Push Route for LAN behind OpenVPN

jun

I have configured a VPN and want to enable clients access the VPN and the subnet behind the VPN. All these machines are based on Windows. But now I have a routing issue.

My OpenVPN server private IP is 192.168.4.30 ( I know it's not good to use 192.168.x.x, but I am not allow to change this).
The subnet is 192.168.4.0/24. I used push route now I can ping from my VPN client (10.8.0.4) to the VPN server (10.8.0.1) and the private IP of the server (192.168.4.30).
However, I cannot reach the machines within the same subnet, which means I cannot ping from 10.8.0.4 to 192.168.4.40.
For testing purposes, I disabled all the firewall. I have enabled IP forwarding on the server and all these machines.
I found some other similar issues on the forum and I have tried those solutions, but not really helpful in my case.
After reading this,
https://community.openvpn.net/openvpn/wiki/RoutedLans
I am wondering whether I need iroute in my case. But I think my clients do not have LAN behind, and I have no idea how to put iroute in windows.

I have tried to used tracert to 192.168.4.40, the first hop is 10.8.0.1 then it cannot find anything else.
Also when I tired to tracert 192.168.4.30, the result was

Tracing route to 192.168.4.30 over a maximum of 30 hops

  1     *        *        *     Request timed out.
  2    28 ms    27 ms    28 ms  192.168.4.30

Trace complete.

So, my goal is access from VPN client (10.8.0.4) to a machine (192.168.4.40) via the OpenVPN.
Any further configuration I need to do? Or any of my settings were wrong?
Please let me know. Thank you in advance.

Server Config

port 1194
proto udp
dev tun

ca "C:\\Program Files (x86)\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files (x86)\\OpenVPN\\config\\server.crt"
key "C:\\Program Files (x86)\\OpenVPN\\config\\server.key"
dh "C:\\Program Files (x86)\\OpenVPN\\config\\dh1024.pem"

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

push "route 192.168.4.0 255.255.255.0"
topology subnet

client-to-client
keepalive 10 120

comp-lzo

persist-key
persist-tun

status openvpn-status.log
verb 3

Client Config


client
dev tun
proto udp
remote xxx.xxx.xxx.xxx 1194
resolv-retry infinite
nobind

persist-key
persist-tun

ca "C:\\Program Files (x86)\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files (x86)\\OpenVPN\\config\\laptop.crt"
key "C:\\Program Files (x86)\\OpenVPN\\config\\laptop.key"

ns-cert-type server

comp-lzo

verb 3

Server Status

Mon Oct 14 23:37:41 2013 OpenVPN 2.1.3 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Aug 20 2010
Mon Oct 14 23:37:41 2013 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Mon Oct 14 23:37:41 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Oct 14 23:37:41 2013 Diffie-Hellman initialized with 1024 bit key
Mon Oct 14 23:37:41 2013 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Oct 14 23:37:41 2013 Socket Buffers: R=[65536->65536] S=[65536->65536]
Mon Oct 14 23:37:42 2013 ROUTE default_gateway=192.168.0.1
Mon Oct 14 23:37:42 2013 OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
Mon Oct 14 23:37:42 2013 OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.4.0
Mon Oct 14 23:37:42 2013 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{767B31B7-E4A3-42BB-9CAD-E33C6073A4B8}.tap
Mon Oct 14 23:37:42 2013 TAP-Win32 Driver Version 9.7 
Mon Oct 14 23:37:42 2013 TAP-Win32 MTU=1500
Mon Oct 14 23:37:42 2013 Set TAP-Win32 TUN subnet mode network/local/netmask = 10.8.0.0/10.8.0.1/255.255.255.0 [SUCCEEDED]
Mon Oct 14 23:37:42 2013 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.1/255.255.255.0 on interface {767B31B7-E4A3-42BB-9CAD-E33C6073A4B8} [DHCP-serv: 10.8.0.254, lease-time: 31536000]
Mon Oct 14 23:37:42 2013 Sleeping for 10 seconds...
Mon Oct 14 23:37:52 2013 Successful ARP Flush on interface [17] {767B31B7-E4A3-42BB-9CAD-E33C6073A4B8}
Mon Oct 14 23:37:52 2013 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Oct 14 23:37:52 2013 UDPv4 link local (bound): [undef]:1194
Mon Oct 14 23:37:52 2013 UDPv4 link remote: [undef]
Mon Oct 14 23:37:52 2013 MULTI: multi_init called, r=256 v=256
Mon Oct 14 23:37:52 2013 IFCONFIG POOL: base=10.8.0.2 size=252
Mon Oct 14 23:37:52 2013 IFCONFIG POOL LIST
Mon Oct 14 23:37:52 2013 laptop,10.8.0.4
Mon Oct 14 23:37:52 2013 Initialization Sequence Completed

