bryant
i have studied and googled more than a week to set a openvpn (all traffic thru VPN gateway) but i am facing a problem after another problem ....
Actually i am a newbie for that kind of networking
i have followed the steps in how to setup openvpn DDWRT. now i have connection from my work to home newtork. But at work i cant ping my VPN cant browse
hereby i am begging professional advise of my network
only can ping intranet device but no response form remote device
server openVPN Buffalo WZR-HP-G300NH2GA1
----------------------------------
Home
Router 192.168.110.0/24
Gateway 192.168.110.100
OpenVPN: 192.168.66.0/24
work
router 192.168.11.0/24
gateway 192.168.11.1
---------------------------------
Server.config
--------------------------------
server 192.168.66.0 255.255.255.0
#push "route 192.168.110.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
dev tun0
proto tcp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
management localhost 5001
startup script:
-----------------------
openvpn --mktun --dev tap0
brctl addif br0 tap0
ifconfig tap0 0.0.0.0 promisc up
firewall script:
-----------------------------
iptables -I INPUT 1 -p tcp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source 192.168.66.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
iptables -I nat -A POSTROUTING -o tun0 -j MASQUERADE
Client config
--------------------------------
client
dev tun
dev-node MyTap
proto tcp
remote test.no-ip.org 1194
route-gateway 192.168.66.1
redirect-gateway
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
comp-lzo
verb 3
----------------------------------
iptables -L output
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:1194
ACCEPT 0 -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT udp -- anywhere anywhere udp dpt:route
ACCEPT udp -- anywhere anywhere udp dpt:route
ACCEPT udp -- anywhere anywhere udp dpt:route
ACCEPT 0 -- anywhere anywhere
ACCEPT tcp -- anywhere router tcp dpt:www
DROP icmp -- anywhere anywhere
DROP igmp -- anywhere anywhere
ACCEPT 0 -- anywhere anywhere state NEW
ACCEPT 0 -- anywhere anywhere state NEW
DROP 0 -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT 0 -- anywhere anywhere
ACCEPT 0 -- anywhere anywhere
ACCEPT 0 -- 192.168.66.0/24 anywhere
ACCEPT gre -- 192.168.110.0/24 anywhere
ACCEPT tcp -- 192.168.110.0/24 anywhere tcp dpt:1723
ACCEPT 0 -- anywhere anywhere
TCPMSS tcp -- anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
lan2wan 0 -- anywhere anywhere
ACCEPT 0 -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT 0 -- anywhere anywhere
TRIGGER 0 -- anywhere anywhere TRIGGER type:in match:0 relate:0
trigger_out 0 -- anywhere anywhere
ACCEPT 0 -- anywhere anywhere state NEW
DROP 0 -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT 0 -- anywhere anywhere
Chain advgrp_1 (0 references)
target prot opt source destination
Chain advgrp_10 (0 references)
target prot opt source destination
Chain advgrp_2 (0 references)
target prot opt source destination
Chain advgrp_3 (0 references)
target prot opt source destination
Chain advgrp_4 (0 references)
target prot opt source destination
Chain advgrp_5 (0 references)
target prot opt source destination
Chain advgrp_6 (0 references)
target prot opt source destination
Chain advgrp_7 (0 references)
target prot opt source destination
Chain advgrp_8 (0 references)
target prot opt source destination
Chain advgrp_9 (0 references)
target prot opt source destination
Chain grp_1 (0 references)
target prot opt source destination
Chain grp_10 (0 references)
target prot opt source destination
Chain grp_2 (0 references)
target prot opt source destination
Chain grp_3 (0 references)
target prot opt source destination
Chain grp_4 (0 references)
target prot opt source destination
Chain grp_5 (0 references)
