Tunnelling to server works, now ROUTE ALL TRAFFIC? (windows)

andreask

Hello!
Please help with ROUTING ALL TRAFFIC OVER VPN.

For a long time now, I have been successfully using openvpn with the configuration below.
But so far it works only to connect to my (virtual) server, e.g. to collect emails.

Now I want to route all client traffic, over a similiar VPN.
If possible, I would prefer to leave the server openvpn.conf untouched, because it works. NCARS :-)

I am using openVPNgui on Windows 7.
What do I have to change in the (client) configuration to route everything over the VPN?

Thanks a million.
Andreas

#################################################

server openvpn.conf

rport 1194
lport 1194
ifconfig 10.11.12.13 255.255.255.252
daemon
secret /opt/psa/var/modules/vpn/vpn-key
writepid /opt/psa/var/modules/vpn/openvpn.pid
mtu-disc yes
comp-lzo
dev tap
float
keepalive 10 60
ping-timer-rem
resolv-retry infinite

#################################################

client config.ovpn

remote 8x.xxx.xxx.xx7
lport 1194
rport 1194
ifconfig 10.11.12.14 255.255.255.252
secret vpn.key
comp-lzo
dev tap
float
keepalive 10 60
ping-timer-rem
resolv-retry infinite

#################################################

WITHOUT the openvpn client running

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0   192.168.10.254     192.168.10.7     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
     192.168.10.0    255.255.255.0         On-link      192.168.10.7    281
     192.168.10.7  255.255.255.255         On-link      192.168.10.7    281
   192.168.10.255  255.255.255.255         On-link      192.168.10.7    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      192.168.10.7    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      192.168.10.7    281
===========================================================================

Wireless LAN adapter Wireless Network Connection:
   Connection-specific DNS Suffix  . : lan
   Description . . . . . . . . . . . : [CommView] Atheros AR5B97 Wireless Network Adapter
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 192.168.10.7(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.10.254
   DHCP Server . . . . . . . . . . . : 192.168.10.254
   DNS Servers . . . . . . . . . . . : 192.168.10.254

#################################################

WITH the openvpn client running

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0   192.168.10.254     192.168.10.7     25
      10.11.12.12  255.255.255.252         On-link       10.11.12.14    286
      10.11.12.14  255.255.255.255         On-link       10.11.12.14    286
      10.11.12.15  255.255.255.255         On-link       10.11.12.14    286
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
     192.168.10.0    255.255.255.0         On-link      192.168.10.7    281
     192.168.10.7  255.255.255.255         On-link      192.168.10.7    281
   192.168.10.255  255.255.255.255         On-link      192.168.10.7    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      192.168.10.7    281
        224.0.0.0        240.0.0.0         On-link       10.11.12.14    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      192.168.10.7    281
  255.255.255.255  255.255.255.255         On-link       10.11.12.14    286
===========================================================================

Wireless LAN adapter Wireless Network Connection:  as above

Ethernet adapter Local Area Connection 2:
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : TAP-Win32 Adapter V9
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 10.11.12.14(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.255.252
   Default Gateway . . . . . . . . . : 
   DHCP Server . . . . . . . . . . . : 10.11.12.12

#################################################

I have already tried a lot, without success.

Do you need any other information to help me?

Thx!

andreask

Is there really no one who can help me with this?

Do I have to find another forum?
Where else can I post questions about openVPN?
Is the question already answered somewhere else?

Thanks a million.

airy52

Delete your re-post of your thread on the front page, its bad manners. And be patient, someone will help you when they have time. Your issue is a very common one and there is lots of instruction if you knew how to search before you asked questions. I have searched for you, this explains how to do it in full detail:

http://openvpn.net/index.php/open-source/documentation/howto.html#redirect

andreask

Thanks a lot.
I will look into it.

I will keep the other post, because I actually want to know about other forums which also discuss openVPN.

Thanks a million!
Sunny greetings.

andreask

http://openvpn.net/index.php/open-source/documentation/howto.html#redirect
Add the following directive to the server configuration file:
push "redirect-gateway def1"

is there any way to not change the server configuration ?

If I can, I would like to (a) have two options, and (b) if possible not change the server setup.
I am happy about my current tunnel, which works well for just a tunnel connection to the server. Everything else on my client is still routed directly into the internet. I want to keep that option.

Is there a way to keep both options, and each time decide on the client, if I want server-only-VPN or all-client-traffic-VPN?

On Linux, you could use a command such as this to NAT the VPN client traffic to the internet:
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

if anything goes wrong, and I want to undo that, what is the command for undoing that change?

Thx!

ste123

andreask wrote

http://openvpn.net/index.php/open-source/documentation/howto.html#redirect
Add the following directive to the server configuration file:
push "redirect-gateway def1"

is there any way to not change the server configuration ?

Yes, add redirect-gateway def1 to the client config instead.

andreask wroteIf I can, I would like to (a) have two options, and (b) if possible not change the server setup.
I am happy about my current tunnel, which works well for just a tunnel connection to the server. Everything else on my client is still routed directly into the internet. I want to keep that option.

Is there a way to keep both options, and each time decide on the client, if I want server-only-VPN or all-client-traffic-VPN?

Create two client config files, one with redirect-gateway def1 and one without, and call the config you want.

