What is the simplest config to access the openvpn server?

fast2

I have gotten myself a little lost, I only wish to access resources on the ubuntu server that openvpn server is installed on, I have only installed openssh and openvpn, I did not install the bridge utilities.

All of the searches I've done come back with results for accessing the local lan.

I would like to keep the install as simple as possible to access just the server.

I have a connection to the server using the default pool with the ios app and the ios app log shows the server config push route option of the server local lan.

The server routing table shows the local lan on eth1 and the default pool on tun but I cannot get a response from the ssh server when using an ssh client user@192.168.23.59, the ssh client does connect when the iphone is on the 192.168.23.0 subnet and not connected to the vpn.

ios config;

client
resolv-retry 20
keepalive 10 60
nobind
mute-replay-warnings
ns-cert-type server
comp-lzo
verb 1
persist-key
persist-tun
explicit-exit-notify 1
dev tun
proto udp
port 1194
cipher AES-128-CBC
cert iphonetest.crt
key iphonetest.key
ca ca.crt
remote ************ 1194

ios log;

2014-12-14 22:26:30 VERIFY OK: depth=0
cert. version    : 3
serial number    : 01
issuer name      : C=US, OU=test3, CN=test, ??=test2
subject name      : C=US, O=test4, OU=test3, CN=1204desk32, ??=test2
issued  on        : 2014-12-14 21:42:44
expires on        : 2024-12-11 21:42:44
signed using      : RSA with SHA1
RSA key size      : 1024 bits
basic constraints : CA=false
cert. type        : SSL Server
key usage        : Digital Signature, Key Encipherment
ext key usage    : TLS Web Server Authentication

2014-12-14 22:26:31 SSL Handshake: TLSv1.0/TLS-DHE-RSA-WITH-AES-256-CBC-SHA
2014-12-14 22:26:31 Session is ACTIVE
2014-12-14 22:26:31 EVENT: GET_CONFIG
2014-12-14 22:26:31 Sending PUSH_REQUEST to server...
2014-12-14 22:26:31 OPTIONS:
0 [route] [192.168.23.0] [255.255.255.0] 
1 [route] [10.8.0.1] 
2 [topology] [net30] 
3 [ping] [10] 
4 [ping-restart] [120] 
5 [ifconfig] [10.8.0.6] [10.8.0.5]

Thanks.

maikcat

please post your server configs/logs.

also are you trying to test while in the SAME network?

Michael.

fast2

Thanks for responding.
I see my subject isn't quite right, it should be asking the simplest config to access tcp resources on the server, for example, ssh and apache, with the same lan address, 192.168.53.59, from the lan, and from the wan through openvpn, without having to add a route to the server lan gateway even though a port forward is required on the server lan gateway. I understand a route is required on the gateway in order for lan nodes other than the server to respond to the vpn client but that's not necessary in this case.

I will not have access to the test server for at least a day, but after reviewing the server.conf example on the openvpn site, I was using the Ubuntu manual instructions, I believe that I failed to enable the ethernet bridging even though I enabled the push route as can be seen in my ios log.

The only changes I made from the default server.conf is to add the keys and the push route.

In answer to your question my tests were done connecting from the wan by turning off the wifi on the iphone.

I have to attempt to enable this on the production server tonight before I can get back to the test server, hopefully enabling the ethernet bridging in server.conf is the key to this.

fast2

If I'm correct, then this server.conf should accomplish the goal.

port 1194
proto udp
dev tun
ca ca.crt
cert 1204desk32.crt
key 1204desk32.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
push "route 192.168.23.0 255.255.255.0"
keepalive 10 120
comp-lzo
max-clients 2
persist-key
persist-tun
status openvpn-status.log
verb 3

maikcat

first avoid bridging , it will complicate things + needs a very DIFFERENT config file.

to keep it simple use server x.x.x.x 255.255.255.0 directive where x.x.x.x use a private network range,
after that enable ip forwarding on server and keep the push directive inside your server config.

thats all.

Michael.

Traffic

fast2 wroteCode:
server 10.8.0.0 255.255.255.0
server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100

You cannot specify --server and --server-bridge .. remove --server-bridge.

fast2

Does this look right?
From both your posts, the following should give me access to https type resources on the openvpn server.

ios config;

client
resolv-retry 20
keepalive 10 60
nobind
mute-replay-warnings
ns-cert-type server
comp-lzo
verb 1
persist-key
persist-tun
explicit-exit-notify 1
dev tun
proto udp
port 1194
cipher AES-128-CBC
cert iphonetest.crt
key iphonetest.key
ca ca.crt
remote ************ 1194

server.conf;

port 1194
proto udp
dev tun
ca ca.crt
cert 1204desk32.crt
key 1204desk32.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
push "route 192.168.23.0 255.255.255.0"
keepalive 10 120
comp-lzo
max-clients 2
persist-key
persist-tun
status openvpn-status.log
verb 3

and lastly, this;
http://openvpn.net/index.php/open-source/faq/77-server/265-how-do-i-enable-ip-forwarding.html

Traffic

fast2 wroteDoes this look right?

Looks good.

fast2 wrotethe following should give me access to https type resources on the openvpn server

Yes.

You will require more steps to access other resources on the server LAN, either by routing or NAT.

These HOWTOs will help:

fast2

Still wouldn't access resources on the vpn server but I found an inconsistency error in the syslog because the server default is blowfish and the ios client config I was using as posted above specified AES, so I enabled AES on the server and that allowed connection without having to use itunes to reload an edited client config.