target prot opt source destination
Chain grp_6 (0 references)
target prot opt source destination
Chain grp_7 (0 references)
target prot opt source destination
Chain grp_8 (0 references)
target prot opt source destination
Chain grp_9 (0 references)
target prot opt source destination
Chain lan2wan (1 references)
target prot opt source destination
Chain logaccept (0 references)
target prot opt source destination
ACCEPT 0 -- anywhere anywhere
Chain logdrop (0 references)
target prot opt source destination
DROP 0 -- anywhere anywhere
Chain logreject (0 references)
target prot opt source destination
REJECT tcp -- anywhere anywhere reject-with tcp-reset
Chain trigger_out (1 references)
target prot opt source destination
----------------------------------
C:\Documents and Settings\Administrator>ipconfig
Windows IP Configuration
Ethernet adapter Wireless Network Connection:
Connection-specific DNS Suffix . : setup
IP Address. . . . . . . . . . . . : 192.168.11.38
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.11.1
Ethernet adapter Local Area Connection 3:
Connection-specific DNS Suffix . :
IP Address. . . . . . . . . . . . : 192.168.66.10
Subnet Mask . . . . . . . . . . . : 255.255.255.252
Default Gateway . . . . . . . . . :
Ethernet adapter Local Area Connection 2:
Media State . . . . . . . . . . . : Media disconnected
Ethernet adapter Local Area Connection:
Media State . . . . . . . . . . . : Media disconnected
C:\Documents and Settings\Administrator>ping 192.168.66.1
Pinging 192.168.66.1 with 32 bytes of data:
Request timed out.
Request timed out.
Ping statistics for 192.168.66.1:
Packets: Sent = 2, Received = 0, Lost = 2 (100% loss),
Control-C
^C
C:\Documents and Settings\Administrator>route print
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 21 6b 6a dc 40 ...... Intel(R) WiFi Link 5100 - Packet Scheduler Minip
ort
0x3 ...00 ff 3e 40 c9 ea ...... TAP-Windows Adapter V9 - Packet Scheduler Minipo
rt
0x4 ...00 ff 49 67 d0 63 ...... TAP-Win32 Adapter OAS - Packet Scheduler Minipor
t
0x20006 ...00 21 4f 61 dc 34 ...... Bluetooth Personal Area Network - Packet Sch
eduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.11.1 192.168.11.38 25
0.0.0.0 128.0.0.0 192.168.66.5 192.168.66.6 1
42.3.128.46 255.255.255.255 192.168.11.1 192.168.11.38 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
128.0.0.0 128.0.0.0 192.168.66.5 192.168.66.6 1
192.168.11.0 255.255.255.0 192.168.11.38 192.168.11.38 25
192.168.11.38 255.255.255.255 127.0.0.1 127.0.0.1 25
192.168.11.255 255.255.255.255 192.168.11.38 192.168.11.38 25
192.168.66.1 255.255.255.255 192.168.66.5 192.168.66.6 1
192.168.66.4 255.255.255.252 192.168.66.6 192.168.66.6 30
192.168.66.6 255.255.255.255 127.0.0.1 127.0.0.1 30
192.168.66.255 255.255.255.255 192.168.66.6 192.168.66.6 30
224.0.0.0 240.0.0.0 192.168.11.38 192.168.11.38 25
224.0.0.0 240.0.0.0 192.168.66.6 192.168.66.6 30
255.255.255.255 255.255.255.255 192.168.11.38 192.168.11.38 1
255.255.255.255 255.255.255.255 192.168.66.6 20006 1
255.255.255.255 255.255.255.255 192.168.66.6 192.168.66.6 1
255.255.255.255 255.255.255.255 192.168.66.6 4 1
Default Gateway: 192.168.66.5
===========================================================================
Persistent Routes:
None
C:\Documents and Settings\Administrator>
maikcat
your config is a little messed up...
server 192.168.66.0 255.255.255.0
#push "route 192.168.110.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
dev tun0
proto tcp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
management localhost 5001
this is a
routed based config...
startup script:
-----------------------
openvpn --mktun --dev tap0
brctl addif br0 tap0
ifconfig tap0 0.0.0.0 promisc up
this is for bridging...
so...what do you want to do?routing or bridging?
