[Solved] RDP connection through VPN

gianluca

Hi to all. I'm new in this forum and first of all.. sorry for my english..

I need a little help configuring VPN to avoid an RDP connection to a MS WINDOWS SERVER.

in a few word, the connection to my openvpn server work fine. I can ping each othe machine in my lan. But i can't connect through RDP to my MS WIN server in LAN

Following my configuration file (server and client) and the output of iptables (filter - mangle - nat).

My LAN configuration:

VPN => server UBUNTU 12.04 - 2 eth (eth0 wan 130.xxx.xxx.2 - eth1 lan 100.1.1.123) iptables
DNS-DHCP-PROXY => server UBUNTU 12.04 - 2 eth (eth0 wan 94.xxx.xxx.150 - eth1 lan 100.1.1.120) iptables
MAIL SERVER => server UBUNTU 12.04 - 1 eth (eth0 lan 100.1.1.122)
MS WINDOWS SRV=> server Windows 2k3 1 lan 100.1.1.145

Thank's in advance to all

my server.conf

#SERVER CONFIG

local 130.xxx.xxx.2
port 1194
proto udp
dev tun0
ca certs/ca.crt
cert certs/server.crt
key keys/server.key
dh certs/dh1024.pem
server 100.1.3.0 255.255.255.0
tls-auth keys/tlsauth.pem
push "route 100.1.1.0 255.255.255.0"
push "redirect-gateway"
push "dhcp-option DNS 100.1.1.123"
keepalive 10 120
client-to-client
comp-lzo
max-clients 20
user nobody
group nogroup
persist-key
persist-tun
log openvpn.log
status openvpn-status.log
verb 3
mute 20

my client.ovpn

client
dev tun
proto udp
remote 130.xxx.xxx.2
resolv retry-infinite
nobind
persist-key
persist-tun
ca "ca.crt"
cert "myname.crt"
key "myname.crt"
tls-auth "tlsauth.pem"
ns-cert-type server
comp-lzo
verb3

my route-n

Kernel IP routing table
Destination        Gateway          Genmask            Flags Metric Ref    Use Iface
0.0.0.0             130.xxx.xxx.1     0.0.0.0              UG    100    0        0 eth0
100.1.1.0          0.0.0.0             255.255.255.0     U      0      0        0 eth1
100.1.3.0          100.1.3.2          255.255.255.0     UG    0      0        0 tun0
100.1.3.2          0.0.0.0             255.255.255.255  UH    0      0        0 tun0
130.xxx.xxx.0     0.0.0.0             255.255.255.252  U      0      0        0 eth0

my iptables -t filter -vnL

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
 2970  329K SRV-INPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT 559 packets, 74802 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 1086 packets, 208K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain LOG_DROP (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 LOG        tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp LOG flags 0 level 4

Chain SRV-INPUT (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
 2298  202K ACCEPT     all  --  eth1   *       0.0.0.0/0            0.0.0.0/0
   27  2026 ACCEPT     all  --  tun0   *       0.0.0.0/0            0.0.0.0/0
  631  124K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 255
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:20022 state NEW
    2   140 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:1194
   12   899 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

my iptables -t mangle -vnl

Chain PREROUTING (policy ACCEPT 3709 packets, 419K bytes)
 pkts bytes target     prot opt in     out     source               destination
 2527  224K MARK       all  --  eth1   *       0.0.0.0/0            0.0.0.0/0            MARK set 0x9
  269 47335 MARK       all  --  tun0   *       0.0.0.0/0            0.0.0.0/0            MARK set 0x7
    0     0 MARK       tcp  --  *      *       100.1.0.0/16         100.1.0.0/16         tcp spts:1024:65535 dpt:80 MARK set 0x8

Chain INPUT (policy ACCEPT 3048 packets, 335K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 559 packets, 74802 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 1114 packets, 212K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 1673 packets, 287K bytes)
 pkts bytes target     prot opt in     out     source               destination

my iptables -t nat -vnl

Chain PREROUTING (policy ACCEPT 376 packets, 47523 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain INPUT (policy ACCEPT 204 packets, 31068 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 15 packets, 906 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 15 packets, 906 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 MASQUERADE  all  --  *      *       0.0.0.0/0            0.0.0.0/0            mark match 0x9
   57  6268 MASQUERADE  all  --  *      *       0.0.0.0/0            0.0.0.0/0            mark match 0x7

gianluca

I also read and follow the troubleshooting flowchart for using the internet over VPN at this topic https://forums.openvpn.net/topic10923.html and..

