Friends-- My first post here. Production environment Have been working with this about 2 1/2 weeks, 2-3 hours per night, all day on weekends, and finally got remote to be able to access files on server. Some work is getting done! Server ("earth") OS: Ubuntu 12.04.2 Client ("samba1") OS: Lubuntu 12.04.2 Local printer #1: 192.168.0.5 Local printer #2: 192.168.0.10 Local file server, serving Samba shares: 192.168.0.201 Local vnc server: 192.168.0.111 (this is WinXP, and the only Win box) 4 other Ubuntu boxes locally remote is 192.168.1.6 in its local network remote is behind a router server and all local computers are behind a router a ddns is used Intent: get remote computer to be able to print to local printers, and to access the vnc server. In addition, let the local computers see the file locks placed by remote machine (I suspect this is the same issue as the printing and vnc). server.conf: [code] port 1194 proto udp dev tun ca /etc/openvpn/ca.crt cert /etc/openvpn/earth.crt key /etc/openvpn/earth.key # This file should be kept secret dh /etc/openvpn/dh1024.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "route 192.168.0.0 255.255.255.0" client-to-client keepalive 10 120 comp-lzo max-clients 1 persist-key persist-tun status openvpn-status.log verb 3 [/code] client.conf: [code]client dev tun proto udp remote [blanked].no-ip.org 1194 resolv-retry infinite nobind persist-key persist-tun ca /etc/openvpn/ca.crt cert /etc/openvpn/samba1.crt key /etc/openvpn/samba1.key remote-cert-tls server comp-lzo verb 3 [/code] ifconfig server:[code] eth0 Link encap:Ethernet HWaddr [blanked] inet addr:192.168.0.201 Bcast:192.168.0.255 Mask:255.255.255.0 inet6 addr: fe80::213:20ff:fe80:83ad/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:23420190 errors:0 dropped:0 overruns:0 frame:0 TX packets:17003747 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:2559473491 (2.5 GB) TX bytes:1906572766 (1.9 GB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:1414 errors:0 dropped:0 overruns:0 frame:0 TX packets:1414 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:87738 (87.7 KB) TX bytes:87738 (87.7 KB) tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:16311 errors:0 dropped:0 overruns:0 frame:0 TX packets:14893 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:3100129 (3.1 MB) TX bytes:6867717 (6.8 MB)[/code] route server: [code]Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default 192.168.0.1 0.0.0.0 UG 100 0 0 eth0 10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0 10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0 localnet * 255.255.255.0 U 0 0 0 eth0[/code] ifconfig client (eth0 is a dead onboard card):[code] eth0 Link encap:Ethernet HWaddr [blanked] UP BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) Interrupt:17 Base address:0x2000 eth1 Link encap:Ethernet HWaddr [blanked] inet addr:192.168.1.6 Bcast:192.168.1.255 Mask:255.255.255.0 inet6 addr: fe80::204:75ff:fece:6f98/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:32052 errors:0 dropped:0 overruns:39 frame:0 TX packets:14760 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:10785294 (10.7 MB) TX bytes:2656008 (2.6 MB) Interrupt:22 Base address:0x2400 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:450 errors:0 dropped:0 overruns:0 frame:0 TX packets:450 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:43469 (43.4 KB) TX bytes:43469 (43.4 KB) tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.8.0.6 P-t-P:10.8.0.5 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:8569 errors:0 dropped:0 overruns:0 frame:0 TX packets:8629 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:3844799 (3.8 MB) TX bytes:1444815 (1.4 MB)[/code] route client: [code]Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default 192.168.1.1 0.0.0.0 UG 0 0 0 eth1 10.8.0.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun0 10.8.0.5 * 255.255.255.255 UH 0 0 0 tun0 192.168.0.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun0 192.168.1.0 * 255.255.255.0 U 1 0 0 eth1[/code] Friends, I am a real newbie around openvpn, and don't grasp yet all the nuances and meanings of bridging and nat and push, and the like, so please bear with me as I ask questions! My last couple of attempts to make this work were the client-to-client and push lines in the server.conf. If it is a clue, when I try to uncomment the user and group nobody lines, connection fails. 10.8.0.1 and 10.8.0.6 are able to ping each other. Other local computers cannot ping remote, nor can remote ping them. remote can ping 192.168.0.5 and 192.168.0.10 (the printers)(this does not make sense to me, if it cannot print to them). So can you help me realize my intent? Thanks! :- Doug.

hi there, for start your configs look ok.. :) [quote]My last couple of attempts to make this work were the client-to-client[/quote] client-to-client enables the communication between 2 clients.. [quote] and push lines in the server.conf.[/quote] yes you need to push to your clients your local network.. [quote] 10.8.0.1 and 10.8.0.6 are able to ping each other. Other local computers cannot ping remote, nor can remote ping them.[/quote] are those local pc have a static route for 10.8.0.0/24 network pointing to your openvpn servers lan ip? [quote] remote can ping 192.168.0.5 and 192.168.0.10 (the printers)(this does not make sense to me, if it cannot print to them).[/quote] if you can ping them from your openvpn client then you have ip connectivity... which protocol you are using for printing? Michael.

