Hello everyone, first of all I want to thank everyone contributing here. Tons of useful info, but I have to admit - even with all this info I could not make my vpn going and hope someone can help... (Jumping ahead I can tell that my client seem to connect to server, but I can't ping/access anything inside my home network, including vpn server itself. ) my home setup is very simple: cable modem - router - few computers and printers. Router still has it's default ip 192.168.0.1 and it acts as dns. The server that I want to becomey vpn server is an old laptop with ubuntu 14.04 and local ip 192.168.0.125 (router knows to assign ip by mac address ). What I want is to be able to vpn into my home network from my laptop (named viao) wherever I am. After some reading it appears bridged configuration is the way to go, so... here is what I did: forwarded port 1194 to server ( ip 192.168.0.125 ) changed server.conf as this:-------------------- # Bridge interface auto lo iface lo inet loopback auto br0 iface br0 inet dhcp bridge_ports eth0 iface eth0 inet manual up ip link set $IFACE up promisc on down ip link set $IFACE down promisc off[/i] --------------------- and this is what ifconfig reports: ---------------------------- br0 Link encap:Ethernet HWaddr 00:1c:7e:ca:dd:21 inet addr:192.168.0.125 Bcast:192.168.0.255 Mask:255.255.255.0 inet6 addr: fe80::21c:7eff:feca:dd21/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:269403 errors:0 dropped:0 overruns:0 frame:0 TX packets:229034 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:52744047 (52.7 MB) TX bytes:47450435 (47.4 MB) eth0 Link encap:Ethernet HWaddr 00:1c:7e:ca:dd:21 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:305813 errors:0 dropped:9 overruns:0 frame:0 TX packets:230779 errors:0 dropped:0 overruns:0 carrier:0 collisions:5113 txqueuelen:1000 RX bytes:68105614 (68.1 MB) TX bytes:48699697 (48.6 MB) Interrupt:20 Memory:ff9c0000-ff9e0000 lo ... --------------------- for server start I chose to go with ubuntu way of starting server 'service openvpn start' (tried bridge-start/bridge-stop scripts as described on this site, but then gave up... ) here is my server config:--------------- port 1194 ;proto tcp-server proto udp dev tap0 ;dev tun ;dev-node MyTap ca ca.crt cert server.crt key server.key # This file should be kept secret dh dh4096.pem ifconfig-pool-persist ipp.txt server-bridge 192.168.0.125 255.255.255.0 192.168.0.200 192.168.0.210 ;push "route 192.168.0.0 255.255.255.0" #push "redirect-gateway" keepalive 10 120 tls-auth wv.key 0 # This file is secret ;cipher BF-CBC # Blowfish (default) ;cipher AES-128-CBC # AES ;cipher DES-EDE3-CBC # Triple-DES comp-lzo max-clients 2 ;user nobody ;group nobody persist-key persist-tun status openvpn-status.log log-append openvpn.log verb 3 ;mute 20 ------------------------ here is server log after starting :----------------- Tue Feb 23 11:05:33 2016 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec 1 2014 Tue Feb 23 11:05:33 2016 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the L$ Tue Feb 23 11:05:33 2016 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the $ Tue Feb 23 11:05:33 2016 Diffie-Hellman initialized with 4096 bit key Tue Feb 23 11:05:33 2016 WARNING: file 'server.key' is group or others accessible Tue Feb 23 11:05:33 2016 Control Channel Authentication: using 'wv.key' as a OpenVPN static key file Tue Feb 23 11:05:33 2016 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Feb 23 11:05:33 2016 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Feb 23 11:05:33 2016 Socket Buffers: R=[212992->131072] S=[212992->131072] Tue Feb 23 11:05:33 2016 TUN/TAP device tap0 opened Tue Feb 23 11:05:33 2016 TUN/TAP TX queue length set to 100 Tue Feb 23 11:05:33 2016 UDPv4 link local (bound): [undef] Tue Feb 23 11:05:33 2016 UDPv4 link remote: [undef] Tue Feb 23 11:05:33 2016 MULTI: multi_init called, r=256 v=256 Tue Feb 23 11:05:33 2016 IFCONFIG POOL: base=192.168.0.200 size=11, ipv6=0 Tue Feb 23 11:05:33 2016 ifconfig_pool_read(), in='viao,192.168.0.200', TODO: IPv6 Tue Feb 23 11:05:33 2016 succeeded -> ifconfig_pool_set() Tue Feb 23 11:05:33 2016 IFCONFIG POOL LIST Tue Feb 23 11:05:33 2016 viao,192.168.0.200 Tue Feb 23 11:05:33 2016 Initialization Sequence Completed ---------------- Here is my client config ----------------------- dev tap ;dev tun ;dev-node MyTap ;proto tcp-client proto udp remote .com 1194 resolv-retry infinite nobind ;user nobody ;group nobody persist-key persist-tun ca ca.crt cert viao.crt key viao.key ns-cert-type server tls-auth wv.key 1 comp-lzo verb 3 ;mute 20 -------------------------------------------------- after I start vpn on the client here is the client log:------------- Tue Feb 23 11:06:46 2016 OpenVPN 2.3.10 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Feb 1 2016 Tue Feb 23 11:06:46 2016 Windows version 6.2 (Windows 8 or greater) Tue Feb 23 11:06:46 2016 library versions: OpenSSL 1.0.1r 28 Jan 2016, LZO 2.09 Enter Management Password: Tue Feb 23 11:06:46 2016 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340 Tue Feb 23 11:06:46 2016 Need hold release from management interface, waiting... Tue Feb 23 11:06:46 2016 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340 Tue Feb 23 11:06:46 2016 MANAGEMENT: CMD 'state on' Tue Feb 23 11:06:46 2016 MANAGEMENT: CMD 'log all on' Tue Feb 23 11:06:46 2016 MANAGEMENT: CMD 'hold off' Tue Feb 23 11:06:46 2016 MANAGEMENT: CMD 'hold release' Tue Feb 23 11:06:46 2016 Control Channel Authentication: using 'wv.key' as a OpenVPN static key file Tue Feb 23 11:06:46 2016 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Feb 23 11:06:46 2016 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Feb 23 11:06:46 2016 Socket Buffers: R=[65536->65536] S=[65536->65536] Tue Feb 23 11:06:46 2016 MANAGEMENT: >STATE:1456243606,RESOLVE,,, Tue Feb 23 11:06:46 2016 UDPv4 link local: [undef] Tue Feb 23 11:06:46 2016 UDPv4 link remote: [AF_INET]:1194 Tue Feb 23 11:06:46 2016 MANAGEMENT: >STATE:1456243606,WAIT,,, Tue Feb 23 11:07:25 2016 MANAGEMENT: >STATE:1456243645,AUTH,,, Tue Feb 23 11:07:25 2016 TLS: Initial packet from [AF_INET]:1194, sid=5763bf7d 1040a9d4 Tue Feb 23 11:07:26 2016 VERIFY OK: depth=1, ... Tue Feb 23 11:07:26 2016 VERIFY OK: nsCertType=SERVER Tue Feb 23 11:07:26 2016 VERIFY OK: depth=0,... Tue Feb 23 11:07:27 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key Tue Feb 23 11:07:27 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Feb 23 11:07:27 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key Tue Feb 23 11:07:27 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Feb 23 11:07:27 2016 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA Tue Feb 23 11:07:27 2016 [server] Peer Connection Initiated with [AF_INET]:1194 Tue Feb 23 11:07:28 2016 MANAGEMENT: >STATE:1456243648,GET_CONFIG,,, Tue Feb 23 11:07:30 2016 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1) Tue Feb 23 11:07:30 2016 PUSH: Received control message: 'PUSH_REPLY,route-gateway 192.168.0.125,ping 10,ping-restart 120,ifconfig 192.168.0.200 255.255.255.0' Tue Feb 23 11:07:30 2016 OPTIONS IMPORT: timers and/or timeouts modified Tue Feb 23 11:07:30 2016 OPTIONS IMPORT: --ifconfig/up options modified Tue Feb 23 11:07:30 2016 OPTIONS IMPORT: route-related options modified Tue Feb 23 11:07:30 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Tue Feb 23 11:07:30 2016 MANAGEMENT: >STATE:1456243650,ASSIGN_IP,,192.168.0.200, Tue Feb 23 11:07:30 2016 open_tun, tt->ipv6=0 Tue Feb 23 11:07:30 2016 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{3F27C6A6-D9EC-46F6-AED4-F85FE68F9218}.tap Tue Feb 23 11:07:30 2016 TAP-Windows Driver Version 9.21 Tue Feb 23 11:07:30 2016 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.0.200/255.255.255.0 on interface {3F27C6A6-D9EC-46F6-AED4-F85FE68F9218} [DHCP-serv: 192.168.0.0, lease-time: 31536000] Tue Feb 23 11:07:30 2016 Successful ARP Flush on interface [37] {3F27C6A6-D9EC-46F6-AED4-F85FE68F9218} Tue Feb 23 11:07:35 2016 TEST ROUTES: 0/0 succeeded len=0 ret=1 a=0 u/d=up Tue Feb 23 11:07:35 2016 Initialization Sequence Completed Tue Feb 23 11:07:35 2016 MANAGEMENT: >STATE:1456243655,CONNECTED,SUCCESS,192.168.0.200, ----------------- and