OpenVPN bad config ?

tofu00

Hi,
I'm a student and i'm blocked by a firewall so I want to use OpenVPN. But it doesn't work.
I'm using OpenVPN 2.3.5 and easyrsa3.

server.conf:

port 443
proto tcp
dev tun

ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key  # This file should be kept secret
dh /etc/openvpn/dh2048.pem

server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt

push "route 10.8.0.0 255.255.255.0"
;push "redirect-gateway def1 bypass-dhcp"
push "redirect-gateway"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"

keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun

status openvpn-status.log
log-append  openvpn.log
verb 3

client.conf:

client
dev tun
proto tcp
remote 195.x.x.x 443

resolv-retry 3
nobind
persist-key
persist-tun

ca ca.crt
cert tofu_serverside.crt
key tofu.key

remote-cert-tls server
comp-lzo
verb 3

Connection log:

Sun Nov 16 17:55:57 2014 OpenVPN 2.3.3 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Apr 10 2014
Enter Management Password:
Sun Nov 16 17:55:57 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sun Nov 16 17:55:57 2014 Need hold release from management interface, waiting...
Sun Nov 16 17:55:57 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sun Nov 16 17:55:57 2014 MANAGEMENT: CMD 'state on'
Sun Nov 16 17:55:57 2014 MANAGEMENT: CMD 'log all on'
Sun Nov 16 17:55:57 2014 MANAGEMENT: CMD 'hold off'
Sun Nov 16 17:55:57 2014 MANAGEMENT: CMD 'hold release'
Sun Nov 16 17:55:58 2014 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sun Nov 16 17:55:58 2014 Attempting to establish TCP connection with [AF_INET]195.x.x.x:443
Sun Nov 16 17:55:58 2014 MANAGEMENT: >STATE:1416156958,TCP_CONNECT,,,
Sun Nov 16 17:55:58 2014 TCP connection established with [AF_INET]195.x.x.x:443
Sun Nov 16 17:55:58 2014 TCPv4_CLIENT link local: [undef]
Sun Nov 16 17:55:58 2014 TCPv4_CLIENT link remote: [AF_INET]195.x.x.x:443
Sun Nov 16 17:55:58 2014 MANAGEMENT: >STATE:1416156958,WAIT,,,
Sun Nov 16 17:55:58 2014 MANAGEMENT: >STATE:1416156958,AUTH,,,
Sun Nov 16 17:55:58 2014 TLS: Initial packet from [AF_INET]195.x.x.x:443, sid=c4524b13 421cfece
Sun Nov 16 17:55:58 2014 VERIFY OK: depth=1, CN=dedibox
Sun Nov 16 17:55:58 2014 Validating certificate key usage
Sun Nov 16 17:55:58 2014 ++ Certificate has key usage  00a0, expects 00a0
Sun Nov 16 17:55:58 2014 VERIFY KU OK
Sun Nov 16 17:55:58 2014 Validating certificate extended key usage
Sun Nov 16 17:55:58 2014 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sun Nov 16 17:55:58 2014 VERIFY EKU OK
Sun Nov 16 17:55:58 2014 VERIFY OK: depth=0, CN=dedibox
Sun Nov 16 17:55:59 2014 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Nov 16 17:55:59 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Nov 16 17:55:59 2014 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Nov 16 17:55:59 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Nov 16 17:55:59 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sun Nov 16 17:55:59 2014 [dedibox] Peer Connection Initiated with [AF_INET]195.x.x.x:443
Sun Nov 16 17:56:00 2014 MANAGEMENT: >STATE:1416156960,GET_CONFIG,,,
Sun Nov 16 17:56:01 2014 SENT CONTROL [dedibox]: 'PUSH_REQUEST' (status=1)
Sun Nov 16 17:56:01 2014 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,redirect-gateway def1,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Sun Nov 16 17:56:01 2014 OPTIONS IMPORT: timers and/or timeouts modified
Sun Nov 16 17:56:01 2014 OPTIONS IMPORT: --ifconfig/up options modified
Sun Nov 16 17:56:01 2014 OPTIONS IMPORT: route options modified
Sun Nov 16 17:56:01 2014 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Nov 16 17:56:01 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Nov 16 17:56:01 2014 MANAGEMENT: >STATE:1416156961,ASSIGN_IP,,10.8.0.6,
Sun Nov 16 17:56:01 2014 open_tun, tt->ipv6=0
Sun Nov 16 17:56:01 2014 TAP-WIN32 device [FrozenWay] opened: \\.\Global\{BA0106E6-5A5D-49D5-86FA-DC152C046885}.tap
Sun Nov 16 17:56:01 2014 TAP-Windows Driver Version 9.9 
Sun Nov 16 17:56:01 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {BA0106E6-5A5D-49D5-86FA-DC152C046885} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Sun Nov 16 17:56:01 2014 Successful ARP Flush on interface [16] {BA0106E6-5A5D-49D5-86FA-DC152C046885}
Sun Nov 16 17:56:06 2014 TEST ROUTES: 3/3 succeeded len=2 ret=1 a=0 u/d=up
Sun Nov 16 17:56:06 2014 C:\Windows\system32\route.exe ADD 195.x.x.x MASK 255.255.255.255 192.168.0.200
Sun Nov 16 17:56:06 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Sun Nov 16 17:56:06 2014 Route addition via IPAPI succeeded [adaptive]
Sun Nov 16 17:56:06 2014 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Sun Nov 16 17:56:06 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Nov 16 17:56:06 2014 Route addition via IPAPI succeeded [adaptive]
Sun Nov 16 17:56:06 2014 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Sun Nov 16 17:56:06 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Nov 16 17:56:06 2014 Route addition via IPAPI succeeded [adaptive]
Sun Nov 16 17:56:06 2014 MANAGEMENT: >STATE:1416156966,ADD_ROUTES,,,
Sun Nov 16 17:56:06 2014 C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.5
Sun Nov 16 17:56:06 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Nov 16 17:56:06 2014 Route addition via IPAPI succeeded [adaptive]
Sun Nov 16 17:56:06 2014 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Sun Nov 16 17:56:06 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Nov 16 17:56:06 2014 Route addition via IPAPI succeeded [adaptive]
Sun Nov 16 17:56:06 2014 Initialization Sequence Completed
Sun Nov 16 17:56:06 2014 MANAGEMENT: >STATE:1416156966,CONNECTED,SUCCESS,10.8.0.6,195.x.x.x

