Hello,
first, I would like to apology for my english. I have openvpn server installed on ubuntu 12 - ethernet bridge mode. It seems to be that the server is working fine. It create the tap interface and it´s listening on port 1194. The client can ping the server. The client get the IP address from a server range, tap interface is created, but when the client get the VPN IP address then it cant ping the server, but it can ping the getway 10.0.88.1 (it is no getway from VPN but getway on the location). On the server is no firewall, the client is running on virtual machine ubuntu 12 (main system on the client PC is win 7). The client is behind the NAT. I suspect the route table on the client is wrong. The subnet on server side is 192.168.55.0/24, the range on client side is 10.0.88.0/24. In ubuntu is ip 10.0.2.0/24 because of NAT mode for virtual machine.
config for server
management 127.0.0.1 7505
port 1194
proto udp
server-bridge 192.168.55.12 255.255.255.0 192.168.55.110 192.168.55.150
script-security 3 #nutno zadat aby se mohl spustit script up.sh down.sh
dev tap #interface pro ethernet bridge mod
ca ca.crt
cert server.crt
tun-mtu 1400 #dodatecna autentizace TLS
key server.key
dh dh1024.pem
tls-auth ta.key 0
up "/etc/openvpn/up.sh br0 tap0 1500"
down "/etc/openvpn/down.sh br0 tap0"
ifconfig-pool-persist ipp.txt
keepalive 10 60
comp-lzo
persist-key
persist-tun
verb 3
mute 20
status openvpn-status.log
;client-config-dir ccd
client-to-client
=================================
route table for server
root@david-nbubun:/home/david# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.55.1 0.0.0.0 UG 0 0 0 br0
169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 br0
192.168.55.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
====================
firewall for server - when i use the the firewall settings according to HOWTO manual then the situation is same
root@david-nbubun:/home/david# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
=========================
log from the server
May 23 14:16:03 david-nbubun ovpn-server[6050]: OpenVPN 2.2.1 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Oct 8 2012
May 23 14:16:03 david-nbubun ovpn-server[6050]: MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:7505
May 23 14:16:03 david-nbubun ovpn-server[6050]: NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
May 23 14:16:03 david-nbubun ovpn-server[6050]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
May 23 14:16:03 david-nbubun ovpn-server[6050]: Diffie-Hellman initialized with 1024 bit key
May 23 14:16:03 david-nbubun ovpn-server[6050]: Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
May 23 14:16:03 david-nbubun ovpn-server[6050]: Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
May 23 14:16:03 david-nbubun ovpn-server[6050]: Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
May 23 14:16:03 david-nbubun ovpn-server[6050]: WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
May 23 14:16:03 david-nbubun ovpn-server[6050]: TLS-Auth MTU parms [ L:1474 D:166 EF:66 EB:0 ET:0 EL:0 ]
May 23 14:16:03 david-nbubun ovpn-server[6050]: Socket Buffers: R=[163840->131072] S=[163840->131072]
May 23 14:16:03 david-nbubun ovpn-server[6050]: TUN/TAP device tap0 opened
May 23 14:16:03 david-nbubun ovpn-server[6050]: TUN/TAP TX queue length set to 100
May 23 14:16:03 david-nbubun ovpn-server[6050]: /etc/openvpn/up.sh br0 tap0 1500 tap0 1400 1474 init
May 23 14:16:03 david-nbubun ovpn-server[6050]: Data Channel MTU parms [ L:1474 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
May 23 14:16:03 david-nbubun ovpn-server[6065]: UDPv4 link local (bound): [undef]
May 23 14:16:03 david-nbubun ovpn-server[6065]: UDPv4 link remote: [undef]
May 23 14:16:03 david-nbubun ovpn-server[6065]: MULTI: multi_init called, r=256 v=256
May 23 14:16:03 david-nbubun ovpn-server[6065]: IFCONFIG POOL: base=192.168.55.110 size=41, ipv6=0
May 23 14:16:03 david-nbubun ovpn-server[6065]: ifconfig_pool_read(), in='client2,192.168.55.110', TODO: IPv6
May 23 14:16:03 david-nbubun ovpn-server[6065]: succeeded -> ifconfig_pool_set()
May 23 14:16:03 david-nbubun ovpn-server[6065]: ifconfig_pool_read(), in='client1,192.168.55.111', TODO: IPv6
May 23 14:16:03 david-nbubun ovpn-server[6065]: succeeded -> ifconfig_pool_set()
May 23 14:16:03 david-nbubun ovpn-server[6065]: IFCONFIG POOL LIST