Client Status

Tue Oct 15 10:39:39 2013 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Tue Oct 15 10:39:39 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Oct 15 10:39:39 2013 Need hold release from management interface, waiting...
Tue Oct 15 10:39:39 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Oct 15 10:39:39 2013 MANAGEMENT: CMD 'state on'
Tue Oct 15 10:39:39 2013 MANAGEMENT: CMD 'log all on'
Tue Oct 15 10:39:39 2013 MANAGEMENT: CMD 'hold off'
Tue Oct 15 10:39:39 2013 MANAGEMENT: CMD 'hold release'
Tue Oct 15 10:39:39 2013 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Oct 15 10:39:39 2013 UDPv4 link local: [undef]
Tue Oct 15 10:39:39 2013 UDPv4 link remote: [AF_INET]54.252.176.122:1194
Tue Oct 15 10:39:39 2013 MANAGEMENT: >STATE:1381793979,WAIT,,,
Tue Oct 15 10:39:39 2013 MANAGEMENT: >STATE:1381793979,AUTH,,,
Tue Oct 15 10:39:39 2013 TLS: Initial packet from [AF_INET]54.252.176.122:1194, sid=bce4810b 8f282670
Tue Oct 15 10:39:39 2013 VERIFY OK: depth=1, C=**, ST=**, L=**, O=**, OU=section, CN=OpenVPN-CA, emailAddress=**
Tue Oct 15 10:39:39 2013 VERIFY OK: nsCertType=SERVER
Tue Oct 15 10:39:39 2013 VERIFY OK: depth=0, C=**, ST=**, O=**, OU=section, CN=server, emailAddress=**
Tue Oct 15 10:39:40 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Oct 15 10:39:40 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct 15 10:39:40 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Oct 15 10:39:40 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct 15 10:39:40 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Oct 15 10:39:40 2013 [server] Peer Connection Initiated with [AF_INET]54.252.176.122:1194
Tue Oct 15 10:39:41 2013 MANAGEMENT: >STATE:1381793981,GET_CONFIG,,,
Tue Oct 15 10:39:42 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue Oct 15 10:39:42 2013 PUSH: Received control message: 'PUSH_REPLY,route 192.168.4.0 255.255.255.0,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.4 255.255.255.0'
Tue Oct 15 10:39:42 2013 OPTIONS IMPORT: timers and/or timeouts modified
Tue Oct 15 10:39:42 2013 OPTIONS IMPORT: --ifconfig/up options modified
Tue Oct 15 10:39:42 2013 OPTIONS IMPORT: route options modified
Tue Oct 15 10:39:42 2013 OPTIONS IMPORT: route-related options modified
Tue Oct 15 10:39:42 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Oct 15 10:39:42 2013 MANAGEMENT: >STATE:1381793982,ASSIGN_IP,,10.8.0.4,
Tue Oct 15 10:39:42 2013 open_tun, tt->ipv6=0
Tue Oct 15 10:39:42 2013 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{77EDEE45-8BDD-46C6-870B-03C139C59E10}.tap
Tue Oct 15 10:39:42 2013 TAP-Windows Driver Version 9.9 
Tue Oct 15 10:39:42 2013 Set TAP-Windows TUN subnet mode network/local/netmask = 10.8.0.0/10.8.0.4/255.255.255.0 [SUCCEEDED]
Tue Oct 15 10:39:42 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.4/255.255.255.0 on interface {77EDEE45-8BDD-46C6-870B-03C139C59E10} [DHCP-serv: 10.8.0.254, lease-time: 31536000]
Tue Oct 15 10:39:42 2013 Successful ARP Flush on interface [15] {77EDEE45-8BDD-46C6-870B-03C139C59E10}
Tue Oct 15 10:39:47 2013 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Tue Oct 15 10:39:47 2013 MANAGEMENT: >STATE:1381793987,ADD_ROUTES,,,
Tue Oct 15 10:39:47 2013 C:\Windows\system32\route.exe ADD 192.168.4.0 MASK 255.255.255.0 10.8.0.1
Tue Oct 15 10:39:47 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Oct 15 10:39:47 2013 Route addition via IPAPI succeeded [adaptive]
Tue Oct 15 10:39:47 2013 Initialization Sequence Completed
Tue Oct 15 10:39:47 2013 MANAGEMENT: >STATE:1381793987,CONNECTED,SUCCESS,10.8.0.4,***.***.***.***

