static key vpn works but pki doesn't

dcbahr

Hi there. I've set up a simple static key vpn which works from outside my lan, it's slow but I'm on a cable modem. But I'm concerned about this "forward secrecy" thing which I'm afraid something will get compromised. So I tried to set up a pki vpn with just one client and can't ping across the lan even though the server and client show they are connected. my questions are these: 1. if I'm just using one server and one client, is static key a viable alternative since it is easier to set up than pki and 2. why in the pki config can the server and client see each other even within the lan? I used all defalt values except the udp port which I changed but forwarded on my router. thoughts?

maikcat

hello there,

1. if I'm just using one server and one client, is static key a viable alternative since it is easier to set up than pki

better go with pki....

2. why in the pki config can the server and client see each other even within the lan? I used all defalt values except the udp port which I changed but forwarded on my router. thoughts?

if your config doenst work, simply post configs/logs and we will try to find out what is wrong...

Michael.

dcbahr

ok. here is current server config for the pki.

port 1268
proto udp
dev tun
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem"
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.1.0 255.255.255.0"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

dcbahr

and here is current client config.

client
dev tun
proto udp
remote xxx.dyndns.org 1268
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\dave-laptop.crt"
key "C:\\Program Files\\OpenVPN\\config\\dave-laptop.key"
ns-cert-type server
tls-auth ta.key 1
comp-lzo
push "route 192.168.1.0 255.255.255.0"
verb 3

# Silence repeating messages
;mute 20

maikcat

hi there,

your server side is windows OS..what version?

did you enabled ip forwarding on openvpn server itself?
did you configured its firewall? (if any)

remove the push directive from your client config

add to your server config

log openvpn.log

start up your openvpn server try to connect to it and post the log here...

Michael.

dcbahr

Ok here is that log. I do need the route to my lan though. so can I just do the route "192.168.1.0 255.255.255.0" like I have it in the static key setup? I have not tried testing the client though since I'm not sure what I need to take out or leave in that file.

Tue Feb 26 13:34:17 2013 OpenVPN 2.3.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Feb 14 2013
Enter Management Password:
Tue Feb 26 13:34:17 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Feb 26 13:34:17 2013 Need hold release from management interface, waiting...
Tue Feb 26 13:34:18 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Feb 26 13:34:18 2013 MANAGEMENT: CMD 'state on'
Tue Feb 26 13:34:18 2013 MANAGEMENT: CMD 'log all on'
Tue Feb 26 13:34:18 2013 MANAGEMENT: CMD 'hold off'
Tue Feb 26 13:34:18 2013 MANAGEMENT: CMD 'hold release'
Tue Feb 26 13:34:18 2013 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Tue Feb 26 13:34:18 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Feb 26 13:34:18 2013 Diffie-Hellman initialized with 1024 bit key
Tue Feb 26 13:34:18 2013 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Tue Feb 26 13:34:18 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb 26 13:34:18 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb 26 13:34:18 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Feb 26 13:34:18 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Feb 26 13:34:18 2013 MANAGEMENT: >STATE:1361910858,ASSIGN_IP,,10.8.0.1,
Tue Feb 26 13:34:18 2013 open_tun, tt->ipv6=0
Tue Feb 26 13:34:18 2013 TAP-WIN32 device [Local Area Connection 7] opened: \\.\Global\{4D929BE1-0B9C-4EA1-A78D-10EB9FA3550B}.tap
Tue Feb 26 13:34:18 2013 TAP-Windows Driver Version 9.9
Tue Feb 26 13:34:18 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.1/255.255.255.252 on interface {4D929BE1-0B9C-4EA1-A78D-10EB9FA3550B} [DHCP-serv: 10.8.0.2, lease-time: 31536000]
Tue Feb 26 13:34:18 2013 Sleeping for 10 seconds...
Tue Feb 26 13:34:28 2013 Successful ARP Flush on interface [76] {4D929BE1-0B9C-4EA1-A78D-10EB9FA3550B}
Tue Feb 26 13:34:28 2013 MANAGEMENT: >STATE:1361910868,ADD_ROUTES,,,
Tue Feb 26 13:34:28 2013 C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.2
Tue Feb 26 13:34:28 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Feb 26 13:34:28 2013 Route addition via IPAPI succeeded [adaptive]
Tue Feb 26 13:34:28 2013 UDPv4 link local (bound): [undef]
Tue Feb 26 13:34:28 2013 UDPv4 link remote: [undef]
Tue Feb 26 13:34:28 2013 MULTI: multi_init called, r=256 v=256
Tue Feb 26 13:34:28 2013 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Tue Feb 26 13:34:28 2013 ifconfig_pool_read(), in='dave-laptop,10.8.0.4', TODO: IPv6
Tue Feb 26 13:34:28 2013 succeeded -> ifconfig_pool_set()
Tue Feb 26 13:34:28 2013 IFCONFIG POOL LIST
Tue Feb 26 13:34:28 2013 dave-laptop,10.8.0.4
Tue Feb 26 13:34:28 2013 Initialization Sequence Completed
Tue Feb 26 13:34:28 2013 MANAGEMENT: >STATE:1361910868,CONNECTED,SUCCESS,10.8.0.1,