May 23 14:16:03 david-nbubun ovpn-server[6065]: client2,192.168.55.110
May 23 14:16:03 david-nbubun ovpn-server[6065]: client1,192.168.55.111
May 23 14:16:03 david-nbubun ovpn-server[6065]: Initialization Sequence Completed
May 23 14:16:27 david-nbubun ovpn-server[6065]: MANAGEMENT: Client connected from [AF_INET]127.0.0.1:7505
May 23 14:16:31 david-nbubun ovpn-server[6065]: MULTI: multi_create_instance called
May 23 14:16:31 david-nbubun ovpn-server[6065]: 10.0.88.12:53436 Re-using SSL/TLS context
May 23 14:16:31 david-nbubun ovpn-server[6065]: 10.0.88.12:53436 LZO compression initialized
May 23 14:16:31 david-nbubun ovpn-server[6065]: 10.0.88.12:53436 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
May 23 14:16:31 david-nbubun ovpn-server[6065]: 10.0.88.12:53436 Control Channel MTU parms [ L:1474 D:166 EF:66 EB:0 ET:0 EL:0 ]
May 23 14:16:31 david-nbubun ovpn-server[6065]: 10.0.88.12:53436 Data Channel MTU parms [ L:1474 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
May 23 14:16:31 david-nbubun ovpn-server[6065]: 10.0.88.12:53436 Local Options hash (VER=V4): 'a6e8344b'
May 23 14:16:31 david-nbubun ovpn-server[6065]: 10.0.88.12:53436 Expected Remote Options hash (VER=V4): 'd185e991'
May 23 14:16:31 david-nbubun ovpn-server[6065]: 10.0.88.12:53436 TLS: Initial packet from [AF_INET]10.0.88.12:53436, sid=1dd617d7 a03812b8
May 23 14:16:31 david-nbubun ovpn-server[6065]: 10.0.88.12:53436 VERIFY OK: depth=1, /C=CR/ST=CR/L=MoravskyKrumlov/O=CertAutorita/OU=changeme/CN=openVPN-CA/name=changeme/emailAddress=david.malysz@jednotamk.cz
May 23 14:16:31 david-nbubun ovpn-server[6065]: 10.0.88.12:53436 VERIFY OK: depth=0, /C=CR/ST=CR/L=MoravskyKrumlov/O=CertAutorita/OU=changeme/CN=client1/name=changeme/emailAddress=david.malysz@jednotamk.cz
May 23 14:16:31 david-nbubun ovpn-server[6065]: 10.0.88.12:53436 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
May 23 14:16:31 david-nbubun ovpn-server[6065]: 10.0.88.12:53436 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
May 23 14:16:31 david-nbubun ovpn-server[6065]: 10.0.88.12:53436 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
May 23 14:16:31 david-nbubun ovpn-server[6065]: 10.0.88.12:53436 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
May 23 14:16:31 david-nbubun ovpn-server[6065]: 10.0.88.12:53436 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
May 23 14:16:31 david-nbubun ovpn-server[6065]: 10.0.88.12:53436 [client1] Peer Connection Initiated with [AF_INET]10.0.88.12:53436
May 23 14:16:31 david-nbubun ovpn-server[6065]: client1/10.0.88.12:53436 MULTI_sva: pool returned IPv4=192.168.55.111, IPv6=146a:76b7:240a:8cbf:80d:8cbf:88fc:2fb9
May 23 14:16:33 david-nbubun ovpn-server[6065]: client1/10.0.88.12:53436 PUSH: Received control message: 'PUSH_REQUEST'
May 23 14:16:33 david-nbubun ovpn-server[6065]: client1/10.0.88.12:53436 send_push_reply(): safe_cap=960
May 23 14:16:33 david-nbubun ovpn-server[6065]: client1/10.0.88.12:53436 SENT CONTROL [client1]: 'PUSH_REPLY,route-gateway 192.168.55.12,ping 10,ping-restart 60,ifconfi:
May 23 14:18:33 david-nbubun ovpn-server[6065]: client1/10.0.88.12:53436 [client1] Inactivity timeout (--ping-restart), restarting
May 23 1May 23 14:18:33 david-nbubun ovpn-server[6065]: client1/10.0.88.12:53436 [client1] Inactivity timeout (--ping-restart), restarting
May 23 14:18:33 david-nbubun ovpn-server[6065]: client1/10.0.88.12:53436 SIGUSR1[soft,ping-restart] received, client-instance restarting
4:18:33 david-nbubun ovpn-server[6065]: client1/10.0.88.12:53436 SIGUSR1[soft,ping-restart] received, client-instance restarting
====================
log from server openvpn console
status
OpenVPN CLIENT LIST
Updated,Fri May 24 12:27:37 2013
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
client1,10.0.88.12:50256,6540,19924,Fri May 24 12:25:50 2013
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
GLOBAL STATS
Max bcast/mcast queue length,1
END
======================
log from the client
May 21 13:32:14 david-VirtualBox ovpn-client[3121]: OpenVPN 2.2.1 i686-linux-gnu
[SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424
-2 (2.2RC2)] built on Oct 8 2012
May 21 13:32:14 david-VirtualBox ovpn-client[3121]: WARNING: No server certifica
te verification method has been enabled. See http://openvpn.net/howto.html#mitm
for more info.
