stevew
Hi,
I have a strange problem with OpenVPN from a Windows 7 client to a Linux server. There must be something simple I'm missing. I've worked with OpenVPN for years and never seen anything like this before.
The server is on 172.16.0.55, the workstations are on 192.168.1.0/24. The connection passes through a D-Link firewall/router and the traffic between the 172.16.0.0/24 and 192.168.1.0/24 networks is routed not NATted. The client does not have a direct route to the 172.16.0.0/24 network; it goes via its default route.
A VMWare virtual machine running Windows 7 can connect when the VM network interface is configured to NAT but it cannot connect when the VM network interface is configured to bridged (ie is on the 192.168.1.0/24 network). When bridged, the IP address, DNS and gateway are configured via DHCP.
The client configuration is straightforward:
remote 172.16.0.55 1194
dev tun
ifconfig 10.10.0.2 10.10.0.1
comp-lzo
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
route 10.0.0.0 255.255.255.0
secret static-A.key
As is the server configuration:
dev tun
ifconfig 10.10.0.1 10.10.0.2
comp-lzo
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
secret static-A.key
The 10.0.0.0/24 network is on the other side of the OpenVPN server that I want to connect to. Its a training area which I want to keep isolated from our networks but allow admins to get remote desktop on the machines in that area. Hence the VPN.
When the VM is on NAT and I connect with OpenVPN I can see the traffic on the server with tcpdump.
When the VM is on bridged and I try to connect with OpenVPN I can see no traffic on the server with tcpdump. Nothing; the client is not sending any traffic. When I run wireshark on the client VM I can see it trying to send the OpenVPN connection traffic to the appropriate IP address through the appropriate interface. At first I was seeing checksum errors on the UDP packets; I disabled checksum offload on the virtual NIC and this error went away but the traffic still doesn't get to the OpenVPN server.
With the VM on bridged I can use nmap to run a detailed scan just on UDP port 1194 on the server and I see the traffic generated by this scan in tcpdump on the server and the OpenVPN port shows up nicely in the nmap output on the client.
The firewall on the VM is disabled and there is no firewall on the server except the server is running NAT for the 10.0.0.0/24 network to allow its servers to get to the internet.
I am completely stumped. When the VM NIC is on the LAN address OpenVPN client just cannot send traffic to the server at 172.16.0.55, when its on a hidden NATted IP address it works. Oh and the VMWare host that this is running on is on the 192.168.1.0/24 network, in case that wasn't clear. I've tried several workstations and none can connect.
So, what is the incredibly obvious thing that I am just not seeing?
Thanks, I look forward to being made to look like a complete idiot.
