Hello. I have setup an openvpn between my home and the office. A win7 PC at home acts as a server for the VPN (10.8.0.1-VPN side and 192.168.1.148-LAN side) I have entered on the router the "route" commands so that I route the VPN client subnet (10.8.0.0/24) to the OpenVPN server as it is described in the HOWTO Now I can ping the address 10.8.0.18 from a laptop on my home LAN wich has the IP:192.168.1.100 Also from my office, the PC that is connected to the VPN server with an IP (vPN side) 10.8.0.6 can ping a pc on the LAN of my home successfully. I follow the instruction on the HOWTO to make the devices from the client side LAN accessible from my server's side LAN device but I do not manage to do it. This what I do 1. I make a unique IP subnet for the office(client) LAN: 10.10.11.0 2. I enable IP forwarding on the client PC. Question: How can I enable it for the TUN/TAP in win XP 3. Enter the line "client-config-dir ccd". Question: Should I replace the word "ccd" with the actual path (C:\Program Files\openvpn\config) or just leave it as "ccd"? Maybe a stupid question but I cannot resolve it. 4. I create a file named "client2" (this is the clients common name) and enter there the line [i]iroute 10.10.11.0 255.255.255.0[/i] I place it in the path "[i]C:\Program Files\openvpn\config[/i]" 5. I add the line in the server's config file [i]route 10.10.11.0 255.255.255.0[/i] 6. I add the[i] client-to-client [/i]and the [i]push "route 10.10.11.0 255.255.255.0" [/i]lines in the server's config file 7. I add a route to the server's LAN gateway(home router) which directs 10.10.11.0/24 to the OpenVPN server (192.168.1.148) box . But it does not work Firewall is off on all mashines Thank you

my configs are these [code]port 1194 proto udp dev tun dev-node TAP-Win32 ca ca.crt cert server.crt key server.key # This file should be kept secret dh dh1024.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt management localhost 23 push "route 192.168.10.0 255.255.255.0" push "route 192.168.1.0 255.255.255.0" push "route 10.10.11.0 255.255.255.0" client-config-dir ccd route 10.10.11.0 255.255.255.0 route 192.168.10.0 255.255.255.0 client-to-client keepalive 10 120 comp-lzo persist-key persist-tun status openvpn-status.log verb 3 #######Client client dev tun dev-node TAP-Win32 proto udp remote xxx.xxx.xxx 1194 resolv-retry infinite nobind persist-key persist-tun management localhost 23 ca ca.crt cert client2.crt key client2.key ns-cert-type server comp-lzo verb 3 [/code]

[quote] 2. I enable IP forwarding on the client PC. Question: How can I enable it for the TUN/TAP in win XP [/quote] this is a global setting - if IP Forwarding is enabled it applies to all interfaces [quote] 3. Enter the line "client-config-dir ccd". Question: Should I replace the word "ccd" with the actual path (C:\Program Files\openvpn\config) or just leave it as "ccd"? Maybe a stupid question but I cannot resolve it. [/quote] it is best to use an absolute path, e.g. [code]client-config-dir "c:/program files/openvpn/config"[/code] Alternatively you can try creating a directory 'ccd' underneath "C:\Program Files\openvpn\config" and then use [code]client-config-dir ccd[/code]

