Please Help - Bridged Setup Connects but thats it

nutpuk

Hi all,

I'm in need of some help with my VPN setup.

I'm struggling to resolve this niggling issue after a week of trying.

I have installed OpenVPN on a VM unsing CentOS 7.

The server lives in Vlan 5 and uses an IP of 10.1.5.2

Clients can connect and get issues with an IP address of 10.1.5.101-150

However clients can't ping the server and the server can't ping the client.

I believe it has to be something with the routing but really unsure what.

I selected bridge mode as I believe it will be better for my environment, as connected clients need to be able to reach file shares in the VLan of 10.1.10.0 and RDP sessions to other machines in the 10.1.5.0

Please can you help this idiot figure this out.

Below are my configs.
#####Bridge start #####

#!/bin/bash

#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0,tap1,tap2"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="ens32"
eth_ip="10.1.5.2"
eth_netmask="255.255.255.0"
eth_broadcast="10.1.5.255"
#eth_gateway="10.1.5.253"

for t in $tap; do
openvpn --mktun --dev $t
done

brctl addbr $br
brctl addif $br $eth

for t in $tap; do
brctl addif $br $t
done

for t in $tap; do
ifconfig $t 0.0.0.0 promisc up
done

ifconfig $eth 0.0.0.0 promisc up

ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast
route add default gw 10.1.5.253

#####Server config #####

# The second parameter should be '0'
# on the server and '1' on the clients.
;tls-auth ta.key 0 # This file is secret

# Select a cryptographic cipher.
# This config item must be copied to
# the client config file as well.
;cipher BF-CBC # Blowfish (default)
;cipher AES-128-CBC # AES
;cipher DES-EDE3-CBC # Triple-DES

# Enable compression on the VPN link.
# If you enable it here, you must also
# enable it in the client config file.
comp-lzo

# The maximum number of concurrently connected
# clients we want to allow.
;max-clients 100

# It's a good idea to reduce the OpenVPN
# daemon's privileges after initialization.
#
# You can uncomment this out on
# non-Windows systems.
user nobody
group nobody

# The persist options will try to avoid
# accessing certain resources on restart
# that may no longer be accessible because
# of the privilege downgrade.
persist-key
persist-tun

# Output a short status file showing
# current connections, truncated
# and rewritten every minute.
status openvpn-status.log

# By default, log messages will go to the syslog (or
# on Windows, if running as a service, they will go to
# the "\Program Files\OpenVPN\log" directory).
# Use log or log-append to override this default.
# "log" will truncate the log file on OpenVPN startup,
# while "log-append" will append to it. Use one
# or the other (but not both).
;log openvpn.log
;log-append openvpn.log

# Set the appropriate level of log
# file verbosity.
#
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 3

# Silence repeating messages. At most 20
# sequential messages of the same message
# category will be output to the log.
;mute 20

#####Client config #####
client
dev tap
proto udp
remote 78.109.xxx.xxx 1194
route-nopull
link-mtu 1574
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
ca "C:\\OpenVPN\\ca.crt"
cert "C:\\OpenVPN\\Client1.crt"
key "C:\\OpenVPN\\client1.key"
route-delay 5
route-method exe
ip-win32 netsh

