OpenVPN for Remote Control

bania

Hi Guys,

I am new here and I am learning how to write properly OpenVPN config files, so be patient and calm, when You will read my questions and problems. And sorry for bad grammar. 😉

I am reading manuals and tips, also "openvpn cookbook", but even with that great help I can't make a connection, somewhere, somehow I am still making errors 🙁

I want to make connection to my PLC controler threw OpenVPN. PLC with router as server is in place A with internet connection, and my computer is in place B with internet connection as client. If I think right, with OpenVPN connection I will be in LAN area and I will can read/write files to my PLC with using proper software. I've choose a tap mode, because it is ethernet connection (as in PLC), but I can be wrong with that.

I have router BuffaloWZR-HP-AG300H with DD-wrt. In router i have option to make openvpn configuration (by config files or gui mode).

I already make files using easy-rsa:
-> ca certificate,
-> dh for server,
-> server crt and key,
-> client crt and key.

I've made config for server and client, but I don't know if i made it good.
Server config file:

dev tap
dev-node lowicz_smf
port 1194
proto tcp-server
ca ca.crt
cert server_lowicz.crt
key server_lowicz.key
dh dh2048.pem
server-bridge 192.168.3.1 255.255.255.0 192.168.3.180 192.168.3.220
push "dhcp-option DNS 192.168.3.1"
push "dhcp-option WINS 192.168.3.1"
push "route-gateway 192.168.3.1"
verb 4
mute 5
persist-key
persist-tun
keepalive 10 60
inactive 3600
comp-lzo

Client config file:
client
dev tap
proto tcp-client
port 1194
remote 201.201.201.201 <- Router IP
resolv-retry infinite
ip-win32 dynamic
ca ca.crt
cert klient_lowicz_001.crt
key klient_lowicz_001.key
ping 10
ping-restart 60
verb 7
mute 3
comp-lzo

On windows 7, the server file is working, but client can't make connection.
On Buffalo router I don't know if it works properly. If I am wrong correct me with that. Buffalo router has linux, so in server config file it should be at start "dev tap0" -> in windows it should be "dev tap dev-node lowicz_smf"

If You see what I've done wrong, please help me and answer on my problem. I will be very happy when it will work properly 😛 From my side I can say, that I will test it further. 🙂

bania

Hi, this is me again, I read that I must give log's too.

I changed server's config file. and it looks similar like in dd-wrt topic here
http://www.dd-wrt.com/wiki/index.php/VPN_(the_easy_way)_v24%2B

Config file of server:

mode server
dev tap0
daemon
port 1194
proto tcp-server
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
server-bridge 192.168.3.1 255.255.255.0 192.168.3.180 192.168.3.220
verb 6
mute 5
persist-key
persist-tun
keepalive 10 60
inactive 3600
comp-lzo[/code]

The server log file:

192.168.3.82:50978 TCPv4_SERVER READ [114] from 192.168.3.82:50978: P_CONTROL_V1 kid=0 [ ] pid=2 DATA len=100
192.168.3.82:50978 NOTE: --mute triggered...
192.168.3.82:50978 131 variation(s) on previous 5 message(s) suppressed by --mute
192.168.3.82:50978 VERIFY ERROR: depth=1, error=certificate is not yet valid: /C=PL/ST=Lubelskie/L=Swidnik/O=smf_germany/OU=smf_germany/CN=server/name=server_smf_germany/emailAddress=b.banczerowski@smfgmh.com
192.168.3.82:50978 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:lib(20):func(137):reason(178)
192.168.3.82:50978 TLS Error: TLS object -> incoming plaintext read error
192.168.3.82:50978 TLS Error: TLS handshake failed
192.168.3.82:50978 Fatal TLS error (check_tls_errors_co), restarting
192.168.3.82:50978 SIGUSR1[soft,tls-error] received, client-instance restarting
TCP/UDP: Closing socket
MULTI: multi_create_instance called
Re-using SSL/TLS context
LZO compression initialized
Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Local Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Expected Remote Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Local Options hash (VER=V4): '3e6d1056'
Expected Remote Options hash (VER=V4): '31fdf004'
TCP connection established with 192.168.3.82:50999
TCPv4_SERVER link local: [undef]
192.168.3.82:50999 TCPv4_SERVER READ [22] from 192.168.3.82:50999: P_ACK_V1 kid=0 [ 0 ]
192.168.3.82:50999 TCPv4_SERVER READ [114] from 192.168.3.82:50999: P_CONTROL_V1 kid=0 [ ] pid=1 DATA len=100
192.168.3.82:50999 TCPv4_SERVER WRITE [22] to 192.168.3.82:50999: P_ACK_V1 kid=0 [ 1 ]
192.168.3.82:50999 TCPv4_SERVER READ [114] from 192.168.3.82:50999: P_CONTROL_V1 kid=0 [ ] pid=2 DATA len=100
192.168.3.82:50999 NOTE: --mute triggered...
192.168.3.82:50999 131 variation(s) on previous 5 message(s) suppressed by --mute
192.168.3.82:50999 VERIFY ERROR: depth=1, error=certificate is not yet valid: /C=PL/ST=Lubelskie/L=Swidnik/O=smf_germany/OU=smf_germany/CN=server/name=server_smf_germany/emailAddress=b.banczerowski@smfgmh.com
192.168.3.82:50999 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:lib(20):func(137):reason(178)
192.168.3.82:50999 TLS Error: TLS object -> incoming plaintext read error
192.168.3.82:50999 TLS Error: TLS handshake failed
192.168.3.82:50999 Fatal TLS error (check_tls_errors_co), restarting
192.168.3.82:50999 SIGUSR1[soft,tls-error] received, client-instance restarting
TCP/UDP: Closing socket
MULTI: multi_create_instance called
Re-using SSL/TLS context
LZO compression initialized
Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Local Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Expected Remote Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Local Options hash (VER=V4): '3e6d1056'
Expected Remote Options hash (VER=V4): '31fdf004'
TCP connection established with 192.168.3.82:51002
TCPv4_SERVER link local: [undef]
192.168.3.82:51002 TCPv4_SERVER READ [14] from 192.168.3.82:51002: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
192.168.3.82:51002 TLS: Initial packet from 192.168.3.82:51002, sid=ac8a9558 6735f294
192.168.3.82:51002 TCPv4_SERVER WRITE [26] to 192.168.3.82:51002: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ 0 ] pid=0 DATA len=0
192.168.3.82:51002 TCPv4_SERVER READ [22] from 192.168.3.82:51002: P_ACK_V1 kid=0 [ 0 ]
192.168.3.82:51002 TCPv4_SERVER READ [114] from 192.168.3.82:51002: P_CONTROL_V1 kid=0 [ ] pid=1 DATA len=100
192.168.3.82:51002 TCPv4_SERVER WRITE [22] to 192.168.3.82:51002: P_ACK_V1 kid=0 [ 1 ]
192.168.3.82:51002 TCPv4_SERVER READ [114] from 192.168.3.82:51002: P_CONTROL_V1 kid=0 [ ] pid=2 DATA len=100
192.168.3.82:51002 NOTE: --mute triggered...
192.168.3.82:51002 131 variation(s) on previous 5 message(s) suppressed by --mute
192.168.3.82:51002 VERIFY ERROR: depth=1, error=certificate is not yet valid: /C=PL/ST=Lubelskie/L=Swidnik/O=smf_germany/OU=smf_germany/CN=server/name=server_smf_germany/emailAddress=b.banczerowski@smfgm
h.com
192.168.3.82:51002 TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:lib(20):func(137):reason(178)
192.168.3.82:51002 TLS Error: TLS object -> incoming plaintext read error
192.168.3.82:51002 TLS Error: TLS handshake failed
192.168.3.82:51002 Fatal TLS error (check_tls_errors_co), restarting
192.168.3.82:51002 SIGUSR1[soft,tls-error] received, client-instance restarting
TCP/UDP: Closing socket

The Client config file on Windows 7:

client
dev tap
dev-node server
proto tcp-client
port 1194
remote 192.168.3.1
resolv-retry infinite
ip-win32 dynamic
ca ca.crt
cert klient_001.crt
key klient_001.key
ping 10
ping-restart 60
verb 5
mute 3
comp-lzo

The client log look like this:

Current Parameter Settings:
 = 'klient_001.ovpn'
mode = 0
NOTE: --mute triggered...
282 variation(s) on previous 3 message(s) suppressed by --mute
OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Enter Management Password:
MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Need hold release from management interface, waiting...
MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
MANAGEMENT: CMD 'state on'
MANAGEMENT: CMD 'log all on'
MANAGEMENT: CMD 'hold off'
NOTE: --mute triggered...
1 variation(s) on previous 3 message(s) suppressed by --mute
WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
LZO compression initialized
Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Socket Buffers: R=[8192->8192] S=[8192->8192]
Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Local Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Expected Remote Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Local Options hash (VER=V4): '31fdf004'
Expected Remote Options hash (VER=V4): '3e6d1056'
Attempting to establish TCP connection with [AF_INET]192.168.3.1:1194
MANAGEMENT: >STATE:1381225582,TCP_CONNECT,,,
TCP connection established with [AF_INET]192.168.3.1:1194
TCPv4_CLIENT link local: [undef]
TCPv4_CLIENT link remote: [AF_INET]192.168.3.1:1194
MANAGEMENT: >STATE:1381225585,WAIT,,,
MANAGEMENT: >STATE:1381225585,AUTH,,,
TLS: Initial packet from [AF_INET]192.168.3.1:1194, sid=52b6e4de 210b1f65
VERIFY OK: depth=1, C=PL, ST=Lubelskie, L=Swidnik, O=smf_germany, OU=smf_germany, CN=server, name=server_smf_germany, emailAddress=b.banczerowski@smfgmbh.com
VERIFY OK: depth=0, C=PL, ST=Lubelskie, L=Swidnik, O=smf_germany, OU=smf_germany, CN=server, name=server_smf_germany, emailAddress=b.banczerowski@smfgmbh.com
Connection reset, restarting [-1]
TCP/UDP: Closing socket
SIGUSR1[soft,connection-reset] received, process restarting
MANAGEMENT: >STATE:1381225585,RECONNECTING,connection-reset,,
Restart pause, 5 second(s)
WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
LZO compression initialized
Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Socket Buffers: R=[8192->8192] S=[8192->8192]
Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Local Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Expected Remote Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Local Options hash (VER=V4): '31fdf004'
Expected Remote Options hash (VER=V4): '3e6d1056'
Attempting to establish TCP connection with [AF_INET]192.168.3.1:1194
MANAGEMENT: >STATE:1381225590,TCP_CONNECT,,,
TCP connection established with [AF_INET]192.168.3.1:1194
TCPv4_CLIENT link local: [undef]
TCPv4_CLIENT link remote: [AF_INET]192.168.3.1:1194
MANAGEMENT: >STATE:1381225590,WAIT,,,
MANAGEMENT: >STATE:1381225590,AUTH,,,
TLS: Initial packet from [AF_INET]192.168.3.1:1194, sid=9ef2f43e eea43586
VERIFY OK: depth=1, C=PL, ST=Lubelskie, L=Swidnik, O=smf_germany, OU=smf_germany, CN=server, name=server_smf_germany, emailAddress=b.banczerowski@smfgmbh.com
Connection reset, restarting [-1]
TCP/UDP: Closing socket

Like I said in first post of this topic, I want to make remote connection to my PLC and I think that I need bridging.
The Buffalo router has DD-WRT with OpenVPN, I can give some pictures if it will help.

bania

Hi,

Thanks for advices. I've changed things like You said, but not certificates (I will show You examples how I make them, maybe this is the biggest problem 🙂 )

I give some pictures and my thoughts first. I read at
http://www.dd-wrt.com/wiki/index.php/VPN_(the_easy_way)_v24%2B
That I can have NTP issues. I've made ntp server like said in dd-wrt hear (I'm from Poland, so I've choosen Germany server, we are neighbors)
http://www.dd-wrt.com/wiki/index.php/Network_Time_Protocol
And this is a picture on my router: ntp setting

Picture what time I have on my router after re-connecting:

I think that time should be something like: 7:57 a.m (Like i have time now in Poland). In work my router is connected to another router, so maybe I have routing problem? I will check in this evening this router at my home, he will be a main router, so I will have better sight viev on this case.

