[Solved] Lans behind OpenVPN - NatHack

danielvpn

Hello,

1st of all - thanks for the article, really well documented.
I tried to follow it because it is exactly what I need - I think.

Having 2 nets, one at home via DSL and WiFi Router, one at my shop via UMTS router. The router at my shop doesn't get a public ip but the provider uses NAT.
So the idea is to have one PC in the shop with an openvpn client, and one pc at home with openvpn server.

So far, so good - here some facts: home net: 192.168.1.x, shop net: 192.168.0.x (I know, 192er nets - but never will any other net be connected, so it is fine).
Router @home 192.168.1.1, OpenVPN Server@home 192.168.1.3
Router @shop 192.168.0.1, OpenVPN client@shop 192.168.0.101

I setup the server with a config as follows:

port 1194
proto udp
dev tun
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-to-client
keepalive 10 600
comp-lzo
persist-key
persist-tun
status openvpn-status.log
client-config-dir ccd
route 192.168.0.0 255.255.255.0
push "route 192.168.0.0 255.255.255.0"

and the client as follows:

client
dev tun
proto udp
remote myserverip 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ns-cert-type server
comp-lzo
verb 3

and the client specific file in the ccd dir on the server as follows:

iroute 192.168.0.0 255.255.255.0

This is the server log when the shop clients connects successfully and I try to ping it not using the openvpn ip, but the local ip:

Sun Aug 31 18:23:10 2014 Diffie-Hellman initialized with 1024 bit key
Sun Aug 31 18:23:10 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sun Aug 31 18:23:10 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Aug 31 18:23:10 2014 MANAGEMENT: >STATE:1409502190,ASSIGN_IP,,10.8.0.1,
Sun Aug 31 18:23:10 2014 open_tun, tt->ipv6=0
Sun Aug 31 18:23:10 2014 TAP-WIN32 device [OpenVPN] opened: \\.\Global\{0CD6E545-D1F2-4BE9-8FF6-9DD880A7C15B}.tap
Sun Aug 31 18:23:10 2014 TAP-Windows Driver Version 9.21 
Sun Aug 31 18:23:10 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.1/255.255.255.252 on interface {0CD6E545-D1F2-4BE9-8FF6-9DD880A7C15B} [DHCP-serv: 10.8.0.2, lease-time: 31536000]
Sun Aug 31 18:23:10 2014 Sleeping for 10 seconds...
Sun Aug 31 18:23:20 2014 Successful ARP Flush on interface [19] {0CD6E545-D1F2-4BE9-8FF6-9DD880A7C15B}
Sun Aug 31 18:23:20 2014 MANAGEMENT: >STATE:1409502200,ADD_ROUTES,,,
Sun Aug 31 18:23:20 2014 C:\Windows\system32\route.exe ADD 192.168.0.0 MASK 255.255.255.0 10.8.0.2
Sun Aug 31 18:23:20 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Sun Aug 31 18:23:20 2014 Route addition via IPAPI succeeded [adaptive]
Sun Aug 31 18:23:20 2014 C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.2
Sun Aug 31 18:23:20 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Sun Aug 31 18:23:20 2014 Route addition via IPAPI succeeded [adaptive]
Sun Aug 31 18:23:20 2014 UDPv4 link local (bound): [undef]
Sun Aug 31 18:23:20 2014 UDPv4 link remote: [undef]
Sun Aug 31 18:23:20 2014 MULTI: multi_init called, r=256 v=256
Sun Aug 31 18:23:20 2014 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Sun Aug 31 18:23:20 2014 ifconfig_pool_read(), in='my CN PC,10.8.0.4', TODO: IPv6
Sun Aug 31 18:23:20 2014 succeeded -> ifconfig_pool_set()
Sun Aug 31 18:23:20 2014 ifconfig_pool_read(), in='my CN shop PC,10.8.0.8', TODO: IPv6
Sun Aug 31 18:23:20 2014 succeeded -> ifconfig_pool_set()
Sun Aug 31 18:23:20 2014 IFCONFIG POOL LIST
Sun Aug 31 18:23:20 2014 my CN PC,10.8.0.4
Sun Aug 31 18:23:20 2014 my CN shop PC,10.8.0.8
Sun Aug 31 18:23:20 2014 Initialization Sequence Completed
Sun Aug 31 18:23:20 2014 MANAGEMENT: >STATE:1409502200,CONNECTED,SUCCESS,10.8.0.1,
Sun Aug 31 19:50:27 2014 89.204.153.66:51570 TLS: Initial packet from [AF_INET]89.204.153.66:51570, sid=313afccf f0cbdfb5
Sun Aug 31 19:50:31 2014 89.204.153.66:51570 VERIFY OK: depth=1, C=DE, ST=BW, L=Weinsberg, O=OpenVPN, OU=my OU, CN=my CN, name=my, emailAddress=mydani@gmx.de
Sun Aug 31 19:50:31 2014 89.204.153.66:51570 VERIFY OK: depth=0, C=DE, ST=BW, L=Weinsberg, O=OpenVPN, OU=my OU shop PC, CN=my CN shop PC, name=my, emailAddress=mydani@gmx.de
Sun Aug 31 19:50:34 2014 89.204.153.66:51570 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Aug 31 19:50:34 2014 89.204.153.66:51570 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Aug 31 19:50:34 2014 89.204.153.66:51570 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Aug 31 19:50:34 2014 89.204.153.66:51570 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Aug 31 19:50:35 2014 89.204.153.66:51570 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Aug 31 19:50:35 2014 89.204.153.66:51570 [my CN shop PC] Peer Connection Initiated with [AF_INET]89.204.153.66:51570
Sun Aug 31 19:50:35 2014 my CN shop PC/89.204.153.66:51570 OPTIONS IMPORT: reading client specific options from: ccd\my CN shop PC
Sun Aug 31 19:50:35 2014 my CN shop PC/89.204.153.66:51570 MULTI_sva: pool returned IPv4=10.8.0.10, IPv6=(Not enabled)
Sun Aug 31 19:50:35 2014 my CN shop PC/89.204.153.66:51570 MULTI: Learn: 10.8.0.10 -> my CN shop PC/89.204.153.66:51570
Sun Aug 31 19:50:35 2014 my CN shop PC/89.204.153.66:51570 MULTI: primary virtual IP for my CN shop PC/89.204.153.66:51570: 10.8.0.10
Sun Aug 31 19:50:35 2014 my CN shop PC/89.204.153.66:51570 MULTI: internal route 192.168.0.0/24 -> my CN shop PC/89.204.153.66:51570
Sun Aug 31 19:50:35 2014 my CN shop PC/89.204.153.66:51570 MULTI: Learn: 192.168.0.0/24 -> my CN shop PC/89.204.153.66:51570
Sun Aug 31 19:50:35 2014 my CN shop PC/89.204.153.66:51570 REMOVE PUSH ROUTE: 'route 192.168.0.0 255.255.255.0'
Sun Aug 31 19:50:37 2014 my CN shop PC/89.204.153.66:51570 PUSH: Received control message: 'PUSH_REQUEST'
Sun Aug 31 19:50:37 2014 my CN shop PC/89.204.153.66:51570 send_push_reply(): safe_cap=940
Sun Aug 31 19:50:37 2014 my CN shop PC/89.204.153.66:51570 SENT CONTROL [my CN shop PC]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 600,ifconfig 10.8.0.10 10.8.0.9' (status=1)
Sun Aug 31 19:54:51 2014 my CN shop PC/89.204.153.66:51570 MULTI: Learn: 192.168.0.100 -> my CN shop PC/89.204.153.66:51570
Sun Aug 31 20:11:57 2014 MULTI: Learn: 192.168.0.1 -> my CN shop PC/89.204.153.66:51570
Sun Aug 31 20:13:50 2014 MULTI: Learn: 192.168.0.102 -> my CN shop PC/89.204.153.66:51570
Sun Aug 31 20:13:57 2014 MULTI: Learn: 192.168.0.101 -> my CN shop PC/89.204.153.66:51570
Sun Aug 31 20:15:58 2014 MULTI: Learn: 192.168.0.103 -> my CN shop PC/89.204.153.66:51570

Result from my ends: it looks everything is configured okay from the log - but however I do not get any response when pinging the shop's local ips, even when I ping the local IP of the shop'S openvpn client.