ipconfig /all:

Configuration IP de Windows

   Nom de l'hôte . . . . . . . . . . : DELL
   Suffixe DNS principal . . . . . . :
   Type de noeud. . . . . . . . . .  : Hybride
   Routage IP activé . . . . . . . . : Non
   Proxy WINS activé . . . . . . . . : Non
   Liste de recherche du suffixe DNS.: univnautes.lan

Carte Ethernet FrozenWay :

   Suffixe DNS propre à la connexion. . . :
   Description. . . . . . . . . . . . . . : TAP-Windows Adapter V9
   Adresse physique . . . . . . . . . . . : 00-FF-BA-01-06-E6
   DHCP activé. . . . . . . . . . . . . . : Oui
   Configuration automatique activée. . . : Oui
   Adresse IPv4. . . . . . . . . . . . . .: 10.8.0.6(préféré)
   Masque de sous-réseau. . . . . . . . . : 255.255.255.252
   Bail obtenu. . . . . . . . . . . . . . : dimanche 16 novembre 2014 17:45:34
   Bail expirant. . . . . . . . . . . . . : lundi 16 novembre 2015 17:45:33
   Passerelle par défaut. . . . . . . . . : 10.8.0.5
   Serveur DHCP . . . . . . . . . . . . . : 10.8.0.5
   Serveurs DNS. . .  . . . . . . . . . . : 208.67.222.222
                                       208.67.220.220
   NetBIOS sur TCPIP. . . . . . . . . . . : Désactivé

Carte Ethernet Ethernet :

   Suffixe DNS propre à la connexion. . . : univnautes.lan
   Description. . . . . . . . . . . . . . : Contrôleur Realtek PCIe FE Family
   Adresse physique . . . . . . . . . . . : 18-03-73-75-38-4E
   DHCP activé. . . . . . . . . . . . . . : Oui
   Configuration automatique activée. . . : Oui
   Adresse IPv4. . . . . . . . . . . . . .: 192.168.0.1(préféré)
   Masque de sous-réseau. . . . . . . . . : 255.255.255.0
   Bail obtenu. . . . . . . . . . . . . . : dimanche 16 novembre 2014 17:11:15
   Bail expirant. . . . . . . . . . . . . : jeudi 24 décembre 2150 00:32:26
   Passerelle par défaut. . . . . . . . . :
   Serveur DHCP . . . . . . . . . . . . . : 192.168.0.200
   Serveurs DNS. . .  . . . . . . . . . . : 192.168.0.200
   NetBIOS sur Tcpip. . . . . . . . . . . : Activé

Wireshark:

55	45.190157000	00:ff:ba:01:06:e6	Broadcast	ARP	42	Who has 10.8.0.5?  Tell 10.8.0.6
56	45.190194000	00:ff:bb:01:06:e6	00:ff:ba:01:06:e6	ARP	42	10.8.0.5 is at 00:ff:bb:01:06:e6

I c'ant ping anything execpt 195.x.x.x and 10.8.0.1.
I've try to put 10.8.0.1 in default gw but is the same thing.

What is the problem ? Route config ? What I have to do ?

