Can't get an openvpn server to work (win 7 ultimate)

moni

Here's the scenario. The server is run on machine with local IP 192.168.0.3 which is behind a cable modem/router
and it is in DMZ. I have tried to bridge the server's lan interface with the tap one, to no avail.
The internet traffic just aren't going via the VPN.

Both machines (server & client) are running Windows 7 Ultimate.

Please advice.

----------- SERVER.OVPN -----------

local 192.168.0.3
port 51194
proto udp
dev tap
dev-node tap01
ca ca.crt
cert server.crt
key server.key 
dh dh4096.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
push "redirect-gateway"
push "dhcp-option DNS 192.168.0.1"
push "dhcp-option DNS 10.8.0.1"
push "dhcp-option DNS 4.4.4.4"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 88.80.96.7"
push "dhcp-option DNS 88.80.96.2"
push "dhcp-option WINS 10.8.0.1"
client-to-client
duplicate-cn
route-method exe
route-delay 2
keepalive 10 120
cipher AES-256-CBC   # AES
comp-lzo
max-clients 100
persist-key
persist-tun
status openvpn-status.log
verb 5
mute 20

client
dev tap
proto udp
remote 192.168.0.3 51194
resolv-retry infinite
nobind
persist-tun
ca ca.crt
cert client1.crt
key client1.key
cipher AES-256-CBC
comp-lzo
verb 3
mute 20

maikcat

first use push "redirect-gateway def1"

second you will need to NAT traffic from your server lan to internet,RRAS can do that
but most people use linux for this

third always test your setup while in a different internet connection, not while in the same lan

also try dev tun instead of dev tap.

Michael.

Traffic

Also, 192.168.0.0/24 is probably the most over used LAN IP.

It is important that you change your server side LAN to a more unique number, eg: 192.168.171.0/24

Otherwise, you will almost certainly suffer from network conflicts!

moni

I forgot to add that the server is running RRAS and yes, I have patched the registry too as it is explained in Wiki guide.
I just can't use Linux on that machine. And yes, I've configured Linux ovpn server in the past and it was running ok.
I tried to connect remotely the laptop with win7 via another Internet connection, that's why I am writing this thread.
Thanks for the help.

I can't change the configuration of the cable modem, because my Internet provider does not allow customers to have admin passwords for their routers. So I can't change the subnet either (I know it's the most obvious one).

moni

RRAS is running on the server.
I did changed dev tun and "redirect gateway def1" as advised.
Unfortunately, nothing changed.
I can't change the subnet (192.168.0.0/24) in the cable modem config as I don't have the admin password by one simple reason - the Internet provider does not reveal the admin passwords to their users 🙁

Traffic

moni wrotethe Internet provider does not reveal the admin passwords to their users

So how have you set your server to be in a DMZ if you cannot configure the device.

maikcat

unless DMZ is a simple pass through port instead or a real DMZ zone.

Michael.

Traffic

maikcat wroteunless DMZ is a simple pass through port instead

Even so .. do you not require access to the router to enable this ...

@ moni : Please post your server and client logs at verb 4

Also, the server LAN is 192.168.0.0/24 .. what is the client LAN ?

maikcat

Even so .. do you not require access to the router to enable this ...

maybe he has readonly access 😉

please op enlighten us.

Michael.

moni

It's that simple. I needed to go to the Internet Provider's office and to speak with the admins to ask them to put the IP 192.168.0.3 in DMZ. They said they don't reveal the admin's passwords to anyone and that's the provider's policy. I really can't do anything about it and they, of course, are refusing to change the default DHCP network from 192.168.0.0/24 to something else.

Also, there are no other provider around, excluding the Telco one, who also does not reveal the admin passwords, but at least they're publicly available in the Internet. Alas, this provider offers bigger prices and lower speed.

