Hi, I've just setup OpenVPN semi-successfully in a routing (not bridging) mode, single server-to-multiple-clients scenario. Both the server and the client instances connect fine, and from my client machine I can PING the private LAN address of the server machine. My problem is that I can't PING any other machine on that private LAN. I've followed every example, scrutinized every snippet I could find on the topic, but nothing is working. Here's my setup: My home network: 192.168.60.x My laptop: Windows 7 Pro, 192.168.60.100 My laptop's TAP adapter's name is "tap-bridge" My laptop is logged in with Administrator privileges Remote LAN's network: 192.168.1.x Remote machine (hosting OpenVPN Server): Windows XP Pro SP3, 192.168.1.22 Remote machine's TAP adapter's name is "tap-bridge" (not using Ethernet Bridging) Remote machine is logged in with Administrator privileges Remote machine's firewall: disabled Remote OpenVPN server's VPN subnet: 10.8.0.0/24 Remote LAN's router: D-Link DIR-651, LAN address: 192.168.1.254 Remote LAN's router static route entry: [list]Destination IP: 10.8.0.0 Netmask: 255.255.255.0 Gateway: 192.168.1.22 Metric: 1 Interface: WAN (this is the only option available in the drop-down list)[/list] My server config: [code]port 1194 proto udp dev tun dev-node tap-bridge ca ca.crt cert server.crt key server.key # This file should be kept secret dh dh1024.pem server 10.8.0.0 255.255.255.0 push "route 192.168.1.0 255.255.255.0" keepalive 10 120 status openvpn-status.log[/code] My client configuration: [code]client dev tun dev-node tap-bridge proto udp remote 1194 resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert client1.crt key client1.key status client-status.log verb 3 pull[/code] One thing I noticed that seemed odd was the status of the TAP adapter (when connected): it doesn't have an IP address of the remote LAN I'm supposed to be connected to. Here are the details of the adapter: [list]Description: TAP-Win32 Adapter V9 Physical Address: ‎00-FF-2A-FB-C2-80 DHCP Enabled: Yes IPv4 Address: 10.8.0.6 IPv4 Subnet Mask: 255.255.255.252 Lease Obtained: Friday, December 13, 2013 3:31:21 PM Lease Expires: Saturday, December 13, 2014 3:31:21 PM IPv4 Default Gateway: IPv4 DHCP Server: 10.8.0.5 IPv4 DNS Server: IPv4 WINS Server: NetBIOS over Tcpip Enabled: Yes IPv6 Address: 2620:9b::19be:7fb0 Link-local IPv6 Address: fe80::48ac:c6d4:b164:abc8%27 IPv6 Default Gateway: 2620:9b::1900:1 IPv6 DNS Servers: fec0:0:0:ffff::1%1, fec0:0:0:ffff::2%1, fec0:0:0:ffff::3%1[/list] Another thing I noticed was an error in the system log of the remote server with the title "dhcp" and the message: "The IP address lease 10.8.0.1 for the Network Card with network address 00FFF7F1B8F4 has been denied by the DHCP server 10.8.0.2 (The DHCP Server sent a DHCPNACK message)." (Side note: I realize that if I were to use Ethernet Bridging then I would automatically have access to all remote LAN machines, but this isn't an option in my situation.) What am I missing? Thanks for any and all help.

Can PING Server Machine; Cannot PING Other Machines

a011011011

Hi,
I've just setup OpenVPN semi-successfully in a routing (not bridging) mode, single server-to-multiple-clients scenario. Both the server and the client instances connect fine, and from my client machine I can PING the private LAN address of the server machine. My problem is that I can't PING any other machine on that private LAN. I've followed every example, scrutinized every snippet I could find on the topic, but nothing is working.