Michael.
bryant
sorry i am a newbie in networking :lol:
what do you suggest me to use if i just want to all traffic pass from remote thru home vpn
bryant
i think routing is more easier so i tried to delete the bridging start script but still doesn' work
bryant
i found some problems in client log
Sun Mar 24 00:04:35 2013 [server] Peer Connection Initiated with [AF_INET]xx.xx.xx.xx
Sun Mar 24 00:04:36 2013 MANAGEMENT: >STATE:1364054676,GET_CONFIG,,,
Sun Mar 24 00:04:37 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sun Mar 24 00:04:38 2013 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route 192.168.110.0 255.255.255.0,dhcp-option DNS 218.102.23.77,dhcp-option DNS 218.102.62.71,route 192.168.66.1,topology net30,ping 10,ping-restart 120,ifconfig 192.168.66.10 192.168.66.9'
Sun Mar 24 00:04:38 2013 OPTIONS IMPORT: timers and/or timeouts modified
Sun Mar 24 00:04:38 2013 OPTIONS IMPORT: --ifconfig/up options modified
Sun Mar 24 00:04:38 2013 OPTIONS IMPORT: route options modified
Sun Mar 24 00:04:38 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Mar 24 00:04:38 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Mar 24 00:04:38 2013 MANAGEMENT: >STATE:1364054678,ASSIGN_IP,,192.168.66.10,
Sun Mar 24 00:04:38 2013 open_tun, tt->ipv6=0
Sun Mar 24 00:04:38 2013 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{AC55914E-1D37-4E7E-9703-729C10249B03}.tap
Sun Mar 24 00:04:38 2013 TAP-Windows Driver Version 9.9
Sun Mar 24 00:04:38 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.66.10/255.255.255.252 on interface {AC55914E-1D37-4E7E-9703-729C10249B03} [DHCP-serv: 192.168.66.9, lease-time: 31536000]
Sun Mar 24 00:04:38 2013 NOTE: FlushIpNetTable failed on interface [17] {AC55914E-1D37-4E7E-9703-729C10249B03} (status=5) : Access is denied.
Sun Mar 24 00:04:43 2013 TEST ROUTES: 3/3 succeeded len=2 ret=1 a=0 u/d=up
Sun Mar 24 00:04:43 2013 C:\Windows\system32\route.exe ADD 42.3.128.46 MASK 255.255.255.255 192.168.110.100
Sun Mar 24 00:04:43 2013 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=11]
Sun Mar 24 00:04:43 2013 Route addition via IPAPI failed [adaptive]
Sun Mar 24 00:04:43 2013 Route addition fallback to route.exe
Sun Mar 24 00:04:43 2013 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
The requested operation requires elevation.
Sun Mar 24 00:04:43 2013 ERROR: Windows route add command failed [adaptive]: returned error code 1
Sun Mar 24 00:04:43 2013 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 192.168.66.9
Sun Mar 24 00:04:43 2013 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=17]
Sun Mar 24 00:04:43 2013 Route addition via IPAPI failed [adaptive]
bryant
just ignore my last post.
when i run openvpn GUI as admin, windows allows the program to create routes
but still cant browse or ping
maikcat
please post your current settings used,
config files
output of iptables -L -t nat (server sode)
output of netstat -nr (client)
Michael.
