[Solved] Routing to only one WAN ip?

lemussky

Hello forum users!

As a very new opnVPN admin, I'm sucessfully set up an
openVPN server (dedicated hardware).
Clients can connect to our LAN and use the rescources.
That's fine!

Now I have a special problem:

Clients internet traffic runs over the local gateway,
what is ok for all requests, except one:
one and only one connection to a static
(internet) ip should be routed through the openVPN.
(This IP belongs to our dedicated server at our ISP,
which accepts only connections to our gateway).

Questions:
- is a routing possible for only one IP?
- and when "yes": how can I solve it?

Any hint is welcome!

Cheers, Lemussky

lemussky

Hello debbie10t,

thank you for your quick reply!

I think the push option is placed on server side?

I put it in there and restarted the server.
But now the clients get the messages

 ... TEST ROUTES: 2/3 succeeded len=3 ret=0 a=0 u/d=up
 ... Route: waiting for TUN/TAP interface to come up...

this loops "infinite" (with different tiemstampes)...

What can I do furthermore?

Thank you!

lemussky

Hello!

My old server.conf had one push statement:

push "route 192.168.0.0 255.255.255.0"

Clients could connect with this config.

Yesterday I added following line

push "route x.x.x.x 255.255.255.255 192.168.0.254"

with x.x.x.x = our external server ip
and 192.168.0.254 ip of our LAN gateway

Commenting out the second push, clients can connect agian without problems...

Thank you for your help again!

Cheers, Lemussky

lemussky

Hello debbie10t,

I've modified now the 2nd push as you mentioned.
And yes, clients can connect and work with our resources! Fine!!

A "tracert" hangs in the second hop:

1  20 ms    20 ms   20 ms   10.8.0.1
2   *          *         *        timeout

Is this the "missing route"?

I will try to add it and I'll report...

Thanks a lot for your help!!!

lemussky

Hello again!

Sorry, I still stuck in here...

I've tried several possibilities for my routing table.
But it does not work.

On the command prompt of the server I manualley added i.e. a route like this:

route add -host x.x.x.x gw 10.8.0.2

The result of tracert on the client machine is still the same.

Could it be, that our internet gw needs one more forward too?

lemussky

hello debbie10t!

Thank you again, but...

A standard VPN connection between one server and many clients.
You have successfully set this up.

Yes

One client must route one specific IP address outside of the VPN.
You have not successfully set this up.

No.

I have solved this:

All (vpn) clients can reach specific servers in our LAN.
Form client I can PING i.e.
- Server1 with 192.168.0.44
- Server2 with 192.168.0.45
which I set up as reachalble from 10.8.0.0 openvpn network.

All other IPs within the LAN are not reachable and that is what I want.

Now the second task:

All openvpn clients should reach a server located in internet (with IP A.B.C.D)
but through the vpn tunnel.

With your help clients requests to A.B.C.D are routed in the openvpn.
But there they are dropped as tracert says:

$ tracert A.B.C.D
1 28ms 27ms 28ms   18.8.0.1
2 *    *    *      timeout

Just now I've tried to tracert our default gateway (@ 192.168.0.254)
and I get the same result as above.

That is why I guess that the gateway should know something about 10.8.0.0-network!?
Unfortunately I can't set it up by myself. This is a job for our ISP.

Do you agree that it needs something like

route add -net 10.8.0.0 netmask 255.255.255.0 gw 192.168.0.XXX dev.....

(with 192.168.0.XXX = open server host)?

Thanks for your patience and your help!

lemussky

here it comes. Server:

server.conf

port 1194
proto udp
dev tun
ca   ca.pem
cert clc.pem
key  clk.pem

dh dh1024.pem

server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt

push "route 192.168.0.0 255.255.255.0"
push "route A.B.C.D 255.255.255.255"

keepalive 10 120

comp-lzo
max-clients 5

user nobody
group nogroup

persist-key
persist-tun

status openvpn-status.log

log         /var/log/openvpn.log
verb 3

Note: A.B.C.D external Server IP. This one is located in internet

server-log:

