OPENVPN - Unable to connect to connect to remote subnet.

RKGD512

Hi,
This is my first time posting here and also my first time setting up OPENVPN.

I am setting up openvpn on a Linksys E3000 flashed with Firmware: DD-WRT v24-sp2 (08/12/10) mega. Some may recommend I upgrade but I would like to work on this version as it is live and we do not have much time to flash a new firmware.

Issue: Unable to ping the remote subnet when connected to VPN. From the CLI of the router I am also unable to ping my client IP (10.8.0.6) in my case.
Goal: To be able to ping back and forth, connect via RDP/CIFS, the whole 9, unrestricted connection.
So Far: Able to connect to the vpn. That's about it.
Troubleshooting Steps Taken: Read countless threads and tried many fixes which ultimately got me to the below configs. Tried Static Routing on the client machine. tried various routings on the DD-WRT Side. Tried turning off "SPI Firewall."

Any help would be greatly appreciated!

Office (Remote Subnet): 192.168.201.0/24
VPN Subnet (OPENVPN): 10.8.0.0/24
Home Subnet (Sure this doesn't matter much as long as its not the same as the Office Subnet): 192.168.1.0/24

Server Config:
push "route 192.168.201.0 255.255.255.0"
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.201.11"
push "dhcp-option DNS 8.8.8.8"
dev tun0
proto udp
port 5001
keepalive 10 120
daemon
verb 5
comp-lzo
client-to-client
duplicate-cn
cipher bf-cbc
auth sha1
tls-server
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
management localhost 5002

Client Config (client1.ovpn):
client
dev tun0
proto udp
remote 71.165.30.234 5001
resolv-retry infinite
nobind
persist-key
persist-tun
ns-cert-type server
comp-lzo
verb 3
float
tls-client
cipher bf-cbc
auth sha1
ca ca.crt
cert client1.crt
key client1.key

Firewall (IPTables):
iptables -I INPUT 1 -p udp --dport 5001 -j ACCEPT
iptables -I FORWARD 1 --source 10.8.0.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE

RKGD512

First, thanks for getting back to me. I agree, the issue i believe is related to either (Route or firewall).

I Omitted some info as its personal info. Also I changed the Real public ip of source of connection (Client side public ip) to 88.88.88.88, and the server side to 99.99.99.99

These logs are from /var/log/messages

Sorry Like I said, I am new to this so i think this is where the logs should be.