1=> can youu ping the VPn ip of the server (in my case 100.1.3.1) => YES
2=> Is redirect-gateway enbled on client=> I think so... In server.conf i have push "redirect-gateway"
3=> can you ping 8.8.8.8 => YES
4=> can you ping google.com => YES
5=> does http://www.secure-computing.net/ip.php show your vpn server's Ip? => Well..No. i can't surf the web... :shock:

gianluca

HI debbie10t. Thank for reply.
As I say in my previous post, i can ping both 8.8.8.8 and google.com.

The test is made with Win8.

I think ( but i'm not sure...) can be a non correct configuration of iptables in the server.. But i can not understand where is the problem

Following:

my ipconfig -all

Configurazione IP di Windows

   Nome host . . . . . . . . . . . . . . : MGL-Spa
   Suffisso DNS primario . . . . . . . . : 
   Tipo nodo . . . . . . . . . . . . . . : Ibrido
   Routing IP abilitato. . . . . . . . . : No
   Proxy WINS abilitato . . . . . . . .  : No


Scheda LAN wireless Wi-Fi:

   Suffisso DNS specifico per connessione: 
   Descrizione . . . . . . . . . . . . . : Qualcomm Atheros AR9485 802.11b/g/n WiFi Adapter
   Indirizzo fisico. . . . . . . . . . . : 20-68-9D-99-51-EA
   DHCP abilitato. . . . . . . . . . . . : S
   Configurazione automatica abilitata   : S
   Indirizzo IPv6 locale rispetto al collegamento . : fe80::51eb:248e:8591:499f%31(Preferenziale) 
   Indirizzo IPv4. . . . . . . . . . . . : 192.168.1.107(Preferenziale) 
   Subnet mask . . . . . . . . . . . . . : 255.255.255.0
   Lease ottenuto. . . . . . . . . . . . : domenica 29 settembre 2013 10.21.48
   Scadenza lease . . . . . . . . . . .  : luned 30 settembre 2013 10.21.49
   Gateway predefinito . . . . . . . . . : 
   Server DHCP . . . . . . . . . . . . . : 192.168.1.1
   IAID DHCPv6 . . . . . . . . . . . : 488663197
   DUID Client DHCPv6. . . . . . . . : 00-01-00-01-17-FF-99-8E-84-34-97-77-C2-5B
   Server DNS . . . . . . . . . . . . .  : 192.168.1.1
   Server WINS primario . . . . . . . .  : 192.168.1.1
   Server WINS secondario . . . . . . .  : 192.168.1.1
   NetBIOS su TCP/IP . . . . . . . . . . : Attivato

Scheda Ethernet Connessione alla rete locale (LAN) 2:

   Suffisso DNS specifico per connessione: 
   Descrizione . . . . . . . . . . . . . : TAP-Win32 Adapter V9
   Indirizzo fisico. . . . . . . . . . . : 00-FF-D2-53-54-DC
   DHCP abilitato. . . . . . . . . . . . : S
   Configurazione automatica abilitata   : S
   Indirizzo IPv6 locale rispetto al collegamento . : fe80::45fc:5680:b09f:dca%19(Preferenziale) 
   Indirizzo IPv4. . . . . . . . . . . . : 100.1.3.6(Preferenziale) 
   Subnet mask . . . . . . . . . . . . . : 255.255.255.252
   Lease ottenuto. . . . . . . . . . . . : domenica 29 settembre 2013 10.30.57
   Scadenza lease . . . . . . . . . . .  : luned 29 settembre 2014 10.30.57
   Gateway predefinito . . . . . . . . . : 100.1.3.5
   Server DHCP . . . . . . . . . . . . . : 100.1.3.5
   IAID DHCPv6 . . . . . . . . . . . : 587268050
   DUID Client DHCPv6. . . . . . . . : 00-01-00-01-17-FF-99-8E-84-34-97-77-C2-5B
   Server DNS . . . . . . . . . . . . .  : 100.1.1.123
   NetBIOS su TCP/IP . . . . . . . . . . : Attivato


Scheda Tunnel 6TO4 Adapter:

   Suffisso DNS specifico per connessione: 
   Descrizione . . . . . . . . . . . . . : Scheda Microsoft 6to4
   Indirizzo fisico. . . . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP abilitato. . . . . . . . . . . . : No
   Configurazione automatica abilitata   : S
   Indirizzo IPv6 . . . . . . . . . . . . . . . . . : 2002:6401:306::6401:306(Preferenziale) 
   Gateway predefinito . . . . . . . . . : 
   Server DNS . . . . . . . . . . . . .  : 100.1.1.123
   NetBIOS su TCP/IP . . . . . . . . . . : Disattivato

my ping test

Esecuzione di Ping 8.8.8.8 con 32 byte di dati:
Risposta da 8.8.8.8: byte=32 durata=88ms TTL=47
Risposta da 8.8.8.8: byte=32 durata=91ms TTL=47
Risposta da 8.8.8.8: byte=32 durata=89ms TTL=47
Risposta da 8.8.8.8: byte=32 durata=88ms TTL=47

Statistiche Ping per 8.8.8.8:
    Pacchetti: Trasmessi = 4, Ricevuti = 4, 
    Persi = 0 (0% persi),
Tempo approssimativo percorsi andata/ritorno in millisecondi:
    Minimo = 88ms, Massimo =  91ms, Medio =  89ms

Esecuzione di Ping google.com [74.125.232.128] con 32 byte di dati:
Risposta da 74.125.232.128: byte=32 durata=79ms TTL=55
Risposta da 74.125.232.128: byte=32 durata=78ms TTL=55
Risposta da 74.125.232.128: byte=32 durata=79ms TTL=54
Risposta da 74.125.232.128: byte=32 durata=79ms TTL=54

Statistiche Ping per 74.125.232.128:
    Pacchetti: Trasmessi = 4, Ricevuti = 4, 
    Persi = 0 (0% persi),
Tempo approssimativo percorsi andata/ritorno in millisecondi:
    Minimo = 78ms, Massimo =  79ms, Medio =  78ms

my route print command in my client

===========================================================================
Elenco interfacce
 33...12 68 9d 99 51 ea ......Scheda virtuale Microsoft Wi-Fi Direct #6
 31...20 68 9d 99 51 ea ......Qualcomm Atheros AR9485 802.11b/g/n WiFi Adapter
 19...00 ff d2 53 54 dc ......TAP-Win32 Adapter V9
 12...84 34 97 77 c2 5b ......Realtek PCIe FE Family Controller
  1...........................Software Loopback Interface 1
 13...00 00 00 00 00 00 00 e0 Scheda Microsoft 6to4
 16...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
 18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
 34...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
===========================================================================

IPv4 Tabella route
===========================================================================
Route attive:
     Indirizzo rete             Mask          Gateway     Interfaccia Metrica
          0.0.0.0          0.0.0.0        100.1.3.5        100.1.3.6     30
        100.1.1.0    255.255.255.0        100.1.3.5        100.1.3.6     30
        100.1.3.0    255.255.255.0        100.1.3.5        100.1.3.6     30
        100.1.3.4  255.255.255.252         On-link         100.1.3.6    286
        100.1.3.6  255.255.255.255         On-link         100.1.3.6    286
        100.1.3.7  255.255.255.255         On-link         100.1.3.6    286
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
    130.xxx.xxx.2  255.255.255.255      192.168.1.1    192.168.1.107     25
      192.168.1.0    255.255.255.0         On-link     192.168.1.107    281
    192.168.1.107  255.255.255.255         On-link     192.168.1.107    281
    192.168.1.255  255.255.255.255         On-link     192.168.1.107    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         100.1.3.6    286
        224.0.0.0        240.0.0.0         On-link     192.168.1.107    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link         100.1.3.6    286
  255.255.255.255  255.255.255.255         On-link     192.168.1.107    281
===========================================================================
Route permanenti:
  Nessuna

IPv6 Tabella route
===========================================================================
Route attive:
 Interf Metrica Rete Destinazione      Gateway
  1    306 ::1/128                  On-link
 13   1040 2002::/16                On-link
 13    296 2002:6401:306::6401:306/128
                                    On-link
 19    286 fe80::/64                On-link
 31    281 fe80::/64                On-link
 19    286 fe80::45fc:5680:b09f:dca/128
                                    On-link
 31    281 fe80::51eb:248e:8591:499f/128
                                    On-link
  1    306 ff00::/8                 On-link
 19    286 ff00::/8                 On-link
 31    281 ff00::/8                 On-link
===========================================================================
Route permanenti:
  Nessuna