On router all looks like that:

In the status mode on router I see that:

In command of the router I've made like it's said in dd-wrt wiki:

But I must said that I disable firewall. First I want to make sure that I have only config problems 🙂

Now How I make certificates. I'm using easy-rsa and every file is making "good" (every file has some "weight")

But maybe I'm making some errors in writing certificates.
In vars I have
set KEY_COUNTRY=PL
set KEY_PROVINCE=Lubelskie
set KEY_CITY=Swidnik
set KEY_ORG=smf_germany
set KEY_OU=smf_germany
set KEY_CN=server
set KEY_NAME=server_smf_germany
set KEY_EMAIL=b.banczerowski@smfgmbh.com
set PKCS11_MODULE_PATH=changeme -> I'm not using it
set PKCS11_PIN=1234 -> I'm not using it

In crt files I see Issuer:
Issuer: C=PL, ST=Lubelskie, L=Swidnik, O=smf_germany, OU=smf_germany, CN=server/name=server_smf_germany/emailAddress=b.banczerowski@smfgmbh.com

And this is what I have in "Subject":
ca:
Subject: C=PL, ST=Lubelskie, L=Swidnik, O=smf_germany, OU=smf_germany, CN=server/name=server_smf_germany/emailAddress=b.banczerowski@smfgmbh.com

server:
C=PL, ST=Lubelskie, L=Swidnik, O=smf_germany, OU=smf_germany, CN=server/name=server_smf_germany/emailAddress=b.banczerowski@smfgmbh.com

ca and server are the same

client:
Subject: C=PL, ST=Lubelskie, L=Swidnik, O=smf_germany, OU=smf_germany, CN=klient1/name=server_smf_germany/emailAddress=b.banczerowski@smfgmbh.com

client have only diffrent common name

And now I give my config and logs files. In work I've changed IP on 192.168.10.220,becuase the company Lan is on that IP and bridging should be on same IP, if I think right. If I can have VPN bridging another IP for LAN I would be happy to know 😉 I've worked 12 hours yesterday and I didn't have energy to sit on this router after your post.

Server Config:

dev tap0
daemon
port 1194
proto tcp-server
dh /tmp/openvpn/dh.pem 
ca /tmp/openvpn/ca.crt 
cert /tmp/openvpn/cert.crt
key /tmp/openvpn/key.key
tls-auth /tmp/openvpn/ta.key 0
server-bridge 192.168.10.1 255.255.255.0 192.168.10.230 192.168.3.235
verb 3
mute 5
persist-key
persist-tun
keepalive 10 60
inactive 3600
comp-lzo

Server Log on verb3:

server user.info syslog: vpn modules : nf_conntrack_proto_gre successfully loaded
server user.info syslog: vpn modules : nf_nat_proto_gre successfully loaded
server user.info syslog: vpn modules : nf_conntrack_pptp successfully loaded
server user.info syslog: vpn modules : nf_nat_pptp successfully loaded
server user.info syslog: vpn modules : vpn modules successfully unloaded
server user.info syslog: vpn modules : nf_conntrack_proto_gre successfully loaded
server user.info syslog: vpn modules : nf_nat_proto_gre successfully loaded
server user.info syslog: vpn modules : nf_conntrack_pptp successfully loaded
server user.info syslog: vpn modules : nf_nat_pptp successfully loaded
server syslog.info syslogd started: BusyBox v1.19.4

Client Config:

client
dev tap
dev-node server
proto tcp-client
remote 192.168.10.220 1194
resolv-retry infinite
ip-win32 dynamic
ca ca.crt
cert klient_001.crt
key klient_001.key
tls-auth ta.key 1
ping 10
ping-restart 60
verb 5
mute 3
comp-lzo
ns-cert-type server

Client Log:

Current Parameter Settings:
config = 'klient_001.ovpn'
mode = 0
NOTE: --mute triggered...
282 variation(s) on previous 3 message(s) suppressed by --mute
OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Enter Management Password:
MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Need hold release from management interface, waiting...
MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
MANAGEMENT: CMD 'state on'
MANAGEMENT: CMD 'log all on'
MANAGEMENT: CMD 'hold off'
NOTE: --mute triggered...
1 variation(s) on previous 3 message(s) suppressed by --mute
Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
LZO compression initialized
Control Channel MTU parms [ L:1576 D:168 EF:68 EB:0 ET:0 EL:0 ]
Socket Buffers: R=[8192->8192] S=[8192->8192]
Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Local Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_CLIENT,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Expected Remote Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_SERVER,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Local Options hash (VER=V4): 'e39a3273'
Expected Remote Options hash (VER=V4): '3c14feac'
Attempting to establish TCP connection with [AF_INET]192.168.10.220:1194
WMANAGEMENT: >STATE:1381300826,TCP_CONNECT,,,
TCP: connect to [AF_INET]192.168.10.220:1194 failed, will try again in 5 seconds: Connection refused (WSAECONNREFUSED)
MANAGEMENT: >STATE:1381300832,TCP_CONNECT,,,
TCP: connect to [AF_INET]192.168.10.220:1194 failed, will try again in 5 seconds: Connection refused (WSAECONNREFUSED)
MANAGEMENT: >STATE:1381300838,TCP_CONNECT,,,
TCP: connect to [AF_INET]192.168.10.220:1194 failed, will try again in 5 seconds: Connection refused (WSAECONNREFUSED)
SIGTERM[hard,init_instance] received, process exiting
Wed Oct 09 08:40:41 2013 us=795587

And about naming tap adapter. First I named him "lowicz-server", but when I was testing and trying to connect I was making a lot of files again and again so I named it "server", because it shorter to write 🙂

I can't connect neither now, and obviously I'm making something wrong, like You said, but I don't know what. Maybe this pictures will help You to find in wich place is error.
I will wait on Your response 🙂

bania

Hi,

I'm glad to hear that I'm close, but I didn't make any step further.
At home, the buffalo router as main router is giving a proper time, so ntp server is set good. 🙂

This suggest that your client cannot connect to the server, most likely due to firewall, make sure you allow TCP port 1194.

About Firewall:
I've checked option without firewall first ->
On the router I've disabled firewall, on the windows 7 I've disabled my antivirus and windows 7 firewall, and the client logs are same like in my earlier post. Maybe I am making some wrong settings with my windows tap adapter?

I should give some IP on TAP adapter?

bania

Hi,

In my work I'm testing on such subnet topology:

Windows 7 CLIENT OpenVPN
v
v
MAIN COMPANY ROUTER -> My Buffalo Router -> PLC

Company Main Router:
IP: 192.168.10.1
Mask: 255.255.255.0
Gate: 192.168.10.1

My Buffalo router:
IP: 192.168.10.220
Mask: 255.255.255.0
Gate: 192.168.10.220

PLC -> 192.168.10.3 (in fabric setting it has 3.3, but in VPN bridge if I think right that woudn't work server-bridge 192.168.3.x 192.168.3.x 192.168.3.x, because It should have the same IP like physic LAN?)

In My house:

Windows 7 Client OpenVPN
V
V
My Buffalo Router (MAIN ROUTER) -> PLC

IP: 192.168.3.1
Mask: 255.255.255.0
Gate: 192.168.3.1

I know that it could be misleading. At home for me it easier to change router IP settings (+ that he is a main "gate" router with internet)

Both in work and at home the OpenVPN server on the router is giving good logs (like in earlier post), but I think that in company I must make better config file or routing to my router, because I don't see proper time in the Buffalo router.

But at home Like i said, I've disabled router firewall and firewall Win7 + my antivirus and it doesn't working.

I have to admit that at final OpenVPN connection I'm interested in the 1st working option:
company router->buffalo openvpn router -> PLC controller
But at home I'm testing the simpler connection. In company I'm quite sure that it woudn't work without writing some new procedures about routing? But I can be wrong 🙂

P.S. I've submitted earlier post too fast and I don't see the option to delete it. If someone can clean it, I would be grateful. 😉

bania

debbie10t wrote OpenVPN expects and demands the following for general operation, subtle changes can be made but stick with this overall layout for normal operation:

Client [Lan] -=- router -=- [WAN] -=- router -=- [LAN] Server

The buffalo router may try to hide one of the "interfaces" but they all have to be present.
Otherwise you're gonna stress openvpn due to default gateways and routing, it is a limitation due to RFC's.

