Ubuntu Ovpn server, W7 client(s) access to W7 behind server

jrd

Hello,

I am trying to setup a VPN (Openvpn on Ubuntu)so that I can access windows shares on my desktop (Windows 7) while I am away on my laptop (Windows 7) from public access points.

This diagram illustrates my scenario:

I have bought the OpenVPN cookbook and I read and tried some recipes which I thought would accomplish this but with no success.

My router is a Netgear N150, I plan to upgrade to a linux computer for my router which will also run openvpn but that is down the road a bit still.

Here are my config files:
Currently using example3-1-client.conf on the client, I converted it to .ovpn:

client
proto udp
remote vpn.example.com
port 1194

dev tap
nobind

ca       "c:/program files (x86)/openvpn/config/ca.crt"
cert     "c:/program files (x86)/openvpn/config/ruffin-mobile1.crt"
key      "c:/program files (x86)/openvpn/config/ruffin-mobile1.key"
;tls-auth "c:/program files (x86)/openvpn/config/ta.key" 1 # I commented this line out because the connection would not establish at all with it< I don't know why.

ns-cert-type server

And example3-1-server.conf:

tls-server
proto udp
port 1194
dev tap

server 192.168.99.0 255.255.255.0

ca       /etc/openvpn/cookbook/ca.crt
cert     /etc/openvpn/cookbook/server.crt
key      /etc/openvpn/cookbook/server.key
dh       /etc/openvpn/cookbook/dh1024.pem
;tls-auth /etc/openvpn/cookbook/ta.key 0 # Again, commented out because the connection wouldn't establish.

persist-key
persist-tun
keepalive 10 60

push "route 192.168.160.0 255.255.0.0"

user  nobody
group nogroup

daemon
log-append /var/log/openvpn.log

I can connect with this config but I cannot ping the remote lan:

pinging the VPN server's tap0 address from the remote client wroteC:\Users\Rick>ping 192.168.99.1

Pinging 192.168.99.1 with 32 bytes of data:
Reply from 192.168.99.1: bytes=32 time=1297ms TTL=64
Reply from 192.168.99.1: bytes=32 time=550ms TTL=64
Reply from 192.168.99.1: bytes=32 time=246ms TTL=64
Reply from 192.168.99.1: bytes=32 time=231ms TTL=64

Ping statistics for 192.168.99.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 231ms, Maximum = 1297ms, Average = 581ms

pinging the vpn server's eth0 address from the remote client wroteC:\Users\Rick>ping 192.168.160.99

Pinging 192.168.160.99 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 192.168.160.99:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

pinging my desktop on the server side lan from the server wrote# ping -c 4 192.168.160.11
PING 192.168.160.11 (192.168.160.11) 56(84) bytes of data.
From 192.168.160.1: icmp_seq=1 Redirect Host(New nexthop: 192.168.160.11)
64 bytes from 192.168.160.11: icmp_req=1 ttl=128 time=0.746 ms
64 bytes from 192.168.160.11: icmp_req=2 ttl=128 time=0.375 ms
64 bytes from 192.168.160.11: icmp_req=3 ttl=128 time=0.387 ms
64 bytes from 192.168.160.11: icmp_req=4 ttl=128 time=0.391 ms

--- 192.168.160.11 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3000ms
rtt min/avg/max/mdev = 0.375/0.474/0.746/0.158 ms

Here are the entries in /var/log/openvpn.log for today:

server log wroteFri Aug 3 08:11:43 2012 OpenVPN 2.2.1 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Mar 30 2012
Fri Aug 3 08:11:43 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Fri Aug 3 08:11:43 2012 TUN/TAP device tap0 opened
Fri Aug 3 08:11:43 2012 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Aug 3 08:11:43 2012 /sbin/ifconfig tap0 192.168.99.1 netmask 255.255.255.0 mtu 1500 broadcast 192.168.99.255
Fri Aug 3 08:11:43 2012 GID set to nogroup
Fri Aug 3 08:11:43 2012 UID set to nobody
Fri Aug 3 08:11:43 2012 UDPv4 link local (bound): [undef]
Fri Aug 3 08:11:43 2012 UDPv4 link remote: [undef]
Fri Aug 3 08:11:43 2012 Initialization Sequence Completed
Fri Aug 3 08:11:46 2012 75.232.78.181:58484 Re-using SSL/TLS context
Fri Aug 3 08:11:49 2012 75.232.78.181:58484 [ruffin-mobile1] Peer Connection Initiated with [AF_INET]75.232.78.181:58484
Fri Aug 3 08:11:49 2012 ruffin-mobile1/75.232.78.181:58484 MULTI_sva: pool returned IPv4=192.168.99.2, IPv6=149a:3300:b04d:c821::b04d:c821
Fri Aug 3 08:11:51 2012 ruffin-mobile1/75.232.78.181:58484 send_push_reply(): safe_cap=960
Fri Aug 3 08:28:26 2012 event_wait : Interrupted system call (code=4)
Fri Aug 3 08:28:26 2012 /sbin/ifconfig tap0 0.0.0.0
SIOCSIFADDR: Permission denied
SIOCSIFFLAGS: Permission denied
Fri Aug 3 08:28:26 2012 Linux ip addr del failed: external program exited with error status: 255
Fri Aug 3 08:28:26 2012 SIGTERM[hard,] received, process exiting
Fri Aug 3 08:28:27 2012 OpenVPN 2.2.1 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Mar 30 2012
Fri Aug 3 08:28:27 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Fri Aug 3 08:28:27 2012 TUN/TAP device tap0 opened
Fri Aug 3 08:28:27 2012 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Aug 3 08:28:27 2012 /sbin/ifconfig tap0 192.168.99.1 netmask 255.255.255.0 mtu 1500 broadcast 192.168.99.255
Fri Aug 3 08:28:27 2012 GID set to nogroup
Fri Aug 3 08:28:27 2012 UID set to nobody
Fri Aug 3 08:28:27 2012 UDPv4 link local (bound): [undef]
Fri Aug 3 08:28:27 2012 UDPv4 link remote: [undef]
Fri Aug 3 08:28:27 2012 Initialization Sequence Completed
Fri Aug 3 08:29:26 2012 75.232.78.181:61169 Re-using SSL/TLS context
Fri Aug 3 08:29:30 2012 75.232.78.181:61169 [ruffin-mobile1] Peer Connection Initiated with [AF_INET]75.232.78.181:61169
Fri Aug 3 08:29:30 2012 ruffin-mobile1/75.232.78.181:61169 MULTI_sva: pool returned IPv4=192.168.99.2, IPv6=149a:c000:b05d:6722::b05d:6722
Fri Aug 3 08:29:32 2012 ruffin-mobile1/75.232.78.181:61169 send_push_reply(): safe_cap=960
Fri Aug 3 11:01:25 2012 75.203.235.128:57042 Re-using SSL/TLS context
Fri Aug 3 11:01:27 2012 75.203.235.128:57042 [ruffin-mobile1] Peer Connection Initiated with [AF_INET]75.203.235.128:57042
Fri Aug 3 11:01:27 2012 MULTI_sva: pool returned IPv4=192.168.99.2, IPv6=6868:6722:405e:6a22::
Fri Aug 3 11:01:30 2012 ruffin-mobile1/75.203.235.128:57042 send_push_reply(): safe_cap=960
Fri Aug 3 11:36:52 2012 event_wait : Interrupted system call (code=4)
