Hello, I configured my VPN finally. I can't ping all devices, don't know why. There are devices that I can ping and devices that I can't ping :( CLIENT SUBNET: 192.168.1.0 SERVER SUBNET: 192.168.20.0 VPN SERVER IP (WINDOWS 7) - 192.168.20.120 - 10.8.0.1 [color=#008000][b]PING OK[/b][/color] FIREWALL DISABLED - [b]IP FORWARD IS ENABLED[/b] PRINTER HP - 192.168.20.109 [color=#008000][b]PING OK[/b][/color] PRINTER KYOCERA - 192.168.20.60 [color=#BF0000][b]PING FAILED[/b][/color] PC WITH XP - 192.168.20.102 [color=#008000][b]PING OK[/b][/color] FIREWALL DISABLED PC WITH WIN7 - 192.168.20.101 [color=#BF0000][b]PING FAILED[/b][/color] FIREWALL DISABLED ROUTER - 192.168.20.1 [color=#008000][b]PING OK[/b][/color] [b]STATIC ROUTE 10.8.0.0 TO 192.168.20.120[/b] and [b]PORT 1194 FORWADRED TO 192.168.20.120[/b] CLIENT IP - 10.8.0.6 - FIREWALL DISABLED ROUTE PRINT OF VPN SERVER [img]http://zapodaj.net/images/a576f4a59fd8e.png[/img] [b]VPN SERVER CFG:[/b] [code]local 192.168.20.120 port 1194 proto udp dev tun ca ca.crt cert server.crt key server.key dh dh1024.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "route 192.168.20.0 255.255.255.0" keepalive 10 120 comp-lzo persist-key persist-tun status openvpn-status.log verb 3[/code] [b]VPN CLIENT CFG:[/b] [code]client dev tun proto udp remote IP 1194 resolv-retry infinite nobind persist-key persist-tun ca ca.crt" cert cert.crt" key key.key" ns-cert-type server comp-lzo verb 3[/code] I will check that I can ping other PC's with WINDOWS 7 Anyone can help? Thanks.

CLIENT CAN REACH THE SUBNET BEHIND VPN SERVER BUT NOT ALL

leon111

Hello,

I configured my VPN finally. I can't ping all devices, don't know why. There are devices that I can ping and devices that I can't ping 🙁

CLIENT SUBNET: 192.168.1.0
SERVER SUBNET: 192.168.20.0

VPN SERVER IP (WINDOWS 7) - 192.168.20.120 - 10.8.0.1 PING OK FIREWALL DISABLED - IP FORWARD IS ENABLED
PRINTER HP - 192.168.20.109 PING OK
PRINTER KYOCERA - 192.168.20.60 PING FAILED
PC WITH XP - 192.168.20.102 PING OK FIREWALL DISABLED
PC WITH WIN7 - 192.168.20.101 PING FAILED FIREWALL DISABLED
ROUTER - 192.168.20.1 PING OK STATIC ROUTE 10.8.0.0 TO 192.168.20.120 and PORT 1194 FORWADRED TO 192.168.20.120

CLIENT IP - 10.8.0.6 - FIREWALL DISABLED

ROUTE PRINT OF VPN SERVER

VPN SERVER CFG:

local 192.168.20.120
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.20.0 255.255.255.0"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

VPN CLIENT CFG:

client
dev tun
proto udp
remote IP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt"
cert cert.crt"
key key.key"
ns-cert-type server
comp-lzo
verb 3

I will check that I can ping other PC's with WINDOWS 7

Anyone can help?

Thanks.

leon111

Here you have log from wireshark.

What is mal-configured?