Jan 14 22:53:26 LaMirada-DDWRT daemon.err openvpn[8150]: read UDPv4 [ECONNREFUSED]: Connection refused (code=146)
Jan 14 22:53:36 LaMirada-DDWRT daemon.err openvpn[8150]: read UDPv4 [ECONNREFUSED]: Connection refused (code=146)
Jan 14 22:53:44 LaMirada-DDWRT daemon.notice openvpn[8150]: LaMirada-DDWRT/99.99.99.99:58737 [LaMirada-DDWRT] Inactivity timeout (--ping-restart), restarting
Jan 14 22:53:44 LaMirada-DDWRT daemon.notice openvpn[8150]: LaMirada-DDWRT/99.99.99.99:58737 SIGUSR1[soft,ping-restart] received, client-instance restarting
Jan 14 23:59:52 LaMirada-DDWRT user.debug syslog: ttraff: data for 14-1-2014 commited to nvram
Jan 15 06:49:54 LaMirada-DDWRT authpriv.info dropbear[8944]: exit after auth (root): error reading: Connection timed out
Jan 15 13:46:18 LaMirada-DDWRT authpriv.notice dropbear[23282]: password auth succeeded for 'root' from 88.88.88.88:55214
Jan 15 13:47:26 LaMirada-DDWRT daemon.notice openvpn[8150]: MULTI: multi_create_instance called
Jan 15 13:47:26 LaMirada-DDWRT daemon.notice openvpn[8150]: 88.88.88.88:61854 Re-using SSL/TLS context
Jan 15 13:47:26 LaMirada-DDWRT daemon.notice openvpn[8150]: 88.88.88.88:61854 LZO compression initialized
Jan 15 13:47:26 LaMirada-DDWRT daemon.notice openvpn[8150]: 88.88.88.88:61854 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Jan 15 13:47:26 LaMirada-DDWRT daemon.notice openvpn[8150]: 88.88.88.88:61854 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Jan 15 13:47:26 LaMirada-DDWRT daemon.notice openvpn[8150]: 88.88.88.88:61854 TLS: Initial packet from 88.88.88.88:61854, sid=3a48a332 9232c38d
Jan 15 13:47:26 LaMirada-DDWRT daemon.notice openvpn[8150]: 88.88.88.88:61854 VERIFY OK: depth=1, OMITTED INFO By me
Jan 15 13:47:26 LaMirada-DDWRT daemon.notice openvpn[8150]: 88.88.88.88:61854 VERIFY OK: depth=0, OMITTED INFO By me
Jan 15 13:47:27 LaMirada-DDWRT daemon.notice openvpn[8150]: 88.88.88.88:61854 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Jan 15 13:47:27 LaMirada-DDWRT daemon.notice openvpn[8150]: 88.88.88.88:61854 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Jan 15 13:47:27 LaMirada-DDWRT daemon.notice openvpn[8150]: 88.88.88.88:61854 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Jan 15 13:47:27 LaMirada-DDWRT daemon.notice openvpn[8150]: 88.88.88.88:61854 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Jan 15 13:47:27 LaMirada-DDWRT daemon.notice openvpn[8150]: 88.88.88.88:61854 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Jan 15 13:47:27 LaMirada-DDWRT daemon.notice openvpn[8150]: 88.88.88.88:61854 [LaMirada-DDWRT] Peer Connection Initiated with 88.88.88.88:61854
Jan 15 13:47:27 LaMirada-DDWRT daemon.notice openvpn[8150]: LaMirada-DDWRT/88.88.88.88:61854 MULTI: Learn: 10.8.0.6 -> LaMirada-DDWRT/88.88.88.88:61854
Jan 15 13:47:27 LaMirada-DDWRT daemon.notice openvpn[8150]: LaMirada-DDWRT/88.88.88.88:61854 MULTI: primary virtual IP for LaMirada-DDWRT/88.88.88.88:61854: 10.8.0.6
Jan 15 13:47:29 LaMirada-DDWRT daemon.notice openvpn[8150]: LaMirada-DDWRT/88.88.88.88:61854 PUSH: Received control message: 'PUSH_REQUEST'
Jan 15 13:47:29 LaMirada-DDWRT daemon.notice openvpn[8150]: LaMirada-DDWRT/88.88.88.88:61854 SENT CONTROL [LaMirada-DDWRT]: 'PUSH_REPLY,route 192.168.201.0 255.255.255.0,redirect-gateway def1,dhcp-option DNS 192.168.201.11,dhcp-option DNS 8.8.8.8,route 10.8.0.0 255.255.255.0,to
Jan 15 13:47:29 LaMirada-DDWRT daemon.warn openvpn[8150]: LaMirada-DDWRT/88.88.88.88:61854 Need IPv6 code in mroute_extract_addr_from_packet
Jan 15 13:47:29 LaMirada-DDWRT daemon.warn openvpn[8150]: LaMirada-DDWRT/88.88.88.88:61854 Need IPv6 code in mroute_extract_addr_from_packet
Jan 15 13:47:29 LaMirada-DDWRT daemon.warn openvpn[8150]: LaMirada-DDWRT/88.88.88.88:61854 Need IPv6 code in mroute_extract_addr_from_packet
Jan 15 13:47:29 LaMirada-DDWRT daemon.warn openvpn[8150]: LaMirada-DDWRT/88.88.88.88:61854 Need IPv6 code in mroute_extract_addr_from_packet

RKGD512

Thanks,
Regarding ipv6 I do see a lot of errors but I doubt that is causing the issue. Still looks like bad routing or no routing. Packets from the VPN network doesn't know how to get to the LAN. Something wierd that I cannot figure out.

Is there a way to just disable IPV6? Were not using it.

Server Side: added the following line in the server config:
log /var/log/openvpn.log
Server Log:
Looks like the log I gave you resulted in the same thing, just moved the log from original location to /var/log/openvpn.log. No new info in logs on the system side.

I do see some rout issues below. Looking into this... Hope you can help.

