Hello everybody, I am using as server OpenVPN 2.2.2 mips-linux installed on a Netgear 2200v3 router that has a modified firmware with openvpn inside. Here's my server configuration [code]dev ovpns dev-type tun dev-node /dev/tun0 proto tcp-server daemon writepid /var/run/openvpn_server.pid script-security 3 #secret /config/xxx/amod/openvpn/openvpn_server_static.key tls-server ca /config/xxx/amod/openvpn/ca.crt cert /config/xxx/amod/openvpn/server.crt key /config/xxx/amod/openvpn/server.key dh /config/xxx/amod/openvpn/dh1024.pem log /tmp/ovpnspipe status /var/log/openvpn_server_status.log 60 #local 192.168.0.1 lport 8080 ######################################## # You may touch these, but only # if you know what you are doing #ifconfig 10.76.0.1 10.76.0.2 server 10.76.0.0 255.255.255.0 push "route 192.168.0.0 255.255.255.0" #user nobody #group nobody nice 12 mute 3 suppress-timestamps keepalive 10 60 ping-timer-rem persist-tun persist-key float comp-lzo verb 5[/code] And here's my client one: [code]client dev tun proto tcp-client keepalive 10 60 ping-timer-rem persist-tun persist-key verb 5 tls-client ns-cert-type server ca ca.crt cert hawk.crt key hawk.key #ifconfig 10.76.0.2 10.76.0.1 remote MYIPADDRESS 8080 #route 192.168.0.0 255.255.255.0 10.76.0.1 comp-lzo[/code] I can establish successfully the connection with the server, I get the ip address 10.76.0.1 but then I cannot access to any pc in the remote lan 192.168.0.x. Can anybody help me? [code][/code] Here's the relevant part of server log: [code]OpenVPN 2.2.2 mips-linux [SSL] [LZO2] [EPOLL] [eurephia] built on Mar 19 2013 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts Diffie-Hellman initialized with 1024 bit key TLS-Auth MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ] Socket Buffers: R=[87380->131072] S=[16384->131072] TUN/TAP device ovpns opened TUN/TAP TX queue length set to 100 /sbin/ip link set dev ovpns up mtu 1500 /sbin/ip addr add dev ovpns local 10.76.0.1 peer 10.76.0.2 /sbin/ip route add 10.76.0.0/24 via 10.76.0.2 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ] nice 12 succeeded Listening for incoming TCP connection on [undef]:8080 TCPv4_SERVER link local (bound): [undef]:8080 TCPv4_SERVER link remote: [undef] MULTI: multi_init called, r=256 v=256 IFCONFIG POOL: base=10.76.0.4 size=62 MULTI: TCP INIT maxclients=1024 maxevents=1028 Initialization Sequence Completed MULTI: multi_create_instance called Re-using SSL/TLS context LZO compression initialized Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ] Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ] Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server' Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client' Local Options hash (VER=V4): 'c0103fa8' Expected Remote Options hash (VER=V4): '69109d17' TCP connection established with 2.159.205.139:47977 TCPv4_SERVER link local: [undef] TCPv4_SERVER link remote: 2.159.205.139:47977 R2.159.205.139:47977 TLS: Initial packet from 2.159.205.139:47977, sid=17e17023 068a2d2c [...] 2.159.205.139:47977 [hawk] Peer Connection Initiated with 2.159.205.139:47977 hawk/2.159.205.139:47977 MULTI: Learn: 10.76.0.6 -> hawk/2.159.205.139:47977 hawk/2.159.205.139:47977 MULTI: primary virtual IP for hawk/2.159.205.139:47977: 10.76.0.6 Rhawk/2.159.205.139:47977 PUSH: Received control message: 'PUSH_REQUEST' hawk/2.159.205.139:47977 SENT CONTROL [hawk]: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,route 10.76.