OpenVPN looks alright, though no Ping possible?

[deleted]

Alright guy, good evenning!

I'm having a little prob down here. The situation is, that I have an OpenVPN server in my little LAN openning a bridge to clients from WAN.
Doing the connect operation from the clients side works out to be alright. The connection can be estabilished.
Though once connected I cannot reach any IP in the server's network. If I now perform a ping from the client's side to some IP in the network that does not belong to nobody, I get the normal respond and if I ping an IP that is asigned to an existing computer, I don't get a ping response from that computer, but of my own TAP saying that the host is unreachable...??
Why can I not reach anyone in the network?

I tried to follow the configuration shown on http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html the best I could and I checked their FAQ as well, which wasn't successful though.

Guys, please let me know what information you need from my computers and I'll provide that the fastest I can.
Thank in advance for any helpful soul!!!

Could anybody help me out, please?

maikcat

hi there,

please for starters post your server config & every setting you done on your server side..

Michael.

[deleted]

Hi Michael!

First off, thanks for your reply. I will try to provide all the necessary information.

Meanwhile I tried around a bit with the openvpn settings of my server, finding out that I had a little misconfiguration setting up the bridge. But we may walk our way through.

The details of my server are:

OS: Ubuntu 10.04
eth0: not used
eth1: 10.10.10.2
eth1-mask: 255.255.255.0

LAN-router/gateway: 10.10.10.1
router-forwarding: port 1194 to 10.10.10.2

To setup the bridge I do:

sudo openvpn --mktun --dev tap0
sudo brctl addbr br0
sudo brctl addif br0 eth1

And at the last command connecting br0 and eth1 the ssh-connection to my server interrupts and I have to restart my server manually. Why is that? What's wrong on that?

maikcat

you can setup your ubuntu lan nic in bridged mode and adding tap0
when starting openvpn service...

also post your server config,the output of ifconfig command.

be sure to have ip forwarding enabled and ip tables disabled for testing.

Michael.

[deleted]

you can setup your ubuntu lan nic in bridged mode and adding tap0
when starting openvpn service...

Well, after "sudo brctl addif br0 eth1" I am not able to continue any further, as I don't reach the server anymore. I believe that I have to find a solution for that bridging before starting to operate on the server.conf. What command would be right to setup a bridge?

Server config:

port 1194
proto udp
dev tap0
ca keys/ca.crt
cert keys/server.crt
key keys/server.key
dh keys/dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 10.10.10.1 255.255.255.0 10.10.10.50 10.10.10.100
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

ifconfig:

eth0      Link encap:Ethernet  Hardware Adresse 00:3c:c5:53:8e:ac  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metrik:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 Sendewarteschlangenlänge:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:19 Basisadresse:0x2100 

eth1      Link encap:Ethernet  Hardware Adresse d0:36:9b:59:31:b6  
          inet Adresse:10.10.10.2  Bcast:10.10.10.255  Maske:255.255.255.0
          inet6-Adresse: fe20::e236:9aef:f229:42a7/64 Gültigkeitsbereich:Verbindung
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metrik:1
          RX packets:47043 errors:0 dropped:0 overruns:0 frame:0
          TX packets:31307 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 Sendewarteschlangenlänge:1000 
          RX bytes:17322819 (17.3 MB)  TX bytes:4719213 (4.7 MB)
          Interrupt:17 Basisadresse:0x6000 

lo        Link encap:Lokale Schleife  
          inet Adresse:127.0.0.1  Maske:255.0.0.0
          inet6-Adresse: ::1/128 Gültigkeitsbereich:Maschine
          UP LOOPBACK RUNNING  MTU:16436  Metrik:1
          RX packets:326 errors:0 dropped:0 overruns:0 frame:0
          TX packets:326 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 Sendewarteschlangenlänge:0 
          RX bytes:28082 (28.0 KB)  TX bytes:28082 (28.0 KB)

Ip forwarding works on my router and is setup.

...and ip tables disabled for testing.

How do I disable iptables?

Any idea of that bridging problem? How do I setup a bridge + tap the right way?

maikcat

merry christmas,

here we go...

sample /etc/network/interfaces
-------------------------------------------------------------------
# The primary network interface
auto eth0
iface eth0 inet manual

auto br0
iface br0 inet static
address 192.168.178.236
network 192.168.178.0
netmask 255.255.255.0
broadcast 192.168.178.255
gateway 192.168.178.203
bridge_ports eth0
bridge_stp off
bridge_fd 0
bridge_maxwait 0
-------------------------------------------------------------------

i personally uninstall Network-Manager package...

use the 2 brctl commands to add tap0 to br0

sudo brctl addbr br0
sudo brctl addif br0 eth1

keep in mind that in ifconfig output both eth1 & tap0 MUST
have promisc status...