OK. Thanks. I'll try it and see if I make it

I cannot do it. I need help I am postiong all the steps I have followed, wishing that someone with a good heart will help me I repeat the network "topology" I have a network (192.168.1.0/255.255.255.0) at home. The gateway is a thompson router (192.168.1.254) and the openVPN server is located in a win7 PC in this network(192.168.1.148) A Second network is at my country home (192.168.10.0/255.255.255.0). A same router is used as a gateway (192.168.10.1) and the client PC (to the VPN) is a WinXP Pro Sp3 (192.168.1.249) The VPN is active and running on this PCs and I can connect to it from other places too. Server Config [code]port 1194 proto udp dev tun dev-node TAP-Win32 ca ca.crt cert server.crt key server.key # This file should be kept secret dh dh1024.pem server 10.8.1.0 255.255.255.0 #ifconfig-pool-persist ipp.txt #server-bridge management localhost 23 #push "route 192.168.10.0 255.255.255.0" #push "route 192.168.20.0 255.255.255.0" #push "route 10.10.11.0 255.255.255.0" #route 10.10.11.0 255.255.255.0 #route 192.168.10.0 255.255.255.0 #route 192.168.1.0 255.255.255.0 #client-config-dir C:\\Program Files\\OpenVPN\\config\\ccd client-to-client push "route 192.168.1.0 255.255.255.0" keepalive 10 120 ;tls-auth ta.key 0 # This file is secret ;cipher BF-CBC # Blowfish (default) ;cipher AES-128-CBC # AES ;cipher DES-EDE3-CBC # Triple-DES comp-lzo max-clients 100 ;user nobody ;group nobody persist-key persist-tun status openvpn-status.log verb 6 ;mute 20 [/code] Client Config [code]client dev tun dev-node TAP-Win32 proto udp remote xxxx.xxx.xxx 1194 resolv-retry infinite nobind ;user nobody ;group nobody persist-key persist-tun ca ca.crt cert client4.crt key client4.key ns-cert-type server comp-lzo verb 3 [/code] [color=#FF0000]1st STEP:include additional machines on the server subnet.[/color] -Enable IP forwarding -add the line push "route 192.168.1.0 255.255.255.0" on the server config file - using telnet (this is the only way for the Thompson router to add routes) I add a route for the 10.8.1.0 on the gateway which is located at the openvpn server LAN. I use this command: [code]ip rtadd ip rtadd dst = [dstmsk = [label = [gateway = [intf = [srcintf = [metric = [/code] dst=10.8.1.0 dstmsk=24 label "nothing" gateway= 192.168.1.148 (the IP of the PC that runs the VPN server intf=LocalNetwork Also I use the command "ip saveall" to save this route on the router So I've got a new entry on the IP table saying: Destination=10.8.1.0/24, gateway=192.168.1.148, localnetwork Firewall is disabled on both computers Now I am at the home LAN(192.168.1.0), on a laptop with IP-192.168.1.68. I can ping the VPN server (10.8.1.0 and 192.168.1.148) and I can ping any other adress of the VPN (10.8.1.0). From my country home LAN(192.168.10.0) I can ping the VPN server and the Home LAN's gateway (192.168.1.254) but nothing else So it seems that the VPN server (192.168.1.148 or 10.8.1.0) does not route the traffic correctly to the Home Lans PCs, since it routes it only to the router (192.168.10.254) [color=#FF0000]2nd step "Including multiple machines on the client side when using a routed VPN (dev tun)[/color] -I create the client config dir ("C:\Program files\openvpn\config\ccd") -I add the entry client-config-dir C:\\Program files\\openvpn\\config\\ccd -create a file names client4 (no extension, right?) that contains the line iroute 192.168.10.0 255.255.255.0 and place it in the ccd dir. client4 is the common name of the client pc -place the command route 192.168.10.0 255.255.255.0 in the server config file -uncomment the "client-to-client" option in tthe server config file -add the push "route 192.168.10.0 255.255.255.0" command in the server config -create a route on the home LAN gateway ip rtadd dst=192.168.10.0/24 gateway=192.168.1.148 intf=LocalNetwork -create a route on the Client side LAN gateway ip rtadd dst=10.8.1.0/24 gateway=192.168.1.249 intf=LocalNetwork and at last ip saveall so I should be able to reach anh ip of the subnet (192.168.10.0) from any ip on the subnet 192.168.1.0. Well something is wrong because I cannot Any help?

It seems that I am almost there The main problem was tha I had to add routes to the gateway of each subnet for each subnet of the server and client side. After I did that I begun to communicate with the clients' side. I have managed to "see" devices in the client side and devices in the server side of the VPN from both directions. But not all For example I can trace an IP camera I have on the client side from any side of the VPN but not an Access point that is connect to this subnet: [code]traceroute 192.168.10.6 from 10.10.11.10 1 1 ms 1 ms 2 ms 10.10.11.1 #This is the LAN gateway 2 3 ms 40 ms 26 ms ANASTOFFICE [10.10.11.5] #this is the client gateway to VPN 3 82 ms 84 ms 75 ms PC-HOME [10.8.1.6] #This is the other client gateway to VPN 4 80 ms 76 ms 78 ms 192.168.10.6 #this the LAN address of the IP camera [/code] This is a trace using windows traceroute command. I use a laptop connected on subnet (10.10.11.0 with gateway 10.10.11.1) to trace another client on a diferent subnet (192.168.10.0, with gateway 192.168.1.1) the Client PC for the fist subnet is ANASTOFFIC (10.10.11.5) and for the second subnet is the PC-HOME(192.168.10.249) This trace is successfull. But if I try to trace from PC home the IP 10.10.11.128 it does not work. It stops on anastoffice (IP 10.8.1.10). 10.10.11.128 is another laptop on the first subnet [code] #Client ANASTOFFICE (10.10.11.5 or 10.8.1.10) config client dev tun dev-node TAP-Win32 ;proto tcp proto udp remote xxx.xxx.xxx 1194 resolv-retry infinite nobind persist-key persist-tun management localhost 23 ca ca.crt cert client3.crt key client3.key ns-cert-type server comp-lzo verb 3 [/code] Client2 Config (at PC-Home 192.168.10.249) is the same Server config [code]dev tun dev-node TAP-Win32 ca ca.crt cert server.crt key server.key # This file should be kept secret dh dh1024.pem server 10.8.1.0 255.255.255.0 management localhost 23 route 10.10.11.0 255.255.255.0 route 192.168.10.0 255.255.255.0 client-config-dir ccd client-to-client push "route 192.168.1.0 255.255.255.0" push "route 10.10.11.0 255.255.255.0" push "route 192.168.10.0 255.255.255.0" keepalive 10 120 comp-lzo persist-key persist-tun status openvpn-status.log verb 6 [/code] I suspect that the problem is on the router of the 10.10.11.0 subnet. When I add routes on this router/gateway iI have tow options on the interface: LAN/br0 and NAS 8_35 I select the first one is that correct?

