Site-to-site routing with OpenVPN on WinSrv2012

myriaxis

Hi

I'm struggling with the following network setup for some days now.
I read many threads on this forum but fail to find a suitable solution.
Please help me.

Here is the network diagram:

Server side                                                      Client side
+---------------+                                                +---------------+
|    Gateway    |                                                |  Gateway,DNS  |
| S 192.168.1.1 |                                                | S 192.168.2.1 |
+-------+-------+                                                +-------+-------+
        |                                                                |
        |          +---------------+          +---------------+          |
        |          | 192.168.255.x +==========+ 192.168.255.y |          |
        |          |    OpenVPN    |          |  OpenVPN,DHCP |          |
        +----------+S 192.168.1.21 |          |S 192.168.2.21 +----------+
        |          +---------------+          +---------------+          |
        |          |    Hyper-V    |                                     |
        |          |S 192.168.1.20 |                                     |
        |          +---------------+                                     |
        |                                                                |
        |          +---------------+                                     |
        |          |   DHCP,DNS    |                                     |
        +----------+S 192.168.1.24 |                                     |
        |          +---------------+                                     |
        |                                                                |
+-------+-------+                                                +-------+-------+
|       PC      |                                                |       PC      |
|R 192.168.1.101|                                                |R 192.168.2.210|
+---------------+                                                +---------------+

The gateways are basic routers (D-Link and Belkin).
The servers (OpenVPN, Hyper-V, DHCP/DNS) are all Windows Server 2012.
The PCs are Windows 8 (server side) and Windows 7 (client side).
Since I can't specify static routes in the router configuration, I decided to use DHCP servers on both sides.
On the Server side, I have a file server to which I added DHCP and DNS server roles (192.168.1.24).
On the client side, the DHCP server is on the OpenVPN server (192.168.2.21) and DNS is on the gateway.
"S" in front of the IP Address means the IPv4 configuration is static.
"R" in front of the IP Address means the IPv4 configuration is dynamic, but reserved in the DHCP.

Here is the OpenVPN server config:

port 1194
proto udp
dev tun
server 192.168.255.0 255.255.255.0
route 192.168.2.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"
push "route 192.168.2.0 255.255.255.0"
client-to-client
client-config-dir "C:\\Program Files\\OpenVPN\\config"
ifconfig-pool-persist ipp.txt
max-clients 100
keepalive 10 120
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\ServerNode.crt"
key "C:\\Program Files\\OpenVPN\\config\\ServerNode.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem"
cipher AES-128-CBC
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

Here is the client file on the server:

iroute 192.168.2.0 255.255.255.0

Here is the OpenVPN client config:

client
proto udp
dev tun
remote serverdomain.com 1194
resolv-retry infinite
ping 15
ping-restart 45
ping-timer-rem
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\ClientNode.crt"
key "C:\\Program Files\\OpenVPN\\config\\ClientNode.key"
ns-cert-type server
cipher AES-128-CBC
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

Based on all the reading I've made, I ensured:
1. Port 1194 forwarding to OpenVPN server is configured in the server side gateway.
2. IP forwarding is enabled on both OpenVPN servers
3. Firewall is inactive on the VPN interface on both OpenVPN servers
4. ICMPv4 is allowed on both OpenVPN servers
5. Port 1194 is allowed on both OpenVPN servers
6. Static route 192.168.2.0 - 255.255.255.0 - 192.168.1.21 added to server side DHCP Static route option 121
7. Static route 192.168.255.0 - 255.255.255.0 - 192.168.1.21 added to server side DHCP Static route option 121
8. Static route 192.168.1.0 - 255.255.255.0 - 192.168.2.21 added to client side DHCP Static route option 121
9. Static route 192.168.255.0 - 255.255.255.0 - 192.168.2.21 added to client side DHCP Static route option 121

At some point, I managed to establish a link between the two OpenVPN servers.
I was able to ping each OpenVPN servers from each other (ex. ping 192.168.2.21 from 192.168.1.21 and vice-versa was OK).
But I've never managed to ping the PCs behind the OpenVPN servers.

Before posting Route Prints and log files, I have a few questions:
1. Since the servers with static IP Address don't receive the DCHP static routes, do I have to manually add them to these servers?
a. If yes, is it also true for the OpenVPN servers?
b. If yes, is it also true for the Hyper-V server?
2. Do I have to enable IP forwarding on the Hyper-V server?
3. Do I have to deactivate the Firewall on the Hyper-V server?
4. Are my config files OK?
5. I read that AES cipher may not be compatible with Windows. Should I use another cipher?
a. If yes, which one?

Many thanks for your help.

maikcat

hello there,

very nice diagram,includes all necessary info,great post! 😉

personally i havent got much expirience with win 2012/ win 8...

but openvpn (and AES) works great in win xp/7...

some questions/observations...

instead of passing static routes via dhcp,can you try for testing adding them manually?
also for testing disable completely firewalls on openvpn client/serve.

also use traceroute from your client to:

openvpn servers tun ip,
openvpn clients tun ip
openvpn clients lan ip.

also for checking out that your ccd is parsed correctly ,use it to assign
static ip to your client like:

ifconfig-push 192.168.255.22 192.168.255.21

add the previous to your ccd and reconnect your client,if he gets .22 ip then
your ccd is parsed correctly...
you do named your ccd ClientNode right?

openvpn automatically adds routes when it starts/connects
btw remove this from your server config:

push "route 192.168.2.0 255.255.255.0"

except there are many clients that connect...

your configs look ok.. 🙂
also from openvpn client you should be able to ping 192.168.1.21..

just use static routes for now,then try using DHCP to pass them over..

also keep in mind that traffic coming from vpn/remote side will be blocked on windows
clients if they have firewall enabled...

hope that helps..