dcbahr

oops, running win 7 64 bit. removed push routes from server config.

dcbahr

ah sorry, one more thing, yes ip routing is enabled in the registry. Here is the client log though, because it's not right. the client when I connect it gives the ip of 10.8.0.6 and the server has one of 10.8.0.1 and the netmasks are the same. take a look:

Tue Feb 26 13:54:09 2013 OpenVPN 2.3.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Feb 14 2013
Enter Management Password:
Tue Feb 26 13:54:09 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Feb 26 13:54:09 2013 Need hold release from management interface, waiting...
Tue Feb 26 13:54:10 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Feb 26 13:54:10 2013 MANAGEMENT: CMD 'state on'
Tue Feb 26 13:54:10 2013 MANAGEMENT: CMD 'log all on'
Tue Feb 26 13:54:10 2013 MANAGEMENT: CMD 'hold off'
Tue Feb 26 13:54:10 2013 MANAGEMENT: CMD 'hold release'
Tue Feb 26 13:54:10 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Feb 26 13:54:11 2013 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Tue Feb 26 13:54:11 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb 26 13:54:11 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb 26 13:54:11 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Feb 26 13:54:11 2013 MANAGEMENT: >STATE:1361912051,RESOLVE,,,
Tue Feb 26 13:54:11 2013 UDPv4 link local: [undef]
Tue Feb 26 13:54:11 2013 UDPv4 link remote: [AF_INET]24.9.27.117:1268
Tue Feb 26 13:54:11 2013 MANAGEMENT: >STATE:1361912051,WAIT,,,
Tue Feb 26 13:54:11 2013 MANAGEMENT: >STATE:1361912051,AUTH,,,
Tue Feb 26 13:54:11 2013 TLS: Initial packet from [AF_INET]24.9.27.117:1268, sid=3d0c93fc d49c32a9
Tue Feb 26 13:54:11 2013 VERIFY OK: depth=1, C=US, ST=CO, L=Denver, O=OpenVPN, OU=changeme, CN=dave, name=changeme, emailAddress=blah1@gmail.com
Tue Feb 26 13:54:11 2013 VERIFY OK: nsCertType=SERVER
Tue Feb 26 13:54:11 2013 VERIFY OK: depth=0, C=US, ST=CO, L=Denver, O=OpenVPN, OU=changeme, CN=server, name=changeme, emailAddress=blah1@gmail.com
Tue Feb 26 13:54:12 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Feb 26 13:54:12 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb 26 13:54:12 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Feb 26 13:54:12 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb 26 13:54:12 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Feb 26 13:54:12 2013 [server] Peer Connection Initiated with [AF_INET]24.9.27.117:1268
Tue Feb 26 13:54:13 2013 MANAGEMENT: >STATE:1361912053,GET_CONFIG,,,
Tue Feb 26 13:54:14 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue Feb 26 13:54:15 2013 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Tue Feb 26 13:54:15 2013 OPTIONS IMPORT: timers and/or timeouts modified
Tue Feb 26 13:54:15 2013 OPTIONS IMPORT: --ifconfig/up options modified
Tue Feb 26 13:54:15 2013 OPTIONS IMPORT: route options modified
Tue Feb 26 13:54:15 2013 RESOLVE: Cannot resolve host address: 192.168.1.0 255.255.255.0: The requested name is valid, but no data of the requested type was found.
Tue Feb 26 13:54:15 2013 OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.1.0 255.255.255.0
Tue Feb 26 13:54:15 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Feb 26 13:54:15 2013 MANAGEMENT: >STATE:1361912055,ASSIGN_IP,,10.8.0.6,
Tue Feb 26 13:54:15 2013 open_tun, tt->ipv6=0
Tue Feb 26 13:54:15 2013 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{FEE1D806-43CC-4FAA-A862-DC288C5BB0CC}.tap
Tue Feb 26 13:54:15 2013 TAP-Windows Driver Version 9.9
Tue Feb 26 13:54:15 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {FEE1D806-43CC-4FAA-A862-DC288C5BB0CC} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Tue Feb 26 13:54:15 2013 Successful ARP Flush on interface [32] {FEE1D806-43CC-4FAA-A862-DC288C5BB0CC}
Tue Feb 26 13:54:20 2013 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Tue Feb 26 13:54:20 2013 MANAGEMENT: >STATE:1361912060,ADD_ROUTES,,,
Tue Feb 26 13:54:20 2013 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Tue Feb 26 13:54:20 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Feb 26 13:54:20 2013 Route addition via IPAPI succeeded [adaptive]
Tue Feb 26 13:54:20 2013 Initialization Sequence Completed
Tue Feb 26 13:54:20 2013 MANAGEMENT: >STATE:1361912060,CONNECTED,SUCCESS,10.8.0.6,24.9.27.117
Tue Feb 26 14:01:34 2013 C:\Windows\system32\route.exe DELETE 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Tue Feb 26 14:01:34 2013 Route deletion via IPAPI succeeded [adaptive]
Tue Feb 26 14:01:34 2013 Closing TUN/TAP interface
Tue Feb 26 14:01:34 2013 SIGTERM[hard,] received, process exiting
Tue Feb 26 14:01:34 2013 MANAGEMENT: >STATE:1361912494,EXITING,SIGTERM,,