No. Time Source Destination Protocol Length Info
1 0.000000000 10.8.0.6 192.168.20.109 ICMP 74 Echo (ping) request id=0x0001, seq=150/38400, ttl=128 (reply in 4)

Frame 1: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0
Ethernet II, Src: 00:ff:33:d6:12:53 (00:ff:33:d6:12:53), Dst: 00:ff:32:d6:12:53 (00:ff:32:d6:12:53)
Internet Protocol Version 4, Src: 10.8.0.6 (10.8.0.6), Dst: 192.168.20.109 (192.168.20.109)
Internet Control Message Protocol

No. Time Source Destination Protocol Length Info
2 0.000851000 00:ff:32:d6:12:53 Broadcast ARP 42 Who has 10.8.0.2? Tell 10.8.0.1

Frame 2: 42 bytes on wire (336 bits), 42 bytes captured (336 bits) on interface 0
Ethernet II, Src: 00:ff:32:d6:12:53 (00:ff:32:d6:12:53), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Address Resolution Protocol (request)

No. Time Source Destination Protocol Length Info
3 0.000872000 00:ff:33:d6:12:53 00:ff:32:d6:12:53 ARP 42 10.8.0.2 is at 00:ff:33:d6:12:53

Frame 3: 42 bytes on wire (336 bits), 42 bytes captured (336 bits) on interface 0
Ethernet II, Src: 00:ff:33:d6:12:53 (00:ff:33:d6:12:53), Dst: 00:ff:32:d6:12:53 (00:ff:32:d6:12:53)
Address Resolution Protocol (reply)

No. Time Source Destination Protocol Length Info
4 0.000889000 192.168.20.109 10.8.0.6 ICMP 74 Echo (ping) reply id=0x0001, seq=150/38400, ttl=254 (request in 1)

Frame 4: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0
Ethernet II, Src: 00:ff:32:d6:12:53 (00:ff:32:d6:12:53), Dst: 00:ff:33:d6:12:53 (00:ff:33:d6:12:53)
Internet Protocol Version 4, Src: 192.168.20.109 (192.168.20.109), Dst: 10.8.0.6 (10.8.0.6)
Internet Control Message Protocol

No. Time Source Destination Protocol Length Info
5 0.990519000 10.8.0.6 192.168.20.109 ICMP 74 Echo (ping) request id=0x0001, seq=151/38656, ttl=128 (reply in 6)

Frame 5: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0
Ethernet II, Src: 00:ff:33:d6:12:53 (00:ff:33:d6:12:53), Dst: 00:ff:32:d6:12:53 (00:ff:32:d6:12:53)
Internet Protocol Version 4, Src: 10.8.0.6 (10.8.0.6), Dst: 192.168.20.109 (192.168.20.109)
Internet Control Message Protocol

No. Time Source Destination Protocol Length Info
6 0.991222000 192.168.20.109 10.8.0.6 ICMP 74 Echo (ping) reply id=0x0001, seq=151/38656, ttl=254 (request in 5)

Frame 6: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0
Ethernet II, Src: 00:ff:32:d6:12:53 (00:ff:32:d6:12:53), Dst: 00:ff:33:d6:12:53 (00:ff:33:d6:12:53)
Internet Protocol Version 4, Src: 192.168.20.109 (192.168.20.109), Dst: 10.8.0.6 (10.8.0.6)
Internet Control Message Protocol

No. Time Source Destination Protocol Length Info
7 1.988970000 10.8.0.6 192.168.20.109 ICMP 74 Echo (ping) request id=0x0001, seq=152/38912, ttl=128 (reply in 8)

Frame 7: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0
Ethernet II, Src: 00:ff:33:d6:12:53 (00:ff:33:d6:12:53), Dst: 00:ff:32:d6:12:53 (00:ff:32:d6:12:53)
Internet Protocol Version 4, Src: 10.8.0.6 (10.8.0.6), Dst: 192.168.20.109 (192.168.20.109)
Internet Control Message Protocol

No. Time Source Destination Protocol Length Info
8 1.989606000 192.168.20.109 10.8.0.6 ICMP 74 Echo (ping) reply id=0x0001, seq=152/38912, ttl=254 (request in 7)

Frame 8: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0
Ethernet II, Src: 00:ff:32:d6:12:53 (00:ff:32:d6:12:53), Dst: 00:ff:33:d6:12:53 (00:ff:33:d6:12:53)
Internet Protocol Version 4, Src: 192.168.20.109 (192.168.20.109), Dst: 10.8.0.6 (10.8.0.6)
Internet Control Message Protocol

