Windows 7 connecting to Windows 2003 SBS - Not able to ping

harryit

Greetings.
I hope someone would kindly help me with my issue. I’m looking to remotely join a workstation to a domain over OpenVPN (I don’t want to take a new PC to site all the time to join it to the domain and configure etc. I’d like to do this remotely).

Windows 7 client IPs:
Local IP: 192.168.1.104
Local Gateway: 192.168.1.1
OpenVPN IP: 10.1.1.2

Windows 2003 SBS (LIVE) server IPs:
Local IP: 10.0.0.5
Local Gateway: 10.0.0.1
OpenVPN IP: 10.1.1.1

Windows 7 client does connect to Windows 2003 SBS via OpenVPN (OpenVPN icon goes green). I’m not able to ping the local server 2003 IP: 10.0.0.5 or the Windows 7 client OpenVPN IP: 10.1.1.2. The client is also unable to ping the server 2003 OpenVPN IP: 10.1.1.1. Windows 2003 SBS is a LIVE server so I have to be careful - This has DHCP; DNS and its local IP 10.0.0.5. Server Gateway 10.0.0.1).

I’ve decided to use the ‘server’ directive (very similar to ‘server-bridge; well I get the same problem after my Open VPN connects – not able to ping anything - both ways).

I’ve renamed my Windows Tap adapter as ‘tap-bridge’ on both client and server.

maikcat

post configs used & logs
also post the netmasks used in your setup.

firewall status?

Michael.

harryit

Thanks for your reply. My configs are below.

I have tried and tested so many different variations.
I suspect a routing issue as the company WatchGuard would no nothing about the actual VPN subnet '10.1.1.0'?

I'm not 100% sure if the Windows 2003 Server is running the 'Routing and Remote Access' service as I know they already have a solution in place for remote users to connect into the office (but i'm new to the company so not 100% sure). I've read posts about RAS and OpenVPN so just thought I'd mention it.

Windows 7 – 64 bit (OpenVPN assigned IP: 10.1.1.2):
client.ovpn:

client

dev tap
dev-node tap-bridge
proto udp
remote 200.X.X.X 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ca.crt" 
cert "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\client1.crt" 
key "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\client1.key"
ns-cert-type server
pull
redirect-gateway def1
verb 5

SERVER: Windows 2003 SBS 32 bit (OpenVPN assigned IP: 10.1.1.1):
server.ovpn:

port 1194
proto udp
dev tap
dev-node tap-bridge
ca "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\server.crt"
key "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\server.key"
dh "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\dh2048.pem"
server 10.1.1.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.0.0.0 255.255.255.0"
push "route 10.0.0.5 255.255.255.0"
push "redirect-gateway"
persist-key
persist-tun
verb 5

maikcat

your configs are a little messed up...

the most critical question is: What do you want to do? do you need routing or bridging?

then we talk... 😉

Michael.

harryit

Thanks for your reply.

I'm hoping to use 'bridging' and 'dev-tap'.

But I am not actually bridging the Server 2003 'Local Area Connection' with the virtual OpenVPN 'tap-bridge' LAN adapter as testing has shown that it loses network connectivity and that you then have to manually input the IP address of the Server 'Local Area Connection' back into the new interface called 'Bridge'.

Is it still possible?

I am connecting but just cannot ping either end of the tunnel/VPN IPs.

Thanks for your help.

maikcat

if for some reason you need bridge setup you MUST bridge interfaces first.

use can use tap interface in routing scenario but this is not recommended..

why do you want bridging anyway?

Michael.

harryit

Hi Michael.

It seems to be whatever I try just won't work (it will connect to the VPN server) but won't be able to ping either way. This is because the VPN and local network are on a different subnet I believe but thought VPN would address this?

I've tried 'dev tun' and connect but still no ping.

Not sure what I am doing wrong?

maikcat

try to always start openvpn with admin rights on your win7.
also for testing disable any firewalls running on server side.

also select a config,(f.e routing based) post it here and we go step-by-step until it works...

Michael.

harryit

Hi Michael.

I have changed my config (I will still try with the 'tap method' but getting closer):

Client:

Iponfig:

Ethernet adapter mytapadapter:

Connection-specific DNS Suffix . : 10.0.0.5
Link-local IPv6 Address . . . . . : fe80::a0e3:690b:521e:662c%17
IPv4 Address. . . . . . . . . . . : 10.1.1.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 10.1.1.1

I cannot ping either the 2003 server 10.0.0.5 or the VPN gateway 10.1.1.1 (from the Windows 7 Client).

Pinging 10.0.0.5 with 32 bytes of data:
Request timed out.
Request timed out.

Pinging 10.1.1.1 with 32 bytes of data:
Request timed out.
Request timed out.

