[Solved]OpenVPN client connects to server but no internet

[deleted]

Good evening,

I need a little help here. Been at this for the past 2 days and tried just about anything i could... but still cant figure this out for the life of me. Basically the issue that i'am able to connect to my server (ubuntu 14.04) using my client (Win 7) and get ip adress 10.8.0.8. But unfortunately i'm then sandboxed within my server with no access to either internet or LAN (cant ping the server either). Any help / input would be greatly appreciated as i'm still a novice to openvpn i have included below my server.conf, client.conf and iptables.

Thank you all in advance for your time and much valued input.

Server.conf

dev tun
proto udp
port 1194
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh1024.pem
user nobody
group nogroup
server 10.8.0.0 255.255.255.0
persist-key
persist-tun
client-to-client
push "route 192.168.0.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
log-append /var/log/openvpn
plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so openvpn
client-cert-not-required
username-as-common-name
management localhost 7505

IP tables

Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpt:openvpn

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- 192.168.0.0/24 anywhere ctstate NEW
ACCEPT all -- 10.8.0.0/24 anywhere ctstate NEW
ACCEPT all -- 10.8.0.0/24 192.168.0.0/24 ctstate NEW

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Client.conf

client
dev tun
proto udp
remote 196.xxx.xxx.xxx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
auth-user-pass
comp-lzo
verb 3

maikcat

is ipforwarding enabled on server?
post the output of
iptables -t nat -L -v
on your openvpn server.

Michael

Traffic

Duplicate post:
https://forums.openvpn.net/topic18033.html

[deleted]

First let me start by thanking both of you for getting back at me so quick. I really appreciate the time and input.

@Traffic Sorry about that... I just guess it was double posted by accident when i tried to clean up the code, and post layout....

@maikcat Ip Forwarding is enabled on the server, and here are my ip tables.

Kernel IP routing table (server)
Destination     Gateway         Genmask         Flags      Metric Ref    Use Iface
default         192.168.1.1     0.0.0.0            UG    0      0        0     eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0      tun0
10.8.0.2        *               255.255.255.255  UH    0      0        0      tun0
192.168.1.0     *               255.255.255.0    U     0      0        0      eth0

I have done some more testing today, i'am still unable to ping the server @ 10.8.0.1 or the gateway at 10.8.0.2, furthermore, my firewall (win 7 client) was disabled during this test to make sure it wasnt causing any issues. Any idea what the issue could be?? all input / ideas on the situation would be greatly appreciated.

maikcat

this is your routing table not the output of the command i requested,

also are you starting openvpn on your 7 using admin rights?

Michael.

[deleted]

Good morining Michael.

the following is the output of the command you requested:

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 9 packets, 628 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 9 packets, 628 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  all  --  any    eth1    192.168.0.0/24       anywhere            
    0     0 MASQUERADE  all  --  any    eth1    10.8.0.0/24          anywhere            
    0     0 MASQUERADE  all  --  any    eth     anywhere             anywhere

Mo.

maikcat

please clarify your network topology,

f.e you are pushing route about 192.168.0.0/24 while your lan is 192.168.1.0/24
also you are NATing traffic from 192.168.0.0/24 (?).

Michael.

[deleted]

And yes i do run my client with admin privileges under windows.

[deleted]

Makes sense, thank you for clearing that up Michael. I just modified LAN params, and retested unfortunately still unable to connect. Please bare with me as i said its my first time with open VPN. Could the problem be from the interfaces used? I had a look at the BridgingAndRouting guide on OpenVPN commmunity. it seems to be correct.

