i have a virtualized windows server 2012 machine with a static public ip hosted with iweb smart servers and it runs a voip server application, some of my clients are in countries where voip is blocked so i had given them expressvpn accounts to configure in their router and all works well but recently we wanted to install openvpn server on our machine so they can connect to that and place voip calls directly.
I installed openvpn server with the following config
local x.x.x.210
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
tls-server
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
duplicate-cn
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
cipher AES-128-CBC
tun-mtu 1500
fragment 1450
mssfix 1450
push "dhcp-option DNS 8.8.8.8"
the client was given this config
remote x.x.x.210 1194
proto udp
dev tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
tls-client
tls-auth ta.key 1
keepalive 10 120
comp-lzo
persist-key
persist-tun
verb 3
cipher AES-128-CBC
fast-io
resolv-retry infinite
nobind
pull
key-direction 1
route-method exe
route-delay 2
tun-mtu 1500
fragment 1450
mssfix 1450
with this the client is able to connect to the server and on server we setup RRAS so openvpn clients r natted and we also enable ip forwarding in registry.
Now the problem is when the tunnel is setup, the client is able to register to server using his voip device but the voip application seems to stop accepting registrations from other clients which connect directly without any vpn tunnel through the internet. It happens after a few mins, wireshark shows incoming traffic on the public ip but for some reason it doesnt reach the voip application, i check the firewall on the server and all inbound rules r all fine so i have no clue whats causing this. The strange part is even if i disconnect the vpn tunnel and even restart the voip application it doesnt come back to normal unless i restart the server.
route print before vpn is up
===========================================================================
Interface List
20...00 ff c8 bb 06 c7 ......TAP-Windows Adapter V9
13...00 17 3a 00 81 4e ......Xen Net Device Driver
1...........................Software Loopback Interface 1
16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
18...00 00 00 00 00 00 00 e0 Microsoft 6to4 Adapter
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 x.x.x.209 x.x.x.210 6
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
x.x.x.208 255.255.255.248 On-link x.x.x.210 261
x.x.x.210 255.255.255.255 On-link x.x.x.210 261
x.x.x.215 255.255.255.255 On-link x.x.x.210 261
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link x.x.x.210 261
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link x.x.x.210 261
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
10.0.0.0 255.0.0.0 10.224.187.33 1
0.0.0.0 0.0.0.0 x.x.x.209 1
===========================================================================
route print after vpn connected
===========================================================================
Interface List
20...00 ff c8 bb 06 c7 ......TAP-Windows Adapter V9
13...00 17 3a 00 81 4e ......Xen Net Device Driver
1...........................Software Loopback Interface 1
16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
18...00 00 00 00 00 00 00 e0 Microsoft 6to4 Adapter
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 x.x.x.209 x.x.x.210 6
10.8.0.0 255.255.255.0 10.8.0.2 10.8.0.1 20
10.8.0.0 255.255.255.252 On-link 10.8.0.1 276
10.8.0.1 255.255.255.255 On-link 10.8.0.1 276
10.8.0.3 255.255.255.255 On-link 10.8.0.1 276
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
x.x.x.208 255.255.255.248 On-link x.x.x.210 261
x.x.x.210 255.255.255.255 On-link x.x.x.210 261
x.x.x.215 255.255.255.255 On-link x.x.x.210 261
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.8.0.1 276
224.0.0.0 240.0.0.0 On-link x.x.x.210 261
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.8.0.1 276
255.255.255.255 255.255.255.255 On-link x.x.x.210 261
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
10.0.0.0 255.0.0.0 10.224.187.33 1
0.0.0.0 0.0.0.0 x.x.x.209 1
===========================================================================