maikcat

hello,

my response

remove the push directive from your client config

your response

oops, running win 7 64 bit. removed push routes from server config.

the client when I connect it gives the ip of 10.8.0.6

.6 is correct...

what OS your client has?

if you are using win 7 make sure you start openvpn with admin rights

Michael.

dcbahr

yeah I wasn't thinking when I wrote that. here are server and client logs now. still can't ping either address even though they both say they are connected. running win7 64bit on client as well and openvpngui.exe is running with admin priv.

server:

port 1268
proto udp
dev tun
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem"
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.1.0 255.255.255.0"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
verb 3

client:

client
dev tun
proto udp
remote blah.dyndns.org 1268
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\dave-laptop.crt"
key "C:\\Program Files\\OpenVPN\\config\\dave-laptop.key"
ns-cert-type server
tls-auth ta.key 1
comp-lzo
route "192.168.1.0 255.255.255.0"
verb 3

frustrated. want this to work, not sure why static key works fine but pki doesn't. followed it to the letter, I thought.

dcbahr

logs:
server:

Thu Feb 28 10:55:31 2013 OpenVPN 2.3.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Feb 14 2013
Enter Management Password:
Thu Feb 28 10:55:31 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Feb 28 10:55:31 2013 Need hold release from management interface, waiting...
Thu Feb 28 10:55:31 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Feb 28 10:55:31 2013 MANAGEMENT: CMD 'state on'
Thu Feb 28 10:55:31 2013 MANAGEMENT: CMD 'log all on'
Thu Feb 28 10:55:31 2013 MANAGEMENT: CMD 'hold off'
Thu Feb 28 10:55:31 2013 MANAGEMENT: CMD 'hold release'
Thu Feb 28 10:55:31 2013 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Thu Feb 28 10:55:31 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Feb 28 10:55:31 2013 Diffie-Hellman initialized with 1024 bit key
Thu Feb 28 10:55:31 2013 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Thu Feb 28 10:55:31 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 28 10:55:31 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 28 10:55:31 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Feb 28 10:55:31 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Feb 28 10:55:31 2013 MANAGEMENT: >STATE:1362074131,ASSIGN_IP,,10.8.0.1,
Thu Feb 28 10:55:31 2013 open_tun, tt->ipv6=0
Thu Feb 28 10:55:31 2013 TAP-WIN32 device [Local Area Connection 7] opened: \\.\Global\{BDC6E4E1-5B22-485A-9553-4A5484897FA0}.tap
Thu Feb 28 10:55:31 2013 TAP-Windows Driver Version 9.9
Thu Feb 28 10:55:31 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.1/255.255.255.252 on interface {BDC6E4E1-5B22-485A-9553-4A5484897FA0} [DHCP-serv: 10.8.0.2, lease-time: 31536000]