here is what server log gets during client start:------------------- Tue Feb 23 11:07:19 2016 208.54.36.215:56610 TLS: Initial packet from [AF_INET]208.54.36.215:56610, sid=7fb5cdf7 f3390205 Tue Feb 23 11:07:21 2016 208.54.36.215:56610 VERIFY OK: depth=1, ... Tue Feb 23 11:07:21 2016 208.54.36.215:56610 VERIFY OK: depth=0, ... Tue Feb 23 11:07:21 2016 208.54.36.215:56610 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key Tue Feb 23 11:07:21 2016 208.54.36.215:56610 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Feb 23 11:07:21 2016 208.54.36.215:56610 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key Tue Feb 23 11:07:21 2016 208.54.36.215:56610 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Feb 23 11:07:21 2016 208.54.36.215:56610 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA Tue Feb 23 11:07:21 2016 208.54.36.215:56610 [viao] Peer Connection Initiated with [AF_INET]208.54.36.215:56610 Tue Feb 23 11:07:21 2016 viao/208.54.36.215:56610 MULTI_sva: pool returned IPv4=192.168.0.200, IPv6=(Not enabled) Tue Feb 23 11:07:24 2016 viao/208.54.36.215:56610 PUSH: Received control message: 'PUSH_REQUEST' Tue Feb 23 11:07:24 2016 viao/208.54.36.215:56610 send_push_reply(): safe_cap=940 Tue Feb 23 11:07:24 2016 viao/208.54.36.215:56610 SENT CONTROL [viao]: 'PUSH_REPLY,route-gateway 192.168.0.125,ping 10,ping-restart 120,ifconfig 192.168.0.200 255.255.255.0' (status=1) Tue Feb 23 11:07:24 2016 viao/208.54.36.215:56610 MULTI: Learn: 00:ff:3f:27:c6:a6 -> viao/208.54.36.215:56610 ---------------------------------- and here is what ipconfig reports on client after connect(client on wireless network):----------------- Ethernet adapter Ethernet: Media State . . . . . . . . . . . : Media disconnected Wireless LAN adapter Local Area Connection* 12: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Ethernet adapter Ethernet 2: Connection-specific DNS Suffix . : Link-local IPv6 Address . . . . . : fe80::2847:5ea8:1de4:1fc2%37 IPv4 Address. . . . . . . . . . . : 192.168.0.200 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : Wireless LAN adapter Wi-Fi: Connection-specific DNS Suffix . : Link-local IPv6 Address . . . . . : fe80::dc4f:c626:92c3:663%9 IPv4 Address. . . . . . . . . . . : 192.168.43.155 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.43.1 Tunnel adapter Teredo Tunneling Pseudo-Interface: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Tunnel adapter isatap.{3F27C6A6-D9EC-46F6-AED4-F85FE68F9218}: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Tunnel adapter isatap.{F504B906-FE82-4B0D-B3BA-0D64C4FA34C7}: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : -------------------------- and these are routes on client:------------ IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.43.1 192.168.43.155 25 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 192.168.0.0 255.255.255.0 On-link 192.168.0.200 276 192.168.0.200 255.255.255.255 On-link 192.168.0.200 276 192.168.0.255 255.255.255.255 On-link 192.168.0.200 276 192.168.43.0 255.255.255.0 On-link 192.168.43.155 281 192.168.43.155 255.255.255.255 On-link 192.168.43.155 281 192.168.43.255 255.255.255.255 On-link 192.168.43.155 281 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 192.168.43.155 281 224.0.0.0 240.0.0.0 On-link 192.168.0.200 276 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 192.168.43.155 281 255.255.255.255 255.255.255.255 On-link 192.168.0.200 276 ------------ So it looks like client connects using TAP-WIN32 device '[Ethernet 2]', receives IP 192.168.0.200 from vpn server - all as expected.. but I can't ping vpn server (192.168.0.125) or anything else inside my home network. When I look at network stats on my laptop - 'Ethernet 2' adapter sends packets but does not receive any. I tried to disable windows firewall and 'whitelisted' openvpn - no help... My server does not have any special firewall rules in it's iptables, just default 'ACCEPT all -- anywhere anywhere' Does anyone see any obvious problems with what I am doing? Is my problem due to subnet 192.168.0.x? Thank you. Val.

