Can ping machines on server's network, but nothing else

Nichos

I'm at a loss on this one. Hoping someone here can figure out what I'm doing wrong.

I've got a Windows 2012 server on a LAN (192.168.0.0/23) running OpenVPN. The client connects to the server fine, routes are getting added, the client can ping the machines on the server side LAN, but nothing else seems to work. DNS doesn't work, I can't SSH to machines, I can't RDP, nothing but ping it seems.

server.ovpn

local 192.168.1.44
port 1194
proto udp
dev tun

# Certs
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key"  # This file should be kept secret
dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem"

# VPN Subnet
topology subnet
server 10.8.0.0 255.255.255.0

# Maintain list of client IPs
ifconfig-pool-persist ipp.txt

# Push route to LAN
push "route 192.168.0.0 255.255.254.0"

# DNS servers
push "dhcp-option DNS 192.168.1.29"
push "dhcp-option DNS 192.168.1.42"

keepalive 10 120
comp-lzo

persist-key
persist-tun

status openvpn-status.log
verb 3

Client is Windows 7 Pro

client.ovpn

# Client mode
client

dev tun
proto udp
remote <<MyServer>> 1194

resolv-retry infinite
nobind
persist-key
persist-tun

# Certs
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\schumachern-7b.crt"
key "C:\\Program Files\\OpenVPN\\config\\schumachern-7b.key"

ns-cert-type server
comp-lzo
verb 3

Server Connection Log

Thu Jun 12 12:51:37 2014 OpenVPN 2.3.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Jun  5 2014
Thu Jun 12 12:51:37 2014 library versions: OpenSSL 1.0.1h 5 Jun 2014, LZO 2.05
Thu Jun 12 12:51:37 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Jun 12 12:51:37 2014 Need hold release from management interface, waiting...
Thu Jun 12 12:51:37 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Jun 12 12:51:38 2014 MANAGEMENT: CMD 'state on'
Thu Jun 12 12:51:38 2014 MANAGEMENT: CMD 'log all on'
Thu Jun 12 12:51:38 2014 MANAGEMENT: CMD 'hold off'
Thu Jun 12 12:51:38 2014 MANAGEMENT: CMD 'hold release'
Thu Jun 12 12:51:38 2014 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Thu Jun 12 12:51:38 2014 Diffie-Hellman initialized with 1024 bit key
Thu Jun 12 12:51:38 2014 Socket Buffers: R=[65536->65536] S=[65536->65536]
Thu Jun 12 12:51:38 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Jun 12 12:51:38 2014 MANAGEMENT: >STATE:1402602698,ASSIGN_IP,,10.8.0.1,
Thu Jun 12 12:51:38 2014 open_tun, tt->ipv6=0
Thu Jun 12 12:51:38 2014 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{B5984CD8-0B74-45FA-9E3B-F55EC0AE7317}.tap
Thu Jun 12 12:51:38 2014 TAP-Windows Driver Version 9.9 
Thu Jun 12 12:51:38 2014 Set TAP-Windows TUN subnet mode network/local/netmask = 10.8.0.0/10.8.0.1/255.255.255.0 [SUCCEEDED]
