We have configured an open VPN in a server to permit access to it from outside.
The vpn nerwork is 10.8.0.0 and the lan network is 192.168.19.0
All worked correctly, until we change the physical interface eth0 because it has been damaged.
The user can connect to vpn network and ping the server address :10.8.0.1, but it can't ping any machine in 192.168.19.0 or 192.168
How ever we stop iptables the problem persist.
The server configuration is :
server.conf:
ort 1194
proto udp
dev tun
ca ca.crt
cert seville.crt
key seville.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
#push "dhcp-option DNS 192.168.19.1"
#push "dhcp-option DNS 168.210.2.2"
#push "dhcp-option WINS 192.168.1.2"
push "route 192.168.19.0 255.255.255.0"
#ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
#user nobody
#group users
persist-key
persist-tun
status openvpn-status.log
verb 5
client-to-client
#duplicate-cn
The client conf is :
client
dev tun
proto udp
remote evision.dnsalias.net 1194
persist-key
persist-tun
ca ca.crt
cert faissalb2.crt
key faissalb2.key
comp-lzo
# Set log file verbosity.
verb 3
execute netstat -nr in server :
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.19.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
0.0.0.0 192.168.19.1 0.0.0.0 UG 0 0 0 eth0
execute ifconfig in server :
eth0 Link encap:Ethernet HWaddr 00:15:17:0C:F7:25
inet addr:192.168.19.18 Bcast:192.168.19.255 Mask:255.255.255.0
inet6 addr: fe80::215:17ff:fe0c:f725/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2316801 errors:0 dropped:0 overruns:0 frame:0
TX packets:1114278 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1184683835 (1.1 GiB) TX bytes:147250906 (140.4 MiB)
Base address:0xcc00 Memory:feae0000-feb00000
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:25 errors:0 dropped:0 overruns:0 frame:0
TX packets:32 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:1524 (1.4 KiB) TX bytes:2176 (2.1 KiB)
Logs from client machine are :
Mon May 06 18:44:01 2013 OpenVPN 2.0.9 Win32-MinGW [SSL] [LZO] built on Oct 1 2006
Mon May 06 18:44:01 2013 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA. OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Mon May 06 18:44:01 2013 WARNING: No server certificate verification method has been enabled. See
http://openvpn.net/howto.html#mitm for more info.
Mon May 06 18:44:01 2013 LZO compression initialized
Mon May 06 18:44:01 2013 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon May 06 18:44:01 2013 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon May 06 18:44:01 2013 Local Options hash (VER=V4): '41690919'
Mon May 06 18:44:01 2013 Expected Remote Options hash (VER=V4): '530fdded'
Mon May 06 18:44:01 2013 UDPv4 link local (bound): [undef]:1194
Mon May 06 18:44:01 2013 UDPv4 link remote: 41.140.221.101:1194
Mon May 06 18:44:01 2013 TLS: Initial packet from 41.140.221.101:1194, sid=ba6f7a70 466373bc
Mon May 06 18:44:02 2013 VERIFY OK: depth=1, /C=MA/ST=RA/L=Rabat/O=Strategum/CN=sevi ... rategum.ma
Mon May 06 18:44:02 2013 VERIFY OK: depth=0, /C=MA/ST=RA/L=Rabat/O=Strategum/OU=info ... rategum.ma
Mon May 06 18:44:03 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon May 06 18:44:03 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon May 06 18:44:03 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon May 06 18:44:03 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon May 06 18:44:03 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon May 06 18:44:03 2013 [seville] Peer Connection Initiated with 41.140.221.101:1194
Mon May 06 18:44:04 2013 SENT CONTROL [seville]: 'PUSH_REQUEST' (status=1)
Mon May 06 18:44:04 2013 PUSH: Received control message: 'PUSH_REPLY,route 192.168.19.0 255.255.255.0,route 10.8.0.0 255.255.255.0,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9'
Mon May 06 18:44:04 2013 OPTIONS IMPORT: timers and/or timeouts modified
Mon May 06 18:44:04 2013 OPTIONS IMPORT: --ifconfig/up options modified
Mon May 06 18:44:04 2013 OPTIONS IMPORT: route options modified
Mon May 06 18:44:04 2013 TAP-WIN32 device [Connexion au réseau local 6] opened: \\.\Global\{74521B25-40D3-4BD3-A744-849FE1BAE68D}.tap
Mon May 06 18:44:04 2013 TAP-Win32 Driver Version 8.4
Mon May 06 18:44:04 2013 TAP-Win32 MTU=1500
Mon May 06 18:44:04 2013 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.10/255.255.255.252 on interface {74521B25-40D3-4BD3-A744-849FE1BAE68D} [DHCP-serv: 10.8.0.9, lease-time: 31536000]
Mon May 06 18:44:04 2013 Successful ARP Flush on interface [65542] {74521B25-40D3-4BD3-A744-849FE1BAE68D}
Mon May 06 18:44:04 2013 TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Mon May 06 18:44:04 2013 Route: Waiting for TUN/TAP interface to come up...
Mon May 06 18:44:05 2013 TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Mon May 06 18:44:05 2013 Route: Waiting for TUN/TAP interface to come up...
Mon May 06 18:44:07 2013 TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Mon May 06 18:44:07 2013 Route: Waiting for TUN/TAP interface to come up...
Mon May 06 18:44:08 2013 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Mon May 06 18:44:08 2013 route ADD 192.168.19.0 MASK 255.255.255.0 10.8.0.9
Mon May 06 18:44:08 2013 Route addition via IPAPI succeeded
Mon May 06 18:44:08 2013 route ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.9
Mon May 06 18:44:08 2013 Route addition via IPAPI succeeded
Mon May 06 18:44:08 2013 Initialization Sequence Completed
Thanls for yor help.
