Windows Server 2008 R2 setup: configuration is wrong?

port443

Hello, I'm tryimg to set up a VPN Tunnel between two Windows machines; I need a point-to-point tunnel with no further routing (i.e. just for two machines to talk to each other). I have some problem and my main problem is that I cannot identify what's not working in first place - what I need to fix 🙂
So, my setup is as follows:

Server

- WS 2008 R2 x64
- OpenVPN 2.3 alpha (upgraded from 2.2 in hopes it makes any changes; 2.2 seems to work the same way)

Config file:

port 1194
proto tcp
dev tun
ca ca.crt
cert core-server.crt
key core-server.key  # This file should be kept secret
tls-server
key-method 2
dh dh2048.pem
server 10.8.100.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
log-append  openvpn.log
verb 6
reneg-sec 60
script-security 2
client-config-dir ccd
route 10.8.101.0 255.255.255.0

client's ccd contents:

ifconfig-push 10.8.101.6 10.8.101.5

Client

- W7 Pro x86
- OpenVPN 2.2

Config file:

client
dev tun
proto tcp
remote myserver.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert admin-test.crt
key admin-test.key
tls-client
key-method 2
ns-cert-type server
comp-lzo
verb 5
log-append connect.log

Client and server do connect; ip address is set and they seem talking, but I cannot ping anything remote.

First of all, when connected, on both sides network is called Unindentified Network; is this a concern?

Server routes are added:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0    168.xxx.yyy.1  168.xxx.yyy.160     15
       10.8.100.0    255.255.255.0       10.8.100.2  168.xxx.yyy.160      6
       10.8.101.0    255.255.255.0       10.8.100.2  168.xxx.yyy.160      6
...

Server adapter is assigned an APIPA address!

Ethernet adapter VPN Tunnel Endpoint:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : TAP-Windows Adapter V9
   Physical Address. . . . . . . . . : 00-FF-71-8A-67-8D
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Autoconfiguration IPv4 Address. . : 169.254.71.187(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . :
   NetBIOS over Tcpip. . . . . . . . : Disabled

Client routes are added too:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0    192.168.98.15   192.168.98.110     25
       10.8.100.1  255.255.255.255       10.8.101.5       10.8.101.6     30
       10.8.101.4  255.255.255.252         On-link        10.8.101.6    286
       10.8.101.6  255.255.255.255         On-link        10.8.101.6    286
       10.8.101.7  255.255.255.255         On-link        10.8.101.6    286
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
     192.168.98.0    255.255.255.0         On-link    192.168.98.110    281
   192.168.98.110  255.255.255.255         On-link    192.168.98.110    281
   192.168.98.255  255.255.255.255         On-link    192.168.98.110    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link    192.168.98.110    281
        224.0.0.0        240.0.0.0         On-link        10.8.101.6    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link    192.168.98.110    281
  255.255.255.255  255.255.255.255         On-link        10.8.101.6    286
===========================================================================
Persistent Routes:
  None

Client adapter is assigned proper address:

Ethernet adapter Private VPN:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : TAP-Win32 Adapter V9
   Physical Address. . . . . . . . . : 00-FF-DC-B6-46-54
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 10.8.101.6(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.252
   Lease Obtained. . . . . . . . . . : Thursday, September 06, 2012 00:32:39
   Lease Expires . . . . . . . . . . : Friday, September 06, 2013 00:32:39
   Default Gateway . . . . . . . . . :
   DHCP Server . . . . . . . . . . . : 10.8.101.5
   NetBIOS over Tcpip. . . . . . . . : Disabled

Also, I cannot even ping 10.8.101.5; is this normal?
Client's firewall is all down.

I have some troubles attaching logs here; possibly because of size. I shall figure out a way to add them later.

Please help me figure out what is OK and what is not; I'm a bit confused what is wrong.

TIA.

maikcat

hi there,

the obvious errors...

server 10.8.100.0 255.255.255.0

this means that openvpn server virual ip is 10.8.100.1
also means that your clients can get ip from this range.. (10.8.100.x)

so using

ifconfig-push 10.8.101.6 10.8.101.5

is wrong,change it to

ifconfig-push 10.8.100.6 10.8.100.5

also remove the route directive from your server config...

Michael.

port443

maikcat, I believe this is what I started with. Anyway, after changes you proposed:

Routes on client:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0    192.168.98.15   192.168.98.110     25
       10.8.100.1  255.255.255.255       10.8.100.5       10.8.100.6     30
       10.8.100.4  255.255.255.252         On-link        10.8.100.6    286
       10.8.100.6  255.255.255.255         On-link        10.8.100.6    286
       10.8.100.7  255.255.255.255         On-link        10.8.100.6    286
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
     192.168.98.0    255.255.255.0         On-link    192.168.98.110    281
   192.168.98.110  255.255.255.255         On-link    192.168.98.110    281
   192.168.98.255  255.255.255.255         On-link    192.168.98.110    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link    192.168.98.110    281
        224.0.0.0        240.0.0.0         On-link        10.8.100.6    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link    192.168.98.110    281
  255.255.255.255  255.255.255.255         On-link        10.8.100.6    286
===========================================================================
Persistent Routes:
  None

Client's adapter configuration:

Ethernet adapter Private VPN:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : TAP-Win32 Adapter V9
   Physical Address. . . . . . . . . : 00-FF-DC-B6-46-54
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 10.8.100.6(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.252
   Lease Obtained. . . . . . . . . . : Thursday, September 06, 2012 20:15:53
   Lease Expires . . . . . . . . . . : Friday, September 06, 2013 20:15:52
   Default Gateway . . . . . . . . . :
   DHCP Server . . . . . . . . . . . : 10.8.100.5
   NetBIOS over Tcpip. . . . . . . . : Disabled

Client's logs: http://pastie.org/4677143 (let me know if server side logs can help here).

