First VPN, client connects, ping fails.

DanEllison

Network:

   Internet

      ||
      ||

    RTP300
 192.168.16.1

      ||          \\
      ||            \\

192.168.16.103        192.168.16.111
   WNDR4000             Cray (Win7)
  10.19.80.1            VPN client

      ||
      ||

  10.19.80.2
 Mozart (win7)
  VPN server

Server Config:

port 1194
proto udp
dev tun
ca "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\MOZART.crt"
key "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\MOZART.key"  # This file should be kept secret
dh "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\dh1024.pem"
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

Client config:

client
dev tun
proto udp
remote 192.168.16.103 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\CRAY.crt"
key "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\CRAY.key"  # This file should be kept secret
ns-cert-type server
comp-lzo
verb 3

So, I'm only connecting through the second router right now; connecting from outside is a problem yet to be tackled. When the client starts, it appears to start fine. However I can't ping anything behind the router, and my server can't ping the client. The documentation mentions that the TAP/TUN adapter may be filtered by the Firewall. I'm running Windows 7 and can't see any option in the Firewall settings for this.

C:\Program Files\OpenVPN\config>openvpn CRAY.ovpn
Mon Apr 15 08:22:35 2013 OpenVPN 2.3.1 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO]
[PKCS11] [eurephia] [IPv6] built on Mar 28 2013
Mon Apr 15 08:22:35 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or hig
her to call user-defined scripts or executables
Mon Apr 15 08:22:36 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Apr 15 08:22:36 2013 UDPv4 link local: [undef]
Mon Apr 15 08:22:36 2013 UDPv4 link remote: [AF_INET]192.168.16.103:1194
Mon Apr 15 08:23:36 2013 TLS Error: TLS key negotiation failed to occur within 6
0 seconds (check your network connectivity)
Mon Apr 15 08:23:36 2013 TLS Error: TLS handshake failed
Mon Apr 15 08:23:36 2013 SIGUSR1[soft,tls-error] received, process restarting
Mon Apr 15 08:23:36 2013 Restart pause, 2 second(s)
Mon Apr 15 08:23:38 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or hig
her to call user-defined scripts or executables
Mon Apr 15 08:23:38 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Apr 15 08:23:38 2013 UDPv4 link local: [undef]
Mon Apr 15 08:23:38 2013 UDPv4 link remote: [AF_INET]192.168.16.103:1194
Mon Apr 15 08:23:38 2013 TLS: Initial packet from [AF_INET]192.168.16.103:1194,
sid=c09c655b 35b68195
Mon Apr 15 08:23:38 2013 VERIFY OK: depth=1, C=US, ST=TX, L=Plano, O=Ellison, CN
=ELLISON-HERITAGE, name=Daniel H. Ellison, emailAddress=Daniel.H.Ellison@gmail.c
om
Mon Apr 15 08:23:38 2013 VERIFY OK: nsCertType=SERVER
Mon Apr 15 08:23:38 2013 VERIFY OK: depth=0, C=US, ST=TX, L=Plano, O=Ellison, CN
=MOZART, name=Daniel H. Ellison, emailAddress=Daniel.H.Ellison@gmail.com
Mon Apr 15 08:23:38 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with
128 bit key
Mon Apr 15 08:23:38 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1'
 for HMAC authentication
Mon Apr 15 08:23:38 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with
128 bit key
Mon Apr 15 08:23:38 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1'
 for HMAC authentication
Mon Apr 15 08:23:38 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES2
56-SHA, 1024 bit RSA
Mon Apr 15 08:23:38 2013 [MOZART] Peer Connection Initiated with [AF_INET]192.16
8.16.103:1194
Mon Apr 15 08:23:41 2013 SENT CONTROL [MOZART]: 'PUSH_REQUEST' (status=1)
Mon Apr 15 08:23:41 2013 PUSH: Received control message: 'PUSH_REPLY,route 10.8.
0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Mon Apr 15 08:23:41 2013 OPTIONS IMPORT: timers and/or timeouts modified
Mon Apr 15 08:23:41 2013 OPTIONS IMPORT: --ifconfig/up options modified
Mon Apr 15 08:23:41 2013 OPTIONS IMPORT: route options modified
Mon Apr 15 08:23:41 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Apr 15 08:23:41 2013 open_tun, tt->ipv6=0
Mon Apr 15 08:23:41 2013 TAP-WIN32 device [Local Area Connection 4] opened: \\.\
Global\{89B1F6A2-386D-4D11-B4FF-BB78951EA330}.tap
Mon Apr 15 08:23:41 2013 TAP-Windows Driver Version 9.9
Mon Apr 15 08:23:41 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of
 10.8.0.6/255.255.255.252 on interface {89B1F6A2-386D-4D11-B4FF-BB78951EA330} [D
HCP-serv: 10.8.0.5, lease-time: 31536000]
Mon Apr 15 08:23:41 2013 Successful ARP Flush on interface [52] {89B1F6A2-386D-4
D11-B4FF-BB78951EA330}
Mon Apr 15 08:23:46 2013 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Mon Apr 15 08:23:46 2013 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255
.255.255 10.8.0.5
Mon Apr 15 08:23:46 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMet
ric1=30 and dwForwardType=4
Mon Apr 15 08:23:46 2013 Route addition via IPAPI succeeded [adaptive]
Mon Apr 15 08:23:46 2013 Initialization Sequence Completed

Thanks,
Dan

janjust

So, I'm only connecting through the second router right now; connecting from outside is a problem yet to be tackled. When the client starts, it appears to start fine. However I can't ping anything behind the router, and my server can't ping the client. The documentation mentions that the TAP/TUN adapter may be filtered by the Firewall. I'm running Windows 7 and can't see any option in the Firewall settings for this.

the fact that the server cannot ping the Win7 client is normal - the default win7 firewall rules do not allow a public interface (such as the tap-win32 i/f) to be pinged. You can turn the tap-win32 i/f into a private i/f using some registry key , or you can push a default gw from the VPN server to the client - this will also let you change the adapter type.

The fact that the client cannot ping anything "behind the server" (what is behind it? your diagram does not show it) also does not surprise me, as the IP address of the traffic from the VPN client is 10.8.0.X - do the devices "behind the server" know about this IP range? If not, add a static route on your local router to ensure that all traffic coming from 10.8.0.x points back to 10.19.80.2 (Mozart).

DanEllison

I have other computers on the network along side Mozart, but I couldn't ping Mozart either based on the sample IP. However, I think I took the sample too literally and should have specified a different static IP.

In any case, I knew from the start that I was really going to want a bridged configuration and made the changes per the HOW-TO. Much better, all is as expected, from outside the first router. I'll start a new thread for my router/router issue.

Thanks,
Dan