connected but cannot visit the intranet

rogers_law

hi, i have setup a openvpn on a router. the openvpn connection is working and i can ping the router. however, i cannot ping the machine which connects to the router. can someone help?

server side:
route: 192.168.3.0/24
modem/gateway: 192.168.3.1
router: 192.168.3.2
machine connects to router: 192.168.3.253
openVPN: 10.8.0.0/24
tunnel Protocol: TCP
Port: 443

server config:
verb 5
push "route 192.168.3.0 255.255.255.0"
;push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 192.168.3.2"
keepalive 10 120

client config
client
dev tun
proto tcp
remote xxx.xxx.xxx 443
resolv-retry infinite
nobind
persist-key
persist-tun
ca "c:\\program files\\openvpn\\config\\ca.crt"
cert "c:\\program files\\openvpn\\config\\cad-mobile.crt"
key "c:\\program files\\openvpn\\config\\cad-mobile.key"
ns-cert-type server
cipher AES-256-CBC
comp-lzo
verb 3

can someone help me out please? I can ping 192.168.3.2 but cannot ping 192.168.3.253. all firewalls has been turned off.

thanks

rogers_law

Traffic wroteDid you enable IP_Forwarding & NAT on your server ?

HOWTO: Expanding the scope of the VPN to include additional machines

Please post your logs for further advise.

hi, i am running the openvpn server on a dd-wrt router. how to enable ip-forwarding & NAT?