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.76.0.6 10.76.0.5' (status=1) hawk/2.159.205.139:47977 IPv6 in tun mode is not supported in OpenVPN 2.2[/code] And here's the client one: [code]Sat Jun 01 19:51:20 2013 us=520299 Attempting to establish TCP connection with [AF_INET]151.51.138.129:8080 Sat Jun 01 19:51:20 2013 us=520299 MANAGEMENT: >STATE:1370109080,TCP_CONNECT,,, Sat Jun 01 19:51:20 2013 us=904731 TCP connection established with [AF_INET]151.51.138.129:8080 Sat Jun 01 19:51:20 2013 us=904731 TCPv4_CLIENT link local: [undef] Sat Jun 01 19:51:20 2013 us=904731 TCPv4_CLIENT link remote: [AF_INET]151.51.138.129:8080 Sat Jun 01 19:51:20 2013 us=904731 MANAGEMENT: >STATE:1370109080,WAIT,,, Sat Jun 01 19:51:21 2013 us=359145 MANAGEMENT: >STATE:1370109081,AUTH,,, Sat Jun 01 19:51:21 2013 us=359145 TLS: Initial packet from [AF_INET]151.51.138.129:8080, sid=0001fb5b c7b53a83 [...] Sat Jun 01 19:51:30 2013 us=403014 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key Sat Jun 01 19:51:30 2013 us=403014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Sat Jun 01 19:51:30 2013 us=403014 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key Sat Jun 01 19:51:30 2013 us=403014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Sat Jun 01 19:51:30 2013 us=404022 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA Sat Jun 01 19:51:30 2013 us=404022 [server] Peer Connection Initiated with [AF_INET]151.51.138.129:8080 Sat Jun 01 19:51:31 2013 us=601050 MANAGEMENT: >STATE:1370109091,GET_CONFIG,,, Sat Jun 01 19:51:32 2013 us=798188 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1) Sat Jun 01 19:51:33 2013 us=183147 PUSH: Received control message: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,route 10.76.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.76.0.6 10.76.0.5' Sat Jun 01 19:51:33 2013 us=183147 OPTIONS IMPORT: timers and/or timeouts modified Sat Jun 01 19:51:33 2013 us=183147 OPTIONS IMPORT: --ifconfig/up options modified Sat Jun 01 19:51:33 2013 us=183147 OPTIONS IMPORT: route options modified Sat Jun 01 19:51:33 2013 us=199472 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Sat Jun 01 19:51:33 2013 us=199472 MANAGEMENT: >STATE:1370109093,ASSIGN_IP,,10.76.0.6, Sat Jun 01 19:51:33 2013 us=199472 open_tun, tt->ipv6=0 Sat Jun 01 19:51:33 2013 us=202474 TAP-WIN32 device [Connessione alla rete locale (LAN)] opened: \\.\Global\{532DCA60-08F2-41D6-B14F-E9A018D52321}.tap Sat Jun 01 19:51:33 2013 us=202474 TAP-Windows Driver Version 9.9 Sat Jun 01 19:51:33 2013 us=202474 TAP-Windows MTU=1500 Sat Jun 01 19:51:33 2013 us=215028 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.76.0.6/255.255.255.252 on interface {532DCA60-08F2-41D6-B14F-E9A018D52321} [DHCP-serv: 10.76.0.5, lease-time: 31536000] Sat Jun 01 19:51:33 2013 us=215028 Successful ARP Flush on interface [33] {532DCA60-08F2-41D6-B14F-E9A018D52321} Sat Jun 01 19:51:38 2013 us=544038 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up Sat Jun 01 19:51:38 2013 us=544038 MANAGEMENT: >STATE:1370109098,ADD_ROUTES,,, Sat Jun 01 19:51:38 2013 us=544038 C:\windows\system32\route.exe ADD 192.168.0.0 MASK 255.255.255.0 10.76.0.5 Sat Jun 01 19:51:38 2013 us=552690 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4 Sat Jun 01 19:51:38 2013 us=552690 Route addition via IPAPI succeeded [adaptive] Sat Jun 01 19:51:38 2013 us=552690 C:\windows\system32\route.exe ADD 10.76.0.1 MASK 255.255.255.255 10.76.0.5 Sat Jun 01 19:51:38 2013 us=559922 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4 Sat Jun 01 19:51:38 2013 us=559922 Route addition via IPAPI succeeded [adaptive] Sat Jun 01 19:51:38 2013 us=559922 Initialization Sequence Completed Sat Jun 01 19:51:38 2013 us=559922 MANAGEMENT: >STATE:1370109098,CONNECTED,SUCCESS,10.76.0.6,151.51.138.129[/code]

