[Solved]Client/server connected but cannot ping either way

networks_noob

I'm using a Windows server 2012 instance on Amazon AWS. I'm trying to create a VPN connection between my computer (the client) and the AWS instance (the server) using OpenVPN.

Like the person who opened this thread (https://forums.openvpn.net/topic18131.html), I have followed the easy windows guide to the letter: https://community.openvpn.net/openvpn/wiki/Easy_Windows_Guide#StartingOpenVPN. I've also opened the right ports (including 1194 which I'm using) through the AWS security groups interface.

I've managed to get the client OpenVPN to connect to the server OpenVPN and IPs seem to be assigned at both sides. However I cannot ping from client to server or vice-versa using these IP addresses (10.8.0.1 or 10.8.0.6).

I've taken the following steps to help eliminate issues:
- Windows Firewall is disabled completely for private and public networks on both sides
- I'm running both the client and server OpenVPN applications as administrator
- I've also added the following 2 statements to the server config file as this worked for the other guy (route-delay 5 ip-win32 netsh)
- Rebooted both sides
However none of these in any combination have worked for me.

Any ideas?

I've posted my server log file below:

Sun Mar 01 13:50:24 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 1 2014
Sun Mar 01 13:50:24 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Sun Mar 01 13:50:24 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sun Mar 01 13:50:24 2015 Need hold release from management interface, waiting...
Sun Mar 01 13:50:24 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sun Mar 01 13:50:24 2015 MANAGEMENT: CMD 'state on'
Sun Mar 01 13:50:24 2015 MANAGEMENT: CMD 'log all on'
Sun Mar 01 13:50:24 2015 MANAGEMENT: CMD 'hold off'
Sun Mar 01 13:50:24 2015 MANAGEMENT: CMD 'hold release'
Sun Mar 01 13:50:24 2015 Diffie-Hellman initialized with 1024 bit key
Sun Mar 01 13:50:24 2015 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sun Mar 01 13:50:24 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Mar 01 13:50:24 2015 MANAGEMENT: >STATE:1425217824,ASSIGN_IP,,10.8.0.1,
Sun Mar 01 13:50:25 2015 NETSH: C:\Windows\system32\netsh.exe interface ip set address Local Area Connection static 10.8.0.1 255.255.255.252
Sun Mar 01 13:50:27 2015 NETSH: C:\Windows\system32\netsh.exe interface ip delete dns Local Area Connection all
Sun Mar 01 13:50:28 2015 NETSH: C:\Windows\system32\netsh.exe interface ip delete wins Local Area Connection all
Sun Mar 01 13:50:28 2015 open_tun, tt->ipv6=0
Sun Mar 01 13:50:28 2015 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{DD5231F1-C4E8-4A1B-B5C8-BC869C5B2AC0}.tap
Sun Mar 01 13:50:28 2015 TAP-Windows Driver Version 9.9
Sun Mar 01 13:50:28 2015 Sleeping for 5 seconds...
Sun Mar 01 13:50:33 2015 Successful ARP Flush on interface [15] {DD5231F1-C4E8-4A1B-B5C8-BC869C5B2AC0}
Sun Mar 01 13:50:33 2015 MANAGEMENT: >STATE:1425217833,ADD_ROUTES,,,
Sun Mar 01 13:50:33 2015 C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.2