Client Log:
Wed Jan 15 16:48:13 2014 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Wed Jan 15 16:48:13 2014 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Jan 15 16:48:13 2014 LZO compression initialized
Wed Jan 15 16:48:13 2014 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Jan 15 16:48:13 2014 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Jan 15 16:48:13 2014 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Jan 15 16:48:13 2014 Local Options hash (VER=V4): '41690919'
Wed Jan 15 16:48:13 2014 Expected Remote Options hash (VER=V4): '530fdded'
Wed Jan 15 16:48:13 2014 UDPv4 link local: [undef]
Wed Jan 15 16:48:13 2014 UDPv4 link remote: 99.99.99.99:5001
Wed Jan 15 16:48:13 2014 TLS: Initial packet from 99.99.99.99:5001, sid=ab536c55 c69efd8b
Wed Jan 15 16:48:13 2014 VERIFY OK:
Wed Jan 15 16:48:13 2014 VERIFY OK: nsCertType=SERVER
Wed Jan 15 16:48:13 2014 VERIFY OK:
Wed Jan 15 16:48:14 2014 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Jan 15 16:48:14 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jan 15 16:48:14 2014 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Jan 15 16:48:14 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jan 15 16:48:14 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Jan 15 16:48:14 2014 [LaMirada-Server] Peer Connection Initiated with 99.99.99.99:5001
Wed Jan 15 16:48:16 2014 SENT CONTROL [LaMirada-Server]: 'PUSH_REQUEST' (status=1)
Wed Jan 15 16:48:16 2014 PUSH: Received control message: 'PUSH_REPLY,route 192.168.201.0 255.255.255.0,redirect-gateway def1,dhcp-option DNS 192.168.201.11,dhcp-option DNS 8.8.8.8,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Wed Jan 15 16:48:16 2014 OPTIONS IMPORT: timers and/or timeouts modified
Wed Jan 15 16:48:16 2014 OPTIONS IMPORT: --ifconfig/up options modified
Wed Jan 15 16:48:16 2014 OPTIONS IMPORT: route options modified
Wed Jan 15 16:48:16 2014 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Jan 15 16:48:16 2014 ROUTE default_gateway=10.146.66.1
Wed Jan 15 16:48:16 2014 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{4B01AFB5-BDE3-48D2-8C96-88ACE5F78C93}.tap
Wed Jan 15 16:48:16 2014 TAP-Win32 Driver Version 9.9
Wed Jan 15 16:48:16 2014 TAP-Win32 MTU=1500
Wed Jan 15 16:48:16 2014 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {4B01AFB5-BDE3-48D2-8C96-88ACE5F78C93} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Wed Jan 15 16:48:16 2014 NOTE: FlushIpNetTable failed on interface [46] {4B01AFB5-BDE3-48D2-8C96-88ACE5F78C93} (status=5) : Access is denied.
Wed Jan 15 16:48:21 2014 TEST ROUTES: 3/3 succeeded len=2 ret=1 a=0 u/d=up
Wed Jan 15 16:48:21 2014 C:\WINDOWS\system32\route.exe ADD 71.165.30.234 MASK 255.255.255.255 10.146.66.1
Wed Jan 15 16:48:21 2014 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=3]
Wed Jan 15 16:48:21 2014 Route addition via IPAPI failed [adaptive]
Wed Jan 15 16:48:21 2014 Route addition fallback to route.exe
The requested operation requires elevation.
Wed Jan 15 16:48:21 2014 ERROR: Windows route add command failed [adaptive]: returned error code 1
Wed Jan 15 16:48:21 2014 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Wed Jan 15 16:48:21 2014 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=46]
Wed Jan 15 16:48:21 2014 Route addition via IPAPI failed [adaptive]
Wed Jan 15 16:48:21 2014 Route addition fallback to route.exe
The requested operation requires elevation.
Wed Jan 15 16:48:21 2014 ERROR: Windows route add command failed [adaptive]: returned error code 1
Wed Jan 15 16:48:21 2014 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Wed Jan 15 16:48:21 2014 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=46]
Wed Jan 15 16:48:21 2014 Route addition via IPAPI failed [adaptive]
Wed Jan 15 16:48:21 2014 Route addition fallback to route.exe
The requested operation requires elevation.
Wed Jan 15 16:48:21 2014 ERROR: Windows route add command failed [adaptive]: returned error code 1
Wed Jan 15 16:48:21 2014 C:\WINDOWS\system32\route.exe ADD 192.168.201.0 MASK 255.255.255.0 10.8.0.5
Wed Jan 15 16:48:21 2014 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=46]
Wed Jan 15 16:48:21 2014 Route addition via IPAPI failed [adaptive]
Wed Jan 15 16:48:21 2014 Route addition fallback to route.exe
The requested operation requires elevation.
Wed Jan 15 16:48:21 2014 ERROR: Windows route add command failed [adaptive]: returned error code 1
Wed Jan 15 16:48:21 2014 C:\WINDOWS\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.5
Wed Jan 15 16:48:21 2014 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=46]
Wed Jan 15 16:48:21 2014 Route addition via IPAPI failed [adaptive]
Wed Jan 15 16:48:21 2014 Route addition fallback to route.exe
The requested operation requires elevation.
Wed Jan 15 16:48:21 2014 ERROR: Windows route add command failed [adaptive]: returned error code 1
Wed Jan 15 16:48:21 2014 Initialization Sequence Completed

RKGD512

debbie10t wrote
RKGD512 wroteThe requested operation requires elevation.
Wed Jan 15 16:48:21 2014 ERROR: Windows route add command failed [adaptive]: returned error code 1
Wed Jan 15 16:48:21 2014 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Wed Jan 15 16:48:21 2014 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=46]
Wed Jan 15 16:48:21 2014 Route addition via IPAPI failed [adaptive]
Wed Jan 15 16:48:21 2014 Route addition fallback to route.exe
The requested operation requires elevation.
You MUST run openvpn as administrator or try starting the openvpn windows service.

HAHA! OMG, Something so simple. I did everything else but run the program as administrator. I feel very dumb... Everything now works and I can ping!

We can close this. Thank you so much!