and here is the log file from my client side

Fri Aug 29 11:37:26 2014 OpenVPN 2.3.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug 7 2014
Fri Aug 29 11:37:26 2014 library versions: OpenSSL 1.0.1i 6 Aug 2014, LZO 2.05
Fri Aug 29 11:37:26 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Fri Aug 29 11:37:26 2014 Need hold release from management interface, waiting...
Fri Aug 29 11:37:26 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Fri Aug 29 11:37:26 2014 MANAGEMENT: CMD 'state on'
Fri Aug 29 11:37:26 2014 MANAGEMENT: CMD 'log all on'
Fri Aug 29 11:37:27 2014 MANAGEMENT: CMD 'hold off'
Fri Aug 29 11:37:27 2014 MANAGEMENT: CMD 'hold release'
Fri Aug 29 11:37:27 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Fri Aug 29 11:37:27 2014 MANAGEMENT: >STATE:1409269047,RESOLVE,,,
Fri Aug 29 11:37:27 2014 Attempting to establish TCP connection with [AF_INET]203.109.205.239:443
Fri Aug 29 11:37:27 2014 MANAGEMENT: >STATE:1409269047,TCP_CONNECT,,,
Fri Aug 29 11:37:27 2014 TCP connection established with [AF_INET]203.109.205.239:443
Fri Aug 29 11:37:27 2014 TCPv4_CLIENT link local: [undef]
Fri Aug 29 11:37:27 2014 TCPv4_CLIENT link remote: [AF_INET]203.109.205.239:443
Fri Aug 29 11:37:27 2014 MANAGEMENT: >STATE:1409269047,WAIT,,,
Fri Aug 29 11:37:27 2014 MANAGEMENT: >STATE:1409269047,AUTH,,,
Fri Aug 29 11:37:27 2014 TLS: Initial packet from [AF_INET]203.109.205.239:443, sid=c3a799dc 8ba8e008
Fri Aug 29 11:37:27 2014 VERIFY OK: depth=1, C=NZ, ST=Canterbury, L=Christchurch, O=TaegeEng, OU=changeme, CN=TaegeEng-CA, name=changeme, emailAddress=roger@taege.com
Fri Aug 29 11:37:27 2014 VERIFY OK: nsCertType=SERVER
Fri Aug 29 11:37:27 2014 VERIFY OK: depth=0, C=NZ, ST=Canterbury, L=Christchurch, O=TaegeEng, OU=changeme, CN=server, name=changeme, emailAddress=roger@taege.com
Fri Aug 29 11:37:28 2014 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Aug 29 11:37:28 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Aug 29 11:37:28 2014 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Aug 29 11:37:28 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Aug 29 11:37:28 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Fri Aug 29 11:37:28 2014 [server] Peer Connection Initiated with [AF_INET]203.109.205.239:443
Fri Aug 29 11:37:30 2014 MANAGEMENT: >STATE:1409269050,GET_CONFIG,,,
Fri Aug 29 11:37:31 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Fri Aug 29 11:37:31 2014 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route 192.168.3.0 255.255.255.0,dhcp-option DNS 192.168.3.2,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,socket-flags TCP_NODELAY,ifconfig 10.8.0.2 255.255.255.0'
Fri Aug 29 11:37:31 2014 OPTIONS IMPORT: timers and/or timeouts modified
Fri Aug 29 11:37:31 2014 OPTIONS IMPORT: --socket-flags option modified
Fri Aug 29 11:37:31 2014 OPTIONS IMPORT: --ifconfig/up options modified
Fri Aug 29 11:37:31 2014 OPTIONS IMPORT: route options modified
Fri Aug 29 11:37:31 2014 OPTIONS IMPORT: route-related options modified
Fri Aug 29 11:37:31 2014 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Fri Aug 29 11:37:31 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Aug 29 11:37:31 2014 MANAGEMENT: >STATE:1409269051,ASSIGN_IP,,10.8.0.2,
Fri Aug 29 11:37:31 2014 open_tun, tt->ipv6=0
Fri Aug 29 11:37:31 2014 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{728005E7-103B-4C0F-B4E8-FEA478BA436A}.tap
Fri Aug 29 11:37:31 2014 TAP-Windows Driver Version 9.21
Fri Aug 29 11:37:31 2014 Set TAP-Windows TUN subnet mode network/local/netmask = 10.8.0.0/10.8.0.2/255.255.255.0 [SUCCEEDED]
Fri Aug 29 11:37:31 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.2/255.255.255.0 on interface {728005E7-103B-4C0F-B4E8-FEA478BA436A} [DHCP-serv: 10.8.0.254, lease-time: 31536000]
Fri Aug 29 11:37:31 2014 NOTE: FlushIpNetTable failed on interface [16] {728005E7-103B-4C0F-B4E8-FEA478BA436A} (status=5) : Access is denied.
Fri Aug 29 11:37:36 2014 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Fri Aug 29 11:37:36 2014 C:\Windows\system32\route.exe ADD 203.109.205.239 MASK 255.255.255.255 192.168.1.254
Fri Aug 29 11:37:36 2014 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=13]
Fri Aug 29 11:37:36 2014 Route addition via IPAPI failed [adaptive]
Fri Aug 29 11:37:36 2014 Route addition fallback to route.exe
Fri Aug 29 11:37:36 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Fri Aug 29 11:37:36 2014 ERROR: Windows route add command failed [adaptive]: returned error code 1
Fri Aug 29 11:37:36 2014 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.1
Fri Aug 29 11:37:36 2014 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=16]
Fri Aug 29 11:37:36 2014 Route addition via IPAPI failed [adaptive]
Fri Aug 29 11:37:36 2014 Route addition fallback to route.exe
Fri Aug 29 11:37:36 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Fri Aug 29 11:37:36 2014 ERROR: Windows route add command failed [adaptive]: returned error code 1
Fri Aug 29 11:37:36 2014 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.1
Fri Aug 29 11:37:36 2014 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=16]
Fri Aug 29 11:37:36 2014 Route addition via IPAPI failed [adaptive]
Fri Aug 29 11:37:36 2014 Route addition fallback to route.exe
Fri Aug 29 11:37:36 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Fri Aug 29 11:37:36 2014 ERROR: Windows route add command failed [adaptive]: returned error code 1
Fri Aug 29 11:37:36 2014 MANAGEMENT: >STATE:1409269056,ADD_ROUTES,,,
Fri Aug 29 11:37:36 2014 C:\Windows\system32\route.exe ADD 192.168.3.0 MASK 255.255.255.0 10.8.0.1
Fri Aug 29 11:37:36 2014 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=16]
Fri Aug 29 11:37:36 2014 Route addition via IPAPI failed [adaptive]
Fri Aug 29 11:37:36 2014 Route addition fallback to route.exe
Fri Aug 29 11:37:36 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Fri Aug 29 11:37:36 2014 ERROR: Windows route add command failed [adaptive]: returned error code 1
Fri Aug 29 11:37:36 2014 Initialization Sequence Completed

