OpenVPN TAP client cannot browse LAN behind server

Tiemichael

Maybe I am expecting too much ...

My server is on an ASUS-router (192.169.1.1) providing a LAN for a few PCs, a NAS and a printer. This ASUS-router is connected to the Internet.
My clients are an ANDROID phone and ANDROID tablet, using 'OPENVPN CLIENT' which supports both TUN and TAP-configurations.
I have successfully (?) setup my VPN using TAP, and I am able to ping and connect my remote clients to the LAN using the specific IP-addresses (192.168.1.* - range) and vice-versa.

What I am missing:
when browsing the 'local' network (192.168.1.*) from my ANDROID clients, the client sees and browses the Gateway for the client (e.g. 192.168.43.1), but NOT the other devices on my LAN (192.168.1.*).
And here is the problem:
1) when trying to use my LAN-printer from my ANDROID-client (192.168.1.245 / 192.168.43.167) the client cannot find the printer as it's on the LAN, and the client sees/browses only the client-network (192.168.43.*). (Too bad there is no option to specify the Printer-IP directly)
2) I can only connect to LAN-devices when I know their IP-address (which is not a big deal)

So, maybe I am expecting too much, but it would be great to get it working

I tried a TUN-setup before, but changed to TAP hoping that this specific issue would not appear.

Here is my server.conf

proto udp
port 1194
dev tap1
server-bridge 192.168.1.1 255.255.255.0 192.168.1.245 192.168.1.254
auth SHA1
cipher BF-CBC
comp-lzo adaptive
push "comp-lzo adaptive"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS xxx.yy.zz.6"
push "dhcp-option DNS xxx.yy.zz.1"
push "dhcp-option WINS 192.168.1.1"
ca /etc/storage/openvpn/server/ca.crt
dh /etc/storage/openvpn/server/dh1024.pem
cert /etc/storage/openvpn/server/server.crt
key /etc/storage/openvpn/server/server.key
persist-key
persist-tun
user nobody
group nogroup
script-security 2
tmp-dir /tmp/openvpn
writepid /var/run/openvpn_svr.pid
client-connect ovpns.script
client-disconnect ovpns.script

### User params:
max-clients 10
client-to-client
keepalive 10 60
nice 3
verb 0
mute 10
server-bridge
push "route 0.0.0.0 255.255.255.255 net_gateway"

Here my client.ovpn

client
dev tap
proto udp
remote www.yyyy.xxx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
auth SHA1
cipher BF-CBC
comp-lzo adaptive
nice 0
verb 3
mute 10
;ns-cert-type server

Thanks for your help!

Traffic

Set --verb 4 in your server & client and review your logs ...

Also, notice this:

Tiemichael wroteserver.conf
Code:
server-bridge 192.168.1.1 255.255.255.0 192.168.1.245 192.168.1.254
### User params:
server-bridge

Only the second server-bridge will be implemented ..

Tiemichael

Thank you!
I removed the 2nd 'server-bridge' - it did not change anything.
Also setting verb = 4 did not reveal anything to me, but what should I look for ???

Here is the server.log:

Feb 5 15:50:10 openvpn-srv[1704]: P600/xxx.yyy.81.65:1194 TLS: new session incoming connection from [AF_INET]xxx.yyy.81.65:1194
Feb 5 15:50:11 openvpn-srv[1704]: P600/xxx.yyy.81.65:1194 VERIFY OK: depth=1, CN=OpenVPN CA
Feb 5 15:50:11 openvpn-srv[1704]: P600/xxx.yyy.81.65:1194 VERIFY OK: depth=0, CN=P600
Feb 5 15:50:11 openvpn-srv[1704]: P600/xxx.yyy.81.65:1194 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Feb 5 15:50:11 openvpn-srv[1704]: P600/xxx.yyy.81.65:1194 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Feb 5 15:50:11 openvpn-srv[1704]: P600/xxx.yyy.81.65:1194 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Feb 5 15:50:11 openvpn-srv[1704]: P600/xxx.yyy.81.65:1194 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Feb 5 15:50:11 openvpn-srv[1704]: P600/xxx.yyy.81.65:1194 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Feb 5 15:50:11 openvpn-srv[1704]: P600/xxx.yyy.81.65:1194 TLS: tls_multi_process: untrusted session promoted to trusted
Feb 5 15:50:11 openvpn-srv[1704]: P600/xxx.yyy.81.65:1194 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Feb 5 15:50:13 openvpn-srv[1704]: P600/xxx.yyy.81.65:1194 PUSH: Received control message: 'PUSH_REQUEST'
Feb 5 15:50:13 openvpn-srv[1704]: P600/xxx.yyy.81.65:1194 send_push_reply(): safe_cap=940
Feb 5 15:50:13 openvpn-srv[1704]: P600/xxx.yyy.81.65:1194 SENT CONTROL [P600]: 'PUSH_REPLY,comp-lzo adaptive,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 202.65.242.46,dhcp-option DNS 202.65.242.50,dhcp-option WINS 192.168.1.1,route-gateway 192.168.1.1,ping 10,ping-restart 60,ifconfig 192.168.1.245 255.255.255.0' (status=1)

Traffic

Tiemichael wrotedhcp-option WINS 192.168.1.1

Are you running a WINS/Samba server on this host ?

What you need to check is that broadcast packets from your client device are seen not just by the server but also by hosts on the server LAN.

The problem is this ..

1. you want to know how to configure a layer 2 VPN (which is what you have)
- Good .. not much else we can do ..
2. that windows network browser and NetBIOS will work with (which you do not have)
- This forum does not provide support for Microsoft products
3. but you can connect to your printer by IP address
- I would accept this as a limitation

Tiemichael wroteMaybe I am expecting too much ...

I have never seen windows networking work properly over a layer 2 bridged VPN or Layer 3 routed VPN.

Tiemichael

Thank you!

Yes, I am running a WINS/SAMBA-server on my host (i.e. VPN-server), but I am not sure if it's needed at all. I switched them on merely to resolve my issue.

My whole LAN does typically NOT include any Windows-systems (ok, once in while I connect a Win7-Laptop).

Yes, the VPN-client can communicate with the LAN-hosts behind the VPN-server (and vice-verse) , but I need to know the IP-addresses of these hosts. The VPN-client (android-tablet) cannot 'auto-detect' the VPN-server and LAN-hosts behind from the VPN-client - although the VPN-connection is working fine.

Sorry, I am quite a layman in this area, and even describing the issue is not easy ...