Ip forwarding works on my router and is setup.

i was talking about your openvpn server itself..(unless its also the router)

How do I disable iptables?

the easy way...
service iptables stop

regards,

Michael.

[deleted]

Merry Christmas,

alright I have had quite some tries around and I got the thing about the bridging fixed. Seems to work well now.
After that I adapted the server.conf.
The only thing is, that I still get an error on the client side when I try to connect. The result is that the connection is not estabilished. I get an error log that I will post at the end of this posting.
Here is my complete configuration of the server and the client:

These are my files in /etc/openvpn/ (SERVER)

down.sh
easy-rsa #folder with rsa in files in it
keys/ca.crt
keys/dh1024.pem
keys/server.crt
keys/server.key
server.conf
ta.key
up.sh

This is in the up.sh: (SERVER)

#!/bin/sh

BR=$1
DEV=$2
MTU=$3
/sbin/ip link set "$DEV" up promisc on mtu "$MTU"
brctl addif $BR $DEV

This is in the down.sh: (SERVER)

#!/bin/sh

BR=$1
DEV=$2

brctl delif $BR $DEV
/sbin/ip link set "$DEV" down

This is in the server.conf: (SERVER)

mode server
tls-server

local 10.10.10.2  #ip/hostname of server
port 1194         #default open port
proto udp

#bridging directive
dev tap0          #If you need multiple tap devices, add them here
up "/etc/openvpn/up.sh br0 tap0 1500"
down "/etc/openvpn/down.sh br0 tap0"

persist-key
persist-tun

#certificates and encryption
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key   #this file is secret
dh /etc/openvpn/keys/dh1024.pem
tls-auth /etc/openvpn/ta.key       #this file is secret

cipher BF-CBC                      #Blowfish (default)
comp-lzo

#DHCP information
ifconfig-pool-persist ipp.txt
server-bridge 10.10.10.2 255.255.255.0 10.10.10.100 10.10.10.110
push "dhcp-option DNS 10.10.10.1"
#push "dhcp-option DOMAIN yourdomain.com"
max-clients 10                     #set this to the max number of clients to be connected at a time

#log and security
user nobody
group nogroup
keepalive 10 120
status /etc/openvpn/openvpn-status.log
verb 3

This is in the /etc/network/interfaces: (SERVER)

# The loopback network interface
auto lo br0
iface lo inet loopback
#iface eth1 inet dhcp

iface br0 inet static
  address 10.10.10.2
  netmask 255.255.255.0
  gateway 10.10.10.1
  bridge_ports eth1

iface eth1 inet manual
  up ip link set $IFACE up promisc on
  down ip link set $IFACE down promisc off

This is in ifconfig: (SERVER)

br0       Link encap:Ethernet  Hardware Adresse e1:42:9c:2c:c1:d7  
          inet Adresse:10.10.10.2  Bcast:10.10.10.255  Maske:255.255.255.0
          inet6-Adresse: fe80::e446:9bff:fe29:42a7/64 Gültigkeitsbereich:Verbindung
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metrik:1
          RX packets:3186 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1657 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 Sendewarteschlangenlänge:0 
          RX bytes:321170 (321.1 KB)  TX bytes:219304 (219.3 KB)

eth1      Link encap:Ethernet  Hardware Adresse e1:42:9c:2c:c1:d7  
          inet6-Adresse: fe80::e446:9bff:fe29:42a7/64 Gültigkeitsbereich:Verbindung
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metrik:1
          RX packets:3244 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1657 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 Sendewarteschlangenlänge:1000 
          RX bytes:379986 (379.9 KB)  TX bytes:219304 (219.3 KB)
          Interrupt:17 Basisadresse:0x6000 

lo        Link encap:Lokale Schleife  
          inet Adresse:127.0.0.1  Maske:255.0.0.0
          inet6-Adresse: ::1/128 Gültigkeitsbereich:Maschine
          UP LOOPBACK RUNNING  MTU:16436  Metrik:1
          RX packets:136 errors:0 dropped:0 overruns:0 frame:0
          TX packets:136 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 Sendewarteschlangenlänge:0 
          RX bytes:11064 (11.0 KB)  TX bytes:11064 (11.0 KB)

service iptables stop

Does not work on my Ubuntu 10.04 LTS server. Is there another way? When I put this command the system responds: iptables: unrecognized service