Sun Mar 01 13:50:33 2015 Warning: route gateway is not reachable on any active network adapters: 10.8.0.2
Sun Mar 01 13:50:33 2015 Route addition via IPAPI failed [adaptive]
Sun Mar 01 13:50:33 2015 Route addition fallback to route.exe
Sun Mar 01 13:50:33 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Sun Mar 01 13:50:33 2015 UDPv4 link local (bound): [undef]
Sun Mar 01 13:50:33 2015 UDPv4 link remote: [undef]
Sun Mar 01 13:50:33 2015 MULTI: multi_init called, r=256 v=256
Sun Mar 01 13:50:33 2015 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Sun Mar 01 13:50:33 2015 ifconfig_pool_read(), in='openvpn-client,10.8.0.4', TODO: IPv6
Sun Mar 01 13:50:33 2015 succeeded -> ifconfig_pool_set()
Sun Mar 01 13:50:33 2015 IFCONFIG POOL LIST
Sun Mar 01 13:50:33 2015 openvpn-client,10.8.0.4
Sun Mar 01 13:50:33 2015 Initialization Sequence Completed
Sun Mar 01 13:50:33 2015 MANAGEMENT: >STATE:1425217833,CONNECTED,SUCCESS,10.8.0.1,
Sun Mar 01 13:50:33 2015 XX.XX.XX.XX:50866 TLS: Initial packet from [AF_INET]XX.XX.XX.XX:50866, sid=306d78a5 b3c7ea30
Sun Mar 01 13:50:35 2015 XX.XX.XX.XX:50866 VERIFY OK: depth=1, C=GB, ST=XXX, L=YYY, O=YYY, OU=ZZZ, CN=openvpn-server, name=changeme, emailAddress=PPP
Sun Mar 01 13:50:35 2015 XX.XX.XX.XX:50866 VERIFY OK: depth=0, C=GB, ST=XXX, L=YYY, O=YYY, OU=ZZZ, CN=openvpn-client, name=changeme, emailAddress=PPP
Sun Mar 01 13:50:35 2015 XX.XX.XX.XX:50866 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Mar 01 13:50:35 2015 XX.XX.XX.XX:50866 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Mar 01 13:50:35 2015 XX.XX.XX.XX:50866 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Mar 01 13:50:35 2015 XX.XX.XX.XX:50866 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Mar 01 13:50:35 2015 XX.XX.XX.XX:50866 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Mar 01 13:50:35 2015 XX.XX.XX.XX:50866 [openvpn-client] Peer Connection Initiated with [AF_INET]XX.XX.XX.XX:50866
Sun Mar 01 13:50:35 2015 openvpn-client/XX.XX.XX.XX:50866 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Sun Mar 01 13:50:35 2015 openvpn-client/XX.XX.XX.XX:50866 MULTI: Learn: 10.8.0.6 -> openvpn-client/XX.XX.XX.XX:50866
Sun Mar 01 13:50:35 2015 openvpn-client/XX.XX.XX.XX:50866 MULTI: primary virtual IP for openvpn-client/XX.XX.XX.XX:50866: 10.8.0.6
Sun Mar 01 13:50:38 2015 openvpn-client/XX.XX.XX.XX:50866 PUSH: Received control message: 'PUSH_REQUEST'
Sun Mar 01 13:50:38 2015 openvpn-client/XX.XX.XX.XX:50866 send_push_reply(): safe_cap=940
Sun Mar 01 13:50:38 2015 openvpn-client/XX.XX.XX.XX:50866 SENT CONTROL [openvpn-client]: 'PUSH_REPLY,route 10.8.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Sun Mar 01 13:50:49 2015 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
Sun Mar 01 13:50:51 2015 XX.XX.XX.XX:57714 TLS: Initial packet from [AF_INET]XX.XX.XX.XX:57714, sid=4593cca7 b15b12c8
Sun Mar 01 13:50:54 2015 XX.XX.XX.XX:57714 VERIFY OK: depth=1, C=GB, ST=XXX, L=YYY, O=YYY, OU=ZZZ, CN=openvpn-client, name=changeme, emailAddress=PPP
Sun Mar 01 13:50:54 2015 XX.XX.XX.XX:57714 VERIFY OK: depth=0, C=GB, ST=XXX, L=YYY, O=YYY, OU=ZZZ, CN=openvpn-client, name=changeme, emailAddress=PPP