Alternatively, note the routes the client creates in the log file (set/increase verb level if required) and manually add the routes after you have connected by using the same command (in an elevated command prompt, or in a .BAT/.CMD file run as administrator).

andreask wrote

On Linux, you could use a command such as this to NAT the VPN client traffic to the internet:
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

if anything goes wrong, and I want to undo that, what is the command for undoing that change?

Thx!

Yes.

iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

andreask

Thanks a million for your answer. I am very happy!

> Yes, add redirect-gateway def1 to the client config instead.
I have tried that now.

How could I see that it is working?
I have tried several things now:

1) google "show my ip" is unchanged.

2) My tunnel does not show up in traceroutes, like

tracert www.google.com

3) moreover,

route print

still looks like this:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.104     25
      10.11.12.12  255.255.255.252         On-link       10.11.12.14    286
      10.11.12.14  255.255.255.255         On-link       10.11.12.14    286
      10.11.12.15  255.255.255.255         On-link       10.11.12.14    286
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.1.0    255.255.255.0         On-link     192.168.1.104    281
    192.168.1.104  255.255.255.255         On-link     192.168.1.104    281
    192.168.1.255  255.255.255.255         On-link     192.168.1.104    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     192.168.1.104    281
        224.0.0.0        240.0.0.0         On-link       10.11.12.14    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     192.168.1.104    281
  255.255.255.255  255.255.255.255         On-link       10.11.12.14    286

doesn't that mean that all traffic apart from 10.11.12.12/14/15 is still not routed through the tunnel?

THANKS!
Love and Light!

Andreas

janjust

0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.104 25

this means your default route is still via the regular network

10.11.12.12 255.255.255.252 On-link 10.11.12.14 286
10.11.12.14 255.255.255.255 On-link 10.11.12.14 286
10.11.12.15 255.255.255.255 On-link 10.11.12.14 286

this means that traffic to hosts 10.11.12.{12,14,15} is routed via the tunnel , but only for those IP addresses.

So what is it that you're trying to achieve? please post the latest and greatest client and server configs, as well as a connection log when the client is connecting with "verb 5" in the client configuration file.

andreask

Thanks for taking your time!

> So what is it that you're trying to achieve?
I want to route ALL of my client internet traffic through the tunnel.

And my question above means: How do I find out when it was successful?

> this means that traffic to hosts 10.11.12.{12,14,15}
> is routed via the tunnel , but only for those IP addresses.
Thanks a lot for your explanation.
I had thought so.

> please post the latest and greatest client and server configs,
> as well as a connection log when the client is connecting
> with "verb 5" in the client configuration file.

with pleasure:

client config

remote MYSERVER
lport 1194
rport 1194
ifconfig 10.11.12.14 255.255.255.252
secret vpn.key
comp-lzo
dev tap
float
keepalive 10 60
ping-timer-rem
resolv-retry infinite
redirect-gateway def1

server config:

server openvpn.conf

rport 1194
lport 1194
ifconfig 10.11.12.13 255.255.255.252
daemon
secret /opt/psa/var/modules/vpn/vpn-key
writepid /opt/psa/var/modules/vpn/openvpn.pid
mtu-disc yes
comp-lzo
dev tap
float
keepalive 10 60
ping-timer-rem
resolv-retry infinite

verb 5 output:

 us=875000 Current Parameter Settings:
 us=875000   config = 'config_all-traffic.ovpn'
 us=875000   mode = 0
 us=875000   show_ciphers = DISABLED
 us=875000   show_digests = DISABLED
 us=875000   show_engines = DISABLED
 us=875000   genkey = DISABLED
 us=875000   key_pass_file = '[UNDEF]'
 us=875000   show_tls_ciphers = DISABLED
 us=875000 Connection profiles [default]:
 us=875000   proto = udp
 us=875000   local = '[UNDEF]'
 us=875000   local_port = 1194
 us=875000   remote = 'MYSERVER'
 us=875000   remote_port = 1194
 us=875000   remote_float = ENABLED
 us=875000   bind_defined = DISABLED
 us=875000   bind_local = ENABLED
 us=875000   connect_retry_seconds = 5
 us=875000   connect_timeout = 10
 us=875000   connect_retry_max = 0
 us=875000   socks_proxy_server = '[UNDEF]'
 us=875000   socks_proxy_port = 0
 us=875000   socks_proxy_retry = DISABLED
 us=875000 Connection profiles END
 us=875000   remote_random = DISABLED
 us=875000   ipchange = '[UNDEF]'
 us=875000   dev = 'tap'
 us=875000   dev_type = '[UNDEF]'
 us=875000   dev_node = '[UNDEF]'
 us=875000   lladdr = '[UNDEF]'
 us=875000   topology = 1
 us=875000   tun_ipv6 = DISABLED
 us=875000   ifconfig_local = '10.11.12.14'
 us=875000   ifconfig_remote_netmask = '255.255.255.252'
 us=875000   ifconfig_noexec = DISABLED
 us=875000   ifconfig_nowarn = DISABLED
 us=875000   shaper = 0
 us=875000   tun_mtu = 1500
 us=875000   tun_mtu_defined = ENABLED
 us=875000   link_mtu = 1500
 us=875000   link_mtu_defined = DISABLED
 us=875000   tun_mtu_extra = 32
 us=875000   tun_mtu_extra_defined = ENABLED
 us=875000   fragment = 0
 us=875000   mtu_discover_type = -1
 us=875000   mtu_test = 0
 us=875000   mlock = DISABLED
 us=875000   keepalive_ping = 10
 us=875000   keepalive_timeout = 60
 us=875000   inactivity_timeout = 0
 us=875000   ping_send_timeout = 10
 us=875000   ping_rec_timeout = 60
 us=875000   ping_rec_timeout_action = 2
 us=875000   ping_timer_remote = ENABLED
 us=875000   remap_sigusr1 = 0
 us=875000   explicit_exit_notification = 0
 us=875000   persist_tun = DISABLED
 us=875000   persist_local_ip = DISABLED
 us=875000   persist_remote_ip = DISABLED
 us=875000   persist_key = DISABLED
 us=875000   mssfix = 1450
 us=875000   resolve_retry_seconds = 1000000000
 us=875000   username = '[UNDEF]'
 us=875000   groupname = '[UNDEF]'
 us=875000   chroot_dir = '[UNDEF]'
 us=875000   cd_dir = '[UNDEF]'
 us=875000   writepid = '[UNDEF]'
 us=109000   up_script = '[UNDEF]'
 us=109000   down_script = '[UNDEF]'
 us=109000   down_pre = DISABLED
 us=109000   up_restart = DISABLED
 us=109000   up_delay = DISABLED
 us=109000   daemon = DISABLED
 us=109000   inetd = 0
 us=109000   log = DISABLED
 us=109000   suppress_timestamps = DISABLED
 us=109000   nice = 0
 us=109000   verbosity = 5
 us=109000   mute = 0
 us=109000   gremlin = 0
 us=109000   status_file = '[UNDEF]'
 us=109000   status_file_version = 1
 us=109000   status_file_update_freq = 60
 us=109000   occ = ENABLED
 us=109000   rcvbuf = 0
 us=125000   sndbuf = 0
 us=125000   sockflags = 0
 us=125000   fast_io = DISABLED
 us=125000   lzo = 7
 us=125000   route_script = '[UNDEF]'
 us=125000   route_default_gateway = '[UNDEF]'
 us=125000   route_default_metric = 0
 us=125000   route_noexec = DISABLED
 us=125000   route_delay = 5
 us=125000   route_delay_window = 30
 us=125000   route_delay_defined = ENABLED
 us=125000   route_nopull = DISABLED
 us=125000   route_gateway_via_dhcp = DISABLED
 us=125000   max_routes = 100
 us=125000   allow_pull_fqdn = DISABLED
 us=125000   [redirect_default_gateway local=0]
 us=141000   management_addr = '[UNDEF]'
 us=141000   management_port = 0
 us=141000   management_user_pass = '[UNDEF]'
 us=141000   management_log_history_cache = 250
 us=141000   management_echo_buffer_size = 100
 us=141000   management_write_peer_info_file = '[UNDEF]'
 us=141000   management_client_user = '[UNDEF]'
 us=141000   management_client_group = '[UNDEF]'
 us=141000   management_flags = 0
 us=141000   shared_secret_file = 'vpn.key'
 us=141000   key_direction = 0
 us=141000   ciphername_defined = ENABLED
 us=141000   ciphername = 'BF-CBC'
 us=141000   authname_defined = ENABLED
 us=141000   authname = 'SHA1'
 us=156000   prng_hash = 'SHA1'
 us=156000   prng_nonce_secret_len = 16
 us=156000   keysize = 0
 us=156000   engine = DISABLED
 us=156000   replay = ENABLED
 us=156000   mute_replay_warnings = DISABLED
 us=156000   replay_window = 64
 us=156000   replay_time = 15
 us=156000   packet_id_file = '[UNDEF]'
 us=156000   use_iv = ENABLED
 us=156000   test_crypto = DISABLED
 us=156000   tls_server = DISABLED
 us=156000   tls_client = DISABLED
 us=156000   key_method = 2
 us=156000   ca_file = '[UNDEF]'
 us=156000   ca_path = '[UNDEF]'
 us=156000   dh_file = '[UNDEF]'
 us=172000   cert_file = '[UNDEF]'
 us=172000   priv_key_file = '[UNDEF]'
 us=172000   pkcs12_file = '[UNDEF]'
 us=172000   cryptoapi_cert = '[UNDEF]'
 us=172000   cipher_list = '[UNDEF]'
 us=172000   tls_verify = '[UNDEF]'
 us=172000   tls_export_cert = '[UNDEF]'
 us=172000   tls_remote = '[UNDEF]'
 us=172000   crl_file = '[UNDEF]'
 us=172000   ns_cert_type = 0
 us=172000   remote_cert_ku[i] = 0
 us=172000   remote_cert_ku[i] = 0
 us=172000   remote_cert_ku[i] = 0
 us=172000   remote_cert_ku[i] = 0
 us=172000   remote_cert_ku[i] = 0
 us=172000   remote_cert_ku[i] = 0
 us=187000   remote_cert_ku[i] = 0
 us=187000   remote_cert_ku[i] = 0
 us=187000   remote_cert_ku[i] = 0
 us=187000   remote_cert_ku[i] = 0
 us=187000   remote_cert_ku[i] = 0
 us=187000   remote_cert_ku[i] = 0
 us=187000   remote_cert_ku[i] = 0
 us=187000   remote_cert_ku[i] = 0
 us=187000   remote_cert_ku[i] = 0
 us=187000   remote_cert_ku[i] = 0
 us=187000   remote_cert_eku = '[UNDEF]'
 us=187000   tls_timeout = 2
 us=187000   renegotiate_bytes = 0
 us=187000   renegotiate_packets = 0
 us=187000   renegotiate_seconds = 3600
 us=187000   handshake_window = 60
 us=187000   transition_window = 3600
 us=203000   single_session = DISABLED
 us=203000   push_peer_info = DISABLED
 us=203000   tls_exit = DISABLED
 us=203000   tls_auth_file = '[UNDEF]'
 us=203000   pkcs11_protected_authentication = DISABLED
 us=203000   pkcs11_protected_authentication = DISABLED