May 21 13:32:14 david-VirtualBox ovpn-client[3121]: NOTE: OpenVPN 2.1 requires '
--script-security 2' or higher to call user-defined scripts or executables
May 21 13:32:17 david-VirtualBox ovpn-client[3121]: WARNING: this configuration
may cache passwords in memory -- use the auth-nocache option to prevent this
May 21 13:32:17 david-VirtualBox ovpn-client[3121]: LZO compression initialized
May 21 13:32:17 david-VirtualBox ovpn-client[3121]: WARNING: normally if you use
--mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is
1400)
May 21 13:32:17 david-VirtualBox ovpn-client[3121]: Control Channel MTU parms [
L:1474 D:138 EF:38 EB:0 ET:0 EL:0 ]
May 21 13:32:17 david-VirtualBox ovpn-client[3121]: Socket Buffers: R=[163840->1
31072] S=[163840->131072]
May 21 13:32:17 david-VirtualBox ovpn-client[3121]: Data Channel MTU parms [ L:1
474 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
May 21 13:32:17 david-VirtualBox ovpn-client[3121]: Local Options hash (VER=V4):
'c7d68c77'
May 21 13:32:17 david-VirtualBox ovpn-client[3121]: Expected Remote Options hash
(VER=V4): '34f45a4a'
May 21 13:32:17 david-VirtualBox ovpn-client[3122]: UDPv4 link local: [undef]
May 21 13:32:17 david-VirtualBox ovpn-client[3122]: UDPv4 link remote: [AF_INET]
192.168.55.12:1194
May 21 13:32:17 david-VirtualBox ovpn-client[3122]: TLS: Initial packet from [AF
_INET]192.168.55.12:1194, sid=1fba605e 3e9f36eb
May 21 13:32:17 david-VirtualBox ovpn-client[3122]: VERIFY OK: depth=1, /C=CR/ST
=CR/L=MoravskzKrumlov/O=CertAutorita/OU=changeme/CN=changeme/name=changeme/email
Address=mail@host.domain
May 21 13:32:17 david-VirtualBox ovpn-client[3122]: VERIFY OK: depth=0, /C=CR/ST
=CR/L=MoravskzKrumlov/O=CertAutorita/OU=changeme/CN=changeme/name=changeme/email
Address=mail@host.domain
May 21 13:32:17 david-VirtualBox ovpn-client[3122]: Data Channel Encrypt: Cipher
'BF-CBC' initialized with 128 bit key
May 21 13:32:17 david-VirtualBox ovpn-client[3122]: Data Channel Encrypt: Using
160 bit message hash 'SHA1' for HMAC authentication
May 21 13:32:17 david-VirtualBox ovpn-client[3122]: Data Channel Decrypt: Cipher
'BF-CBC' initialized with 128 bit key
May 21 13:32:17 david-VirtualBox ovpn-client[3122]: Data Channel Decrypt: Using
160 bit message hash 'SHA1' for HMAC authentication
May 21 13:32:17 david-VirtualBox ovpn-client[3122]: Control Channel: TLSv1, ciph
er TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
May 21 13:32:17 david-VirtualBox ovpn-client[3122]: [changeme] Peer Connection I
nitiated with [AF_INET]192.168.55.12:1194
May 21 13:32:20 david-VirtualBox ovpn-client[3122]: SENT CONTROL [changeme]: 'PU
SH_REQUEST' (status=1)
May 21 13:32:20 david-VirtualBox ovpn-client[3122]: PUSH: Received control messa
ge: 'PUSH_REPLY,route-gateway 192.168.55.12,ping 10,ping-restart 600,ifconfig 19
2.168.55.110 255.255.255.0'
May 21 13:32:20 david-VirtualBox ovpn-client[3122]: OPTIONS IMPORT: timers and/o
r timeouts modified
May 21 13:32:20 david-VirtualBox ovpn-client[3122]: OPTIONS IMPORT: --ifconfig/u
p options modified
May 21 13:32:20 david-VirtualBox ovpn-client[3122]: OPTIONS IMPORT: route-relate
d options modified
May 21 13:32:20 david-VirtualBox ovpn-client[3122]: WARNING: --remote address [1
92.168.55.12] conflicts with --ifconfig subnet [192.168.55.110, 255.255.255.0] -
- local and remote addresses cannot be inside of the --ifconfig subnet. (silence
this warning with --ifconfig-nowarn)
May 21 13:32:20 david-VirtualBox ovpn-client[3122]: TUN/TAP device tap0 opened
May 21 13:32:20 david-VirtualBox ovpn-client[3122]: TUN/TAP TX queue length set
to 100
May 21 13:32:20 david-VirtualBox ovpn-client[3122]: do_ifconfig, tt->ipv6=0, tt-
>did_ifconfig_ipv6_setup=0
May 21 13:32:20 david-VirtualBox ovpn-client[3122]: /sbin/ifconfig tap0 192.168.
