Cannot ping DHCP server,connection is established w/o errors

jj12

Hi Everyone, I am unable to set up openvpn on two windows machines and any help would be appreciated.

I am using the sample configuration files and I have only modified the ip address. I have disabled the windows firewall as the logs show the port 1194 is open. I have also disabled the antivirus and I tried it both by having the client and server on the same local network and with port forwarding with the client connecting remotely. I am attaching detailed log files including the openvpn console output from both the client and the server. I have attached the result of the route command on both the client and server.

When I open network connections the open vpn adapter shows up as:
Local Area Connection
Unidentified network
TAP-Windows Adapter - V9
on both machines.

The server has:
IP address 10.8.0.1
DHCP server 10.8.0.2
The client has:
IP address 10.8.0.6
DHCP server 10.8.0.5

The strange part is that I cannot ping the DHCP ip of the client from the client or the DHCP ip of the server from the server. I obviously cannot ping the client from the server or the server from the client. In the route table the DHCP is the gateway.

I tried the following pings:
client -> 10.8.0.1 = Request timed out
client -> 10.8.0.6 = success
client -> 10.8.0.5 = Request timed out
client -> 10.8.0.2 = Request timed out
Similarly the server only works when pinging itself.

Here is a drop box line (with txt files from the console output and the ovpn config files)
As you can see everything the connection is established without any errors. I am running the command prompt with administrator privileges.
https://www.dropbox.com/sh/vvbinqqqc1c2r6v/YPO7doDko9

jj12

Thanks for the reply.

I have tried it with disabled Windows firewall on both computers and disabled antivirus. My router is linksys wrt54gl with stock firmware and the port is open.

jj12

The weird thing is that I think I should be able to ping 10.8.0.2 (the server TAP adapter DHCP server) even before establishing connection. I can see in the route table that this address is my gateway to 10.8.0.0/24 so I think this is the reason why everything fails.

You should be able to ping this address right?

I am including the configs, connection log, and the route command input with comments redacted, below.

server config
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun

client config
client
dev tun
proto udp
remote 92.247.58.12 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
comp-lzo
verb 3