Thu Feb 20 08:57:35 2014 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Feb 20 08:57:35 2014 Socket Buffers: R=[212992->131072] S=[212992->131072]
Thu Feb 20 08:57:35 2014 ROUTE default_gateway=192.168.0.254
Thu Feb 20 08:57:35 2014 TUN/TAP device tun0 opened
Thu Feb 20 08:57:35 2014 TUN/TAP TX queue length set to 100
Thu Feb 20 08:57:35 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Feb 20 08:57:35 2014 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Thu Feb 20 08:57:35 2014 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Thu Feb 20 08:57:35 2014 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Feb 20 08:57:35 2014 GID set to nogroup
Thu Feb 20 08:57:35 2014 UID set to nobody
Thu Feb 20 08:57:35 2014 UDPv4 link local (bound): [undef]
Thu Feb 20 08:57:35 2014 UDPv4 link remote: [undef]
Thu Feb 20 08:57:35 2014 MULTI: multi_init called, r=256 v=256
Thu Feb 20 08:57:35 2014 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Thu Feb 20 08:57:35 2014 ifconfig_pool_read(), in='*******,10.8.0.4', TODO: IPv6
Thu Feb 20 08:57:35 2014 succeeded -> ifconfig_pool_set()
Thu Feb 20 08:57:35 2014 ifconfig_pool_read(), in='openVPN-RD-Client_01,10.8.0.8', TODO: IPv6
Thu Feb 20 08:57:35 2014 succeeded -> ifconfig_pool_set()
Thu Feb 20 08:57:35 2014 IFCONFIG POOL LIST
Thu Feb 20 08:57:35 2014 *******,10.8.0.4
Thu Feb 20 08:57:35 2014 Initialization Sequence Completed
Thu Feb 20 09:00:06 2014 MULTI: multi_create_instance called
Thu Feb 20 09:00:06 2014 62.224.X.Y:1042 Re-using SSL/TLS context
Thu Feb 20 09:00:06 2014 62.224.X.Y:1042 LZO compression initialized
Thu Feb 20 09:00:06 2014 62.224.X.Y:1042 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Feb 20 09:00:06 2014 62.224.X.Y:1042 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Feb 20 09:00:06 2014 62.224.X.Y:1042 Local Options hash (VER=V4): '530fdded'
Thu Feb 20 09:00:06 2014 62.224.X.Y:1042 Expected Remote Options hash (VER=V4): '41690919'
Thu Feb 20 09:00:06 2014 62.224.X.Y:1042 TLS: Initial packet from [AF_INET]62.224.X.Y:1042, sid=9db9249d 9f5d861d
Thu Feb 20 09:00:08 2014 62.224.X.Y:1042 VERIFY OK: depth=1, /C=DE/ST=......
Thu Feb 20 09:00:08 2014 62.224.X.Y:1042 VERIFY OK: depth=0, /C=DE/ST=......
Thu Feb 20 09:00:08 2014 62.224.X.Y:1042 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 20 09:00:08 2014 62.224.X.Y:1042 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 20 09:00:08 2014 62.224.X.Y:1042 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 20 09:00:08 2014 62.224.X.Y:1042 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 20 09:00:08 2014 62.224.X.Y:1042 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Thu Feb 20 09:00:08 2014 62.224.X.Y:1042 [*******] Peer Connection Initiated with [AF_INET]62.224.X.Y:1042
Thu Feb 20 09:00:08 2014 *******/62.224.X.Y:1042 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=1::2c00:0:5e7f:0
Thu Feb 20 09:00:08 2014 *******/62.224.X.Y:1042 MULTI: Learn: 10.8.0.6 -> *******/62.224.X.Y:1042
Thu Feb 20 09:00:08 2014 *******/62.224.X.Y:1042 MULTI: primary virtual IP for *******/62.224.X.Y:1042: 10.8.0.6
Thu Feb 20 09:00:10 2014 *******/62.224.X.Y:1042 PUSH: Received control message: 'PUSH_REQUEST'
Thu Feb 20 09:00:10 2014 *******/62.224.X.Y:1042 send_push_reply(): safe_cap=960
Thu Feb 20 09:00:10 2014 *******/62.224.X.Y:1042 SENT CONTROL [*******]: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,route A:B:C:D 255.255.255.255,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Thu Feb 20 10:00:08 2014 *******/62.224.X.Y:1042 TLS: soft reset sec=0 bytes=38206/0 pkts=716/0
Thu Feb 20 10:00:09 2014 *******/62.224.X.Y:1042 VERIFY OK: depth=1, /C=DE...
Thu Feb 20 10:00:09 2014 *******/62.224.X.Y:1042 VERIFY OK: depth=0, /C=DE...
Thu Feb 20 10:00:09 2014 *******/62.224.X.Y:1042 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 20 10:00:09 2014 *******/62.224.X.Y:1042 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 20 10:00:09 2014 *******/62.224.X.Y:1042 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 20 10:00:09 2014 *******/62.224.X.Y:1042 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 20 10:00:09 2014 *******/62.224.X.Y:1042 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Thu Feb 20 11:00:08 2014 *******/62.224.X.Y:1042 TLS: tls_process: killed expiring key
Thu Feb 20 11:00:09 2014 *******/62.224.X.Y:1042 TLS: soft reset sec=0 bytes=36855/0 pkts=702/0
Thu Feb 20 11:00:11 2014 *******/62.224.X.Y:1042 VERIFY OK: depth=1, /C=DE.....
Thu Feb 20 11:00:11 2014 *******/62.224.X.Y:1042 VERIFY OK: depth=0, /C=DE.....
Thu Feb 20 11:00:11 2014 *******/62.224.X.Y:1042 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 20 11:00:11 2014 *******/62.224.X.Y:1042 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 20 11:00:11 2014 *******/62.224.X.Y:1042 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 20 11:00:11 2014 *******/62.224.X.Y:1042 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 20 11:00:11 2014 *******/62.224.X.Y:1042 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA

Note: *** client name

server route:

Ziel            Router          Genmask         Flags Metric Ref    Use Iface
default         192.168.0.254   0.0.0.0         UG    100    0        0 eth2
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        *               255.255.255.255 UH    0      0        0 tun0
192.168.0.0     *               255.255.255.0   U     0      0        0 eth2

==============================

Client-Config: (Win XP)

nobind
client
dev tun
proto udp
remote U.X.Y.Z 1194

persist-key
persist-tun

ca ca.pem
cert client-cert.pem
key client-key.pem

comp-lzo
verb 4

mute 20

reneg-sec 0
ip-win32 netsh

client-log:

Thu Feb 20 08:59:36 2014 us=140000 Current Parameter Settings:
Thu Feb 20 08:59:36 2014 us=140000   config = 'my.ovpn'
Thu Feb 20 08:59:36 2014 us=140000   mode = 0
Thu Feb 20 08:59:36 2014 us=140000   show_ciphers = DISABLED
Thu Feb 20 08:59:36 2014 us=140000   show_digests = DISABLED
Thu Feb 20 08:59:36 2014 us=140000   show_engines = DISABLED
Thu Feb 20 08:59:36 2014 us=140000   genkey = DISABLED
Thu Feb 20 08:59:36 2014 us=140000   key_pass_file = '[UNDEF]'
Thu Feb 20 08:59:36 2014 us=140000   show_tls_ciphers = DISABLED
Thu Feb 20 08:59:36 2014 us=140000 Connection profiles [default]:
Thu Feb 20 08:59:36 2014 us=140000   proto = udp
Thu Feb 20 08:59:36 2014 us=140000   local = '[UNDEF]'
Thu Feb 20 08:59:36 2014 us=140000   local_port = 0
Thu Feb 20 08:59:36 2014 us=140000   remote = 'U.X.Y.Z'
Thu Feb 20 08:59:36 2014 us=140000   remote_port = 1194
Thu Feb 20 08:59:36 2014 us=140000   remote_float = DISABLED
Thu Feb 20 08:59:36 2014 us=140000   bind_defined = DISABLED
Thu Feb 20 08:59:36 2014 us=140000   bind_local = DISABLED
Thu Feb 20 08:59:36 2014 us=140000   connect_retry_seconds = 5
Thu Feb 20 08:59:36 2014 us=140000   connect_timeout = 10
Thu Feb 20 08:59:36 2014 us=140000 NOTE: --mute triggered...
Thu Feb 20 08:59:36 2014 us=140000 253 variation(s) on previous 20 message(s) suppressed by --mute
Thu Feb 20 08:59:36 2014 us=140000 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Thu Feb 20 08:59:36 2014 us=140000 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu Feb 20 08:59:36 2014 us=140000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Feb 20 09:00:05 2014 us=718000 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Feb 20 09:00:05 2014 us=765000 LZO compression initialized
Thu Feb 20 09:00:05 2014 us=765000 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Feb 20 09:00:05 2014 us=781000 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Feb 20 09:00:05 2014 us=796000 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Feb 20 09:00:05 2014 us=796000 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Thu Feb 20 09:00:05 2014 us=796000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Feb 20 09:00:05 2014 us=796000 Local Options hash (VER=V4): '41690919'
Thu Feb 20 09:00:05 2014 us=796000 Expected Remote Options hash (VER=V4): '530fdded'
Thu Feb 20 09:00:05 2014 us=796000 UDPv4 link local: [undef]
Thu Feb 20 09:00:05 2014 us=796000 UDPv4 link remote: U.X.Y.Z:1194
Thu Feb 20 09:00:05 2014 us=859000 TLS: Initial packet from U.X.Y.Z:1194, sid=cc8a6f6c 506ea1ac
Thu Feb 20 09:00:06 2014 us=343000 VERIFY OK: depth=1, /C=DE....
Thu Feb 20 09:00:06 2014 us=359000 VERIFY OK: depth=0, /C=DE...