Here's my setup:
My home network: 192.168.60.x
My laptop: Windows 7 Pro, 192.168.60.100
My laptop's TAP adapter's name is "tap-bridge"
My laptop is logged in with Administrator privileges
Remote LAN's network: 192.168.1.x
Remote machine (hosting OpenVPN Server): Windows XP Pro SP3, 192.168.1.22
Remote machine's TAP adapter's name is "tap-bridge" (not using Ethernet Bridging)
Remote machine is logged in with Administrator privileges
Remote machine's firewall: disabled
Remote OpenVPN server's VPN subnet: 10.8.0.0/24
Remote LAN's router: D-Link DIR-651, LAN address: 192.168.1.254
Remote LAN's router static route entry:

Destination IP: 10.8.0.0
Netmask: 255.255.255.0
Gateway: 192.168.1.22
Metric: 1
Interface: WAN (this is the only option available in the drop-down list)

My server config:

port 1194
proto udp
dev tun
dev-node tap-bridge
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"
keepalive 10 120
status openvpn-status.log

My client configuration:

client
dev tun
dev-node tap-bridge
proto udp
remote <<snip>> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
status client-status.log
verb 3
pull

One thing I noticed that seemed odd was the status of the TAP adapter (when connected): it doesn't have an IP address of the remote LAN I'm supposed to be connected to. Here are the details of the adapter:

Description: TAP-Win32 Adapter V9
Physical Address: ‎00-FF-2A-FB-C2-80
DHCP Enabled: Yes
IPv4 Address: 10.8.0.6
IPv4 Subnet Mask: 255.255.255.252
Lease Obtained: Friday, December 13, 2013 3:31:21 PM
Lease Expires: Saturday, December 13, 2014 3:31:21 PM
IPv4 Default Gateway:
IPv4 DHCP Server: 10.8.0.5
IPv4 DNS Server:
IPv4 WINS Server:
NetBIOS over Tcpip Enabled: Yes
IPv6 Address: 2620:9b::19be:7fb0
Link-local IPv6 Address: fe80::48ac:c6d4:b164:abc8%27
IPv6 Default Gateway: 2620:9b::1900:1
IPv6 DNS Servers: fec0:0:0:ffff::1%1, fec0:0:0:ffff::2%1, fec0:0:0:ffff::3%1

Another thing I noticed was an error in the system log of the remote server with the title "dhcp" and the message: "The IP address lease 10.8.0.1 for the Network Card with network address 00FFF7F1B8F4 has been denied by the DHCP server 10.8.0.2 (The DHCP Server sent a DHCPNACK message)."

(Side note: I realize that if I were to use Ethernet Bridging then I would automatically have access to all remote LAN machines, but this isn't an option in my situation.)

What am I missing?

Thanks for any and all help.

a011011011

Hi,

Yep, I've followed those examples, and a few more snippets I found on other OpenVPN.net pages.

I've enabled IP forwarding as per your suggestion and as per Microsoft's procedure, reconnected server and client, and it is still not working (i.e. I can ping the server machine at 192.168.1.22, but not another device at 192.168.1.20).

On the 2nd link you provided, there's some extra instructions:

Next, you must set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24) to the OpenVPN server (this is only necessary if the OpenVPN server and the LAN gateway are different machines).
Make sure that you've enabled IP and TUN/TAP forwarding on the OpenVPN server machine.

First, can you please clarify where exacly I set up this route? I've attempted to setup a route on my network's router (as listed in my original post), but am I supposed to be setting up a route on the server machine as well (or instead)?

Second, in addition to IP forwarding, what is "TUN/TAP forwarding" that it says I have to enable on the server machine?

Here are my logs:
Server:

Mon Dec 16 07:23:44 2013 OpenVPN 2.3.2 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Enter Management Password:
Mon Dec 16 07:23:45 2013 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Mon Dec 16 07:23:45 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Dec 16 07:23:45 2013 open_tun, tt->ipv6=0
Mon Dec 16 07:23:45 2013 TAP-WIN32 device [tap-bridge] opened: \\.\Global\{F7F1B8F4-41F3-450A-BDD8-9962EBC0809F}.tap
Mon Dec 16 07:23:45 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.1/255.255.255.252 on interface {F7F1B8F4-41F3-450A-BDD8-9962EBC0809F} [DHCP-serv: 10.8.0.2, lease-time: 31536000]
Mon Dec 16 07:23:45 2013 Sleeping for 10 seconds...
Mon Dec 16 07:23:55 2013 Successful ARP Flush on interface [65540] {F7F1B8F4-41F3-450A-BDD8-9962EBC0809F}
Mon Dec 16 07:23:55 2013 UDPv4 link local (bound): [undef]
Mon Dec 16 07:23:55 2013 UDPv4 link remote: [undef]
Mon Dec 16 07:23:55 2013 Initialization Sequence Completed
Mon Dec 16 07:24:01 2013 <<snip>>:57273 [client1] Peer Connection Initiated with [AF_INET]99.239.100.211:57273
Mon Dec 16 07:24:01 2013 client1/<<snip>>:57273 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Mon Dec 16 07:24:04 2013 client1/<<snip>>:57273 send_push_reply(): safe_cap=940

