Having trouble talking to machines on LAN from VPN

DrAzzy

I'm trying to set up a VPN so that I can connect to my home network while away from home, and access the shared network drives that I normally can at home, remote desktop to systems, etc.

Right now, I can connect without problems.

Client can communicate fully with the machine running the OpenVPN server.
Client can successfully ping the router
Client cannot ping other machines on the network
Other machines on the network can ping the client
Other machines on the network can ping eachother

Does anyone have any thoughts as to what I'm missing here?
I've tried to post any information that might be useful - let me know if there's more information I can provide.

Background:

Running 2.2.2 on both systems.

Followed instructions here:
http://www.runpcrun.com/howtoopenvpn (but using latest version)

192.168.2.12 is openvpn server, running windows XP.
192.168.2.24 is another machine on the network
10.8.0.6 is the ip of the client

Router is Asus RT N10+ - 192.168.2.1

Client pinging stuff:

Tracing route to 192.168.2.12 over a maximum of 30 hops

  1   183 ms    60 ms    61 ms  192.168.2.12

Trace complete.

C:\Windows\system32>tracert -d 192.168.2.24

Tracing route to 192.168.2.24 over a maximum of 30 hops

  1   225 ms    70 ms    63 ms  10.8.0.1
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4     *     ^C
C:\Windows\system32>tracert -d 192.168.2.1

Tracing route to 192.168.2.1 over a maximum of 30 hops

  1   133 ms    65 ms    60 ms  10.8.0.1
  2    69 ms    60 ms    59 ms  192.168.2.1

Trace complete.

192.168.2.24 pinging client:

Tracing route to 10.8.0.6 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  192.168.2.1
  2     1 ms    <1 ms    <1 ms  192.168.2.12
  3   246 ms    60 ms    58 ms  10.8.0.6

Have set router:

This should provide the needed routing functionality right? And the other machines on the network can contact client, so I think this is.. sort of.. working.

Open VPN server is running WinXP, client running Win7

On server, HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IPEnableRouter is set to 1

Windows Firewall turned off on all systems for testing.

OpenVPN Configurations:

server (computer name is "music" because it controls the sound system in addition to running openvpn - I wasn't sure whether some of these things needed to match the computer name as was shown in the instructions I followed):

port 1194
proto udp
dev tun
ca ca.crt
cert music.crt
key music.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.2.0 255.255.255.0"
push "dhcp-option WINS 192.168.2.12"
push "dhcp-option DNS 192.168.2.12"
push "dhcp-option DOMAIN music"
keepalive 10 120
comp-lzo
max-clients 2
persist-key
persist-tun
status openvpn-status.log
verb 3

Client:

client
proto udp
dev tun
remote (snip) 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert zenbook.crt
key zenbook.key
comp-lzo
verb 3

Thanks in advance

maikcat

hi there,

192.168.2.24 pinging client:
Code:
Tracing route to 10.8.0.6 over a maximum of 30 hops

1 <1 ms <1 ms <1 ms 192.168.2.1
2 1 ms <1 ms <1 ms 192.168.2.12
3 246 ms 60 ms 58 ms 10.8.0.6

this says alot...

routing is ok
2.24 has any type of firewall/antivirus/antimalware on?

Michael.

DrAzzy

Firewall is off on all machines.

I can ping 192.168.2.24 from machines on the LAN, but not from the VPN client.

DrAzzy

I'm not sure whether I posted a reply already (as far as I can tell, there's no way for me to see posts I've made that are subject to mod approval, and I apparently can't PM mods to ask either - so I apologize if this is a double post).

There is no firewall running on 192.168.2.24 (or any of the other computers involved in this testing), and I can ping 192.168.2.24 from computers on the LAN, but not on the VPN client computer.
From other machines on LAN:

C:\Documents and Settings\User>tracert -d 192.168.2.24

Tracing route to 192.168.2.24 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  192.168.2.24

Trace complete.

DrAzzy

From client - not really sure how to interpret this, or if it's useful here.

