Hello, Here is my set-up: Server installed on openwrt, nothing very special ... The version is "[b]openvpn-openssl - 2.3.2-3[/b]" The tun0 address is 10.8.0.1 [code]tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255 [/code] [code]port 1194 proto udp dev tun ca /etc/openvpn/ca.crt cert /etc/openvpn/homeserver.crt key /etc/openvpn/homeserver.key # This file should be kept secret dh /etc/openvpn/dh2048.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist /tmp/ipp.txt client-config-dir ccd route 10.8.0.0 255.255.255.0 route 10.8.1.0 255.255.255.0 keepalive 10 120 comp-lzo persist-key persist-tun status /tmp/openvpn-status.log verb 3 [/code] I have four client, the android clients work like a charm. Linux clients work like a charm. But the windows client didn't work :( It connects, assign an ip (10.8.0.10), i get 10.8.0.9 as gw -> 10.8.0.9 is not pingable if i add a route to 10.8.0.1 via 10.8.0.9, 10.8.0.1 is also not pingable [code]client dev tun proto udp remote my.server.fqdn 1194 resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert client7.crt key client7.key remote-cert-tls server comp-lzo verb 3 route-method exe route-delay 2 route 0.0.0.0 0.0.0.0 vpn_gateway[/code] any idea ? Regards.

are you running your win client with admin rights? Michael.

Hello, Yess!! of course, the client is running in admin mode. Only the local assigned ip is pingable, not the gateway regards.

please post: your client log output of netstat -nr on your client before & after openvpn is up. Michael.

[quote="feeling"]Only the local assigned ip is pingable, not the gateway[/quote]Note: With [b]--topology net30[/b] the gateway address in your case:[quote="feeling"]assign an ip (10.8.0.10), i get 10.8.0.9 as gw -> [u]10.8.0.9 is not pingable[/u][/quote]This is correct function .. the gateway is not pingable by design. Instead [b]ping 10.8.0.1[/b] .. the server address.