bryant
output of iptables -L -t nat
target prot opt source destination
DNAT tcp -- anywhere 42-3-128-046.static.netvigator.com tcp dpt:webcache to:192.168.110.100:80
DNAT icmp -- anywhere 42-3-128-046.static.netvigator.com to:192.168.110.100
TRIGGER 0 -- anywhere 42-3-128-046.static.netvigator.com TRIGGER type:dnat match:0 relate:0
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT 0 -- 192.168.110.0/24 anywhere to:42.3.128.46
RETURN 0 -- anywhere anywhere PKTTYPE = broadcast
MASQUERADE 0 -- 192.168.110.0/24 192.168.110.0/24
===========================================================================
netstat -nr
C:\Documents and Settings\Administrator>netstat -nr
Route Table
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 21 6b 6a dc 40 ...... Intel(R) WiFi Link 5100 - Packet Scheduler Minip
ort
0x3 ...00 ff 3e 40 c9 ea ...... TAP-Windows Adapter V9 - Packet Scheduler Minipo
rt
0x4 ...00 ff 49 67 d0 63 ...... TAP-Win32 Adapter OAS - Packet Scheduler Minipor
t
0x10006 ...00 21 4f 61 dc 34 ...... Bluetooth Personal Area Network - Packet Sch
eduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.11.1 192.168.11.38 25
0.0.0.0 128.0.0.0 192.168.66.5 192.168.66.6 1
42.3.128.46 255.255.255.255 192.168.11.1 192.168.11.38 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
128.0.0.0 128.0.0.0 192.168.66.5 192.168.66.6 1
192.168.11.0 255.255.255.0 192.168.11.38 192.168.11.38 25
192.168.11.38 255.255.255.255 127.0.0.1 127.0.0.1 25
192.168.11.255 255.255.255.255 192.168.11.38 192.168.11.38 25
192.168.66.1 255.255.255.255 192.168.66.5 192.168.66.6 1
192.168.66.4 255.255.255.252 192.168.66.6 192.168.66.6 30
192.168.66.6 255.255.255.255 127.0.0.1 127.0.0.1 30
192.168.66.255 255.255.255.255 192.168.66.6 192.168.66.6 30
192.168.110.0 255.255.255.0 192.168.66.5 192.168.66.6 1
224.0.0.0 240.0.0.0 192.168.11.38 192.168.11.38 25
224.0.0.0 240.0.0.0 192.168.66.6 192.168.66.6 30
255.255.255.255 255.255.255.255 192.168.11.38 192.168.11.38 1
255.255.255.255 255.255.255.255 192.168.66.6 10006 1
255.255.255.255 255.255.255.255 192.168.66.6 192.168.66.6 1
255.255.255.255 255.255.255.255 192.168.66.6 4 1
Default Gateway: 192.168.66.5
===========================================================================
Persistent Routes:
None
===========================================================================
server conf
server 192.168.66.0 255.255.255.0
push "route 192.168.110.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
dev tun0
proto tcp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
management localhost 5001
===========================================================================
client config
client
dev tun0
proto tcp
remote test.no-ip.org 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert mobile.crt
key mobile.key
ns-cert-type server
comp-lzo
verb 3
===========================================================================
firewall
iptables -I INPUT 1 -p tcp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source 192.168.66.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
iptables -I nat -A POSTROUTING -o tun0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.110.0/255.255.255.0 -d 192.168.110.0/255.255.255.0 -o br0 -j MASQUERADE
bryant
one more thing i checked when i connected to vpn (intranet) and i found in the openvpn log as follow
i dunno whether it helps or not. it's always say need IPV6 ...
Serverlog Clientlog 20130324 18:43:02 I OpenVPN 2.2.1 mips-linux [SSL] [LZO2] built on Jun 3 2012
20130324 18:43:02 W IMPORTANT: OpenVPN's default port number is now 1194 based on an official port number assignment by IANA. OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
20130324 18:43:02 W NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
20130324 18:43:02 W WARNING: file '/tmp/openvpn/key.pem' is group or others accessible
20130324 18:43:02 I TUN/TAP device tun0 opened
20130324 18:43:02 I /sbin/ifconfig tun0 192.168.66.1 pointopoint 192.168.66.2 mtu 1500
20130324 18:43:02 W WARNING: External program may not be called unless '--script-security 2' or higher is enabled. Use '--script-security 3 system' for backward compatibility with 2.1_rc8 and earlier. See --help text or man page for detailed info.
