Dual Tun/Tap Server

simone

Hi. im trying to setup openvpn to work with both windows and linux clients.

its currently running on a linux vm. and im testing with a windows vm on the same host.

i can connect to the server and obtain the correct IP, but cannot ping the server..
ipv4 forwarding is enabled.

windows client ovpn 2.3.2

my IP range is only selected for the purpose of learning how to do this and IPs can be changed if required.

the idea is to have 1 10.255.0.0/23 subnet both sets of clients can access. i've set aside 10.255.0.1 - 0.255 for linux clients and 10.255.1.5 - 1.254 for windows clients.

using my windows client. I can connect to the VPN OK. i get allocated 10.255.1.5/23 as expected. but can't ping the server on 10.255.0.1

any help would be greatly appreciated.

Server

eth0      Link encap:Ethernet  HWaddr 08:00:27:52:B5:CD  
          inet addr:10.200.70.137  Bcast:10.200.70.255  Mask:255.255.255.0
          inet6 addr: fe80::a00:27ff:fe52:b5cd/64 Scope:Link
eth1      Link encap:Ethernet  HWaddr 08:00:27:16:DF:31  
          inet addr:10.255.0.1  Bcast:10.255.1.255  Mask:255.255.254.0
          inet6 addr: fe80::a00:27ff:fe16:df31/64 Scope:Link
lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.255.0.1  P-t-P:10.255.0.2  Mask:255.255.255.255

server_windows.conf

port 1195
proto udp
dev tap
server-bridge 10.255.0.1 255.255.254.0 10.255.1.5 10.255.1.254
push "route 10.255.0.0 255.255.254.0"

ca ca.crt
cert server_windows.crt
key server_windows.key

dh dh1024.pem

#crl-verify crl.pem

user nobody
group nobody

cipher AES-128-CBC

comp-lzo

keepalive 10 120

persist-key
persist-tun

log server_windows.log
status server_windows-status.log
verb 3

client-config-dir /etc/openvpn/clients/

client-to-client

# Allow direct access to these sites.
#
# Note that you should also add a corrisponding `iroute' option
# to the client configuration file.

windows_client.ovpn

client
dev tap
proto udp
remote 10.200.70.137 1195
resolv-retry infinite
nobind
ns-cert-type server
persist-key
persist-tun
comp-lzo
verb 3
cipher AES-128-CBC

ca ca.crt
cert windows_client.crt
key windows_client.key

server_linux.conf

server 10.255.0.0 255.255.224.0
port 1194
proto udp
dev tun

ca ca.crt
cert server_linux.crt
key server_linux.key

dh dh1024.pem

#crl-verify crl.pem

user nobody
group nobody

cipher AES-128-CBC

comp-lzo

keepalive 10 120

persist-key
persist-tun

log server_linux.log
status server_linux-status.log
verb 3

client-config-dir /etc/openvpn/clients/

client-to-client

# Allow direct access to these sites.
#
# Note that you should also add a corrisponding `iroute' option

my sole goal is to have both windows and linux/unix clients able to connect to the same LAN (10.255.0.0/23) using the same server. the linux clients are tun because they will be always on and require static IPs. windows clients just need to be able to connect and access that LAN.