Please start with the HOWTO: [url=http://openvpn.net/index.php/open-source/documentation/howto.html]HOWTO: For OpenVPN Community Edition[/url]

[quote="valpal"]it appears bridged configuration is the way to go[/quote]I would advise you start with a normal tunnel not a bridged setup .. at least while you learn ;) [quote="valpal"]Router still has it's default ip 192.168.0.1[/quote]Not a good idea .. Why, [list]NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create [b]routing conflicts[/b] if you connect to the VPN server from public locations such as internet cafes that use the same subnet.[/list] :arrow: [u]Never[/u] use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!: [list]You are advised to change your server LAN to a more unique [url=http://en.wikipedia.org/wiki/Private_network]RFC1918[/url] compliant subnet. f.e 192.168.143.0/24[/list] Also, ensure [url=https://community.openvpn.net/openvpn/wiki/265-how-do-i-enable-ip-forwarding]IP forwarding[/url] is enabled on your server.

[quote="Traffic"]I would advise you start with a normal tunnel not a bridged setup .. at least while you learn ;) [/quote] The 'HOWTO' speaks about of 'routed or bridged VPN'. By 'normal tunnel' you mean 'routed', correct? In my reading it appeared that bridged setup is simpler because there is no need to define routes (that was the reason I chose it). Do you suggest 'routed' setup because it is easier to manage/configure/troubleshoot? [quote="Traffic"]Not a good idea ... [/quote] - This is where I would appreciate if someone could confirm to me that this is in fact the problem in my case. I agree that 192.168.0.x is a 'bad idea', but if changing it is not going to fix anything - I will change subnet later... [quote="Traffic"]Also, ensure [url=https://community.openvpn.net/openvpn/wiki/265-how-do-i-enable-ip-forwarding]IP forwarding[/url] is enabled on your server.[/quote] - that is needed if I switch to 'routing VPN' setup, correct? Thank you!