20130324 18:43:02 W WARNING: Failed running command (--route-up): external program fork failed
20130324 18:43:02 I Listening for incoming TCP connection on [undef]:1194
20130324 18:43:02 I TCPv4_SERVER link local (bound): [undef]:1194
20130324 18:43:02 I TCPv4_SERVER link remote: [undef]
20130324 18:43:02 I Initialization Sequence Completed
20130324 18:45:31 I Re-using SSL/TLS context
20130324 18:45:31 I LZO compression initialized
20130324 18:45:31 I TCP connection established with 192.168.110.61:57276
20130324 18:45:31 I TCPv4_SERVER link local: [undef]
20130324 18:45:31 I TCPv4_SERVER link remote: 192.168.110.61:57276
20130324 18:45:31 I 192.168.110.61:57276 [be] Peer Connection Initiated with 192.168.110.61:57276
20130324 18:45:34 W be/192.168.110.61:57276 Need IPv6 code in mroute_extract_addr_from_packet
20130324 18:45:34 W be/192.168.110.61:57276 Need IPv6 code in mroute_extract_addr_from_packet
20130324 18:45:34 W be/192.168.110.61:57276 Need IPv6 code in mroute_extract_addr_from_packet
20130324 18:45:34 W be/192.168.110.61:57276 Need IPv6 code in mroute_extract_addr_from_packet
20130324 18:45:34 W be/192.168.110.61:57276 Need IPv6 code in mroute_extract_addr_from_packet
20130324 18:45:34 W be/192.168.110.61:57276 Need IPv6 code in mroute_extract_addr_from_packet
maikcat
please read this regarding your iptable rules
Routing all client traffic (including web-traffic) through the VPN
Overview
By default, when an OpenVPN client is active, only network traffic to and from the OpenVPN server site will pass over the VPN. General web browsing, for example, will be accomplished with direct connections that bypass the VPN.
In certain cases this behavior might not be desirable -- you might want a VPN client to tunnel all network traffic through the VPN, including general internet web browsing. While this type of VPN configuration will exact a performance penalty on the client, it gives the VPN administrator more control over security policies when a client is simultaneously connected to both the public internet and the VPN at the same time.
Implementation
Add the following directive to the server configuration file:
push "redirect-gateway def1"
If your VPN setup is over a wireless network, where all clients and the server are on the same wireless subnet, add the local flag:
push "redirect-gateway local def1"
Pushing the redirect-gateway option to clients will cause all IP network traffic originating on client machines to pass through the OpenVPN server. The server will need to be configured to deal with this traffic somehow, such as by NATing it to the internet, or routing it through the server site's HTTP proxy.
On Linux, you could use a command such as this to NAT the VPN client traffic to the internet:
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
This command assumes that the VPN subnet is 10.8.0.0/24 (taken from the server directive in the OpenVPN server configuration) and that the local ethernet interface is eth0.
When redirect-gateway is used, OpenVPN clients will route DNS queries through the VPN, and the VPN server will need handle them. This can be accomplished by pushing a DNS server address to connecting clients which will replace their normal DNS server settings during the time that the VPN is active. For example:
push "dhcp-option DNS 10.8.0.1"
will configure Windows clients (or non-Windows clients with some extra server-side scripting) to use 10.8.0.1 as their DNS server. Any address which is reachable from clients may be used as the DNS server address.
for the ipv6 messages simply disable ipv6 on tap adapter..
Michael.
bryant
thanks for your additioanl info michael!
i have modifed the fireware script and push dns to client but still neither cant ping 192.168.88.1 (VPN server ip) or browse
Server config server 192.168.66.0 255.255.255.0
push "route 192.168.110.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.66.1"
dev tun
proto tcp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
comp-lzo
management localhost 5001
iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DNAT tcp -- anywhere 42-3-128-046.static.netvigator.com tcp dpt:webcache to:192.168.110.100:80
DNAT icmp -- anywhere 42-3-128-046.static.netvigator.com to:192.168.110.100
TRIGGER 0 -- anywhere 42-3-128-046.static.netvigator.com TRIGGER type:dnat match:0 relate:0
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT 0 -- 192.168.110.0/24 anywhere to:42.3.128.46
RETURN 0 -- anywhere anywhere PKTTYPE = broadcast
MASQUERADE 0 -- 192.168.66.0/24 anywhere
Firewall iptables -I INPUT 1 -p tcp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source 192.168.66.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.66.0/24 -o eth0 -j MASQUERADE
client config
client
dev tun
proto tcp
remote xxxxx.no-ip.org 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert be.crt
key be.key
ns-cert-type server
comp-lzo
verb 3
for redirect can we use both for in the server config ???