And the route print

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      10.0.50.200      10.0.50.219     10
        10.0.50.0    255.255.255.0         On-link       10.0.50.219    266
      10.0.50.219  255.255.255.255         On-link       10.0.50.219    266
      10.0.50.255  255.255.255.255         On-link       10.0.50.219    266
         10.8.0.0    255.255.255.0         On-link          10.8.0.4    286
         10.8.0.4  255.255.255.255         On-link          10.8.0.4    286
       10.8.0.255  255.255.255.255         On-link          10.8.0.4    286
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.4.0    255.255.255.0         10.8.0.1         10.8.0.4     30
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link          10.8.0.4    286
        224.0.0.0        240.0.0.0         On-link       10.0.50.219    266
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link          10.8.0.4    286
  255.255.255.255  255.255.255.255         On-link       10.0.50.219    266
===========================================================================

maikcat

hello there,

if you simply want to access server side lan pcs from your openvpn client ONLY
then you DONT need iroute...

you MUST though configure routing accordingly, so packets destined from/to your
openvpn client ,from/to server side pcs can reach one another.

Michael.

jun

Hi Michael,

Thank you for your help. I have tried to configure routing but I need a little bit more help.
Actually the machines (OpenVPN server and the subnet) are all on Amazon AWS VPC.
I can edit the route table of the subnet (kind of router), but I need to get permission before I do so.
On the other hand, I have tried to add a static route on the machine (192.168.4.40) behind the OpenVPN server saying:
route add 10.8.0.0 mask 255.255.255.0 192.168.4.30

According to this:
# Push routes to the client to allow it
# to reach other private subnets behind
# the server. Remember that these
# private subnets will also need
# to know to route the OpenVPN client
# address pool (10.8.0.0/255.255.255.0)
# back to the OpenVPN server.

The static route rule was added and I can see it in the route print.
However, I cannot ping from the 192.168.4.40 to 10.8.0.1.
I've tried tracert to 10.8.0.1 but I cannot reach anything, not even the 192.168.4.30.
So that means the static route rule was not working?
Any part went wrong or I must do the config on the route table of the subnet?

Please give me some hints where I should go. Thank you.

maikcat

did you enable ip forwarding on openvpn server?
did you configure firewall (if any) on openvpn server to allow traffic from/to tun interface?

Michael.

jun

Yes, I've double checked that I enabled IP forwarding on the OpenVPN server using Regedt32.exe.
Also all the firewalls were down, but still cannot reach the machine from OpenVPN client.
I am confused because I have no idea where is the problem:(

jun

Hi there,

Yes, I have went through that one, particularly this section Including multiple machines on the server side when using a routed VPN (dev tun).
I used
push "route 192.168.4.0 255.255.255.0"
in my server config just like that in the HOWTO.

However, I am not sure whether I understand correctly for this:
Next, you must set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24) to the OpenVPN server (this is only necessary if the OpenVPN server and the LAN gateway are different machines).

My OpenVPN server (192.168.4.30) and the LAN gateway (192.168.4.1) are different machines.
So does that mean I should put
route add 10.8.0.0 mask 255.255.255.0 192.168.4.1
instead of
route add 10.8.0.0 mask 255.255.255.0 192.168.4.30
on the machine (192.168.4.40) behind the OpenVPN server?
I have tried any of them but still not working.

Also I have tried to use
route add 10.8.0.0 mask 255.255.255.0 192.168.4.1
or
route add 10.8.0.0 mask 255.255.255.0 192.168.4.30
on my OpenVPN server. But still not working in either way.

Do I have to put route in the route table (on AWS) of the LAN so that the OpenVPN client can talk to the machine behind the server?
Or anything not correct?
Thank you for your help.