Hi everyone, i followed the instructions on this site: http://www.smallnetbuilder.com/security/security-howto/30353-how-to-set-up-a-site-to-site-vpn-with-openvpn to connect two offices. The network topology looks like this: Site A: Server A: - Configured as OpenVPN server - Hyper-V Ubuntu box living on a Microsoft Server 2008 - It has its own network card attached - Lives behind router A with following configuration: [code]eth0 Link encap:Ethernet Hardware Adresse 00:15:5d:0a:21:02 inet Adresse:192.168.10.63 Bcast:192.168.10.255 Maske:255.255.255.0 inet6-Adresse: fe80::215:5dff:fe0a:2102/64 Gültigkeitsbereich:Verbindung UP BROADCAST RUNNING MULTICAST MTU:1500 Metrik:1 RX-Pakete:5059895 Fehler:0 Verloren:0 Überläufe:0 Fenster:0 TX-Pakete:2610854 Fehler:0 Verloren:0 Überläufe:0 Träger:0 Kollisionen:0 Sendewarteschlangenlänge:1000 RX-Bytes:537788999 (537.7 MB) TX-Bytes:188249098 (188.2 MB) lo Link encap:Lokale Schleife inet Adresse:127.0.0.1 Maske:255.0.0.0 inet6-Adresse: ::1/128 Gültigkeitsbereich:Maschine UP LOOPBACK RUNNING MTU:65536 Metrik:1 RX-Pakete:0 Fehler:0 Verloren:0 Überläufe:0 Fenster:0 TX-Pakete:0 Fehler:0 Verloren:0 Überläufe:0 Träger:0 Kollisionen:0 Sendewarteschlangenlänge:0 RX-Bytes:0 (0.0 B) TX-Bytes:0 (0.0 B) tun0 Link encap:UNSPEC Hardware Adresse 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet Adresse:10.8.0.1 P-z-P:10.8.0.2 Maske:255.255.255.255 UP PUNKTZUPUNKT RUNNING NOARP MULTICAST MTU:1500 Metrik:1 RX-Pakete:0 Fehler:0 Verloren:0 Überläufe:0 Fenster:0 TX-Pakete:27 Fehler:0 Verloren:0 Überläufe:0 Träger:0 Kollisionen:0 Sendewarteschlangenlänge:100 RX-Bytes:0 (0.0 B) TX-Bytes:1368 (1.3 KB) [/code] Router A: - has following forwarding rule [code] (UDP) port: 1194 to: 192.168.10.63:1194 [/code] - And the following route configured: [code] network: 192.168.11.0 subnet: 255.255.255.0 gateway: 192.168.10.63 [/code] Site B: Server B: - Raspberry Pi (Raspbian) - Configured as OpenVPN client - Lives behind router B with following configuration: [code] eth0 Link encap:Ethernet HWaddr b8:27:eb:94:3e:88 inet addr:192.168.11.27 Bcast:192.168.11.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:5380023 errors:0 dropped:0 overruns:0 frame:0 TX packets:6130239 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:130072321 (124.0 MiB) TX bytes:422162099 (402.6 MiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.8.0.6 P-t-P:10.8.0.5 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:3 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:152 (152.0 B) TX bytes:0 (0.0 B) [/code] Router B: - has the following route configured: [code] network: 192.168.10.0 subnet: 255.255.255.0 gateway: 192.168.11.27 [/code] Server A has the following .conf file: [code] local 192.168.10.63 port 1194 proto udp dev tun0 ca /etc/openvpn/certs/ca.crt cert /etc/openvpn/certs/server.crt key /etc/openvpn/keys/server.key # This file should be kept secret dh /etc/openvpn/dh2048.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist /etc/openvpn/ipp.txt push "route 192.168.10.0 255.255.255.0" client-config-dir client-configs route 192.168.11.0 255.255.255.0 keepalive 10 120 cipher BF-CBC # Blowfish (default) max-clients 5 user nobody group nogroup persist-key persist-tun status /var/log/openvpn-status.log verb 6 #daemon client-to-client [/code] route -n on Server A gives me: [code] Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.11.1 0.0.0.0 UG 0 0 0 eth0 10.8.0.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun0 10.8.0.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 192.168.10.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun0 192.168.11.