server connection log
C:\Program Files\OpenVPN\sample-config>openvpn "my server.ovpn"
Wed Nov 13 13:32:00 2013 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Wed Nov 13 13:32:00 2013 Diffie-Hellman initialized with 1024 bit key
Wed Nov 13 13:32:00 2013 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Nov 13 13:32:00 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Nov 13 13:32:00 2013 open_tun, tt->ipv6=0
Wed Nov 13 13:32:00 2013 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{536B08FD-8E6C-4A3A-98CD-FF82F2D121A7}.tap
Wed Nov 13 13:32:00 2013 TAP-Windows Driver Version 9.9
Wed Nov 13 13:32:00 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.1/255.255.255.252 on interface {536B08FD-8E6C-4A3A-98CD-FF82F2D121A7} [DHCP-serv: 10.8.0.2, lease-time: 31536000]
Wed Nov 13 13:32:00 2013 Sleeping for 10 seconds...
Wed Nov 13 13:32:10 2013 Successful ARP Flush on interface [29] {536B08FD-8E6C-4A3A-98CD-FF82F2D121A7}
Wed Nov 13 13:32:10 2013 C:\WINDOWS\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.2
Wed Nov 13 13:32:10 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Wed Nov 13 13:32:10 2013 Route addition via IPAPI succeeded [adaptive]
Wed Nov 13 13:32:10 2013 UDPv4 link local (bound): [undef]
Wed Nov 13 13:32:10 2013 UDPv4 link remote: [undef]
Wed Nov 13 13:32:10 2013 MULTI: multi_init called, r=256 v=256
Wed Nov 13 13:32:10 2013 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Wed Nov 13 13:32:10 2013 ifconfig_pool_read(), in='client1,10.8.0.4', TODO: IPv6
Wed Nov 13 13:32:10 2013 succeeded -> ifconfig_pool_set()
Wed Nov 13 13:32:10 2013 IFCONFIG POOL LIST
Wed Nov 13 13:32:10 2013 client1,10.8.0.4
Wed Nov 13 13:32:10 2013 Initialization Sequence Completed
Wed Nov 13 13:33:12 2013 92.247.61.227:58066 TLS: Initial packet from [AF_INET]92.247.61.227:58066, sid=f9a769b1 386f975e
Wed Nov 13 13:33:12 2013 92.247.61.227:58066 VERIFY OK: depth=1, C=BG, ST=Sofia, L=Sofia, O=TrdInc, OU=changeme, CN=server, name=server, emailAddress=zhivkogp@gmail.com
Wed Nov 13 13:33:12 2013 92.247.61.227:58066 VERIFY OK: depth=0, C=BG, ST=Sofia, L=Sofia, O=TrdInc, OU=changeme, CN=client1, name=client1, emailAddress=zhivkogp@gmail.com
Wed Nov 13 13:33:12 2013 92.247.61.227:58066 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov 13 13:33:12 2013 92.247.61.227:58066 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov 13 13:33:12 2013 92.247.61.227:58066 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov 13 13:33:12 2013 92.247.61.227:58066 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov 13 13:33:12 2013 92.247.61.227:58066 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Nov 13 13:33:12 2013 92.247.61.227:58066 [client1] Peer Connection Initiated with [AF_INET]92.247.61.227:58066
Wed Nov 13 13:33:12 2013 client1/92.247.61.227:58066 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Wed Nov 13 13:33:12 2013 client1/92.247.61.227:58066 MULTI: Learn: 10.8.0.6 -> client1/92.247.61.227:58066
Wed Nov 13 13:33:12 2013 client1/92.247.61.227:58066 MULTI: primary virtual IP for client1/92.247.61.227:58066: 10.8.0.6
Wed Nov 13 13:33:14 2013 client1/92.247.61.227:58066 PUSH: Received control message: 'PUSH_REQUEST'
Wed Nov 13 13:33:14 2013 client1/92.247.61.227:58066 send_push_reply(): safe_cap=940
Wed Nov 13 13:33:14 2013 client1/92.247.61.227:58066 SENT CONTROL [client1]: 'PUSH_REPLY,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

client connection log
C:\Program Files\OpenVPN\sample-config>openvpn "my client.ovpn"
Wed Nov 13 13:33:14 2013 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Wed Nov 13 13:33:15 2013 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Nov 13 13:33:15 2013 UDPv4 link local: [undef]
Wed Nov 13 13:33:15 2013 UDPv4 link remote: [AF_INET]92.247.58.12:1194
Wed Nov 13 13:33:15 2013 TLS: Initial packet from [AF_INET]92.247.58.12:1194, sid=1bb2db14 e94b5312
Wed Nov 13 13:33:15 2013 VERIFY OK: depth=1, C=BG, ST=Sofia, L=Sofia, O=TrdInc, OU=changeme, CN=server, name=server, emailAddress=zhivkogp@gmail.com
Wed Nov 13 13:33:15 2013 VERIFY OK: nsCertType=SERVER
Wed Nov 13 13:33:15 2013 VERIFY OK: depth=0, C=BG, ST=Sofia, L=Sofia, O=TrdInc, OU=changeme, CN=server, name=server, emailAddress=zhivkogp@gmail.com
Wed Nov 13 13:33:15 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov 13 13:33:15 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov 13 13:33:15 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov 13 13:33:15 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov 13 13:33:15 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Nov 13 13:33:15 2013 [server] Peer Connection Initiated with [AF_INET]92.247.58.12:1194
Wed Nov 13 13:33:17 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Nov 13 13:33:17 2013 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Wed Nov 13 13:33:17 2013 OPTIONS IMPORT: timers and/or timeouts modified
Wed Nov 13 13:33:17 2013 OPTIONS IMPORT: --ifconfig/up options modified
Wed Nov 13 13:33:17 2013 OPTIONS IMPORT: route options modified
Wed Nov 13 13:33:17 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Nov 13 13:33:17 2013 open_tun, tt->ipv6=0
Wed Nov 13 13:33:17 2013 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{862F9A8F-333E-4D66-BCDD-69AD78B819F8}.tap
Wed Nov 13 13:33:17 2013 TAP-Windows Driver Version 9.9
Wed Nov 13 13:33:17 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {862F9A8F-333E-4D66-BCDD-69AD78B819F8} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Wed Nov 13 13:33:17 2013 Successful ARP Flush on interface [37] {862F9A8F-333E-4D66-BCDD-69AD78B819F8}
Wed Nov 13 13:33:22 2013 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Wed Nov 13 13:33:22 2013 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Wed Nov 13 13:33:22 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Wed Nov 13 13:33:22 2013 Route addition via IPAPI succeeded [adaptive]
Wed Nov 13 13:33:22 2013 Initialization Sequence Completed