 us=203000   pkcs11_protected_authentication = DISABLED
 us=203000   pkcs11_protected_authentication = DISABLED
 us=203000   pkcs11_protected_authentication = DISABLED
 us=203000   pkcs11_protected_authentication = DISABLED
 us=203000   pkcs11_protected_authentication = DISABLED
 us=203000   pkcs11_protected_authentication = DISABLED
 us=203000   pkcs11_protected_authentication = DISABLED
 us=203000   pkcs11_protected_authentication = DISABLED
 us=219000   pkcs11_protected_authentication = DISABLED
 us=219000   pkcs11_protected_authentication = DISABLED
 us=219000   pkcs11_protected_authentication = DISABLED
 us=219000   pkcs11_protected_authentication = DISABLED
 us=219000   pkcs11_protected_authentication = DISABLED
 us=219000   pkcs11_protected_authentication = DISABLED
 us=219000   pkcs11_private_mode = 00000000
 us=219000   pkcs11_private_mode = 00000000
 us=219000   pkcs11_private_mode = 00000000
 us=219000   pkcs11_private_mode = 00000000
 us=219000   pkcs11_private_mode = 00000000
 us=219000   pkcs11_private_mode = 00000000
 us=219000   pkcs11_private_mode = 00000000
 us=219000   pkcs11_private_mode = 00000000
 us=219000   pkcs11_private_mode = 00000000
 us=219000   pkcs11_private_mode = 00000000
 us=219000   pkcs11_private_mode = 00000000
 us=219000   pkcs11_private_mode = 00000000
 us=219000   pkcs11_private_mode = 00000000
 us=219000   pkcs11_private_mode = 00000000
 us=219000   pkcs11_private_mode = 00000000
 us=219000   pkcs11_private_mode = 00000000
 us=219000   pkcs11_cert_private = DISABLED
 us=219000   pkcs11_cert_private = DISABLED
 us=219000   pkcs11_cert_private = DISABLED
 us=219000   pkcs11_cert_private = DISABLED
 us=219000   pkcs11_cert_private = DISABLED
 us=219000   pkcs11_cert_private = DISABLED
 us=234000   pkcs11_cert_private = DISABLED
 us=234000   pkcs11_cert_private = DISABLED
 us=234000   pkcs11_cert_private = DISABLED
 us=234000   pkcs11_cert_private = DISABLED
 us=234000   pkcs11_cert_private = DISABLED
 us=234000   pkcs11_cert_private = DISABLED
 us=234000   pkcs11_cert_private = DISABLED
 us=234000   pkcs11_cert_private = DISABLED
 us=234000   pkcs11_cert_private = DISABLED
 us=234000   pkcs11_cert_private = DISABLED
 us=234000   pkcs11_pin_cache_period = -1
 us=234000   pkcs11_id = '[UNDEF]'
 us=234000   pkcs11_id_management = DISABLED
 us=234000   server_network = 0.0.0.0
 us=250000   server_netmask = 0.0.0.0
 us=250000   server_bridge_ip = 0.0.0.0
 us=250000   server_bridge_netmask = 0.0.0.0
 us=250000   server_bridge_pool_start = 0.0.0.0
 us=250000   server_bridge_pool_end = 0.0.0.0
 us=250000   ifconfig_pool_defined = DISABLED
 us=250000   ifconfig_pool_start = 0.0.0.0
 us=250000   ifconfig_pool_end = 0.0.0.0
 us=250000   ifconfig_pool_netmask = 0.0.0.0
 us=250000   ifconfig_pool_persist_filename = '[UNDEF]'
 us=250000   ifconfig_pool_persist_refresh_freq = 600
 us=250000   n_bcast_buf = 256
 us=250000   tcp_queue_limit = 64
 us=250000   real_hash_size = 256
 us=265000   virtual_hash_size = 256
 us=265000   client_connect_script = '[UNDEF]'
 us=265000   learn_address_script = '[UNDEF]'
 us=265000   client_disconnect_script = '[UNDEF]'
 us=265000   client_config_dir = '[UNDEF]'
 us=265000   ccd_exclusive = DISABLED
 us=265000   tmp_dir = 'C:\Temp\'
 us=265000   push_ifconfig_defined = DISABLED
 us=265000   push_ifconfig_local = 0.0.0.0
 us=265000   push_ifconfig_remote_netmask = 0.0.0.0
 us=265000   enable_c2c = DISABLED
 us=265000   duplicate_cn = DISABLED
 us=265000   cf_max = 0
 us=265000   cf_per = 0
 us=265000   max_clients = 1024
 us=281000   max_routes_per_client = 256
 us=281000   auth_user_pass_verify_script = '[UNDEF]'
 us=281000   auth_user_pass_verify_script_via_file = DISABLED
 us=281000   ssl_flags = 0
 us=281000   client = DISABLED
 us=281000   pull = DISABLED
 us=281000   auth_user_pass_file = '[UNDEF]'
 us=281000   show_net_up = DISABLED
 us=281000   route_method = 0
 us=281000   ip_win32_defined = DISABLED
 us=281000   ip_win32_type = 3
 us=281000   dhcp_masq_offset = 0
 us=281000   dhcp_lease_time = 31536000
 us=281000   tap_sleep = 0
 us=281000   dhcp_options = DISABLED
 us=281000   dhcp_renew = DISABLED
 us=281000   dhcp_pre_release = DISABLED
 us=281000   dhcp_release = DISABLED
 us=281000   domain = '[UNDEF]'
 us=281000   netbios_scope = '[UNDEF]'
 us=281000   netbios_node_type = 0
 us=281000   disable_nbt = DISABLED
 us=281000 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
 us=281000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
 us=281000 Static Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
 us=281000 Static Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
 us=281000 Static Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
 us=281000 Static Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
 us=297000 LZO compression initialized
 us=297000 Socket Buffers: R=[128000->128000] S=[49152->49152]
 us=359000 ROUTE default_gateway=192.168.10.254
 us=712000 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{72533D1A-383C-4F31-B507-4803BFA85B4B}.tap
 us=712000 TAP-Win32 Driver Version 9.9 
 us=712000 TAP-Win32 MTU=1500
 us=727000 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.11.12.14/255.255.255.252 on interface {72533D1A-383C-4F31-B507-4803BFA85B4B} [DHCP-serv: 10.11.12.12, lease-time: 31536000]
 us=727000 NOTE: FlushIpNetTable failed on interface [31] {72533D1A-383C-4F31-B507-4803BFA85B4B} (status=5) : Access is denied.  
 us=727000 Data Channel MTU parms [ L:1577 D:1450 EF:45 EB:135 ET:32 EL:0 AF:3/1 ]
 us=727000 Local Options String: 'V4,dev-type tap,link-mtu 1577,tun-mtu 1532,proto UDPv4,ifconfig 10.11.12.12 255.255.255.252,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,secret'
 us=727000 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1577,tun-mtu 1532,proto UDPv4,ifconfig 10.11.12.12 255.255.255.252,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,secret'
 us=727000 Local Options hash (VER=V4): 'b726230f'
 us=727000 Expected Remote Options hash (VER=V4): 'b726230f'
 us=727000 UDPv4 link local (bound): [undef]:1194
 us=727000 UDPv4 link remote: MYSERVER:1194
 us=705000 Peer Connection Initiated with MYSERVER:1194