push "redirect-gateway def1"
push "redirect-gateway local def1"
bryant
one more thing from the last post
i checked the client log but it seems some problem with routing.
i pushed to the client but at the end it delete the route :shock: :shock: :shock: :shock:
un Mar 24 23:25:54 2013 open_tun, tt->ipv6=0
Sun Mar 24 23:25:54 2013 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{AC55914E-1D37-4E7E-9703-729C10249B03}.tap
Sun Mar 24 23:25:54 2013 TAP-Windows Driver Version 9.9
Sun Mar 24 23:25:54 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.66.6/255.255.255.252 on interface {AC55914E-1D37-4E7E-9703-729C10249B03} [DHCP-serv: 192.168.66.5, lease-time: 31536000]
Sun Mar 24 23:25:54 2013 Successful ARP Flush on interface [17] {AC55914E-1D37-4E7E-9703-729C10249B03}
Sun Mar 24 23:25:59 2013 TEST ROUTES: 3/3 succeeded len=2 ret=1 a=0 u/d=up
Sun Mar 24 23:25:59 2013 C:\Windows\system32\route.exe ADD 42.3.128.46 MASK 255.255.255.255 192.168.110.100
Sun Mar 24 23:25:59 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=10 and dwForwardType=4
Sun Mar 24 23:25:59 2013 Route addition via IPAPI succeeded [adaptive]
Sun Mar 24 23:25:59 2013 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 192.168.66.5
Sun Mar 24 23:25:59 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Mar 24 23:25:59 2013 Route addition via IPAPI succeeded [adaptive]
Sun Mar 24 23:25:59 2013 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 192.168.66.5
Sun Mar 24 23:25:59 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Mar 24 23:25:59 2013 Route addition via IPAPI succeeded [adaptive]
Sun Mar 24 23:25:59 2013 MANAGEMENT: >STATE:1364138759,ADD_ROUTES,,,
Sun Mar 24 23:25:59 2013 C:\Windows\system32\route.exe ADD 192.168.110.0 MASK 255.255.255.0 192.168.66.5
Sun Mar 24 23:25:59 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Mar 24 23:25:59 2013 Route addition via IPAPI succeeded [adaptive]
Sun Mar 24 23:25:59 2013 C:\Windows\system32\route.exe ADD 192.168.66.1 MASK 255.255.255.255 192.168.66.5
Sun Mar 24 23:25:59 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Mar 24 23:25:59 2013 Route addition via IPAPI succeeded [adaptive]
Sun Mar 24 23:25:59 2013 Initialization Sequence Completed
Sun Mar 24 23:25:59 2013 MANAGEMENT: >STATE:1364138759,CONNECTED,SUCCESS,192.168.66.6,42.3.128.46
Sun Mar 24 23:28:44 2013 C:\Windows\system32\route.exe DELETE 192.168.66.1 MASK 255.255.255.255 192.168.66.5
Sun Mar 24 23:28:44 2013 Route deletion via IPAPI succeeded [adaptive]
Sun Mar 24 23:28:44 2013 C:\Windows\system32\route.exe DELETE 192.168.110.0 MASK 255.255.255.0 192.168.66.5
Sun Mar 24 23:28:44 2013 Route deletion via IPAPI succeeded [adaptive]
Sun Mar 24 23:28:44 2013 C:\Windows\system32\route.exe DELETE 42.3.128.46 MASK 255.255.255.255 192.168.110.100
Sun Mar 24 23:28:44 2013 Route deletion via IPAPI succeeded [adaptive]
Sun Mar 24 23:28:44 2013 C:\Windows\system32\route.exe DELETE 0.0.0.0 MASK 128.0.0.0 192.168.66.5
Sun Mar 24 23:28:44 2013 Route deletion via IPAPI succeeded [adaptive]
Sun Mar 24 23:28:44 2013 C:\Windows\system32\route.exe DELETE 128.0.0.0 MASK 128.0.0.0 192.168.66.5
Sun Mar 24 23:28:44 2013 Route deletion via IPAPI succeeded [adaptive]
Sun Mar 24 23:28:44 2013 Closing TUN/TAP interface
Sun Mar 24 23:28:44 2013 SIGTERM[hard,] received, process exiting
Sun Mar 24 23:28:44 2013 MANAGEMENT: >STATE:1364138924,EXITING,SIGTERM,,
maikcat
the deletions occur 3 minutes after connection,
assume that you disconnect your client?
