Road-Warrior setup issue

raven

Hi,

since a few days i am desperatley failing in establishing a Road-Warrior setup using DD-WRT (using OpenVPN 2.3.6) on my router.
I know there are tons of these question out there already, but i tried to find a solution and failed so far.

My home network is in IP Range 192.168.1.0/24, my VPN networkt in 10.1.1.0/24

I tested the connection with my Windows 8.1 PC. The connection can be established but once connected i cannot reach (ping, access samba shares, etc.) any other machines. Neither in the VPN net nor in my home net.
I am aware that i have the knwon issue that Windows sees the VPN connection as "Unidentified network" which applies the firewall rules for a public network. So i haven't found a (working) solution for this yet.
Thus i tried connecting with another client, an Android Tablet. But the result is exactly the same.

So i hope someone can help me figuring out what i am missing.

DD-WRT firewall options

iptables -I INPUT 1 -p udp --dport 443 -j ACCEPT
iptables -I INPUT 3 -i tun2 -j ACCEPT
iptables -I FORWARD 3 -i tun2 -o tun2 -j ACCEPT
iptables -I FORWARD -i br0 -o tun2 -j ACCEPT
iptables -I FORWARD -i tun2 -o br0 -j ACCEPT

Server config

dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
keepalive 10 120
verb 3
mute 3
syslog
writepid /var/run/openvpnd.pid
management 127.0.0.1 14
management-log-cache 100
topology subnet
script-security 2
port 443
proto udp
cipher aes-256-cbc
auth sha512
client-connect /tmp/openvpn/clcon.sh
client-disconnect /tmp/openvpn/cldiscon.sh
client-config-dir /jffs/etc/openvpn/ccd
comp-lzo adaptive
tls-server
ifconfig-pool-persist /tmp/openvpn/ip-pool 86400
client-to-client
fast-io
tun-mtu 1500
mtu-disc yes
server 10.1.1.0 255.255.255.0
dev tun2
tun-ipv6
# Push routes to the client to allow it to reach other private subnets behind the server.
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 10.1.1.1"
persist-key
persist-tun
# this is is intended to be a workaround for windows’ unidentified network issue
route 0.0.0.0 0.0.0.0 10.1.1.1

client config

dev tun
proto udp
remote 192.168.1.1 443
cipher aes-256-cbc
auth sha512
resolv-retry infinite
nobind
persist-key
persist-tun
client
verb 3

<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</ca>

<cert>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
</key>

output "route print -4" (Windows 8.1 PC) [WITHOUT VPN CONNECTION]

===========================================================================
Interfaces
 30...00 ff 42 f4 87 83 ......TAP-Windows Adapter V9
  2...f4 b7 e2 16 6b 69 ......Ralink RT3290 802.11bgn Wi-Fi Adapter
 20...00 ff 16 fb 22 77 ......TAP-Win32 Adapter V9 for OpenVPN Accelerator
  9...f4 b7 e2 16 6b 6b ......Virtueller Microsoft-Adapter für direktes WiFi
  6...f4 b7 e2 16 6b 6a ......Bluetooth-Gerät (PAN)
  4...b4 b5 2f 86 19 1d ......Controller der Familie Realtek PCIe GBE
  1...........................Software Loopback Interface 1
  8...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
  7...00 00 00 00 00 00 00 e0 Microsoft-6zu4-Adapter
 21...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter #5
===========================================================================

IPv4-Routingtable
===========================================================================
Active Routes:
     IP                    Subnet          Gateway    Interface Metric
          0.0.0.0          0.0.0.0      192.168.1.1     192.168.1.61     10
        127.0.0.0        255.0.0.0   Auf Verbindung         127.0.0.1    306
        127.0.0.1  255.255.255.255   Auf Verbindung         127.0.0.1    306
  127.255.255.255  255.255.255.255   Auf Verbindung         127.0.0.1    306
      192.168.1.0    255.255.255.0   Auf Verbindung      192.168.1.61    266
     192.168.1.61  255.255.255.255   Auf Verbindung      192.168.1.61    266
    192.168.1.255  255.255.255.255   Auf Verbindung      192.168.1.61    266
        224.0.0.0        240.0.0.0   Auf Verbindung         127.0.0.1    306
        224.0.0.0        240.0.0.0   Auf Verbindung      192.168.1.61    266
  255.255.255.255  255.255.255.255   Auf Verbindung         127.0.0.1    306
  255.255.255.255  255.255.255.255   Auf Verbindung      192.168.1.61    266
===========================================================================

output "route print -4" (Windows 8.1 PC) [WHEN CONNECTED TO VPN]

===========================================================================
Interfaces
 30...00 ff 42 f4 87 83 ......TAP-Windows Adapter V9
  2...f4 b7 e2 16 6b 69 ......Ralink RT3290 802.11bgn Wi-Fi Adapter
 20...00 ff 16 fb 22 77 ......TAP-Win32 Adapter V9 for OpenVPN Accelerator
  9...f4 b7 e2 16 6b 6b ......Virtueller Microsoft-Adapter für direktes WiF
  6...f4 b7 e2 16 6b 6a ......Bluetooth-Gerät (PAN)
  4...b4 b5 2f 86 19 1d ......Controller der Familie Realtek PCIe GBE
  1...........................Software Loopback Interface 1
  8...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
  7...00 00 00 00 00 00 00 e0 Microsoft-6zu4-Adapter
 29...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter #3
 21...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter #5
===========================================================================

