[deleted]
Hello,
I recently configured OpenVPN in a server role on Windows 7 Professional. My configuration for the server side is located below. Essentially, the network has been greatly reduced in complexity to help isolate issues and is configured in this manner:
ASUS N66U: Primary Router - Has Public WAN IP and port forwarding is properly enabled to route UDP/1194 traffic to 192.168.0.109 which is the private IP of the OpenVPN server. The ASUS on the LAN side has 192.168.0.254 for it's own IP.
HP DC7900: Standalone OpenVPN Server running on Windows 7 Pro - it has 1 NIC and has it's IP address configured as 192.168.0.109. The Windows Firewall has been disabled as well.
As mentioned above, I can connect to the OpenVPN server fine both internally and externally on a different ISP with no problem. Unfortunately that's all I can do - I can't ping or access the internet or ping the ASUS router on the LAN.
Based on other posts, I performed these steps as well on the server but nothing changed:
Navigate to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\Tcpip\Parameters\IPEnableRouter setting, right click and select Modify. Change 0 to 1 and exit the editor.
The OpenVPN server needs to be configured to use tun for various reasons and to push other networks.
Server Config:
server 10.8.0.0 255.255.255.0
proto udp
port 1194
dev tun
cipher BF-CBC
comp-lzo adaptive
keepalive 15 60
verb 3
push "route 192.168.0.0 255.255.255.0"
client-config-dir ccd
client-to-client
#duplicate-cn
route 192.168.3.0 255.255.255.0
push "route 192.168.3.0 255.255.255.0"
route 192.168.4.0 255.255.255.0
push "route 192.168.4.0 255.255.255.0"
tls-auth static.key 0
ca ca.crt
dh dh.pem
cert server.crt
key server.key
status-version 2
status status
OpenVPN Log:
Sat Jan 03 10:17:47 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 1 2014
Sat Jan 03 10:17:47 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Enter Management Password:
Sat Jan 03 10:17:47 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sat Jan 03 10:17:47 2015 Need hold release from management interface, waiting...
Sat Jan 03 10:17:47 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sat Jan 03 10:17:47 2015 MANAGEMENT: CMD 'state on'
Sat Jan 03 10:17:47 2015 MANAGEMENT: CMD 'log all on'
Sat Jan 03 10:17:47 2015 MANAGEMENT: CMD 'hold off'
Sat Jan 03 10:17:47 2015 MANAGEMENT: CMD 'hold release'
Sat Jan 03 10:17:47 2015 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Sat Jan 03 10:17:47 2015 Diffie-Hellman initialized with 1024 bit key
Sat Jan 03 10:17:50 2015 MANAGEMENT: CMD 'password [...]'
Sat Jan 03 10:17:50 2015 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sat Jan 03 10:17:50 2015 Control Channel Authentication: using 'static.key' as a OpenVPN static key file
Sat Jan 03 10:17:50 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Jan 03 10:17:50 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Jan 03 10:17:50 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sat Jan 03 10:17:50 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Jan 03 10:17:50 2015 MANAGEMENT: >STATE:1420301870,ASSIGN_IP,,10.8.0.1,
Sat Jan 03 10:17:50 2015 open_tun, tt->ipv6=0
Sat Jan 03 10:17:50 2015 TAP-WIN32 device [MyTAP] opened: \\.\Global\{3FACE7B4-F928-4D58-BB7D-91402633DAAC}.tap
Sat Jan 03 10:17:50 2015 TAP-Windows Driver Version 9.21
Sat Jan 03 10:17:50 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.1/255.255.255.252 on interface {3FACE7B4-F928-4D58-BB7D-91402633DAAC} [DHCP-serv: 10.8.0.2, lease-time: 31536000]
Sat Jan 03 10:17:50 2015 Sleeping for 10 seconds...
Sat Jan 03 10:18:00 2015 Successful ARP Flush on interface [14] {3FACE7B4-F928-4D58-BB7D-91402633DAAC}
Sat Jan 03 10:18:00 2015 MANAGEMENT: >STATE:1420301880,ADD_ROUTES,,,
Sat Jan 03 10:18:00 2015 C:\Windows\system32\route.exe ADD 192.168.3.0 MASK 255.255.255.0 10.8.0.2
Sat Jan 03 10:18:00 2015 Warning: route gateway is not reachable on any active network adapters: 10.8.0.2
Sat Jan 03 10:18:00 2015 Route addition via IPAPI failed [adaptive]
Sat Jan 03 10:18:00 2015 Route addition fallback to route.exe
Sat Jan 03 10:18:00 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Sat Jan 03 10:18:01 2015 C:\Windows\system32\route.exe ADD 192.168.4.0 MASK 255.255.255.0 10.8.0.2
Sat Jan 03 10:18:01 2015 Warning: route gateway is not reachable on any active network adapters: 10.8.0.2
Sat Jan 03 10:18:01 2015 Route addition via IPAPI failed [adaptive]
Sat Jan 03 10:18:01 2015 Route addition fallback to route.exe
Sat Jan 03 10:18:01 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Sat Jan 03 10:18:01 2015 C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.2
Sat Jan 03 10:18:01 2015 Warning: route gateway is not reachable on any active network adapters: 10.8.0.2
Sat Jan 03 10:18:01 2015 Route addition via IPAPI failed [adaptive]
Sat Jan 03 10:18:01 2015 Route addition fallback to route.exe
Sat Jan 03 10:18:01 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Sat Jan 03 10:18:01 2015 UDPv4 link local (bound): [undef]
Sat Jan 03 10:18:01 2015 UDPv4 link remote: [undef]
Sat Jan 03 10:18:01 2015 MULTI: multi_init called, r=256 v=256
Sat Jan 03 10:18:01 2015 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Sat Jan 03 10:18:01 2015 Initialization Sequence Completed
Sat Jan 03 10:18:01 2015 MANAGEMENT: >STATE:1420301881,CONNECTED,SUCCESS,10.8.0.1,
Any ideas on what's occurring?