Michael-- Thanks for replying so quickly! Thanks for confirming no major issues in the configs! That is really a relief to me. [quote]client-to-client enables the communication between 2 clients..[/quote] I am guessing this means local client at 192.168.0.7 for instance should be able to see remote at 192.168.1.6/10.8.0.6, yes? But that is not happening: 192.168.0.7 cannot ping either of those addresses. Nor can remote ping 192.168.0.7. Is there a log for ssh to troubleshoot this? [quote]yes you need to push to your clients your local network..[/quote] Have I pushed all that needs to be pushed here? Does 10.8.0.0/24 need to be pushed, too? [quote]are those local pc have a static route for 10.8.0.0/24 network pointing to your openvpn servers lan ip?[/quote] Ahh, you have touched the weak place where I do not understand fully your question. Let me take a couple of guesses: 1. I have not set up the remote computer to have a static 10.8.0.0/24 ipaddress. I have set it up with a static one in its own /etc/hosts for 192.168.0.6. If I need to set it up with a static 10.8.0.6, would I do it in /etc/hosts too? 2. Ahh, you said local PCs! Only 192.168.0.201 (the file server/openvpn server/samba server), and 192.168.0.111 (the vnc server, and in some cases it acts as a print server) as well as the printers have static ipaddresses. What specifically must I do and in what file to accomplish this pointing, please? 3. The /etc/hosts file on the other linux boxes locally all have a line 192.168.0.201 earth. Is this enough? [quote]if you can ping them from your openvpn client then you have ip connectivity...[/quote] Well, I guess I do: [code]doug@samba1:~$ traceroute 192.168.0.5 traceroute to 192.168.0.5 (192.168.0.5), 30 hops max, 60 byte packets 1 10.8.0.1 (10.8.0.1) 25.427 ms 32.319 ms 32.305 ms 2 192.168.0.5 (192.168.0.5) 32.183 ms 32.067 ms 31.881 ms doug@samba1:~$ traceroute 192.168.0.10 traceroute to 192.168.0.10 (192.168.0.10), 30 hops max, 60 byte packets 1 10.8.0.1 (10.8.0.1) 26.302 ms 26.200 ms 26.014 ms 2 192.168.0.10 (192.168.0.10) 24.024 ms 23.861 ms 23.685 ms[/code] This tells me it is going through the openvpn server 10.8.0.1. [quote]which protocol you are using for printing?[/quote] Cups; appears to be version 1.5.3-0ubuntu6 on my desktop, not sure how to tell on the remote, since I only have ssh connectivity to remote. (I ssh to the server and from there ssh to the remote, using 10.8.0.6). Michael, you give me hope by pointing out that the printer connectivity is at least partially there. I suspect you are telling me we are very close! Thanks! :- Doug.

Further info: Just ran [code]lp -d dcp8085dn test.txt[/code] and there is an entry in /var/log/cups/error_log that reads: [code]E [13/Feb/2013:20:51:23 -0500] [Job 15] The printer is not responding. E [13/Feb/2013:20:52:43 -0500] [Job 14] Aborting job because it has no files. E [13/Feb/2013:20:52:56 -0500] [Job 15] The printer is not responding. E [13/Feb/2013:20:54:29 -0500] [Job 15] The printer is not responding. [/code] Clues for us? :- Doug.

Oh, job 15 was the one is just sent using the lp command. I suspect 14 was the one sent yesterday by the remote user. :- Doug.

hi there, [quote]I am guessing this means local client at 192.168.0.7 for instance should be able to see remote at 192.168.1.6/10.8.0.6, yes? But that is not happening: 192.168.0.7 cannot ping either of those addresses. Nor can remote ping 192.168.0.7. Is there a log for ssh to troubleshoot this?[/quote] using the term "clients" i mean openvpn clients, f.e you have 2 clients connected with ips 10.8.0.10 & 10.8.0.14 when client-to-client is enabled one client can see each other... local pcs (the ones inside openvpn servers lan) are not "clients" also your client is visible from your lan with 10.8.0.6 ip ONLY... to access its lan you need to create lan-to-lan connectivity.. (extra directives needed) [quote]Have I pushed all that needs to be pushed here? Does 10.8.0.0/24 need to be pushed, too?[/quote] when you use the server directive , openvpn creates the necessary routes to the client by itself, no need to push route 10.8.0.0 255.255.255.0 about routing stuff... for your internal lan pcs to access a unknown network (thats 10.8.0.0/24 for them) they use by default their default gateway and send packets destined for the vpn network to their default gateway,with that in mind you can: 1) setup a static route on your default gateway for the openvpn subnet or 2) set the openvpn server (lan ip) as the default gateway for the devices you want to be accessible from openvpn clients (your printer servers) the tracert that works is a good sign :) when i say printing protocol i dont mean cups...cups is not a protocol..ipp,lpd,smb are protocols i believe you are using lpd for printing... are you print servers have any other service (web config,ssh) to check their connectivity from openvpn client? yeap i believe you are close... Michael.