####client log#####

Fri Feb 20 14:39:53 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 1 2014
Fri Feb 20 14:39:53 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Enter Management Password:
Fri Feb 20 14:39:53 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Fri Feb 20 14:39:53 2015 Need hold release from management interface, waiting...
Fri Feb 20 14:39:53 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Fri Feb 20 14:39:53 2015 MANAGEMENT: CMD 'state on'
Fri Feb 20 14:39:53 2015 MANAGEMENT: CMD 'log all on'
Fri Feb 20 14:39:53 2015 MANAGEMENT: CMD 'hold off'
Fri Feb 20 14:39:53 2015 MANAGEMENT: CMD 'hold release'
Fri Feb 20 14:39:53 2015 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Fri Feb 20 14:39:54 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Fri Feb 20 14:39:54 2015 UDPv4 link local: [undef]
Fri Feb 20 14:39:54 2015 UDPv4 link remote: [AF_INET]78.105.xxx.xxx:1194
Fri Feb 20 14:39:54 2015 MANAGEMENT: >STATE:1424443194,WAIT,,,
Fri Feb 20 14:39:54 2015 MANAGEMENT: >STATE:1424443194,AUTH,,,
Fri Feb 20 14:39:54 2015 TLS: Initial packet from [AF_INET]78.109.176.117:1194, sid=ad33f192 574bd467
Fri Feb 20 14:39:54 2015 VERIFY OK: depth=1, C=GB, ST=test, L=test, O=test, OU=IT Services, CN=hucklow, name=hucklow, emailAddress=
Fri Feb 20 14:39:54 2015 VERIFY OK: depth=0, C=GB, ST=test, L=test, O=test, OU=IT Services, CN=server, name=server, emailAddress=
Fri Feb 20 14:39:55 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Feb 20 14:39:55 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Feb 20 14:39:55 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Feb 20 14:39:55 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Feb 20 14:39:55 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Fri Feb 20 14:39:55 2015 [server] Peer Connection Initiated with [AF_INET]78.109.176.117:1194
Fri Feb 20 14:39:56 2015 MANAGEMENT: >STATE:1424443196,GET_CONFIG,,,
Fri Feb 20 14:39:57 2015 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Fri Feb 20 14:39:58 2015 PUSH: Received control message: 'PUSH_REPLY,route 10.0.30.0 255.255.255.0,route 10.1.30.0 255.255.255.0,route 10.1.5.0 255.255.255.0,redirect-gateway,route-gateway 10.1.5.2,ping 10,ping-restart 120,ifconfig 10.1.5.101 255.255.255.0'
Fri Feb 20 14:39:58 2015 Options error: option 'route' cannot be used in this context ([PUSH-OPTIONS])
Fri Feb 20 14:39:58 2015 Options error: option 'route' cannot be used in this context ([PUSH-OPTIONS])
Fri Feb 20 14:39:58 2015 Options error: option 'route' cannot be used in this context ([PUSH-OPTIONS])
Fri Feb 20 14:39:58 2015 Options error: option 'redirect-gateway' cannot be used in this context ([PUSH-OPTIONS])
Fri Feb 20 14:39:58 2015 OPTIONS IMPORT: timers and/or timeouts modified
Fri Feb 20 14:39:58 2015 OPTIONS IMPORT: --ifconfig/up options modified
Fri Feb 20 14:39:58 2015 OPTIONS IMPORT: route-related options modified
Fri Feb 20 14:39:58 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Feb 20 14:39:58 2015 MANAGEMENT: >STATE:1424443198,ASSIGN_IP,,10.1.5.101,
Fri Feb 20 14:39:59 2015 NETSH: C:\Windows\system32\netsh.exe interface ip set address MyTap static 10.1.5.101 255.255.255.0
Fri Feb 20 14:40:00 2015 NETSH: C:\Windows\system32\netsh.exe interface ip delete dns MyTap all
Fri Feb 20 14:40:01 2015 NETSH: C:\Windows\system32\netsh.exe interface ip delete wins MyTap all
Fri Feb 20 14:40:01 2015 open_tun, tt->ipv6=0
Fri Feb 20 14:40:01 2015 TAP-WIN32 device [MyTap] opened: \\.\Global\{70E8BBE1-5257-4BF1-B4A5-9564DC49942C}.tap
Fri Feb 20 14:40:01 2015 TAP-Windows Driver Version 9.21
Fri Feb 20 14:40:01 2015 Successful ARP Flush on interface [19] {70E8BBE1-5257-4BF1-B4A5-9564DC49942C}
Fri Feb 20 14:40:06 2015 TEST ROUTES: 0/0 succeeded len=0 ret=1 a=0 u/d=up
Fri Feb 20 14:40:06 2015 Initialization Sequence Completed
Fri Feb 20 14:40:06 2015 MANAGEMENT: >STATE:1424443206,CONNECTED,SUCCESS,10.1.5.101,78.105.xxx.xxx

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.43.1 192.168.43.161 25
0.0.0.0 128.0.0.0 10.1.5.2 192.168.43.161 26
10.1.5.0 255.255.255.0 On-link 10.1.5.101 276
10.1.5.101 255.255.255.255 On-link 10.1.5.101 276
10.1.5.255 255.255.255.255 On-link 10.1.5.101 276
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
128.0.0.0 128.0.0.0 10.1.5.2 192.168.43.161 26
192.168.43.0 255.255.255.0 On-link 192.168.43.161 281
192.168.43.161 255.255.255.255 On-link 192.168.43.161 281
192.168.43.255 255.255.255.255 On-link 192.168.43.161 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.1.5.101 276
224.0.0.0 240.0.0.0 On-link 192.168.43.161 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.1.5.101 276
255.255.255.255 255.255.255.255 On-link 192.168.43.161 281
===========================================================================

Traffic

Starting with the obvious !

Remove this:

nutpuk wrote#####Client config #####

route-nopull

:roll:

nutpuk

Thanks fo the reply, any help is appreciated.

I removed that line from the client config, but still no joy.

I connect, get issued with an IP, but I'm unable to ping the OpenVPN server, any other sever.

Any other thoughts?

Traffic

Set --verb 4 in your configs, restart your vpn and post client log please.