Thanks for advice, I didn't make static WAN IP on server, maybe this is the cause of my problem with client connecting. Today's evening I will test it at home and give logs. Now I'm in work (yeah, even in saturday, 6 day per week 🙂 ) and I can't do it now.

And with OpenVPN and routing I don't have big experience, but I'm determined to do it, even if I will make a little step by little step 😉 I'm searching in free time what I'm making wrong, reading a OpenVPN book "OpenVPN Cookbook ver2" (I want to be a newbie with some knowledge 😛 ) but I must say that Your advices are very, very helpful. And You are very patient with my connecting problem.

But I have to ask. Can I at home connect via OpenVPN, when router(server) and Computer(client) are in the same LAN? I think that it's possible, because client is connecting via external ip, I'm not sure. But I'm quite certain that it's stupid question... :roll:

bania

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

bania

Hi!

30 minutes ago I've made my first connection via OpenVPN 8-) I've tested it in scenario 2 at my home. Thanks a lot debbie10t for helping me. You are my true hero 🙂 I've won with firewalls and with them or without them I'm connecting now clearly with green light, like this smile -> :mrgreen: But I'm not sure if it's all ok, because I can't ping ip of the openvpn server router and main router too.

Here are ending config files of server(I added "management 5001") and client(I added "float"):
Server:

dev tap0
daemon
port 1194
proto tcp-server
dh /tmp/openvpn/dh.pem 
ca /tmp/openvpn/ca.crt 
cert /tmp/openvpn/cert.crt
key /tmp/openvpn/key.key
tls-auth /tmp/openvpn/ta.key 0
server-bridge 192.168.3.1 255.255.255.0 192.168.3.210 192.168.3.220
verb 3
mute 5
persist-key
persist-tun
keepalive 10 60
inactive 3600
comp-lzo
management localhost 5001

client:

client

dev tap
dev-node server
proto tcp-client
remote 109.200.92.87 1194
resolv-retry infinite

ca ca.crt
cert klient_001.crt
key klient_001.key
tls-auth ta.key 1
nobind
ping 10
ping-restart 60
verb 3
mute 3
comp-lzo
float
ns-cert-type server

Client Connection:

Server log:

MULTI: multi_create_instance called 
I Re-using SSL/TLS context 
I LZO compression initialized 
Control Channel MTU parms [ L:1576 D:168 EF:68 EB:0 ET:0 EL:0 ] 
Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ] 
Local Options hash (VER=V4): '3c14feac' 
Expected Remote Options hash (VER=V4): 'e39a3273' 
I TCP connection established with 192.168.1.1:58038 
I TCPv4_SERVER link local: [undef] 
I TCPv4_SERVER link remote: 192.168.1.1:58038 
192.168.1.1:58038 TLS: Initial packet from 192.168.1.1:58038 sid=8cc4b616 2f26cfa5 
192.168.1.1:58038 VERIFY OK: depth=1 /C=PL/ST=Lubelskie/L=Swidnik/O=smf_germany/OU=smf_germany/CN=server/name=server_smf_germany/emailAddress=b.banczerowski@smfgmbh.com
192.168.1.1:58038 VERIFY OK: depth=0 /C=PL/ST=Lubelskie/L=Swidnik/O=smf_germany/OU=smf_germany/CN=klient1/name=server_smf_germany/emailAddress=b.banczerowski@smfgmbh.com
192.168.1.1:58038 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key 
192.168.1.1:58038 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication 
192.168.1.1:58038 NOTE: --mute triggered... 
192.168.1.1:58038 3 variation(s) on previous 5 message(s) suppressed by --mute 
I 192.168.1.1:58038 [klient1] Peer Connection Initiated with 192.168.1.1:58038 
klient1/192.168.1.1:58038 PUSH: Received control message: 'PUSH_REQUEST' 
klient1/192.168.1.1:58038 SENT CONTROL [klient1]: 'PUSH_REPLY route-gateway 192.168.3.1 ping 10 ping-restart 60 ifconfig 192.168.3.210 255.255.255.0' (status=1) 
klient1/192.168.1.1:58038 MULTI: Learn: 00:ff:37:02:23:7b -> klient1/192.168.1.1:58038 
klient1/192.168.1.1:58038 MULTI: Learn: 02:26:22:d9:2b:cd -> klient1/192.168.1.1:58038 
MANAGEMENT: Client connected from 127.0.0.1:5001 
D MANAGEMENT: CMD 'state' 
MANAGEMENT: Client disconnected 
MANAGEMENT: Client connected from 127.0.0.1:5001 
D MANAGEMENT: CMD 'state' 
MANAGEMENT: Client disconnected 
MANAGEMENT: Client connected from 127.0.0.1:5001 
D MANAGEMENT: CMD 'state' 
MANAGEMENT: Client disconnected 
MANAGEMENT: Client connected from 127.0.0.1:5001 
D MANAGEMENT: CMD 'log 500'