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 [/code] Server B has the following .conf file: [code] client dev tun0 remote dyndns.router-a.com ca /etc/openvpn/certs/ca.crt cert /etc/openvpn/certs/reutlingen.crt key /etc/openvpn/keys/reutlingen.key cipher BF-CBC proto udp port 1194 log-append /var/log/openvpn.log verb 4 user nobody group nogroup #daemon persist-tun persist-key #ns-cert-type server [/code] route -n on server B gives me: [code] Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.11.1 0.0.0.0 UG 0 0 0 eth0 10.8.0.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun0 10.8.0.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 192.168.10.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun0 192.168.11.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 [/code] On Server A, net.ipv4.ip_forward is set to 1 What i want: - All Hosts on site A can communicate with Hosts on site B and vice versa. What is currently working: - Pinging the server A's tunnel ip from B and vice versa - VPN set up seems to work. The only suspicious line in the log file of server B (client) is SIOCADDRT: File exists: [code]Wed Jun 4 10:18:08 2014 us=903731 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key Wed Jun 4 10:18:08 2014 us=904050 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Wed Jun 4 10:18:08 2014 us=904542 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key Wed Jun 4 10:18:08 2014 us=904746 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Wed Jun 4 10:18:08 2014 us=905421 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA Wed Jun 4 10:18:08 2014 us=905770 [server] Peer Connection Initiated with [AF_INET]217.8.50.182:1194 Wed Jun 4 10:18:11 2014 us=328955 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1) Wed Jun 4 10:18:11 2014 us=371784 PUSH: Received control message: 'PUSH_REPLY,route 192.168.10.0 255.255.255.0,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,route 192.168.10.0 255.255.255.0 vpn_gateway,ifconfig 10.8.0.6 10.8.0.5' Wed Jun 4 10:18:11 2014 us=372487 OPTIONS IMPORT: timers and/or timeouts modified Wed Jun 4 10:18:11 2014 us=372671 OPTIONS IMPORT: --ifconfig/up options modified Wed Jun 4 10:18:11 2014 us=372808 OPTIONS IMPORT: route options modified Wed Jun 4 10:18:11 2014 us=374185 ROUTE default_gateway=192.168.11.1 Wed Jun 4 10:18:11 2014 us=388950 TUN/TAP device tun0 opened Wed Jun 4 10:18:11 2014 us=389398 TUN/TAP TX queue length set to 100 Wed Jun 4 10:18:11 2014 us=389642 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Wed Jun 4 10:18:11 2014 us=389979 /sbin/ifconfig tun0 10.8.0.6 pointopoint 10.8.0.5 mtu 1500 Wed Jun 4 10:18:11 2014 us=402508 /sbin/route add -net 192.168.10.0 netmask 255.255.255.0 gw 10.8.0.5 Wed Jun 4 10:18:11 2014 us=423991 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.5 Wed Jun 4 10:18:11 2014 us=441064 /sbin/route add -net 192.168.10.0 netmask 255.255.255.0 gw 10.8.0.5 SIOCADDRT: File exists Wed Jun 4 10:18:11 2014 us=459433 ERROR: Linux route add command failed: external program exited with error status: 7 Wed Jun 4 10:18:11 2014 us=459837 GID set to nogroup Wed Jun 4 10:18:11 2014 us=460088 UID set to nobody Wed Jun 4 10:18:11 2014 us=460256 Initialization Sequence Completed[/code] What is not working: - Ping from server A to server B and vice versa - Ping from different host in site B to different host in site A and vice versa From what I see, I think there are some problems with the routing information given. Unfortunately im not experienced at all with iptables/routing. Thanks in advance, Johannes

