Hi all,
I have a Debian Squeeze server (vServer with some restricted rights) running openvpn and multiple windows and OS X clients - they all connect fine and get assigned an IP address and show no errors in the log, however no one of the windows clients can ping the server (they are Windows 7 and one Windows 8), but the OS X Mountain Lion can (OS X Lion client also cannot ping, but this is another issue).
I use the openVPN GUI client v2.3.0 from this site, it is run as adminstrator, renamed the interface to "openVPN" in network connections (and client.conf of course), added a dummy route to prevent Windows form treating it as "unidentified network", looked into the routes, disabled the firewall (completely and later only for the TAP-Adapter) on the clientside and allowed ICMPv4 traffic to pass, just to be sure. None of this helped and I have run out of ideas what to do. Obviously there are no problems in the server.conf or else the OS X Mountain Lion also couldn't connect, right?
Note: This is not the same question posted everywhere that was solved my disabling firewalls, typos in config file etc. because every single solution I tried didn't work. I hope I am in the right forum, if not please move this to the correct one.
Below is my anonymized log from when I connect to the server:
Thu Jan 24 23:03:53 2013 OpenVPN 2.3.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Jan 8 2013
Thu Jan 24 23:03:53 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Jan 24 23:03:53 2013 Need hold release from management interface, waiting...
Thu Jan 24 23:03:54 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Jan 24 23:03:54 2013 MANAGEMENT: CMD 'state on'
Thu Jan 24 23:03:54 2013 MANAGEMENT: CMD 'log all on'
Thu Jan 24 23:03:54 2013 MANAGEMENT: CMD 'hold off'
Thu Jan 24 23:03:54 2013 MANAGEMENT: CMD 'hold release'
Thu Jan 24 23:03:54 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Jan 24 23:03:54 2013 Control Channel Authentication: using 'C:\Program Files (x86)\OpenVPN\config\ta.key' as a OpenVPN static key file
Thu Jan 24 23:03:54 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Jan 24 23:03:54 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Jan 24 23:03:54 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Jan 24 23:03:54 2013 UDPv4 link local: [undef]
Thu Jan 24 23:03:54 2013 UDPv4 link remote: [AF_INET]xx.xx.xx.xx:1194
Thu Jan 24 23:03:54 2013 MANAGEMENT: >STATE:1359065034,WAIT,,,
Thu Jan 24 23:03:54 2013 MANAGEMENT: >STATE:1359065034,AUTH,,,
Thu Jan 24 23:03:54 2013 TLS: Initial packet from [AF_INET]xx.xx.xx.xx:1194, sid=70a61aa0 4e95d008
Thu Jan 24 23:03:55 2013 VERIFY OK: depth=1, C=AT, ST=Tyrol, L=Innsbruck, O=eq, OU=General, CN=openvpn-eq, name=openvpn-eq, emailAddress=admin@xxxxxx.com
Thu Jan 24 23:03:55 2013 VERIFY OK: nsCertType=SERVER
Thu Jan 24 23:03:55 2013 VERIFY OK: depth=0, C=AT, ST=Tyrol, L=Innsbruck, O=eq, OU=General, CN=openvpn-eq, name=openvpn-eq, emailAddress=admin@xxxxxx.com
Thu Jan 24 23:03:55 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Jan 24 23:03:55 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Jan 24 23:03:55 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Jan 24 23:03:55 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Jan 24 23:03:55 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Jan 24 23:03:55 2013 [openvpn-eq] Peer Connection Initiated with [AF_INET]xx.xx.xx.xx:1194
Thu Jan 24 23:03:57 2013 MANAGEMENT: >STATE:1359065037,GET_CONFIG,,,
Thu Jan 24 23:03:58 2013 SENT CONTROL [openvpn-eq]: 'PUSH_REQUEST' (status=1)
Thu Jan 24 23:03:58 2013 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 10.240.43.1,route-gateway 10.240.43.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.240.43.8 255.255.255.0'
Thu Jan 24 23:03:58 2013 OPTIONS IMPORT: timers and/or timeouts modified
Thu Jan 24 23:03:58 2013 OPTIONS IMPORT: --ifconfig/up options modified
Thu Jan 24 23:03:58 2013 OPTIONS IMPORT: route-related options modified
Thu Jan 24 23:03:58 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Jan 24 23:03:58 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Jan 24 23:03:58 2013 MANAGEMENT: >STATE:1359065038,ASSIGN_IP,,10.240.43.8,
Thu Jan 24 23:03:58 2013 open_tun, tt->ipv6=0
Thu Jan 24 23:03:58 2013 TAP-WIN32 device [openVPN] opened: \\.\Global\{145FFCA5-1EBD-49E6-9CA2-42B832968EFE}.tap
Thu Jan 24 23:03:58 2013 TAP-Windows Driver Version 9.9
Thu Jan 24 23:03:58 2013 Set TAP-Windows TUN subnet mode network/local/netmask = 10.240.43.0/10.240.43.8/255.255.255.0 [SUCCEEDED]
Thu Jan 24 23:03:58 2013 Notified TAP-Windows driver tow~i\
Thu Jan 24 22:41:49 2013 Successful ARP Flush on interface [22] {145FFCA5-1EBD-49E6-9CA2-42B832968EFE}
Thu Jan 24 23:03:58 2013 Successful ARP Flush on interface [22] {145FFCA5-1EBD-49E6-9CA2-42B832968EFE}
Thu Jan 24 23:04:03 2013 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Thu Jan 24 23:04:03 2013 C:\Windows\system32\route.exe ADD xx.xx.xx.xx MASK 255.255.255.255 192.168.1.1
Thu Jan 24 23:04:03 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Thu Jan 24 23:04:03 2013 Route addition via IPAPI succeeded [adaptive]
Thu Jan 24 23:04:03 2013 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.240.43.1
Thu Jan 24 23:04:03 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Jan 24 23:04:03 2013 Route addition via IPAPI succeeded [adaptive]
Thu Jan 24 23:04:03 2013 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.240.43.1
Thu Jan 24 23:04:03 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Jan 24 23:04:03 2013 Route addition via IPAPI succeeded [adaptive]
Thu Jan 24 23:04:03 2013 MANAGEMENT: >STATE:1359065043,ADD_ROUTES,,,
Thu Jan 24 23:04:03 2013 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 0.0.0.0 10.240.43.1 METRIC 50
Thu Jan 24 23:04:03 2013 Route addition via IPAPI succeeded [adaptive]
Thu Jan 24 23:04:03 2013 Initialization Sequence Completed
Thu Jan 24 23:04:03 2013 MANAGEMENT: >STATE:1359065043,CONNECTED,SUCCESS,10.240.43.8,xx.xx.xx.xx
and my Windows client config:
dev tun
dev-node openVPN
proto udp
remote xx.xx.xx.xx 1194
#Dummy default gateway to work around Windows 'unidentified network'/'unknown network'
route-metric 50
route 0.0.0.0 0.0.0.0 10.240.43.1
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\client1_win7.crt"
key "C:\\Program Files\\OpenVPN\\config\\client1_win7.key"
ns-cert-type server
tls-auth "C:\\Program Files\\OpenVPN\\config\\ta.key" 1
comp-lzo
verb 3
I don't know if I am allowed to post links to other sites (haven't found any rules concerning that), but I have posted my problem on serverfault
http://serverfault.com/questions/471745/ping-debian-vpn-server-from-windows-clients, there you can find more information about my setup, it saves some time from copying all that stuff again..
Any help is greatly appreciated, really!
