Unable to initiate communication from LAN to OpenVPN clients

mears

My wife was just moved out of the country on assignment for a year, so I've been trying to get OpenVPN setup, so she can VPN back into our home network remotely. I've had a fair amount of success getting everything configured. My server is running Windows Sever 2008 R2. I have enabled IP routing via the IPEnableRouter setting in the registry. The the clients I've currently added are: OS X using Tunnelblick (wife's computer), iPAD, Android, and Windows 7. All clients are able to connect to my server and access local resources, initiate RDP connections across the LAN, access CIFS shares on LAN, access the internet, DNS works, etc. Where I am currently stuck is I cannot see clients connected to my VPN from any of the machines on my LAN *except* for my OpenVPN server. ping fails, tracert fails, etc.

My LAN uses IPs in the following namespace: 192.168.253.0/24

My OpenVPN server is assigned a static IP of 192.168.1.2 and a host name of "nfs-file". It has the following configuration for its TAP adapter:

Ethernet adapter MyTap:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : TAP-Windows Adapter V9
   Physical Address. . . . . . . . . : 00-FF-40-F7-41-9F
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 192.168.137.1(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.252
   Lease Obtained. . . . . . . . . . : Monday, April 28, 2014 7:45:15 PM
   Lease Expires . . . . . . . . . . : Tuesday, April 28, 2015 7:45:15 PM
   Default Gateway . . . . . . . . . :
   DHCP Server . . . . . . . . . . . : 192.168.137.2
   NetBIOS over Tcpip. . . . . . . . : Enabled

So, the server assigns IPs to VPN clients as 192.168.137.x.

This is the servers config file:

local 192.168.253.2
port 1194
proto udp
dev tun
dev-node MyTap
server 192.168.137.0 255.255.255.0 
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.253.1" #Router
push "dhcp-option DOMAIN ."
keepalive 10 120
comp-lzo 
persist-key
persist-tun
status openvpn-status.log
verb 3

Right now, I am debugging on a Windows 7 laptop. This is its config file:

client
dev tun
proto udp
remote *REMOVED* 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert msi-laptop.crt
key msi-laptop.key
ns-cert-type server
comp-lzo
verb 4
register-dns

On my LAN router (Tomato based) I added a single static route as an attempt to get my LAN machines to see VPN clients:

Destination         Gateway           Subnet Mask      Metric   Interface	Description
192.168.137.0       192.168.253.2     255.255.255.0	 0        LAN

Right now, I have a single client connected with VPN assigned IP of 192.168.137.14. Here is the result of a failed tracert:

Tracing route to 192.168.137.14 over a maximum of 30 hops

  1    <1 ms     *       <1 ms  nfs-file [192.168.253.2]
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4     *        *        *     Request timed out.

It's correctly (I believe) hopping to my OpenVPN server, but then it gets stuck. If I'm on my OpenVPN server (nfs-file), I can access the VPN clients:

C:\OpenVPN\easy-rsa>tracert 192.168.137.14

Tracing route to NFS-NOTEBOOK [192.168.137.14]
over a maximum of 30 hops:

  1   116 ms   112 ms   187 ms  NFS-NOTEBOOK [192.168.137.14]

Trace complete.

I've been banging my head on this for quite a while. I would appreciate any help/leads.

mears

debbie10t wrote
mears wroteMy OpenVPN server is assigned a static IP of 192.168.1.2
But it is not ... ?
mears wroteThis is the servers config file:
local 192.168.253.2 ### The server real IP
server 192.168.137.0 255.255.255.0 ### The VPN IP
I see no reference to 192.168.1.x ... ?

Also, you should avoid the use of 192.168.0/1.x within your server LAN and VPN.
192.168.0/1.x networks are so widely used that you will almost cetainly run into a network conflict at some point.
However, your configs show that you are not using any of these networks so hard to say for sure ... please verify for yourself.

Thank you for catching that. I've been using 192.168.1.x/24 for so long that my mind fills in blanks for me when I type in the first couple octets. The correct LAN IP for my OpenVPN server is 192.168.253.2. As you pointed out, I ended up switching to 192.168.253.x/24 to avoid network conflicts. My apologies for the confusion.

debbie10t wrote Right now it looks like you are not finished working through our HOWTO:
HOWTO: Expanding the scope of the VPN to include additional machines

Work through that and make sure you add routing to your LAN router for the remote networks you want to connect to.
IE: the LAN address of your client (eg. Your Wife's LAN) must also have a route in the server LAN gateway

I did go through that, but maybe I missed something. It seems like there's two things:
1. Advertise the local LAN subnet to the VPN clients
2. Add a route on the server-side LAN gateway to route the VPN client to the OpenVPN server

For #1, I think

push "redirect-gateway def1"

is all that is required. I did originally have:

push "route 192.168.253.0 255.255.255.0"

in there and it didn't seem to make a difference. In any event, I put that pack in just to make sure.

For #2, I have the following static route (details in OP) added in my router:

Destination         Gateway           Subnet Mask      Metric   Interface   Description
192.168.137.0       192.168.253.2     255.255.255.0    0        LAN

Does that look right?

One thing I may not have covered correctly, is your comment:

Work through that and make sure you add routing to your LAN router for the remote networks you want to connect to.
IE: the LAN address of your client (eg. Your Wife's LAN) must also have a route in the server LAN gateway

For the VPN client, I'm attempting to connect, it is assigned a LAN (pre-VPN) IP of 192.168.43.165. I attempted to add a second route in my local LAN router to route 192.168.43.x/24 through my OpenVPN server:

Destination         Gateway           Subnet Mask      Metric   Interface   Description
192.168.43.0        192.168.253.2     255.255.255.0    0        LAN

When I did that, I was still not able to ping the connected VPN client from any machine other than the OpenVPN server. Here was the tracert that shows the the new rule working (redirecting through OpenVPN server):

C:\Users\Josh>tracert 192.168.43.165

Tracing route to 192.168.43.165 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  unknown [192.168.253.1]
  2     1 ms     *        1 ms  nfs-file [192.168.253.2]
  3     *        *        *     Request timed out.
  4     *        *        *     Request timed out.
  5  ^C

If I attempt to tracert to the VPN clients, VPN assigned address, same thing:

C:\Users\Josh>tracert 192.168.137.14

Tracing route to 192.168.137.14 over a maximum of 30 hop

  1     2 ms     *        2 ms  nfs-file [192.168.253.2]
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4     *        *        *     Request timed out.

Again, I appreciate any/all help.