday, July 29, 2012 9:45:46 AM
Lease Expires . . . . . . . . . . : Monday, July 30, 2012 9:45:46 AM
Ethernet adapter Local Area Connection 4:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TAP-Win32 Adapter V9
Physical Address. . . . . . . . . : 00-FF-C9-C2-23-FE
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 10.8.0.1
Subnet Mask . . . . . . . . . . . : 255.255.255.252
Default Gateway . . . . . . . . . :
DHCP Server . . . . . . . . . . . : 10.8.0.2
NetBIOS over Tcpip. . . . . . . . : Disabled
Lease Obtained. . . . . . . . . . : Sunday, July 29, 2012 10:00:51 AM
Lease Expires . . . . . . . . . . : Monday, July 29, 2013 10:00:51 AM
###########################################
C:\Documents and Settings\starfire>ping 10.8.0.1
Pinging 10.8.0.1 with 32 bytes of data:
Reply from 10.8.0.1: bytes=32 time<1ms TTL=64
Reply from 10.8.0.1: bytes=32 time<1ms TTL=64
Reply from 10.8.0.1: bytes=32 time<1ms TTL=64
Reply from 10.8.0.1: bytes=32 time<1ms TTL=64
Ping statistics for 10.8.0.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
###############################################################
# this the server log
Sun Jul 29 10:57:45 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Sun Jul 29 10:57:45 2012 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Sun Jul 29 10:57:45 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sun Jul 29 10:57:45 2012 Diffie-Hellman initialized with 2048 bit key
Sun Jul 29 10:57:45 2012 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Jul 29 10:57:45 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sun Jul 29 10:57:45 2012 ROUTE default_gateway=192.168.1.1
Sun Jul 29 10:57:45 2012 TAP-WIN32 device [Local Area Connection 4] opened: \\.\Global\{C9C223FE-DD33-45EA-9CA5-4D1378C5457C}.tap
Sun Jul 29 10:57:45 2012 TAP-Win32 Driver Version 9.9
Sun Jul 29 10:57:45 2012 TAP-Win32 MTU=1500
Sun Jul 29 10:57:45 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.1/255.255.255.252 on interface {C9C223FE-DD33-45EA-9CA5-4D1378C5457C} [DHCP-serv: 10.8.0.2, lease-time: 31536000]
Sun Jul 29 10:57:45 2012 Sleeping for 10 seconds...
Sun Jul 29 10:57:55 2012 NOTE: FlushIpNetTable failed on interface [65541] {C9C223FE-DD33-45EA-9CA5-4D1378C5457C} (status=259) : No more data is available.
Sun Jul 29 10:57:55 2012 C:\WINDOWS\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.2
Sun Jul 29 10:57:55 2012 Route addition via IPAPI succeeded [adaptive]
Sun Jul 29 10:57:55 2012 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Jul 29 10:57:55 2012 UDPv4 link local (bound): [undef]:1194
Sun Jul 29 10:57:55 2012 UDPv4 link remote: [undef]
Sun Jul 29 10:57:55 2012 MULTI: multi_init called, r=256 v=256
Sun Jul 29 10:57:55 2012 IFCONFIG POOL: base=10.8.0.4 size=62
Sun Jul 29 10:57:55 2012 Initialization Sequence Completed
Sun Jul 29 10:58:11 2012 MULTI: multi_create_instance called
Sun Jul 29 10:58:11 2012 10.8.0.1:2599 Re-using SSL/TLS context
Sun Jul 29 10:58:11 2012 10.8.0.1:2599 LZO compression initialized
Sun Jul 29 10:58:11 2012 10.8.0.1:2599 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Jul 29 10:58:11 2012 10.8.0.1:2599 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Jul 29 10:58:11 2012 10.8.0.1:2599 Local Options hash (VER=V4): '530fdded'
Sun Jul 29 10:58:11 2012 10.8.0.1:2599 Expected Remote Options hash (VER=V4): '41690919'
Sun Jul 29 10:58:11 2012 10.8.0.1:2599 TLS: Initial packet from 10.8.0.1:2599, sid=4cc81f1b 7babf32f
Sun Jul 29 10:58:11 2012 10.8.0.1:2599 VERIFY OK: depth=1, /C=DE/ST=schlaugen/L=frem/O=ogff/OU=stermnz_/CN=stun/name=guniff/emailAddress=
Kron@webmail.com
Sun Jul 29 10:58:11 2012 10.8.0.1:2599 VERIFY OK: depth=0, /C=DE/ST=Schlaugen/L=Geshlaufen/O=Plato/OU=Pluton/CN=Circle/name=Pluty/emailAddress=
circle@webmail.com
Sun Jul 29 10:58:11 2012 10.8.0.1:2599 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Jul 29 10:58:11 2012 10.8.0.1:2599 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jul 29 10:58:11 2012 10.8.0.1:2599 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Jul 29 10:58:11 2012 10.8.0.1:2599 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jul 29 10:58:11 2012 10.8.0.1:2599 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sun Jul 29 10:58:11 2012 10.8.0.1:2599 [Circle] Peer Connection Initiated with 10.8.0.1:2599
Sun Jul 29 10:58:11 2012 Circle/10.8.0.1:2599 MULTI: Learn: 10.8.0.6 -> Circle/10.8.0.1:2599
Sun Jul 29 10:58:11 2012 Circle/10.8.0.1:2599 MULTI: primary virtual IP for Circle/10.8.0.1:2599: 10.8.0.6
Sun Jul 29 10:58:14 2012 Circle/10.8.0.1:2599 PUSH: Received control message: 'PUSH_REQUEST'