Here is a new list from my iptables and routing:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     udp  --  anywhere             anywhere             udp dpt:openvpn

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  192.168.1.0/24       anywhere             ctstate NEW
ACCEPT     all  --  10.8.0.0/24          anywhere             ctstate NEW
ACCEPT     all  --  10.8.0.0/24          192.168.1.0/24       ctstate NEW

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain PREROUTING (policy ACCEPT 137 packets, 9310 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain INPUT (policy ACCEPT 35 packets, 4020 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 22 packets, 1510 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 22 packets, 1510 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 MASQUERADE  all  --  any    eth1    192.168.1.0/24       anywhere
    0     0 MASQUERADE  all  --  any    eth1    10.8.0.0/24          anywhere
    0     0 MASQUERADE  all  --  any    eth     anywhere             anywhere

Much appreciated.

Mo.

[deleted]

Upon further modifications (changing interface to eth0, as eth1 was not present in my ifconfig). It seems that i'm starting to get some packets going through which wasnt the case using non-existant eth1. :oops: ... Although im making a bit of progress, unfortunately the server still cant connect to the internet.

Output from #iptables -t nat -L -v

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    4   274 MASQUERADE  all  --  any    eth0    192.168.1.0/24       anywhere
    0     0 MASQUERADE  all  --  any    eth0    10.8.0.0/24          anywhere
    0     0 MASQUERADE  all  --  any    eth     anywhere             anywhere

Output from #iptables-save

# Generated by iptables-save v1.4.21 on Fri Jan 30 12:34:00 2015
*nat
:PREROUTING ACCEPT [1:60]
:INPUT ACCEPT [1:60]
:OUTPUT ACCEPT [31:2138]
:POSTROUTING ACCEPT [31:2138]
-A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -o eth -j MASQUERADE
COMMIT
# Completed on Fri Jan 30 12:34:00 2015
# Generated by iptables-save v1.4.21 on Fri Jan 30 12:34:00 2015
*filter
:INPUT ACCEPT [298:15907]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [190:11601]
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.1.0/24 -i eth0 -o eth0 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -i tun0 -o eth0 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -d 192.168.1.0/24 -i tun0 -o eth0 -m conntrack --ctstate NEW -j ACCEPT
COMMIT
# Completed on Fri Jan 30 12:34:00 2015

Output from #ifconfig

eth0      Link encap:Ethernet  HWaddr 00:1e:33:7b:e9:1b
          inet addr:192.168.1.4  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::21e:33ff:fe7b:e91b/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:10585 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6005 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:892118 (892.1 KB)  TX bytes:557751 (557.7 KB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:32 errors:0 dropped:0 overruns:0 frame:0
          TX packets:32 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:2480 (2.4 KB)  TX bytes:2480 (2.4 KB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

Any ideas??

maikcat

lets start all over...

flush *ALL* firewall & NAT rules and add ONLY this

0     0 MASQUERADE  all  --  any    eth0    10.8.0.0/24          anywhere

leave your firewall rules to allow for testing,you review them later.

Michael.

[deleted]

Hello Michael, sorry i've been away for a couple of days; I hope all is well with you.

I've had a chance to modify my config as per your recommendations. Firewall and NAT rules have been flushed (copy preserved for future reference) and only one NAT rule was added.

IPtable now reads

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

And iptables -t nat -L -v

Chain PREROUTING (policy ACCEPT 1 packets, 60 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 1 packets, 60 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 4 packets, 274 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 4 packets, 274 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  all  --  any    eth0    10.8.0.0/24          anywhere

I have re-teseted today with just this single rule. Unfortunately still cant get out to the internet or ping anything other than myself(10.8.0.6).

Hope to hear from you and as always thanks for being so helpful.

maikcat

your openvpns server lan is 192.168.1.0,
what is your clients lan?
can you post your newly used config?
can you post your clients log and output of netstat -nr?

Michael.

