Hi,
I have setup OpenVPN on a windows2008 machine here in the office. And, I have asked different co-co-workers to try VPNing into our network from outside the office (i.e: their home). Out of 5 users, I got mixed results, and I am puzzled:
clients A- 2 clients for which it works fine. Connection and pinging inside the network. We are OK here!
clients B- 2 clients for which the connection cannot even be established. (stays yellow). Problem?!
clients C- 1 client who can connect fine (lite turns green), but he cannot ping out internal network. He can ping the VPN Server IP (192.168.10.10, see below) but not the other machines in the LAN (192.168.10.*). Problem?!
Clients are all windows machines, XP or Vista, with pretty much same configuration as I configured them myself (no client firewall). I have RDP access to these machines for testing....
All clients have the same openvpn config file (When I am testing, I don't connect the clients at the same time).
My config is as follows:
INTERNET MODEM ---------------------------------------------------
| [192.168.1.1] |
| |
| [NIC1: 192.168.1.10]
| VPN Server
| [NIC2: 192.168.10.10]
| |
[192.168.1.2] |
ROUTER |
[192.168.10.1] and DHCP |
| |
| |
------------------------------------------------------------------------
LAN (192.168.10.*)
------------------------------------------------------------------------
* VPN SERVER has 2 NIC cards:
- external NIC is connected to the internet router (192.168.1.10)
- internal NIC is connected to my LAN network (192.168.10.10)
* OpenVPN gives out 192.168.11.0 IPs.
* I have also: added a static route in my Router: 192.168.11.0 MASK 255.255.255.0 gateway: 192.168.10.0
* I have also added/installed RRAS (routing and remote access service) role in my VPN SERVER, and I've activated IPv4 routing. (I did not add static route in here or anything else). Note:
withOUT the RRAS on, my successful clients ( of type A above) are able to connect to the VPN server BUT will *not* be able to ping the internal network (just like clients C). Unfortunately it did not solve the problem of Client C ?
* VPN Server is a windows 2008 Server SP1. In where I set in the registry IPRouteEnabled to 1. (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\IPEnableRouter Registry set to 1).
* NAT Rule in my Internet Modem 1555 UDP to my VPN Server.
------------------------------
My openvpn server config is:
#local 192.168.1.10 # I removed this one as it was causing even my clients A (above) to fail. ( I am not sure why)
port 1555
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
ifconfig-pool-persist ipp.txt
server 192.168.11.0 255.255.255.0
push "route 192.168.10.0 255.255.255.0"
route "192.168.10.0 255.255.255.0"
push "dhcp-option DNS 192.168.10.10"
tls-auth ta.key 0
topology subnet
keepalive 10 120
comp-lzo
max-clients 9
persist-key
persist-tun
status openvpn-status.log
verb 6
------------------------------
My ovpn client config:
client
dev tun
proto udp
remote [MY_SERVER_STATIC_IP] 1555 # obvioulsy replaced with the right value.
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client2.crt
key client2.key
tls-auth ta.key 1
ns-cert-type server
comp-lzo
verb 6
------------------------------
I have investigated extensively the case of users B and here is my finding:
Case of clients B- client cannot established OpenVPN connection (icon stays yellow).
---------------------------------------------------------------------------------
For these ones, I noticed that the server sends data back to the client, but the client seems to never get it....the sequence of event is this:
the client: UDPv4 WRITE [14] to [MY_SERVER_STATIC_IP]:1555: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
the server: UDPv4 READ [14] from CLIENTB:57595: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
the server:TLS: Initial packet from CLIENTB:57595, sid=a44cd2a8 05755296
the server: UDPv4 WRITE [26] to CLIENTB:57595: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ 0 ] pid=0 DATA len=0
the client: UDPv4 READ [0] from [undef]: DATA UNDEF len=-1
the client: WRITE [14] to [MY_SERVER_STATIC_IP]:1555: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
on and on... I have no idea why!?
It looks to me like a (client) firewall is dropping the packets or a server routing issue (although Clients A can connect just fine)
I am at a point where I don't anymore where to look at...If anyone can give me a boost, I would really appreciate it.
Thank you,