Thu Jun 12 12:51:38 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.1/255.255.255.0 on interface {B5984CD8-0B74-45FA-9E3B-F55EC0AE7317} [DHCP-serv: 10.8.0.254, lease-time: 31536000]
Thu Jun 12 12:51:38 2014 Sleeping for 10 seconds...
Thu Jun 12 12:51:48 2014 Successful ARP Flush on interface [17] {B5984CD8-0B74-45FA-9E3B-F55EC0AE7317}
Thu Jun 12 12:51:48 2014 UDPv4 link local (bound): [AF_INET]192.168.1.44:1194
Thu Jun 12 12:51:48 2014 UDPv4 link remote: [undef]
Thu Jun 12 12:51:48 2014 MULTI: multi_init called, r=256 v=256
Thu Jun 12 12:51:48 2014 IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
Thu Jun 12 12:51:48 2014 ifconfig_pool_read(), in='schumachern-7b,10.8.0.4', TODO: IPv6
Thu Jun 12 12:51:48 2014 succeeded -> ifconfig_pool_set()
Thu Jun 12 12:51:48 2014 IFCONFIG POOL LIST
Thu Jun 12 12:51:48 2014 schumachern-7b,10.8.0.4
Thu Jun 12 12:51:48 2014 Initialization Sequence Completed
Thu Jun 12 12:51:48 2014 MANAGEMENT: >STATE:1402602708,CONNECTED,SUCCESS,10.8.0.1,
Thu Jun 12 12:51:57 2014 <<MyPublicIP>>:3817 TLS: Initial packet from [AF_INET]<<MyPublicIP>>, sid=686c9058 3114de13
Thu Jun 12 12:52:00 2014 <<MyPublicIP>>:3817 VERIFY OK: depth=1, C=US, ST=NA, L=MyCity, O=<<MyCompany, OU=MyOU, CN=vpn2012-CA, name=vpn2012, emailAddress=<<MyEmail>>
Thu Jun 12 12:52:00 2014 <<MyPublicIP>>:3817 VERIFY OK: depth=0, C=US, ST=NA, L=MyCity, O=<<MyCompany, OU=MyOU, CN=schumachern-7b, name=schumachern-7b, emailAddress=<<MyEmail>>
Thu Jun 12 12:52:00 2014 <<MyPublicIP>>:3817 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Jun 12 12:52:00 2014 <<MyPublicIP>>:3817 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Jun 12 12:52:00 2014 <<MyPublicIP>>:3817 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Jun 12 12:52:00 2014 <<MyPublicIP>>:3817 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Jun 12 12:52:01 2014 <<MyPublicIP>>:3817 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Jun 12 12:52:01 2014 <<MyPublicIP>>:3817 [schumachern-7b] Peer Connection Initiated with [AF_INET]<<MyPublicIP>>:3817
Thu Jun 12 12:52:01 2014 schumachern-7b/<<MyPublicIP>>:3817 MULTI_sva: pool returned IPv4=10.8.0.4, IPv6=(Not enabled)
Thu Jun 12 12:52:01 2014 schumachern-7b/<<MyPublicIP>>:3817 MULTI: Learn: 10.8.0.4 -> schumachern-7b/<<MyPublicIP>>:3817
Thu Jun 12 12:52:01 2014 schumachern-7b/<<MyPublicIP>>:3817 MULTI: primary virtual IP for schumachern-7b/<<MyPublicIP>>:3817: 10.8.0.4
Thu Jun 12 12:52:02 2014 schumachern-7b/<<MyPublicIP>>:3817 PUSH: Received control message: 'PUSH_REQUEST'
Thu Jun 12 12:52:02 2014 schumachern-7b/<<MyPublicIP>>:3817 send_push_reply(): safe_cap=940
Thu Jun 12 12:52:02 2014 schumachern-7b/<<MyPublicIP>>:3817 SENT CONTROL [schumachern-7b]: 'PUSH_REPLY,route 192.168.0.0 255.255.254.0,dhcp-option DNS 192.168.1.29,dhcp-option DNS 192.168.1.42,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.4 255.255.255.0' (status=1)

