Internal OpenVPN unable to route to host.

Dilianov

Hey guys I'm trying to install OpenVPN on my internal network I have a server and host
Server: 192.168.1.4
Host: 192.168.1.3

I have all the Certs and keys in both server/host side.
I can ping both ways and I have created a static route to 192.168.1.4 from 192.168.1.3, both can ping the router (192.168.1.1)
Everytime i try to boot up the config file on the server I get this error message

TCP: Connect to 192.168.1.4:1194 failed, will try again in 60 seconds: No route to host (errno=113)

Can anybody help me please?

Host file:

client
dev tun
;dev-node MyTap
proto tcp-client
remote 192.168.1.4 1194
;remote-random
resolv-retry infinite
nobind
;user nobody
;group nobody
persist-key
persist-tun
;mute-replay-warnings
ca ca.crt
cert Internal_server.crt
key Internal_server.key
ns-cert-type server
tls-auth vpn-ta.key 1
;cipher x
comp-lzo
verb 3
;mute 20
connect-retry 60

maikcat

what exactly are you trying to do?

you added a route pointing where?

please post your configs.

Michael.

Dilianov

I am trying to create a TUN link between my server and host , which config files specifically would you like, here is my server config file:

port 1194
proto tcp
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
reneg-sec 0
ca /etc/openvpn/easy-rsa/2.0/keys/SV-FTP.crt
cert /etc/openvpn/easy-rsa/2.0/keys/SV-FTP.crt
key /etc/openvpn/easy-rsa/2.0/keys/SV-FTP.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login #- Co$
#plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf #- Uncomment$
client-cert-not-required
username-as-common-name
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

maikcat

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

Dilianov

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

maikcat

Yes Host and server are in the same network.

you can check your config locally BUT you must not have any routing based
directives enabled....

so disable redirect-gateway statement on your server config

Those CA and CRT are the servers CA and CRT
The ones you saw in the host config are the hosts crt and ca, am i ment to copy and paste the server's ca/crt into the host? I thought I'm meant to make unique CA/CRT for all hosts or do they just use the servers ones?

my advice is to read more about SSL/TLS to avoid any issues later...

for now ca.crt (which is your CA) must be the same on ALL clients/server.
you should use a different cert for each client though,
also keep in mind that the server cert must be created using build-key-server script...

Michael.

Dilianov

Does the key/cert need to be unique to all hosts and if so, do i create them on the host or do i create them on the server and copy them over to the host?

maikcat

Does the key/cert need to be unique to all hosts and if so,

for your own good yes.. 😉

do i create them on the host or do i create them on the server and copy them over to the host?

again please read about how TLS/SSL works...

short answer,
you create your certs werever you want,as long as you keep all files needed for cert creation.

Michael.