Please help, TAP worked forever, can't get TUN to work

burntoc

All,

First, thanks in advance for any help. Second, I've searched and searched and read wikis but I just can't seem to get enough info to solve my problem. Per my subject, too, I've had TAP OpenVPN working on multiple routers (Cisco, Linksys, Asus) at multiple sites, so at least I know that I'm capable of getting it working with enough info. I want to connect my Android phone and some other devices that only use TUN mode, so this is forcing my change. Messing with some configurations allows me to connect, but I can't ping the router or route through (testing using a Windows laptop). Here is my current setup:

Handful of mixed clients, though most are Windows 7, with some Android, iPhone
ASUS N66U Dark Knight router w/latest Merlin build
Local LAN 192.168.200.0/255.255.255.0, router is 192.168.200.1

Server is configured to use TCP port 443 (which works fine in TAP mode). It is also using the same TLS, auth, and compression settings I've always used, and I am not seeing any errors about that. The VPN net and netmask are set to 10.8.0.0 255.255.255.0. The checkboxes to push LAN, force redirect over VPN, allow client-client, etc are checked, and I've even added a custom command to have it push "route 192.168.200.0 255.255.255.0".

Here is my client config:

remote myhostname.dyndns.org
port 443
dev tun
ifconfig 10.8.0.2 10.8.0.1
tls-client
proto tcp-client
comp-lzo
float
resolv-retry infinite
nobind
persist-key
persist-tun
float
ca ca.crt
cert mark-laptop.crt
key mark-laptop.key
ns-cert-type server
route 192.168.200.0 255.255.255.0
route-gateway 192.168.200.1
redirect-gateway

If I run a route print from my Windows host upon connection, I never see a 192.168.200.0 route, though the client clearly captures the 10.8.0.2 address and can at least establish the tunnel with the 10.8.0.1 address of the router. I presume it is a simple Windows/OpenVPN routing issue and any help with this would be greatly appreciated. If I can get this working, my next concern would be if I have 2 clients connect, will the second one just grab the 10.8.0.3 address or will I have to change something to have more available client addresses.

Thanks again for your help!!

burntoc

Anyone?

mwandelaar

I suspect this is a routing-issue, so lets first try to peel down the layers.
Please post the server-config here too so we can have a look on the server-side-config

Can you remove the next lines from the config:

route 192.168.200.0 255.255.255.0
route-gateway 192.168.200.1
redirect-gateway

(and the line "float", as with tcp-connections this doesn't really make sense, but i don't expect this to be a problem)

Maybe, for some debugging purposes add

verb 3

to the config.

Then, try to restart and see your local ip-address (probably 10.8.0.2). Then try:

ping 10.8.0.2 from the client

ping 10.8.0.1 from the client

ping 10.8.0.2 from the server

If these all work successfull, your tunnel all works fine, you excluded firewall-issues and we can step to pushing routes.
Please take a review of the manpage about "redirect-gateway". As i don't know your local network-setup, i cannot advise you which flag to use. Maybe you need "local" if you're on the same lan, else "def1" would be a great option.
Add the line

redirect-gateway <option>

back to the config and try again.
As everything is redirected to the openvpn-server, i guess the other lines are not neccesary anymore.

Please capture the logfile and post it here if it still doesn't work.

If I can get this working, my next concern would be if I have 2 clients connect, will the second one just grab the 10.8.0.3 address or will I have to change something to have more available client addresses.

Simply add the line

topology subnet

to the server-config and you're done.

burntoc

Thank you VERY much for helping me! I removed the lines as you instructed, and connected via my tunnel, and I am able to ping the local interface (10.8.0.2) when connected but I cannot ping .1 or any of 192.168.200.x addresses. It appears that it WILL get to the internet now (which it wouldn't before), but it is incredibly slow. Here is the server config:

# Automatically generated configuration
daemon
server 10.8.0.0 255.255.255.0
proto tcp-server
port 443
dev tun22
comp-lzo adaptive
keepalive 15 60
verb 3
push "route 192.168.200.0 255.255.255.0"
client-config-dir ccd
client-to-client
push "dhcp-option DNS 192.168.200.1"
push "redirect-gateway def1"
ca ca.crt
dh dh.pem
cert server.crt
key server.key
status-version 2
status status

# Custom Configuration
topology subnet

Anything stand out? It looks straightforward enough...

burntoc

Playing around with it a bit more I know now why I can get to the Internet when connected - because it isn't sending any of the traffic through the tunnel.....