Client Connection Log

Thu Jun 12 12:51:56 2014 OpenVPN 2.3.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Jun  5 2014
Thu Jun 12 12:51:56 2014 library versions: OpenSSL 1.0.1h 5 Jun 2014, LZO 2.05
Thu Jun 12 12:51:56 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Jun 12 12:51:56 2014 Need hold release from management interface, waiting...
Thu Jun 12 12:51:56 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Jun 12 12:51:56 2014 MANAGEMENT: CMD 'state on'
Thu Jun 12 12:51:56 2014 MANAGEMENT: CMD 'log all on'
Thu Jun 12 12:51:56 2014 MANAGEMENT: CMD 'hold off'
Thu Jun 12 12:51:56 2014 MANAGEMENT: CMD 'hold release'
Thu Jun 12 12:51:57 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Jun 12 12:51:57 2014 MANAGEMENT: >STATE:1402602717,RESOLVE,,,
Thu Jun 12 12:51:57 2014 UDPv4 link local: [undef]
Thu Jun 12 12:51:57 2014 UDPv4 link remote: [AF_INET]<<ServerPublicIP>>:1194
Thu Jun 12 12:51:57 2014 MANAGEMENT: >STATE:1402602717,WAIT,,,
Thu Jun 12 12:51:57 2014 MANAGEMENT: >STATE:1402602717,AUTH,,,
Thu Jun 12 12:51:57 2014 TLS: Initial packet from [AF_INET]<<ServerPublicIP>>:1194, sid=02cce177 0bc1edd4
Thu Jun 12 12:51:58 2014 VERIFY OK: depth=1, C=US, ST=NA, L=MyCity, O=MyCompany, OU=MyOU, CN=vpn2012-CA, name=vpn2012, emailAddress=MyEmail
Thu Jun 12 12:51:58 2014 VERIFY OK: nsCertType=SERVER
Thu Jun 12 12:51:58 2014 VERIFY OK: depth=0, C=US, ST=NA, L=MyCity, O=MyCompany, OU=MyOU, CN=server, name=server, emailAddress=MyEmail
Thu Jun 12 12:52:00 2014 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Jun 12 12:52:00 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Jun 12 12:52:00 2014 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Jun 12 12:52:00 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Jun 12 12:52:00 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Jun 12 12:52:00 2014 [server] Peer Connection Initiated with [AF_INET]<<ServerPublicIP>>:1194
Thu Jun 12 12:52:01 2014 MANAGEMENT: >STATE:1402602721,GET_CONFIG,,,
Thu Jun 12 12:52:02 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Jun 12 12:52:02 2014 PUSH: Received control message: 'PUSH_REPLY,route 192.168.0.0 255.255.254.0,dhcp-option DNS 192.168.1.29,dhcp-option DNS 192.168.1.42,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.4 255.255.255.0'
Thu Jun 12 12:52:02 2014 OPTIONS IMPORT: timers and/or timeouts modified
Thu Jun 12 12:52:02 2014 OPTIONS IMPORT: --ifconfig/up options modified
Thu Jun 12 12:52:02 2014 OPTIONS IMPORT: route options modified
Thu Jun 12 12:52:02 2014 OPTIONS IMPORT: route-related options modified
Thu Jun 12 12:52:02 2014 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Jun 12 12:52:02 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Jun 12 12:52:02 2014 MANAGEMENT: >STATE:1402602722,ASSIGN_IP,,10.8.0.4,
Thu Jun 12 12:52:02 2014 open_tun, tt->ipv6=0
Thu Jun 12 12:52:02 2014 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{ABE0205B-71E7-41B8-8EAF-DFAB445274E8}.tap
Thu Jun 12 12:52:02 2014 TAP-Windows Driver Version 9.9 
Thu Jun 12 12:52:02 2014 Set TAP-Windows TUN subnet mode network/local/netmask = 10.8.0.0/10.8.0.4/255.255.255.0 [SUCCEEDED]
Thu Jun 12 12:52:02 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.4/255.255.255.0 on interface {ABE0205B-71E7-41B8-8EAF-DFAB445274E8} [DHCP-serv: 10.8.0.254, lease-time: 31536000]
Thu Jun 12 12:52:02 2014 Successful ARP Flush on interface [20] {ABE0205B-71E7-41B8-8EAF-DFAB445274E8}
Thu Jun 12 12:52:07 2014 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Thu Jun 12 12:52:07 2014 MANAGEMENT: >STATE:1402602727,ADD_ROUTES,,,
Thu Jun 12 12:52:07 2014 C:\Windows\system32\route.exe ADD 192.168.0.0 MASK 255.255.254.0 10.8.0.1
Thu Jun 12 12:52:07 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Jun 12 12:52:07 2014 Route addition via IPAPI succeeded [adaptive]
Thu Jun 12 12:52:07 2014 Initialization Sequence Completed
Thu Jun 12 12:52:07 2014 MANAGEMENT: >STATE:1402602727,CONNECTED,SUCCESS,10.8.0.4,208.75.44.143

I've turned firewalls off on both machines, I've added a static route on the router for the Server side LAN to route 10.8.0.0/24 to 192.168.1.44 (LAN IP of server), and I've even confirmed via wireshark that the pings are coming from the machines on the LAN.

Where should I be looking that I haven't yet?

Nichos

debbie10t wrote What network is your client ?

Client network is 192.168.43.0/24

debbie10t wrote Presume you mean "Machines on the VPN" ?

Actually, I meant that the ping responses are coming from the Server side LAN.

debbie10t wrote What does Wireshark show for the source IP ?

Source IP on the ping packets are 10.8.0.4 (or whatever happens to be the client IP that time around)

debbie10t wrote Did you add routing to your server side default-gateway for the VPN network ?

Yeah, the gateway is the router and there is a static route in there for getting back to the VPN network. Also, I forgot to mention, I have enabled IP forwarding in the registry on the server.

Playing with it a little more, I think I don't have something set right on the Juniper router. When connected to the VPN, I actually can RDP to the VPN server, and SSH to the router just fine, but nothing makes it past the router after that except ICMP.

Nichos

So, still haven't got this to work yet. Everything looks like it should work, but it just doesn't. I did find out today that machines on the server side LAN can access the VPN clients just fine. So really it's just anything besides ICMP going from the VPN subnet to the local LAN is just lost. Any thoughts?

Nichos

Nichos wroteSo, still haven't got this to work yet. Everything looks like it should work, but it just doesn't. I did find out today that machines on the server side LAN can access the VPN clients just fine. So really it's just anything besides ICMP going from the VPN subnet to the local LAN is just lost. Any thoughts?

I just noticed that even though I've set the IPEnableRouter to 1 in the registry, when I do ipconfig /all it still claims IP Routing Enabled is off. Not sure why. I did reboot after the change. It's a Windows Server 2012 box and RRAS is also setup if that makes any difference.

ienstein

I have this exact same problem myself. You might try the push "redirect-gateway def1 bypass-dhcp" option on the server temporarily, and see if that works. If it does, compare the routing tables in the 2 scenarios for a possible clue.