maikcat

please post BOTH configs please.

Michael.

networks_noob

Thanks for the reply.

My client config is:

client
dev tun
proto udp
remote AB.CD.DE.FG 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ..//keys//ca.crt
cert ..//keys//openvpn-client.crt
key ..//keys//openvpn-client.key
ns-cert-type server
cipher AES-256-CBC
comp-lzo
verb 3

My server config is:

local 0.0.0.0
port 1194
proto udp
dev tun
ca ..//easy-rsa//keys//ca.crt
cert ..//easy-rsa//keys//openvpn-server.crt
key ..//easy-rsa//keys//openvpn-server.key
dh ..//easy-rsa//keys//dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 60
cipher AES-256-CBC
comp-lzo
max-clients 10
persist-key
persist-tun
route-delay 5
ip-win32 netsh
status openvpn-status.log
verb 3

maikcat

client logs please,

also post which ndis version is your tap driver.

Michael

networks_noob

This is my client log:

Tue Mar 03 17:55:30 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec  1 2014
Tue Mar 03 17:55:30 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Tue Mar 03 17:55:30 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Mar 03 17:55:30 2015 Need hold release from management interface, waiting...
Tue Mar 03 17:55:30 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Mar 03 17:55:30 2015 MANAGEMENT: CMD 'state on'
Tue Mar 03 17:55:30 2015 MANAGEMENT: CMD 'log all on'
Tue Mar 03 17:55:30 2015 MANAGEMENT: CMD 'hold off'
Tue Mar 03 17:55:30 2015 MANAGEMENT: CMD 'hold release'
Tue Mar 03 17:55:30 2015 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Mar 03 17:55:30 2015 MANAGEMENT: >STATE:1425405330,RESOLVE,,,
Tue Mar 03 17:55:30 2015 UDPv4 link local: [undef]
Tue Mar 03 17:55:30 2015 UDPv4 link remote: [AF_INET]YY.YY.YY.YY:1194
Tue Mar 03 17:55:30 2015 MANAGEMENT: >STATE:1425405330,WAIT,,,
Tue Mar 03 17:55:31 2015 MANAGEMENT: >STATE:1425405331,AUTH,,,
Tue Mar 03 17:55:31 2015 TLS: Initial packet from [AF_INET]YY.YY.YY.YY:1194, sid=2990e819 7f2aa8a7
Tue Mar 03 17:55:37 2015 VERIFY OK: depth=1, C=GB, ST=XXX, L=YYY, O=YYY, OU=ZZZ, CN=openvpn-server, name=changeme, emailAddress=PPP
Tue Mar 03 17:55:37 2015 VERIFY OK: nsCertType=SERVER
Tue Mar 03 17:55:37 2015 VERIFY OK: depth=0, C=GB, ST=XXX, L=YYY, O=YYY, OU=ZZZ, CN=openvpn-server, name=changeme, emailAddress=PPP
Tue Mar 03 17:55:38 2015 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Mar 03 17:55:38 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 03 17:55:38 2015 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Mar 03 17:55:38 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 03 17:55:38 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Mar 03 17:55:38 2015 [openvpn-server] Peer Connection Initiated with [AF_INET]YY.YY.YY.YY:1194
Tue Mar 03 17:55:40 2015 MANAGEMENT: >STATE:1425405340,GET_CONFIG,,,
Tue Mar 03 17:55:41 2015 SENT CONTROL [openvpn-server]: 'PUSH_REQUEST' (status=1)
Tue Mar 03 17:55:41 2015 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.8.0.6 10.8.0.5'
Tue Mar 03 17:55:41 2015 OPTIONS IMPORT: timers and/or timeouts modified
Tue Mar 03 17:55:41 2015 OPTIONS IMPORT: --ifconfig/up options modified
Tue Mar 03 17:55:41 2015 OPTIONS IMPORT: route options modified
Tue Mar 03 17:55:41 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Mar 03 17:55:41 2015 MANAGEMENT: >STATE:1425405341,ASSIGN_IP,,10.8.0.6,
Tue Mar 03 17:55:41 2015 open_tun, tt->ipv6=0
Tue Mar 03 17:55:41 2015 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{30D724F1-8102-47F4-9B7A-060C96BD4BDD}.tap
Tue Mar 03 17:55:41 2015 TAP-Windows Driver Version 9.9 
Tue Mar 03 17:55:41 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {30D724F1-8102-47F4-9B7A-060C96BD4BDD} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Tue Mar 03 17:55:41 2015 Successful ARP Flush on interface [20] {30D724F1-8102-47F4-9B7A-060C96BD4BDD}
Tue Mar 03 17:55:46 2015 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Tue Mar 03 17:55:46 2015 MANAGEMENT: >STATE:1425405346,ADD_ROUTES,,,
Tue Mar 03 17:55:46 2015 C:\WINDOWS\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Tue Mar 03 17:55:46 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Mar 03 17:55:46 2015 Route addition via IPAPI succeeded [adaptive]
Tue Mar 03 17:55:46 2015 Initialization Sequence Completed
Tue Mar 03 17:55:46 2015 MANAGEMENT: >STATE:1425405346,CONNECTED,SUCCESS,10.8.0.6,YY.YY.YY.YY

The TAP driver version on both the client and server side is 9.0.0.9.
The Server is running Windows Server 2012 and has ndis version 6.30 (file version 6.2.9200.16642). The client is running Windows 8.1 and has ndis version 6.40 (file version 6.3.9600.17199).

maikcat

can you for testing install I0 version of openvpn which has ndis5 version of tap driver?

Michael.

networks_noob

Hi Michael, thanks for your reply.
My answer to your previous question was the version of my windows ndis.sys file. I wasn't aware this was different and I had incorrectly used the 'IOxx' installer on both the client and server.

SOLUTION (for the benefit of others):
There are 2 types of Windows installers with the text 'I0' and 'I6' in them. Which one you use should depend on your choice of operating system. 'IOxx' installers are used if you have an OS that supports NDIS5. Use 'I6xx' installers if you have an OS that supports NDIS6. To find out what NDIS version you OS is likely to have, look at this page: https://msdn.microsoft.com/en-us/library/windows/hardware/ff567893(v=vs.85).aspx

In my case, the client is Windows 8.1 and the server is Windows Server 12. So in both cases I wanted the installer that supports NDIS6 and therefore I should have used the 'I6xx' installer. My mistake was to use the 'IOxx' installer.

maikcat

There are cases that ndis6 version caused strange openvpn behavior and switching back to ndis5
solved the problem,i am aware that win 8.1 use ndis6.30 version and assumed you had downloaded I6 based file.

Marked as solved,

Closing topic

regards,

Michael.