Fri Aug 3 11:36:52 2012 /sbin/ifconfig tap0 0.0.0.0
SIOCSIFADDR: Permission denied
SIOCSIFFLAGS: Permission denied
Fri Aug 3 11:36:52 2012 Linux ip addr del failed: external program exited with error status: 255
Fri Aug 3 11:36:52 2012 SIGTERM[hard,] received, process exiting
Options error: --route-delay cannot be used with --mode server
Use --help for more information.
Fri Aug 3 13:20:31 2012 OpenVPN 2.2.1 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Mar 30 2012
Fri Aug 3 13:20:31 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Fri Aug 3 13:20:32 2012 TUN/TAP device tap0 opened
Fri Aug 3 13:20:32 2012 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Aug 3 13:20:32 2012 /sbin/ifconfig tap0 192.168.99.1 netmask 255.255.255.0 mtu 1500 broadcast 192.168.99.255
Fri Aug 3 13:20:32 2012 GID set to nogroup
Fri Aug 3 13:20:32 2012 UID set to nobody
Fri Aug 3 13:20:32 2012 UDPv4 link local (bound): [undef]
Fri Aug 3 13:20:32 2012 UDPv4 link remote: [undef]
Fri Aug 3 13:20:32 2012 Initialization Sequence Completed
Fri Aug 3 13:21:02 2012 event_wait : Interrupted system call (code=4)
Fri Aug 3 13:21:02 2012 /sbin/ifconfig tap0 0.0.0.0
SIOCSIFADDR: Permission denied
SIOCSIFFLAGS: Permission denied
Fri Aug 3 13:21:02 2012 Linux ip addr del failed: external program exited with error status: 255
Fri Aug 3 13:21:02 2012 SIGTERM[hard,] received, process exiting
Options error: --route-delay cannot be used with --mode server
Use --help for more information.
Fri Aug 3 13:21:49 2012 OpenVPN 2.2.1 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Mar 30 2012
Fri Aug 3 13:21:49 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Fri Aug 3 13:21:49 2012 TUN/TAP device tap0 opened
Fri Aug 3 13:21:49 2012 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Aug 3 13:21:49 2012 /sbin/ifconfig tap0 192.168.99.1 netmask 255.255.255.0 mtu 1500 broadcast 192.168.99.255
Fri Aug 3 13:21:49 2012 GID set to nogroup
Fri Aug 3 13:21:49 2012 UID set to nobody
Fri Aug 3 13:21:49 2012 UDPv4 link local (bound): [undef]
Fri Aug 3 13:21:49 2012 UDPv4 link remote: [undef]
Fri Aug 3 13:21:49 2012 Initialization Sequence Completed
Fri Aug 3 13:22:00 2012 173.233.182.245:55099 Re-using SSL/TLS context
Fri Aug 3 13:22:00 2012 173.233.182.245:55099 [ruffin-mobile1] Peer Connection Initiated with [AF_INET]173.233.182.245:55099
Fri Aug 3 13:22:00 2012 ruffin-mobile1/173.233.182.245:55099 MULTI_sva: pool returned IPv4=192.168.99.2, IPv6=146a:8600:b0ad:a121::b0ad:a121
Fri Aug 3 13:22:02 2012 ruffin-mobile1/173.233.182.245:55099 send_push_reply(): safe_cap=960
Fri Aug 3 14:57:32 2012 75.232.189.11:58880 Re-using SSL/TLS context
Fri Aug 3 14:57:35 2012 75.232.189.11:58880 [ruffin-mobile1] Peer Connection Initiated with [AF_INET]75.232.189.11:58880
Fri Aug 3 14:57:35 2012 MULTI_sva: pool returned IPv4=192.168.99.2, IPv6=68b8:a121:3035:a521::
Fri Aug 3 14:57:38 2012 ruffin-mobile1/75.232.189.11:58880 send_push_reply(): safe_cap=960