Hello , Before eveything, thanx for your answers !!! Here is my routing table before connecting OPENVPN [code]C:\>netstat -nr =========================================================================== Interface List 25...00 ff 1a 39 xx xx ......TAP-Windows Adapter V9 19...8c bf 9d 50 xx xx ......Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card 6...e8 b1 fc 23 xx xx ......Microsoft Wi-Fi Direct Virtual Adapter 5...e8 b1 fc 23 xx xx ......Intel(R) Dual Band Wireless-AC 7260 4...e8 b1 fc 23 xx xx ......Bluetooth Device (Personal Area Network) 1...........................Software Loopback Interface 1 7...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter 8...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface =========================================================================== IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 10.32.253.1 10.32.253.174 25 10.32.253.0 255.255.255.0 On-link 10.32.253.174 281 10.32.253.174 255.255.255.255 On-link 10.32.253.174 281 10.32.253.255 255.255.255.255 On-link 10.32.253.174 281 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 10.32.253.174 281 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 10.32.253.174 281 =========================================================================== Persistent Routes: None [/code] After I connect openvpn, I get two default route (Ugly I know, but the 10.8.0.1 should ping and didn't ping) [code]C:\>netstat -nr =========================================================================== Interface List 25...00 ff 1a 39 xx xx ......TAP-Windows Adapter V9 19...8c bf 9d 50 xx xx ......Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband 6...e8 b1 fc 23 xx xx ......Microsoft Wi-Fi Direct Virtual Adapter 5...e8 b1 fc 23 xx xx ......Intel(R) Dual Band Wireless-AC 7260 4...e8 b1 fc 23 xx xx ......Bluetooth Device (Personal Area Network) 1...........................Software Loopback Interface 1 7...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter 8...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface 9...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2 =========================================================================== IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 10.32.253.1 10.32.253.174 25 0.0.0.0 0.0.0.0 10.8.0.9 10.8.0.10 21 10.8.0.1 255.255.255.255 10.8.0.9 10.8.0.10 21 10.8.0.8 255.255.255.252 On-link 10.8.0.10 276 10.8.0.10 255.255.255.255 On-link 10.8.0.10 276 10.8.0.11 255.255.255.255 On-link 10.8.0.10 276 10.32.253.0 255.255.255.0 On-link 10.32.253.174 281 10.32.253.174 255.255.255.255 On-link 10.32.253.174 281 10.32.253.255 255.255.255.255 On-link 10.32.253.174 281 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 10.8.0.10 276 224.0.0.0 240.0.0.0 On-link 10.32.253.174 281 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 10.8.0.10 276 255.255.255.255 255.255.255.255 On-link 10.32.253.174 281 =========================================================================== Persistent Routes: None[/code] So, I delete the 2 default route ( route delete 0.0.0.0 ) and add by the hand the correct route ( default 0.0.0.0 netmask 0.0.0.0 via 10.8.0.9 ) I get now [code]C:\>route add 0.0.0.0 mask 0.0.0.0 10.8.0.9 OK! C:\>route print -4 IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 10.8.0.9 10.8.0.10 21 10.8.0.1 255.255.255.255 10.8.0.9 10.8.0.10 21 10.8.0.8 255.255.255.252 On-link 10.8.0.10 276 10.8.0.10 255.255.255.255 On-link 10.8.0.10 276 10.8.0.11 255.255.255.255 On-link 10.8.0.10 276 10.32.253.0 255.255.255.0 On-link 10.32.253.174 281 10.32.253.174 255.255.255.255 On-link 10.32.253.174 281 10.32.253.255 255.255.255.255 On-link 10.32.253.174 281 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 10.8.0.10 276 224.0.0.0 240.0.0.0 On-link 10.32.253.174 281 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 10.8.0.10 276 255.255.255.255 255.255.255.255 On-link 10.32.253.174 281 =========================================================================== Persistent Routes: None C:\>ping 10.8.0.1 Pinging 10.8.0.1 with 32 bytes of data: Request timed out. Ping statistics for 10.8.0.1: Packets: Sent = 1, Received = 0, Lost = 1 (100% loss), Control-C ^C C:\>ping 10.8.0.9 Pinging 10.8.0.9 with 32 bytes of data: Control-C ^C C:\>[/code] Edit: and the client side log : [code]Mon Feb 02 16:08:24 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 1 2014 Mon Feb 02 16:08:24 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08 Mon Feb 02 16:08:24 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340 Mon Feb 02 16:08:24 2015 Need hold release from management interface, waiting... Mon Feb 02 16:08:24 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340 Mon Feb 02 16:08:25 2015 MANAGEMENT: CMD 'state on' Mon Feb 02 16:08:25 2015 MANAGEMENT: CMD 'log all on' Mon Feb 02 16:08:25 2015 MANAGEMENT: CMD 'hold off' Mon Feb 02 16:08:25 2015 MANAGEMENT: CMD 'hold release' Mon Feb 02 16:08:25 2015 Socket Buffers: R=[65536->65536] S=[65536->65536] Mon Feb 02 16:08:25 2015 MANAGEMENT: >STATE:1422889705,RESOLVE,,, Mon Feb 02 16:08:25 2015 UDPv4 link local: [undef] Mon Feb 02 16:08:25 2015 UDPv4 link remote: [AF_INET]109.129.xxx.xxx:1194 Mon Feb 02 16:08:25 2015 MANAGEMENT: >STATE:1422889705,WAIT,,, Mon Feb 02 16:08:25 2015 MANAGEMENT: >STATE:1422889705,AUTH,,, Mon Feb 02 16:08:25 2015 TLS: Initial packet from [AF_INET]109.129.xxx.xxx:1194, sid=bc65359f 769f9715 Mon Feb 02 16:08:25 2015 VERIFY OK: depth=1, C=BE, ST=BE, L=Brussels, O=azerty, OU=ICT, CN=azerty CA, name=EasyRSA, emailAddress=webmaster@azerty.be Mon Feb 02 16:08:25 2015 Validating certificate key usage Mon Feb 02 16:08:25 2015 ++ Certificate has key usage 00a0, expects 00a0 Mon Feb 02 16:08:25 2015 VERIFY KU OK Mon Feb 02 16:08:25 2015 Validating certificate extended key usage Mon Feb 02 16:08:25 2015 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication Mon Feb 02 16:08:25 2015 VERIFY EKU OK Mon Feb 02 16:08:25 2015 VERIFY OK: depth=0, C=BE, ST=BE, L=Brussels, O=azerty, OU=ICT, CN=myfqdn.ip.be, name=EasyRSA, emailAddress=webmaster@azerty.be Mon Feb 02 16:08:26 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key Mon Feb 02 16:08:26 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Mon Feb 02 16:08:26 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key Mon Feb 02 16:08:26 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Mon Feb 02 16:08:26 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA Mon Feb 02 16:08:26 2015 [myfqdn.ip.be] Peer Connection Initiated with [AF_INET]109.129.xxx.xxx:1194 Mon Feb 02 16:08:27 2015 MANAGEMENT: >STATE:1422889707,GET_CONFIG,,, Mon Feb 02 16:08:28 2015 SENT CONTROL [myfqdn.ip.be]: 'PUSH_REQUEST' (status=1) Mon Feb 02 16:08:28 2015 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9' Mon Feb 02 16:08:28 2015 OPTIONS IMPORT: timers and/or timeouts modified Mon Feb 02 16:08:28 2015 OPTIONS IMPORT: --ifconfig/up options modified Mon Feb 02 16:08:28 2015 OPTIONS IMPORT: route options modified Mon Feb 02 16:08:28 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Mon Feb 02 16:08:28 2015 MANAGEMENT: >STATE:1422889708,ASSIGN_IP,,10.8.0.10, Mon Feb 02 16:08:28 2015 open_tun, tt->ipv6=0 Mon Feb 02 16:08:28 2015 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{1A395F7B-8910-4EAA-85DC-362CBCFB12B0}.tap Mon Feb 02 16:08:28 2015 TAP-Windows Driver Version 9.21 Mon Feb 02 16:08:28 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.10/255.255.255.252 on interface {1A395F7B-8910-4EAA-85DC-362CBCFB0000} [DHCP-serv: 10.8.0.9, lease-time: 31536000] Mon Feb 02 16:08:28 2015 Successful ARP Flush on interface [25] {1A395F7B-8910-4EAA-85DC-362CBCFB0000} Mon Feb 02 16:08:31 2015 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up Mon Feb 02 16:08:31 2015 MANAGEMENT: >STATE:1422889711,ADD_ROUTES,,, Mon Feb 02 16:08:31 2015 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 0.0.0.0 10.8.0.9 Mon Feb 02 16:08:31 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem Mon Feb 02 16:08:31 2015 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.9 Mon Feb 02 16:08:31 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem Mon Feb 02 16:08:31 2015 Initialization Sequence Completed Mon Feb 02 16:08:31 2015 MANAGEMENT: >STATE:1422889711,CONNECTED,SUCCESS,10.8.0.10,109.129.xxx.xxx[/code] MMmh, not funny. Regards.

