Hi all,
I would really really appreciate if you can give me some help in properly configuring my OpenVPN.
The configuration:
I have a OpenVPN 2.2.1-3 server (on Debian) and have used different versions on the client side (including 2.2.x and 2.3alpha). There are no subnets behind either the server or the clients (I use the VPN only as a tunnel). I have both Win and *nix clients.
Snippet (edited) of server-conf:
local IPv4_IP_addr
port PORT
proto udp
topology subnet
dev tun
tun-ipv6
ca ce.crt
cert servercert.crt
key serverkey.key
dh dh2048.pem
server Private_IPv4_IP_addr 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
cipher AES-256-CBC
auth SHA256
comp-lzo
persist-key
persist-tun
verb 9
Snippet (edited) of client-conf:
client
dev tun
tun-ipv6
proto udp
remote IPv4_IP_addr PORT
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ca ca.crt
cert clientcert.crt
key clientkey.key
ns-cert-type server
cipher AES-256-CBC
auth SHA256
comp-lzo
verb 9
The problem:
The result is always the same: Connecting from a linux machine everything
works well (and only in IPv4), when trying to connect from a Win7 client (any OpenVPN version) I always get the following error in the server log (and obviously loose connectivity):
name/ClientPublicIPv4Addr:port GET INST BY VIRT: fe80::2832:zzzz:yyyy:xxxx [failed]
MULTI: bad source address from client [fe80::2832:zzzz:yyyy:xxxx], packet dropped
I have read the FAQ section on this problem, where the same error with an IPv4 address is mentioned, but I wasn't able to transpose the solution. I understand that it's a IPv6 routing problem on the server side, however I have not been able to solve it in any way. My tun0 interface (which is created by OpenVPN) doesn't have any IPv6 address associated, and I am really new to IPv6.
This is a (edited) snippet of my interfaces config:
eth0 Link encap:Ethernet HWaddr NIC_MAC
inet addr:PUBLIC_IP_ADDRESS Bcast:MY_BROADCAST Mask:255.255.254.0
inet6 addr: 2605:blahblah1/128 Scope:Global
inet6 addr: fe80::blahblah2/64 Scope:Link
inet6 addr: 2605:blahblah3/64 Scope:Global
inet6 addr: 2605:blahblah4/128 Scope:Global
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
tun0 Link encap:UNSPEC HWaddr 00-...-00
inet addr:10.10.10.1 P-t-P:10.10.10.1 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
While the following is a (edited) strip from my ip(6)tables:
--IPv4--
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 10.10.10.0/24 anywhere
--IPv6--
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all fe80::/64 anywhere
The objective:
My objective is to get also the Win7 clients working (point to point tunnel is sufficient) in tun mode and thus being able to use the VPN server as a gateway for all client services. I have multiple dynamic clients, so I would prefer to avoid any client specific configuration (like the ccd trick) and try to keep any necessary modification on the server side.
The plead:
:oops: :oops: :oops: :oops:
I really need help on this one... any help is most welcome!!!!
