[SOLVED] Connected to VPN server but cannot ping server or L

mbr661

Hello Forum any help will be appreciated!

My setup:
A new install of FreeBSD 8.3

FreeBSD 8.3-RELEASE-p3 #0: Mon Jun 11 23:52:38 UTC 2012     root@i386-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC  i386

OpenVPN Version:

OpenVPN 2.3.1 i386-portbld-freebsd8.3 [SSL (OpenSSL)] [LZO] [eurephia] [MH] [IPv6] built on May  1 2013

On the Mac Client (10.8.3 - Mountain Lion):

Tunnelblick 3.3beta50 (build 3302)  -  OpenVPN 2.2.1

The client connects to the server without a problem, but then I cannot ping from the client to the server or vice versa. I cannot ping any of the machines on the LAN either. There is no firewall running on the server.

Client is on subnet 192.168.10.X

After connecting to the OpenVPN server, the DNS server gets changed to the correct one from the LAN (192.168.1.130), the TAP interface gets the correct IP address 192.168.1.160.

Yet I cannot ping any of the machines on the 192.168.1.X I have used this same setup on the old server, now retired, but I just cannot get it to work on the new server now.

My Server Conf:

port 1194
proto udp
dev tap
ca keys/openvpn-CAcert.pem
cert keys/openvpn-cert.pem
key keys/openvpn-unencrypted-key.pem
dh keys/dh2048.pem
tls-auth keys/HBC-ta.key 0
ifconfig-pool-persist ipp.txt

server-bridge 192.168.1.250 255.255.255.0 192.168.1.160 192.168.1.170

push "redirect-gateway def1"

push "dhcp-option DOMAIN sample.org"
push "dhcp-option DNS 192.168.1.130"

keepalive 10 120
comp-lzo
client-to-client
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log-append  /var/log/openvpn.log
verb 3

My Client Conf:

client
dev tap
proto udp
remote 192.168.10.2 1194
resolv-retry infinite
persist-key
persist-tun
ca "/Users/Manuel/Library/Application Support/Tunnelblick/Configurations/openvpn-CAcert.pem"
cert "/Users/Manuel/Library/Application Support/Tunnelblick/Configurations/MBP-cert.pem"
key "/Users/Manuel/Library/Application Support/Tunnelblick/Configurations/MBP-key.pem"
tls-auth "/Users/Manuel/Library/Application Support/Tunnelblick/Configurations/HBC-ta.key" 1
comp-lzo
verb 3

Routing table on the client before connection:

bel-mac01:.ssh Manuel$ netstat -rn
Routing tables

Internet:
Destination        	Gateway            	Flags        	     Refs   	     Use   	Netif 	Expire
default            	192.168.10.1       	        UGSc                8        	0     	en1
10.37.129/24       	link#9             	        UC              	2        	0   	vnic1
10.37.129.2        	0:1c:42:0:0:9      	UHLWIi        	1        	2     	lo0
10.37.129.255      	ff:ff:ff:ff:ff:ff  		UHLWbI        	0        	9   	vnic1
10.211.55/24       	link#8             	        UC              	2        	0   	vnic0
10.211.55.2        	0:1c:42:0:0:8      	UHLWIi     	        1        	2     	lo0
10.211.55.255      	ff:ff:ff:ff:ff:ff  		UHLWbI      	0        	9   	vnic0
127                	127.0.0.1          	        UCS             	0        	0     	lo0
127.0.0.1          	127.0.0.1          	UH              	1     	     5210   lo0
169.254            	link#5             	        UCS             	0        	0     	en1
192.168.10         	link#5             	        UCS             	2        	0     	en1
192.168.10.1       	68:ef:bd:9f:18:58  	UHLWIir            9       	20    en1   	1196
192.168.10.23      	127.0.0.1          	UHS             	0        	0     	lo0
192.168.10.255     	ff:ff:ff:ff:ff:ff  		UHLWbI            0        	9     	en1