Thu Feb 28 10:55:31 2013 Sleeping for 10 seconds...
Thu Feb 28 10:55:41 2013 Successful ARP Flush on interface [77] {BDC6E4E1-5B22-485A-9553-4A5484897FA0}
Thu Feb 28 10:55:41 2013 MANAGEMENT: >STATE:1362074141,ADD_ROUTES,,,
Thu Feb 28 10:55:41 2013 C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.2
Thu Feb 28 10:55:41 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 28 10:55:41 2013 Route addition via IPAPI succeeded [adaptive]
Thu Feb 28 10:55:41 2013 UDPv4 link local (bound): [undef]
Thu Feb 28 10:55:41 2013 UDPv4 link remote: [undef]
Thu Feb 28 10:55:41 2013 MULTI: multi_init called, r=256 v=256
Thu Feb 28 10:55:41 2013 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Thu Feb 28 10:55:41 2013 ifconfig_pool_read(), in='dave-laptop,10.8.0.4', TODO: IPv6
Thu Feb 28 10:55:41 2013 succeeded -> ifconfig_pool_set()
Thu Feb 28 10:55:41 2013 IFCONFIG POOL LIST
Thu Feb 28 10:55:41 2013 dave-laptop,10.8.0.4
Thu Feb 28 10:55:41 2013 Initialization Sequence Completed
Thu Feb 28 10:55:41 2013 MANAGEMENT: >STATE:1362074141,CONNECTED,SUCCESS,10.8.0.1,
Thu Feb 28 10:56:56 2013 128.138.95.193:65335 TLS: Initial packet from [AF_INET]128.138.95.193:65335, sid=2210996e 5cec51c6
Thu Feb 28 10:56:57 2013 128.138.95.193:65335 VERIFY OK: depth=1, C=US, ST=CO, L=Denver, O=OpenVPN, OU=changeme, CN=dave, name=changeme, emailAddress=dcbahr1@gmail.com
Thu Feb 28 10:56:57 2013 128.138.95.193:65335 VERIFY OK: depth=0, C=US, ST=CO, L=Denver, O=OpenVPN, OU=changeme, CN=dave-laptop, name=changeme, emailAddress=dcbahr1@gmail.com
Thu Feb 28 10:56:57 2013 128.138.95.193:65335 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 28 10:56:57 2013 128.138.95.193:65335 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 28 10:56:57 2013 128.138.95.193:65335 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 28 10:56:57 2013 128.138.95.193:65335 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 28 10:56:57 2013 128.138.95.193:65335 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Feb 28 10:56:57 2013 128.138.95.193:65335 [dave-laptop] Peer Connection Initiated with [AF_INET]128.138.95.193:65335
Thu Feb 28 10:56:57 2013 dave-laptop/128.138.95.193:65335 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Thu Feb 28 10:56:57 2013 dave-laptop/128.138.95.193:65335 MULTI: Learn: 10.8.0.6 -> dave-laptop/128.138.95.193:65335
Thu Feb 28 10:56:57 2013 dave-laptop/128.138.95.193:65335 MULTI: primary virtual IP for dave-laptop/128.138.95.193:65335: 10.8.0.6
Thu Feb 28 10:56:59 2013 dave-laptop/128.138.95.193:65335 PUSH: Received control message: 'PUSH_REQUEST'
Thu Feb 28 10:56:59 2013 dave-laptop/128.138.95.193:65335 send_push_reply(): safe_cap=940
Thu Feb 28 10:56:59 2013 dave-laptop/128.138.95.193:65335 SENT CONTROL [dave-laptop]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

client:

Thu Feb 28 10:56:52 2013 OpenVPN 2.3.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Feb 14 2013
Enter Management Password:
Thu Feb 28 10:56:52 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Feb 28 10:56:52 2013 Need hold release from management interface, waiting...
Thu Feb 28 10:56:52 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Feb 28 10:56:52 2013 MANAGEMENT: CMD 'state on'
Thu Feb 28 10:56:52 2013 MANAGEMENT: CMD 'log all on'
Thu Feb 28 10:56:52 2013 MANAGEMENT: CMD 'hold off'
Thu Feb 28 10:56:52 2013 MANAGEMENT: CMD 'hold release'
Thu Feb 28 10:56:52 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Feb 28 10:56:53 2013 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Thu Feb 28 10:56:53 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 28 10:56:53 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 28 10:56:53 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Feb 28 10:56:53 2013 MANAGEMENT: >STATE:1362074213,RESOLVE,,,
Thu Feb 28 10:56:55 2013 UDPv4 link local: [undef]
Thu Feb 28 10:56:55 2013 UDPv4 link remote: [AF_INET]24.9.27.117:1268
Thu Feb 28 10:56:55 2013 MANAGEMENT: >STATE:1362074215,WAIT,,,
Thu Feb 28 10:56:55 2013 MANAGEMENT: >STATE:1362074215,AUTH,,,
Thu Feb 28 10:56:55 2013 TLS: Initial packet from [AF_INET]24.9.27.117:1268, sid=bacbc48a 51e16547
Thu Feb 28 10:56:56 2013 VERIFY OK: depth=1, C=US, ST=CO, L=Denver, O=OpenVPN, OU=changeme, CN=dave, name=changeme, emailAddress=dcbahr1@gmail.com
Thu Feb 28 10:56:56 2013 VERIFY OK: nsCertType=SERVER
Thu Feb 28 10:56:56 2013 VERIFY OK: depth=0, C=US, ST=CO, L=Denver, O=OpenVPN, OU=changeme, CN=server, name=changeme, emailAddress=dcbahr1@gmail.com
Thu Feb 28 10:56:56 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 28 10:56:56 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 28 10:56:56 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 28 10:56:56 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 28 10:56:56 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Feb 28 10:56:56 2013 [server] Peer Connection Initiated with [AF_INET]24.9.27.117:1268
Thu Feb 28 10:56:57 2013 MANAGEMENT: >STATE:1362074217,GET_CONFIG,,,
Thu Feb 28 10:56:59 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 28 10:56:59 2013 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Thu Feb 28 10:56:59 2013 OPTIONS IMPORT: timers and/or timeouts modified
Thu Feb 28 10:56:59 2013 OPTIONS IMPORT: --ifconfig/up options modified
Thu Feb 28 10:56:59 2013 OPTIONS IMPORT: route options modified
Thu Feb 28 10:56:59 2013 RESOLVE: Cannot resolve host address: 192.168.1.0 255.255.255.0: The requested name is valid, but no data of the requested type was found.
Thu Feb 28 10:56:59 2013 OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.1.0 255.255.255.0
Thu Feb 28 10:56:59 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Feb 28 10:56:59 2013 MANAGEMENT: >STATE:1362074219,ASSIGN_IP,,10.8.0.6,
Thu Feb 28 10:56:59 2013 open_tun, tt->ipv6=0
Thu Feb 28 10:56:59 2013 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{8E19C812-02EC-42AB-ADD5-A9894C894313}.tap
Thu Feb 28 10:56:59 2013 TAP-Windows Driver Version 9.9
Thu Feb 28 10:56:59 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {8E19C812-02EC-42AB-ADD5-A9894C894313} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Thu Feb 28 10:56:59 2013 Successful ARP Flush on interface [33] {8E19C812-02EC-42AB-ADD5-A9894C894313}
Thu Feb 28 10:57:04 2013 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Thu Feb 28 10:57:04 2013 MANAGEMENT: >STATE:1362074224,ADD_ROUTES,,,
Thu Feb 28 10:57:04 2013 C:\Windows\system32\route.exe ADD 192.168.1.0 MASK 255.255.255.0 10.8.0.5
Thu Feb 28 10:57:04 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 28 10:57:04 2013 Route addition via IPAPI succeeded [adaptive]
Thu Feb 28 10:57:04 2013 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Thu Feb 28 10:57:04 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 28 10:57:04 2013 Route addition via IPAPI succeeded [adaptive]
Thu Feb 28 10:57:04 2013 Initialization Sequence Completed
Thu Feb 28 10:57:04 2013 MANAGEMENT: >STATE:1362074224,CONNECTED,SUCCESS,10.8.0.6,24.9.27.117

maikcat

remove the route directive from your client config

use netstat -nr on your client and check if the route for 192.168.1.0 network
is added after the vpn is up...

on your server side ,how the virtual adapter is recognized? as unindentified network?

is there any antivirus/antimalware software running on server side?