hi there, with a quick look you are missing 2 things: 1) create a ccd file named reutlingen with the following in it: [code]iroute 192.168.11.0 255.255.255.0[/code] 2) add to your server config [code]route 192.168.11.0 255.255.255.0[/code] Michael.

Hi, thanks for your reply. I have allready created a ccd file named reutlingen with the following content: [code] iroute 192.168.11.0 255.255.255.0 push "route 192.168.10.0 255.255.255.0 vpn_gateway" [/code] removing the second line did not do the trick either. [code] route 192.168.11.0 255.255.255.0 [/code] is allready present in the servers (A) config. Johannes

ok for test add this to your ccd file [code]ifconfig-push 10.8.0.10 10.8.0.9[/code] check if your client gets 10.8.0.10 ip... Michael.

cannot ping hosts in remote subnet

bstore

Hi everyone,

i followed the instructions on this site: http://www.smallnetbuilder.com/security/security-howto/30353-how-to-set-up-a-site-to-site-vpn-with-openvpn
to connect two offices. The network topology looks like this:

Site A:
Server A:
- Configured as OpenVPN server
- Hyper-V Ubuntu box living on a Microsoft Server 2008
- It has its own network card attached
- Lives behind router A with following configuration:

eth0      Link encap:Ethernet  Hardware Adresse 00:15:5d:0a:21:02  
          inet Adresse:192.168.10.63  Bcast:192.168.10.255  Maske:255.255.255.0
          inet6-Adresse: fe80::215:5dff:fe0a:2102/64 Gültigkeitsbereich:Verbindung
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metrik:1
          RX-Pakete:5059895 Fehler:0 Verloren:0 Überläufe:0 Fenster:0
          TX-Pakete:2610854 Fehler:0 Verloren:0 Überläufe:0 Träger:0
          Kollisionen:0 Sendewarteschlangenlänge:1000 
          RX-Bytes:537788999 (537.7 MB)  TX-Bytes:188249098 (188.2 MB)

lo        Link encap:Lokale Schleife  
          inet Adresse:127.0.0.1  Maske:255.0.0.0
          inet6-Adresse: ::1/128 Gültigkeitsbereich:Maschine
          UP LOOPBACK RUNNING  MTU:65536  Metrik:1
          RX-Pakete:0 Fehler:0 Verloren:0 Überläufe:0 Fenster:0
          TX-Pakete:0 Fehler:0 Verloren:0 Überläufe:0 Träger:0
          Kollisionen:0 Sendewarteschlangenlänge:0 
          RX-Bytes:0 (0.0 B)  TX-Bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  Hardware Adresse 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet Adresse:10.8.0.1  P-z-P:10.8.0.2  Maske:255.255.255.255
          UP PUNKTZUPUNKT RUNNING NOARP MULTICAST  MTU:1500  Metrik:1
          RX-Pakete:0 Fehler:0 Verloren:0 Überläufe:0 Fenster:0
          TX-Pakete:27 Fehler:0 Verloren:0 Überläufe:0 Träger:0
          Kollisionen:0 Sendewarteschlangenlänge:100 
          RX-Bytes:0 (0.0 B)  TX-Bytes:1368 (1.3 KB)

Router A:
- has following forwarding rule

(UDP)
port: 1194
to: 192.168.10.63:1194

- And the following route configured:

network: 192.168.11.0
subnet: 255.255.255.0 
gateway: 192.168.10.63

Site B:
Server B:
- Raspberry Pi (Raspbian)
- Configured as OpenVPN client
- Lives behind router B with following configuration:

eth0      Link encap:Ethernet  HWaddr b8:27:eb:94:3e:88  
          inet addr:192.168.11.27  Bcast:192.168.11.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:5380023 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6130239 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:130072321 (124.0 MiB)  TX bytes:422162099 (402.6 MiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.6  P-t-P:10.8.0.5  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:3 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:152 (152.0 B)  TX bytes:0 (0.0 B)

Router B:
- has the following route configured:

network: 192.168.10.0
subnet: 255.255.255.0
gateway: 192.168.11.27

Server A has the following .conf file:

local 192.168.10.63
port 1194
proto udp
dev tun0
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/server.crt
key /etc/openvpn/keys/server.key  # This file should be kept secret
dh /etc/openvpn/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /etc/openvpn/ipp.txt
push "route 192.168.10.0 255.255.255.0"
client-config-dir client-configs
route 192.168.11.0 255.255.255.0
keepalive 10 120
cipher BF-CBC        # Blowfish (default)
max-clients 5
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 6
#daemon
client-to-client

route -n on Server A gives me:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.11.1    0.0.0.0         UG    0      0        0 eth0
10.8.0.0        10.8.0.5        255.255.255.0   UG    0      0        0 tun0
10.8.0.5        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
192.168.10.0    10.8.0.5        255.255.255.0   UG    0      0        0 tun0
192.168.11.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0