IPv4-Routingtable
===========================================================================
Active Routes:
     IP                     Subnet          Gateway    Interface Metric
          0.0.0.0          0.0.0.0      192.168.1.1     192.168.1.61     10
         10.1.1.0    255.255.255.0   Auf Verbindung          10.1.1.3    276
         10.1.1.3  255.255.255.255   Auf Verbindung          10.1.1.3    276
       10.1.1.255  255.255.255.255   Auf Verbindung          10.1.1.3    276
        127.0.0.0        255.0.0.0   Auf Verbindung         127.0.0.1    306
        127.0.0.1  255.255.255.255   Auf Verbindung         127.0.0.1    306
  127.255.255.255  255.255.255.255   Auf Verbindung         127.0.0.1    306
      192.168.1.0    255.255.255.0   Auf Verbindung      192.168.1.61    266
      192.168.1.0    255.255.255.0         10.1.1.1         10.1.1.3     20
     192.168.1.61  255.255.255.255   Auf Verbindung      192.168.1.61    266
    192.168.1.255  255.255.255.255   Auf Verbindung      192.168.1.61    266
        224.0.0.0        240.0.0.0   Auf Verbindung         127.0.0.1    306
        224.0.0.0        240.0.0.0   Auf Verbindung          10.1.1.3    276
        224.0.0.0        240.0.0.0   Auf Verbindung      192.168.1.61    266
  255.255.255.255  255.255.255.255   Auf Verbindung         127.0.0.1    306
  255.255.255.255  255.255.255.255   Auf Verbindung          10.1.1.3    276
  255.255.255.255  255.255.255.255   Auf Verbindung      192.168.1.61    266
===========================================================================

server log:

20150530 02:45:36 192.168.1.61:58577 TLS: Initial packet from [AF_INET]192.168.1.61:58577 sid=5eaef164 0ab35a8f
20150530 02:45:36 192.168.1.61:58577 VERIFY OK: depth=1 C=...
20150530 02:45:36 192.168.1.61:58577 VERIFY OK: depth=0 C=...
20150530 02:45:36 W 192.168.1.61:58577 WARNING: 'link-mtu' is used inconsistently local='link-mtu 1602' remote='link-mtu 1601'
20150530 02:45:36 W 192.168.1.61:58577 WARNING: 'comp-lzo' is present in local config but missing in remote config local='comp-lzo'
20150530 02:45:36 192.168.1.61:58577 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
20150530 02:45:36 192.168.1.61:58577 Data Channel Encrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
20150530 02:45:36 192.168.1.61:58577 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
20150530 02:45:36 192.168.1.61:58577 NOTE: --mute triggered...
20150530 02:45:36 192.168.1.61:58577 2 variation(s) on previous 3 message(s) suppressed by --mute
20150530 02:45:36 I 192.168.1.61:58577 [XXXX] Peer Connection Initiated with [AF_INET]192.168.1.61:58577
20150530 02:45:36 I XXXX/192.168.1.61:58577 MULTI_sva: pool returned IPv4=10.1.1.3 IPv6=(Not enabled)
20150530 02:45:36 XXXX/192.168.1.61:58577 OPTIONS IMPORT: reading client specific options from: /tmp/openvpn_cc_ba04d6ee0eb5557773a577167e73ed03.tmp
20150530 02:45:36 XXXX/192.168.1.61:58577 MULTI: Learn: 10.1.1.3 -> XXXX/192.168.1.61:58577
20150530 02:45:36 XXXX/192.168.1.61:58577 MULTI: primary virtual IP for XXXX/192.168.1.61:58577: 10.1.1.3
20150530 02:45:38 XXXX/192.168.1.61:58577 PUSH: Received control message: 'PUSH_REQUEST'
20150530 02:45:38 I XXXX/192.168.1.61:58577 send_push_reply(): safe_cap=940
20150530 02:45:38 XXXX/192.168.1.61:58577 SENT CONTROL [XXXX]: 'PUSH_REPLY route 192.168.1.0 255.255.255.0 dhcp-option DNS 10.1.1.1 route-gateway 10.1.1.1 topology subnet ping 10 ping-restart 120 ifconfig 10.1.1.3 255.255.255.0' (status=1)

client log:

Sat May 30 02:45:34 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar 19 2015
Sat May 30 02:45:34 2015 library versions: OpenSSL 1.0.1m 19 Mar 2015, LZO 2.08
Sat May 30 02:45:34 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sat May 30 02:45:34 2015 Need hold release from management interface, waiting...
Sat May 30 02:45:34 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sat May 30 02:45:35 2015 MANAGEMENT: CMD 'state on'
Sat May 30 02:45:35 2015 MANAGEMENT: CMD 'log all on'
Sat May 30 02:45:35 2015 MANAGEMENT: CMD 'hold off'
Sat May 30 02:45:35 2015 MANAGEMENT: CMD 'hold release'
Sat May 30 02:45:35 2015 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sat May 30 02:45:35 2015 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sat May 30 02:45:35 2015 UDPv4 link local: [undef]
Sat May 30 02:45:35 2015 UDPv4 link remote: [AF_INET]192.168.1.1:443
Sat May 30 02:45:35 2015 MANAGEMENT: >STATE:1432946735,WAIT,,,
Sat May 30 02:45:35 2015 MANAGEMENT: >STATE:1432946735,AUTH,,,
Sat May 30 02:45:35 2015 TLS: Initial packet from [AF_INET]192.168.1.1:443, sid=f2d57d81 f971528d
Sat May 30 02:45:35 2015 VERIFY OK: depth=1, C=....
Sat May 30 02:45:35 2015 VERIFY OK: depth=0, C=....
Sat May 30 02:45:35 2015 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1601', remote='link-mtu 1602'
Sat May 30 02:45:35 2015 WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
Sat May 30 02:45:35 2015 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat May 30 02:45:35 2015 Data Channel Encrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Sat May 30 02:45:35 2015 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sat May 30 02:45:35 2015 Data Channel Decrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Sat May 30 02:45:35 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sat May 30 02:45:35 2015 [YYYY] Peer Connection Initiated with [AF_INET]192.168.1.1:443
Sat May 30 02:45:36 2015 MANAGEMENT: >STATE:1432946736,GET_CONFIG,,,
Sat May 30 02:45:37 2015 SENT CONTROL [YYYY]: 'PUSH_REQUEST' (status=1)
Sat May 30 02:45:37 2015 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,dhcp-option DNS 10.1.1.1,route-gateway 10.1.1.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.1.1.3 255.255.255.0'
Sat May 30 02:45:37 2015 OPTIONS IMPORT: timers and/or timeouts modified
Sat May 30 02:45:37 2015 OPTIONS IMPORT: --ifconfig/up options modified
Sat May 30 02:45:37 2015 OPTIONS IMPORT: route options modified
Sat May 30 02:45:37 2015 OPTIONS IMPORT: route-related options modified
Sat May 30 02:45:37 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sat May 30 02:45:37 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat May 30 02:45:37 2015 MANAGEMENT: >STATE:1432946737,ASSIGN_IP,,10.1.1.3,
Sat May 30 02:45:37 2015 open_tun, tt->ipv6=0
Sat May 30 02:45:37 2015 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{42F48783-2D4C-4F7E-BB21-D6956D8C9AEF}.tap
Sat May 30 02:45:37 2015 TAP-Windows Driver Version 9.21 
Sat May 30 02:45:37 2015 Set TAP-Windows TUN subnet mode network/local/netmask = 10.1.1.0/10.1.1.3/255.255.255.0 [SUCCEEDED]
Sat May 30 02:45:37 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.1.1.3/255.255.255.0 on interface {42F48783-2D4C-4F7E-BB21-D6956D8C9AEF} [DHCP-serv: 10.1.1.254, lease-time: 31536000]
Sat May 30 02:45:37 2015 Successful ARP Flush on interface [30] {42F48783-2D4C-4F7E-BB21-D6956D8C9AEF}
Sat May 30 02:45:42 2015 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Sat May 30 02:45:42 2015 MANAGEMENT: >STATE:1432946742,ADD_ROUTES,,,
Sat May 30 02:45:42 2015 C:\WINDOWS\system32\route.exe ADD 192.168.1.0 MASK 255.255.255.0 10.1.1.1
Sat May 30 02:45:42 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Sat May 30 02:45:42 2015 Route addition via IPAPI succeeded [adaptive]
Sat May 30 02:45:42 2015 Initialization Sequence Completed
Sat May 30 02:45:42 2015 MANAGEMENT: >STATE:1432946742,CONNECTED,SUCCESS,10.1.1.3,192.168.1.1

thanks in advance!

Traffic

You need to check this:

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

raven

hi,

thanks for the reply.

Traffic wroteYou need to check this:
NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

i know. But this shouldn't be an issue i guess?
Because i test the connection LAN internally.

Traffic

raven wroteBecause i test the connection LAN internally

I presume you mean that your server and client are in the same LAN while you try to set up the VPN ..

If so, remove these items for testing:

raven wroteServer config
Code:
# Push routes to the client to allow it to reach other private subnets behind the server.
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 10.1.1.1"
# this is is intended to be a workaround for windows’ unidentified network issue
route 0.0.0.0 0.0.0.0 10.1.1.1

You can manually add a rule to Windows firewall to allow all VPN packets.

Finally: Re: Road-Warrior setup issue

Once you take your client "on the road" you will suffer from routing conflicts because your server LAN is 192.168.1.0/24

nataraj

Are you running openvpn as Administrator on the windows box? This is required for windows 7 and above.

Have you checked the log file on your server to make sure you are not getting any IPTABLES violations?

This Rule:

iptables -I FORWARD 3 -i tun2 -o tun2 -j ACCEPT

looks a little bit strange. Why do you have packets coming in and going out the same vpn interface?
Can you provide the output from:

iptables -L -v -n

Nataraj