[quote]I use a laptop connected on subnet (10.10.11.0 with gateway 10.10.11.1) to trace another client on a diferent subnet (192.168.10.0, with gateway 192.168.1.1) the Client PC for the fist subnet is ANASTOFFIC (10.10.11.5) and for the second subnet is the PC-HOME(192.168.10.249) This trace is successfull. But if I try to trace from PC home the IP 10.10.11.128 it does not work. It stops on anastoffice (IP 10.8.1.10). 10.10.11.128 is another laptop on the first subnet[/quote] so it works in one direction but not the other? do you have a 'ccd' file for the openvpn client (= ANASTOFFIC)? you will need this , with the right 'iroute' statement for subnet-to-subnet routing to work.

I have 2 files in this dir (ccd) file1: client3, this is for the PC anastoffice with the command iroute 10.10.11.0.255.255.255.0 file2: client4. for PC-Home with command iroute 192.168.10.0 255.255.255.0 The problem is not that it works only in one direction, but mostly it is that it cannot reach all the IPs I can reach IP 10.10.11.5 but not 10.10.11.254 (which for example is an access point) It is something I am missing. Do I have to "iroute" all subnets in the ccd files? I mean, do I have to add both iroute 10.10.11.0 and iroute 192.168.10.0 on both ffiles (client3 and client4) in the ccd dir?

[quote]I can reach IP 10.10.11.5 but not 10.10.11.254 (which for example is an access point) [/quote] the IP 10.10.11.5 is the IP of the VPN client - is IP forwarding enabled on this client? on Windows you can check this using 'ipconfig /all'. Also, when pinging 10.10.11.254 from 192.168.10.X: does the machine 10.10.11.254 know where to send packets back to? (they need to go back to the VPN client). You can work around this by adding an extra route on your LAN router to point the subnet 192.168.10/24 to 10.10.11.5 [quote]Do I have to "iroute" all subnets in the ccd files?[/quote] no this is not required, and as the PC 192.168.10.XX can reach 10.10.11.5 this shows that *that* iroute statement is working - remove it from the CCD file and you should see that it can no longer be reached

IP10.10.11.5 is a client and the gateway to the VPN from the client side(I hope I am saying it correctly) Ip forwarding is enabled in this PC [quote]Also, when pinging 10.10.11.254 from 192.168.10.X: does the machine 10.10.11.254 know where to send packets back to? (they need to go back to the VPN client). You can work around this by adding an extra route on your LAN router to point the subnet 192.168.10/24 to 10.10.11.5 [/quote] Yes I have added this. theseare the static routes on my router [code]Static Routing Destination Network Address Default Gateway Subnet Mask Interface 10.8.1.0 10.10.11.5 255.255.255.0 br0 192.168.1.0 10.10.11.5 255.255.255.0 br0 192.168.10.0 10.10.11.5 255.255.255.0 br0 [/code] Just for fun, I made the mistake and entered bot iroute in both client files and this i a trace that bounced between the two client all the time [quote] Tracing route to 10.10.11.3 over a maximum of 30 hops 1 70 ms 100 ms 1 ms PC3 [192.168.1.148] 2 35 ms 37 ms 37 ms PC-HOME [10.8.1.10] 3 37 ms 137 ms 99 ms 192.168.10.1 4 97 ms 36 ms 36 ms PC-HOME [192.168.10.249] 5 37 ms 38 ms 37 ms PC-HOME [192.168.10.249] 6 67 ms 37 ms 38 ms PC-HOME [192.168.10.249] 7 99 ms 62 ms 117 ms 192.168.10.1 8 96 ms 37 ms 37 ms PC-HOME [192.168.10.249] 9 39 ms 39 ms 38 ms PC-HOME [192.168.10.249] 10 64 ms 38 ms 39 ms PC-HOME [192.168.10.249] 11 40 ms 40 ms 39 ms PC-HOME [192.168.10.249] 12 67 ms 37 ms 38 ms PC-HOME [192.168.10.249] 13 38 ms 40 ms 110 ms PC-HOME [192.168.10.249] 14 60 ms 99 ms 41 ms PC-HOME [192.168.10.249] 15 42 ms 450 ms 40 ms PC-HOME [192.168.10.249] 16 45 ms 99 ms 40 ms PC-HOME [192.168.10.249] 17 40 ms 52 ms 96 ms 192.168.10.1 18 94 ms 44 ms 42 ms PC-HOME [192.168.10.249] 19 94 ms 99 ms 100 ms 192.168.10.1 20 42 ms 42 ms 42 ms PC-HOME [192.168.10.249] 21 42 ms 42 ms 114 ms 192.168.10.1 22 46 ms 41 ms 41 ms PC-HOME [192.168.10.249] 23 41 ms 42 ms 138 ms 192.168.10.1 24 41 ms 42 ms 43 ms PC-HOME [192.168.10.249] 25 43 ms 98 ms 100 ms 192.168.10.1 26 41 ms 44 ms 43 ms PC-HOME [192.168.10.249] 27 127 ms 99 ms 97 ms 192.168.10.1 28 45 ms 42 ms 45 ms PC-HOME [192.168.10.249] 29 77 ms 100 ms 98 ms 192.168.10.1 30 97 ms 44 ms 48 ms PC-HOME [192.168.10.249] Trace complete.[/quote]