my client log

Sun Sep 29 10:30:39 2013 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Sun Sep 29 10:30:39 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sun Sep 29 10:30:39 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sun Sep 29 10:30:40 2013 Control Channel Authentication: using 'tlsauth.pem' as a OpenVPN static key file
Sun Sep 29 10:30:40 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Sep 29 10:30:40 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Sep 29 10:30:40 2013 LZO compression initialized
Sun Sep 29 10:30:40 2013 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Sun Sep 29 10:30:40 2013 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sun Sep 29 10:30:40 2013 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Sep 29 10:30:40 2013 Local Options hash (VER=V4): '02af3434'
Sun Sep 29 10:30:40 2013 Expected Remote Options hash (VER=V4): '3f08d474'
Sun Sep 29 10:30:40 2013 UDPv4 link local: [undef]
Sun Sep 29 10:30:40 2013 UDPv4 link remote: 130.xxx.xxx.2:1194
Sun Sep 29 10:30:40 2013 TLS: Initial packet from 130.xxx.xxx.2:1194, sid=bbe9857d 3b59d19b
Sun Sep 29 10:30:40 2013 VERIFY OK: depth=1, /C=IT/ST=MI/L=Lonate_Pozzolo/O=mycompany.com/OU=EDP/CN=mycompany.com_CA/emailAddress=vpn@mycompany.com
Sun Sep 29 10:30:40 2013 VERIFY OK: depth=0, /C=IT/ST=MI/L=Lonate_Pozzolo/O=mycompany.com/OU=EDP/CN=server/emailAddress=vpn@mycompany.com
Sun Sep 29 10:30:41 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Sep 29 10:30:41 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Sep 29 10:30:41 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Sep 29 10:30:41 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Sep 29 10:30:41 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Sep 29 10:30:41 2013 [server] Peer Connection Initiated with 130.xxx.xxx.2:1194
Sun Sep 29 10:30:44 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sun Sep 29 10:30:44 2013 PUSH: Received control message: 'PUSH_REPLY,route 100.1.1.0 255.255.255.0,redirect-gateway,dhcp-option DNS 100.1.1.123,route 100.1.3.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 100.1.3.6 100.1.3.5'
Sun Sep 29 10:30:44 2013 OPTIONS IMPORT: timers and/or timeouts modified
Sun Sep 29 10:30:44 2013 OPTIONS IMPORT: --ifconfig/up options modified
Sun Sep 29 10:30:44 2013 OPTIONS IMPORT: route options modified
Sun Sep 29 10:30:44 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Sep 29 10:30:56 2013 ROUTE default_gateway=192.168.1.1
Sun Sep 29 10:30:56 2013 TAP-WIN32 device [Connessione alla rete locale (LAN) 2] opened: \\.\Global\{D25354DC-48B5-4D5B-9B7B-9D33DA62B812}.tap
Sun Sep 29 10:30:56 2013 TAP-Win32 Driver Version 9.9 
Sun Sep 29 10:30:56 2013 TAP-Win32 MTU=1500
Sun Sep 29 10:30:57 2013 Notified TAP-Win32 driver to set a DHCP IP/netmask of 100.1.3.6/255.255.255.252 on interface {D25354DC-48B5-4D5B-9B7B-9D33DA62B812} [DHCP-serv: 100.1.3.5, lease-time: 31536000]
Sun Sep 29 10:30:57 2013 Successful ARP Flush on interface [19] {D25354DC-48B5-4D5B-9B7B-9D33DA62B812}
Sun Sep 29 10:31:08 2013 TEST ROUTES: 3/3 succeeded len=2 ret=1 a=0 u/d=up
Sun Sep 29 10:31:08 2013 C:\WINDOWS\system32\route.exe ADD 130.xxx.xxx.2 MASK 255.255.255.255 192.168.1.1
Sun Sep 29 10:31:08 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Sun Sep 29 10:31:08 2013 Route addition via IPAPI succeeded [adaptive]
Sun Sep 29 10:31:08 2013 C:\WINDOWS\system32\route.exe DELETE 0.0.0.0 MASK 0.0.0.0 192.168.1.1
Sun Sep 29 10:31:12 2013 Route deletion via IPAPI succeeded [adaptive]
Sun Sep 29 10:31:12 2013 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 0.0.0.0 100.1.3.5
Sun Sep 29 10:31:12 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Sep 29 10:31:12 2013 Route addition via IPAPI succeeded [adaptive]
Sun Sep 29 10:31:12 2013 C:\WINDOWS\system32\route.exe ADD 100.1.1.0 MASK 255.255.255.0 100.1.3.5
Sun Sep 29 10:31:15 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Sep 29 10:31:15 2013 Route addition via IPAPI succeeded [adaptive]
Sun Sep 29 10:31:15 2013 WARNING: potential route subnet conflict between local LAN [100.1.3.4/255.255.255.252] and remote VPN [100.1.3.0/255.255.255.0]
Sun Sep 29 10:31:15 2013 C:\WINDOWS\system32\route.exe ADD 100.1.3.0 MASK 255.255.255.0 100.1.3.5
Sun Sep 29 10:31:15 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Sep 29 10:31:15 2013 Route addition via IPAPI succeeded [adaptive]
Sun Sep 29 10:31:15 2013 Initialization Sequence Completed