[quote="valpal"]tried bridge-start/bridge-stop scripts as described on this site, [b]but then gave up[/b]... ) here is my server config:--------------- .. [u]server-bridge[/u] 192.168.0.125 255.255.255.0 192.168.0.200 192.168.0.210[/quote]If you gave up then why are you using server-bridge ? Start your VPN server then post [b]route -n[/b] and [b]brctl show[/b]

Need help with openvpn setup (to vpn into home network)

valpal

Hello everyone,
first of all I want to thank everyone contributing here. Tons of useful info, but I have to admit - even with all this info I could not make my vpn going and hope someone can help...

(Jumping ahead I can tell that my client seem to connect to server, but I can't ping/access anything inside my home network, including vpn server itself. )

my home setup is very simple: cable modem - router - few computers and printers. Router still has it's default ip 192.168.0.1 and it acts as dns. The server that I want to becomey vpn server is an old laptop with ubuntu 14.04 and local ip 192.168.0.125 (router knows to assign ip by mac address ).

What I want is to be able to vpn into my home network from my laptop (named viao) wherever I am. After some reading it appears bridged configuration is the way to go, so...

here is what I did:
forwarded port 1194 to server ( ip 192.168.0.125 )

changed server.conf as this:--------------------
# Bridge interface
auto lo
iface lo inet loopback

auto br0
iface br0 inet dhcp
bridge_ports eth0

iface eth0 inet manual
up ip link set $IFACE up promisc on
down ip link set $IFACE down promisc off[/i]
---------------------

and this is what ifconfig reports: ----------------------------
br0 Link encap:Ethernet HWaddr 00:1c:7e:ca:dd:21
inet addr:192.168.0.125 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::21c:7eff:feca:dd21/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:269403 errors:0 dropped:0 overruns:0 frame:0
TX packets:229034 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:52744047 (52.7 MB) TX bytes:47450435 (47.4 MB)

eth0 Link encap:Ethernet HWaddr 00:1c:7e:ca:dd:21
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:305813 errors:0 dropped:9 overruns:0 frame:0
TX packets:230779 errors:0 dropped:0 overruns:0 carrier:0
collisions:5113 txqueuelen:1000
RX bytes:68105614 (68.1 MB) TX bytes:48699697 (48.6 MB)
Interrupt:20 Memory:ff9c0000-ff9e0000

lo ...
---------------------

for server start I chose to go with ubuntu way of starting server 'service openvpn start' (tried bridge-start/bridge-stop scripts as described on this site, but then gave up... )

here is my server config:---------------
port 1194

;proto tcp-server
proto udp

dev tap0
;dev tun

;dev-node MyTap

ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh4096.pem

ifconfig-pool-persist ipp.txt

server-bridge 192.168.0.125 255.255.255.0 192.168.0.200 192.168.0.210

;push "route 192.168.0.0 255.255.255.0"

#push "redirect-gateway"

keepalive 10 120

tls-auth wv.key 0 # This file is secret

;cipher BF-CBC # Blowfish (default)
;cipher AES-128-CBC # AES
;cipher DES-EDE3-CBC # Triple-DES

comp-lzo
max-clients 2

;user nobody
;group nobody

persist-key
persist-tun

status openvpn-status.log
log-append openvpn.log
verb 3
;mute 20
------------------------