maikcat-- Not sure how to tell what protocol my printers are using. The address for both in the system-config-printer dialog starts with dnssd://, and both are using hplip. (Am having some problems with my hp p2035n driver, but my brother dcp-8085 is working well.) In one case I use an address that goes through smb://192.168.0.111/p2035n. Couldn't find anything on Google to help me figure out what protocol I am using. I can access administration for these printers in the local domain via 127.0.0.1:631, if that gives you any clue. [quote]f.e you have 2 clients connected with ips 10.8.0.10 & 10.8.0.14 when client-to-client is enabled one client can see each other...[/quote] OK, then since I only allow one client, I should remove the client to client line, yes? [quote]local pcs (the ones inside openvpn servers lan) are not "clients"[/quote] Thank you for helping me learn this important vocabulary, Michael! [quote]also your client is visible from your lan with 10.8.0.6 ip ONLY... to access its lan you need to create lan-to-lan connectivity.. (extra directives needed)[/quote] Well, it seems to me this is at least part of what I need. Do you agree, Michael? What are those directives, please? [quote]1) setup a static route on your default gateway for the openvpn subnet or 2) set the openvpn server (lan ip) as the default gateway for the devices you want to be accessible from openvpn clients (your printer servers)[/quote] I'm guessing this is the kind of directives you mean, maikcat. 2. seems to be more limited, so I am not sure that is what I want. Do you agree that all three problems I have (file locks, vnc connectivity, printing) are probably related? If so, then it might be harder to choose which devices control those, while a static route for everything makes our troubleshooting less difficult. Am I understanding this correctly? [quote]are you print servers have any other service (web config,ssh) to check their connectivity from openvpn client?[/quote] Just the cups Web interface, but I see nothing there which helps me diagnose connectivity. ssh connections are refused. [quote]yeap i believe you are close...[/quote] Wonderful! So what should I try?

hi there, [quote]In one case I use an address that goes through smb://192.168.0.111/p2035n.[/quote] the [b]smb[/b] is what you need, this tells me that you are printing via samba share...from its name i assume it has a jetdirect lan card what is its default gateway? [quote]OK, then since I only allow one client, I should remove the client to client line, yes?[/quote] if only one client will connect , then yes its safe to comment out client-to-client if you want your client (and NOT pcs that in the same LAN with your client) to be able to access things then its not necessary... 2 directives needed but i dont want to confuse you further.. [quote]while a static route for everything makes our troubleshooting less difficult. Am I understanding this correctly?[/quote] adding a static route to each local pc yes it would make troubleshooting easier but its more easier to setup to your lan pcs the openvpn server as their default gateway... CUPS interface by default only listens to loopback address ,did you setup CUPS to allow connections from the lan to its web management port? (631) please create a detailed diagram about: OS used network topology if ping from openvpn client to printers work ,then your problem is NOT ip connectivity... regards, Michael.

maikcat-- Thank you for helping me, maikcat! [quote]this tells me that you are printing via samba share...from its name i assume it has a jetdirect lan card what is its default gateway?[/quote] I don't know how to tell. I will do some Googling tomorrow and see if I can figure out what a default gateway is. There is no hp card in the pc at 192.168.0.111 as far as I can remember. It is a computer about 6 years old. The printer is physically cabled to a usb port on this pc. This same printer (hp p2035n) also has an ethernet connection to the lan at 192.168.0.5. I print to it both ways. The other printer is strictly accessed through its ethernet cable. I am curious why the printer connection is so crucial to connecting these two lans together? OK, then tomorrow I will comment out client-to-client. I don't know how to set up a default gateway. (That's probably obvious since I don't know what a default gateway is!) Is that one of the two directives you mention? The OS used by the server and two or three other local PCs is Ubuntu 12.04.2. One local pc (192.168.0.111) is WinXP. The openvpn client is Lubuntu 12.04.2. Diagram: Local PCs (Ubuntu & WinXP, 192.168.0.0/24) --> Local server (Ubuntu, 192.168.0.201) --> Router (192.168.0.1) --> Internet --> Router (192.168.1.1) --> Client (192.168.1.6/10.8.0.6) Is that what you wanted? (I need to Google what topology means, probably?) I plan to work on this somewhat intensively tomorrow, so if you can give me some more clues, that would be wonderful, Michael. I have been googling some key terms you have used in your posts, and learning (and confusing myself). Again, my first concern is to get file locks working. Then the VNC. Least important at this point is the printing, because someone local can always do the printing for the person at the remote location, if it is only a document or two. Printing is not a big thing this person does. (If that makes a difference to what you would prescribe, Michael!) Thanks for your help. It feels like you have a life preserver you are thowing to me, and I am in the sea, floundering! :- Doug.

