I have problem with OpenServer behind router

binx

Hello. I have problem with Open server who is being placed behind router. Router is a Asus WL 500G v2. I have forwarded corresponding port (1194 - tcp). I set up server's and client's configuration according to this page http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html. I have tried my options bypass router, it works. but when I try over router conection isn't establishing. How can I set up my router correct he could pass openVPN connections.

binx

debbie10t wrotePlease post your configs and logs, please read this:
https://forums.openvpn.net/post33633.html

server's config

dev tap
dev-node tap-bridge
proto tcp-server
port 1194
tls-server
server-bridge 192.168.1.100 255.255.255.0 192.168.1.240 192.168.1.254
comp-lzo
push "route 192.168.1.0 255.255.255.0"
push "route-gateway 62.220.59.181"
client-to-client
client-config-dir C:\\OpenVPN\\config\\ccd
ifconfig-pool-persist C:\\OpenVPN\\config\\ccd\\ipp.txt
dh C:\\OpenVPN\\ssl\\dh1024.pem
ca C:\\OpenVPN\\ssl\\ca.crt
cert C:\\OpenVPN\\ssl\\Server.crt
key C:\\OpenVPN\\ssl\\Server.key
persist-key
tls-auth C:\\OpenVPN\\ssl\\ta.key 0
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
keepalive 10 120
status C:\\OpenVPN\\log\\openvpn-status.log
log C:\\OpenVPN\\log\\openvpn.log
verb 4

client config

dev tap 
proto tcp
remote 	62.220.49.181 1194
route-method  exe
route-delay 3  
client  
tls-client  
ns-cert-type server  
nobind

ca C:\\OpenVPN\\ssl\\ca.crt  
cert C:\\OpenVPN\\ssl\\client1.crt  
key C:\\OpenVPN\\ssl\\client1.key  
tls-auth C:\\OpenVPN\\ssl\\ta.key 1  
comp-lzo  
tun-mtu 1500  
tun-mtu-extra 32  
mssfix 1450  
ping-restart 60  
ping 10  
status C:\\OpenVPN\\log\\openvpn-status.log  
log C:\\OpenVPN\\log\\openvpn.log  
verb 3

logs of server

Wed Oct 23 12:47:10 2013 us=386000 TCP/UDP: Closing socket
Wed Oct 23 12:47:19 2013 us=699000 MULTI: multi_create_instance called
Wed Oct 23 12:47:19 2013 us=699000 Re-using SSL/TLS context
Wed Oct 23 12:47:19 2013 us=699000 LZO compression initialized
Wed Oct 23 12:47:19 2013 us=699000 Control Channel MTU parms [ L:1576 D:168 EF:68 EB:0 ET:0 EL:0 ]
Wed Oct 23 12:47:19 2013 us=699000 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Wed Oct 23 12:47:19 2013 us=699000 Local Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_SERVER,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Wed Oct 23 12:47:19 2013 us=699000 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_CLIENT,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Wed Oct 23 12:47:19 2013 us=699000 Local Options hash (VER=V4): '3c14feac'
Wed Oct 23 12:47:19 2013 us=699000 Expected Remote Options hash (VER=V4): 'e39a3273'
Wed Oct 23 12:47:19 2013 us=699000 TCP connection established with 192.168.1.1:56949
Wed Oct 23 12:47:19 2013 us=699000 TCPv4_SERVER link local: [undef]
Wed Oct 23 12:47:19 2013 us=699000 TCPv4_SERVER link remote: 192.168.1.1:56949
Wed Oct 23 12:47:19 2013 us=715000 192.168.1.1:56949 TLS: Initial packet from 192.168.1.1:56949, sid=2e6ffef5 fc52024b
Wed Oct 23 12:47:20 2013 us=370000 192.168.1.1:56949 VERIFY OK: depth=1, /C=RU/ST=Samara/L=Samara/O=Promsensor/CN=server/emailAddress=n.bil@promsensor.ru
Wed Oct 23 12:47:20 2013 us=370000 192.168.1.1:56949 VERIFY OK: depth=0, /C=RU/ST=Samara/O=Promsensor/CN=client1/emailAddress=n.bil@promsensor.ru
Wed Oct 23 12:47:20 2013 us=791000 192.168.1.1:56949 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Oct 23 12:47:20 2013 us=791000 192.168.1.1:56949 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 23 12:47:20 2013 us=791000 192.168.1.1:56949 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Oct 23 12:47:20 2013 us=791000 192.168.1.1:56949 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 23 12:47:21 2013 us=181000 192.168.1.1:56949 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Oct 23 12:47:21 2013 us=181000 192.168.1.1:56949 [client1] Peer Connection Initiated with 192.168.1.1:56949
Wed Oct 23 12:47:22 2013 us=679000 client1/192.168.1.1:56949 PUSH: Received control message: 'PUSH_REQUEST'
Wed Oct 23 12:47:22 2013 us=679000 client1/192.168.1.1:56949 SENT CONTROL [client1]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route-gateway 62.220.59.181,route-gateway 192.168.1.100,ping 10,ping-restart 120,ifconfig 192.168.1.240 255.255.255.0' (status=1)
Wed Oct 23 12:47:22 2013 us=881000 client1/192.168.1.1:56949 MULTI: Learn: 00:ff:e7:b0:24:e3 -> client1/192.168.1.1:56949