No. Time Source Destination Protocol Length Info
9 2.987388000 10.8.0.6 192.168.20.109 ICMP 74 Echo (ping) request id=0x0001, seq=153/39168, ttl=128 (reply in 10)

Frame 9: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0
Ethernet II, Src: 00:ff:33:d6:12:53 (00:ff:33:d6:12:53), Dst: 00:ff:32:d6:12:53 (00:ff:32:d6:12:53)
Internet Protocol Version 4, Src: 10.8.0.6 (10.8.0.6), Dst: 192.168.20.109 (192.168.20.109)
Internet Control Message Protocol

No. Time Source Destination Protocol Length Info
10 2.988099000 192.168.20.109 10.8.0.6 ICMP 74 Echo (ping) reply id=0x0001, seq=153/39168, ttl=254 (request in 9)

Frame 10: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0
Ethernet II, Src: 00:ff:32:d6:12:53 (00:ff:32:d6:12:53), Dst: 00:ff:33:d6:12:53 (00:ff:33:d6:12:53)
Internet Protocol Version 4, Src: 192.168.20.109 (192.168.20.109), Dst: 10.8.0.6 (10.8.0.6)
Internet Control Message Protocol

No. Time Source Destination Protocol Length Info
11 4.263130000 10.8.0.6 192.168.20.60 ICMP 74 Echo (ping) request id=0x0001, seq=154/39424, ttl=128

Frame 11: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0
Ethernet II, Src: 00:ff:33:d6:12:53 (00:ff:33:d6:12:53), Dst: 00:ff:32:d6:12:53 (00:ff:32:d6:12:53)
Internet Protocol Version 4, Src: 10.8.0.6 (10.8.0.6), Dst: 192.168.20.60 (192.168.20.60)
Internet Control Message Protocol

No. Time Source Destination Protocol Length Info
12 9.086940000 10.8.0.6 192.168.20.60 ICMP 74 Echo (ping) request id=0x0001, seq=155/39680, ttl=128

Frame 12: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0
Ethernet II, Src: 00:ff:33:d6:12:53 (00:ff:33:d6:12:53), Dst: 00:ff:32:d6:12:53 (00:ff:32:d6:12:53)
Internet Protocol Version 4, Src: 10.8.0.6 (10.8.0.6), Dst: 192.168.20.60 (192.168.20.60)
Internet Control Message Protocol

No. Time Source Destination Protocol Length Info
13 14.079035000 10.8.0.6 192.168.20.60 ICMP 74 Echo (ping) request id=0x0001, seq=156/39936, ttl=128

Frame 13: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0
Ethernet II, Src: 00:ff:33:d6:12:53 (00:ff:33:d6:12:53), Dst: 00:ff:32:d6:12:53 (00:ff:32:d6:12:53)
Internet Protocol Version 4, Src: 10.8.0.6 (10.8.0.6), Dst: 192.168.20.60 (192.168.20.60)
Internet Control Message Protocol

No. Time Source Destination Protocol Length Info
14 15.388767000 10.8.0.1 10.8.0.3 UDP 82 Source port: 56768 Destination port: sentinelsrm

Frame 14: 82 bytes on wire (656 bits), 82 bytes captured (656 bits) on interface 0
Ethernet II, Src: 00:ff:32:d6:12:53 (00:ff:32:d6:12:53), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 10.8.0.1 (10.8.0.1), Dst: 10.8.0.3 (10.8.0.3)
User Datagram Protocol, Src Port: 56768 (56768), Dst Port: sentinelsrm (1947)
Data (40 bytes)

0000 65 69 53 43 6c 76 6c 2b 5a 4d 41 4d 63 57 51 46 eiSClvl+ZMAMcWQF
0010 55 78 38 41 47 41 39 50 65 55 41 65 68 47 75 36 Ux8AGA9PeUAehGu6
0020 51 2f 53 76 64 7a 67 41 Q/SvdzgA
Data: 656953436c766c2b5a4d414d635751465578384147413950...
[Length: 40]