for redirect can we use both for in the server config ???
push "redirect-gateway def1"
push "redirect-gateway local def1"
no,each one has a different purpose,please read the docs,
word of advice,disable ALL iptables,add only the one needed (in your case the masq)
test your config,if it works THEN add rules needed...
Michael.
bryant
michael
i tried only use the masq but it doesnt work.
actually when i set redirect in server.config i cant ping
i am still checking. when i comment the redirect i can ping again
maikcat
i noticed this..
client config
client
dev tun
proto tcp
remote xxxxx.no-ip.org 1194
ok so far,but...
20130324 18:45:31 I TCP connection established with 192.168.110.61:57276
20130324 18:45:31 I TCPv4_SERVER link local: [undef]
20130324 18:45:31 I TCPv4_SERVER link remote: 192.168.110.61:57276
remote is 192.168.110.61 ??????
how exactly are you testing your setup...?
i cant help you without providing me the correct logs/configs
Michael.
bryant
Michael,
sorry the last log was tested on my desktop with my internal network, because my laptop is in office.
tomorrow i test my notebook with remote network and provide you more clear data.
i dont understand why the VPN asigns me an ip but i cant ping the server ip due to two different subnets or no route ?
by the way thanks for your continued support! i think the thing is getting closer.
bryant
please let me know whether i am on the right road
home network VPN network office network
192.168.110.0 /24 ------------------- 10.0.8.0 /24 ---------------------- 192.168.11.0/24
192.168.110.100 (gateway) 192.168.11.1 (gateway)
Buffalo router model WZR-HP-G300NH2 with ddwrt opvpn
server config
server 10.0.8.0 255.255.255.0
dev tun
push "route 192.168.110.0 255.255.255.0"
push "route 192.168.11.0 255.255.255.0"
push "route 10.0.8.0. 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 10.0.8.1 255.255.255.0"
proto tcp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
management localhost 5001
firewall
iptables -I INPUT 1 -p tcp --dport 1194 -j ACCEPT (a for connection)
iptables -I INPUT 3 -i tun -p icmp -j ACCEPT (b for ping)
iptables -A INPUT -i tun -p tcp -j ACCEPT (c for tunnel)
iptables -A FORWARD -i tun -s 10.8.1.0/24 -d 192.168.110.0/24 -j ACCEPT (d for tunnel)
iptables -t nat -A POSTROUTING -s 10.8.1.0/24 -o eth0 -j MASQUERADE (e for all traffic)
iptables
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:1194
ACCEPT 0 -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp dpt:route
ACCEPT udp -- anywhere anywhere udp dpt:route
ACCEPT udp -- anywhere anywhere udp dpt:route
ACCEPT 0 -- anywhere anywhere
ACCEPT 0 -- anywhere anywhere
ACCEPT tcp -- anywhere router tcp dpt:www
DROP icmp -- anywhere anywhere
DROP igmp -- anywhere anywhere
ACCEPT 0 -- anywhere anywhere state NEW
ACCEPT 0 -- anywhere anywhere state NEW
DROP 0 -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT gre -- 192.168.110.0/24 anywhere
ACCEPT tcp -- 192.168.110.0/24 anywhere tcp dpt:1723
