Please help :-) I can connect to openvpn cant access any IP

alexvpn

Hi,
I have setup openvpn on my CentOS vmware machine. I have enabled promiscuous mode in Vmware.

I can connect to my openvpn however I cant ping the gateway, any machines on the lan, or the internet.

If you could help me fix, it would be much appreciated.

Here is my config:

servers has two nic's, eth0 192.168.0.9, and eth1 which is used as part of the bridge with the ip 192.168.0.5
the lan gateway is 192.168.0.1

server.conf


local 192.168.0.5
port 1194
proto udp
server-bridge 192.168.0.5 255.255.255.0 192.168.0.210 192.168.0.220
dev tap0
ca ca.crt
cert server.crt
tun-mtu 1454
key server.key
dh dh1024.pem
ifconfig-pool-persist ipp.txt
keepalive 10 600
comp-lzo
persist-key
persist-tun
verb 3
mute 20
status openvpn-status.log
client-to-client

openvpn-startup

#!/bin/bash

#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth1"
eth_ip="192.168.0.5"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.0.255"

for t in $tap; do
     /usr/sbin/openvpn --mktun --dev $t
done

brctl addbr $br
brctl addif $br $eth

for t in $tap; do
    brctl addif $br $t
done

for t in $tap; do
    ifconfig $t 0.0.0.0 promisc up
done

ifconfig $eth 0.0.0.0 promisc up

ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast

ifconfig -a

br0 Link encap:Ethernet HWaddr 00:0C:29:79:6A:5C
inet addr:192.168.0.5 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe79:6a5c/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:844 errors:0 dropped:0 overruns:0 frame:0
TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:110937 (108.3 KiB) TX bytes:468 (468.0 b)

eth0 Link encap:Ethernet HWaddr 00:0C:29:79:6A:52
inet addr:192.168.0.9 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe79:6a52/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:446501 errors:0 dropped:0 overruns:0 frame:0
TX packets:245638 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:587260208 (560.0 MiB) TX bytes:19540319 (18.6 MiB)

eth1 Link encap:Ethernet HWaddr 00:0C:29:79:6A:5C
inet6 addr: fe80::20c:29ff:fe79:6a5c/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:769641 errors:0 dropped:0 overruns:0 frame:0
TX packets:1164 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:629691064 (600.5 MiB) TX bytes:75160 (73.3 KiB)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:96 errors:0 dropped:0 overruns:0 frame:0
TX packets:96 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:11732 (11.4 KiB) TX bytes:11732 (11.4 KiB)

tap0 Link encap:Ethernet HWaddr 0E:B5:35:18:E1:9E
inet6 addr: fe80::cb5:35ff:fe18:e19e/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:422 errors:0 dropped:0 overruns:0 frame:0
TX packets:308 errors:0 dropped:3 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:73388 (71.6 KiB) TX bytes:18690 (18.2 KiB

On the client:

connection file

client
dev tap
proto udp
remote #my wan ip - removed#
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
<ca>
removed
</ca>
<cert>
removed
</cert>
<key>
removed
</key>