Routing table on the client after connection:

bel-mac01:~ Manuel$ netstat -rn
Routing tables

Internet:
Destination        Gateway                        Flags        Refs      Use   Netif Expire
default            192.168.1.250                 UGSc           66        0     en0
10.37.129/24       link#9                         UC              2        0   vnic1
10.37.129.2        0:1c:42:0:0:9               UHLWIi         1        2     lo0
10.37.129.255      ff:ff:ff:ff:ff:ff               UHLWbI        0        1   vnic1
10.211.55/24       link#8                        UC                2        0   vnic0
10.211.55.2        0:1c:42:0:0:8               UHLWIi         1        2     lo0
10.211.55.255      ff:ff:ff:ff:ff:ff               UHLWbI        0        1   vnic0
127                127.0.0.1                          UCS             0        0     lo0
127.0.0.1          127.0.0.1                       UH              3     2796     lo0
169.254            link#4                            UCS             0        0     en0
192.168.1          link#4                           UCS            15        0     en0
192.168.1.18       74:e2:f5:b3:17:d2       UHLWIi         0        0     en0    889
192.168.1.23       90:e6:ba:ec:e:a0         UHLWIi          0        0     en0   1174
192.168.1.30       30:f7:c5:55:72:be       UHLWIi          0       37     en0    168
192.168.1.33       ec:a8:6b:2f:fb:e0        UHLWIi          0        0     en0   1189
192.168.1.37       6c:f0:49:90:ea:90       UHLWIi          0        0     en0   1197
192.168.1.40       127.0.0.1                   UHS               0        1     lo0
192.168.1.52       0:1c:10:f8:8b:b0         UHLWIi          0        0     en0    700
192.168.1.130      0:15:5d:1:be:0           UHLWIi          0      283     en0   1200
192.168.1.131      28:6a:ba:1e:57:f3      UHLWIi           0        0     en0   1150
192.168.1.133      0:b0:d0:e4:a:c3          UHLWIi          0        0     en0    956
192.168.1.137      10:78:d2:2e:85:5c      UHLWIi          0        0     en0   1082
192.168.1.141      f4:6d:4:96:fa:17         UHLWIi          0        0     en0   1075
192.168.1.149      0:11:11:96:83:86       UHLWIi          0        0     en0   1174
192.168.1.250      54:75:d0:88:ff:be       UHLWIir        67       36     en0   1160
192.168.1.253      0:b:cd:cc:5f:76           UHLWIi          2      669     en0   1134
192.168.1.255      ff:ff:ff:ff:ff:ff  UHLWbI          0        1     en0

janjust

this is a bridged setup, but you're specifying

dev tap

you need to explicitly specify the tap device that is part of the bridge , e.g.

dev tap0

mbr661

Thank you Jen,

I changed the Tap to Tap0 on the server, and it still did not work.
Then I changed the client conf the same and it still did not work.
then I changed the server conf back to just Tap and kept the client conf as Tap0, but still did not work.

I can still connect to the server, but cannot reach anything on the other side of the VPN.

I just notice the default routes does not change when I connect to the VPN. it stays as 192.168.10.1, instead of changing to 192.168.1.250. I see this in the "System Preferences/network".

Do you think this is what is causing the problem?

mbr661

Sorry, typo on the previous post: it should read router instead of routes.

After connecting to the VPN server, when I look on the "System Preferences/Network" on my mac, I see:

The DNS server address changes to the correct one, from 192,168,10,1 to 192.168.1.130

The Tap0 interface takes on the correct IP address of 192.168.1.160

But, I noticed that the default router does not change, it stays as 192.168.10.1 instead of adopting 192.168.1.250

Could this be the problem?

Thanks

janjust

I'm not exactly sure how bridging works on FreeBSD, but how did you configure it? Are tools like 'brct' available? if so what does

brctl show br0

give?

mbr661

This has been solved, it was a simple mistake on my part. On /etc/rc.conf I had the wrong interface:

openvpn_enable="YES"
cloned_interfaces="bridge0 tap0"
ifconfig_bridge0="addm ed0 addm tap0"

Instead of ed0, I should have had bge0.

Thank you for your time and I hope this mistake and posts help someone else in the future.