Hi all I have setup an openvpn gateway to gateway connection, but I cant reach one network. Can you help me? Network A: Network IP: 192.168.100.0/24 Server: Linux Debian OpenVPN Server Server IP: 192.168.100.202 Config file: [code] cd /etc/openvpn dev tun0 port 1194 proto udp tun-mtu 1500 fragment 1300 mssfix ifconfig 10.0.0.1 10.0.0.2 route 172.16.55.0 255.255.255.0 tls-server auth SHA1 dh dh2048.pem ca ca.crt cert hp.crt key hp.key verb 5 [/code] iptables: [code] iptables -A INPUT -p udp --dport 1194 -j ACCEPT iptables -A OUTPUT -p udp --dport 1194 -j ACCEPT iptables -A INPUT -i tun+ -j ACCEPT iptables -A FORWARD -i tun+ -j ACCEPT iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE [/code] Network B: Network IP: 172.16.55.0/24 OpenVPN Client: Conel ER 75 i router Config: Is in the GUI of the router Now what i got so far: Network A [list] OpenVPN server can ping 10.0.0.2 OpenVPN server can ping 172.16.55.1 [/list] Network B [list] Client behind Conel router can ping 10.0.0.1 Client behind Conel router can ping OpenVPN Server 192.168.100.202 Client behind Conel router can ping router behind OpenVPN server 192.168.100.1 [/list] What I need: Whats missing is, that the openvpn server(network A) can ping the client(network B) behind the conel router. A traceroute looks like this: [code]traceroute 172.16.55.1 traceroute to 172.16.55.1 (172.16.55.1), 30 hops max, 60 byte packets 1 172.16.55.1 (172.16.55.1) 290.814 ms 329.299 ms 388.264 ms [/code] [code]traceroute 172.16.55.2 traceroute to 172.16.55.2 (172.16.55.2), 30 hops max, 60 byte packets 1 10.0.0.2 (10.0.0.2) 360.555 ms 379.987 ms 439.658 ms 2 * * * 3 * * * 4 * * * [/code] Do you have any idea, what is missing? Regards jompsi

[url=http://openvpn.net/index.php/open-source/documentation/howto.html#scope]HOWTO: Expanding the scope of the VPN to include additional machines[/url]

Hi again I used now WireShark on the client in network B. What i found out: [list]If the client pings the IP address 192.168.100.1 he gets a reply. Source: 192.168.100.1 Destination: 172.16.55.2 If the client(network b) gets ping-ed from the openvpn server(network a) the source address is 10.0.0.1 and the destination 172.16.55.2. The client sends no reply.[/list] The client from network b can ping 10.0.0.1 succesfully. If the client gets ping-ed he just recieves the request, but there is no reply leaving the client. Do you have any idea? Thanks and regards jompsi

[quote="jompsi"]the source address is 10.0.0.1 and the destination 172.16.55.2. The client sends no reply.[/quote]172.16.55.2 does not have a route for 10.0.0.1 .. Add the route or NAT on the router.

Reach the network behind a conel ER75i router

jompsi

Hi all

I have setup an openvpn gateway to gateway connection, but I cant reach one network. Can you help me?

Network A:
Network IP: 192.168.100.0/24
Server: Linux Debian OpenVPN Server
Server IP: 192.168.100.202
Config file:

cd /etc/openvpn
dev tun0
port 1194
proto udp
tun-mtu 1500
fragment 1300
mssfix
ifconfig 10.0.0.1 10.0.0.2
route 172.16.55.0 255.255.255.0
tls-server
auth SHA1
dh dh2048.pem
ca ca.crt
cert hp.crt
key hp.key
verb 5

iptables:

iptables -A INPUT -p udp --dport 1194 -j ACCEPT
iptables -A OUTPUT -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE

Network B:
Network IP: 172.16.55.0/24
OpenVPN Client: Conel ER 75 i router
Config: Is in the GUI of the router

Now what i got so far:
Network A

OpenVPN server can ping 10.0.0.2
OpenVPN server can ping 172.16.55.1

Network B

Client behind Conel router can ping 10.0.0.1
Client behind Conel router can ping OpenVPN Server 192.168.100.202
Client behind Conel router can ping router behind OpenVPN server 192.168.100.1

What I need:
Whats missing is, that the openvpn server(network A) can ping the client(network B) behind the conel router.