client log wroteFri Aug 03 13:21:57 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Fri Aug 03 13:21:57 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Fri Aug 03 13:21:57 2012 UDPv4 link local: [undef]
Fri Aug 03 13:21:57 2012 UDPv4 link remote: 173.233.182.245:1194
Fri Aug 03 13:21:57 2012 [Ruffin-VPN] Peer Connection Initiated with 173.233.182.245:1194
Fri Aug 03 13:21:59 2012 TAP-WIN32 device [tap-bridge] opened: \\.\Global\{23AC5212-207C-49F0-9E9B-634E1ED78E48}.tap
Fri Aug 03 13:21:59 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.99.2/255.255.255.0 on interface {23AC5212-207C-49F0-9E9B-634E1ED78E48} [DHCP-serv: 192.168.99.0, lease-time: 31536000]
Fri Aug 03 13:21:59 2012 Successful ARP Flush on interface [22] {23AC5212-207C-49F0-9E9B-634E1ED78E48}
Fri Aug 03 13:22:04 2012 WARNING: potential route subnet conflict between local LAN [192.168.160.0/255.255.255.0] and remote VPN [192.168.0.0/255.255.0.0]
Fri Aug 03 13:22:04 2012 Warning: address 192.168.160.0 is not a network address in relation to netmask 255.255.0.0
Fri Aug 03 13:22:04 2012 ROUTE: route addition failed using CreateIpForwardEntry: The parameter is incorrect. [status=87 if_index=22]
The route addition failed: The parameter is incorrect.
Fri Aug 03 13:22:04 2012 Initialization Sequence Completed
Fri Aug 03 14:57:27 2012 [Ruffin-VPN] Inactivity timeout (--ping-restart), restarting
Fri Aug 03 14:57:27 2012 ROUTE: route deletion failed using DeleteIpForwardEntry: The parameter is incorrect.
The route deletion failed: Element not found.
Fri Aug 03 14:57:27 2012 SIGUSR1[soft,ping-restart] received, process restarting
Fri Aug 03 14:57:29 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Fri Aug 03 14:57:29 2012 UDPv4 link local: [undef]
Fri Aug 03 14:57:29 2012 UDPv4 link remote: 173.233.182.245:1194
Fri Aug 03 14:57:33 2012 [Ruffin-VPN] Peer Connection Initiated with 173.233.182.245:1194
Fri Aug 03 14:57:35 2012 TAP-WIN32 device [tap-bridge] opened: \\.\Global\{23AC5212-207C-49F0-9E9B-634E1ED78E48}.tap
Fri Aug 03 14:57:35 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.99.2/255.255.255.0 on interface {23AC5212-207C-49F0-9E9B-634E1ED78E48} [DHCP-serv: 192.168.99.0, lease-time: 31536000]
Fri Aug 03 14:57:35 2012 Successful ARP Flush on interface [22] {23AC5212-207C-49F0-9E9B-634E1ED78E48}
Fri Aug 03 14:57:40 2012 Warning: address 192.168.160.0 is not a network address in relation to netmask 255.255.0.0
Fri Aug 03 14:57:40 2012 ROUTE: route addition failed using CreateIpForwardEntry: One or more arguments are not correct. [status=160 if_index=22]
The route addition failed: The parameter is incorrect.
Fri Aug 03 14:57:40 2012 Initialization Sequence Completed

