[Solved] Forward from VPN to extranl IPs and server LAN

beethoven

Hi everybody, I just changed linux server and have to migrate to Windows 2012 R2 server.
Tried to migrate settings from the linux box to windows box but still a problem I can't solve myself... I think I am really near but not figuring out where to go to solve it.
The goal should be from OVPN client to reach LAN behind the server and forward some specific external ip addresses

OVPN Client LAN 192.168.10.X gw 192.168.10.254

OVPN SERVER LAN 192.168.1.X gw 192.168.1.1 DNS 192.168.1.1

Server configuration:
port 1194
dev tun
dev-node OpenVPN
tls-server
ca "mycertficatepath.crt"
cert "mycertficatepath.crt"
key "mykeypath.key"
dh "path.pem"

mode server

ifconfig 10.8.0.1 10.8.0.2
ifconfig-pool 10.8.0.4 10.8.0.255
ifconfig-pool-persist ipp.txt

push "route10.8.0.1 255.255.255.255"
push "route 192.168.1.0 255.255.255.0"
push " route XXX.XXX.XXX.XXX 255.255.255.255" #internet single IP address to be routed from vpn client to internet through ovpn server

push "dcp-option DNS 192.168.1.1"

keepalive 10 120
inactive 600

route 10.8.0.0 255.255.255.0

persist-tun
persist-key

client configuration:
port 1194
dev tun
remote server.ip.address

tls-client
ca path.crt
cert path.crt
key path.key

pull
verb3

Now my client gets 10.8.0.6 IP and server is on 10.8.0.1. I can succesfully ping and connect to server services on 10.8.0.1
I was not able to ping LAN server address 192.168.1.A
On linux box it was enough to "enable forwarding" whatever by command line or graphic interface and it worked.
I googled a bit and found to change a DWORD registry key to allow windows to forward traffic to external: Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurentControlSet\Services\Tcpip\parameters IPEnableRouter to 1
Now I am able to ping 192.168.1.A from client and connect to services on server LAN address but no way to ping othe server LAN machines or forward traffic to external internet IP.
Ping says request timeout
If I do a traceroute I get 19ms [10.8.0.1] and then 29 times * * * Timeout request
Same behaviour for internet ip address to be forwarded.
Like packages got sticked to ovpn server. I found also a post to add some routes, tried adding but no difference, but maybe I did not understood where to add such route tables addition...
What am I missing to make it work correctly??
Many thanks for help!

beethoven

I tried suggestions from this post https://forums.openvpn.net/topic7806.html topic 7806 but result it is a mess... no way to ping anything, even server on its ovpn address 10.8.0.1
Started the service as described and shared connection with ovpn TAP device.

Traffic

Hi,

take your configuration back to how it was with your first post, as you were almost there and then implement the Windows NAT-Hack solution:
https://community.openvpn.net/openvpn/wiki/NatHack

It is the equivalent to Linux iptables NAT solution.

Also,

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

beethoven

Hi Traffic, thank you very much for your help!

Actually I reverted to first configuration. I opened the topic suggested but I am stopped on point 3:
netsh routing ip nat install
on my windows server 2012 R2 command shell it returns
"Impossible to find command: routing ip nat install"
If I access to netsh and give help command I have as result those possible commands:

..
?
abort
add
advfirewall
alias
branchcache
bridge
bye
commit
delete
dhcpclient
dnsclient
dump
exec
exit
firewall
help
http
interface
ipsec
ipsecdosprotection
lan
namespace
nap
netio
offline
online
popd
pushd
quit
ras
rpc
set
show
trace
unalias
wfp
winhttp
winsock

and this sub-contest
 advfirewall branchcache bridge dhcpclient dnsclient firewall http interface ips
ec ipsecdosprotection lan namespace nap netio ras rpc trace wfp winhttp winsock

Googling a bit sounds like this command not more available in windows server 2012?
I found an article on another site (I think here is not possible to link outside articles..), but googling netsh routing ip nat install windows server 2012 R2 it is 3rd result from deploymentresearch, but do not fully understand if it is the same...

Do you have idea on howto do it or another way to configure it? Should I try to install the routing and remote access role and try to configure it (maybe GUI configuration available there?)

Many thanks for help, waiting hint from you.

Traffic

Hint:

If you can not NAT then you must Route.

BTW:
You must NAT at some point .. probably your network router is doing NAT even now.

beethoven

Hi Traffic, thanks for the hint ... then I miss the way to route it correctly.
Yes I am doing a kind of NAT, my adsl router has NAT service by virtual server function, to forward traffic request from external to the computer where ovpn server is installed I set rule to forward traffic on 1194 ports to internal server ip address, from there it goes to ovpn server that it is reachable; but then from there it stops and does not go out of TAP driver onto outside...

I already put route instruction on client by
push "route 192.168.1.0 255.255.255.0"
Should I put also instruction on server
route 192.168.1.0 255.255.255.0 ?

Should I look directly to adsl modem/router and add a route there:
actually destination 192.168.1.0 mask 24 through gateway 192.168.1.1
should I add also some static routing here ? But what kind of routing?
Destination 192.168.1.0 mask 24 gateway 192.168.1.X (ovpn server LAN address) or will get in conflict with existing? Or should I route 10.8.0.0 mask 24 through gateway 192.168.1.X (ovpn server LAN address)?

I asked for help because I am going around in circle but cannot find out where is the way to follow, I am going into confusion, lost in the packet flow...

Many thanks for your help up to now!

EDIT:
Just tried now, added static route to home adsl modem/router which is also gateway, to destination 10.8.0.0 mask 24 gateway 192.168.1.X metric 5 because I do not know what it is. Now ping and it is working! All LAN is accessible!
It is working also traffic on external internet IP Address!
I would like to put solved on topic title, putting on subject here.

Traffic

beethoven wroteadded static route to home adsl modem/router which is also gateway

That is the full routed solution. 8-)

beethoven wroteI would like to put solved on topic

I'll ask a Mod to update for you.