janjust

oops, this post slipped my attention:

very interesting setup, I was not expecting tap+preshared keys.

it seems the 'redirect-gateway def1' did not play out correctly; try adding

route-gateway 10.11.12.13

reconnect and check the routing table again; also
* make sure ip forwarding is enabled on the server side
* use some masquerading to hide the VPN IP range e.g.

iptables -t nat -O POSTROUTING -i tun+ -j MASQUERADE

andreask

Thanks a million. Very happy to receive your answer.

it seems the 'redirect-gateway def1' did not play out correctly; try adding
Code:

route-gateway 10.11.12.13

Thanks!

But that results in the "verb 5" log that I will show below this.

* make sure ip forwarding is enabled on the server side

So I am forced to change the server setup, too? No way around that?

Remember, I would like to leave the server untouched, as the "server-only-tunnel" is working well. (Let's call that "config 1")

Or can I push that command from the client config ("config 2" = "all traffic through tunnel") into the server?

* use some masquerading to hide the VPN IP range e.g.

Why?

Code:
iptables -t nat -O POSTROUTING -i tun+ -j MASQUERADE
[/code]

Thanks.

I guess that's also on the server?

If that is indispensable - what would be the command to undo that change?

Thanks a million!

Sunny Greetings!

andreask

This is the current "verb 5" logfile. Please see my comments in the post above. Thx!

