Hi everybody,
I was told to set-up a VPN-solution on a MS-Windows 2008R2 server, so that some people could get a "maintenance access" to that system.
I installed openVPN 2.3.4 today, and created a basic configuration. It's started as a service.
My test-client can connect to the server without any problems, but I can't use the tunnel eg. for RDP, or any other things ... I can ping the server's VPN-interface (10.7.0.1), but not the LAN-interface (192.168.2.105).
On the server I open'd within MS-Firewall the ports udp 1194, tcp 3389 and ICMPv4 for any application & any network, but RDP, etc. won't work ...
Plus I changed HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\IPEnableRouter to 1
What did I miss?
What do you need?
Thanks in advance!
cu
Torsten
server.conf
local 192.168.2.105
port 1194
proto udp
dev tun
ca C:\\Programme\\OpenVPN\\config\\ca.crt
cert C:\\Programme\\OpenVPN\\config\\server.crt
key C:\\Programme\\OpenVPN\\config\\server.key
dh C:\\Programme\\OpenVPN\\config\\dh1024.pem
status C:\\Programme\\OpenVPN\\log\\openvpn-status.log
log C:\\Programme\\OpenVPN\\log\\openvpn.log
log-append C:\\Programme\\OpenVPN\\log\\openvpn.log
route 192.168.2.0 255.255.255.0 10.7.0.1 1
server 10.7.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.2.0 255.255.255.0"
keepalive 10 120
comp-lzo
persist-key
persist-tun
max-clients 5
verb 3
openvpn.log
Thu Sep 04 17:37:39 2014 OpenVPN 2.3.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug 7 2014
Thu Sep 04 17:37:39 2014 library versions: OpenSSL 1.0.1i 6 Aug 2014, LZO 2.05
Thu Sep 04 17:37:39 2014 Diffie-Hellman initialized with 1024 bit key
Thu Sep 04 17:37:39 2014 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1492)
Thu Sep 04 17:37:39 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Sep 04 17:37:39 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Sep 04 17:37:39 2014 open_tun, tt->ipv6=0
Thu Sep 04 17:37:39 2014 TAP-WIN32 device [LAN-Verbindung 2] opened: \\.\Global\{96F380FA-98FE-4E43-B8E0-11802D30F923}.tap
Thu Sep 04 17:37:39 2014 TAP-Windows Driver Version 9.9
Thu Sep 04 17:37:39 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.7.0.1/255.255.255.252 on interface {96F380FA-98FE-4E43-B8E0-11802D30F923} [DHCP-serv: 10.7.0.2, lease-time: 31536000]
Thu Sep 04 17:37:39 2014 Sleeping for 10 seconds...
Thu Sep 04 17:37:50 2014 Successful ARP Flush on interface [15] {96F380FA-98FE-4E43-B8E0-11802D30F923}
Thu Sep 04 17:37:50 2014 C:\Windows\system32\route.exe ADD 192.168.2.0 MASK 255.255.255.0 10.7.0.1 METRIC 1
Thu Sep 04 17:37:50 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Sep 04 17:37:50 2014 Route addition via IPAPI succeeded [adaptive]
Thu Sep 04 17:37:50 2014 C:\Windows\system32\route.exe ADD 10.7.0.0 MASK 255.255.255.0 10.7.0.2
Thu Sep 04 17:37:50 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Sep 04 17:37:50 2014 Route addition via IPAPI succeeded [adaptive]
Thu Sep 04 17:37:50 2014 UDPv4 link local (bound): [AF_INET]192.168.2.105:1194
Thu Sep 04 17:37:50 2014 UDPv4 link remote: [undef]
Thu Sep 04 17:37:50 2014 MULTI: multi_init called, r=256 v=256
Thu Sep 04 17:37:50 2014 IFCONFIG POOL: base=10.7.0.4 size=62, ipv6=0
Thu Sep 04 17:37:50 2014 ifconfig_pool_read(), in='cbleich,10.7.0.4', TODO: IPv6