here is server log after starting :-----------------
Tue Feb 23 11:05:33 2016 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec 1 2014
Tue Feb 23 11:05:33 2016 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the L$
Tue Feb 23 11:05:33 2016 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the $
Tue Feb 23 11:05:33 2016 Diffie-Hellman initialized with 4096 bit key
Tue Feb 23 11:05:33 2016 WARNING: file 'server.key' is group or others accessible
Tue Feb 23 11:05:33 2016 Control Channel Authentication: using 'wv.key' as a OpenVPN static key file
Tue Feb 23 11:05:33 2016 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb 23 11:05:33 2016 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb 23 11:05:33 2016 Socket Buffers: R=[212992->131072] S=[212992->131072]
Tue Feb 23 11:05:33 2016 TUN/TAP device tap0 opened
Tue Feb 23 11:05:33 2016 TUN/TAP TX queue length set to 100
Tue Feb 23 11:05:33 2016 UDPv4 link local (bound): [undef]
Tue Feb 23 11:05:33 2016 UDPv4 link remote: [undef]
Tue Feb 23 11:05:33 2016 MULTI: multi_init called, r=256 v=256
Tue Feb 23 11:05:33 2016 IFCONFIG POOL: base=192.168.0.200 size=11, ipv6=0
Tue Feb 23 11:05:33 2016 ifconfig_pool_read(), in='viao,192.168.0.200', TODO: IPv6
Tue Feb 23 11:05:33 2016 succeeded -> ifconfig_pool_set()
Tue Feb 23 11:05:33 2016 IFCONFIG POOL LIST
Tue Feb 23 11:05:33 2016 viao,192.168.0.200
Tue Feb 23 11:05:33 2016 Initialization Sequence Completed
----------------

Here is my client config -----------------------
dev tap
;dev tun

;dev-node MyTap

;proto tcp-client
proto udp

remote <-mydomain->.com 1194
resolv-retry infinite
nobind

;user nobody
;group nobody

persist-key
persist-tun

ca ca.crt
cert viao.crt
key viao.key
ns-cert-type server
tls-auth wv.key 1

comp-lzo
verb 3
;mute 20
--------------------------------------------------

after I start vpn on the client here is the client log:-------------
Tue Feb 23 11:06:46 2016 OpenVPN 2.3.10 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Feb 1 2016
Tue Feb 23 11:06:46 2016 Windows version 6.2 (Windows 8 or greater)
Tue Feb 23 11:06:46 2016 library versions: OpenSSL 1.0.1r 28 Jan 2016, LZO 2.09
Enter Management Password:
Tue Feb 23 11:06:46 2016 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Feb 23 11:06:46 2016 Need hold release from management interface, waiting...
Tue Feb 23 11:06:46 2016 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Feb 23 11:06:46 2016 MANAGEMENT: CMD 'state on'
Tue Feb 23 11:06:46 2016 MANAGEMENT: CMD 'log all on'
Tue Feb 23 11:06:46 2016 MANAGEMENT: CMD 'hold off'
Tue Feb 23 11:06:46 2016 MANAGEMENT: CMD 'hold release'
Tue Feb 23 11:06:46 2016 Control Channel Authentication: using 'wv.key' as a OpenVPN static key file
Tue Feb 23 11:06:46 2016 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb 23 11:06:46 2016 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb 23 11:06:46 2016 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Feb 23 11:06:46 2016 MANAGEMENT: >STATE:1456243606,RESOLVE,,,
Tue Feb 23 11:06:46 2016 UDPv4 link local: [undef]
Tue Feb 23 11:06:46 2016 UDPv4 link remote: [AF_INET]<-pub IP->:1194
Tue Feb 23 11:06:46 2016 MANAGEMENT: >STATE:1456243606,WAIT,,,
Tue Feb 23 11:07:25 2016 MANAGEMENT: >STATE:1456243645,AUTH,,,
Tue Feb 23 11:07:25 2016 TLS: Initial packet from [AF_INET]<-pub IP->:1194, sid=5763bf7d 1040a9d4
Tue Feb 23 11:07:26 2016 VERIFY OK: depth=1, ...
Tue Feb 23 11:07:26 2016 VERIFY OK: nsCertType=SERVER
Tue Feb 23 11:07:26 2016 VERIFY OK: depth=0,...
Tue Feb 23 11:07:27 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Feb 23 11:07:27 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb 23 11:07:27 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Feb 23 11:07:27 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb 23 11:07:27 2016 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Tue Feb 23 11:07:27 2016 [server] Peer Connection Initiated with [AF_INET]<-pub IP->:1194
Tue Feb 23 11:07:28 2016 MANAGEMENT: >STATE:1456243648,GET_CONFIG,,,
Tue Feb 23 11:07:30 2016 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue Feb 23 11:07:30 2016 PUSH: Received control message: 'PUSH_REPLY,route-gateway 192.168.0.125,ping 10,ping-restart 120,ifconfig 192.168.0.200 255.255.255.0'
Tue Feb 23 11:07:30 2016 OPTIONS IMPORT: timers and/or timeouts modified
Tue Feb 23 11:07:30 2016 OPTIONS IMPORT: --ifconfig/up options modified
Tue Feb 23 11:07:30 2016 OPTIONS IMPORT: route-related options modified
Tue Feb 23 11:07:30 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Feb 23 11:07:30 2016 MANAGEMENT: >STATE:1456243650,ASSIGN_IP,,192.168.0.200,
Tue Feb 23 11:07:30 2016 open_tun, tt->ipv6=0
Tue Feb 23 11:07:30 2016 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{3F27C6A6-D9EC-46F6-AED4-F85FE68F9218}.tap
Tue Feb 23 11:07:30 2016 TAP-Windows Driver Version 9.21
Tue Feb 23 11:07:30 2016 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.0.200/255.255.255.0 on interface {3F27C6A6-D9EC-46F6-AED4-F85FE68F9218} [DHCP-serv: 192.168.0.0, lease-time: 31536000]
Tue Feb 23 11:07:30 2016 Successful ARP Flush on interface [37] {3F27C6A6-D9EC-46F6-AED4-F85FE68F9218}
Tue Feb 23 11:07:35 2016 TEST ROUTES: 0/0 succeeded len=0 ret=1 a=0 u/d=up
Tue Feb 23 11:07:35 2016 Initialization Sequence Completed
Tue Feb 23 11:07:35 2016 MANAGEMENT: >STATE:1456243655,CONNECTED,SUCCESS,192.168.0.200,<-pub IP->
-----------------