Server B has the following .conf file:

client
dev tun0
remote dyndns.router-a.com
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/reutlingen.crt
key /etc/openvpn/keys/reutlingen.key
cipher BF-CBC
proto udp
port 1194
log-append /var/log/openvpn.log
verb 4
user nobody
group nogroup
#daemon
persist-tun
persist-key
#ns-cert-type server

route -n on server B gives me:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.11.1    0.0.0.0         UG    0      0        0 eth0
10.8.0.0        10.8.0.5        255.255.255.0   UG    0      0        0 tun0
10.8.0.5        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
192.168.10.0    10.8.0.5        255.255.255.0   UG    0      0        0 tun0
192.168.11.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0

On Server A, net.ipv4.ip_forward is set to 1

What i want:
- All Hosts on site A can communicate with Hosts on site B and vice versa.

What is currently working:
- Pinging the server A's tunnel ip from B and vice versa
- VPN set up seems to work. The only suspicious line in the log file of server B (client) is SIOCADDRT: File exists:

Wed Jun  4 10:18:08 2014 us=903731 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Jun  4 10:18:08 2014 us=904050 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jun  4 10:18:08 2014 us=904542 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Jun  4 10:18:08 2014 us=904746 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jun  4 10:18:08 2014 us=905421 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Jun  4 10:18:08 2014 us=905770 [server] Peer Connection Initiated with [AF_INET]217.8.50.182:1194
Wed Jun  4 10:18:11 2014 us=328955 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Jun  4 10:18:11 2014 us=371784 PUSH: Received control message: 'PUSH_REPLY,route 192.168.10.0 255.255.255.0,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,route 192.168.10.0 255.255.255.0 vpn_gateway,ifconfig 10.8.0.6 10.8.0.5'
Wed Jun  4 10:18:11 2014 us=372487 OPTIONS IMPORT: timers and/or timeouts modified
Wed Jun  4 10:18:11 2014 us=372671 OPTIONS IMPORT: --ifconfig/up options modified
Wed Jun  4 10:18:11 2014 us=372808 OPTIONS IMPORT: route options modified
Wed Jun  4 10:18:11 2014 us=374185 ROUTE default_gateway=192.168.11.1
Wed Jun  4 10:18:11 2014 us=388950 TUN/TAP device tun0 opened
Wed Jun  4 10:18:11 2014 us=389398 TUN/TAP TX queue length set to 100
Wed Jun  4 10:18:11 2014 us=389642 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Jun  4 10:18:11 2014 us=389979 /sbin/ifconfig tun0 10.8.0.6 pointopoint 10.8.0.5 mtu 1500
Wed Jun  4 10:18:11 2014 us=402508 /sbin/route add -net 192.168.10.0 netmask 255.255.255.0 gw 10.8.0.5
Wed Jun  4 10:18:11 2014 us=423991 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.5
Wed Jun  4 10:18:11 2014 us=441064 /sbin/route add -net 192.168.10.0 netmask 255.255.255.0 gw 10.8.0.5
SIOCADDRT: File exists
Wed Jun  4 10:18:11 2014 us=459433 ERROR: Linux route add command failed: external program exited with error status: 7
Wed Jun  4 10:18:11 2014 us=459837 GID set to nogroup
Wed Jun  4 10:18:11 2014 us=460088 UID set to nobody
Wed Jun  4 10:18:11 2014 us=460256 Initialization Sequence Completed

What is not working:
- Ping from server A to server B and vice versa
- Ping from different host in site B to different host in site A and vice versa

From what I see, I think there are some problems with the routing information given. Unfortunately im not experienced at all with iptables/routing.

Thanks in advance,
Johannes

maikcat

hi there,

with a quick look you are missing 2 things:

1) create a ccd file named reutlingen with the following in it:

iroute 192.168.11.0 255.255.255.0

2) add to your server config

route 192.168.11.0 255.255.255.0

Michael.

bstore

Hi,

thanks for your reply. I have allready created a ccd file named reutlingen with the following content:

iroute 192.168.11.0 255.255.255.0
push "route 192.168.10.0 255.255.255.0 vpn_gateway"

removing the second line did not do the trick either.

route 192.168.11.0 255.255.255.0

is allready present in the servers (A) config.

Johannes

maikcat

ok for test add this to your ccd file

ifconfig-push 10.8.0.10 10.8.0.9

check if your client gets 10.8.0.10 ip...