rogers_law

Traffic wrote
rogers_law wrotehere is the log file from my client side

Fri Aug 29 11:37:26 2014 OpenVPN 2.3.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug 7 2014
Fri Aug 29 11:37:26 2014 library versions: OpenSSL 1.0.1i 6 Aug 2014, LZO 2.05

Fri Aug 29 11:37:36 2014 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=16]

Fri Aug 29 11:37:36 2014 Initialization Sequence Completed
You must run your client from an admin account.

sorry, after i run as admin, i only can ping 192.168.3.2 but not 192.168.3.253.

here is the client log after i run as admin

Fri Aug 29 12:11:46 2014 OpenVPN 2.3.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug 7 2014
Fri Aug 29 12:11:46 2014 library versions: OpenSSL 1.0.1i 6 Aug 2014, LZO 2.05
Enter Management Password:
Fri Aug 29 12:11:46 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Fri Aug 29 12:11:46 2014 Need hold release from management interface, waiting...
Fri Aug 29 12:11:46 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Fri Aug 29 12:11:46 2014 MANAGEMENT: CMD 'state on'
Fri Aug 29 12:11:46 2014 MANAGEMENT: CMD 'log all on'
Fri Aug 29 12:11:46 2014 MANAGEMENT: CMD 'hold off'
Fri Aug 29 12:11:46 2014 MANAGEMENT: CMD 'hold release'
Fri Aug 29 12:11:47 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Fri Aug 29 12:11:47 2014 MANAGEMENT: >STATE:1409271107,RESOLVE,,,
Fri Aug 29 12:11:47 2014 Attempting to establish TCP connection with [AF_INET]203.109.205.239:443
Fri Aug 29 12:11:47 2014 MANAGEMENT: >STATE:1409271107,TCP_CONNECT,,,
Fri Aug 29 12:11:47 2014 TCP connection established with [AF_INET]203.109.205.239:443
Fri Aug 29 12:11:47 2014 TCPv4_CLIENT link local: [undef]
Fri Aug 29 12:11:47 2014 TCPv4_CLIENT link remote: [AF_INET]203.109.205.239:443
Fri Aug 29 12:11:47 2014 MANAGEMENT: >STATE:1409271107,WAIT,,,
Fri Aug 29 12:11:47 2014 MANAGEMENT: >STATE:1409271107,AUTH,,,
Fri Aug 29 12:11:47 2014 TLS: Initial packet from [AF_INET]203.109.205.239:443, sid=93d49761 5efc0a1b
Fri Aug 29 12:11:47 2014 VERIFY OK: depth=1, C=NZ, ST=Canterbury, L=Christchurch, O=TaegeEng, OU=changeme, CN=TaegeEng-CA, name=changeme, emailAddress=roger@taege.com
Fri Aug 29 12:11:47 2014 VERIFY OK: nsCertType=SERVER
Fri Aug 29 12:11:47 2014 VERIFY OK: depth=0, C=NZ, ST=Canterbury, L=Christchurch, O=TaegeEng, OU=changeme, CN=server, name=changeme, emailAddress=roger@taege.com
Fri Aug 29 12:11:48 2014 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Aug 29 12:11:48 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Aug 29 12:11:48 2014 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Aug 29 12:11:48 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Aug 29 12:11:48 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Fri Aug 29 12:11:48 2014 [server] Peer Connection Initiated with [AF_INET]203.109.205.239:443
Fri Aug 29 12:11:50 2014 MANAGEMENT: >STATE:1409271110,GET_CONFIG,,,