55.110 netmask 255.255.255.0 mtu 1400 broadcast 192.168.55.255
May 21 13:32:20 david-VirtualBox ovpn-client[3122]: Initialization Sequence Comp
leted <<<<<<<<<<<<<<<<<<<<<<
May 21 13:32:23 david-VirtualBox ovpn-client[3122]: read UDPv4 [EHOSTUNREACH|EHO
STUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOST
UNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUN
REACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNR]
: No route to host (code=113)
May 21 13:32:26 david-VirtualBox ovpn-client[3122]: read UDPv4 [EHOSTUNREACH|EHO
STUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOST
UNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH]: No ro
ute to host (code=113) <<<<<<<<<<<<<<<<<
May 21 13:32:30 david-VirtualBox ovpn-client[3122]: read UDPv4 [EHOSTUNREACH|EHO
STUNREACH|EHOSTUNREACH|EHOSTUNREACH]: No route to host (code=113)
May 21 13:33:33 ovpn-client[3122]: last message repeated 6 times
May 21 13:34:34 ovpn-client[3122]: last message repeated 5 times
May 21 13:35:40 ovpn-client[3122]: last message repeated 5 times
May 21 13:35:40 david-VirtualBox ovpn-client[3122]: event_wait : Interrupted sys
tem call (code=4)
May 21 13:35:40 david-VirtualBox ovpn-client[3122]: TCP/UDP: Closing socket
May 21 13:35:40 david-VirtualBox ovpn-client[3122]: Closing TUN/TAP interface
May 21 13:35:40 david-VirtualBox ovpn-client[3122]: /sbin/ifconfig tap0 0.0.0.0
May 21 13:35:40 david-VirtualBox ovpn-client[3122]: SIGTERM[hard,] received, pro
cess exiting
==================
route table from the client when the vpn client is running
root@david-VirtualBox:/home/david# route -n
Směrovací tabulka v jádru pro IP
Adresát Brána Maska Přízn Metrik Odkaz Užt Rozhraní
0.0.0.0 10.0.2.2 0.0.0.0 UG 0 0 0 eth0
10.0.2.0 0.0.0.0 255.255.255.0 U 1 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 eth0
192.168.55.0 0.0.0.0 255.255.255.0 U 0 0 0 tap0
================
client configuration
client
dev tap
;dev tun
;dev-node MyTap
# Are we connecting to a TCP or
# UDP server? Use the same setting as
# on the server.
;proto tcp
proto udp
remote 192.168.55.12 1194
;remote my-server-2 1194
;remote-random
resolv-retry infinite
# Most clients don't need to bind to
# a specific local port number.
nobind
;user nobody
;group nogroup
persist-key
persist-tun
tun-mtu 1400
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
;mute-replay-warnings
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
tls-auth ta.key 1
;cipher x
comp-lzo
verb 3
mute 20
================
firewall on the client
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
When I use the TCP or UDP protocol there is no change, still no route to the server.
When I try to ping the server (when the vpn client is running) there is no outgoing traffic from the physical interface on PC (The whireshark in win 7 doesnt see any outgoing traffic from the interface).
Must I set up the route on the client or some additional configuration on client side is required?
Many thanks for any advice.