simone

windows connection log

Tue Feb 04 16:53:32 2014 OpenVPN 2.3.2 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Enter Management Password:
Tue Feb 04 16:53:32 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Feb 04 16:53:32 2014 Need hold release from management interface, waiting...
Tue Feb 04 16:53:32 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Feb 04 16:53:32 2014 MANAGEMENT: CMD 'state on'
Tue Feb 04 16:53:32 2014 MANAGEMENT: CMD 'log all on'
Tue Feb 04 16:53:32 2014 MANAGEMENT: CMD 'hold off'
Tue Feb 04 16:53:33 2014 MANAGEMENT: CMD 'hold release'
Tue Feb 04 16:53:33 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Feb 04 16:53:33 2014 UDPv4 link local: [undef]
Tue Feb 04 16:53:33 2014 UDPv4 link remote: [AF_INET]10.200.70.137:1195
Tue Feb 04 16:53:33 2014 MANAGEMENT: >STATE:1391532813,WAIT,,,
Tue Feb 04 16:53:33 2014 MANAGEMENT: >STATE:1391532813,AUTH,,,
Tue Feb 04 16:53:33 2014 TLS: Initial packet from [AF_INET]10.200.70.137:1195, sid=8404dfb7 cf0e5082
Tue Feb 04 16:53:33 2014 VERIFY OK: depth=1, C=UK, ST=England, L=London, O=BLAH, OU=linuxVM, CN=linux_VM, name=linux_test, emailAddress=BLAH
Tue Feb 04 16:53:33 2014 VERIFY OK: nsCertType=SERVER
Tue Feb 04 16:53:33 2014 VERIFY OK: depth=0, C=UK, ST=England, L=London, O=BLAH, OU=server, CN=server_windows, name=OpenVPN_WindowsServer, emailAddress=BLAH
Tue Feb 04 16:53:33 2014 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Tue Feb 04 16:53:33 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb 04 16:53:33 2014 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Tue Feb 04 16:53:33 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb 04 16:53:33 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Feb 04 16:53:33 2014 [server_windows] Peer Connection Initiated with [AF_INET]10.200.70.137:1195
Tue Feb 04 16:53:34 2014 MANAGEMENT: >STATE:1391532814,GET_CONFIG,,,
Tue Feb 04 16:53:35 2014 SENT CONTROL [server_windows]: 'PUSH_REQUEST' (status=1)
Tue Feb 04 16:53:35 2014 PUSH: Received control message: 'PUSH_REPLY,route 10.255.0.0 255.255.254.0,route-gateway 10.255.0.1,ping 10,ping-restart 120,ifconfig 10.255.1.5 255.255.254.0'
Tue Feb 04 16:53:35 2014 OPTIONS IMPORT: timers and/or timeouts modified
Tue Feb 04 16:53:35 2014 OPTIONS IMPORT: --ifconfig/up options modified
Tue Feb 04 16:53:35 2014 OPTIONS IMPORT: route options modified
Tue Feb 04 16:53:35 2014 OPTIONS IMPORT: route-related options modified
Tue Feb 04 16:53:35 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Feb 04 16:53:35 2014 MANAGEMENT: >STATE:1391532815,ASSIGN_IP,,10.255.1.5,
Tue Feb 04 16:53:35 2014 open_tun, tt->ipv6=0
Tue Feb 04 16:53:35 2014 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{15411729-5213-4822-9C03-B8835E73D303}.tap
Tue Feb 04 16:53:35 2014 TAP-Windows Driver Version 9.9 
Tue Feb 04 16:53:35 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.255.1.5/255.255.254.0 on interface {15411729-5213-4822-9C03-B8835E73D303} [DHCP-serv: 10.255.0.0, lease-time: 31536000]
Tue Feb 04 16:53:35 2014 Successful ARP Flush on interface [17] {15411729-5213-4822-9C03-B8835E73D303}
Tue Feb 04 16:53:40 2014 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Tue Feb 04 16:53:40 2014 MANAGEMENT: >STATE:1391532820,ADD_ROUTES,,,
Tue Feb 04 16:53:40 2014 C:\Windows\system32\route.exe ADD 10.255.0.0 MASK 255.255.254.0 10.255.0.1
Tue Feb 04 16:53:40 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Feb 04 16:53:40 2014 Route addition via IPAPI succeeded [adaptive]
Tue Feb 04 16:53:40 2014 Initialization Sequence Completed
Tue Feb 04 16:53:40 2014 MANAGEMENT: >STATE:1391532820,CONNECTED,SUCCESS,10.255.1.5,10.200.70.137