ACCEPT 0 -- anywhere anywhere
TCPMSS tcp -- anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
lan2wan 0 -- anywhere anywhere
ACCEPT 0 -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT 0 -- anywhere anywhere
ACCEPT 0 -- anywhere anywhere
TRIGGER 0 -- anywhere anywhere TRIGGER type:in match:0 relate:0
trigger_out 0 -- anywhere anywhere
ACCEPT 0 -- anywhere anywhere state NEW
DROP 0 -- anywhere anywhere
ACCEPT 0 -- 10.8.1.0/24 192.168.110.0/24
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT 0 -- anywhere anywhere
ACCEPT 0 -- anywhere anywhere
REJECT tcp -- anywhere anywhere reject-with tcp-reset
Chain trigger_out (1 references)
client log
C:\Documents and Settings\Administrator>netstat -nr
Route Table
================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 21 6b 6a dc 40 ...... Intel(R) WiFi Link 5100 - Packet Scheduler Minip
ort
0x3 ...00 ff 3e 40 c9 ea ...... TAP-Windows Adapter V9 - Packet Scheduler Minipo
rt
0x4 ...00 ff 49 67 d0 63 ...... TAP-Win32 Adapter OAS - Packet Scheduler Minipor
t
0x20006 ...00 21 4f 61 dc 34 ...... Bluetooth Personal Area Network - Packet Sch
eduler Miniport
================================================================
================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 128.0.0.0 10.0.8.5 10.0.8.6 1
0.0.0.0 0.0.0.0 192.168.11.1 192.168.11.38 25
10.0.8.0 255.255.255.0 10.0.8.5 10.0.8.6 1
10.0.8.1 255.255.255.255 10.0.8.5 10.0.8.6 1
10.0.8.4 255.255.255.252 10.0.8.6 10.0.8.6 30
10.0.8.6 255.255.255.255 127.0.0.1 127.0.0.1 30
10.255.255.255 255.255.255.255 10.0.8.6 10.0.8.6 30
42.3.128.46 255.255.255.255 192.168.11.1 192.168.11.38 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
128.0.0.0 128.0.0.0 10.0.8.5 10.0.8.6 1
192.168.11.0 255.255.255.0 192.168.11.38 192.168.11.38 25
192.168.11.0 255.255.255.0 10.0.8.5 10.0.8.6 1
192.168.11.38 255.255.255.255 127.0.0.1 127.0.0.1 25
192.168.11.255 255.255.255.255 192.168.11.38 192.168.11.38 25
192.168.110.0 255.255.255.0 10.0.8.5 10.0.8.6 1
224.0.0.0 240.0.0.0 10.0.8.6 10.0.8.6 30
224.0.0.0 240.0.0.0 192.168.11.38 192.168.11.38 25
255.255.255.255 255.255.255.255 10.0.8.6 10.0.8.6 1
255.255.255.255 255.255.255.255 10.0.8.6 20006 1
255.255.255.255 255.255.255.255 10.0.8.6 4 1
255.255.255.255 255.255.255.255 192.168.11.38 192.168.11.38 1
Default Gateway: 10.0.8.5
================================================================
Persistent Routes:
None
C:\Documents and Settings\Administrator>
bryant
client config
dev tun0
proto tcp
remote xxxx.no-ip.org.1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert mobile.crt
key mobile.key
ns-cert-type server
comp-lzo
verb3
maikcat
remove these from your server config:
push "route 192.168.11.0 255.255.255.0"
push "route 10.0.8.0. 255.255.255.0"
also disable ALL iptables and leave ONLY the masq rule for testing....
Michael.
bryant
great !!!! can ping VPN server ip and router gateway ip now !
cant ping google DNS is still now working