Forwarding is enabled.

If I have forgotten anything or you need anything else to make a suggestion please ask me for it.

Eagerly awaiting your suggestions! Thanks! 🙂

maikcat

hi therem
there is a typo

push "route 192.168.160.0 255.255.0.0"

should be

push "route 192.168.160.0 255.255.255.0"

regards.

Michael.

jrd

Thanks, I made that change and will test it when I go out.

On another note, when I connect to the VPN from its home network with my laptop(my laptop connected to the same physical network as the server and connected to the virtual network that is the VPN) I lose the ability to lookup DNS for websites and cannot connect to local file shares.

Any idea why this may be and what I can do to fix it?

Here are my log files for today:

Server log wroteThu Aug 9 09:10:10 2012 OpenVPN 2.2.1 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Mar 30 2012
Thu Aug 9 09:10:10 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Aug 9 09:10:11 2012 TUN/TAP device tap0 opened
Thu Aug 9 09:10:11 2012 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Aug 9 09:10:11 2012 /sbin/ifconfig tap0 192.168.99.1 netmask 255.255.255.0 mtu 1500 broadcast 192.168.99.255
Thu Aug 9 09:10:11 2012 GID set to nogroup
Thu Aug 9 09:10:11 2012 UID set to nobody
Thu Aug 9 09:10:11 2012 UDPv4 link local (bound): [undef]
Thu Aug 9 09:10:11 2012 UDPv4 link remote: [undef]
Thu Aug 9 09:10:11 2012 Initialization Sequence Completed
Thu Aug 9 09:10:49 2012 173.233.182.245:49247 Re-using SSL/TLS context
Thu Aug 9 09:10:49 2012 173.233.182.245:49247 [ruffin-mobile1] Peer Connection Initiated with [AF_INET]173.233.182.245:49247
Thu Aug 9 09:10:49 2012 ruffin-mobile1/173.233.182.245:49247 MULTI_sva: pool returned IPv4=192.168.99.2, IPv6=146a:d800:c0ad:ae21::c0ad:ae21
Thu Aug 9 09:10:51 2012 ruffin-mobile1/173.233.182.245:49247 send_push_reply(): safe_cap=960
Thu Aug 9 09:16:38 2012 ruffin-mobile1/173.233.182.245:49247 [ruffin-mobile1] Inactivity timeout (--ping-restart), restarting
Thu Aug 9 10:10:46 2012 173.233.182.245:53975 Re-using SSL/TLS context
Thu Aug 9 10:10:46 2012 173.233.182.245:53975 [ruffin-mobile1] Peer Connection Initiated with [AF_INET]173.233.182.245:53975
Thu Aug 9 10:10:46 2012 ruffin-mobile1/173.233.182.245:53975 MULTI_sva: pool returned IPv4=192.168.99.2, IPv6=146a:d800:d0d5:b021::d0d5:b021
Thu Aug 9 10:10:48 2012 ruffin-mobile1/173.233.182.245:53975 send_push_reply(): safe_cap=960
Thu Aug 9 10:21:34 2012 ruffin-mobile1/173.233.182.245:53975 [ruffin-mobile1] Inactivity timeout (--ping-restart), restarting
Thu Aug 9 10:36:15 2012 173.233.182.245:53308 Re-using SSL/TLS context
Thu Aug 9 10:36:16 2012 173.233.182.245:53308 [ruffin-mobile1] Peer Connection Initiated with [AF_INET]173.233.182.245:53308
Thu Aug 9 10:36:16 2012 ruffin-mobile1/173.233.182.245:53308 MULTI_sva: pool returned IPv4=192.168.99.2, IPv6=146a:d800:d0d5:b021::d0d5:b021
Thu Aug 9 10:36:18 2012 ruffin-mobile1/173.233.182.245:53308 send_push_reply(): safe_cap=960

Client log wroteThu Aug 09 10:36:14 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Thu Aug 09 10:36:14 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Aug 09 10:36:15 2012 UDPv4 link local: [undef]
Thu Aug 09 10:36:15 2012 UDPv4 link remote: 173.233.182.245:1194
Thu Aug 09 10:36:15 2012 [Ruffin-VPN] Peer Connection Initiated with 173.233.182.245:1194
Thu Aug 09 10:36:17 2012 TAP-WIN32 device [tap-bridge] opened: \\.\Global\{23AC5212-207C-49F0-9E9B-634E1ED78E48}.tap
Thu Aug 09 10:36:17 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.99.2/255.255.255.0 on interface {23AC5212-207C-49F0-9E9B-634E1ED78E48} [DHCP-serv: 192.168.99.0, lease-time: 31536000]
Thu Aug 09 10:36:17 2012 Successful ARP Flush on interface [22] {23AC5212-207C-49F0-9E9B-634E1ED78E48}
Thu Aug 09 10:36:22 2012 WARNING: potential route subnet conflict between local LAN [192.168.160.0/255.255.255.0] and remote VPN [192.168.160.0/255.255.255.0]
Thu Aug 09 10:36:22 2012 Initialization Sequence Completed

maikcat

WARNING: potential route subnet conflict between local LAN [192.168.160.0/255.255.255.0] and remote VPN [192.168.160.0/255.255.255.0]

i think this says alot...

if your home lan ip range is the same with the vpn , then you have a routing problem..

try to allocate a non used subnet for your vpn ,f.e 10.121.134.0/24

regards

Michael.

jrd

I believe that error is coming from the fact that I was already connected to that network so windows added a route and I have the VPN setup to push that route in my server config, When I connect from a remote location I do not get that error and I have DNS access but I cannot see any windows shares.

Client log from remote location wroteFri Aug 10 08:38:52 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Fri Aug 10 08:38:52 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Fri Aug 10 08:38:52 2012 UDPv4 link local: [undef]
Fri Aug 10 08:38:52 2012 UDPv4 link remote: 173.233.182.245:1194
Fri Aug 10 08:38:53 2012 [Ruffin-VPN] Peer Connection Initiated with 173.233.182.245:1194
Fri Aug 10 08:38:55 2012 TAP-WIN32 device [tap-bridge] opened: \\.\Global\{23AC5212-207C-49F0-9E9B-634E1ED78E48}.tap
Fri Aug 10 08:38:55 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.99.2/255.255.255.0 on interface {23AC5212-207C-49F0-9E9B-634E1ED78E48} [DHCP-serv: 192.168.99.0, lease-time: 31536000]
Fri Aug 10 08:38:55 2012 Successful ARP Flush on interface [22] {23AC5212-207C-49F0-9E9B-634E1ED78E48}
Fri Aug 10 08:39:01 2012 Initialization Sequence Completed