sounds like a routing issue to me; from the client, can you [list][*]ping 172.160.1 [*]ping the LAN IP of the VPN server [*]check that IP forwarding is enabled on the VPN server (router): [code]cat /proc/sys/net/ipv4/ip_forward[/code][/list]

Connectio established but I can't access remote lan pc's

hardhu

Hello everybody,
I am using as server OpenVPN 2.2.2 mips-linux installed on a Netgear 2200v3 router that has a modified firmware with openvpn inside.

Here's my server configuration

dev ovpns
dev-type tun
dev-node /dev/tun0
proto tcp-server
daemon
writepid /var/run/openvpn_server.pid
script-security 3
#secret /config/xxx/amod/openvpn/openvpn_server_static.key
tls-server
ca /config/xxx/amod/openvpn/ca.crt
cert /config/xxx/amod/openvpn/server.crt
key /config/xxx/amod/openvpn/server.key
dh /config/xxx/amod/openvpn/dh1024.pem

log /tmp/ovpnspipe
status /var/log/openvpn_server_status.log 60

#local 192.168.0.1
lport 8080

########################################
# You may touch these, but only
# if you know what you are doing

#ifconfig 10.76.0.1 10.76.0.2
server 10.76.0.0 255.255.255.0
push "route 192.168.0.0 255.255.255.0"
#user nobody
#group nobody

nice 12
mute 3
suppress-timestamps

keepalive 10 60
ping-timer-rem
persist-tun
persist-key
float

comp-lzo
verb 5

And here's my client one:

client
dev tun
proto tcp-client
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
verb 5
tls-client
ns-cert-type server
ca ca.crt
cert hawk.crt
key hawk.key
#ifconfig 10.76.0.2 10.76.0.1
remote MYIPADDRESS 8080
#route 192.168.0.0 255.255.255.0 10.76.0.1
comp-lzo

I can establish successfully the connection with the server, I get the ip address 10.76.0.1 but then I cannot access to any pc in the remote lan 192.168.0.x.
Can anybody help me?

Here's the relevant part of server log:

OpenVPN 2.2.2 mips-linux [SSL] [LZO2] [EPOLL] [eurephia] built on Mar 19 2013
NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Diffie-Hellman initialized with 1024 bit key
TLS-Auth MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Socket Buffers: R=[87380->131072] S=[16384->131072]
TUN/TAP device ovpns opened
TUN/TAP TX queue length set to 100
/sbin/ip link set dev ovpns up mtu 1500
/sbin/ip addr add dev ovpns local 10.76.0.1 peer 10.76.0.2
/sbin/ip route add 10.76.0.0/24 via 10.76.0.2
Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
nice 12 succeeded
Listening for incoming TCP connection on [undef]:8080
TCPv4_SERVER link local (bound): [undef]:8080
TCPv4_SERVER link remote: [undef]
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL: base=10.76.0.4 size=62
MULTI: TCP INIT maxclients=1024 maxevents=1028
Initialization Sequence Completed
MULTI: multi_create_instance called
Re-using SSL/TLS context
LZO compression initialized
Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Local Options hash (VER=V4): 'c0103fa8'
Expected Remote Options hash (VER=V4): '69109d17'
TCP connection established with 2.159.205.139:47977
TCPv4_SERVER link local: [undef]
TCPv4_SERVER link remote: 2.159.205.139:47977
R2.159.205.139:47977 TLS: Initial packet from 2.159.205.139:47977, sid=17e17023 068a2d2c
[...]
2.159.205.139:47977 [hawk] Peer Connection Initiated with 2.159.205.139:47977
hawk/2.159.205.139:47977 MULTI: Learn: 10.76.0.6 -> hawk/2.159.205.139:47977
hawk/2.159.205.139:47977 MULTI: primary virtual IP for hawk/2.159.205.139:47977: 10.76.0.6
Rhawk/2.159.205.139:47977 PUSH: Received control message: 'PUSH_REQUEST'
hawk/2.159.205.139:47977 SENT CONTROL [hawk]: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,route 10.76.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.76.0.6 10.76.0.5' (status=1)
hawk/2.159.205.139:47977 IPv6 in tun mode is not supported in OpenVPN 2.2

And here's the client one:

Sat Jun 01 19:51:20 2013 us=520299 Attempting to establish TCP connection with [AF_INET]151.51.138.129:8080
Sat Jun 01 19:51:20 2013 us=520299 MANAGEMENT: >STATE:1370109080,TCP_CONNECT,,,
Sat Jun 01 19:51:20 2013 us=904731 TCP connection established with [AF_INET]151.51.138.129:8080
Sat Jun 01 19:51:20 2013 us=904731 TCPv4_CLIENT link local: [undef]
Sat Jun 01 19:51:20 2013 us=904731 TCPv4_CLIENT link remote: [AF_INET]151.51.138.129:8080
Sat Jun 01 19:51:20 2013 us=904731 MANAGEMENT: >STATE:1370109080,WAIT,,,
Sat Jun 01 19:51:21 2013 us=359145 MANAGEMENT: >STATE:1370109081,AUTH,,,
Sat Jun 01 19:51:21 2013 us=359145 TLS: Initial packet from [AF_INET]151.51.138.129:8080, sid=0001fb5b c7b53a83
[...]
Sat Jun 01 19:51:30 2013 us=403014 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Jun 01 19:51:30 2013 us=403014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Jun 01 19:51:30 2013 us=403014 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Jun 01 19:51:30 2013 us=403014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Jun 01 19:51:30 2013 us=404022 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sat Jun 01 19:51:30 2013 us=404022 [server] Peer Connection Initiated with [AF_INET]151.51.138.129:8080
Sat Jun 01 19:51:31 2013 us=601050 MANAGEMENT: >STATE:1370109091,GET_CONFIG,,,
Sat Jun 01 19:51:32 2013 us=798188 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Jun 01 19:51:33 2013 us=183147 PUSH: Received control message: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,route 10.76.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.76.0.6 10.76.0.5'
Sat Jun 01 19:51:33 2013 us=183147 OPTIONS IMPORT: timers and/or timeouts modified
Sat Jun 01 19:51:33 2013 us=183147 OPTIONS IMPORT: --ifconfig/up options modified
Sat Jun 01 19:51:33 2013 us=183147 OPTIONS IMPORT: route options modified
Sat Jun 01 19:51:33 2013 us=199472 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Jun 01 19:51:33 2013 us=199472 MANAGEMENT: >STATE:1370109093,ASSIGN_IP,,10.76.0.6,
Sat Jun 01 19:51:33 2013 us=199472 open_tun, tt->ipv6=0
Sat Jun 01 19:51:33 2013 us=202474 TAP-WIN32 device [Connessione alla rete locale (LAN)] opened: \\.\Global\{532DCA60-08F2-41D6-B14F-E9A018D52321}.tap
Sat Jun 01 19:51:33 2013 us=202474 TAP-Windows Driver Version 9.9 
Sat Jun 01 19:51:33 2013 us=202474 TAP-Windows MTU=1500
Sat Jun 01 19:51:33 2013 us=215028 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.76.0.6/255.255.255.252 on interface {532DCA60-08F2-41D6-B14F-E9A018D52321} [DHCP-serv: 10.76.0.5, lease-time: 31536000]
Sat Jun 01 19:51:33 2013 us=215028 Successful ARP Flush on interface [33] {532DCA60-08F2-41D6-B14F-E9A018D52321}
Sat Jun 01 19:51:38 2013 us=544038 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Sat Jun 01 19:51:38 2013 us=544038 MANAGEMENT: >STATE:1370109098,ADD_ROUTES,,,
Sat Jun 01 19:51:38 2013 us=544038 C:\windows\system32\route.exe ADD 192.168.0.0 MASK 255.255.255.0 10.76.0.5
Sat Jun 01 19:51:38 2013 us=552690 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sat Jun 01 19:51:38 2013 us=552690 Route addition via IPAPI succeeded [adaptive]
Sat Jun 01 19:51:38 2013 us=552690 C:\windows\system32\route.exe ADD 10.76.0.1 MASK 255.255.255.255 10.76.0.5
Sat Jun 01 19:51:38 2013 us=559922 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sat Jun 01 19:51:38 2013 us=559922 Route addition via IPAPI succeeded [adaptive]
Sat Jun 01 19:51:38 2013 us=559922 Initialization Sequence Completed
Sat Jun 01 19:51:38 2013 us=559922 MANAGEMENT: >STATE:1370109098,CONNECTED,SUCCESS,10.76.0.6,151.51.138.129

janjust

sounds like a routing issue to me; from the client, can you

ping 172.160.1
ping the LAN IP of the VPN server

check that IP forwarding is enabled on the VPN server (router):

cat /proc/sys/net/ipv4/ip_forward