So the only difference form the above configs is to add, enable: cipher AES-128-CBC

Thank you.

Traffic

Well spotted: blowfish-CBC is the openvpn default.

fast2

Here's another one for the noodle, I ran the setup on the production server and it did not require changing the ip_forward file value to 1, I have full access to resources on that server and the ip_forward file is still at 0.

maikcat

no way this could happening,

how are you checking ip_forward value?

are there any NAT rules enabled?

Michael.

fast2

maikcat wroteno way this could happening,

how are you checking ip_forward value?

are there any NAT rules enabled?

Michael.

user@server:~$ cat /proc/sys/net/ipv4/ip_forward
0
user@server:~$ sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 0
user@server:~$ netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 192.168.11.1 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
192.168.11.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

Traffic

fast2 wroteHere's another one for the noodle, I ran the setup on the production server and it did not require changing the ip_forward file value to 1, I have full access to resources on that server and the ip_forward file is still at 0.

Yes .. you can access resources on the server

As Michael pointed out:

maikcat wroteno way this could happening

but what about resources in the server LAN which are not on the server ?

fast2

Traffic wrote
fast2 wroteHere's another one for the noodle, I ran the setup on the production server and it did not require changing the ip_forward file value to 1, I have full access to resources on that server and the ip_forward file is still at 0.
Yes .. you can access resources on the server

As Michael pointed out:
maikcat wroteno way this could happening
but what about resources in the server LAN which are not on the server ?

I cannot access addresses on the lan outside the openvpn server.

Which is all I asked for.

Again and again in each post. I made every effort to be very clear about what I wanted.

For several days I followed up on these posts even though I had already solved the setup issues and setup the server to my needs.

This forum is not at all helpful.

Each post requesting help took about 2 days to be published to the forum.

Then, those that tried to help, failed to understand the needs of the original post and gave incomplete, incorrect and inconsistent assistance.

Therefore, I can't imagine what the point of this forum is.

Anyway, thanks for trying and happy new year.

Traffic

fast2 wroteI cannot access addresses on the lan outside the openvpn server.

Which is all I asked for.

Actually .. that is not the case ..

You found an error in your first config:

fast2 wroteStill wouldn't access resources on the vpn server but I found an inconsistency error in the syslog because the server default is blowfish

and you solved it yourself .. well done!

Then you came back with:

fast2 wroteHere's another one for the noodle

And you claimed that you can access resources on the server LAN without IP_Forward=1 ..

maikcat wroteno way this could happening

and then i realised that you could access resources on the server as you can without IP_Forwarding .. see my previous post.

And now this:

fast2 wroteAgain and again in each post. I made every effort to be very clear about what I wanted

You were not clear enough ..

And .. enable IP_Forwarding.

If that does not solve the problem .. please check your firewall and routing.

fast2 wroteThis forum is not at all helpful

I disagree.

fast2 wrotehappy new year

you too ..... :mrgreen:

maikcat

from your FIRST post...

I only wish to access resources on the ubuntu server that openvpn server is installed on

from your LAST post

I cannot access addresses on the lan outside the openvpn server.

Which is all I asked for.

I rest my case,

Michael.

fast2

maikcat wrote
I rest my case,

Michael.

You just don't get it.

Read the title of this thread.

"What is the simplest config to access the openvpn server?"

Despite your 'help', I was able setup the config so I could access resources on the openvpn server and I cannot access addresses on the lan outside of the openvpn server.

Which is all I asked for.

Jerking people around with misinformation isn't being helpful, so I can only assume you're a troll.

Hopefully if other frustrated users see this they won't take your advice blindly and waste their time on it.

Traffic

Amazing :lol: :shock: :lol:

fast2 wroteJerking people around with misinformation isn't being helpful, so I can only assume you're a troll

as that appears to be aimed at maikcat, i can only assume you have not read anything we have posted to help you.

@fast2: Meet maikcat .. the #1 mod on this forum ..

Otherwise:
https://forums.openvpn.net/topic17742.html#p47726

:arrow: closing topic :?:

maikcat

fast2 wrote
You just don't get it.

Read the title of this thread.

"What is the simplest config to access the openvpn server?"

Despite your 'help', I was able setup the config so I could access resources on the openvpn server and I cannot access addresses on the lan outside of the openvpn server.

Which is all I asked for.

Jerking people around with misinformation isn't being helpful, so I can only assume you're a troll.

Hopefully if other frustrated users see this they won't take your advice blindly and waste their time on it.

At first i wouldnt bother to answer to your "response" but since you were addressing to me i though , what the heck...

My "suggestions" were:

please post your server configs/logs.

also are you trying to test while in the SAME network?

Michael.

first avoid bridging , it will complicate things + needs a very DIFFERENT config file.

to keep it simple use server x.x.x.x 255.255.255.0 directive where x.x.x.x use a private network range,
after that enable ip forwarding on server and keep the push directive inside your server config.

thats all.

Michael.

and last...

no way this could happening,

how are you checking ip_forward value?

are there any NAT rules enabled?

Michael.

So , you call me a troll because :

1) i asked you to post your client/server logs
2) suggested to avoid bridging and enable routing on your openvpn server and push the necessary routes to your clients
3) avoid to test your setup while in the same network
4) is NAT enabled.

you "frustrated user" , if my above statements caused so many confusion/frustration to you them i am sorry.

so after 20+ days you come back to say:

Jerking people around with misinformation isn't being helpful

My answer to that is: LOL

i will also agree with traffic , did you bother to read any of the links traffic provided?

but why actually do that anyway... :?:

I will keep this topic open for now...

Michael.