I think I found the problem, now seeking the solution I connected via telenet to the vpn server and typed the status command: [code]status OpenVPN CLIENT LIST Updated,Fri May 17 11:28:49 2013 Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since client3,xx.xx.xx.106:1938,1305094,6951076,Fri May 17 07:56:26 2013 client4,yy.yy.yy.218:55546,1303670,263014,Fri May 17 07:34:08 2013 ROUTING TABLE Virtual Address,Common Name,Real Address,Last Ref 192.168.10.0/24,client4,xx.xx.xx.218:55546,Fri May 17 07:34:09 2013 10.10.11.0/24,client3,yy.yy.yy.106:1938,Fri May 17 07:56:40 2013 10.8.1.6,client3,xx.xx.xx.106:1938,Fri May 17 11:28:49 2013 10.8.1.10,client4,yy.yy.yy.218:55546,Fri May 17 11:28:46 2013 10.10.11.10C,client3,xx.xx.xx.106:1938,Fri May 17 11:28:48 2013 GLOBAL STATS Max bcast/mcast queue length,1 END [/code] The strange here is the line that says 10.10.11.10C..... the IP 10.10.11.10 is a laptop connected to the client3 LAN via WiFi and has vpn connectivity to both directions. I notice that there are not any other similar entries for other IPs in client3 network Now I go to laptop that is connected to the client3 LAN via cable (ethernet, cat5e) and hasNOT vpm connectivity. I dissable this connection. Then connect it to the LAN with wifi. Now look at the status commend on the vpn server [quote]status OpenVPN CLIENT LIST Updated,Fri May 17 11:42:46 2013 Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since client3,xx.xx.xx.106:1938,2196553,9338207,Fri May 17 07:56:26 2013 client4,yy.yy.yy.218:55546,1312679,273451,Fri May 17 07:34:08 2013 ROUTING TABLE Virtual Address,Common Name,Real Address,Last Ref 192.168.10.0/24,client4,yy.yy.yy.218:55546,Fri May 17 07:34:09 2013 10.10.11.0/24,client3,xx.xx.xx.106:1938,Fri May 17 07:56:40 2013 192.168.10.6C,client4,yy.yy.yy.218:55546,Fri May 17 11:42:35 2013 10.8.1.6,client3,xx.xx.xx.106:1938,Fri May 17 11:42:45 2013 10.8.1.10,client4,yy.yy.yy.218:55546,Fri May 17 11:38:46 2013 10.10.11.15C,client3,xx.xx.xx.106:1938,Fri May 17 11:41:56 2013 10.10.11.10C,client3,xx.xx.xx.106:1938,Fri May 17 11:42:42 2013 GLOBAL STATS Max bcast/mcast queue length,1 END[/quote] an new line was added: " 10.10.11.15C...." which is the IP of the second laptop, which now has VPN connectivity So I think that there is a routing problem on the client3 LAN gateway which routes only devices connected via wifi and not cable connections. Do you find it possible?

Some questions on the HOWTo

dentalan

In the huawei router's settings, there is a por binding setting
In help it describes it as "

•Port binding

It is used to specify which LAN ports and WLAN ports are bound to the WAN connection. The bound LAN ports and WLAN ports can access the network through only the designated WAN connection.

There is a list of LAN ports 1 to 4 and a list of SSIDs (1 to 4)
All the LAN ports were checked and not the SSIDs. (Remember ? The wlan was working in VPN) I unchecked the LAN2 and LAN3 (these are the only ports that I use in this router and the vpn works. I suddenly can see all the devices in the client side. A litle slow I 'm afraid but t works.
I would realy apreciate an explanation

« Previous Page