C:\Windows\system32>route print
===========================================================================
Interface List
 19...00 ff 0a aa 5a c7 ......TAP-Win32 Adapter V9
 13...e0 b9 a5 d1 67 96 ......Atheros AR9485WB-EG Wireless Network Adapter
  1...........................Software Loopback Interface 1
 30...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
 16...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
 18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #5
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     192.168.43.1    192.168.43.61     25
         10.8.0.1  255.255.255.255         10.8.0.5         10.8.0.6     30
         10.8.0.4  255.255.255.252         On-link          10.8.0.6    286
         10.8.0.6  255.255.255.255         On-link          10.8.0.6    286
         10.8.0.7  255.255.255.255         On-link          10.8.0.6    286
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.2.0    255.255.255.0         10.8.0.5         10.8.0.6     30
     192.168.43.0    255.255.255.0         On-link     192.168.43.61    281
    192.168.43.61  255.255.255.255         On-link     192.168.43.61    281
   192.168.43.255  255.255.255.255         On-link     192.168.43.61    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link          10.8.0.6    286
        224.0.0.0        240.0.0.0         On-link     192.168.43.61    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link          10.8.0.6    286
  255.255.255.255  255.255.255.255         On-link     192.168.43.61    281
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
 16     58 ::/0                     On-link
  1    306 ::1/128                  On-link
 16     58 2001::/32                On-link
 16    306 2001:0:4137:9e76:3c32:2adc:3f57:d4c2/128
                                    On-link
 13    281 fe80::/64                On-link
 16    306 fe80::/64                On-link
 16    306 fe80::3c32:2adc:3f57:d4c2/128
                                    On-link
 13    281 fe80::b454:835d:a9d0:e675/128
                                    On-link
  1    306 ff00::/8                 On-link
 16    306 ff00::/8                 On-link
 13    281 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

dropje

The problem could be out of state packets. You're using a static route on your router to point the subnet 10.8.0.0/24 to the vpn gateway. I'll try to sketch what seems to be happening:

Client1 (10.8.0.6)
VPN Server (192.168.2.12)
LAN host (192.168.2.24)

Client1 source address 10.8.0.6 pings LAN host -> VPN server -> LAN host (192.168.2.24).

The LAN host sends a reply but does not have a route for the client so sends it to your local router (gateway) with destination 10.8.0.6. Here is where it could go wrong.. The router has not seen the inital SYN of the client so marks the packet out of state. Normally on a Linux host you could prevent this by MASQUERADING or SNAT, don't know if thats possible in Windows. To check if this is the problem you could add a static route on the LAN host like this:

route add 10.8.0.0 MASK 255.255.255.0 192.168.2.12

This way the LAN host will send its reply directly back to the VPN server and bypasses the local router (gateway).

DrAzzy

Badabing! That did it!

Unfortunately, one of the network devices I need to access is an NAS device (Zyxel NSA320), which doesn't have a way to add static routes, so I'm still in a bit of a pickle.

Any thoughts on ways to deal with this problem, without putting a static route on the LAN host?

The first idea I had was to set the default gateway for the NAS device to the OpenVPN server, but wouldn't that force all traffic between the NAS device and other machines on the LAN to go through the one running the OpenVPN server (which also happens to be on 100mbit connection, while most of the rest of the LAN is 1gbit ethernet), thus destroying performance when used within the LAN? Or would the gateway only be used for talking to hosts outside 192.168.2.*, and hence I could do this without impacting the performance within the LAN?

Failing that, could we force get it to route like Client -> VPN Server -> local router -> LAN host, so the router will have seen the initial packet when the response comes, and won't mark it out of state?

Or is it possible that there's a way to tell the router to not drop out of state packets? (Is this a common option, or something I won't find on a consumer router? If there's hope, what might the option be called?)

Thanks much!

krzee

just add that same route to your router
as explained here:
section: "ROUTES TO ADD OUTSIDE OPENVPN"
https://forums.openvpn.net/routed-example-f19.html

dropje

@krzee he did 😉 The problem is out of state packets.

There might be a configurable option in your firewall settings to allow all states going to the network 10.8.0.0/24
The alternative would be to investigate if Windows is able to MASQUERADE or SNAT (Source NAT).

There is no way to force the client going through the local gateway as that is Layer 2 traffic..

DrAzzy

dropje wrote@krzee he did 😉 The problem is out of state packets.

There might be a configurable option in your firewall settings to allow all states going to the network 10.8.0.0/24
The alternative would be to investigate if Windows is able to MASQUERADE or SNAT (Source NAT).

There is no way to force the client going through the local gateway as that is Layer 2 traffic..

Which machine would the MASQUERADE/SNAT need to be done on? I will research whether there is a way to do that on windows.

DrAzzy

Changed the NAS box to use a static IP (same as before, 192.168.2.13, subnet mask 255.255.255.0, gateway 192.168.2.12 (OpenVPN server).

This seems to have done the trick. Performance between NAS and other devices on LAN was not effected.

So it looks like this has been solved.

Thanks a lot for all the help, I never would have realized what the issue was.