[Solved] Unable to access intranet when accessed via OpenVPN

ukgeorge

I have a intranet (wiki) that I would like to access via OpenVPN running on my Synology NAS
http://serverName/wiki/Main_Page.
If I connect via VPN to my network my browser reports that the internal webpage is not available.

For Reference:

- Interestingly the external website 'is' accessible over the VPN connection. Normally this would direct me to the router if I tried to access it internally.
- If I enter the ip address directly ( http://192.168.1.xxx/wiki/Main_page) I get the same result i.e no access.
- I can access my local network via my the Tunnelblick OpenVPN client and access shared directories
- Web browsing is routed through my network, i.e my ip address changes when i go through VPN.
- I can ping the local machines both by ip address and machinename.local from a terminal

If I try to enter a local ip address in my browser though it can't find the the page. As I understand it the dhcp-option DNS entry relates to the local IP address on the server side.

**OpenVPN client configuration:**

    dev tun
    tls-client

    remote www.mywebsite.com 1194

    #float

    redirect-gateway

    # dhcp-option DNS: To set primary domain name server address.
    #192.168.1.1 is the local ip address of my router
    dhcp-option DNS 192.168.1.1

    pull

    proto udp
    script-security 2

    ca ca.crt

    comp-lzo

    reneg-sec 0

    auth-user-pass

**OpenVPN Server Configuration**

    dev tun

    management 127.0.0.1 1195

    server 10.8.0.0 255.255.255.0

    push "route 10.8.0.0 255.255.255.0"

    dh /var/packages/VPNCenter/target/etc/openvpn/keys/dh1024.pem
    ca /var/packages/VPNCenter/target/etc/openvpn/keys/ca.crt
    cert /var/packages/VPNCenter/target/etc/openvpn/keys/server.crt
    key /var/packages/VPNCenter/target/etc/openvpn/keys/server.key

    
    comp-lzo

    persist-tun
    persist-key

    verb 3

    #log-append /var/log/openvpn.log

    keepalive 10 60
    reneg-sec 0

    plugin /var/packages/VPNCenter/target/lib/radiusplugin.so /var/packages/VPNCenter/target
    client-cert-not-required
    username-as-common-name
    duplicate-cn

I also tried adding push "dhcp-option DNS 192.168.1.1" to the server configuration but this did not appear to alter any behaviour.

From the docs it says The OpenVPN server machine may need to NAT or bridge the TUN interface to the internet in order for this to work properly but I'm not sure if this is the issue or what particularly is involved.

Any advise gratefully received.