As for the LAN configurations - the cable modem is connected to Internet with static IP and has DHCP server configured to 192.168.0.0/24. As you may have imagined by now, the client's PCs are configured also in this network (usually by auto configuration, but I use the DMZ's static IP 192.168.0.3, netmask 255.255.255.0, default gateway 192.168.0.1)

Logs to follow.

moni

------------ Client.log ------------------
Sat Dec 13 22:53:26 2014 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Sat Dec 13 22:53:26 2014 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sat Dec 13 22:53:26 2014 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sat Dec 13 22:53:26 2014 LZO compression initialized
Sat Dec 13 22:53:26 2014 UDPv4 link local: [undef]
Sat Dec 13 22:53:26 2014 UDPv4 link remote: 88.80.105.121:51194
Sat Dec 13 22:53:28 2014 [HQ] Peer Connection Initiated with 88.80.105.121:51194
Sat Dec 13 22:53:30 2014 Options error: --dhcp-option DNS: maximum of 4 DNS servers can be specified
Sat Dec 13 22:53:30 2014 Options error: --dhcp-option DNS: maximum of 4 DNS servers can be specified
Sat Dec 13 22:53:30 2014 TAP-WIN32 device [tap01] opened: \\.\Global\{16F2CC59-0D54-45A7-8D27-EF9A9E860F59}.tap
Sat Dec 13 22:53:30 2014 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.2/255.255.255.0 on interface {16F2CC59-0D54-45A7-8D27-EF9A9E860F59} [DHCP-serv: 10.8.0.0, lease-time: 31536000]
Sat Dec 13 22:53:30 2014 Successful ARP Flush on interface [14] {16F2CC59-0D54-45A7-8D27-EF9A9E860F59}
Sat Dec 13 22:53:35 2014 Initialization Sequence Completed
Sat Dec 13 22:55:55 2014 SIGTERM[hard,] received, process exiting
---------------------------------------------------------------------------------------