us=544000 Current Parameter Settings:
us=544000   config = 'config_all-traffic.ovpn'
us=544000   mode = 0
us=544000   show_ciphers = DISABLED
us=544000   show_digests = DISABLED
us=544000   show_engines = DISABLED
us=544000   genkey = DISABLED
us=544000   key_pass_file = '[UNDEF]'
us=544000   show_tls_ciphers = DISABLED
us=544000 Connection profiles [default]:
us=544000   proto = udp
us=544000   local = '[UNDEF]'
us=544000   local_port = 1194
us=544000   remote = 'MYSERVER'
us=544000   remote_port = 1194
us=544000   remote_float = ENABLED
us=544000   bind_defined = DISABLED
us=544000   bind_local = ENABLED
us=544000   connect_retry_seconds = 5
us=544000   connect_timeout = 10
us=544000   connect_retry_max = 0
us=544000   socks_proxy_server = '[UNDEF]'
us=544000   socks_proxy_port = 0
us=544000   socks_proxy_retry = DISABLED
us=544000 Connection profiles END
us=544000   remote_random = DISABLED
us=544000   ipchange = '[UNDEF]'
us=544000   dev = 'tap'
us=544000   dev_type = '[UNDEF]'
us=544000   dev_node = '[UNDEF]'
us=544000   lladdr = '[UNDEF]'
us=544000   topology = 1
us=544000   tun_ipv6 = DISABLED
us=544000   ifconfig_local = '10.11.12.14'
us=544000   ifconfig_remote_netmask = '255.255.255.252'
us=544000   ifconfig_noexec = DISABLED
us=544000   ifconfig_nowarn = DISABLED
us=544000   shaper = 0
us=544000   tun_mtu = 1500
us=544000   tun_mtu_defined = ENABLED
us=544000   link_mtu = 1500
us=544000   link_mtu_defined = DISABLED
us=544000   tun_mtu_extra = 32
us=544000   tun_mtu_extra_defined = ENABLED
us=544000   fragment = 0
us=544000   mtu_discover_type = -1
us=544000   mtu_test = 0
us=544000   mlock = DISABLED
us=544000   keepalive_ping = 10
us=544000   keepalive_timeout = 60
us=544000   inactivity_timeout = 0
us=544000   ping_send_timeout = 10
us=544000   ping_rec_timeout = 60
us=544000   ping_rec_timeout_action = 2
us=544000   ping_timer_remote = ENABLED
us=544000   remap_sigusr1 = 0
us=544000   explicit_exit_notification = 0
us=544000   persist_tun = DISABLED
us=544000   persist_local_ip = DISABLED
us=544000   persist_remote_ip = DISABLED
us=544000   persist_key = DISABLED
us=544000   mssfix = 1450
us=544000   resolve_retry_seconds = 1000000000
us=544000   username = '[UNDEF]'
us=544000   groupname = '[UNDEF]'
us=544000   chroot_dir = '[UNDEF]'
us=544000   cd_dir = '[UNDEF]'
us=544000   writepid = '[UNDEF]'
us=778000   up_script = '[UNDEF]'
us=778000   down_script = '[UNDEF]'
us=778000   down_pre = DISABLED
us=778000   up_restart = DISABLED
us=778000   up_delay = DISABLED
us=778000   daemon = DISABLED
us=778000   inetd = 0
us=778000   log = DISABLED
us=778000   suppress_timestamps = DISABLED
us=778000   nice = 0
us=778000   verbosity = 5
us=778000   mute = 0
us=778000   gremlin = 0
us=778000   status_file = '[UNDEF]'
us=778000   status_file_version = 1
us=778000   status_file_update_freq = 60
us=778000   occ = ENABLED
us=778000   rcvbuf = 0
us=793000   sndbuf = 0
us=793000   sockflags = 0
us=793000   fast_io = DISABLED
us=793000   lzo = 7
us=793000   route_script = '[UNDEF]'
us=793000   route_default_gateway = '10.11.12.13'
us=793000   route_default_metric = 0
us=793000   route_noexec = DISABLED
us=793000   route_delay = 5
us=793000   route_delay_window = 30
us=793000   route_delay_defined = ENABLED
us=793000   route_nopull = DISABLED
us=793000   route_gateway_via_dhcp = DISABLED
us=793000   max_routes = 100
us=793000   allow_pull_fqdn = DISABLED
us=793000   [redirect_default_gateway local=0]
us=825000   management_addr = '[UNDEF]'
us=825000   management_port = 0
us=825000   management_user_pass = '[UNDEF]'
us=825000   management_log_history_cache = 250
us=825000   management_echo_buffer_size = 100
us=825000   management_write_peer_info_file = '[UNDEF]'
us=825000   management_client_user = '[UNDEF]'
us=825000   management_client_group = '[UNDEF]'
us=825000   management_flags = 0
us=825000   shared_secret_file = 'vpn.key'
us=825000   key_direction = 0
us=825000   ciphername_defined = ENABLED
us=825000   ciphername = 'BF-CBC'
us=825000   authname_defined = ENABLED
us=825000   authname = 'SHA1'
us=840000   prng_hash = 'SHA1'
us=840000   prng_nonce_secret_len = 16
us=840000   keysize = 0
us=840000   engine = DISABLED
us=840000   replay = ENABLED
us=840000   mute_replay_warnings = DISABLED
us=840000   replay_window = 64
us=840000   replay_time = 15
us=840000   packet_id_file = '[UNDEF]'
us=840000   use_iv = ENABLED
us=840000   test_crypto = DISABLED
us=840000   tls_server = DISABLED
us=840000   tls_client = DISABLED
us=840000   key_method = 2
us=840000   ca_file = '[UNDEF]'
us=840000   ca_path = '[UNDEF]'
us=840000   dh_file = '[UNDEF]'
us=856000   cert_file = '[UNDEF]'
us=856000   priv_key_file = '[UNDEF]'
us=856000   pkcs12_file = '[UNDEF]'
us=856000   cryptoapi_cert = '[UNDEF]'
us=856000   cipher_list = '[UNDEF]'
us=856000   tls_verify = '[UNDEF]'
us=856000   tls_export_cert = '[UNDEF]'
us=856000   tls_remote = '[UNDEF]'
us=856000   crl_file = '[UNDEF]'
us=856000   ns_cert_type = 0
us=856000   remote_cert_ku[i] = 0
us=856000   remote_cert_ku[i] = 0
us=856000   remote_cert_ku[i] = 0
us=856000   remote_cert_ku[i] = 0
us=856000   remote_cert_ku[i] = 0
us=856000   remote_cert_ku[i] = 0
us=871000   remote_cert_ku[i] = 0
us=871000   remote_cert_ku[i] = 0
us=871000   remote_cert_ku[i] = 0
us=871000   remote_cert_ku[i] = 0
us=871000   remote_cert_ku[i] = 0
us=871000   remote_cert_ku[i] = 0
us=871000   remote_cert_ku[i] = 0
us=871000   remote_cert_ku[i] = 0
us=871000   remote_cert_ku[i] = 0
us=871000   remote_cert_ku[i] = 0
us=871000   remote_cert_eku = '[UNDEF]'
us=871000   tls_timeout = 2
us=871000   renegotiate_bytes = 0
us=871000   renegotiate_packets = 0
us=871000   renegotiate_seconds = 3600
us=871000   handshake_window = 60
us=871000   transition_window = 3600
us=887000   single_session = DISABLED
us=887000   push_peer_info = DISABLED
us=887000   tls_exit = DISABLED
us=887000   tls_auth_file = '[UNDEF]'
us=887000   pkcs11_protected_authentication = DISABLED
us=887000   pkcs11_protected_authentication = DISABLED
us=887000   pkcs11_protected_authentication = DISABLED
us=887000   pkcs11_protected_authentication = DISABLED
us=887000   pkcs11_protected_authentication = DISABLED
us=887000   pkcs11_protected_authentication = DISABLED
us=887000   pkcs11_protected_authentication = DISABLED
us=887000   pkcs11_protected_authentication = DISABLED
us=887000   pkcs11_protected_authentication = DISABLED
us=887000   pkcs11_protected_authentication = DISABLED
us=903000   pkcs11_protected_authentication = DISABLED
us=903000   pkcs11_protected_authentication = DISABLED
us=903000   pkcs11_protected_authentication = DISABLED
us=903000   pkcs11_protected_authentication = DISABLED