Michael.

bstore

hi,

if i do this, the client gets the ip 10.8.0.10:

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.10  P-t-P:10.8.0.9  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

But ping does not work either. What now?

Johannes

maikcat

did you enabled ip forwarding on your openvpn client?

please try the folowing and tell us which works..

ping from openvpn client:

servers tun ip,
servers lan ip,
a pc in your server lan,

then from a pc on your client side ping:

openvpn clients tun ip, (.10)
openvpn server tun ip,
openvpn server lan ip,

Michael.

bstore

hi,

i did not enable ip forwarding on client side. But i have enabled it for the following ping tests.

server ifconfig:

eth0      Link encap:Ethernet  Hardware Adresse 00:15:5d:0a:21:02  
          inet Adresse:192.168.10.63  Bcast:192.168.10.255  Maske:255.255.255.0
          inet6-Adresse: fe80::215:5dff:fe0a:2102/64 Gültigkeitsbereich:Verbindung
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metrik:1
          RX-Pakete:12795428 Fehler:0 Verloren:0 Überläufe:0 Fenster:0
          TX-Pakete:6657400 Fehler:0 Verloren:0 Überläufe:0 Träger:0
          Kollisionen:0 Sendewarteschlangenlänge:1000 
          RX-Bytes:1427696801 (1.4 GB)  TX-Bytes:504317675 (504.3 MB)

lo        Link encap:Lokale Schleife  
          inet Adresse:127.0.0.1  Maske:255.0.0.0
          inet6-Adresse: ::1/128 Gültigkeitsbereich:Maschine
          UP LOOPBACK RUNNING  MTU:65536  Metrik:1
          RX-Pakete:0 Fehler:0 Verloren:0 Überläufe:0 Fenster:0
          TX-Pakete:0 Fehler:0 Verloren:0 Überläufe:0 Träger:0
          Kollisionen:0 Sendewarteschlangenlänge:0 
          RX-Bytes:0 (0.0 B)  TX-Bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  Hardware Adresse 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet Adresse:10.8.0.1  P-z-P:10.8.0.2  Maske:255.255.255.255
          UP PUNKTZUPUNKT RUNNING NOARP MULTICAST  MTU:1500  Metrik:1
          RX-Pakete:2070 Fehler:0 Verloren:0 Überläufe:0 Fenster:0
          TX-Pakete:1495 Fehler:0 Verloren:0 Überläufe:0 Träger:0
          Kollisionen:0 Sendewarteschlangenlänge:100 
          RX-Bytes:146344 (146.3 KB)  TX-Bytes:1054433 (1.0 MB)

client ifconfig:

eth0      Link encap:Ethernet  HWaddr b8:27:eb:94:3e:88  
          inet addr:192.168.11.27  Bcast:192.168.11.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:24348 errors:0 dropped:0 overruns:0 frame:0
          TX packets:27943 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:16526915 (15.7 MiB)  TX bytes:19045852 (18.1 MiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.10  P-t-P:10.8.0.9  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:1215 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1705 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:826367 (806.9 KiB)  TX bytes:126626 (123.6 KiB)

ping from openvpn client:

servers tun ip (ping 10.8.0.1): works
servers lan ip (ping 192.168.10.63): works
a pc in your server lan (ping 192.168.10.23 (workstation), ping 192.168.10.21 (openvpn servers hyper-v host)): does not work

then from a pc on your client side ping:

openvpn clients tun ip (ping 10.8.0.10): does not work
openvpn server tun ip (ping 10.8.0.1): does not work
openvpn server lan ip (ping 192.168.10.63): works (other workstations in servers lan work too but not vice versa)

Johannes

maikcat

step by step approach...

a pc in your server lan (ping 192.168.10.23 (workstation), ping 192.168.10.21 (openvpn servers hyper-v host)): does not work

use your openvpn's servers lan ip (192.168.10.63) as the default gateway on 192.168.10.23 based host and report back the results.

ip forwarding MUST be enabled on BOTH server/client in order lan-to-lan scenario to work...

also DISABLE any firewalls involved for testing.

Michael.

bstore

Hi,

when setting the servers ip address as gateway I was not able to ping 192.168.11.21 (client workstation). I was able to ping google.com though. While messing around with the gw i killed my own teamviewer session so I can't give you more details until Monday :x

Johannes