server route command
===========================================================================
Interface List
29...00 ff 53 6b 08 fd ......TAP-Windows Adapter V9
3...90 2b 34 dd 74 c2 ......Qualcomm Atheros AR8161 PCI-E Gigabit Ethernet Controller (NDI
1...........................Software Loopback Interface 1
7...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
6...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.23.1 192.168.23.99 276
10.8.0.0 255.255.255.0 On-link 10.8.0.1 31
10.8.0.0 255.255.255.0 10.8.0.2 10.8.0.1 30
10.8.0.0 255.255.255.252 On-link 10.8.0.1 286
10.8.0.1 255.255.255.255 On-link 10.8.0.1 286
10.8.0.3 255.255.255.255 On-link 10.8.0.1 286
10.8.0.255 255.255.255.255 On-link 10.8.0.1 286
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.23.0 255.255.255.0 On-link 192.168.23.99 276
192.168.23.99 255.255.255.255 On-link 192.168.23.99 276
192.168.23.255 255.255.255.255 On-link 192.168.23.99 276
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.23.99 276
224.0.0.0 240.0.0.0 On-link 10.8.0.1 286
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.23.99 276
255.255.255.255 255.255.255.255 On-link 10.8.0.1 286

client route command

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.100.1 192.168.100.3 25
10.8.0.1 255.255.255.255 10.8.0.5 10.8.0.6 30
10.8.0.4 255.255.255.252 On-link 10.8.0.6 286
10.8.0.6 255.255.255.255 On-link 10.8.0.6 286
10.8.0.7 255.255.255.255 On-link 10.8.0.6 286
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.100.0 255.255.255.0 On-link 192.168.100.3 281
192.168.100.3 255.255.255.255 On-link 192.168.100.3 281
192.168.100.255 255.255.255.255 On-link 192.168.100.3 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.100.3 281
224.0.0.0 240.0.0.0 On-link 10.8.0.6 286
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.100.3 281
255.255.255.255 255.255.255.255 On-link 10.8.0.6 286
===========================================================================

jj12

Ok it is good to know that pinging the dhcp server ip shouldn't work.

The weird thing is that these configuration files are pretty much the sample configuration files with the server IP address added in. And it is really strange that it doesn't work on a local network with firewall turned off, while there are no error messages in the logs.

FWIW I am running the 64bit openvpn on Windows 8.1

rainbow6

Add the following to your client.conf

route-method exe
route 0.0.0.0 0.0.0.0

See if this helps.

jj12

I tried both suggestions with no luck.

I don't think it is an UAC issue since I don't get access denied like in the other thread. However I disabled UAC and tried it for the heck of it.

The route add lines didn't help either.

army153

I have EXACTLY the same problem. Almost identical config....

Which i got from here:
http://www.rosehosting.com/blog/openvpn-setup-script-for-debian-and-ubuntu/?replytocom=43489#respond

did you find any solution?

I added "topological subnet" to my config and that solves the ip and routing problem, as well as ping works now. However I still cannot connect to the internet. The routes are pointing in the right direction, and yes I have masqueraded+firewall is off on both server and client :?
Im running it on ubuntu 14.04, still with no luck after hours of trying!