Michael.

dcbahr

Yes, route is there on client side netstat -nr command. Took route directive out of client config. Server has microsoft security essentials on it. I'd rather not disable that, I only have one router here. still can't ping either server or client even inside the lan.

dcbahr

yes, the network adapter does say unidentified network. I did specify the adapter name after the dev-node line, forgot to do that since I now have two adapters, one for static key config which I know works and then one for t pki config which I really want to get working. should I try disabling windows firewall? the ports are open on the router and the firewall is allowing traffic through on any port it looks like, not sure what else to do

dcbahr

So I did some more looking through the routing tables and it appears that the client doesn't recognize the gateway as 10.8.0.1. It shows the client connected to itself but not to the gateway. So it's a loop? Should I just get a new set of sample config files?

maikcat

here we go again...

your config:

client
dev tun
proto udp
remote blah.dyndns.org 1268
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\dave-laptop.crt"
key "C:\\Program Files\\OpenVPN\\config\\dave-laptop.key"
ns-cert-type server
tls-auth ta.key 1
comp-lzo
[b] push route "192.168.1.0 255.255.255.0" [/b]
verb 3

my comment:

remove the push directive from your client config

your config after that...

client
dev tun
proto udp
remote blah.dyndns.org 1268
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\dave-laptop.crt"
key "C:\\Program Files\\OpenVPN\\config\\dave-laptop.key"
ns-cert-type server
tls-auth ta.key 1
comp-lzo
[b] route "192.168.1.0 255.255.255.0" [/b]   <--you removed the push word.... :? 
verb 3

let me refrase that...

please remove the whole line (push "route 192.168.1.0 255.255.255.0) from your client config
then try to reconnect and check your routing table using netstat -nr directive...

Server has microsoft security essentials on it. I'd rather not disable that

when you try to setup something and its not working ,and you dont know why,
you try to disable firewall and everything else that it looks suspicious until your setup works,
then when you find what blocks you you try to configure it...

forgot to do that since I now have two adapters, one for static key config which I know works and then one for t pki config which I really want to get working. should I try disabling windows firewall

tell me you are trying to run 2 configs simultaneous.....

if you are testing one config at a time you can safely do it with one adapter...
openvpn's behavior is directed by its config file , not by tap adapter itself...

Michael.

dcbahr

Well now I've got a new problem. I started over with the client config file from the sample directory. I figured that maybe I just missed something somewhere so why not start from scratch? Now I'm getting a different error when I try to connect the client. it says the following in the log. same thing every time I try to connect. even after rebuilding the keys for both server and client. server connects fine. clint log is

Sun Mar 03 22:24:56 2013 OpenVPN 2.3.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Feb 14 2013
Enter Management Password:
Sun Mar 03 22:24:56 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sun Mar 03 22:24:56 2013 Need hold release from management interface, waiting...
Sun Mar 03 22:24:57 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sun Mar 03 22:24:57 2013 MANAGEMENT: CMD 'state on'
Sun Mar 03 22:24:57 2013 MANAGEMENT: CMD 'log all on'
Sun Mar 03 22:24:57 2013 MANAGEMENT: CMD 'hold off'
Sun Mar 03 22:24:57 2013 MANAGEMENT: CMD 'hold release'
Sun Mar 03 22:24:57 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sun Mar 03 22:24:58 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sun Mar 03 22:24:58 2013 MANAGEMENT: >STATE:1362374698,RESOLVE,,,
Sun Mar 03 22:24:58 2013 UDPv4 link local: [undef]
Sun Mar 03 22:24:58 2013 UDPv4 link remote: [AF_INET]24.9.27.117:1194
Sun Mar 03 22:24:58 2013 MANAGEMENT: >STATE:1362374698,WAIT,,,
Sun Mar 03 22:25:07 2013 SIGTERM[hard,] received, process exiting
Sun Mar 03 22:25:07 2013 MANAGEMENT: >STATE:1362374707,EXITING,SIGTERM,,

client config now looks like this, where did I go wrong?