------------ SERVER.LOG --------------------------------------------------------------
Fri Dec 19 20:42:01 2014 us=543200 Current Parameter Settings:
Fri Dec 19 20:42:01 2014 us=544200   config = 'server.ovpn'
Fri Dec 19 20:42:01 2014 us=544200   mode = 1
Fri Dec 19 20:42:01 2014 us=544200   show_ciphers = DISABLED
Fri Dec 19 20:42:01 2014 us=544200   show_digests = DISABLED
Fri Dec 19 20:42:01 2014 us=544200   show_engines = DISABLED
Fri Dec 19 20:42:01 2014 us=544200   genkey = DISABLED
Fri Dec 19 20:42:01 2014 us=544200   key_pass_file = '[UNDEF]'
Fri Dec 19 20:42:01 2014 us=544200   show_tls_ciphers = DISABLED
Fri Dec 19 20:42:01 2014 us=544200 Connection profiles [default]:
Fri Dec 19 20:42:01 2014 us=544200   proto = udp
Fri Dec 19 20:42:01 2014 us=544200   local = '192.168.0.3'
Fri Dec 19 20:42:01 2014 us=544200   local_port = 51194
Fri Dec 19 20:42:01 2014 us=544200   remote = '[UNDEF]'
Fri Dec 19 20:42:01 2014 us=544200   remote_port = 51194
Fri Dec 19 20:42:01 2014 us=544200   remote_float = DISABLED
Fri Dec 19 20:42:01 2014 us=544200   bind_defined = DISABLED
Fri Dec 19 20:42:01 2014 us=544200   bind_local = ENABLED
Fri Dec 19 20:42:01 2014 us=544200   connect_retry_seconds = 5
Fri Dec 19 20:42:01 2014 us=544200   connect_timeout = 10
Fri Dec 19 20:42:01 2014 us=544200 NOTE: --mute triggered...
Fri Dec 19 20:42:01 2014 us=544200 278 variation(s) on previous 20 message(s) suppressed by --mute
Fri Dec 19 20:42:01 2014 us=544200 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec  1 2014
Fri Dec 19 20:42:01 2014 us=544200 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Enter Management Password:
Fri Dec 19 20:42:01 2014 us=545200 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Fri Dec 19 20:42:01 2014 us=545200 Need hold release from management interface, waiting...
Fri Dec 19 20:42:02 2014 us=6200 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Fri Dec 19 20:42:02 2014 us=107200 MANAGEMENT: CMD 'state on'
Fri Dec 19 20:42:02 2014 us=107200 MANAGEMENT: CMD 'log all on'
Fri Dec 19 20:42:02 2014 us=182200 MANAGEMENT: CMD 'hold off'
Fri Dec 19 20:42:02 2014 us=184200 MANAGEMENT: CMD 'hold release'
Fri Dec 19 20:42:02 2014 us=185200 WARNING: --ifconfig-pool-persist will not work with --duplicate-cn
Fri Dec 19 20:42:02 2014 us=187200 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Fri Dec 19 20:42:02 2014 us=426200 Diffie-Hellman initialized with 4096 bit key
Fri Dec 19 20:42:02 2014 us=427200 TLS-Auth MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Dec 19 20:42:02 2014 us=427200 Socket Buffers: R=[8192->8192] S=[8192->8192]
Fri Dec 19 20:42:02 2014 us=429200 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Dec 19 20:42:02 2014 us=429200 MANAGEMENT: >STATE:1419014522,ASSIGN_IP,,10.8.0.1,
Fri Dec 19 20:42:02 2014 us=429200 open_tun, tt->ipv6=0
Fri Dec 19 20:42:02 2014 us=430200 TAP-WIN32 device [tap01] opened: \\.\Global\{81306876-114F-41FD-9DE7-3A47479CEA3A}.tap
Fri Dec 19 20:42:02 2014 us=430200 TAP-Windows Driver Version 9.21 
Fri Dec 19 20:42:02 2014 us=430200 TAP-Windows MTU=1500
Fri Dec 19 20:42:02 2014 us=431200 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.1/255.255.255.252 on interface {81306876-114F-41FD-9DE7-3A47479CEA3A} [DHCP-serv: 10.8.0.2, lease-time: 31536000]
Fri Dec 19 20:42:02 2014 us=431200 Sleeping for 2 seconds...
Fri Dec 19 20:42:04 2014 us=431200 NOTE: FlushIpNetTable failed on interface [15] {81306876-114F-41FD-9DE7-3A47479CEA3A} (status=1168) : Element not found.  
Fri Dec 19 20:42:04 2014 us=434200 MANAGEMENT: >STATE:1419014524,ADD_ROUTES,,,
Fri Dec 19 20:42:04 2014 us=434200 C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.2
Fri Dec 19 20:42:04 2014 us=434200 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Fri Dec 19 20:42:04 2014 us=484200 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Fri Dec 19 20:42:04 2014 us=484200 UDPv4 link local (bound): [AF_INET]192.168.0.3:51194
Fri Dec 19 20:42:04 2014 us=484200 UDPv4 link remote: [undef]
Fri Dec 19 20:42:04 2014 us=484200 MULTI: multi_init called, r=256 v=256
Fri Dec 19 20:42:04 2014 us=484200 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Fri Dec 19 20:42:04 2014 us=484200 IFCONFIG POOL LIST
Fri Dec 19 20:42:04 2014 us=484200 Initialization Sequence Completed
Fri Dec 19 20:42:04 2014 us=484200 MANAGEMENT: >STATE:1419014524,CONNECTED,SUCCESS,10.8.0.1,
---------------------------------------------------------------------------------------

maikcat

can you ping from client both vpn & lan ip addresses of server?
a tracert 8.8.8.8 shows what?
you are pushing dns 10.8.0.1 , do you run dns service on your win7?

Michael.

moni

Sorry for the late answer, and Merry Christmas to you all!

maikcat wrotecan you ping from client both vpn & lan ip addresses of server?

No, only vpn ip's. All other ping outside cannot be completed.

maikcat wrotea tracert 8.8.8.8 shows what?

It is even resolving...

C:\Users\moni>tracert 8.8.8.8

Tracing route to google-public-dns-a.google.com [8.8.8.8]
over a maximum of 30 hops:

1 * * * Request timed out.
2 * * * Request timed out.
3 * *

maikcat wroteyou are pushing dns 10.8.0.1 , do you run dns service on your win7?

Yes, Bind9

Traffic

moni wrotemaikcat wrote:
can you ping from client both vpn & lan ip addresses of server?

No, only vpn ip's. All other ping outside cannot be completed.

So the VPN is successfully connected as you can ping 10.8.0.1 .. but you cannot ping 192.168.0.3

As your client uses --remote 192.168.0.3 51194 your client is in the same LAN ..
the client should be able to ping 192.168.0.3 with or without a VPN ?

Please start the VPN and post results of ipconfig /all from server and client.