Thanks!
[deleted]
I found a post from Google shortly after posting my question and it advised adding the following to my server config:
route-delay 5
route-method exe
ip-win32 netsh
After restarting OpenVPN (after making the configuration file changes) all is working fine now. Is anyone familiar with these 3 commands and what they do and how it resolved the issue?
Thanks
Server Log File after configuration change:
Sat Jan 03 10:38:17 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Enter Management Password:
Sat Jan 03 10:38:17 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sat Jan 03 10:38:17 2015 Need hold release from management interface, waiting...
Sat Jan 03 10:38:17 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sat Jan 03 10:38:17 2015 MANAGEMENT: CMD 'state on'
Sat Jan 03 10:38:17 2015 MANAGEMENT: CMD 'log all on'
Sat Jan 03 10:38:17 2015 MANAGEMENT: CMD 'hold off'
Sat Jan 03 10:38:17 2015 MANAGEMENT: CMD 'hold release'
Sat Jan 03 10:38:17 2015 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Sat Jan 03 10:38:17 2015 Diffie-Hellman initialized with 1024 bit key
Sat Jan 03 10:38:22 2015 MANAGEMENT: CMD 'password [...]'
Sat Jan 03 10:38:22 2015 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sat Jan 03 10:38:22 2015 Control Channel Authentication: using 'static.key' as a OpenVPN static key file
Sat Jan 03 10:38:22 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Jan 03 10:38:22 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Jan 03 10:38:22 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sat Jan 03 10:38:22 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Jan 03 10:38:22 2015 MANAGEMENT: >STATE:1420303102,ASSIGN_IP,,10.8.0.1,
Sat Jan 03 10:38:22 2015 open_tun, tt->ipv6=0
Sat Jan 03 10:38:22 2015 TAP-WIN32 device [MyTAP] opened: \\.\Global\{3FACE7B4-F928-4D58-BB7D-91402633DAAC}.tap
Sat Jan 03 10:38:22 2015 TAP-Windows Driver Version 9.21
Sat Jan 03 10:38:23 2015 NETSH: C:\Windows\system32\netsh.exe interface ip set address MyTAP dhcp
Sat Jan 03 10:38:23 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.1/255.255.255.252 on interface {3FACE7B4-F928-4D58-BB7D-91402633DAAC} [DHCP-serv: 10.8.0.2, lease-time: 31536000]
Sat Jan 03 10:38:23 2015 Sleeping for 5 seconds...
Sat Jan 03 10:38:28 2015 Successful ARP Flush on interface [14] {3FACE7B4-F928-4D58-BB7D-91402633DAAC}
Sat Jan 03 10:38:28 2015 MANAGEMENT: >STATE:1420303108,ADD_ROUTES,,,
Sat Jan 03 10:38:28 2015 C:\Windows\system32\route.exe ADD 192.168.3.0 MASK 255.255.255.0 10.8.0.2
Sat Jan 03 10:38:28 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Sat Jan 03 10:38:28 2015 C:\Windows\system32\route.exe ADD 192.168.4.0 MASK 255.255.255.0 10.8.0.2
Sat Jan 03 10:38:28 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Sat Jan 03 10:38:28 2015 C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.2
Sat Jan 03 10:38:28 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Sat Jan 03 10:38:28 2015 UDPv4 link local (bound): [undef]
Sat Jan 03 10:38:28 2015 UDPv4 link remote: [undef]
Sat Jan 03 10:38:28 2015 MULTI: multi_init called, r=256 v=256
Sat Jan 03 10:38:28 2015 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Sat Jan 03 10:38:28 2015 Initialization Sequence Completed
Sat Jan 03 10:38:28 2015 MANAGEMENT: >STATE:1420303108,CONNECTED,SUCCESS,10.8.0.1,
Sat Jan 03 10:38:28 2015 IP packet with unknown IP version=15 seen