route print -4 while connected remotely wrote===========================================================================
Interface List
23...02 ff 23 ac 52 12 ......MAC Bridge Miniport
22...00 ff 23 ac 52 12 ......TAP-Win32 Adapter V9
15...70 f1 a1 a3 2d 35 ......Microsoft Virtual WiFi Miniport Adapter
13...00 ff 5b eb be 9e ......TAP-Win32 Adapter OAS
11...70 f1 a1 a3 2d 35 ......Realtek RTL8191SE Wireless LAN 802.11n PCI-E NIC
10...c8 0a a9 99 5b 62 ......Atheros AR8152 PCI-E Fast Ethernet Controller
1...........................Software Loopback Interface 1
19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
25...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #7
20...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
12...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
26...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #8
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
24...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #6
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.200.1 192.168.99.2 286
0.0.0.0 0.0.0.0 192.168.170.1 192.168.170.107 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.99.0 255.255.255.0 On-link 192.168.99.2 286
192.168.99.2 255.255.255.255 On-link 192.168.99.2 286
192.168.99.255 255.255.255.255 On-link 192.168.99.2 286
192.168.160.0 255.255.255.0 192.168.99.1 192.168.99.2 30
192.168.170.0 255.255.255.0 On-link 192.168.170.107 281
192.168.170.107 255.255.255.255 On-link 192.168.170.107 281
192.168.170.255 255.255.255.255 On-link 192.168.170.107 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.170.107 281
224.0.0.0 240.0.0.0 On-link 192.168.99.2 286
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.170.107 281
255.255.255.255 255.255.255.255 On-link 192.168.99.2 286
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 192.168.160.1 Default
0.0.0.0 0.0.0.0 192.168.200.1 Default
===========================================================================

My network map above shows all my IP ranges.

Thanks for your help so far.

jrd

Do you have any idea why I can't see any windows shares or ping any computers on the network behind the VPN server?

maikcat

if your are trying to connect to your openvpn server while
you are in the same lan & you are pushing routes for this lan
then it is certain that will be problems...

can you check your config using a client OUTSIDE your network?

Michael.

jrd

I am connecting to the vpn from a Windows 7 client outside my VPN's local network now.

Log wroteThu Aug 16 07:32:04 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Thu Aug 16 07:32:04 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Aug 16 07:32:05 2012 UDPv4 link local: [undef]
Thu Aug 16 07:32:05 2012 UDPv4 link remote: 173.233.182.245:1194
Thu Aug 16 07:32:05 2012 [Ruffin-VPN] Peer Connection Initiated with 173.233.182.245:1194
Thu Aug 16 07:32:08 2012 TAP-WIN32 device [tap-bridge] opened: \\.\Global\{23AC5212-207C-49F0-9E9B-634E1ED78E48}.tap
Thu Aug 16 07:32:08 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.99.2/255.255.255.0 on interface {23AC5212-207C-49F0-9E9B-634E1ED78E48} [DHCP-serv: 192.168.99.0, lease-time: 31536000]
Thu Aug 16 07:32:08 2012 Successful ARP Flush on interface [21] {23AC5212-207C-49F0-9E9B-634E1ED78E48}
Thu Aug 16 07:32:13 2012 Initialization Sequence Completed

