Hi, I'm new to VPN and OpenVPN.
I have to connect my office with another delegations and some laptops.
My server is a debian linux with ip(private) 192.168.1.104 mask 255.255.255.0, there are anothers machines on same network .100 .101 .102 etc, and I need to add some client networks and they must see server side machines (.100 .101 .102 etc) and work with them, like ssh, apache/iis, samba. Servers must also need to see client's machines, and even clients must see another clients
Server: 192.168.1.104 /255.255.255.0
they are some windows servers and anothers linux machine, now they have full access (samba, http, ssh) between them.
Clients:
a) a network with a Netgear UTM Firewall, this UTM Firewall have a SSL VPN option, that I pretend to use. All local machine must route to UTM to reach servers machine
My first question:
1)Can I use a Netgear UTM9S (SSL VPN) to connect OpenVPN?
b) some machines like laptops, maybe they are on public wifi, so not always I can set private IP
My second question:
2) Do I need a ethernet bridge or routing?
My first step is to try a tun with a laptop (it has 192.168.30.51), with routing, and I have ping from a laptop to server side:
server.conf
script-security 3
port 1194
proto udp
dev tun
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/VPNServer.crt
key /etc/openvpn/certs/VPNServer.key
dh /etc/openvpn/certs/dh2048.pem
tls-auth /etc/openvpn/certs/ta.key 0
server 192.168.88.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir /etc/openvpn/ccd/
push "route 192.168.1.0 255.255.255.0"
push "route 192.168.30.0 255.255.255.0"
route 192.168.30.0 255.255.255.0
client-to-client
keepalive 10 120
cipher DES-EDE3-CBC # Triple-DES
comp-lzo
max-clients 10
user nobody
group nogroup
persist-key
persist-tun
log /var/log/openvpn.log
status /var/log/openvpn-status.log
verb 5
mute 20
ipp.txt
portatil,192.168.88.4
ccd/portatil
iroute 192.168.30.0 255.255.255.0
after start service I get this logfile:
/var/log/openvpn.log
Fri Sep 5 11:38:16 2014 us=609647 Current Parameter Settings:
Fri Sep 5 11:38:16 2014 us=609721 config = '/etc/openvpn/server.conf'
Fri Sep 5 11:38:16 2014 us=609733 mode = 1
Fri Sep 5 11:38:16 2014 us=609742 persist_config = DISABLED
Fri Sep 5 11:38:16 2014 us=609750 persist_mode = 1
Fri Sep 5 11:38:16 2014 us=609758 show_ciphers = DISABLED
Fri Sep 5 11:38:16 2014 us=609765 show_digests = DISABLED
Fri Sep 5 11:38:16 2014 us=609773 show_engines = DISABLED
Fri Sep 5 11:38:16 2014 us=609781 genkey = DISABLED
Fri Sep 5 11:38:16 2014 us=609789 key_pass_file = '[UNDEF]'
Fri Sep 5 11:38:16 2014 us=609797 show_tls_ciphers = DISABLED
Fri Sep 5 11:38:16 2014 us=609805 Connection profiles [default]:
Fri Sep 5 11:38:16 2014 us=609814 proto = udp
Fri Sep 5 11:38:16 2014 us=609823 local = '[UNDEF]'
Fri Sep 5 11:38:16 2014 us=609839 local_port = 1194
Fri Sep 5 11:38:16 2014 us=609854 remote = '[UNDEF]'
Fri Sep 5 11:38:16 2014 us=609869 remote_port = 1194
Fri Sep 5 11:38:16 2014 us=609878 remote_float = DISABLED
Fri Sep 5 11:38:16 2014 us=609886 bind_defined = DISABLED
Fri Sep 5 11:38:16 2014 us=609894 bind_local = ENABLED
Fri Sep 5 11:38:16 2014 us=609901 NOTE: --mute triggered...