No. Time Source Destination Protocol Length Info
15 19.086744000 10.8.0.6 192.168.20.60 ICMP 74 Echo (ping) request id=0x0001, seq=157/40192, ttl=128

Frame 15: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0
Ethernet II, Src: 00:ff:33:d6:12:53 (00:ff:33:d6:12:53), Dst: 00:ff:32:d6:12:53 (00:ff:32:d6:12:53)
Internet Protocol Version 4, Src: 10.8.0.6 (10.8.0.6), Dst: 192.168.20.60 (192.168.20.60)
Internet Control Message Protocol

leon111

Gateways are good configured...

192.168.20.1 is gateway in each machine.

When I ping locally (from VPN server machine - 192.168.20.120) these machines, pings are ok. When I ping via VPN from client (10.8.0.6), there is no replay from machines to the client.

My wireshark log includes network traffic from VPN Server (192.168.20.120). I started wireshark capturing network traffic on VPN Server (192.168.20.120) after that I was pinging "failed ping machines" from vpn client and it didn't get replay.

Finally, PINGS ARE OK LOCALLY

Maybe there is problem with routing on VPN Server?

I will change ip of failed machine to ip of working machine, maybe it will work. Maybe it is someting with mask and not all ips are correctly allowed to work.

maikcat

try to switch gateway on your kyocera from 192.168.20.1 to 192.168.20.120.

Michael.

leon111

Maikcat I changed gateway to 192.168.20.120 and it's working now.

Do you know why was it wrong with 192.168.20.1?

Thanks a lot for help.

Now I have to solve problem with PC (Windows 7)

maikcat

maybe kyocera rejects redirects....

try to add a static route by hand to your win 7.

Michael.

leon111

Hello again,

I gave 192.168.20.120 gateway to kycoera and it's working.

After that I gave 192.168.20.120 gateway to all pc, and now it's working great.

My question is How Can I make it to work with 192.168.20.1 gateway?

Machines recived packets but do not replay with gateway 192.168.20.1.

Maybe I should add more static route to my router?

Any ideas?

Big Thanks for all

maikcat

Maybe I should add more static route to my router?

if you added a static route for your vpn network to your router and its not working it may be due:

1) your router does not handle static routes well

2) your router has firewall policies which filters out redirections

you can try to disable its firewall (if any) and see if this fixes anything,if it does you need to tweak its firewall rules.

Michael.

leon111

Hello again,

I changed my TP-LINK router on CISCO router and it's still nothing. I have to set up default gateway in each machine on VPN MACHINE SERVER (192.168.20.120). When I'm trying set up machines (pc and printers) gateways on router (192.168.20.1) it's not working still... When I power off VPN SERVER MACHINE, other pcs don't have internet because they have gateway to VPN SERVER MACHINE. For now VPN SERVER MACHINE working 24h and everything is good, but I want to change this when I will solve this problem. Maybe Did somebody have similar problem.

Also I turned off all firewalls on VPN SERVER and router ...

Please for help.

Thanks a lot.

leon111

Still can't fix my problem... Without set machines gateways on VPN SERVER PC it's not working good.

Maybe I should add some static route or something?

leon111

I tried everything. Still my PC working as router. When I turned off pc everything stops working. How to solve this problem guys?

Traffic

leon111 wrote When I turned off pc everything stops working. How to solve this problem guys?

Don't turn off your pc ...

maikcat

Maybe I should add some static route or something?

sadly you need to add a static route for vpn subnet to your pcs,
unless you troubleshoot why the one on your router does not work.

Michael.

leon111

What should be done on router? I just added one static route 10.8.0.0 subnet to my VPN machine destination. Something else more Can I do?

Traffic

maikcat wroteunless you troubleshoot why the one on your router does not work.

Does your router support ICMP redirect ?

leon111 wroteSomething else more Can I do?

Add static routes to the machines that require it.

leon111

Now I'm working on TP-LINK WR841N

Don't know that it has ICMP support.

Can I solve this without adding static routes to each machine?