route print -4 wrote===========================================================================
Interface List
21...00 ff 23 ac 52 12 ......TAP-Win32 Adapter V9
15...70 f1 a1 a3 2d 35 ......Microsoft Virtual WiFi Miniport Adapter
13...00 ff 5b eb be 9e ......TAP-Win32 Adapter OAS
11...70 f1 a1 a3 2d 35 ......Realtek RTL8191SE Wireless LAN 802.11n PCI-E NIC
10...c8 0a a9 99 5b 62 ......Atheros AR8152 PCI-E Fast Ethernet Controller
1...........................Software Loopback Interface 1
18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
24...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #7
19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
12...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
20...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #5
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.200.1 192.168.99.2 286
0.0.0.0 0.0.0.0 192.168.170.1 192.168.170.107 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.99.0 255.255.255.0 On-link 192.168.99.2 286
192.168.99.2 255.255.255.255 On-link 192.168.99.2 286
192.168.99.255 255.255.255.255 On-link 192.168.99.2 286
192.168.160.0 255.255.255.0 192.168.99.1 192.168.99.2 30
192.168.170.0 255.255.255.0 On-link 192.168.170.107 281
192.168.170.107 255.255.255.255 On-link 192.168.170.107 281
192.168.170.255 255.255.255.255 On-link 192.168.170.107 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.99.2 286
224.0.0.0 240.0.0.0 On-link 192.168.170.107 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.99.2 286
255.255.255.255 255.255.255.255 On-link 192.168.170.107 281
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 192.168.160.1 Default
0.0.0.0 0.0.0.0 192.168.200.1 Default
===========================================================================

Still no windows shares showing up and cannot ping hosts on the remote network.

maikcat

some things to check:

can you ping the vpn server ip? (both tun & lan)
try to ping a specific host on your lan,
if you try a traceroute from this host to your openvpn virtual ip what do you see?

Still no windows shares showing up

show up where?
if you mean network neiborhood then you are out of luck...
remember this is routed mode you are setting up,broadcasts DONT pass when use routed mode,
you have to access shares by ip of hosts -or- use WINS or dns infrastructure...

also for testing , setup your pc (which is inside the lan) to have default gateway your openvpn server
AND disable its firewall..

Michael.

jrd

maikcat wrotesome things to check:

can you ping the vpn server ip? (both tun & lan)

tun Yes:

C:\windows\system32>ping 192.168.99.1

Pinging 192.168.99.1 with 32 bytes of data:
Reply from 192.168.99.1: bytes=32 time=201ms TTL=64
Reply from 192.168.99.1: bytes=32 time=160ms TTL=64
Reply from 192.168.99.1: bytes=32 time=92ms TTL=64
Reply from 192.168.99.1: bytes=32 time=273ms TTL=64

Ping statistics for 192.168.99.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 92ms, Maximum = 273ms, Average = 181ms

lan Yes:

C:\windows\system32>ping 192.168.160.99

Pinging 192.168.160.99 with 32 bytes of data:
Reply from 192.168.160.99: bytes=32 time=15ms TTL=64
Reply from 192.168.160.99: bytes=32 time=15ms TTL=64
Reply from 192.168.160.99: bytes=32 time=13ms TTL=64
Reply from 192.168.160.99: bytes=32 time=16ms TTL=64

Ping statistics for 192.168.160.99:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 13ms, Maximum = 16ms, Average = 14ms

try to ping a specific host on your lan,

No:

C:\windows\system32>ping 192.168.160.19

Pinging 192.168.160.19 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 192.168.160.19:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

if you try a traceroute from this host to your openvpn virtual ip what do you see?

(my router has a lower metric than my vpn server even though I set the vpn to 1)

C:\Users\Jason>tracert 192.168.99.1

Tracing route to 192.168.99.1 over a maximum of 30 hops

1 1 ms <1 ms <1 ms 192.168.160.1
2 * * * Request timed out.
3 4 ms 2 ms 3 ms static-65-182-134-1.nu-z.net [65.182.134.1]
4 2 ms 2 ms 2 ms static-65-182-132-78.nu-z.net [65.182.132.78]
5 * * * Request timed out.
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
11 * * * Request timed out.
12 * * * Request timed out.
13 * * * Request timed out.
14 * * * Request timed out.
15 * * * Request timed out.
16 * * * Request timed out.
17 * * * Request timed out.
18 * * * Request timed out.
19 * * * Request timed out.
20 * * * Request timed out.
21 * * * Request timed out.
22 * * * Request timed out.
23 * * * Request timed out.
24 * * * Request timed out.
25 * * * Request timed out.
26 * * * Request timed out.
27 * * * Request timed out.
28 * * * Request timed out.
29 * * * Request timed out.
30 * * * Request timed out.

Trace complete.

Still no windows shares showing up
show up where?
if you mean network neiborhood then you are out of luck...
remember this is routed mode you are setting up,broadcasts DONT pass when use routed mode,
you have to access shares by ip of hosts -or- use WINS or dns infrastructure...

also for testing , setup your pc (which is inside the lan) to have default gateway your openvpn server
AND disable its firewall..