Fri Sep 5 11:38:16 2014 us=609921 249 variation(s) on previous 20 message(s) suppressed by --mute
Fri Sep 5 11:38:16 2014 us=609933 OpenVPN 2.1.3 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jun 4 2013
Fri Sep 5 11:38:16 2014 us=610101 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Fri Sep 5 11:38:16 2014 us=610119 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Fri Sep 5 11:38:16 2014 us=621087 Diffie-Hellman initialized with 2048 bit key
Fri Sep 5 11:38:16 2014 us=621784 /usr/bin/openssl-vulnkey -q -b 2048 -m <modulus omitted>
Fri Sep 5 11:38:16 2014 us=712600 Control Channel Authentication: using '/etc/openvpn/certs/ta.key' as a OpenVPN static key file
Fri Sep 5 11:38:16 2014 us=712657 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Sep 5 11:38:16 2014 us=712673 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Sep 5 11:38:16 2014 us=712702 TLS-Auth MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Fri Sep 5 11:38:16 2014 us=712732 Socket Buffers: R=[124928->131072] S=[124928->131072]
Fri Sep 5 11:38:16 2014 us=712922 ROUTE default_gateway=192.168.1.1
Fri Sep 5 11:38:16 2014 us=714134 TUN/TAP device tun0 opened
Fri Sep 5 11:38:16 2014 us=714169 TUN/TAP TX queue length set to 100
Fri Sep 5 11:38:16 2014 us=714206 /sbin/ifconfig tun0 192.168.88.1 pointopoint 192.168.88.2 mtu 1500
Fri Sep 5 11:38:16 2014 us=716478 /sbin/route add -net 192.168.30.0 netmask 255.255.255.0 gw 192.168.88.2
Fri Sep 5 11:38:16 2014 us=720056 /sbin/route add -net 192.168.88.0 netmask 255.255.255.0 gw 192.168.88.2
Fri Sep 5 11:38:16 2014 us=721672 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Fri Sep 5 11:38:16 2014 us=729060 GID set to nogroup
Fri Sep 5 11:38:16 2014 us=729117 UID set to nobody
Fri Sep 5 11:38:16 2014 us=729146 UDPv4 link local (bound): [undef]
Fri Sep 5 11:38:16 2014 us=729157 UDPv4 link remote: [undef]
Fri Sep 5 11:38:16 2014 us=729172 MULTI: multi_init called, r=256 v=256
Fri Sep 5 11:38:16 2014 us=729256 IFCONFIG POOL: base=192.168.88.4 size=62
Fri Sep 5 11:38:16 2014 us=729291 IFCONFIG POOL LIST
Fri Sep 5 11:38:16 2014 us=729302 portatil,192.168.88.4
Fri Sep 5 11:38:16 2014 us=729334 Initialization Sequence Completed
Laptop windows 8 client.conf
client
dev tun
#This is a Windows 8, Do I need this line?
;dev-node MyTap
proto udp
remote vpn.mydomain.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert portatil.crt
key portatil.key
ns-cert-type server
tls-auth ta.key 1
cipher DES-EDE3-CBC
comp-lzo
verb 3
I have ping to server vpn from client laptop:
C:\Windows\system32>ping /t 192.168.88.1
Haciendo ping a 192.168.88.1 con 32 bytes de datos:
Respuesta desde 192.168.88.1: bytes=32 tiempo=57ms TTL=64
Edited:
Even I have ping with another vpn client
C:\Windows\system32>ping /t 192.168.88.10
Haciendo ping a 192.168.88.10 con 32 bytes de datos:
Respuesta desde 192.168.88.10: bytes=32 tiempo=104ms TTL=64
But I have no ping with 192.168.1.1xx servers.