connection log

Wed Dec 25 18:39:16 2013 OpenVPN 2.3.2 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Wed Dec 25 18:39:16 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Dec 25 18:39:16 2013 Need hold release from management interface, waiting...
Wed Dec 25 18:39:16 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Dec 25 18:39:16 2013 MANAGEMENT: CMD 'state on'
Wed Dec 25 18:39:16 2013 MANAGEMENT: CMD 'log all on'
Wed Dec 25 18:39:16 2013 MANAGEMENT: CMD 'hold off'
Wed Dec 25 18:39:16 2013 MANAGEMENT: CMD 'hold release'
Wed Dec 25 18:39:16 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Dec 25 18:39:17 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Dec 25 18:39:17 2013 UDPv4 link local: [undef]
Wed Dec 25 18:39:17 2013 UDPv4 link remote: [AF_INET]#MY WAN IP REMOVED#:1194
Wed Dec 25 18:39:17 2013 MANAGEMENT: >STATE:1387996757,WAIT,,,
Wed Dec 25 18:39:17 2013 MANAGEMENT: >STATE:1387996757,AUTH,,,
Wed Dec 25 18:39:17 2013 TLS: Initial packet from [AF_INET]'wan ip removed#:1194, sid=659543cf 9f317a37
Wed Dec 25 18:39:17 2013 VERIFY OK: #cert details removed#
Wed Dec 25 18:39:17 2013 VERIFY OK: #cert details removed#
Wed Dec 25 18:39:18 2013 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1574', remote='link-mtu 1528'
Wed Dec 25 18:39:18 2013 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1532', remote='tun-mtu 1486'
Wed Dec 25 18:39:18 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Dec 25 18:39:18 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Dec 25 18:39:18 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Dec 25 18:39:18 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Dec 25 18:39:18 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Dec 25 18:39:18 2013 [server] Peer Connection Initiated with [AF_INET]#wan ip removed#:1194
Wed Dec 25 18:39:19 2013 MANAGEMENT: >STATE:1387996759,GET_CONFIG,,,
Wed Dec 25 18:39:21 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Dec 25 18:39:21 2013 PUSH: Received control message: 'PUSH_REPLY,route-gateway 192.168.0.5,ping 10,ping-restart 600,ifconfig 192.168.0.210 255.255.255.0'
Wed Dec 25 18:39:21 2013 OPTIONS IMPORT: timers and/or timeouts modified
Wed Dec 25 18:39:21 2013 OPTIONS IMPORT: --ifconfig/up options modified
Wed Dec 25 18:39:21 2013 OPTIONS IMPORT: route-related options modified
Wed Dec 25 18:39:21 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Dec 25 18:39:21 2013 MANAGEMENT: >STATE:1387996761,ASSIGN_IP,,192.168.0.210,
Wed Dec 25 18:39:21 2013 open_tun, tt->ipv6=0
Wed Dec 25 18:39:21 2013 TAP-WIN32 device [Local Area Connection 4] opened: \\.\Global\{2DC06B57-71CD-4A7D-AC28-0966177D94FE}.tap
Wed Dec 25 18:39:21 2013 TAP-Windows Driver Version 9.9 
Wed Dec 25 18:39:21 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.0.210/255.255.255.0 on interface {2DC06B57-71CD-4A7D-AC28-0966177D94FE} [DHCP-serv: 192.168.0.0, lease-time: 31536000]
Wed Dec 25 18:39:21 2013 Successful ARP Flush on interface [19] {2DC06B57-71CD-4A7D-AC28-0966177D94FE}
Wed Dec 25 18:39:26 2013 TEST ROUTES: 0/0 succeeded len=0 ret=1 a=0 u/d=up
Wed Dec 25 18:39:26 2013 Initialization Sequence Completed
Wed Dec 25 18:39:26 2013 MANAGEMENT: >STATE:1387996766,CONNECTED,SUCCESS,192.168.0.210,#MY WAN IP REMOVED#

ipconfig

C:\Users\Alex>ipconfig

Windows IP Configuration


Ethernet adapter Local Area Connection 4:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::c45d:518:9e83:a966%19
   IPv4 Address. . . . . . . . . . . : 192.168.0.210
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . :

Ethernet adapter Bluetooth Network Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Wireless LAN adapter Wireless Network Connection:

   Connection-specific DNS Suffix  . : lan
   Link-local IPv6 Address . . . . . : fe80::29ae:10f7:bd1f:f53f%11
   IPv4 Address. . . . . . . . . . . : 192.168.1.79
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.1.254

ping

C:\Users\Alex>ping 192.168.0.1

Pinging 192.168.0.1 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 192.168.0.1:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\Users\Alex>ping 192.168.0.210

Pinging 192.168.0.210 with 32 bytes of data:
Reply from 192.168.0.210: bytes=32 time<1ms TTL=128
Reply from 192.168.0.210: bytes=32 time<1ms TTL=128
Reply from 192.168.0.210: bytes=32 time<1ms TTL=128
Reply from 192.168.0.210: bytes=32 time<1ms TTL=128

Ping statistics for 192.168.0.210:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

C:\Users\Alex>ping 192.168.0.9

Pinging 192.168.0.9 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 192.168.0.9:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

Thanks for any help :-)

alexvpn

to add to this, when i try to ping the connected client from the server i get the following:

[root@netserv01 openvpn]# ping 192.168.0.210
PING 192.168.0.210 (192.168.0.210) 56(84) bytes of data.
From 192.168.0.9 icmp_seq=1 Destination Host Prohibited
From 192.168.0.9 icmp_seq=2 Destination Host Prohibited
From 192.168.0.9 icmp_seq=3 Destination Host Prohibited

alexvpn

Thanks I removed "tun-mtu 1454" from the server.conf and I am no longer getting the mtu error, however I still cant ping anything on that network including 192.168.0.5 (the vpn server).

