OpenVPN works on LAN, but not over internet (Port forwarded)

bradair

I have been trying to setup a VPN for my company and having no luck getting it running. When I try to connect from either my phone or my home computer, the connection times out. If I use another pc in the office to connect using the local IP instead of the public IP, it connects immediately. I've forwarded UDP port 1194 on the router and even tried TCP port 443. The issue is the same regardless. I've assumed that the certifications can't be the problem because the pc's connect on the LAN.

My server config is:

port 1194
proto udp
dev tun
dev-node MyTap
server 192.168.137.0 255.255.255.0

ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
ifconfig-pool-persist ipp.txt

keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

The client config is:

client
dev tun
dev-node MyTap
proto udp
remote **.**.**.** 1194

resolv-retry infinite
nobind
persist-key
persist-tun

ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server

comp-lzo
verb 3
explicit-exit-notify 2
ping 10
ping-restart 60

route-method exe
route-delay 2

The server log file:

Wed Jan 15 17:41:43 2014 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Wed Jan 15 17:41:43 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Jan 15 17:41:43 2014 Need hold release from management interface, waiting...
Wed Jan 15 17:41:43 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Jan 15 17:41:44 2014 MANAGEMENT: CMD 'state on'
Wed Jan 15 17:41:44 2014 MANAGEMENT: CMD 'log all on'
Wed Jan 15 17:41:44 2014 MANAGEMENT: CMD 'hold off'
Wed Jan 15 17:41:44 2014 MANAGEMENT: CMD 'hold release'
Wed Jan 15 17:41:44 2014 Diffie-Hellman initialized with 2048 bit key
Wed Jan 15 17:41:44 2014 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Jan 15 17:41:44 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Jan 15 17:41:44 2014 MANAGEMENT: >STATE:1389825704,ASSIGN_IP,,192.168.137.1,
Wed Jan 15 17:41:44 2014 open_tun, tt->ipv6=0
Wed Jan 15 17:41:44 2014 TAP-WIN32 device [MyTap] opened: \\.\Global\{EC16D780-71B7-4B7B-937B-BD95FB35D290}.tap
Wed Jan 15 17:41:44 2014 TAP-Windows Driver Version 9.9 
Wed Jan 15 17:41:44 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.137.1/255.255.255.252 on interface {EC16D780-71B7-4B7B-937B-BD95FB35D290} [DHCP-serv: 192.168.137.2, lease-time: 31536000]
Wed Jan 15 17:41:44 2014 Sleeping for 10 seconds...
Wed Jan 15 17:41:54 2014 Successful ARP Flush on interface [9] {EC16D780-71B7-4B7B-937B-BD95FB35D290}
Wed Jan 15 17:41:54 2014 MANAGEMENT: >STATE:1389825714,ADD_ROUTES,,,
Wed Jan 15 17:41:54 2014 C:\WINDOWS\system32\route.exe ADD 192.168.137.0 MASK 255.255.255.0 192.168.137.2
Wed Jan 15 17:41:54 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Wed Jan 15 17:41:54 2014 Route addition via IPAPI succeeded [adaptive]
Wed Jan 15 17:41:54 2014 UDPv4 link local (bound): [undef]
Wed Jan 15 17:41:54 2014 UDPv4 link remote: [undef]
Wed Jan 15 17:41:54 2014 MULTI: multi_init called, r=256 v=256
Wed Jan 15 17:41:54 2014 IFCONFIG POOL: base=192.168.137.4 size=62, ipv6=0
Wed Jan 15 17:41:54 2014 IFCONFIG POOL LIST
Wed Jan 15 17:41:54 2014 Initialization Sequence Completed
Wed Jan 15 17:41:54 2014 MANAGEMENT: >STATE:1389825714,CONNECTED,SUCCESS,192.168.137.1,

The client log file:

Wed Jan 15 21:50:42 2014 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Wed Jan 15 21:50:42 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Jan 15 21:50:42 2014 Need hold release from management interface, waiting...
Wed Jan 15 21:50:42 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Jan 15 21:50:42 2014 MANAGEMENT: CMD 'state on'
Wed Jan 15 21:50:42 2014 MANAGEMENT: CMD 'log all on'
Wed Jan 15 21:50:42 2014 MANAGEMENT: CMD 'hold off'
Wed Jan 15 21:50:42 2014 MANAGEMENT: CMD 'hold release'
Wed Jan 15 21:50:42 2014 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Jan 15 21:50:42 2014 UDPv4 link local: [undef]
Wed Jan 15 21:50:42 2014 UDPv4 link remote: [AF_INET]**.**.**.**:1194
Wed Jan 15 21:50:42 2014 MANAGEMENT: >STATE:1389840642,WAIT,,,
Wed Jan 15 21:51:42 2014 [UNDEF] Inactivity timeout (--ping-restart), restarting
Wed Jan 15 21:51:42 2014 SIGUSR1[soft,ping-restart] received, process restarting
Wed Jan 15 21:51:42 2014 MANAGEMENT: >STATE:1389840702,RECONNECTING,ping-restart,,
Wed Jan 15 21:51:42 2014 Restart pause, 2 second(s)
Wed Jan 15 21:51:44 2014 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Jan 15 21:51:44 2014 UDPv4 link local: [undef]
Wed Jan 15 21:51:44 2014 UDPv4 link remote: [AF_INET]**.**.**.**:1194
Wed Jan 15 21:51:44 2014 MANAGEMENT: >STATE:1389840704,WAIT,,,

Any help would be appreciated. I really feel like I'm close.

bradair

debbie10t wroteMake sure your server firewall is not dropping incoming packets from foreign hosts (IE. Over the internet)

debbie10t wroteUse a packets sniffer (EG. Wireshark) on the server to see if packets from your router are being forwarded correctly. (Presuming you use Windows on the server)

I am on a windows server. Forgot to mention that.

This is not my area of expertise, so you'll have to pardon my beginner questions. Is it appropriate to use Wireshark to check for the firewall dropping packets? I ran it for around 10 minutes and it shows that 0 packets have been dropped.

I am not sure how to use Wireshark to see if packets are being forwarded properly. When I run Wireshark I see activity, but nothing associated with UDP port 1194

bradair

debbie10t wroteThat would tend to indicate you have not forwarded your port correctly ...

That wouldn't entirely surprise me, our office uses a decade old zonet router. I know how to forward ports on my home router, so I'll try the same setup on my home pc over the weekend.

debbie10t wroteHow are you resolving your server IP .. by DNS name or direct IP ?

I'm using my public IP. It's not static, but I keep checking to make sure it hasn't changed.