more logs:
server log after client connection:
Fri Sep 5 11:40:17 2014 us=596041 MULTI: multi_create_instance called
Fri Sep 5 11:40:17 2014 us=596167 4.3.2.1:14217 Re-using SSL/TLS context
Fri Sep 5 11:40:17 2014 us=596233 4.3.2.1:14217 LZO compression initialized
Fri Sep 5 11:40:17 2014 us=596503 4.3.2.1:14217 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Fri Sep 5 11:40:17 2014 us=596559 4.3.2.1:14217 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Fri Sep 5 11:40:17 2014 us=596640 4.3.2.1:14217 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher DES-EDE3-CBC,auth SHA1,keysize 192,tls-auth,key-method 2,tls-server'
Fri Sep 5 11:40:17 2014 us=596661 4.3.2.1:14217 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher DES-EDE3-CBC,auth SHA1,keysize 192,tls-auth,key-method 2,tls-client'
Fri Sep 5 11:40:17 2014 us=596720 4.3.2.1:14217 Local Options hash (VER=V4): 'b5edb94e'
Fri Sep 5 11:40:17 2014 us=596747 4.3.2.1:14217 Expected Remote Options hash (VER=V4): '53f7fc82'
RFri Sep 5 11:40:17 2014 us=596892 4.3.2.1:14217 TLS: Initial packet from [AF_INET]4.3.2.1:14217, sid=5783182d dad06d5b
WRRWRWRWWWWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRRRRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWR
Fri Sep 5 11:40:18 2014 us=626040 4.3.2.1:14217 VERIFY OK: depth=1, /C=ES/ST=aa/L=bb/O=cc/OU=Servidores/CN=vpn.mydomain.com/name=dd/emailAddress=webmaster@mydomain.com
Fri Sep 5 11:40:18 2014 us=626285 4.3.2.1:14217 VERIFY OK: depth=0, /C=ES/ST=aa/L=bb/O=cc/OU=ES/CN=portatil/name=dd/emailAddress=dclemen@mydomain.com
WRWRWRWRWRWRWRWRWRWR
Fri Sep 5 11:40:18 2014 us=796280 4.3.2.1:14217 Data Channel Encrypt: Cipher 'DES-EDE3-CBC' initialized with 192 bit key
Fri Sep 5 11:40:18 2014 us=796329 4.3.2.1:14217 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Sep 5 11:40:18 2014 us=796350 4.3.2.1:14217 Data Channel Decrypt: Cipher 'DES-EDE3-CBC' initialized with 192 bit key
Fri Sep 5 11:40:18 2014 us=796369 4.3.2.1:14217 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
WWWRRR
Fri Sep 5 11:40:18 2014 us=855317 4.3.2.1:14217 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Fri Sep 5 11:40:18 2014 us=855366 4.3.2.1:14217 [portatil] Peer Connection Initiated with [AF_INET]4.3.2.1:14217
Fri Sep 5 11:40:18 2014 us=855412 portatil/4.3.2.1:14217 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd//portatil
Fri Sep 5 11:40:18 2014 us=855572 portatil/4.3.2.1:14217 MULTI: Learn: 192.168.88.6 -> portatil/4.3.2.1:14217
Fri Sep 5 11:40:18 2014 us=855588 portatil/4.3.2.1:14217 MULTI: primary virtual IP for portatil/4.3.2.1:14217: 192.168.88.6
Fri Sep 5 11:40:18 2014 us=855599 portatil/4.3.2.1:14217 MULTI: internal route 192.168.30.0/24 -> portatil/4.3.2.1:14217
Fri Sep 5 11:40:18 2014 us=855632 portatil/4.3.2.1:14217 MULTI: Learn: 192.168.30.0/24 -> portatil/4.3.2.1:14217
Fri Sep 5 11:40:18 2014 us=855658 portatil/4.3.2.1:14217 REMOVE PUSH ROUTE: 'route 192.168.30.0 255.255.255.0'
RwRFri Sep 5 11:40:20 2014 us=621154 portatil/4.3.2.1:14217 PUSH: Received control message: 'PUSH_REQUEST'
Fri Sep 5 11:40:20 2014 us=621231 portatil/4.3.2.1:14217 SENT CONTROL [portatil]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 192.168.88.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.88.6 192.168.88.5' (status=1)
WWWWRRRRwrWRw.....
client connection log:
Fri Sep 05 11:40:17 2014 Socket Buffers: R=[65536->65536] S=[65536->65536]
Fri Sep 05 11:40:17 2014 MANAGEMENT: >STATE:1409910017,RESOLVE,,,
Fri Sep 05 11:40:17 2014 UDPv4 link local: [undef]
Fri Sep 05 11:40:17 2014 UDPv4 link remote: [AF_INET]1.2.3.4:1194
Fri Sep 05 11:40:17 2014 MANAGEMENT: >STATE:1409910017,WAIT,,,
Fri Sep 05 11:40:17 2014 MANAGEMENT: >STATE:1409910017,AUTH,,,
Fri Sep 05 11:40:17 2014 TLS: Initial packet from [AF_INET]1.2.3.4:1194, sid=d6dee555 105f2d7c
Fri Sep 05 11:40:17 2014 VERIFY OK: depth=1, C=ES, ST=aa, L=bb, O=cc, OU=dd, CN=vpn.mydomain, name=ee, emailAddress=webmaster@mydomain