[quote]Thank you for helping me, maikcat![/quote] you welcome :mrgreen: [quote]I will do some Googling tomorrow and see if I can figure out what a default gateway is[/quote] default gateway is usually the ip address of lans router... why i have the feeling that you dont know much about networking.... ;) [quote]The printer is physically cabled to a usb port on this pc. This same printer (hp p2035n) also has an ethernet connection to the lan at 192.168.0.5. I print to it both ways.[/quote] :shock: if your printer has buildin Lan,why on earth are you using its usb port????? [quote]Diagram: Local PCs (Ubuntu & WinXP, 192.168.0.0/24) --> Local server (Ubuntu, 192.168.0.201) --> Router (192.168.0.1) --> Internet --> Router (192.168.1.1) --> Client (192.168.1.6/10.8.0.6) Is that what you wanted? (I need to Google what topology means, probably?)[/quote] the above diagram is sufficient... [quote]Again, my first concern is to get file locks working.[/quote] stupid question...what file locks are? [quote]I plan to work on this somewhat intensively tomorrow, so if you can give me some more clues, that would be wonderful, Michael. I have been googling some key terms you have used in your posts, and learning (and confusing myself).[/quote] try to first learn about tcp/ip basic stuff & networking concepts THEN jump into vpn's concepts.. ;) [quote]I am curious why the printer connection is so crucial to connecting these two lans together?[/quote] its not crucial,but if you have one thing to work f.e vnc all the others will work too... i admire your courage using linux though... :) regards, Michael.

Michael-- Thanks for educating me! The question for me is not so much what is a default gateway but how to set one up? Is it merely a setting in /etc/hosts? Some other file? Is that all I need to make this work, Michael? [quote]i admire your courage using linux though...[/quote] I have been using Linux for about 10 years and am pretty comfortable with most of the things I need to do on a daily basis. Networking within my lan has been no big task, at least once I figured out samba when I was just getting started. But when it comes to iptables and routing, I know pretty much nothing at all! [quote]default gateway is usually the ip address of lans router...[/quote] Oh! I thought it had a special meaning for openvpn purposes! The local is 192.168.0.1, and the remote is 192.168.1.1. [quote]if your printer has buildin Lan,why on earth are you using its usb port?????[/quote] Simple: when I first installed it, one computer we used a lot was Win95, and it could not print to an ipaddress. Over the years we have left it as it was since it was working. I only plugged in its ethernet cable about 2 months ago because of a printer problem. [quote]what file locks are?[/quote] We do a lot of word processing using LibreOffice. There are many common files. For instance there is George's to do list, which is kept in george.odt. Susan might add something to be done, and George might mark off that he has completed a different task. No problem if they edit the file one after the other. But if they are both in the file at the same time, whoever saves last has his or her text preserved--and the other's is lost. A project could get lost. Worse, changes made to documents going to the outside world might not get saved and the outside parties get the wrong document. File locks say to the computers: George is editing this file, so you cannot open it, or you can open it only read only. This keeps the file edits safe and sequential. When we are all on the same lan, the system (I think it is part of LibreOffice, although I suspect Samba has some effect, too) creates a small file that is named something like ".~lock.george.odt#". That way all the computers on the lan see the lock and respect it. This works internally for us. When I open a file the other internal computers see this lock file. The files show up to the server that way. And even the remote computer can see these. Unfortunately, the locks created by remote cannot be seen by the local computers. I suspect that, as you say, if we solve one problem we may solve them all, then working on the vnc connectivity or the file locks will give us the printing, too. So my main question is, how do I get the internal computers to see the remote? What specific lines or directives do i need to add to what files? Can you give me these directives, Michael? Thanks! :- Doug.

allow remote client to print vnc to local computers

dgermann

Thanks Michael! I could never have gotten through this without your kind help.

I will study your suggestions and see if I can implement them.

Thanks, Michael.

« Previous Page