Remark:
log was got when a client connects from the LAN server openVPN. I guess outcoming packets don't go through router and come back to client along local net. If my computer is not placed in local net packets don't return to client and leave in local net. How can I decide this problem I don't know.

binx

in the server config string push "route-gateway 62.220.59.181" must be push "route-gateway 62.220.49.181"

binx

Server log

OpenVPN CLIENT LIST
Updated,Wed Oct 23 13:27:41 2013
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
client1,192.168.1.1:56949,177764,25440051,Wed Oct 23 12:47:19 2013
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
00:ff:e7:b0:24:e3,client1,192.168.1.1:56949,Wed Oct 23 13:26:54 2013
GLOBAL STATS
Max bcast/mcast queue length,1
END

binx

debbie10t wrote
binx wroteserver's config
server-bridge 192.168.1.100 255.255.255.0 192.168.1.240 192.168.1.254
The syntax for this cammand is as follows:
server-bridge {default gateway address of your server} {dhcp ip pool begin} {dhcp ip pool end}
Which, means that the first parameter is not the ip address of the server but of the server's default gateway. Use command prompt and enter "ipconfig /all" on the server and look for default gateway setting (almost certain to be 192.168.1.1 but that depends on your network setup)
binx wroteserver's config
push "route 192.168.1.0 255.255.255.0"
push "route-gateway 62.220.59.181"
These are not required for bridge mode and, as per the next comment, not required at all if the machines are on the same LAN.
binx wrotelogs of server
Wed Oct 23 12:47:21 2013 us=181000 192.168.1.1:56949 [client1] Peer Connection Initiated with 192.168.1.1:56949
This suggests your server and client are on the same LAN in which case bridging will not work. You can change to tun for testing as tun will work with devices located on the same LAN. However, this is not related to your port forwarding problem so do not change it for now.

binx wroteRemark:
log was got when a client connects from the LAN server openVPN. I guess outcoming packets don't go through router and come back to client along local net. If my computer is not placed in local net packets don't return to client and leave in local net. How can I decide this problem I don't know.
Your main problem was that you do not know if you have setup port forwarding correctly ? Double check your router settings . . .

Or you could use grc.com "Shield's up" [use google to find] to establish if you have successfully opened your port. The website is annoyingly confusing but you will get there eventually. When asked, enter 1194 (your port) and select "User specified custom port probe". There are other sites but that's the one I use.

The only real test I can see for you is to setup a client PC in a remote site and try to connect to your openvpn server. The settings in your configs should work, once you make the changes above if you have port forwarding of tcp 1194 setup correctly.

One final but very important point. On your server side LAN do NOT use 192.168.0.0 or 192.168.1.0 networks as they will almost certainly clash with your client. Recommended private LAN IP for you would be 192.168.88.0 for example. (netmask 255.255.255.0)

Thank you very much! I will try your tips.

binx

stop, but on the page http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html is that
"erver-bridge 192.168.8.4 255.255.255.0 192.168.8.128 192.168.8.254"

binx

probably I mistook in realising string server-bridge changing this expression as you say, I get correct network settings. In network connection tap was set up gateway it make me pleasure 🙂 Thank you for help

binx

Yes, it works properly now, thank you. OpenVPN is great software.

binx

excuse me, but I have question about spped. Speed of connection is not exceeded 500 kb/s, but speed of internet traffic 4 Mb/c.I tried to increase one, but I didn't have any result. I changed mtu, mss, have disabled comp-lzo. What can I do in this case?

binx

debbie10t wroteThe max speed of the TAP driver is 10mbit/sec which is 1.25MByte/sec and that is only if your have sufficiently fast system to support it, including both ends of your internet connection. Messing with MTU is very unlikely to help.

Ok, If I will use tun driver, can I get speed up?

binx

debbie10t wroteNot to my knowledge.

Ok, thank you for help.