Fri Aug 29 12:11:51 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Fri Aug 29 12:11:51 2014 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route 192.168.3.0 255.255.255.0,dhcp-option DNS 192.168.3.2,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,socket-flags TCP_NODELAY,ifconfig 10.8.0.2 255.255.255.0'
Fri Aug 29 12:11:51 2014 OPTIONS IMPORT: timers and/or timeouts modified
Fri Aug 29 12:11:51 2014 OPTIONS IMPORT: --socket-flags option modified
Fri Aug 29 12:11:51 2014 OPTIONS IMPORT: --ifconfig/up options modified
Fri Aug 29 12:11:51 2014 OPTIONS IMPORT: route options modified
Fri Aug 29 12:11:51 2014 OPTIONS IMPORT: route-related options modified
Fri Aug 29 12:11:51 2014 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Fri Aug 29 12:11:51 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Aug 29 12:11:51 2014 MANAGEMENT: >STATE:1409271111,ASSIGN_IP,,10.8.0.2,
Fri Aug 29 12:11:51 2014 open_tun, tt->ipv6=0
Fri Aug 29 12:11:51 2014 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{728005E7-103B-4C0F-B4E8-FEA478BA436A}.tap
Fri Aug 29 12:11:51 2014 TAP-Windows Driver Version 9.21
Fri Aug 29 12:11:51 2014 Set TAP-Windows TUN subnet mode network/local/netmask = 10.8.0.0/10.8.0.2/255.255.255.0 [SUCCEEDED]
Fri Aug 29 12:11:51 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.2/255.255.255.0 on interface {728005E7-103B-4C0F-B4E8-FEA478BA436A} [DHCP-serv: 10.8.0.254, lease-time: 31536000]
Fri Aug 29 12:11:51 2014 Successful ARP Flush on interface [16] {728005E7-103B-4C0F-B4E8-FEA478BA436A}
Fri Aug 29 12:11:56 2014 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Fri Aug 29 12:11:56 2014 C:\Windows\system32\route.exe ADD 203.109.205.239 MASK 255.255.255.255 192.168.1.254
Fri Aug 29 12:11:56 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Fri Aug 29 12:11:56 2014 Route addition via IPAPI succeeded [adaptive]
Fri Aug 29 12:11:56 2014 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.1
Fri Aug 29 12:11:56 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Fri Aug 29 12:11:56 2014 Route addition via IPAPI succeeded [adaptive]
Fri Aug 29 12:11:56 2014 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.1
Fri Aug 29 12:11:56 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Fri Aug 29 12:11:56 2014 Route addition via IPAPI succeeded [adaptive]
Fri Aug 29 12:11:56 2014 MANAGEMENT: >STATE:1409271116,ADD_ROUTES,,,
Fri Aug 29 12:11:56 2014 C:\Windows\system32\route.exe ADD 192.168.3.0 MASK 255.255.255.0 10.8.0.1
Fri Aug 29 12:11:56 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Fri Aug 29 12:11:56 2014 Route addition via IPAPI succeeded [adaptive]
Fri Aug 29 12:11:56 2014 Initialization Sequence Completed
Fri Aug 29 12:11:56 2014 MANAGEMENT: >STATE:1409271116,CONNECTED,SUCCESS,10.8.0.2,203.109.205.239

rogers_law

Traffic wroteGoogle: DD-WRT NAT IP_FORWARD

hi, I am not good at Linux.

have try the following command on Firewall, still not working. can you help me out please?

iptables -I FORWARD -i br0 -o tun2 -j ACCEPT
iptables -I FORWARD -i tun2 -o br0 -j ACCEPT
iptables -I FORWARD -i eth0 -o tun2 -j ACCEPT
iptables -I FORWARD -i tun2 -o eth0 -j ACCEPT
iptables -t nat -A POSTROUTING -o tun2 -j MASQUERADE

Thanks