A traceroute looks like this:

traceroute 172.16.55.1
traceroute to 172.16.55.1 (172.16.55.1), 30 hops max, 60 byte packets
 1  172.16.55.1 (172.16.55.1)  290.814 ms  329.299 ms  388.264 ms

traceroute 172.16.55.2
traceroute to 172.16.55.2 (172.16.55.2), 30 hops max, 60 byte packets
 1  10.0.0.2 (10.0.0.2)  360.555 ms  379.987 ms  439.658 ms
 2  * * *
 3  * * *
 4  * * *

Do you have any idea, what is missing?

Regards jompsi

Traffic

HOWTO: Expanding the scope of the VPN to include additional machines

jompsi

Hi Traffic

I added on the openvpn server:

push "route 192.168.100.0 255.255.255.0"

But it still doesnt work.

The client in network B can ping everything in network A, but the openvpn server can only ping the conel router from network B, but not the clients behind it.

Any idea?

Thx and regards
jompsi

jompsi

Hi again

I used now WireShark on the client in network B.

What i found out:

If the client pings the IP address 192.168.100.1 he gets a reply. Source: 192.168.100.1 Destination: 172.16.55.2
If the client(network b) gets ping-ed from the openvpn server(network a) the source address is 10.0.0.1 and the destination 172.16.55.2. The client sends no reply.

The client from network b can ping 10.0.0.1 succesfully.

If the client gets ping-ed he just recieves the request, but there is no reply leaving the client.

Do you have any idea?

Thanks and regards
jompsi

Traffic

jompsi wrotethe source address is 10.0.0.1 and the destination 172.16.55.2. The client sends no reply.

172.16.55.2 does not have a route for 10.0.0.1 .. Add the route or NAT on the router.

jompsi

Why do you think that?

Because the client can ping 10.0.0.1, so I would say the route is there. It is not on the client, but if the client pings 10.0.0.1 it goes to the router and he forwards it.

With the tracert I can follow, how the client goes to the local router 172.16.55.1 and from there to 10.0.0.1.

Am I understanding something wrong?

Here is the routing table from the conel router(network b):

# route
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.254.254 0.0.0.0         UG    0      0        0 ppp0
10.0.0.1        *               255.255.255.255 UH    0      0        0 tun1
172.16.55.0     *               255.255.255.0   U     0      0        0 eth0
192.168.100.0   10.0.0.1        255.255.255.0   UG    0      0        0 tun1
192.168.254.254 *               255.255.255.255 UH    0      0        0 ppp0

Thanks a lot

Traffic

Check the firewall and what is the routing table of the client 172.16.55.2 ?

jompsi

When I turn the firewall on the windows 7 client off, the reply works.
I allowed ICMP echo replies in the firewall, but the ping wont work from the openvpn unless the firewall is turned off. With the activated firewall the client sends echo replies to other clients in the same network.

I am so sorry. Thanks a lot.

I will search know the firewall for further configurations and post them here when i find something.

Regards
jompsi

Traffic

jompsi wrote allowed ICMP echo replies in the firewall, but the ping wont work. It just works when the firewall is turned off.

You must allow the "incoming echo Request" also.

jompsi

This is done https://pcandtablet.com/windows-7-antivirus-and-security/228/how-to-unblock-icmp-echo-requests-from-windows-firewall.html but it doesnt work, unless the firewall is turned off.

jompsi

This is the solution:
http://www.sysprobs.com/enable-ping-reply-windows-7

elberto

Hi to all, I know it's an old discussion but it's the only one I've found using search...

On client side (linux):

- ca.crt
- OpenVPN_Raspberry_ckient.crt
- OpenVPN_Raspberry_ckient.key

client
cipher AES-256-CBC

dev tun
port 1194

#tun-mtu 1300
#tun-mtu-extra 32
#mssfix 1450
proto tcp-client
remote 2.7.14.9
resolv-retry infinite
#keepalive 5 10
nobind
remote-cert-tls server
ca ca.crt
cert OpenVPN_Raspberry_client.crt
key OpenVPN_Raspberry_client.key
#comp-lzo yes
persist-key
persist-tun
verb 0
reneg-sec 0
auth-user-pass login.conf
askpass keypass
#log-append /var/log/openvpn.log
auth-nocache

And I can connect.

Now I need to replicate configuration on ER75i.
May someone help me to fill fields on ER75i configuration page?

Protocol = TCP
Remote IP Address = 2.7.14.9
Compression = none
CA certificate, ok, I've it.
What about other fields?
Thanks.