Sun Jul 29 10:58:14 2012 Circle/10.8.0.1:2599 SENT CONTROL [Circle]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Sun Jul 29 10:58:18 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 10:58:22 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 10:58:30 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 10:58:40 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 10:58:47 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 10:58:57 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 10:59:07 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 10:59:17 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 10:59:19 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 10:59:29 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 10:59:40 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 10:59:50 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 11:00:00 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 11:00:10 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 11:00:20 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 11:00:24 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 11:00:34 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 11:00:44 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 11:00:54 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 11:01:04 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 11:01:15 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 11:01:25 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 11:01:35 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 11:01:46 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 11:01:56 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 11:02:06 2012 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Jul 29 11:02:14 2012 Circle/10.8.0.1:2599 [Circle] Inactivity timeout (--ping-restart), restarting
Sun Jul 29 11:02:14 2012 Circle/10.8.0.1:2599 SIGUSR1[soft,ping-restart] received, client-instance restarting
#####################################
# client logs
Sun Jul 29 11:53:44 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Sun Jul 29 11:53:44 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sun Jul 29 11:53:44 2012 LZO compression initialized
Sun Jul 29 11:53:44 2012 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Jul 29 11:53:44 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sun Jul 29 11:53:44 2012 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Jul 29 11:53:44 2012 Local Options hash (VER=V4): '41690919'
Sun Jul 29 11:53:44 2012 Expected Remote Options hash (VER=V4): '530fdded'
Sun Jul 29 11:53:44 2012 UDPv4 link local: [undef]
Sun Jul 29 11:53:44 2012 UDPv4 link remote: 10.8.0.1:1194
Sun Jul 29 11:53:44 2012 TLS: Initial packet from 10.8.0.1:1194, sid=852e516a 027db3e5
Sun Jul 29 11:53:44 2012 VERIFY OK: depth=1, /C=DE/ST=schlaugen/L=frem/O=ogff/OU=stermnz_/CN=stun/name=guniff/emailAddress=
Kron@webmail.com
Sun Jul 29 11:53:44 2012 VERIFY OK: nsCertType=SERVER
Sun Jul 29 11:53:44 2012 VERIFY OK: depth=0, /C=DE/ST=Schlaugen/L=Geshlaufen/O=Struts/OU=Circle/CN=Plates/name=Viagra/emailAddress=
Circle@webmail.com
Sun Jul 29 11:53:45 2012 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Jul 29 11:53:45 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jul 29 11:53:45 2012 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Jul 29 11:53:45 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jul 29 11:53:45 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sun Jul 29 11:53:45 2012 [Plates] Peer Connection Initiated with 10.8.0.1:1194
Sun Jul 29 11:53:47 2012 SENT CONTROL [Plates]: 'PUSH_REQUEST' (status=1)
Sun Jul 29 11:53:47 2012 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Sun Jul 29 11:53:47 2012 OPTIONS IMPORT: timers and/or timeouts modified
Sun Jul 29 11:53:47 2012 OPTIONS IMPORT: --ifconfig/up options modified
Sun Jul 29 11:53:47 2012 OPTIONS IMPORT: route options modified
Sun Jul 29 11:53:47 2012 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Jul 29 11:53:47 2012 WARNING: potential conflict between --remote address [10.8.0.1] and --ifconfig address pair [10.8.0.6, 10.8.0.5] -- this is a warning only that is triggered when local/remote addresses exist within the same /24 subnet as --ifconfig endpoints. (silence this warning with --ifconfig-nowarn)
Sun Jul 29 11:53:47 2012 ROUTE default_gateway=192.168.1.1
Sun Jul 29 11:53:47 2012 CreateFile failed on TAP device: \\.\Global\{C9C223FE-DD33-45EA-9CA5-4D1378C5457C}.tap
Sun Jul 29 11:53:47 2012 All TAP-Win32 adapters on this system are currently in use.
Sun Jul 29 11:53:47 2012 Exiting