I can ping 10.8.100.6 (obviously), but 10.8.100.5 and 10.8.100.1 are not reachable.

What else should I check?

TIA.

port443

One more (possibly meaningful) thing:

C:\Windows\System32>netsh interface ipv4 show interface "Private VPN"

Interface Private VPN Parameters
----------------------------------------------
IfLuid                             : ethernet_10
IfIndex                            : 16
State                              : disconnected
Metric                             : 30
Link MTU                           : 1300 bytes
Reachable Time                     : 27500 ms
Base Reachable Time                : 30000 ms
Retransmission Interval            : 1000 ms
DAD Transmits                      : 3
Site Prefix Length                 : 64
Site Id                            : 1
Forwarding                         : enabled
Advertising                        : disabled
Neighbor Discovery                 : enabled
Neighbor Unreachability Detection  : enabled
Router Discovery                   : dhcp
Managed Address Configuration      : enabled
Other Stateful Configuration       : enabled
Weak Host Sends                    : disabled
Weak Host Receives                 : disabled
Use Automatic Metric               : enabled
Ignore Default Routes              : disabled
Advertised Router Lifetime         : 1800 seconds
Advertise Default Route            : disabled
Current Hop Limit                  : 0
Force ARPND Wake up patterns       : disabled
Directed MAC Wake up patterns      : disabled

maikcat

hi there,

did you disabled firewall on 2008?
are you running the client with admin rights on 7?

Michael.

port443

maikcat, FW is down on client.
On/off switch it out of my control on server unfortunately 🙁 I can add rules though, I added TCP 1194 so that OpenVPN can connect through. I can paste my server logs (not quick though).
Should I be able to ping 10.8.100.5 (note that I have forwarding enabled)? I really did not understand where this address goes to.

port443

Oh, sorry, forgot to mention: in both cases OpenVPN runs as windows service, so there should be no access rights issues, correct?

maikcat

OpenVPN runs as windows service, so there should be no access rights issues, correct?

if you configure it to run with the neccesary rights..no

I added TCP 1194 so that OpenVPN can connect through. I can paste my server logs

this is needed for you to connect,
you also want to allow traffic from-to TAP adapter..

Michael.

port443

maikcat wrote
OpenVPN runs as windows service, so there should be no access rights issues, correct?
if you configure it to run with the neccesary rights..no

It runs under machine's SYSTEM account (default) which AFAIK has almost everything accessible.

maikcat wrote
I added TCP 1194 so that OpenVPN can connect through. I can paste my server logs
this is needed for you to connect,
you also want to allow traffic from-to TAP adapter..

You mean forwarding? Will try.

port443

maikcat, it is turned on:

C:\Windows\system32>netsh interface ipv4 show interface "VPN Tunnel Endpoint"

Interface VPN Tunnel Endpoint Parameters
----------------------------------------------
IfLuid                             : ethernet_9
IfIndex                            : 18
State                              : disconnected
Metric                             : 30
Link MTU                           : 1500 bytes
Reachable Time                     : 17000 ms
Base Reachable Time                : 30000 ms
Retransmission Interval            : 1000 ms
DAD Transmits                      : 3
Site Prefix Length                 : 64
Site Id                            : 1
Forwarding                         : enabled
Advertising                        : disabled
Neighbor Discovery                 : enabled
Neighbor Unreachability Detection  : enabled
Router Discovery                   : dhcp
Managed Address Configuration      : enabled
Other Stateful Configuration       : enabled
Weak Host Sends                    : disabled
Weak Host Receives                 : disabled
Use Automatic Metric               : enabled
Ignore Default Routes              : disabled
Advertised Router Lifetime         : 1800 seconds
Advertise Default Route            : disabled
Current Hop Limit                  : 0
Force ARPND Wake up patterns       : disabled
Directed MAC Wake up patterns      : disabled

port443

Just not to confuse: the dump above is from server.
Here are server logs: http://pastie.org/4685083 I started it, connected client, did four failed pings, stopped client, stopped server.

Should I be concerned about this?

Warning: route gateway is not reachable on any active network adapters: 10.8.100.2

Note that I don't need any routing outside server; I just need a client-server point-to-point link.

Thanks.

Mimiko

Warning: route gateway is not reachable on any active network adapters: 10.8.100.2

You are getting this warning, because in server's config you have route 10.8.101.0 255.255.255.0. You don't need this option.

The unidentified network responce from Windows for this connection is because it does not have an internet connection or other servers to check for network destination. Don't bother for notworking features in Windows.

The fact that you don't have a ping from server, leads to a firewall issue on the server. Add rule for igmp packets to and from the tap adapter on the server.