Fri Sep 05 11:40:17 2014 VERIFY OK: nsCertType=SERVER
Fri Sep 05 11:40:17 2014 VERIFY OK: depth=0, C=ES, ST=aa, L=bb, O=cc, OU=ES, CN=VPNServer, name=dd, emailAddress=webmaster@mydomain.com
Fri Sep 05 11:40:18 2014 Data Channel Encrypt: Cipher 'DES-EDE3-CBC' initialized with 192 bit key
Fri Sep 05 11:40:18 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Sep 05 11:40:18 2014 Data Channel Decrypt: Cipher 'DES-EDE3-CBC' initialized with 192 bit key
Fri Sep 05 11:40:18 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Sep 05 11:40:18 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Fri Sep 05 11:40:18 2014 [VPNServer] Peer Connection Initiated with [AF_INET]1.2.3.4:1194
Fri Sep 05 11:40:19 2014 MANAGEMENT: >STATE:1409910019,GET_CONFIG,,,
Fri Sep 05 11:40:20 2014 SENT CONTROL [VPNServer]: 'PUSH_REQUEST' (status=1)
Fri Sep 05 11:40:20 2014 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 192.168.88.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.88.6 192.168.88.5'
Fri Sep 05 11:40:20 2014 OPTIONS IMPORT: timers and/or timeouts modified
Fri Sep 05 11:40:20 2014 OPTIONS IMPORT: --ifconfig/up options modified
Fri Sep 05 11:40:20 2014 OPTIONS IMPORT: route options modified
Fri Sep 05 11:40:20 2014 Preserving previous TUN/TAP instance: Ethernet 2
Fri Sep 05 11:40:20 2014 Initialization Sequence Completed
Fri Sep 05 11:40:20 2014 MANAGEMENT: >STATE:1409910020,CONNECTED,SUCCESS,192.168.88.6,1.2.3.4
More info, server route:
route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.88.2 * 255.255.255.255 UH 0 0 0 tun0
192.168.1.0 * 255.255.255.0 U 0 0 0 eth0
192.168.30.0 192.168.88.2 255.255.255.0 UG 0 0 0 tun0
192.168.88.0 192.168.88.2 255.255.255.0 UG 0 0 0 tun0
default 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
client route:
route print
===========================================================================
ILista de interfaces
19...00 ff 1e 41 ba 1d ......TAP-Windows Adapter V9
3...c4 54 44 17 da f7 ......Qualcomm Atheros AR8171/8175 PCI-E Gigabit Etherne
t Controller (NDIS 6.30)
1...........................Software Loopback Interface 1
7...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
8...00 00 00 00 00 00 00 e0 Adaptador ISATAP de Microsoft #3
9...00 00 00 00 00 00 00 e0 Adaptador ISATAP de Microsoft
===========================================================================
IPv4 Tabla de enrutamiento
===========================================================================
Rutas activas:
Destino de red Máscara de red Puerta de enlace Interfaz Métrica
0.0.0.0 0.0.0.0 192.168.30.1 192.168.30.51 20
127.0.0.0 255.0.0.0 En vínculo 127.0.0.1 306
127.0.0.1 255.255.255.255 En vínculo 127.0.0.1 306
127.255.255.255 255.255.255.255 En vínculo 127.0.0.1 306
192.168.1.0 255.255.255.0 192.168.88.5 192.168.88.6 20
192.168.30.0 255.255.255.0 En vínculo 192.168.30.51 276
192.168.30.51 255.255.255.255 En vínculo 192.168.30.51 276
192.168.30.255 255.255.255.255 En vínculo 192.168.30.51 276
192.168.88.0 255.255.255.0 192.168.88.5 192.168.88.6 20
192.168.88.4 255.255.255.252 En vínculo 192.168.88.6 276
192.168.88.6 255.255.255.255 En vínculo 192.168.88.6 276
192.168.88.7 255.255.255.255 En vínculo 192.168.88.6 276
224.0.0.0 240.0.0.0 En vínculo 127.0.0.1 306
224.0.0.0 240.0.0.0 En vínculo 192.168.30.51 276
224.0.0.0 240.0.0.0 En vínculo 192.168.88.6 276
255.255.255.255 255.255.255.255 En vínculo 127.0.0.1 306
255.255.255.255 255.255.255.255 En vínculo 192.168.30.51 276
255.255.255.255 255.255.255.255 En vínculo 192.168.88.6 276
===========================================================================
Rutas persistentes:
Ninguno
IPv6 Tabla de enrutamiento
===========================================================================
Rutas activas:
Cuando destino de red métrica Puerta de enlace
1 306 ::1/128 En vínculo
1 306 ff00::/8 En vínculo
===========================================================================
Rutas persistentes:
Ninguno
Can you help me?
Thanks!!