Thu Feb 20 09:00:07 2014 us=656000 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 20 09:00:07 2014 us=656000 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 20 09:00:07 2014 us=656000 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 20 09:00:07 2014 us=656000 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 20 09:00:07 2014 us=656000 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Thu Feb 20 09:00:07 2014 us=656000 [openVPN-ReservoirDog] Peer Connection Initiated with U.X.Y.Z:1194
Thu Feb 20 09:00:09 2014 us=687000 SENT CONTROL [openVPN-ReservoirDog]: 'PUSH_REQUEST' (status=1)
Thu Feb 20 09:00:09 2014 us=718000 PUSH: Received control message: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,route A.B.C.D 255.255.255.255,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Thu Feb 20 09:00:09 2014 us=718000 OPTIONS IMPORT: timers and/or timeouts modified
Thu Feb 20 09:00:09 2014 us=718000 OPTIONS IMPORT: --ifconfig/up options modified
Thu Feb 20 09:00:09 2014 us=718000 OPTIONS IMPORT: route options modified
Thu Feb 20 09:00:09 2014 us=750000 ROUTE default_gateway=192.168.2.1
Thu Feb 20 09:00:10 2014 us=765000 NETSH: C:\WINDOWS\system32\netsh.exe interface ip set address LAN-Verbindung 3 static 10.8.0.6 255.255.255.252
OK.
Thu Feb 20 09:00:16 2014 us=906000 NETSH: C:\WINDOWS\system32\netsh.exe interface ip delete dns LAN-Verbindung 3 all
OK.
Thu Feb 20 09:00:21 2014 us=765000 NETSH: C:\WINDOWS\system32\netsh.exe interface ip delete wins LAN-Verbindung 3 all
OK.
Thu Feb 20 09:00:25 2014 us=687000 TAP-WIN32 device [LAN-Verbindung 3] opened: \\.\Global\{AB0D5653-936C-4DE2-AAC6-25C43A66EABA}.tap
Thu Feb 20 09:00:25 2014 us=703000 TAP-Win32 Driver Version 9.9
Thu Feb 20 09:00:25 2014 us=703000 TAP-Win32 MTU=1500
Thu Feb 20 09:00:25 2014 us=703000 Successful ARP Flush on interface [3] {AB0D5653-936C-4DE2-AAC6-25C43A66EABA}
Thu Feb 20 09:00:31 2014 us=15000 TEST ROUTES: 3/3 succeeded len=3 ret=1 a=0 u/d=up
Thu Feb 20 09:00:31 2014 us=31000 C:\WINDOWS\system32\route.exe ADD 192.168.0.0 MASK 255.255.255.0 10.8.0.5
Thu Feb 20 09:00:31 2014 us=46000 Route addition via IPAPI succeeded [adaptive]
Thu Feb 20 09:00:31 2014 us=62000 C:\WINDOWS\system32\route.exe ADD A.B.C.D MASK 255.255.255.255 10.8.0.5
Thu Feb 20 09:00:31 2014 us=78000 Route addition via IPAPI succeeded [adaptive]
Thu Feb 20 09:00:31 2014 us=93000 C:\WINDOWS\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Thu Feb 20 09:00:31 2014 us=109000 Route addition via IPAPI succeeded [adaptive]
Thu Feb 20 09:00:31 2014 us=109000 Initialization Sequence Completed
Thu Feb 20 10:00:08 2014 us=296000 VERIFY OK: depth=1, /C=DE.....
Thu Feb 20 10:00:08 2014 us=312000 VERIFY OK: depth=0, /C=DE......
Thu Feb 20 10:00:09 2014 us=390000 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 20 10:00:09 2014 us=390000 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 20 10:00:09 2014 us=390000 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 20 10:00:09 2014 us=390000 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 20 10:00:09 2014 us=390000 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Thu Feb 20 11:00:07 2014 us=625000 TLS: tls_process: killed expiring key
Thu Feb 20 11:00:10 2014 us=156000 VERIFY OK: depth=1, /C=DE.....
Thu Feb 20 11:00:10 2014 us=171000 VERIFY OK: depth=0, /C=DE.....
Thu Feb 20 11:00:11 2014 us=296000 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 20 11:00:11 2014 us=296000 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 20 11:00:11 2014 us=296000 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 20 11:00:11 2014 us=296000 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 20 11:00:11 2014 us=296000 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA

client route:


===========================================================================
Schnittstellenliste
0x1 ........................... MS TCP Loopback interface
0x2 ...00 23 54 46 89 29 ...... Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Cont
roller - Paketplaner-Miniport
0x3 ...00 ff ab 0d 56 53 ...... TAP-Win32 Adapter V9 - Paketplaner-Miniport
===========================================================================
===========================================================================
Aktive Routen:
     Netzwerkziel    Netzwerkmaske          Gateway   Schnittstelle  Anzahl
          0.0.0.0          0.0.0.0         10.8.0.5        10.8.0.6       30
          0.0.0.0          0.0.0.0      192.168.2.1   192.168.2.100       20
         10.8.0.1  255.255.255.255         10.8.0.5        10.8.0.6       1
         10.8.0.4  255.255.255.252         10.8.0.6        10.8.0.6       30
         10.8.0.6  255.255.255.255        127.0.0.1       127.0.0.1       30
   10.255.255.255  255.255.255.255         10.8.0.6        10.8.0.6       30
          A.B.C.D  255.255.255.255         10.8.0.5        10.8.0.6       1
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      192.168.0.0    255.255.255.0         10.8.0.5        10.8.0.6       1
      192.168.2.0    255.255.255.0    192.168.2.100   192.168.2.100       20
    192.168.2.100  255.255.255.255        127.0.0.1       127.0.0.1       20
    192.168.2.255  255.255.255.255    192.168.2.100   192.168.2.100       20
        224.0.0.0        240.0.0.0         10.8.0.6        10.8.0.6       30
        224.0.0.0        240.0.0.0    192.168.2.100   192.168.2.100       20
  255.255.255.255  255.255.255.255         10.8.0.6        10.8.0.6       1
  255.255.255.255  255.255.255.255    192.168.2.100   192.168.2.100       1
Standardgateway:       192.168.2.1
===========================================================================
St??ndige Routen:
  Netzwerkadresse          Netzmaske  Gatewayadresse  Anzahl
      192.168.0.0    255.255.255.0         10.8.0.5       1

that's it...

lemussky

Hello debbie10t!

Are your server and client on the same physical LAN .. IE

No.

they are in the same room ?

At this moment yes.
But the client is connected via a different connection to the internet
as our LAN and different ISPs.