Michael.

myriaxis

Hello Maikcat,

Thanks for the reply ... and the compliments. 😃

Well, to make sure I had no previous tweaks left in the setup, I reinstalled OpenVPN on a fresh VM.
I disabled Windows Firewall for both private and public profiles on each OpenVPN servers.
I made sure IP forwarding was enabled on each OpenVPN servers.
I removed the DHCP static route option and added static route manually on the PCs.
I did not add static route on OpenVPN servers and Hyper-V server.
I did not enable IP forwarding on the Hyper-V server.
I made the config changes as you suggested and confirmed the ccd is parsed correctly.

... and got the same results.

However, you nailed it with your last comment.

also keep in mind that traffic coming from vpn/remote side will be blocked on windows
clients if they have firewall enabled...

After disabling Windows Firewall on the remote PC (192.168.2.210), I was able to ping and tracert across the VPN from (192.168.1.101).
I initially thought that vpn/remote traffic, if allowed through the VPN, would be considered local traffic.
Now I have to figure out which rule to add in the Windows Firewall.
Any pointers?

Also, I noticed that I can't ping/tracert the remote gateway.
Any idea why?

Many thanks for your help.
It's pretty good for someone who doesn't know much about WinSrv2012 / Win 8 ... 😉

janjust

I initially thought that vpn/remote traffic, if allowed through the VPN, would be considered local traffic.
Now I have to figure out which rule to add in the Windows Firewall.
Any pointers?

Win2012 (and Win7/8) uses Network Location Awareness, most likely, in which case all traffic from the TAP-Win32 adapter is considered 'Public' ; by default, Win 7/8/2012 do not allow you to ping hosts on their 'public' interfaces. On Win7 you can use a weird to overcome this: add two lines to the client config

redirect-gateway
route-metric 9999

this will add a default GW on the tap-win32 adapter but it will not be used due to the high metric. However, the fact that the adapter now has a default GW causes Win7 NLA( and perhaps 2012 as well) to "trust" the adapter: you can now change it to "work" or "home" (e.g. non-public). After that, you should be able to ping the Win2012 server with the firewall enabled.

Also, I noticed that I can't ping/tracert the remote gateway.
Any idea why?

do you mean the VPN remote endpoint or the VPN server itself? in a default openvpn setup , each client is assign a /30 address (e.g. 10.8.0.6, remote endpoint 10.8.0.5) ; the remote endpoint in this setup is NOT pingable, but the server IP (10.8.0.1) should be - is this the case?

myriaxis

Hello janjust,

Thanks for the tips.

For the TAP-Win32 Adapter, I used a registry fix to add "*NdisDeviceType" set to 1 for the adapter.
Apparently, this tells Windows to consider the TAP-Win32 Adapter as local/private.

I can ping/tracert the Win2012 OpenVPN servers just fine.
However, to ping/tracert the Win7/8 PCs on the subnets, I need to disable their Windows Firewall.
I suppose that I have to add Firewall rules on each PCs to allow vpn traffic.
It's a bit cumbersome.
Unless the registry fix isn't working as expected.

When I referred to the gateways, I meant the basic routers (192.168.2.1 and 192.168.1.1).
When I think about it, it sort of makes sense.
Since the static routes are either provided by DHCP or added manually, the gateways don't get these static routes.
Therefore, they don't know where to send the reply packets.

janjust

the other solution would be to use some form of masquerading - on Windows this can be achieved using the RRAS server, IIRC. There was a post on this forum about a year ago how to set this up on Windows XP - perhaps you can re-use that:
https://forums.openvpn.net/topic7815.html

myriaxis

Hi,

I checked the suggested topic and couldn't relate it to my setup.
If I understand correctly, it's suggested to activate ICS on the OpenVPN server.
I'll give it some thought.

On the other hand, looking at the PC Windows Firewall rules, I noticed that they are set for the local subnet.
On the client side, I changed the DHCP subnet mask to 255.255.0.0.
And "Voilà", I could ping PC from PC (192.168.2.210 from 192.168.1.101) with the Windows Firewall up without any additional rules.
The entire class B range (192.168.0.0) is seen as local.

The next step was to test Windows network neighborhood, shares and all.
My understanding is that if the client side knows the server side DNS address, then the windows network neighborhood should work.
I can push the server side DNS address to the OpenVPN client, but my understanding is that it will only be useful to this server, not the network behind.
So I decided to add the DNS address as secondary DNS in the client side DHCP setup.
Am I correct?

Unfortunately, I couldn't test it further because I ran into some instability with the OpenVPN tunnel.
For an unknown reason, I kept loosing connectivity although the OpenVPN servers status were green.
To put everything back to normal, I had to restart the routers (192.168.1.1 and 192.168.2.1) and restart the OpenVPN tunnel.
Within a few minutes, the problem reappears and I had to reset everything again.
Any ideas as to what's going on?

Thanks for your help.

janjust

you can't simply change the subnet to 192.168.0.0/16 - that would 'flatten' your entire network but your network is not flat - you're routing traffic between two sites. If you want to attempt something like that you could try

dev tap

instead of

dev tun

in both client+server config (but I have my doubts whether that will work).