These files are in ~/openvpn/ (CLIENT)

ca.crt
client.conf
client.crt
client.key
ta.key

This is in the client.conf (CLIENT)

#Specify that this is a client
client

#Bridge device setting
dev tap

#Host name and port for the server
remote myserver 1194

#Client does not need to bind to a specific local port
nobind

#Keep trying to resolve
resolv-retry infinite

#Preserve state across restarts
persist-key
persist-tun

#SSL/TLS parameters
ca /home/myuser/openvpn/ca.crt
cert /home/myuser/openvpn/client.crt
key /home/myuser/openvpn/client.key

#tls-auth for server
#note: 0 = server, 1 = client
tls-auth /home/myuser/openvpn/ta.key 1

#Specify same cipher as server
cipher BF-CBC

#Use compression
comp-lzo

#Log verbosity
verb 3

This is the error while connecting: (CLIENT)

myuser@mycomputer:~/openvpn$ sudo openvpn --config client.conf
Wed Dec 26 03:30:16 2012 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Mar 30 2012
Wed Dec 26 03:30:16 2012 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Dec 26 03:30:16 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Dec 26 03:30:16 2012 Control Channel Authentication: using '/home/myuser/openvpn/ta.key' as a OpenVPN static key file
Wed Dec 26 03:30:16 2012 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Dec 26 03:30:16 2012 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Dec 26 03:30:16 2012 LZO compression initialized
Wed Dec 26 03:30:16 2012 Control Channel MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ]
Wed Dec 26 03:30:16 2012 Socket Buffers: R=[229376->131072] S=[229376->131072]
Wed Dec 26 03:30:16 2012 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Wed Dec 26 03:30:16 2012 Local Options hash (VER=V4): '13a273ba'
Wed Dec 26 03:30:16 2012 Expected Remote Options hash (VER=V4): '360696c5'
Wed Dec 26 03:30:16 2012 UDPv4 link local: [undef]
Wed Dec 26 03:30:16 2012 UDPv4 link remote: [AF_INET]10.10.10.2:1194
Wed Dec 26 03:30:16 2012 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Wed Dec 26 03:30:18 2012 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Wed Dec 26 03:30:22 2012 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Wed Dec 26 03:30:31 2012 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)

Where is the error? What's the next step?

[deleted]

Ok, the client couldn't connect, because I totally forgot to put the command:

sudo openvpn --config server.conf

on the server!

Now the client can reach the server!

But there is another thing:

I had to shut down all the TLS functionality on both, client and server, because I got the following error on the server side while trying to connect with the client:

Wed Dec 26 06:15:19 2012 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]31.59.13.64:54919

I therefore had to undo both with a '#':

(SERVER)

tls-auth /etc/openvpn/ta.key

(CLIENT)

tls-auth /home/jean/openvpn/ta.key 1

After having undone them with the '#' the connection now works perfectly well. I can connect and disconnect with my client to my desired network.
But what went wrong with the tls-auth? Is my connection now less secure? How can I repair this so that I can reuse the tls-auth?

Thank you very much for your help!

maikcat

hi there,

start/stop scripts are usually located in /etc/init.d folder
check if there is a script about iptables there...

i noticed this on your logs:

Wed Dec 26 03:30:16 2012 UDPv4 link local: [undef]
Wed Dec 26 03:30:16 2012 UDPv4 link remote: [AF_INET]10.10.10.2:1194

and this

Wed Dec 26 06:15:19 2012 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]31.59.13.64:54919

are you testing your vpn inside your network or from internet?

Michael.

[deleted]

are you testing your vpn inside your network or from internet?

Yep, partially I am testing inside of my network, just to test if the server is responding at all. Yeah, well now everything works well and the last question surviving in my mind is about this "tls-auth" and the ta.key.
Do I have maximum security right now without tls-auth? Why does tls-auth not work in my settings?

maikcat

try to connect direct to your openvpn server (remove any push routes) WITH tls-auth enabled..

Michael.

[deleted]

Doesn't seem to work.
What exactly does tls-auth do?
Is my connection unsecure without?

[deleted]

Ok, there is another little problem. -> How do I tell the server to run the server.conf automatically at startup?
Right now the server has to be run by hand telling him to "sudo openvpn --config server.conf"
What must I do to let the server create the connection-listening automatically?

maikcat

hi there,

you need to install chkconfig in order to enable/disable easily services for startup..

you can create by hand the appropriate S* & K* scripts but is a PITA...

if you are curious look inside /etc/rc.d folder....

after you install chkconfig simply run

chkconfig openvpn on

regards

Michael