OpenVPN through Juniper router not creating sessions

Nichos

Okay friends, I'm really at a loss on this one. Here's the situation:

I've got a network here with a Juniper router, a server on the LAN running OpenVPN, and clients connecting from the internet.

The clients connect fine, they can ping everything on the network, but protocol besides ping just does not work. I've done a fair bit of debug logging on machines on the LAN, and the router itself, and what's happening is, packets are reaching their destination correctly from the client to the LAN side machines, the LAN machine sends whatever response it will (e.g. DNS reply with ip address of host requested), and then the Juniper drops the packet on the way out due to no session being created.

I've got routes set to the LAN set up correctly, I've set the Juniper to forward traffic for the 10.8.0.0 OpenVPN subnet to the ip of the VPN server for return traffic, so I'm kinda stuck on what to do to get it working. I had it working great before, but I had to turn NATting off on the server due to our phone system's softphones not being able to handle NATed connections for our remote staff, so I'm trying to get this working purely through routing.

Here's my setup:

Server is Windows Server 2012

local 192.168.1.44
port 1194
proto udp
dev tun
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key"  # This file should be kept secret
dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem"
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
push "route 192.168.0.0 255.255.254.0"
push "route 172.16.0.0 255.255.0.0"
push "dhcp-option DNS 192.168.1.29"
push "dhcp-option DNS 192.168.1.42"
push "dhcp-option DOMAIN ourdomain.com"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

Client is Windows 7

client
dev tun
proto udp
remote <<publicIP>> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\client.crt"
key "C:\\Program Files\\OpenVPN\\config\\client.key"
ns-cert-type server
comp-lzo
verb 3

Ideas???

Nichos

debbie10t wrote
Nichos wrotethe LAN machine sends whatever response it will (e.g. DNS reply with ip address of host requested), and then the Juniper drops the packet on the way out due to no session being created.
Did you read the HOWTO, where it says about adding static routes to your default gateway ?
HOWTO: Expanding the scope of the VPN to include additional machines

I sure did. 🙂 That's what I meant in my original post when I said, "I've set the juniper to forward traffic for the 10.8.0.0 OpenVPN subnet to the ip of the VPN server for return traffic"

I did exactly that, on the gateway I added a static route for the 10.8.0.0 subnet to the OpenVPN server, and actually, traffic initiated from the Server side LAN to the VPN clients works fine.

P.S. Not sure how this is considered off topic and not a configuration issue... O_o

Nichos

debbie10t wroteThis forum cannot possibly provide information on how to configure a Juniper Router.

So you're telling me with 100% certainty that not a single member on here has ever used a Juniper router??? Seems quite a friendly place.

Nichos

debbie10t wroteBut you understand why it is off-topic right ?

Kind of. Seems more of a grey area to me. Maybe only because I'm not sure yet if the session isn't being create due to a configuration of the Juniper, or setting on the Windows Server, or what since it's basically the exact same config that was working before and all I did was turn NATing off on the Windows Server... didn't know if maybe there was some option I didn't know about to handle that change, or a route I needed to add in the OpenVPN config, etc.

debbie10t wrote Would you like to post your Juniper config ?

Maybe, I'll have to look at it tomorrow. We do a lot of work with the government and there's a lot of private IP's and stuff in there that I don't think they'd like publicized, but I can probably scrub the irrelevant info out.