us=903000   pkcs11_protected_authentication = DISABLED
us=903000   pkcs11_protected_authentication = DISABLED
us=903000   pkcs11_private_mode = 00000000
us=903000   pkcs11_private_mode = 00000000
us=903000   pkcs11_private_mode = 00000000
us=903000   pkcs11_private_mode = 00000000
us=903000   pkcs11_private_mode = 00000000
us=903000   pkcs11_private_mode = 00000000
us=903000   pkcs11_private_mode = 00000000
us=918000   pkcs11_private_mode = 00000000
us=918000   pkcs11_private_mode = 00000000
us=918000   pkcs11_private_mode = 00000000
us=918000   pkcs11_private_mode = 00000000
us=918000   pkcs11_private_mode = 00000000
us=918000   pkcs11_private_mode = 00000000
us=918000   pkcs11_private_mode = 00000000
us=918000   pkcs11_private_mode = 00000000
us=918000   pkcs11_private_mode = 00000000
us=918000   pkcs11_cert_private = DISABLED
us=918000   pkcs11_cert_private = DISABLED
us=918000   pkcs11_cert_private = DISABLED
us=918000   pkcs11_cert_private = DISABLED
us=918000   pkcs11_cert_private = DISABLED
us=918000   pkcs11_cert_private = DISABLED
us=934000   pkcs11_cert_private = DISABLED
us=934000   pkcs11_cert_private = DISABLED
us=934000   pkcs11_cert_private = DISABLED
us=934000   pkcs11_cert_private = DISABLED
us=934000   pkcs11_cert_private = DISABLED
us=934000   pkcs11_cert_private = DISABLED
us=934000   pkcs11_cert_private = DISABLED
us=934000   pkcs11_cert_private = DISABLED
us=934000   pkcs11_cert_private = DISABLED
us=934000   pkcs11_cert_private = DISABLED
us=934000   pkcs11_pin_cache_period = -1
us=949000   pkcs11_id = '[UNDEF]'
us=949000   pkcs11_id_management = DISABLED
us=949000   server_network = 0.0.0.0
us=949000   server_netmask = 0.0.0.0
us=949000   server_bridge_ip = 0.0.0.0
us=949000   server_bridge_netmask = 0.0.0.0
us=949000   server_bridge_pool_start = 0.0.0.0
us=949000   server_bridge_pool_end = 0.0.0.0
us=949000   ifconfig_pool_defined = DISABLED
us=949000   ifconfig_pool_start = 0.0.0.0
us=949000   ifconfig_pool_end = 0.0.0.0
us=949000   ifconfig_pool_netmask = 0.0.0.0
us=949000   ifconfig_pool_persist_filename = '[UNDEF]'
us=949000   ifconfig_pool_persist_refresh_freq = 600
us=949000   n_bcast_buf = 256
us=949000   tcp_queue_limit = 64
us=949000   real_hash_size = 256
us=981000   virtual_hash_size = 256
us=981000   client_connect_script = '[UNDEF]'
us=981000   learn_address_script = '[UNDEF]'
us=981000   client_disconnect_script = '[UNDEF]'
us=981000   client_config_dir = '[UNDEF]'
us=981000   ccd_exclusive = DISABLED
us=981000   tmp_dir = 'C:\Users\Andreas\AppData\Local\Temp\'
us=981000   push_ifconfig_defined = DISABLED
us=981000   push_ifconfig_local = 0.0.0.0
us=981000   push_ifconfig_remote_netmask = 0.0.0.0
us=981000   enable_c2c = DISABLED
us=981000   duplicate_cn = DISABLED
us=981000   cf_max = 0
us=981000   cf_per = 0
us=981000   max_clients = 1024
us=996000   max_routes_per_client = 256
us=996000   auth_user_pass_verify_script = '[UNDEF]'
us=996000   auth_user_pass_verify_script_via_file = DISABLED
us=996000   ssl_flags = 0
us=996000   client = DISABLED
us=996000   pull = DISABLED
us=996000   auth_user_pass_file = '[UNDEF]'
us=996000   show_net_up = DISABLED
us=996000   route_method = 0
us=996000   ip_win32_defined = DISABLED
us=996000   ip_win32_type = 3
us=996000   dhcp_masq_offset = 0
us=996000   dhcp_lease_time = 31536000
us=996000   tap_sleep = 0
us=996000   dhcp_options = DISABLED
us=996000   dhcp_renew = DISABLED
us=12000   dhcp_pre_release = DISABLED
us=12000   dhcp_release = DISABLED
us=12000   domain = '[UNDEF]'
us=12000   netbios_scope = '[UNDEF]'
us=12000   netbios_node_type = 0
us=12000   disable_nbt = DISABLED
us=12000 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
us=12000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
us=12000 Static Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
us=12000 Static Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
us=12000 Static Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
us=12000 Static Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
us=12000 LZO compression initialized
us=27000 Socket Buffers: R=[128000->128000] S=[49152->49152]
us=74000 ROUTE default_gateway=192.168.10.254
us=90000 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{72533D1A-383C-4F31-B507-4803BFA85B4B}.tap
us=90000 TAP-Win32 Driver Version 9.9 
us=90000 TAP-Win32 MTU=1500
us=105000 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.11.12.14/255.255.255.252 on interface {72533D1A-383C-4F31-B507-4803BFA85B4B} [DHCP-serv: 10.11.12.12, lease-time: 31536000]
us=105000 NOTE: FlushIpNetTable failed on interface [31] {72533D1A-383C-4F31-B507-4803BFA85B4B} (status=5) : Access is denied.  
us=105000 Data Channel MTU parms [ L:1577 D:1450 EF:45 EB:135 ET:32 EL:0 AF:3/1 ]
us=105000 Local Options String: 'V4,dev-type tap,link-mtu 1577,tun-mtu 1532,proto UDPv4,ifconfig 10.11.12.12 255.255.255.252,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,secret'
us=105000 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1577,tun-mtu 1532,proto UDPv4,ifconfig 10.11.12.12 255.255.255.252,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,secret'
us=105000 Local Options hash (VER=V4): 'b726230f'
us=105000 Expected Remote Options hash (VER=V4): 'b726230f'
us=105000 UDPv4 link local (bound): [undef]:1194
us=105000 UDPv4 link remote: MYSERVER:1194
us=704000 Peer Connection Initiated with MYSERVER:1194
us=180000 TEST ROUTES: 1/1 succeeded len=0 ret=1 a=0 u/d=up
us=180000 C:\WINDOWS\system32\route.exe ADD MYSERVER MASK 255.255.255.255 192.168.10.254
us=180000 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied.   [status=5 if_index=12]
us=180000 Route addition via IPAPI failed [adaptive]
us=180000 Route addition fallback to route.exe
The requested operation requires elevation.
us=211000 ERROR: Windows route add command failed [adaptive]: returned error code 1
us=211000 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.11.12.13
us=211000 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied.   [status=5 if_index=31]
us=211000 Route addition via IPAPI failed [adaptive]
us=211000 Route addition fallback to route.exe
The requested operation requires elevation.
us=242000 ERROR: Windows route add command failed [adaptive]: returned error code 1
us=242000 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.11.12.13
us=242000 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied.   [status=5 if_index=31]
us=242000 Route addition via IPAPI failed [adaptive]
us=242000 Route addition fallback to route.exe
The requested operation requires elevation.
us=258000 ERROR: Windows route add command failed [adaptive]: returned error code 1
us=258000 Initialization Sequence Completed