Thanks

ukgeorge

Thanks. I've included a server and client log

Server Log

Tue Nov 19 00:07:27 2013 OpenVPN 2.1.4 i686-linux-gnu [SSL] [LZO2] [EPOLL] built on May 31 2013                                                                                                                                                   
Tue Nov 19 00:07:27 2013 MANAGEMENT: TCP Socket listening on 127.0.0.1:1195                                                                                                                                                                       
Tue Nov 19 00:07:27 2013 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.                                                
Tue Nov 19 00:07:27 2013 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafe
Tue Nov 19 00:07:27 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables                                                                                                                   
Tue Nov 19 00:07:27 2013 RADIUS-PLUGIN: Configfile name: /var/packages/VPNCenter/target/etc/openvpn/radiusplugin.cnf.                                                                                                                             
Tue Nov 19 00:07:27 2013 PLUGIN_INIT: POST /var/packages/VPNCenter/target/lib/radiusplugin.so '[/var/packages/VPNCenter/target/lib/radiusplugin.so] [/var/packages/VPNCenter/target/etc/openvpn/radiusplugin.cnf]' intercepted=PLUGIN_AUTH_USER_PA
Tue Nov 19 00:07:27 2013 Diffie-Hellman initialized with 1024 bit key                                                                                                                                                                             
Tue Nov 19 00:07:27 2013 WARNING: POTENTIALLY DANGEROUS OPTION --client-cert-not-required may accept clients which do not present a certificate                                                                                                   
Tue Nov 19 00:07:27 2013 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]                                                                                                                                                                 
Tue Nov 19 00:07:27 2013 Socket Buffers: R=[229376->131072] S=[229376->131072]                                                                                                                                                                    
Tue Nov 19 00:07:27 2013 ROUTE default_gateway=192.168.1.1                                                                                                                                                                                        
Tue Nov 19 00:07:27 2013 TUN/TAP device tun0 opened                                                                                                                                                                                               
Tue Nov 19 00:07:27 2013 TUN/TAP TX queue length set to 100                                                                                                                                                                                       
Tue Nov 19 00:07:27 2013 /sbin/ifconfig tun0 10.0.0.1 pointopoint 10.0.0.2 mtu 1500                                                                                                                                                               
Tue Nov 19 00:07:27 2013 /sbin/route add -net 10.0.0.0 netmask 255.255.255.0 gw 10.0.0.2                                                                                                                                                          
Tue Nov 19 00:07:27 2013 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]                                                                                                                                                   
Tue Nov 19 00:07:27 2013 UDPv4 link local (bound): [undef]:1194                                                                                                                                                                                   
Tue Nov 19 00:07:27 2013 UDPv4 link remote: [undef]                                                                                                                                                                                               
Tue Nov 19 00:07:27 2013 MULTI: multi_init called, r=256 v=256                                                                                                                                                                                    
Tue Nov 19 00:07:27 2013 IFCONFIG POOL: base=10.0.0.4 size=62                                                                                                                                                                                     
Tue Nov 19 00:07:27 2013 Initialization Sequence Completed                                                                                                                                                                                        
Tue Nov 19 00:08:46 2013 MULTI: multi_create_instance called                                                                                                                                                                                      
Tue Nov 19 00:08:46 2013 94.196.249.200:1194 Re-using SSL/TLS context                                                                                                                                                                             
Tue Nov 19 00:08:46 2013 94.196.249.200:1194 LZO compression initialized                                                                                                                                                                          
