I'm using tunnel mode on a Debian installation. I have 3 Win7 laptops connecting to my server. I want to connect from each laptop to the others through OpenVPN using RDP.
My setup:
LAN- 192.168.1.0/24
VPN- 192.168.128.0/24
VPN Server- 192.168.1.64
Laptop1: 192.168.128.6
Laptop2: 192.168.128.18 (problematic laptop)
All 3 of them connect fine, I get an IP address and I can ping the server (192.168.128.1) without any issues. However, one of my laptops is giving me quite a few issues. I can RDP from that laptop to others. However, I cannot RDP from the other laptops to this one. Even though I can ping the server, I cannot ping other hosts (I don't know if I'm missing an iptables entry for this one).
I tried disabling the Windows 7 firewall on the problematic laptop, but that did not help. I don't know what configuration I'm missing.
tcpdump -i tun0 does not show me any traffic even when I have a successful connection.
Can someone please help me troubleshoot this issue?
Thanks,
MT
Some config info:
Server
mode server
tls-server
port 1194
proto udp
dev tun
ca /etc/CA/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/CA/openvpn/easy-rsa/2.0/keys/VPNServer.crt
key /etc/CA/openvpn/easy-rsa/2.0/keys/VPNServer.key # This file should be
kept secret
tls-auth /etc/CA/openvpn/easy-rsa/2.0/keys/ta.key 0 # This file is secret
dh /etc/CA/openvpn/easy-rsa/2.0/keys/dh1024.pem
server 192.168.128.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-to-client
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
Client
client
dev tap
proto udp
remote server 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert laptop1.crt
key laptop1.key
ns-cert-type server
tls-auth ta.key 1
comp-lzo
verb 3
iptables-save
*filter
:INPUT ACCEPT [164:17683]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [121:11379]
-A INPUT -i tun+ -j ACCEPT
COMMIT
Client connection log
OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
LZO compression initialized
Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Socket Buffers: R=[8192->8192] S=[8192->8192]
Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Local Options hash (VER=V4): '504e774e'
Expected Remote Options hash (VER=V4): '14168603'
UDPv4 link local: [undef]
UDPv4 link remote: 192.168.1.64:1194
TLS: Initial packet from 192.168.1.64:1194, sid=f465cdb1 ff3600f2
VERIFY OK: depth=1, /cert info deleted
VERIFY OK: nsCertType=SERVER
VERIFY OK: depth=0, /cert info deleted
Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
[VPNServer] Peer Connection Initiated with 192.168.1.64:1194
SENT CONTROL [VPNServer]: 'PUSH_REQUEST' (status=1)
PUSH: Received control message: 'PUSH_REPLY,route 192.168.128.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.128.18 192.168.128.17'
OPTIONS IMPORT: timers and/or timeouts modified
OPTIONS IMPORT: --ifconfig/up options modified
OPTIONS IMPORT: route options modified
ROUTE default_gateway=192.168.1.1
TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{177CFBE8-18BE-4AB5-B304-83121BDDBE2B}.tap
TAP-Win32 Driver Version 9.9
TAP-Win32 MTU=1500
Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.128.18/255.255.255.252 on interface {177CFBE8-18BE-4AB5-B304-83121BDDBE2B} [DHCP-serv: 192.168.128.17, lease-time: 31536000]
Successful ARP Flush on interface [29] {177CFBE8-18BE-4AB5-B304-83121BDDBE2B}
TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
C:\WINDOWS\system32\route.exe ADD 192.168.128.0 MASK 255.255.255.0 192.168.128.17
ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Route addition via IPAPI succeeded [adaptive]
Initialization Sequence Completed
