Windows 8.1 Networking w/ OpenVPN

dirkus

I have a new Windows 8.1 machine that I am trying to setup in a remote home office. I have installed OpenVPN 2.3.6 x86_64. I can get a connection to my OpenVPN server and if I open a command prompt I can ping machines in the central network. If I switch into the File Explorer, I cannot connect to any of my Windows or samba services in the central office. I am trying to connect by specifying the IP address.

What am I missing in this Windows 8.1 setup?

thanks!

Dirkus

Traffic

As you have not posted your configs or logs .. please make sure you have read this:
HOWTO: Expanding the scope of the VPN to include additional machines

With regard to browsing samba shares you require a Layer 2 vpn (--dev tap)
Connecting directly via ip address will work for layer 3 (--dev tun)

dirkus wroteI can ping machines in the central network. If I switch into the File Explorer, I cannot connect to any of my Windows or samba services in the central office. I am trying to connect by specifying the IP address

on the target machines: check firewalls and routing ..

dirkus

My server configuration looks like this:

cat server.conf 
mode server
multihome
ca   data/ca.crt
cert data/server.crt
key  data/server.key
dh   data/dh.pem
client-config-dir ccd
keepalive 10 60
user nobody
group nogroup
tls-server
comp-lzo
status openvpn-status.log
verb 1
dev tun0
max-clients 2048
ccd-exclusive
persist-key
persist-tun
mute 20
management 127.0.0.1 1195
log-append /var/log/openvpn.log
ifconfig-pool-persist /etc/openvpn/address-pool-assignments.txt
push "register-dns"
proto udp
port 1194
cipher AES-128-CBC
client-to-client
server 172.16.209.0 255.255.255.0
# Exports
push "route 192.168.70.0 255.255.255.0"
push "route 192.168.68.0 255.255.255.0"
route 192.168.1.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"

The ccd file for the client in question is:

push "dhcp-option DNS 172.16.209.1"

The server has ip_forwarding enabled.

This is the config file that the client loads.

client
resolv-retry 20
keepalive 10 60
nobind
mute-replay-warnings
ns-cert-type server
comp-lzo
verb 1
persist-key
persist-tun
explicit-exit-notify 1
dev tun
proto udp
port 1194
cipher AES-128-CBC
cert keys/mms-nibley-pc4tonya.crt
key keys/mms-nibley-pc4tonya.key
ca keys/mms-nibley-pc4tonya-ca.crt
remote 23.30.61.25 1194 # public address 
remote 23.30.61.25 1194 # static WAN 1

This is the .opvn file

client
resolv-retry 20
keepalive 10 60
nobind
mute-replay-warnings
ns-cert-type server
comp-lzo
verb 1
persist-key
persist-tun
explicit-exit-notify 1
dev tun
proto udp
port 1194
cipher AES-128-CBC
cert keys/mms-nibley-pc4tonya.crt
key keys/mms-nibley-pc4tonya.key
ca keys/mms-nibley-pc4tonya-ca.crt
remote 23.30.61.25 1194 # public address 
remote 23.30.61.25 1194 # static WAN 1

Traffic

dirkus wroteI can ping machines in the central network.

this means your VPN and routing are ok.

dirkus wroteIf I switch into the File Explorer, I cannot connect to any of my Windows or samba services in the central office.

What "file explorer" do you mean ?

dirkus wroteI am trying to connect by specifying the IP address

what command do you use ?

dirkus

Traffic wroteWhat "file explorer" do you mean ?

C:\Windows\explorer.exe

Traffic wrotewhat command do you use ?

\\192.168.68.50\directory is entered into the address bar.

This is my log file. No errors are generated there.

Wed May 13 08:50:03 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar 19 2015
Wed May 13 08:50:03 2015 library versions: OpenSSL 1.0.1m 19 Mar 2015, LZO 2.08
Enter Management Password:
Wed May 13 08:50:04 2015 UDPv4 link local: [undef]
Wed May 13 08:50:04 2015 UDPv4 link remote: [AF_INET]23.30.61.25:1194
Wed May 13 08:50:06 2015 [server] Peer Connection Initiated with [AF_INET]23.30.61.25:1194
Wed May 13 08:50:09 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed May 13 08:50:09 2015 open_tun, tt->ipv6=0
Wed May 13 08:50:09 2015 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{AC8062D3-B259-4946-85F6-5B7571B0FEF2}.tap
Wed May 13 08:50:09 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 172.16.209.14/255.255.255.252 on interface {AC8062D3-B259-4946-85F6-5B7571B0FEF2} [DHCP-serv: 172.16.209.13, lease-time: 31536000]
Wed May 13 08:50:09 2015 Successful ARP Flush on interface [24] {AC8062D3-B259-4946-85F6-5B7571B0FEF2}
Wed May 13 08:50:14 2015 Initialization Sequence Completed
Wed May 13 08:50:14 2015 Start net commands...
Wed May 13 08:50:14 2015 C:\windows\system32\net.exe stop dnscache
Wed May 13 08:50:19 2015 C:\windows\system32\net.exe start dnscache
Wed May 13 08:50:20 2015 ERROR: Windows ipconfig command failed: returned error code 2
Wed May 13 08:50:20 2015 C:\windows\system32\ipconfig.exe /flushdns
Wed May 13 08:50:20 2015 C:\windows\system32\ipconfig.exe /registerdns
Wed May 13 08:50:23 2015 End net commands...

This is the message I get from the Windows Explorer:

Windows cannot access \\192.168.68.50\directory

Check the spelling of the name. Otherwise, there might be a problem with your network.  To
try to identify and resolve network problems, click Diagnose.

Error code: 0x80004005
Unspecified error

If I bring the machine into the central office, the File Explorer works just fine. It is just when I try to access across the VPN.

Thanks for the help.

dirkus

OK, I think I know what is going on. It appears that the TUN adapter is initiated as a PUBLIC interface, not a PRIVATE interface. This means that Windows filters the smb connections due to security concerns. I couldn't find a way to change the TUN interface to be a private network.

My fix for this was to install a new OpenVPN router instead of using the OpenVPN client on Windows 8.1.

Dirkus