[deleted]

Good evening Michael,

My openvpn server LAN ip is not at 192.168.1.0 it is at 192.168.1.5 (behind the home router LAN ip 192.168.1.1.). IP forewarding is enabled on both router and server. I made the following diagram to give you an idea of the type of setup i'm working with.

http://weshare.me/5f6330a7f400529f/network.jpg

My client's LAN is 192.168.43.171 (behind the office router);

No changes have been made to my client config as none were necessary;

Client Log

Wed Feb 04 22:29:57 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec  1 2014
Wed Feb 04 22:29:57 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Enter Management Password:
Wed Feb 04 22:29:57 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Feb 04 22:29:57 2015 Need hold release from management interface, waiting...
Wed Feb 04 22:29:57 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Feb 04 22:29:57 2015 MANAGEMENT: CMD 'state on'
Wed Feb 04 22:29:57 2015 MANAGEMENT: CMD 'log all on'
Wed Feb 04 22:29:57 2015 MANAGEMENT: CMD 'hold off'
Wed Feb 04 22:29:57 2015 MANAGEMENT: CMD 'hold release'
Wed Feb 04 22:30:10 2015 MANAGEMENT: CMD 'username "Auth" "vpn1"'
Wed Feb 04 22:30:10 2015 MANAGEMENT: CMD 'password [...]'
Wed Feb 04 22:30:10 2015 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Feb 04 22:30:10 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Feb 04 22:30:10 2015 UDPv4 link local: [undef]
Wed Feb 04 22:30:10 2015 UDPv4 link remote: [AF_INET]xxx.xxx.xxx.xx:1194
Wed Feb 04 22:30:10 2015 MANAGEMENT: >STATE:1423089010,WAIT,,,
Wed Feb 04 22:30:13 2015 MANAGEMENT: >STATE:1423089013,AUTH,,,
Wed Feb 04 22:30:13 2015 TLS: Initial packet from [AF_INET]xxx.xxx.xxx.xx:1194, sid=3c269222 527accc8
Wed Feb 04 22:30:13 2015 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Feb 04 22:30:23 2015 VERIFY OK: depth=1, CN=IBSVPN
Wed Feb 04 22:30:23 2015 VERIFY OK: depth=0, CN=IBSVPN
Wed Feb 04 22:30:24 2015 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1542', remote='link-mtu 1541'
Wed Feb 04 22:30:24 2015 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Wed Feb 04 22:30:24 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Feb 04 22:30:24 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 04 22:30:24 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Feb 04 22:30:24 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 04 22:30:24 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Feb 04 22:30:24 2015 [IBSVPN] Peer Connection Initiated with [AF_INET]xxx.xxx.xxx.xx:1194
Wed Feb 04 22:30:25 2015 MANAGEMENT: >STATE:1423089025,GET_CONFIG,,,
Wed Feb 04 22:30:26 2015 SENT CONTROL [IBSVPN]: 'PUSH_REQUEST' (status=1)
Wed Feb 04 22:30:27 2015 PUSH: Received control message: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,redirect-gateway def1,dhcp-option DNS 8.8.8.8,route 10.8.0.0 255.255.255.0,topology net30,ifconfig 10.8.0.6 10.8.0.5'
Wed Feb 04 22:30:27 2015 OPTIONS IMPORT: --ifconfig/up options modified
Wed Feb 04 22:30:27 2015 OPTIONS IMPORT: route options modified
Wed Feb 04 22:30:27 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Feb 04 22:30:27 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Feb 04 22:30:27 2015 MANAGEMENT: >STATE:1423089027,ASSIGN_IP,,10.8.0.6,
Wed Feb 04 22:30:27 2015 open_tun, tt->ipv6=0
Wed Feb 04 22:30:27 2015 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{E7C5282C-B97F-4125-B0A3-304AACAE9A5D}.tap
Wed Feb 04 22:30:27 2015 TAP-Windows Driver Version 9.9 
Wed Feb 04 22:30:27 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {E7C5282C-B97F-4125-B0A3-304AACAE9A5D} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Wed Feb 04 22:30:27 2015 Successful ARP Flush on interface [18] {E7C5282C-B97F-4125-B0A3-304AACAE9A5D}