Client log:

Mon Dec 16 09:23:56 2013 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Mon Dec 16 09:23:56 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Dec 16 09:23:56 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Dec 16 09:23:56 2013 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Dec 16 09:23:56 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Dec 16 09:23:56 2013 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Mon Dec 16 09:23:56 2013 Local Options hash (VER=V4): '3514370b'
Mon Dec 16 09:23:56 2013 Expected Remote Options hash (VER=V4): '239669a8'
Mon Dec 16 09:23:56 2013 UDPv4 link local: [undef]
Mon Dec 16 09:23:56 2013 UDPv4 link remote: <<snip>>:1194
Mon Dec 16 09:23:56 2013 TLS: Initial packet from <<snip>>:1194, sid=6aeab10b b70ceb28
Mon Dec 16 09:23:57 2013 VERIFY OK: depth=1, /C=CA/ST=ON/L=Barrie/O=Truck_Wash_Technologies_Inc/OU=Controls/CN=Bruce/name=Bruce/emailAddress=bruce@truckwashtechnologies.com
Mon Dec 16 09:23:57 2013 VERIFY OK: depth=0, /C=CA/ST=ON/L=Barrie/O=Truck_Wash_Technologies_Inc/OU=Controls/CN=server/name=Bruce/emailAddress=bruce@truckwashtechnologies.com
Mon Dec 16 09:23:58 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Dec 16 09:23:58 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 16 09:23:58 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Dec 16 09:23:58 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 16 09:23:58 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon Dec 16 09:23:58 2013 [server] Peer Connection Initiated with <<snip>>:1194
Mon Dec 16 09:24:00 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Dec 16 09:24:00 2013 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Mon Dec 16 09:24:00 2013 OPTIONS IMPORT: timers and/or timeouts modified
Mon Dec 16 09:24:00 2013 OPTIONS IMPORT: --ifconfig/up options modified
Mon Dec 16 09:24:00 2013 OPTIONS IMPORT: route options modified
Mon Dec 16 09:24:00 2013 ROUTE default_gateway=192.168.60.1
Mon Dec 16 09:24:00 2013 TAP-WIN32 device [tap-bridge] opened: \\.\Global\{2AFBC280-F26B-4104-BE67-9098758172DB}.tap
Mon Dec 16 09:24:00 2013 TAP-Win32 Driver Version 9.9 
Mon Dec 16 09:24:00 2013 TAP-Win32 MTU=1500
Mon Dec 16 09:24:00 2013 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {2AFBC280-F26B-4104-BE67-9098758172DB} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Mon Dec 16 09:24:00 2013 Successful ARP Flush on interface [27] {2AFBC280-F26B-4104-BE67-9098758172DB}
Mon Dec 16 09:24:05 2013 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Mon Dec 16 09:24:05 2013 C:\WINDOWS\system32\route.exe ADD 192.168.1.0 MASK 255.255.255.0 10.8.0.5
Mon Dec 16 09:24:05 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Mon Dec 16 09:24:05 2013 Route addition via IPAPI succeeded [adaptive]
Mon Dec 16 09:24:05 2013 C:\WINDOWS\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Mon Dec 16 09:24:05 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Mon Dec 16 09:24:05 2013 Route addition via IPAPI succeeded [adaptive]
Mon Dec 16 09:24:05 2013 Initialization Sequence Completed

Thanks

a011011011

Ok, then the route that I've setup in my router:

Destination IP: 10.8.0.0
Netmask: 255.255.255.0
Gateway: 192.168.1.22
Metric: 1
Interface: WAN (this is the only option available in the drop-down list)

... does it look correct (according to my setup in the original post)?

a011011011

That's what I suspected.
So essentially what I'm trying to achieve is never going to work until I install a different router that has better routing options?