I would appreciate any help, really! 🙁 🙁 🙁

Thanks and regards,
Daniel

danielvpn

One update, here is some tracert output, showing that now the local ip of the openvpn client is pingable, however the other participants in the client's lan are not reachably via vpn.

C:\>ipconfig

Windows-IP-Konfiguration


Ethernet-Adapter OpenVPN:

   Verbindungsspezifisches DNS-Suffix:
   Verbindungslokale IPv6-Adresse  . : fe80::fc2a:2ca5:7c23:d67%19
   IPv4-Adresse  . . . . . . . . . . : 10.8.0.1
   Subnetzmaske  . . . . . . . . . . : 255.255.255.252
   Standardgateway . . . . . . . . . :

Ethernet-Adapter Kabel:

   Verbindungsspezifisches DNS-Suffix:
   Verbindungslokale IPv6-Adresse  . : fe80::ec12:ed69:7d75:bdca%10
   IPv4-Adresse  . . . . . . . . . . : 192.168.1.3
   Subnetzmaske  . . . . . . . . . . : 255.255.255.0
   Standardgateway . . . . . . . . . : 192.168.1.1

Tunneladapter isatap.{56073E5E-D224-4F52-AA5D-27CF731DD574}:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix:

Tunneladapter Teredo Tunneling Pseudo-Interface:

   Verbindungsspezifisches DNS-Suffix:
   IPv6-Adresse. . . . . . . . . . . : 2001:0:9d38:90d7:30b8:9bc:a4a6:7784
   Verbindungslokale IPv6-Adresse  . : fe80::30b8:9bc:a4a6:7784%12
   Standardgateway . . . . . . . . . : ::

Tunneladapter isatap.{0CD6E545-D1F2-4BE9-8FF6-9DD880A7C15B}:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix:

C:\>tracert 192.168.0.100

Routenverfolgung zu WPC [192.168.0.100] über maximal 30 Abschnitte:

  1  1170 ms   510 ms   851 ms  WPC [192.168.0.100]

Ablaufverfolgung beendet.

C:\>tracert 192.168.0.1

Routenverfolgung zu 192.168.0.1 über maximal 30 Abschnitte

  1     *        *        *     Zeitüberschreitung der Anforderung.
  2     *        *        *     Zeitüberschreitung der Anforderung.
  3     *        *        *     Zeitüberschreitung der Anforderung.
  4     *        *        *     Zeitüberschreitung der Anforderung.
  5

danielvpn

Thank you for moving my post, I did not want to spoil the tuts section but I registered it to late. 🙁 Sorry.
Please find attached a little picture which shows what I did. I also setup one static route in my home net - but thougt it should not mather as I executed the commands directly on the OpenVPN server, which should (hopefully?) know the route to the foreign net.

Regards,
Daniel

danielvpn

Hm after seeing my own picture, I realize - the paket which e.g. arrives at 192.168.0.1 when I send a ping from my openvpn server (192.168.1.3) will have a response address of 192.168.1.3 and as there is no route from 192.168.0.1 to 192.168.0.100 set up for the net 192.168.1.x, it will try to send it via the standard gateway, where the paket will be dropped.

Unfortunately, in my camera, which I want to actually connect to, I cannot setup any custom route. :-( So seems like no chance to get to it.

Regards,
Daniel

danielvpn

Hi,

the UMTS router is more a hotspot - TP Link M5350.
No static routing there, unfort.

Regards,
Daniel

danielvpn

Hi
only one machine is a openvpn client. Setting up static routes would work on PCs, but the camera doesn't give me that option. It is connected via WiFi, and the Hotspot 192.168.0.1 is DHCP and declares himself (same ip) as gateway for the camera. So the camera is basically trying to send the response to the hotspot and the hotspot does not know the route to the openvpn client. -_-

I think I require a router with vpn client capabilities, wifi and UMTS.
Or I need some setup like Hotspot <> Router with VPN+WLAN <> Client LAN
Or sth. more complicated Hotspot <> Router with WLAN+Static Routing <> CLient with OpenVPN <> Client LAN.

Regards,
Daniel

danielvpn

Traffic, you are a hero!
After setting up the NAT on client-side, incl. reboots, it works.
Thanks man.

debbie10t

OpenVPN NATHack Soloution:

https://community.openvpn.net/openvpn/wiki/NatHack