This is the current "verb 5" logfile. Please see my comments in the post above. Thx!

janjust

Quote:
* make sure ip forwarding is enabled on the server side

So I am forced to change the server setup, too? No way around that?

for rerouting all traffic? yes

Remember, I would like to leave the server untouched, as the "server-only-tunnel" is working well. (Let's call that "config 1")

Or can I push that command from the client config ("config 2" = "all traffic through tunnel") into the server?

rerouting all traffic requires a different type of server than a "server-only" tunnel - when you want to route traffic the server must be well, err, set up for routing. This is not required if you're tunnelling only to the server.

Quote:
* use some masquerading to hide the VPN IP range e.g.

Why?

Quote:
Code:
iptables -t nat -O POSTROUTING -i tun+ -j MASQUERADE
[/code]

I guess that's also on the server?

If that is indispensable - what would be the command to undo that change?

again, when you want to route all traffic steps like these (or other alterations on the server-side network ) are needed. This has little to do with OpenVPN , only with IP routing.

You can undo the step above using

iptables -t nat -D POSTROUTING -i tun+ -j MASQUERADE

andreask

Thx a lot.

1) Then I will change the server. Will it affect it's other usages in any way?

2) Please have a look at the last error messages above. That is a client problem. How to solve?

Thanks a 10^6!

:-)

BigRedFed

This is the first result in Google, so I am raising this Zombie thread. I resolved the issue by running the openvpn client as an administriator. Click the shortcut on the desktop,
Select compatibility tab
Check "Run this program as an administrator"

It appears that the program must be run as an administrator to add the appropriate routes. That would be the cause of the error codes.