OpenVPN lan-to-lan on both sides with WIN IP Forwarding

iwen

Greetings,

I have a Lan-to-Lan VPN using OpenVPN. The connection is great, the bandwidth and performance ist great.

But as soon as I activate Windows IP Forwarding, the tunnel is not usable anymore.I have a packet loss around 50%.
After some seconds the the tunnel gets ping replies around 3000ms. After further seconds, it is ok again. And so on.
As soon as I deactivate IP forwarding, all is perfekt.

I can reproduce this on 3 different Windows 2008R2 Servers. One of them is a SBS, the other are Standard Servers without any specific services.

Has anyone an idea? I could not figure it since some days.

Regards,

Traffic

Please see the Forum rules (top of page)

iwen

Thank you. I don't know what exactly you mean. Probably the configs. I don't think its a config thing. But you are right. Sorry for that.

client
remote some-ip 1620
dev tun
dev-node vpn-nic
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
ca c:\\keys\\ca.crt
cert c:\\keys\\srv01.crt
key c:\\keys\\srv01.key
ns-cert-type server
cipher AES-128-CBC
comp-lzo
verb 2
status openvpn-status.log
log  openvpn.log

server 10.0.0.0 255.255.255.0
port 1620
proto udp
dev tun
dev-node vpn-nic
ca c:\\keys\\ca.crt
cert c:\\keys\\server.crt
key c:\\keys\\server.key
dh c:\\keys\\dh1024.pem
client-config-dir "C:\\Program Files\\OpenVPN\\config\\ccd"
push "route 192.168.0.105 255.255.255.255"
route 192.168.50.0 255.255.255.0
keepalive 5 1200
cipher AES-128-CBC 
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 2

in the ccd there is only one entry with "iroute"

All entries in the routing-table are correct after successful connection.

Traffic

iwen wroteI don't think its a config thing.

we see some very strange configs ..

iwen wroteCode:
server 10.0.0.0 255.255.255.0

push "route 192.168.0.105 255.255.255.255"
route 192.168.50.0 255.255.255.0

did you spot that ?

iwen

So what do you think is strange? This is a correct config. Don't know what you see here.

- The server tells the client (initiator) that it should route to the internal IP of the server.
- The server routes the client lan.

Anyway. I solved it.

In my case it is definitely a reproducable problem with that oversized RAS router role from the Windows Server 2008 R2. Remember: I tried it on 3 different (not cloned) server systems. Activate router role = slow and packet loss, deactivate router role perfect.

Solution (for me)
I decided to setup a small lean Debian. Setting ip_forwarding to 1 everything works like a charme. Full bandwidth and extremely stable over LTE.
I tried it with 2.3.4 and 2.3.6.

Traffic

iwen wrotepush "route 192.168.0.105 255.255.255.255"

iwen wroteThe server tells the client (initiator) that it should route to the internal IP of the server

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

iwen wroteSolution (for me)
I decided to setup a small lean Debian. Setting ip_forwarding to 1 everything works like a charme. Full bandwidth and extremely stable over LTE.

Linux ok .. Windows not ok .. fairly normal ..

iwen

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

I got it. But in this case, all addresses are under our control. No mismatch exists. Thanks for the hint.

I am happy that the very most of our infrastructure can be excellently driven by Open OS
Anyhow I would like to know what was going wrong with the Windows Router.

For the users of OpenVPN with Windows Servers 2008(R2)(SBS): If you have trouble with performance and packet loss try to stop RAS Service and check the quality of the tunnel without it.

Thanks to the community.