Thu Sep 04 17:37:50 2014 succeeded -> ifconfig_pool_set()
Thu Sep 04 17:37:50 2014 IFCONFIG POOL LIST
Thu Sep 04 17:37:50 2014 cbleich,10.7.0.4
Thu Sep 04 17:37:50 2014 Initialization Sequence Completed
Thu Sep 04 17:37:52 2014 w.x.y.z:65336 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1492)
Thu Sep 04 17:37:52 2014 w.x.y.z:65336 TLS: Initial packet from [AF_INET]w.x.y.z:65336, sid=f049c237 f154a0af
Thu Sep 04 17:37:53 2014 w.x.y.z:65336 VERIFY OK: depth=1, C=DE, ST=NRW, L=Hattingen, O=IT, OU=IT-Services, CN=domain.freedns.com, name=changeme, emailAddress=cbleich@provider
Thu Sep 04 17:37:53 2014 w.x.y.z:65336 VERIFY OK: depth=0, C=DE, ST=NRW, L=Hattingen, O=IT, OU=IT-Services, CN=cbleich, name=changeme, emailAddress=cbleich@provider
Thu Sep 04 17:37:53 2014 w.x.y.z:65336 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Sep 04 17:37:53 2014 w.x.y.z:65336 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Sep 04 17:37:53 2014 w.x.y.z:65336 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Sep 04 17:37:53 2014 w.x.y.z:65336 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Sep 04 17:37:53 2014 w.x.y.z:65336 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Sep 04 17:37:53 2014 w.x.y.z:65336 [cbleich] Peer Connection Initiated with [AF_INET]w.x.y.z:65336
Thu Sep 04 17:37:53 2014 cbleich/w.x.y.z:65336 MULTI_sva: pool returned IPv4=10.7.0.6, IPv6=(Not enabled)
Thu Sep 04 17:37:53 2014 cbleich/w.x.y.z:65336 MULTI: Learn: 10.7.0.6 -> cbleich/w.x.y.z:65336
Thu Sep 04 17:37:53 2014 cbleich/w.x.y.z:65336 MULTI: primary virtual IP for cbleich/w.x.y.z:65336: 10.7.0.6
Thu Sep 04 17:37:55 2014 cbleich/w.x.y.z:65336 PUSH: Received control message: 'PUSH_REQUEST'
Thu Sep 04 17:37:55 2014 cbleich/w.x.y.z:65336 send_push_reply(): safe_cap=940
Thu Sep 04 17:37:55 2014 cbleich/w.x.y.z:65336 SENT CONTROL [cbleich]: 'PUSH_REPLY,route 192.168.2.0 255.255.255.0,route 10.7.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.7.0.6 10.7.0.5' (status=1)
ping
C:\>ping 10.7.0.6 -- clients VPN-interface
Ping wird ausgeführt für 10.7.0.6 mit 32 Bytes Daten:
Antwort von 10.7.0.6: Bytes=32 Zeit<1ms TTL=64
Antwort von 10.7.0.6: Bytes=32 Zeit<1ms TTL=64
Antwort von 10.7.0.6: Bytes=32 Zeit<1ms TTL=64
Antwort von 10.7.0.6: Bytes=32 Zeit<1ms TTL=64
Ping-Statistik für 10.7.0.6:
Pakete: Gesendet = 4, Empfangen = 4, Verloren = 0
(0% Verlust),
Ca. Zeitangaben in Millisek.:
Minimum = 0ms, Maximum = 0ms, Mittelwert = 0ms
C:\>ping 10.7.0.1 -- servers VPN-interface
Ping wird ausgeführt für 10.7.0.1 mit 32 Bytes Daten:
Antwort von 10.7.0.1: Bytes=32 Zeit=42ms TTL=128
Antwort von 10.7.0.1: Bytes=32 Zeit=41ms TTL=128
Antwort von 10.7.0.1: Bytes=32 Zeit=44ms TTL=128
Antwort von 10.7.0.1: Bytes=32 Zeit=41ms TTL=128
Ping-Statistik für 10.7.0.1:
Pakete: Gesendet = 4, Empfangen = 4, Verloren = 0
(0% Verlust),
Ca. Zeitangaben in Millisek.:
Minimum = 41ms, Maximum = 44ms, Mittelwert = 42ms
C:\>ping 192.168.2.105 -- servers LAN-interface
Ping wird ausgeführt für 192.168.2.105 mit 32 Bytes Daten:
Zeitüberschreitung der Anforderung.
Zeitüberschreitung der Anforderung.
Zeitüberschreitung der Anforderung.
Zeitüberschreitung der Anforderung.
Ping-Statistik für 192.168.2.105:
Pakete: Gesendet = 4, Empfangen = 0, Verloren = 4
(100% Verlust),
C:\>