Wed Feb 04 22:30:32 2015 TEST ROUTES: 3/3 succeeded len=2 ret=1 a=0 u/d=up
Wed Feb 04 22:30:32 2015 C:\Windows\system32\route.exe ADD xxx.xxx.xxx.xx MASK 255.255.255.255 192.168.43.1
Wed Feb 04 22:30:32 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Wed Feb 04 22:30:32 2015 Route addition via IPAPI succeeded [adaptive]
Wed Feb 04 22:30:32 2015 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Wed Feb 04 22:30:32 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Wed Feb 04 22:30:32 2015 Route addition via IPAPI succeeded [adaptive]
Wed Feb 04 22:30:32 2015 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Wed Feb 04 22:30:32 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Wed Feb 04 22:30:32 2015 Route addition via IPAPI succeeded [adaptive]
Wed Feb 04 22:30:32 2015 MANAGEMENT: >STATE:1423089032,ADD_ROUTES,,,
Wed Feb 04 22:30:32 2015 C:\Windows\system32\route.exe ADD 192.168.0.0 MASK 255.255.255.0 10.8.0.5
Wed Feb 04 22:30:32 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Wed Feb 04 22:30:32 2015 Route addition via IPAPI succeeded [adaptive]
Wed Feb 04 22:30:32 2015 C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.5
Wed Feb 04 22:30:32 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Wed Feb 04 22:30:32 2015 Route addition via IPAPI succeeded [adaptive]
Wed Feb 04 22:30:32 2015 Initialization Sequence Completed
Wed Feb 04 22:30:32 2015 MANAGEMENT: >STATE:1423089032,CONNECTED,SUCCESS,10.8.0.6,xxx.xxx.xxx.xx
Wed Feb 04 22:32:28 2015 [IBSVPN] Inactivity timeout (--ping-restart), restarting
Wed Feb 04 22:32:28 2015 SIGUSR1[soft,ping-restart] received, process restarting
Wed Feb 04 22:32:28 2015 MANAGEMENT: >STATE:1423089148,RECONNECTING,ping-restart,,
Wed Feb 04 22:32:28 2015 Restart pause, 2 second(s)
Wed Feb 04 22:32:30 2015 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Feb 04 22:32:30 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Feb 04 22:32:30 2015 UDPv4 link local: [undef]
Wed Feb 04 22:32:30 2015 UDPv4 link remote: [AF_INET]xxx.xxx.xxx.xx:1194
Wed Feb 04 22:32:30 2015 MANAGEMENT: >STATE:1423089150,WAIT,,,
Wed Feb 04 22:32:33 2015 MANAGEMENT: >STATE:1423089153,AUTH,,,
Wed Feb 04 22:32:33 2015 TLS: Initial packet from [AF_INET]xxx.xxx.xxx.xx:1194, sid=cdfae45b ce8d1f33
Wed Feb 04 22:32:34 2015 VERIFY OK: depth=1, CN=IBSVPN
Wed Feb 04 22:32:34 2015 VERIFY OK: depth=0, CN=IBSVPN
Wed Feb 04 22:32:35 2015 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1542', remote='link-mtu 1541'
Wed Feb 04 22:32:35 2015 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Wed Feb 04 22:32:35 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Feb 04 22:32:35 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 04 22:32:35 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Feb 04 22:32:35 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 04 22:32:35 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Feb 04 22:32:35 2015 [IBSVPN] Peer Connection Initiated with [AF_INET]xxx.xxx.xxx.xx:1194
Wed Feb 04 22:32:36 2015 MANAGEMENT: >STATE:1423089156,GET_CONFIG,,,
Wed Feb 04 22:32:37 2015 SENT CONTROL [IBSVPN]: 'PUSH_REQUEST' (status=1)
Wed Feb 04 22:32:41 2015 PUSH: Received control message: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,redirect-gateway def1,dhcp-option DNS 8.8.8.8,route 10.8.0.0 255.255.255.0,topology net30,ifconfig 10.8.0.6 10.8.0.5'
Wed Feb 04 22:32:41 2015 OPTIONS IMPORT: --ifconfig/up options modified
Wed Feb 04 22:32:41 2015 OPTIONS IMPORT: route options modified
Wed Feb 04 22:32:41 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Feb 04 22:32:41 2015 Preserving previous TUN/TAP instance: Local Area Connection 2
Wed Feb 04 22:32:41 2015 Initialization Sequence Completed
Wed Feb 04 22:32:41 2015 MANAGEMENT: >STATE:1423089161,CONNECTED,SUCCESS,10.8.0.6,xxx.xxx.xxx.xx