I was not aware about the different topologies .... Do you recommand to upgrade my server side to use a subnet topology ? https://community.openvpn.net/openvpn/wiki/Topology regards. Laurent.

Hello Again, .... I tried the subnet topologies, restarted the server side, and I get this routing table (I prefer this kind of routing method). But the result is the same, .... the gateway is not pingable [code]IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 10.8.0.1 10.8.0.8 21 10.8.0.0 255.255.255.0 On-link 10.8.0.8 276 10.8.0.8 255.255.255.255 On-link 10.8.0.8 276 10.8.0.255 255.255.255.255 On-link 10.8.0.8 276 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 10.8.0.8 276 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 10.8.0.8 276 =========================================================================== Persistent Routes: None[/code] [code]C:\>ping 10.8.0.1 Pinging 10.8.0.1 with 32 bytes of data: Request timed out. Ping statistics for 10.8.0.1: Packets: Sent = 1, Received = 0, Lost = 1 (100% loss), Control-C ^C C:\>[/code] Damned .... windows windows .... Regards.

which openvpn version did you installed? write please the name of the installer used... Michael.

Hello, Client side, we have : Operating System : Windows Pro 8.1 [code]C:\>ver Microsoft Windows [Version 6.3.9600][/code] Installer : openvpn-install-2.3.6-I601-x86_64 OpenVpn Version : [code]C:\Program Files\OpenVPN\bin>openvpn.exe --version OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 1 2014 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08 Originally developed by James Yonan Copyright (C) 2002-2010 OpenVPN Technologies, Inc. Compile time defines: enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=no enable_def_auth=yes enable_dlopen=unknown enable_dlopen_self=unknown enable_dl open_self_static=unknown enable_fast_install=needless enable_fragment=yes enable_http_proxy=yes enable_iproute2=no enable_libtool_lock=yes enable_lzo=yes enable _lzo_stub=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=yes enable_pedantic=no enable_pf=yes enable_p kcs11=yes enable_plugin_auth_pam=no enable_plugin_down_root=no enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes en able_shared_with_static_runtimes=yes enable_small=no enable_snappy=no enable_socks=yes enable_ssl=yes enable_static=yes enable_strict=no enable_strict_options=n o enable_systemd=no enable_win32_dll=yes enable_x509_alt_username=no with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_plugindir='$(libdir)/ope nvpn/plugins' with_special_build= with_sysroot=no[/code] And Server side ... We have : Operating System : OpenWrt [code]root@router:~# uname -a Linux router 3.10.34 #5 Mon Apr 7 20:01:39 CEST 2014 mips GNU/Linux root@router:~# cat /etc/openwrt_* DISTRIB_ID="OpenWrt" DISTRIB_RELEASE="Bleeding Edge" DISTRIB_REVISION="r40380" DISTRIB_CODENAME="barrier_breaker" DISTRIB_TARGET="ar71xx/generic" DISTRIB_DESCRIPTION="OpenWrt Barrier Breaker r40380" DISTRIB_TAINTS="no-all" r40380 [/code] OpenVPN Version : [code]root@router:~# openvpn --version OpenVPN 2.3.2 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Apr 16 2014 Originally developed by James Yonan Copyright (C) 2002-2010 OpenVPN Technologies, Inc. [/code] Regards

For Information, I noticed that when I run a capture server side : [b]tcpdump -i pppoe-wan 'udp port 1194'[/b] ... There is almost no traffic, and when I run a ping 10.8.0.1, I see packets on the interface ... but no answer to the ping request ... I m'blocked no more idea :( Regards.

[Solved]Windows 8.1 - Openvpn TUN - cannot ping gateway

Traffic

Also, is your W81 client using wireless or ethernet ?

feeling

Hello,

I will also make 2tests in a virtualbox/hyperv ... with windows 7 and ubuntu linux (with other versions of the openvpn cli).

You can run windows 8.1 ent "for free" for 30 days. http://www.microsoft.com/en-us/evalcenter/evaluate-windows-8-1-enterprise

regards.

Traffic

While you are looking for the cause of your problem bear in mind:
Your openvpn server and client logs show openvpn is working properly,
so the most likely cause is 99.9999% Firewall misconfiguration.

If you have access to a linux ubuntu box set that up as a test server
and if W81 client can ping that then you know it is most likely openwrt.

feeling

Hello,
My client interface is wireless .... yes !

But it cannot be a firewall issue because :

- I have tried 2 differents servers, these 2 different servers work with android and linux clients (and they can ping the gateway).

So the server cannot be the issue.

On the client side (windows 8.1 pro x64 on a core i5 via wireless 7260 interface) .... I have disabled the antivirus (mc afee enterprise) and the local firewall (microsoft).

I think that this is an incompatibility with win 8.1 pro (A also have tried on another laptop with 8.1 pro, and the result is the same ....)

I'm setting up a win 7 in virtualbox to try my config.

regards.

maikcat

can you please check which NDIS version your tap adapter uses?

Michael.

feeling

Hum .... I'm confused ... the issue was an access list on my server's gateway ....
Everything works, I just don't understand why my android terminal was showing ping echo .....

C:\>ping 10.8.0.1

Pinging 10.8.0.1 with 32 bytes of data:
Reply from 10.8.0.1: bytes=32 time=24ms TTL=64
Reply from 10.8.0.1: bytes=32 time=25ms TTL=64
Reply from 10.8.0.1: bytes=32 time=25ms TTL=64
Reply from 10.8.0.1: bytes=32 time=25ms TTL=64

Thanx everybody.

maikcat

anyway,

Marked as Solved & closed.

Michael.

« Previous Page