client connects but cant navigate anywhere

andrew.walter

I have been pulling my hair out on every step of this VPN config for a week now. I finally got a windows 7 client to connect to the server via OpenVPN Gui, but now I am unable to navigate to any servers on the subnet. My internet connection im using to test is a wifi hotspot from my phone at 192.168.43.x. I connect to the VPN subnet at 192.168.1.x, and I need to be able to navigate to the subnet behind the office subnet at 192.168.201.x. I am unable to ping anywhere on the 192.168.1.x network, much less the 201.x. I have tried several config changes but nothing is resolving the issues, here are my configs.

Server:
mode server
tls-server
local 192.168.1.80 ## ip/hostname of server
port 15000 ## default openvpn port
proto udp
#bridging directive
dev tap0 ## If you need multiple tap devices, add them here
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"
persist-key
persist-tun
#certificates and encryption
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem
tls-auth ta.key 0 # This file is secret
cipher BF-CBC # Blowfish (default)
comp-lzo
#DHCP Information
ifconfig-pool-persist ipp.txt
server-bridge 192.168.1.80 255.255.255.0 192.168.1.86 192.168.1.90
***I tried adding [push "redirect-gateway" and "redirect-gateway def1"] but neither one worked***
push "dhcp-option DNS 192.168.1.1"
push "dhcp-option DOMAIN opesnet.lab"
max-clients 38 ## set this to the max number of clients that should be connecte$
#log and security
user nobody
group nogroup
keepalive 10 120
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn-net.log
verb 3
script-security 3

Client config:
**edited out my domain name**
client
dev tap
;dev tun
;dev-node MyTap
;proto tcp
proto udp
remote (my domain) 15000
;remote my-server-2 1194
;remote-random
resolv-retry infinite
Nobind
;user nobody
;group nobody
persist-key
persist-tun
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
;mute-replay-warnings
ca ca.crt
cert develop.crt
key develop.key
;ns-cert-type server
tls-auth ta.key 1
cipher BF-CBC
Comp-lzo
Verb 3

I tried a few loosley related solutions I found around the forums like adding default routes and changing default gateways, but nothing changed. Let me know if any other output is needed Please help! 😃

maikcat

post the output of ifconfig AFTER vpn is up (server side)

Michael.

andrew.walter

Server side ifconfig:

br0 Link encap:Ethernet HWaddr 0a:b3:ea:b1:87:ac
inet addr:192.168.1.80 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::5054:ff:feb6:2cb4/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:445784 errors:0 dropped:0 overruns:0 frame:0
TX packets:71503 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:73549011 (73.5 MB) TX bytes:9270681 (9.2 MB)

eth0 Link encap:Ethernet HWaddr 52:54:00:b6:2c:b4
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:444018 errors:0 dropped:0 overruns:0 frame:0
TX packets:76737 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:80878360 (80.8 MB) TX bytes:9788076 (9.7 MB)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:124801 errors:0 dropped:0 overruns:0 frame:0
TX packets:124801 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:9490168 (9.4 MB) TX bytes:9490168 (9.4 MB)

tap0 Link encap:Ethernet HWaddr 0a:b3:ea:b1:87:ac
inet6 addr: fe80::8b3:eaff:feb1:87ac/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:5628 errors:0 dropped:0 overruns:0 frame:0
TX packets:121951 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:560335 (560.3 KB) TX bytes:14373888 (14.3 MB)

maikcat

switch your eth0 to promisc mode.

Michael.

andrew.walter

I changed eth0 to promisc mode, same result. Running Nmap on the server does not see the client at .1.88, and the client is still only able to ping his own interface of .1.88. Here is the routing table on the client. I also tried manually removing the 0.0.0.0 route and assigning 0.0.0.0 to point to 192.168.1.88 just to test, but I get the same result.

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.43.1 192.168.43.240 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.1.0 255.255.255.0 On-link 192.168.1.88 276
192.168.1.88 255.255.255.255 On-link 192.168.1.88 276
192.168.1.255 255.255.255.255 On-link 192.168.1.88 276
192.168.43.0 255.255.255.0 On-link 192.168.43.240 281
192.168.43.240 255.255.255.255 On-link 192.168.43.240 281
192.168.43.255 255.255.255.255 On-link 192.168.43.240 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.43.240 281
224.0.0.0 240.0.0.0 On-link 192.168.1.88 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.43.240 281
255.255.255.255 255.255.255.255 On-link 192.168.1.88 276
===========================================================================

maikcat

some things to check,

1)enable ip forwarding on openvpn server

2)disable any firewall rules on openvpn server

3)post the output of brctl show on openvpn server

4)remove this from server config

mode server

5)try to use routers ip instead of 1.80 on server-bridge directive.

Michael.