Thanks in advance.

Traffic

did you enable ip forwarding ?

tofu00

Yes, sorry, forwarding is enabled and the firewall is disabled for tests.

Traffic

Have you enabled NAT for your VPN ?

tofu00

No.. Nat is the job of the firewall no ? So i have to setting my firewall to make nat?

Traffic

Then it sounds like your firewall need to know the static route for your VPN.

tofu00

You mean that I have to nat my private address 10.8.0.x to the public address of my server ?

Traffic

Your router will almost certainly be doing NAT for you already.
So your Private LAN IP (for example 192.168.0.2 your computer), will be seen as what ever your public IP is.

You also need to do one or the other of the following inside your LAN:

Use NAT to translate your VPN IPs to your Server LAN IP: Do this on the VPN server.
Have a static route on your server LAN default gateway (your router) which routes your VPN IP addresses.

tofu00

Use NAT to translate your VPN IPs to your Server LAN IP: Do this on the VPN server.

So I have to use tap instead of tun in my server.conf ? (I want a routed network)

Have a static route on your server LAN default gateway (your router) which routes your VPN IP addresses.

I'm not sure to understand. Do you mean that I have to put a default gw on my OpenVPN interface ?
What must be the default gw on my Windows Tun/Tap interface if I want routed network ? 10.8.0.1 ?

Traffic

tofu00 wroteQuote:
Use NAT to translate your VPN IPs to your Server LAN IP: Do this on the VPN server.

So I have to use tap instead of tun in my server.conf ? (I want a routed network)

Use --dev tun .. --dev tap has nothing to do with the problem.

NAT is a function of your operating system not OpenVPN.

See this HOWTO: HOWTO: Routing all client traffic (including web-traffic) through the VPN

OR this alternative solution:

tofu00 wroteQuote:
Have a static route on your server LAN default gateway (your router) which routes your VPN IP addresses.

I'm not sure to understand

Use the help files from your firewall/router and find out where you setup a static route on your router/firewall.

tofu00

I've already seen this HOWTO.
When there is 'push "redirect-gateway def1"' in my server.conf, the client has no gateway. So I put 'push "redirect-gateway"' and then the client get a default gw but the address is 10.8.0.5. I don't know why but I think that the address must be 10.8.0.1 ?

I've disabled firewalld, activated iptables, autorize all traffic after a flush and put this line from the HOWTO on my server with the good interface: 'iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE'
But this is the same thing, I can ping 10.8.0.1 and the public address 195.x.x.x of my server but I can't ping the outside.

Have a static route on your server LAN default gateway (your router) which routes your VPN IP addresses.

I don't understand this sentence 😐 Logically you talk about the dedicated server with the public address 195.x.x.x and not the router behind my client. Is this ?
If is this, I've to route the network 10.8.0.0/24 on my 195.x.x.x interface ?

Traffic

tofu00 wroteI've already seen this HOWTO.

You need to read it carefully ..

tofu00 wroteWhen there is 'push "redirect-gateway def1"' in my server.conf, the client has no gateway

Then something else is wrong ..

tofu00 wrotethe address is 10.8.0.5. I don't know why but I think that the address must be 10.8.0.1 ?

10.8.0.5 is the OpenVPN end point for the client side .. also it is the client side DHCP.
It is a net30 address (subnet mask with 30 bits 255.255.255.252) .. It will not respond to ping (this is by design)

As you do not understand the setup you have .. add --topology subnet to your server config.

See --topology in The Manual v23x

tofu00 wroteand put this line from the HOWTO on my server with the good interface: 'iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE'

That is the correct command for NAT if they are the correct parameters for your setup ..

Please post full details of ifconfig from your server with OpenVPN running.

tofu00

ifconfig:

enp2s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 195.154.x.x   netmask 255.255.255.0  broadcast 195.154.x.255
        inet6 fe80::ea9a:xxxx:xxxxx:xxxx  prefixlen 64  scopeid 0x20<link>
        ether e8:9a:8f:13:7f:ca  txqueuelen 1000  (Ethernet)
        RX packets 20289  bytes 1652500 (1.5 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2293  bytes 406949 (397.4 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device interrupt 28  memory 0xfeae0000-feb00000

enp3s0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether e8:9a:8f:13:7f:cb  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device interrupt 36  memory 0xfebe0000-fec00000

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 0  (Local Loopback)
        RX packets 4  bytes 420 (420.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 4  bytes 420 (420.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.8.0.1  netmask 255.255.255.255  destination 10.8.0.2
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

I will see tomorrow the topology option.

Thank you!

Traffic

As your ethernet NICs are not called ethx your NAT command above will not work ...

tofu00

Yes I know 😉 I've said 'with the good interface'. All seems to work with the --topology option. I will see tomorrow what it really does.

Thank you again.