Michael.

I setup my pc in the lan to have a default gateway of 192.168.160.99 and turned off it's firewall before testing.

Still no good.

Here is a picture of the route in my router:

Perhaps iptables or something else is not setup properly on my VPN server?

Once I get pings going through I should be able to access shares on the lan through their IP, right?

maikcat

hi there,

try for testing to add a static route manually to your clients (for vpn subnet),

Once I get pings going through I should be able to access shares on the lan through their IP, right?

if you want to access SMB shares you will have to do it by using \\ip format
-or- using netbios names if you are using a name resolving protocol (f.e wins)

Michael.

jrd

maikcat wrotehi there,

try for testing to add a static route manually to your clients (for vpn subnet),

Is this right?
IF 21 is my tap adapter, is this wrong? should it be my ethernet adapter?

route ADD 192.168.99.0 MASK 255.255.255.255 192.168.99.1 METRIC 1 IF 21

Ping to the router on the lan behind the VPN fails.
Or do you mean a route to the lan behind the vpn through the vpn?

route ADD 192.168.160.0 MASK 255.255.255.255 192.168.99.1 METRIC 1 IF 21

Again the ping to the router fails.

Maybe since I am connected to the internet through wifi the IF should be my wireless adapter?

route ADD 192.168.160.0 MASK 255.255.255.255 192.168.99.1 METRIC 1 IF 11

Still no ping reply.

I don't understand why this is so hard! Thank you for having patience with my issue.

maikcat

we mixed up things a little...

about the static route thing,go to one of your lan pcs and type

route add 192.168.99.0 mask 255.255.255.0 192.168.160.99 (192.168.160.99 is your openvpn servers lan ip)

also to this pc disable firewall and try a tracert 192.168.99.1 and see where it goes...

Michael.

jrd

maikcat wrotewe mixed up things a little...

about the static route thing,go to one of your lan pcs and type

route add 192.168.99.0 mask 255.255.255.0 192.168.160.99 (192.168.160.99 is your openvpn servers lan ip)

also to this pc disable firewall and try a tracert 192.168.99.1 and see where it goes...

Michael.

Route added successfully, firewall still disabled.

Tracert results: wroteC:\windows\system32>tracert 192.168.99.1

Tracing route to 192.168.99.1 over a maximum of 30 hops

1 1 ms 1 ms 1 ms 192.168.99.1

Trace complete.

I am now able to ping the pc on the lan from the vpn client but I am not able to ping the vpn client from the lan pc.

I just changed the subnet mask on the route in the picture above to 255.255.255.0, should this help?

Now pings to the router work and pings from the lan pc to the vpn client work if the vpn clients firewall is turned off.

Once this is working properly firewalls shouldn't have to be down and firewall rules shouldn't have to be added manually right?

maikcat

I am now able to ping the pc on the lan from the vpn client but I am not able to ping the vpn client from the lan pc.

did you check the firewall settings on vpn client itself?

I just changed the subnet mask on the route in the picture above to 255.255.255.0, should this help?

255.255.255.0 is what i wrote...
where did you changed it?

Now pings to the router work and pings from the lan pc to the vpn client work if the vpn clients firewall is turned off.

that means my first comment is already ok...

Once this is working properly firewalls shouldn't have to be down and firewall rules shouldn't have to be added manually right?

yeap 🙂

you can still disable firewall on tap adapter only...

Michael.

jrd

maikcat wrote
I just changed the subnet mask on the route in the picture above to 255.255.255.0, should this help?
255.255.255.0 is what i wrote...
where did you changed it?

In the lan router:

Once this is working properly firewalls shouldn't have to be down and firewall rules shouldn't have to be added manually right?
yeap 🙂

Awesome!

you can still disable firewall on tap adapter only...

Michael.

How do I disable windows firewall for just one adapter?

When setup correctly lan pcs shouldn't need any routes or other modification right? Just being on the lan should make them work?

Looks like I am right I just pinged 3 other hosts on the lan with no problems.

I just typed "\\192.168.160.11" into file browser and got a remote hosts shares! This is so cool! Thank you so much for all your help so far, don't know if all the bugs are out yet or not as I need to go now.

maikcat

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.