[SOLVED] Routing back to vpn client

undefinedfunc

Hi All,

I am conducting a R&D project and have a OpenVPN server configured on centos as follows:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.0.0 255.255.255.0"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
client-to-client
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 3

I have a windows client connected as follows:

client
dev tun
proto udp
remote <host> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
comp-lzo
verb 3

(I know about using 192.168.0 as my internal network IP, that will get changed.)

The server's internal LAN ip is 192.168.0.200.
The Clients VPN IP is 10.8.0.6

I have a second machine in my internal network on IP of 192.168.0.2 (Windows)

My goal is simple: Connect to the client on 10.8.0.6 from machine 192.168.0.2

Could somebody point me in the direction of some resources or provide tips on how this can be achieved? Clients will be a mixture of linux and windows.

Routing/networking isn't my every day business (programming is) so I'm not entirely sure where I need to be looking.

Thanks!

janjust

can the client reach the VPN IP of the server? can it reach the LAN address of the server, i.e. what does

ping 192.168.0.200

return (from the VPN client).

Next, is routing enabled on the VPN server? can the client reach the machine 192.168.0.2 using ping? if not, what error is produced?

undefinedfunc

Hi,

Thanks for your reply.

I am sorry, I made a small error, the VPN host is not 192.168.0.200 but 192.168.0.252

Yes the client can talk to the internal network and vpn server. Traceroutes and Ping's below.
Internal LAN Machine PING

C:\Users\Adam>ping 192.168.0.254 -n 10

Ping statistics for 192.168.0.254:
    Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 172ms, Maximum = 315ms, Average = 223ms

Internal LAN Machine Tracert

C:\Users\Adam>tracert 192.168.0.254

Tracing route to 192.168.0.254 over a maximum of 30 hops

  1   193 ms   220 ms   211 ms  10.8.0.1
  2   233 ms   233 ms   237 ms  192.168.0.254

Trace complete.

VPN Server IP ping

C:\Users\Adam>ping 10.8.0.1 -n 10

Ping statistics for 10.8.0.1:
    Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 185ms, Maximum = 327ms, Average = 211ms

VPN Server Tracert

C:\Users\Adam>tracert 10.8.0.1

Tracing route to 10.8.0.1 over a maximum of 30 hops

  1   289 ms   254 ms   295 ms  10.8.0.1

Trace complete.

Internal Lan VPN Server NIC Tracert

C:\Users\Adam>ping 192.168.0.252 -n 10

Ping statistics for 192.168.0.252:
    Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 112ms, Maximum = 167ms, Average = 140ms

Internal Lan VPN Server NIC Ping

C:\Users\Adam>tracert 192.168.0.252

Tracing route to 192.168.0.252 over a maximum of 30 hops

  1   144 ms   224 ms   135 ms  192.168.0.252

Trace complete.

these where taken with the VPN client connected over a mifi dongle, so connecting in from an external network, not connecting to the VPN server on the same LAN

One thing I noticed was that the host 192.168.0.254 has an FTP server to it, if I open a connection from the VPN client to that server the connection comes 192.168.0.252 (the VPN server IP, not the vpn client IP) but I'm guessing this is down to configuration of the server.

I can open RDP connections and browse network shares over the VPN connection (so I can RDP to 192.168.0.2 / 192.168.0.254 and browse their shares)

undefinedfunc

Also, on a slight side topic, does your book cover the kind of setup's I've described? I'm a little new to this (I'm not entirely sure on the different between TUN/TAP routed/bridged for example) so i'm wondering if a book like that would be a good starting point to learn those differences and then I can have a better understanding on how to get the setup I want.

janjust

so can the LAN PC now reach the VPN client?

about the book: yes this kind of setup is covered (to some extent).

undefinedfunc

No. Only the VPN client can connect to machines in the network. The machines in the network, can't connect to VPN Clients

If I try to ping 10.8.0.6 from my Windows machine (192.168.0.254) this is the result:

C:\Users\Adam>tracert 10.8.0.6

Tracing route to 10.8.0.6 over a maximum of 30 hops

  1     *        *        *     Request timed out.
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4     *        *        *     Request timed out.
  5     *        *        *     Request timed out.
  6     *     ^C
C:\Users\Adam>ping 10.8.0.6

Pinging 10.8.0.6 with 32 bytes of data:
Request timed out.

Ping statistics for 10.8.0.6:
    Packets: Sent = 1, Received = 0, Lost = 1 (100% loss),

C:\Users\Adam>

from the server, I can reach 10.8.0.6 and make connections to it

I'm guessing there needs to be some kind of routing/gateway configuration in my windows box so it knows where to route 10.8.0.6 to?

undefinedfunc

I must have missed something obvious somewhere along the lines.

After my last reply I realised I need to use route ADD and add the route to the system. Once that was done specifying the router for that route was the IP of VPN server lan, I can connect to them perfectly.

I'm gonna go ahead and grab a copy of your book as this can be quite powerful for us now.

Thanks for your time!

janjust

Excellent news! Closing topic.