Ouput of netstat -nr

C:\Users\ClientPC>netstat -nr
===========================================================================
Liste d'Interfaces
 18...00 ff e7 c5 28 2c ......TAP-Windows Adapter V9
 16...72 b7 c3 5b 05 47 ......Microsoft Virtual WiFi Miniport Adapter
 14...50 b7 c3 5b 05 47 ......Atheros AR9485WB-EG Wireless Network Adapter
 13...50 b7 c3 74 c3 9e ......Realtek PCIe GBE Family Controller
 12...50 b7 c3 5b 05 48 ......Périphérique Bluetooth (réseau personnel)
  1...........................Software Loopback Interface 1
 20...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
 19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
 22...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #5
===========================================================================

IPv4 Table de routage
===========================================================================
Itinéraires actifs :
Destination réseau    Masque réseau  Adr. passerelle   Adr. interface Métrique
          0.0.0.0          0.0.0.0     192.168.43.1   192.168.43.171     25
          0.0.0.0        128.0.0.0         10.8.0.5         10.8.0.6     30
         10.8.0.0    255.255.255.0         10.8.0.5         10.8.0.6     30
         10.8.0.4  255.255.255.252         On-link          10.8.0.6    286
         10.8.0.6  255.255.255.255         On-link          10.8.0.6    286
         10.8.0.7  255.255.255.255         On-link          10.8.0.6    286
    xxx.xxx.xx.xx  255.255.255.255     192.168.43.1   192.168.43.171     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        128.0.0.0        128.0.0.0         10.8.0.5         10.8.0.6     30
      192.168.0.0    255.255.255.0         10.8.0.5         10.8.0.6     30
     192.168.43.0    255.255.255.0         On-link    192.168.43.171    281
   192.168.43.171  255.255.255.255         On-link    192.168.43.171    281
   192.168.43.255  255.255.255.255         On-link    192.168.43.171    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link          10.8.0.6    286
        224.0.0.0        240.0.0.0         On-link    192.168.43.171    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link          10.8.0.6    286
  255.255.255.255  255.255.255.255         On-link    192.168.43.171    281
===========================================================================
Itinéraires persistants :
  Aucun

IPv6 Table de routage
===========================================================================
Itinéraires actifs :
 If Metric Network Destination      Gateway
  1    306 ::1/128                  On-link
 18    286 fe80::/64                On-link
 14    281 fe80::/64                On-link
 18    286 fe80::ac1f:4026:3a8a:2370/128
                                    On-link
 14    281 fe80::e105:d75c:571b:ea9d/128
                                    On-link
  1    306 ff00::/8                 On-link
 18    286 ff00::/8                 On-link
 14    281 ff00::/8                 On-link
===========================================================================
Itinéraires persistants :
  Aucun

Thank you Michael i appreciate the effort.
Mo.

Traffic

maikcat wroteyour openvpns server lan is 192.168.1.0,

rahalm45 wroteMy openvpn server LAN ip is not at 192.168.1.0 it is at 192.168.1.5 (behind the home router LAN ip 192.168.1.1.).