Client.ovpn
dev tap
tls-client
dev-node mytapadapter
proto udp
remote 217.X.X.X 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\client1.crt"
key "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\client1.key"
ns-cert-type server
pull
route-method exe
route-delay 2
verb 5

Server.ovpn:

port 1194
tls-server
proto udp
dev tap
dev-node mytapadapter
ca "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\server.crt"
key "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\server.key"
dh "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\dh2048.pem"
server 10.1.1.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.0.0.0 255.255.255.0"
push "route 10.1.1.0 255.255.255.0"
push "route 10.1.1.1 255.255.255.0"
push "redirect-gateway"
#Needed for Windows clients
push "ip-win32 dynamic"
#Push the DNS domain for your internal network
push "dhcp-option DOMAIN 10.0.0.5"
#Push DNS server
push "dhcp-option DNS 10.0.0.5"
#Push WINS server
push "dhcp-option WINS 10.0.0.5"
#Allows clients to talk to each other, otherwise they can only talk to OpenVPN server
client-to-client
persist-key
persist-tun
verb 5

The 2003 server doesn't have a default gateway on the tap adapter:

Ethernet adapter mytapadapter:

Connection-specific DNS Suffix . :
IP Address. . . . . . . . . . . . : 10.1.1.1
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :

Cannot ping the Windows 7 client:

Pinging 10.1.1.2 with 32 bytes of data:

Request timed out.
Request timed out.

maikcat

can you use the following config please:

port 1194
proto udp
dev tun
dev-node mytapadapter
ca "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\server.crt"
key "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\server.key"
dh "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\dh2048.pem"
server 10.1.1.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.0.0.0 255.255.255.0"
push "route 10.1.1.1 255.255.255.0"
push "redirect-gateway def1"
push "ip-win32 dynamic"
push "dhcp-option DOMAIN 10.0.0.5"
push "dhcp-option DNS 10.0.0.5"
client-to-client
persist-key
persist-tun
verb 5

client

dev tun
client
dev-node mytapadapter
proto udp
remote 217.X.X.X 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\client1.crt"
key "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\client1.key"
ns-cert-type server
route-method exe
route-delay 2
verb 5

also post logs please..

harryit

The TUN method always seems to work which is great:

Windows 7 client can ping the local IP and the VPN IP of the Windows 2003 server:

Client:

Ethernet adapter mytapadapter:

Connection-specific DNS Suffix . : 10.0.0.5
Link-local IPv6 Address . . . . . : fe80::a0e3:690b:521e:662c%17
IPv4 Address. . . . . . . . . . . : 10.1.1.6
Subnet Mask . . . . . . . . . . . : 255.255.255.252
Default Gateway . . . . . . . . . :

Pinging 10.0.0.5 with 32 bytes of data:
Reply from 10.0.0.5: bytes=32 time=90ms TTL=128
Reply from 10.0.0.5: bytes=32 time=41ms TTL=128
Reply from 10.0.0.5: bytes=32 time=39ms TTL=128
Reply from 10.0.0.5: bytes=32 time=40ms TTL=128

Pinging 10.1.1.1 with 32 bytes of data:
Reply from 10.1.1.1: bytes=32 time=40ms TTL=128
Reply from 10.1.1.1: bytes=32 time=40ms TTL=128
Reply from 10.1.1.1: bytes=32 time=40ms TTL=128
Reply from 10.1.1.1: bytes=32 time=39ms TTL=128

I'm not sure if additional work is required to get the TAP method to work?

Shall I post the logs for the TAP method to see if it can shed any light on this?

Thanks.

harryit

Also I've noticed that the Windows 7 client OpenVPN GUI actually disconnects correctly when using TUN as it used to freeze/hang leave the connection open in the notification area/system tray when I tried TAP (I had to reboot each time).

I always right click the VPN icon and do 'run as administrator' in Windows 7.

maikcat

rule of thumb:use tap in bridging scenarios,tun in routing..

also when using udp/tun if you disconnect your client your server doesnt actually knows it
for some seconds,to avoid this use

push "explicit-exit-notify 3"

on your server side...

Michael.

harryit

Hi Michael.

I've been using the TUN method to test but found a problem:

I cannot ping anything other than the internal LAN SBS 2003 server 10.0.0.5.

Have I missed a route?

Do I need route gateway 10.1.1.1 (which is the VPN virtual server IP) as Open VPN is installed on the SBS 2003 server (10.0.0.5).

I can only ping 10.1.1.1 and 10.0.0.5 but not 10.0.0.x.

Thanks

maikcat

did you enabled ip forwarding on your SBS?

Michael.

harryit

Hi Michael.

The IPEnableRouter has been set to '1' (on SBS 2003):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

I never rebooted the server after I made that change?

Also the 'Routing and Remote Access' service is disabled. Does this need to be started?

Thanks.

maikcat

AFAIK you need to reboot the server in order the change takes effect...

Michael.

harryit

Hi Michael.

Rebooted the server but still cannot ping anything other than 10.0.0.5 (SBS 2003).

The only thing left is the WatchGuard firewall router where I have only added a port forwarding rule to allow anything from the Internet address 217.x.x.x through to 10.0.0.5 via port 1194.

I'm not sure if I need to do anything else on the WatchGuard?

Thanks

maikcat

go to one pc (lan side) and add a static route for the vpn subnet pointing to your sbs,
also disable its firewall for testing.

if its works you must add the static route on your watchguard also.

Michael.