gianluca

debbie10t wrote
gianluca wroteclient.log:
Sun Sep 29 10:31:15 2013 WARNING: potential route subnet conflict between local LAN [100.1.3.4/255.255.255.252] and remote VPN [100.1.3.0/255.255.255.0]
This looks suspicious, each client subnet needs to be unigue, this is why OpenVPN warns you to avoid using 192.168.0 or .1 subnets.

Have a read of this:
http://openvpn.net/index.php/open-source/documentation/howto.html#numbering

I read it.. But :
=> my company local lan is 100.1.1.0/24
=> my VPN lan is 100.1.3.0/24
=> the 192.168.1.0/24 is my home private lan from where i try to connect to the VPN server
I don't think there could be conflict between the route subnet. I think the warning is why i do not use the standard ip block for private local network (10.0.0.0/8 or 172.16.0.0/12)

debbie10t wrote
gianluca wrote
Routing IP abilitato. . . . . . . . . : No
If this is the server then it must be Yes.
See this:
http://openvpn.net/index.php/open-source/faq/community-software-server/265-how-do-i-enable-ip-forwarding.html

No.. unfortunately is the client. In VPN server the ip_forward is set to 1...

debbie10t wrote As for the problem of your RDP:
Can you ping the server machine (where you want to open a remote desktop session) from the client machine (where you are working) ?

Yes. I can ping both the server ip and server name where i want to open the RDP

gianluca

debbie10t wrote 100.1.3.4/255.255.255.252 (VPN IP) overlap (Server LAN IP) 100.1.3.0/255.255.255.0
you must change the VPN IP Addresses or use mode tap correctly with bridging.

Hi debbie10t.

Sorry.. I hate to seem insistent.

But my VPN server LOCAL LAN ip is 100.1.1.123. Ip 100.1.3.0/24 is pool ip address for the vpn.

In this pool, the 100.1.3.1 is tun0 ip, 100.1.3.2 is tun0 point-to-point and from 100.1.3.4 to 100.1.3.7 are the configuration in client tun interface.

It's wrong??

i set the tun0 interface in the VPN server like:

eth0      Link encap:Ethernet  HWaddr 00:50:56:a5:44:48
          [b]inet addr:130.xxx.xxx.2  Bcast:130.xxx.xxx.3  Mask:255.255.255.252[/b]
          inet6 addr: fe80::250:56ff:fea5:4448/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:51727 errors:0 dropped:0 overruns:0 frame:0
          TX packets:42869 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:41818405 (41.8 MB)  TX bytes:8928200 (8.9 MB)

eth1    Link encap:Ethernet  HWaddr 00:50:56:a5:18:09
          [b]inet addr:100.1.1.123  Bcast:100.1.1.255  Mask:255.255.255.0[/b]
          inet6 addr: fe80::250:56ff:fea5:1809/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:350014 errors:0 dropped:56542 overruns:0 frame:0
          TX packets:7025 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:27951451 (27.9 MB)  TX bytes:2724261 (2.7 MB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:6 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:444 (444.0 B)  TX bytes:444 (444.0 B)

tun0    Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          [b]inet addr:100.1.3.1  P-t-P:100.1.3.2  Mask:255.255.255.255[/b]
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:6736 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6334 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:474398 (474.3 KB)  TX bytes:1185530 (1.1 MB)

gianluca

Thank for your help..

Finally the VPN server work.
I change the ip configuration according your suggestion (server 10.300.1.0/24) to solve the warning in client log.

But I had the same prblem both for the web navigation and for rdp connection..

I solved this (and i feel so stupid....) changing the configuration of tun0 interface in the VPN server from static to DHCP.

Now.. for the moment, the connection work fine...

So.. I owe you a beer..

thank for your time and help.

Have a nice day