:geek:

maikcat wrotewhat is your clients lan?

rahalm45 wroteMy client's LAN is 192.168.43.171 (behind the office router);

No changes have been made to my client config as none were necessary;

rahalm45 wroteI've had a chance to modify my config as per your recommendations. Firewall and NAT rules have been flushed (copy preserved for future reference) and only one NAT rule was added.

maikcat wrotecan you post your newly used config?

Updated config files are required .. try it yourself. :mrgreen:

maikcat wrotecan you post your clients log and output of netstat -nr?

rahalm45 wroteClient Log

Code:
Wed Feb 04 22:29:57 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 1 2014
Wed Feb 04 22:29:57 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
...
Wed Feb 04 22:30:24 2015 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1542', remote='link-mtu 1541'
Wed Feb 04 22:30:24 2015 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
...
Wed Feb 04 22:30:27 2015 PUSH: Received control message: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,redirect-gateway def1,dhcp-option DNS 8.8.8.8,route 10.8.0.0 255.255.255.0,topology net30,ifconfig 10.8.0.6 10.8.0.5'

:roll:

rahalm45 wrote

output of netstat -nr
      192.168.0.0    255.255.255.0         10.8.0.5         10.8.0.6     30
     192.168.43.0    255.255.255.0         On-link    192.168.43.171    281

192.168.0.0

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

[deleted]

@Traffic
Good evening, thank you for your input.

Could you be a little bit clearer, i'am confused as to which element of my in config file should be edit as no where in the said config file does it mention LAN ip 192.168.0.0? i checked both server and client configs.

Mo.

Traffic

rahalm45 wrotei'am confused as to which element of my in config file should be edit as no where in the said config file does it mention LAN ip 192.168.0.0?

:shock:

rahalm45 wroteWed Feb 04 22:30:27 2015 PUSH: Received control message: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,redirect-gateway def1,dhcp-option DNS 8.8.8.8,route 10.8.0.0 255.255.255.0,topology net30,ifconfig 10.8.0.6 10.8.0.5'

It is your log file ..... posted just yesterday

rahalm45 wrotei checked both server and client configs

are you sure .. i guess you could be FL :ugeek: king in the wrong file

[deleted]

@Traffic

Ok i double checked to make sure, and sure enough push route was there in the server.conf. Somehow previously when i ran a "find 192.168.0.0" it didnt locate this entry...

I apologize for that. Consequently I have modified the pushroute in the server.conf to match my LAN.

Server.conf changes:

dev tun
proto udp
port 1194
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh1024.pem
user nobody
group nogroup
server 10.8.0.0 255.255.255.0
persist-key
persist-tun
client-to-client
push "route 192.168.1.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
log-append /var/log/openvpn
plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so openvpn
client-cert-not-required
username-as-common-name
management localhost 7505

Client Log outputs:

Thu Feb 05 17:44:45 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec  1 2014
Thu Feb 05 17:44:45 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Enter Management Password:
Thu Feb 05 17:44:45 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Feb 05 17:44:45 2015 Need hold release from management interface, waiting...
Thu Feb 05 17:44:46 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Feb 05 17:44:46 2015 MANAGEMENT: CMD 'state on'
Thu Feb 05 17:44:46 2015 MANAGEMENT: CMD 'log all on'
Thu Feb 05 17:44:46 2015 MANAGEMENT: CMD 'hold off'
Thu Feb 05 17:44:46 2015 MANAGEMENT: CMD 'hold release'
Thu Feb 05 17:44:58 2015 MANAGEMENT: CMD 'username "Auth" "vpn1"'
Thu Feb 05 17:44:58 2015 MANAGEMENT: CMD 'password [...]'
Thu Feb 05 17:44:58 2015 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu Feb 05 17:44:59 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Feb 05 17:44:59 2015 UDPv4 link local: [undef]
Thu Feb 05 17:44:59 2015 UDPv4 link remote: [AF_INET]xx.xxx.xx.xxx:1194
Thu Feb 05 17:44:59 2015 MANAGEMENT: >STATE:1423158299,WAIT,,,
Thu Feb 05 17:45:02 2015 MANAGEMENT: >STATE:1423158302,AUTH,,,
Thu Feb 05 17:45:02 2015 TLS: Initial packet from [AF_INET]xx.xxx.xx.xxx:1194, sid=f0075aef b56be02c
Thu Feb 05 17:45:02 2015 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Feb 05 17:45:03 2015 VERIFY OK: depth=1, CN=IBSVPN
Thu Feb 05 17:45:03 2015 VERIFY OK: depth=0, CN=IBSVPN
Thu Feb 05 17:45:04 2015 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1542', remote='link-mtu 1541'
Thu Feb 05 17:45:04 2015 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Thu Feb 05 17:45:04 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 05 17:45:04 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 05 17:45:04 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 05 17:45:04 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 05 17:45:04 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu Feb 05 17:45:04 2015 [IBSVPN] Peer Connection Initiated with [AF_INET]xx.xxx.xx.xxx:1194
Thu Feb 05 17:45:05 2015 MANAGEMENT: >STATE:1423158305,GET_CONFIG,,,
Thu Feb 05 17:45:06 2015 SENT CONTROL [IBSVPN]: 'PUSH_REQUEST' (status=1)
Thu Feb 05 17:45:07 2015 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,redirect-gateway def1,dhcp-option DNS 8.8.8.8,route 10.8.0.0 255.255.255.0,topology net30,ifconfig 10.8.0.6 10.8.0.5'
Thu Feb 05 17:45:07 2015 OPTIONS IMPORT: --ifconfig/up options modified
Thu Feb 05 17:45:07 2015 OPTIONS IMPORT: route options modified
Thu Feb 05 17:45:07 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Feb 05 17:45:08 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Feb 05 17:45:08 2015 MANAGEMENT: >STATE:1423158308,ASSIGN_IP,,10.8.0.6,
Thu Feb 05 17:45:08 2015 open_tun, tt->ipv6=0
Thu Feb 05 17:45:08 2015 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{E7C5282C-B97F-4125-B0A3-304AACAE9A5D}.tap
Thu Feb 05 17:45:08 2015 TAP-Windows Driver Version 9.9 
Thu Feb 05 17:45:08 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {E7C5282C-B97F-4125-B0A3-304AACAE9A5D} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Thu Feb 05 17:45:08 2015 Successful ARP Flush on interface [18] {E7C5282C-B97F-4125-B0A3-304AACAE9A5D}
Thu Feb 05 17:45:13 2015 TEST ROUTES: 3/3 succeeded len=2 ret=1 a=0 u/d=up
Thu Feb 05 17:45:13 2015 C:\Windows\system32\route.exe ADD xx.xxx.xx.xxx MASK 255.255.255.255 192.168.43.1
Thu Feb 05 17:45:13 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Thu Feb 05 17:45:13 2015 Route addition via IPAPI succeeded [adaptive]
Thu Feb 05 17:45:13 2015 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Thu Feb 05 17:45:13 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 05 17:45:13 2015 Route addition via IPAPI succeeded [adaptive]
Thu Feb 05 17:45:13 2015 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Thu Feb 05 17:45:13 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 05 17:45:13 2015 Route addition via IPAPI succeeded [adaptive]