Tue Nov 19 00:08:46 2013 94.196.249.200:1194 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]                                                                                                                                      
Tue Nov 19 00:08:46 2013 94.196.249.200:1194 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]                                                                                                                               
Tue Nov 19 00:08:46 2013 94.196.249.200:1194 Local Options hash (VER=V4): '530fdded'                                                                                                                                                              
Tue Nov 19 00:08:46 2013 94.196.249.200:1194 Expected Remote Options hash (VER=V4): '41690919'                                                                                                                                                    
Tue Nov 19 00:08:46 2013 94.196.249.200:1194 TLS: Initial packet from 94.196.249.200:1194, sid=c471867a 9080ed2c                                                                                                                                  
Tue Nov 19 00:09:00 2013 RADIUS-PLUGIN: FOREGROUND THREAD: Auth_user_pass_verify thread started.                                                                                                                                                  
Tue Nov 19 00:09:00 2013 RADIUS-PLUGIN: FOREGROUND THREAD: New user.                                                                                                                                                                              
Tue Nov 19 00:09:00 2013 RADIUS-PLUGIN: No attributes Acct Interim Interval or bad length.                                                                                                                                                        
Tue Nov 19 00:09:00 2013 RADIUS-PLUGIN: Client config file was not written, overwriteccfiles is false                                                                                                                                             
.Tue Nov 19 00:09:00 2013 RADIUS-PLUGIN: FOREGROUND THREAD: Add user to map.                                                                                                                                                                      
Tue Nov 19 00:09:00 2013 94.196.249.200:1194 PLUGIN_CALL: POST /var/packages/VPNCenter/target/lib/radiusplugin.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0                                                                                           
Tue Nov 19 00:09:00 2013 94.196.249.200:1194 TLS: Username/Password authentication succeeded for username 'steve' [CN SET]                                                                                                                        
Tue Nov 19 00:09:00 2013 94.196.249.200:1194 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key                                                                                                                                   
Tue Nov 19 00:09:00 2013 94.196.249.200:1194 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication                                                                                                                      
Tue Nov 19 00:09:00 2013 94.196.249.200:1194 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key                                                                                                                                   
Tue Nov 19 00:09:00 2013 94.196.249.200:1194 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication                                                                                                                      
Tue Nov 19 00:09:02 2013 94.196.249.200:1194 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA                                                                                                                                        
Tue Nov 19 00:09:02 2013 94.196.249.200:1194 [steve] Peer Connection Initiated with 94.196.249.200:1194                                                                                                                                           
Tue Nov 19 00:09:02 2013 steve/94.196.249.200:1194 PLUGIN_CALL: POST /var/packages/VPNCenter/target/lib/radiusplugin.so/PLUGIN_CLIENT_CONNECT status=0                                                                                            
Tue Nov 19 00:09:02 2013 steve/94.196.249.200:1194 MULTI: Learn: 10.0.0.6 -> steve/94.196.249.200:1194                                                                                                                                            
Tue Nov 19 00:09:02 2013 steve/94.196.249.200:1194 MULTI: primary virtual IP for steve/94.196.249.200:1194: 10.0.0.6                                                                                                                              
Tue Nov 19 00:09:04 2013 steve/94.196.249.200:1194 PUSH: Received control message: 'PUSH_REQUEST'                                                                                                                                                 
Tue Nov 19 00:09:04 2013 steve/94.196.249.200:1194 SENT CONTROL [steve]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 10.0.0.0 255.255.255.0,route 10.0.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.0.0.6 10.0.0.5' (status=1)    
Tue Nov 19 00:09:16 2013 steve/94.196.249.200:1194 Replay-window backtrack occurred [1]                                                                                                                                                           
Tue Nov 19 00:10:05 2013 steve/94.196.249.200:1194 Replay-window backtrack occurred [2]