Here is the server ifconfig:


eth2
Link encap:Ethernet  Hardware Adresse 90:e2:ba:29:8c:68
inet Adresse:192.168.0.99  Bcast:192.168.0.255  Maske:255.255.255.0
inet6-Adresse: fe80::92e2:baff:fe29:8c68/64 Gültigkeitsbereich:Verbindung
UP BROADCAST RUNNING MULTICAST  MTU:1500  Metrik:1
RX-Pakete:10845 Fehler:0 Verloren:0 Überläufe:0 Fenster:0
TX-Pakete:5086 Fehler:0 Verloren:0 Überläufe:0 Träger:0
Kollisionen:0 Sendewarteschlangenlänge:1000
RX-Bytes:1014518 (1.0 MB)  TX-Bytes:494583 (494.5 KB)
Speicher:c6820000-c6840000

lo
Link encap:Lokale Schleife
inet Adresse:127.0.0.1  Maske:255.0.0.0
inet6-Adresse: ::1/128 Gültigkeitsbereich:Maschine
UP LOOPBACK RUNNING  MTU:16436  Metrik:1
RX-Pakete:29 Fehler:0 Verloren:0 Überläufe:0 Fenster:0
TX-Pakete:29 Fehler:0 Verloren:0 Überläufe:0 Träger:0
Kollisionen:0 Sendewarteschlangenlänge:0
RX-Bytes:4564 (4.5 KB)  TX-Bytes:4564 (4.5 KB)

tun0
Link encap:UNSPEC  Hardware Adresse 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet Adresse:10.8.0.1  P-z-P:10.8.0.2  Maske:255.255.255.255
UP PUNKTZUPUNKT RUNNING NOARP MULTICAST  MTU:1500  Metrik:1
RX-Pakete:44 Fehler:0 Verloren:0 Überläufe:0 Fenster:0
TX-Pakete:73 Fehler:0 Verloren:0 Überläufe:0 Träger:0
Kollisionen:0 Sendewarteschlangenlänge:100
RX-Bytes:4048 (4.0 KB)  TX-Bytes:6292 (6.2 KB)

and here the client:

Windows-IP-Konfiguration

Hostname. . . . . . . . . . . . . : De
Primäres DNS-Suffix . . . . . . . :
Knotentyp . . . . . . . . . . . . : Broadcast
IP-Routing aktiviert. . . . . . . : Nein
WINS-Proxy aktiviert. . . . . . . : Nein
DNS-Suffixsuchliste . . . . . . . : Speedport_XXXXX

Ethernetadapter LAN-Verbindung:

Verbindungsspezifisches DNS-Suffix: Speedport_XXXXX
Beschreibung. . . . . . . . . . . : Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller
Physikalische Adresse . . . . . . : 00-23-54-46-89-29
DHCP aktiviert. . . . . . . . . . : Ja
Autokonfiguration aktiviert . . . : Ja
IP-Adresse. . . . . . . . . . . . : 192.168.2.100
Subnetzmaske. . . . . . . . . . . : 255.255.255.0
Standardgateway . . . . . . . . . : 192.168.2.1
DHCP-Server . . . . . . . . . . . : 192.168.2.1
DNS-Server. . . . . . . . . . . . : 192.168.2.1
Lease erhalten. . . . . . . . . . : Donnerstag, 20. Februar 2014 08:48:54
Lease läuft ab. . . . . . . . . . : Donnerstag, 13. März 2014 08:48:54

Ethernetadapter LAN-Verbindung 3:

Verbindungsspezifisches DNS-Suffix:
Beschreibung. . . . . . . . . . . : TAP-Win32 Adapter V9
Physikalische Adresse . . . . . . : 00-FF-AB-0D-56-53
DHCP aktiviert. . . . . . . . . . : Nein
IP-Adresse. . . . . . . . . . . . : 10.8.0.6
Subnetzmaske. . . . . . . . . . . : 255.255.255.252
Standardgateway . . . . . . . . . : 10.8.0.5

lemussky

Hello debbie10t,

the provider has configured our router now.

System runs without any further openvpn reconfiguration!

Days of work for nothing... 🙁

Thank's for your help!

Cheers,
Lemussky