sample-config-files/client.conf
##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server. #
# #
# This configuration can be used by multiple #
# clients, however each client should have #
# its own cert and key files. #
# #
# On Windows, you might want to rename this #
# file so it has a .ovpn extension #
##############################################
# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client
# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun
# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one. On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap
# Are we connecting to a TCP or
# UDP server? Use the same setting as
# on the server.
;proto tcp
proto udp
# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote dcbahr.dyndns.org 1194
;remote my-server-2 1194
# Choose a random host from the remote
# list for load-balancing. Otherwise
# try hosts in the order specified.
;remote-random
# Keep trying indefinitely to resolve the
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite
# Most clients don't need to bind to
# a specific local port number.
nobind
# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nobody
# Try to preserve some state across restarts.
persist-key
persist-tun
# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here. See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
# Wireless networks often produce a lot
# of duplicate packets. Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings
# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert ""C:\\Program Files\\OpenVPN\\config\\dave-laptop.crt"
key ""C:\\Program Files\\OpenVPN\\config\\dave-laptop.key"
# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server". This is an
# important precaution to protect against
# a potential attack discussed here:
#
http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server". The build-key-server
# script in the easy-rsa folder will do this.
ns-cert-type server
# If a tls-auth key is used on the server
# then every client must also have the key.
;tls-auth ta.key 1
# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x
# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo
# Set log file verbosity.
verb 3
# Silence repeating messages
;mute 20

maikcat

client
dev tun
proto udp
remote dcbahr.dyndns.org 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert ""C:\\Program Files\\OpenVPN\\config\\dave-laptop.crt"
key ""C:\\Program Files\\OpenVPN\\config\\dave-laptop.key"
ns-cert-type server
comp-lzo
verb 3

please remove comments from your config before posting,

also post server logs also...without them its impossible to tell what is going wrong...

Michael.

dcbahr

sorry, I'm totally blind and I wasn't sure how to get rid of the comments without copying lines one by one in to the post, it's pretty hard to highlight things with a screen reader sometimes. Here is the server log from the openvpn.log file

Mon Mar 04 10:15:22 2013 OpenVPN 2.3.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Feb 14 2013
Enter Management Password:
Mon Mar 04 10:15:22 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Mon Mar 04 10:15:22 2013 Need hold release from management interface, waiting...
Mon Mar 04 10:15:23 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Mon Mar 04 10:15:23 2013 MANAGEMENT: CMD 'state on'
Mon Mar 04 10:15:23 2013 MANAGEMENT: CMD 'log all on'
Mon Mar 04 10:15:23 2013 MANAGEMENT: CMD 'hold off'
Mon Mar 04 10:15:23 2013 MANAGEMENT: CMD 'hold release'
Mon Mar 04 10:15:23 2013 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Mon Mar 04 10:15:23 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Mar 04 10:15:23 2013 Diffie-Hellman initialized with 1024 bit key
Mon Mar 04 10:15:23 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Mar 04 10:15:23 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Mar 04 10:15:23 2013 MANAGEMENT: >STATE:1362417323,ASSIGN_IP,,10.8.0.1,
Mon Mar 04 10:15:23 2013 open_tun, tt->ipv6=0
Mon Mar 04 10:15:23 2013 TAP-WIN32 device [Local Area Connection 7] opened: \\.\Global\{39343813-36AB-44D0-9C11-BAC673BA0916}.tap
Mon Mar 04 10:15:23 2013 TAP-Windows Driver Version 9.9
Mon Mar 04 10:15:23 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.1/255.255.255.252 on interface {39343813-36AB-44D0-9C11-BAC673BA0916} [DHCP-serv: 10.8.0.2, lease-time: 31536000]
Mon Mar 04 10:15:23 2013 Sleeping for 10 seconds...
Mon Mar 04 10:15:33 2013 Successful ARP Flush on interface [77] {39343813-36AB-44D0-9C11-BAC673BA0916}
Mon Mar 04 10:15:33 2013 MANAGEMENT: >STATE:1362417333,ADD_ROUTES,,,
Mon Mar 04 10:15:33 2013 C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.2
Mon Mar 04 10:15:33 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Mon Mar 04 10:15:33 2013 Route addition via IPAPI succeeded [adaptive]
Mon Mar 04 10:15:33 2013 UDPv4 link local (bound): [undef]
Mon Mar 04 10:15:33 2013 UDPv4 link remote: [undef]
Mon Mar 04 10:15:33 2013 MULTI: multi_init called, r=256 v=256
Mon Mar 04 10:15:33 2013 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Mon Mar 04 10:15:33 2013 IFCONFIG POOL LIST
Mon Mar 04 10:15:33 2013 Initialization Sequence Completed
Mon Mar 04 10:15:33 2013 MANAGEMENT: >STATE:1362417333,CONNECTED,SUCCESS,10.8.0.1,

so it looks like the server connected fine.

maikcat

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.