Client log

Tue Nov 19 00:08:36 2013 OpenVPN 2.2.1 i386-apple-darwin10.8.0 [SSL] [LZO2] [PKCS11] [eurephia] built on Oct 25 2013
Tue Nov 19 00:08:36 2013 MANAGEMENT: TCP Socket listening on 127.0.0.1:1337
Tue Nov 19 00:08:36 2013 Need hold release from management interface, waiting...
Tue Nov 19 00:08:36 2013 MANAGEMENT: Client connected from 127.0.0.1:1337
Tue Nov 19 00:08:36 2013 MANAGEMENT: CMD 'pid'
Tue Nov 19 00:08:36 2013 MANAGEMENT: CMD 'state on'
Tue Nov 19 00:08:36 2013 MANAGEMENT: CMD 'state'
Tue Nov 19 00:08:36 2013 MANAGEMENT: CMD 'bytecount 1'
Tue Nov 19 00:08:36 2013 MANAGEMENT: CMD 'hold release'
Tue Nov 19 00:08:43 2013 MANAGEMENT: CMD 'username "Auth" "steve"'
Tue Nov 19 00:08:43 2013 MANAGEMENT: CMD 'password [...]'
Tue Nov 19 00:08:43 2013 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Tue Nov 19 00:08:43 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Tue Nov 19 00:08:43 2013 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue Nov 19 00:08:43 2013 LZO compression initialized
Tue Nov 19 00:08:43 2013 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Nov 19 00:08:43 2013 Socket Buffers: R=[196724->65536] S=[9216->65536]
Tue Nov 19 00:08:43 2013 MANAGEMENT: >STATE:1384819723,RESOLVE,,,
Tue Nov 19 00:08:46 2013 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Nov 19 00:08:46 2013 Local Options hash (VER=V4): '41690919'
Tue Nov 19 00:08:46 2013 Expected Remote Options hash (VER=V4): '530fdded'
Tue Nov 19 00:08:46 2013 UDPv4 link local (bound): [undef]:1194
Tue Nov 19 00:08:46 2013 UDPv4 link remote: 81.86.xxx.xxx:1194
Tue Nov 19 00:08:46 2013 MANAGEMENT: >STATE:1384819726,WAIT,,,
Tue Nov 19 00:08:48 2013 MANAGEMENT: >STATE:1384819728,AUTH,,,
Tue Nov 19 00:08:48 2013 TLS: Initial packet from 81.86.xxx.xxx:1194, sid=b3d1e6a1 3ebda266
Tue Nov 19 00:08:48 2013 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Nov 19 00:08:59 2013 VERIFY OK: depth=1, /C=TW/ST=Taiwan/L=Taipei/O=Synology_Inc./OU=Certificate_Authority/CN=Synology_Inc._CA/emailAddress=product@synology.com
Tue Nov 19 00:08:59 2013 VERIFY OK: depth=0, /C=TW/ST=Taiwan/L=Taipei/O=Synology_Inc./OU=FTP_Team/CN=synology.com/emailAddress=product@synology.com
Tue Nov 19 00:09:02 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Nov 19 00:09:02 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Nov 19 00:09:02 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Nov 19 00:09:02 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Nov 19 00:09:02 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Nov 19 00:09:02 2013 [synology.com] Peer Connection Initiated with 81.86.xxx.xxx:1194
Tue Nov 19 00:09:03 2013 MANAGEMENT: >STATE:1384819743,GET_CONFIG,,,
Tue Nov 19 00:09:04 2013 SENT CONTROL [synology.com]: 'PUSH_REQUEST' (status=1)
Tue Nov 19 00:09:04 2013 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 10.0.0.0 255.255.255.0,route 10.0.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.0.0.6 10.0.0.5'
Tue Nov 19 00:09:04 2013 OPTIONS IMPORT: timers and/or timeouts modified
Tue Nov 19 00:09:04 2013 OPTIONS IMPORT: --ifconfig/up options modified
Tue Nov 19 00:09:04 2013 OPTIONS IMPORT: route options modified
Tue Nov 19 00:09:04 2013 ROUTE default_gateway=192.168.1.1
Tue Nov 19 00:09:04 2013 TUN/TAP device /dev/tun0 opened
Tue Nov 19 00:09:04 2013 MANAGEMENT: >STATE:1384819744,ASSIGN_IP,,10.0.0.6,
Tue Nov 19 00:09:04 2013 /sbin/ifconfig tun0 delete
ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
Tue Nov 19 00:09:04 2013 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
Tue Nov 19 00:09:04 2013 /sbin/ifconfig tun0 10.0.0.6 10.0.0.5 mtu 1500 netmask 255.255.255.255 up
Tue Nov 19 00:09:04 2013 /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw tun0 1500 1542 10.0.0.6 10.0.0.5 init
Tue Nov 19 00:09:08 2013 /sbin/route add -net 81.86.xxx.xxx 192.168.1.1 255.255.255.255
add net 81.86.xxx.xxx: gateway 192.168.1.1
Tue Nov 19 00:09:08 2013 /sbin/route delete -net 0.0.0.0 192.168.1.1 0.0.0.0
delete net 0.0.0.0: gateway 192.168.1.1
Tue Nov 19 00:09:08 2013 /sbin/route add -net 0.0.0.0 10.0.0.5 0.0.0.0
add net 0.0.0.0: gateway 10.0.0.5
Tue Nov 19 00:09:08 2013 MANAGEMENT: >STATE:1384819748,ADD_ROUTES,,,
Tue Nov 19 00:09:08 2013 /sbin/route add -net 192.168.1.0 10.0.0.5 255.255.255.0
route: writing to routing socket: File exists
add net 192.168.1.0: gateway 10.0.0.5: File exists
Tue Nov 19 00:09:08 2013 WARNING: potential route subnet conflict between local LAN [10.0.0.0/255.255.255.0] and remote VPN [10.0.0.0/255.255.255.0]
Tue Nov 19 00:09:08 2013 /sbin/route add -net 10.0.0.0 10.0.0.5 255.255.255.0
add net 10.0.0.0: gateway 10.0.0.5
Tue Nov 19 00:09:08 2013 WARNING: potential route subnet conflict between local LAN [10.0.0.0/255.255.255.0] and remote VPN [10.0.0.1/255.255.255.255]
Tue Nov 19 00:09:08 2013 /sbin/route add -net 10.0.0.1 10.0.0.5 255.255.255.255
add net 10.0.0.1: gateway 10.0.0.5
Tue Nov 19 00:09:08 2013 Initialization Sequence Completed
Tue Nov 19 00:09:08 2013 MANAGEMENT: >STATE:1384819748,CONNECTED,SUCCESS,10.0.0.6,81.86.xxx.xxx

ukgeorge

Following the advise in the log I moved my subnet off 192.168.0.x which solved the issue for me. I was using a USB 3G stick which was using the same subnet. A good lesson to following what it says in the log