Here is my new connection log:
Client:

Fri Dec 27 00:09:43 2013 OpenVPN 2.3.2 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Fri Dec 27 00:09:43 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Fri Dec 27 00:09:43 2013 Need hold release from management interface, waiting...
Fri Dec 27 00:09:49 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Fri Dec 27 00:09:49 2013 MANAGEMENT: CMD 'state on'
Fri Dec 27 00:09:49 2013 MANAGEMENT: CMD 'log all on'
Fri Dec 27 00:09:49 2013 MANAGEMENT: CMD 'hold off'
Fri Dec 27 00:09:49 2013 MANAGEMENT: CMD 'hold release'
Fri Dec 27 00:09:49 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Fri Dec 27 00:09:49 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Fri Dec 27 00:09:49 2013 UDPv4 link local: [undef]
Fri Dec 27 00:09:49 2013 UDPv4 link remote: [AF_INET]2.219.159.120:1194
Fri Dec 27 00:09:49 2013 MANAGEMENT: >STATE:1388102989,WAIT,,,
Fri Dec 27 00:09:50 2013 MANAGEMENT: >STATE:1388102990,AUTH,,,
Fri Dec 27 00:09:50 2013 TLS: Initial packet from [AF_INET]#wan ip removed#, sid=aa27d81a d4033728
Fri Dec 27 00:09:50 2013 VERIFY OK: #private removed#
Fri Dec 27 00:09:50 2013 VERIFY OK: #private removed#
Fri Dec 27 00:09:51 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Dec 27 00:09:51 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Dec 27 00:09:51 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Dec 27 00:09:51 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Dec 27 00:09:51 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Fri Dec 27 00:09:51 2013 [server] Peer Connection Initiated with [AF_INET]#wan ip removed#:1194
Fri Dec 27 00:09:52 2013 MANAGEMENT: >STATE:1388102992,GET_CONFIG,,,
Fri Dec 27 00:09:53 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Fri Dec 27 00:09:53 2013 PUSH: Received control message: 'PUSH_REPLY,route-gateway 192.168.0.5,ping 10,ping-restart 600,ifconfig 192.168.0.210 255.255.255.0'
Fri Dec 27 00:09:53 2013 OPTIONS IMPORT: timers and/or timeouts modified
Fri Dec 27 00:09:53 2013 OPTIONS IMPORT: --ifconfig/up options modified
Fri Dec 27 00:09:53 2013 OPTIONS IMPORT: route-related options modified
Fri Dec 27 00:09:53 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Dec 27 00:09:53 2013 MANAGEMENT: >STATE:1388102993,ASSIGN_IP,,192.168.0.210,
Fri Dec 27 00:09:53 2013 open_tun, tt->ipv6=0
Fri Dec 27 00:09:53 2013 TAP-WIN32 device [Local Area Connection 4] opened: \\.\Global\{2DC06B57-71CD-4A7D-AC28-0966177D94FE}.tap
Fri Dec 27 00:09:53 2013 TAP-Windows Driver Version 9.9 
Fri Dec 27 00:09:53 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.0.210/255.255.255.0 on interface {2DC06B57-71CD-4A7D-AC28-0966177D94FE} [DHCP-serv: 192.168.0.0, lease-time: 31536000]
Fri Dec 27 00:09:53 2013 Successful ARP Flush on interface [19] {2DC06B57-71CD-4A7D-AC28-0966177D94FE}
Fri Dec 27 00:09:58 2013 TEST ROUTES: 0/0 succeeded len=0 ret=1 a=0 u/d=up
Fri Dec 27 00:09:58 2013 Initialization Sequence Completed
Fri Dec 27 00:09:58 2013 MANAGEMENT: >STATE:1388102998,CONNECTED,SUCCESS,192.168.0.210,#wan ip removed#

Server:

[code]Dec 27 00:05:39 netserv01 kernel: device tap0 entered promiscuous mode
Dec 27 00:05:39 netserv01 kernel: br0: port 2(tap0) entering forwarding state
Dec 27 00:05:39 netserv01 kernel: br0: port 1(eth1) entering forwarding state
Dec 27 00:05:39 netserv01 openvpn[15323]: OpenVPN 2.3.2 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Sep 12 2013
Dec 27 00:05:39 netserv01 openvpn[15323]: NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Dec 27 00:05:39 netserv01 openvpn[15323]: NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Dec 27 00:05:39 netserv01 openvpn[15323]: Diffie-Hellman initialized with 1024 bit key
Dec 27 00:05:39 netserv01 openvpn[15323]: Socket Buffers: R=[229376->131072] S=[229376->131072]
Dec 27 00:05:39 netserv01 openvpn[15323]: TUN/TAP device tap0 opened
Dec 27 00:05:39 netserv01 openvpn[15323]: TUN/TAP TX queue length set to 100
Dec 27 00:05:39 netserv01 openvpn[15324]: UDPv4 link local (bound): [AF_INET]192.168.0.5:1194
Dec 27 00:05:39 netserv01 openvpn[15324]: UDPv4 link remote: [undef]
Dec 27 00:05:39 netserv01 openvpn[15324]: MULTI: multi_init called, r=256 v=256
Dec 27 00:05:39 netserv01 openvpn[15324]: IFCONFIG POOL: base=192.168.0.210 size=11, ipv6=0
Dec 27 00:05:39 netserv01 openvpn[15324]: ifconfig_pool_read(), in='laptop,192.168.0.210', TODO: IPv6
Dec 27 00:05:39 netserv01 openvpn[15324]: succeeded -> ifconfig_pool_set()
Dec 27 00:05:39 netserv01 openvpn[15324]: IFCONFIG POOL LIST
Dec 27 00:05:39 netserv01 openvpn[15324]: laptop,192.168.0.210
Dec 27 00:05:39 netserv01 openvpn[15324]: Initialization Sequence Completed
Dec 27 00:05:52 netserv01 openvpn[15324]: #wan ip#:52428 TLS: Initial packet from [AF_INET]#wan ip#:52428, sid=7c000377 dc0dd2ad
Dec 27 00:05:53 netserv01 openvpn[15324]: #wan ip#:52428 VERIFY OK: #private#
Dec 27 00:05:53 netserv01 openvpn[15324]: #wan ip#:52428 VERIFY OK: #private#
Dec 27 00:05:53 netserv01 openvpn[15324]: #wan ip#:52428 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Dec 27 00:05:53 netserv01 openvpn[15324]: #wan ip#:52428 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Dec 27 00:05:53 netserv01 openvpn[15324]: #wan ip#:52428 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Dec 27 00:05:53 netserv01 openvpn[15324]: #wan ip#:52428 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Dec 27 00:05:53 netserv01 openvpn[15324]: #wan ip#:52428 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Dec 27 00:05:53 netserv01 openvpn[15324]: #wan ip#:52428 [laptop] Peer Connection Initiated with [AF_INET]#wan ip#:52428
Dec 27 00:05:53 netserv01 openvpn[15324]: laptop/#wan ip#:52428 MULTI_sva: pool returned IPv4=192.168.0.210, IPv6=(Not enabled)
Dec 27 00:05:54 netserv01 kernel: br0: port 2(tap0) entering forwarding state
Dec 27 00:05:54 netserv01 kernel: br0: port 1(eth1) entering forwarding state
Dec 27 00:05:55 netserv01 openvpn[15324]: laptop/#wan ip#:52428 PUSH: Received control message: 'PUSH_REQUEST'
Dec 27 00:05:55 netserv01 openvpn[15324]: laptop/#wan ip#:52428 send_push_reply(): safe_cap=940
Dec 27 00:05:55 netserv01 openvpn[15324]: laptop/#wan ip#:52428 SENT CONTROL [laptop]: 'PUSH_REPLY,route-gateway 192.168.0.5,ping 10,ping-restart 600,ifconfig 192.168.0.210 255.255.255.0' (status=1)
Dec 27 00:05:56 netserv01 openvpn[15324]: laptop/#wan ip#:52428 MULTI: Learn: 00:ff:2d:c0:6b:57 -> laptop/#wan ip#:52428

[/code]

Thanks,
Alex

maikcat

just curious,

why do have 2 nics?

Michael.

alexvpn

I added an additional nic for the use of openvpn/bridging only.

I did not want the openvpn/bridging configuration to make me loose ability to ssh to the server on my the first NIC.