Thu Feb 05 17:45:13 2015 MANAGEMENT: >STATE:1423158313,ADD_ROUTES,,,
Thu Feb 05 17:45:13 2015 C:\Windows\system32\route.exe ADD 192.168.1.0 MASK 255.255.255.0 10.8.0.5
Thu Feb 05 17:45:13 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 05 17:45:13 2015 Route addition via IPAPI succeeded [adaptive]
Thu Feb 05 17:45:13 2015 C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.5
Thu Feb 05 17:45:13 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 05 17:45:13 2015 Route addition via IPAPI succeeded [adaptive]
Thu Feb 05 17:45:13 2015 Initialization Sequence Completed
Thu Feb 05 17:45:13 2015 MANAGEMENT: >STATE:1423158313,CONNECTED,SUCCESS,10.8.0.6,xx.xxx.xx.xxx
Thu Feb 05 17:47:07 2015 [IBSVPN] Inactivity timeout (--ping-restart), restarting
Thu Feb 05 17:47:07 2015 SIGUSR1[soft,ping-restart] received, process restarting
Thu Feb 05 17:47:07 2015 MANAGEMENT: >STATE:1423158427,RECONNECTING,ping-restart,,
Thu Feb 05 17:47:07 2015 Restart pause, 2 second(s)
Thu Feb 05 17:47:09 2015 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu Feb 05 17:47:09 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Feb 05 17:47:09 2015 UDPv4 link local: [undef]
Thu Feb 05 17:47:09 2015 UDPv4 link remote: [AF_INET]xx.xxx.xx.xxx:1194
Thu Feb 05 17:47:09 2015 MANAGEMENT: >STATE:1423158429,WAIT,,,
Thu Feb 05 17:47:11 2015 MANAGEMENT: >STATE:1423158431,AUTH,,,
Thu Feb 05 17:47:11 2015 TLS: Initial packet from [AF_INET]xx.xxx.xx.xxx:1194, sid=74fcb674 359a0190
Thu Feb 05 17:47:13 2015 VERIFY OK: depth=1, CN=IBSVPN
Thu Feb 05 17:47:13 2015 VERIFY OK: depth=0, CN=IBSVPN
Thu Feb 05 17:47:13 2015 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1542', remote='link-mtu 1541'
Thu Feb 05 17:47:13 2015 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Thu Feb 05 17:47:13 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 05 17:47:13 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 05 17:47:13 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 05 17:47:13 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 05 17:47:13 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu Feb 05 17:47:13 2015 [IBSVPN] Peer Connection Initiated with [AF_INET]xx.xxx.xx.xxx:1194
Thu Feb 05 17:47:14 2015 MANAGEMENT: >STATE:1423158434,GET_CONFIG,,,
Thu Feb 05 17:47:15 2015 SENT CONTROL [IBSVPN]: 'PUSH_REQUEST' (status=1)
Thu Feb 05 17:47:16 2015 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,redirect-gateway def1,dhcp-option DNS 8.8.8.8,route 10.8.0.0 255.255.255.0,topology net30,ifconfig 10.8.0.6 10.8.0.5'
Thu Feb 05 17:47:16 2015 OPTIONS IMPORT: --ifconfig/up options modified
Thu Feb 05 17:47:16 2015 OPTIONS IMPORT: route options modified
Thu Feb 05 17:47:16 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Feb 05 17:47:16 2015 Preserving previous TUN/TAP instance: Local Area Connection 2
Thu Feb 05 17:47:16 2015 Initialization Sequence Completed
Thu Feb 05 17:47:16 2015 MANAGEMENT: >STATE:1423158436,CONNECTED,SUCCESS,10.8.0.6,xx.xxx.xx.xxx

Retested tried to ping the server or anything really on 10.8.0.x nothing...
Any input would be much appreciated.

Mo.

maikcat

Thu Feb 05 17:47:13 2015 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'

add or remove lzo from BOTH configs.

Michael.

[deleted]

@Michael Success!!! You are like the VPN whisperer! 😃 Thnx alot for being so patient throughout this whole process. I can honestly say i've learned quite a bit from the few exchanges we've had.

I owe you a solid one, listen i've got an internet marketing company doing lots of stuff with SEO, webdesign, lead generation, email marketing... If you ever need anything along those lines don't hesitate to PM me, it would be my pleasure to return the favor in anyway i can.

Mo.

PS: @Traffic Thank you as well for your input.