I don't know if it's all good. I think that I made some errors with static routing between 2 routers. I can't ping them in cmd command on windows, but I think that I should ping it properly. I give screens about my confiugaration of routing too, maybe this is a main reason of this.
Static routes on:
Main Router 1 (Asus):

OpenVPN Router (Buffalo):

And the picture of static WAN IP on buffalo router:

So I have to ask You again for help and advice. It's now ok, or I am doing something wrong again? 😉

bania

What I can say? We must be brave. "Winter is coming!" (Game of Thrones book/serial 🙂 )

Ok I can change the local ip of the main router at home, but is it necessary? My VPN router has 192.168.3.0 subnet and it will be propably only one controller PLC connected to him. In company noone is using this IP.

I think that my router is showing the WAN IP: 192.168.1.2, because he is connected to my first router. (and Asus is giving Buffalo 192.168.1.2 IP -> maybe I'm doing something wrong here?)

I must say how looks like Network Setup too:

Physically:
Asus Router 1, Buffalo OpenVPN server Router 2

Settings:

Main Router 1(Asus with internet):

[b]Local:[/b]
Local IP: 192.168.1.1
Subnet Mask: 255.255.255.0
Gateway: 192.168.1.1
Local DNS: 192.168.1.1 (is it ok?)
DHCP Server: 192.168.1.2-254

[b]WAN Connection Type:[/b]
WAN IP Addres: 192.168.1.2
Subnet Mask: 255.255.255.0
Gateway: 192.168.1.1
Static DNS1: 86.63.x.29

[b]Static Routing to Buffalo:[/b]
Metric:0
Destination LAN NET: 192.168.3.0
Subnet Mask: 255.255.255.0
Gateway: 192.168.1.2
Connection Type: LAN   (Because ethernet is connect in LAN in Router1?)

OpenVPN Router 2(Buffalo connected to asus):

[b]Local:[/b]
Local IP: 192.168.3.1
Subnet Mask: 255.255.255.0
Gateway: 192.168.3.1
Local DNS: 192.168.3.1 (is it ok?)
DHCP Server: 192.168.3.100-150
OpenVPN: 192.168.3.200-220

[b]WAN Connection Type:[/b]
WAN IP Addres: 192.168.1.2
Subnet Mask: 255.255.255.0
Gateway: 192.168.1.1
Static DNS1: 86.63.x.29

[b]Static Routing to Asus:[/b]
Metric:0
Destination LAN NET: 192.168.1.0
Subnet Mask: 255.255.255.0
Gateway: 192.168.1.1
Connection Type: WAN   (Because ethernet is connect in WAN in OpenVPN Router2?)

And I have some issues with client log. I'm not sure if is it correct. If You look at the end of log You can see all the time:

"MANAGEMENT: Client connected from 127.0.0.1:5001 
D MANAGEMENT: CMD 'state' 
MANAGEMENT: Client disconnected 
MANAGEMENT: Client connected from 127.0.0.1:5001 
D MANAGEMENT: CMD 'state' 
MANAGEMENT: Client disconnected 
MANAGEMENT: Client connected from 127.0.0.1:5001 
D MANAGEMENT: CMD 'log 500'

I can't sleep with it when I think about it. 😉 Anyway I will test the connection today too. Like everyday 🙂 I will be in touch.