Windows 7 - can't connect to remote desktop

unknownsoldierx

I've done the basic setup by following the Easy Windows Guide. I am able to connect using the OpenVPN Connect client on my Android phone, but I can't do anything with it. My Android RDP client gives a 'connection refused' error. Even with Windows firewall disabled.

server.ovpn

port 1194
proto udp
dev tun
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh2048.pem"
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
tls-auth "C:\\Program Files\\OpenVPN\\config\\ta.key" 0
cipher AES-256-CBC
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

client.ovpn

client
dev tun
proto udp
remote my.dyndns_domain.net 55555
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\upstairs.crt"
key "C:\\Program Files\\OpenVPN\\config\\upstairs.key"
remote-cert-tls server
tls-auth ta.key 1
cipher AES-256-CBC
comp-lzo
verb 3

Traffic

unknownsoldierx wroteMy Android RDP client gives a 'connection refused' error. Even with Windows firewall disabled

To what IP address are you trying to connect from your phone ?

unknownsoldierx

I've tried the PCs LAN address (192.168.1.100) and localhost.

Traffic

Using 'localhost' will try to connect TO your phone .. which is not what you want.

Your phone does not know where 192.168.1.100 is ..

Why don't you try your server on 10.8.0.1 ?

unknownsoldierx

I was under the assumption that when connected to the VPN it would be no different that if I were on my LAN. I get it now. Connecting to 10.8.0.1 worked. Thanks!

Is there a way to change things so that I can use the same addresses over VPN as I do when on my LAN? I ask because I have a lot of apps for which I would prefer not to have to make multiple settings.

RDP is simple enough. I set up two profiles in the app, one for 192.168.1.100 for when I am at home, and one for 10.8.0.1 for when I am off the LAN.

But I have other apps on my phone that would be a real pain to configure and manage for two connection profiles. My file browser, for example, has a few dozen bookmarks to SMB shares on my LAN. I want to access those over the VPN as well, but making an extra set of bookmarks would be tedious and crowd the bookmarks menu.

Traffic

Time to read the official HOWTO:

unknownsoldierx

Changed the server.ovpn and bridged Local Area Network Adapter and tap-bridge. Set the bridge like this:

IP address: 192.168.1.100
sub mask: 255.255.255.0
default gateway: 192.168.1.1
Pref DNS: 192.168.1.1

Android app now gives me this error:

Tun interface setup fialed:
tun_prop_error: ifconfig addresses are not in the same /30 subnet (topology net30)

server.ovpn

port 1194
proto udp
dev tap
dev-node tap-bridge
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh2048.pem"
topology subnet
ifconfig-pool-persist ipp.txt
server-bridge 192.168.1.100 255.255.255.0 192.168.1.200 192.168.1.254
keepalive 10 120
tls-auth "C:\\Program Files\\OpenVPN\\config\\ta.key" 0
cipher AES-256-CBC
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

unknownsoldierx

Disregard my last post. I forgot to edit my config on my phone. Unfortunately, Open VPN Connect now gives me the error "Problem creating TAP tunnel. Sorry, but the Android VPN API doesn't currently support TAP-based tunnels." 🙁

Traffic

You absolutely do not need --dev tap or --server-bridge.

Just implement the HOWTO from 2nd the link above ^^^

unknownsoldierx

Sorry, but I don't get it.

Including multiple machines on the server side when using a routed VPN (dev tun)

Once the VPN is operational in a point-to-point capacity between client and server, it may be desirable to expand the scope of the VPN so that clients can reach multiple machines on the server network, rather than only the server machine itself.

That makes it sound like the machine that is hosting the server should already be accessible. Or is that to make it so that clients are routed to my LAN subnet?

I tried adding push "route 192.168.1.0 255.255.255.0" to my server config, but I still can't access SMB shares.

Traffic

unknownsoldierx wroteI tried adding push "route 192.168.1.0 255.255.255.0" to my server config,

You are using 192.168.1.0/24 which is a very bad choice of subnet for your server LAN .. You are strongly advised to change the entire LAN to a more unique subnet: eg. 192.168.167.0/24

unknownsoldierx wrotebut I still can't access SMB shares.

To use shares you must address them directly as browser will not work.

Use something like (on windows):

net use z: \\ip.address\share-name

You can use computer name instead of ip.address if you have a private DNS solution setup but that is not something I can help you with.

unknownsoldierx

Traffic wroteYou are using 192.168.1.0/24 which is a very bad choice of subnet for your server LAN .. You are strongly advised to change the entire LAN to a more unique subnet: eg. 192.168.167.0/24

I'm aware of that, but I don't have to worry about it just yet. If I get this working, then I'll go through the trouble of changing my subnet.

Traffic wroteTo use shares you must address them directly as browser will not work.

Use something like (on windows):
net use z: \\ip.address\share-name
You can use computer name instead of ip.address if you have a private DNS solution setup but that is not something I can help you with.

I've been trying with IP address, but I would like to eventually move back to using computer names. With the trouble I'm having getting this to work on Windows, I may go back to trying to get it to work on my DD-WRT router. It would allow me to use DNSmasq and hopefully have computer names working on the VPN.