and here is what server log gets during client start:-------------------
Tue Feb 23 11:07:19 2016 208.54.36.215:56610 TLS: Initial packet from [AF_INET]208.54.36.215:56610, sid=7fb5cdf7 f3390205
Tue Feb 23 11:07:21 2016 208.54.36.215:56610 VERIFY OK: depth=1, ...
Tue Feb 23 11:07:21 2016 208.54.36.215:56610 VERIFY OK: depth=0, ...
Tue Feb 23 11:07:21 2016 208.54.36.215:56610 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Feb 23 11:07:21 2016 208.54.36.215:56610 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb 23 11:07:21 2016 208.54.36.215:56610 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Feb 23 11:07:21 2016 208.54.36.215:56610 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb 23 11:07:21 2016 208.54.36.215:56610 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Tue Feb 23 11:07:21 2016 208.54.36.215:56610 [viao] Peer Connection Initiated with [AF_INET]208.54.36.215:56610
Tue Feb 23 11:07:21 2016 viao/208.54.36.215:56610 MULTI_sva: pool returned IPv4=192.168.0.200, IPv6=(Not enabled)
Tue Feb 23 11:07:24 2016 viao/208.54.36.215:56610 PUSH: Received control message: 'PUSH_REQUEST'
Tue Feb 23 11:07:24 2016 viao/208.54.36.215:56610 send_push_reply(): safe_cap=940
Tue Feb 23 11:07:24 2016 viao/208.54.36.215:56610 SENT CONTROL [viao]: 'PUSH_REPLY,route-gateway 192.168.0.125,ping 10,ping-restart 120,ifconfig 192.168.0.200 255.255.255.0' (status=1)
Tue Feb 23 11:07:24 2016 viao/208.54.36.215:56610 MULTI: Learn: 00:ff:3f:27:c6:a6 -> viao/208.54.36.215:56610
----------------------------------

and here is what ipconfig reports on client after connect(client on wireless network):-----------------
Ethernet adapter Ethernet:

Media State . . . . . . . . . . . : Media disconnected

Wireless LAN adapter Local Area Connection* 12:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Ethernet adapter Ethernet 2:

Connection-specific DNS Suffix . :
Link-local IPv6 Address . . . . . : fe80::2847:5ea8:1de4:1fc2%37
IPv4 Address. . . . . . . . . . . : 192.168.0.200
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :

Wireless LAN adapter Wi-Fi:

Connection-specific DNS Suffix . :
Link-local IPv6 Address . . . . . : fe80::dc4f:c626:92c3:663%9
IPv4 Address. . . . . . . . . . . : 192.168.43.155
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.43.1

Tunnel adapter Teredo Tunneling Pseudo-Interface:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.{3F27C6A6-D9EC-46F6-AED4-F85FE68F9218}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.{F504B906-FE82-4B0D-B3BA-0D64C4FA34C7}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
--------------------------

and these are routes on client:------------
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.43.1 192.168.43.155 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.0.0 255.255.255.0 On-link 192.168.0.200 276
192.168.0.200 255.255.255.255 On-link 192.168.0.200 276
192.168.0.255 255.255.255.255 On-link 192.168.0.200 276
192.168.43.0 255.255.255.0 On-link 192.168.43.155 281
192.168.43.155 255.255.255.255 On-link 192.168.43.155 281
192.168.43.255 255.255.255.255 On-link 192.168.43.155 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.43.155 281
224.0.0.0 240.0.0.0 On-link 192.168.0.200 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.43.155 281
255.255.255.255 255.255.255.255 On-link 192.168.0.200 276
------------

So it looks like client connects using TAP-WIN32 device '[Ethernet 2]', receives IP 192.168.0.200 from vpn server - all as expected..

but I can't ping vpn server (192.168.0.125) or anything else inside my home network.

When I look at network stats on my laptop - 'Ethernet 2' adapter sends packets but does not receive any.

I tried to disable windows firewall and 'whitelisted' openvpn - no help...

My server does not have any special firewall rules in it's iptables, just default 'ACCEPT all -- anywhere anywhere'

Does anyone see any obvious problems with what I am doing? Is my problem due to subnet 192.168.0.x?

Thank you.

Val.

Traffic

Please start with the HOWTO:
HOWTO: For OpenVPN Community Edition

valpal

hi Traffic,

Thank you for the prompt response.

I was reading this HOWTO and following what it suggests for past few days... and read a lot of posts from other folks in this forum. Unfortunately nothing helped so far.

I wish there was a good step-by-step guide or method to trace how packets travel from client to server and back, so that I can pinpoint exact location of the broken link.

Thanks again.

Traffic

valpal wroteit appears bridged configuration is the way to go

I would advise you start with a normal tunnel not a bridged setup .. at least while you learn 😉

valpal wroteRouter still has it's default ip 192.168.0.1

Not a good idea ..

Why,

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

You are advised to change your server LAN to a more unique RFC1918 compliant subnet. f.e 192.168.143.0/24

Also, ensure IP forwarding is enabled on your server.

valpal

Traffic wroteI would advise you start with a normal tunnel not a bridged setup .. at least while you learn 😉

The 'HOWTO' speaks about of 'routed or bridged VPN'. By 'normal tunnel' you mean 'routed', correct? In my reading it appeared that bridged setup is simpler because there is no need to define routes (that was the reason I chose it). Do you suggest 'routed' setup because it is easier to manage/configure/troubleshoot?

Traffic wroteNot a good idea ...

- This is where I would appreciate if someone could confirm to me that this is in fact the problem in my case. I agree that 192.168.0.x is a 'bad idea', but if changing it is not going to fix anything - I will change subnet later...

Traffic wroteAlso, ensure IP forwarding is enabled on your server.

- that is needed if I switch to 'routing VPN' setup, correct?

Thank you!

Traffic

valpal wrotetried bridge-start/bridge-stop scripts as described on this site, but then gave up... )

here is my server config:---------------
..
server-bridge 192.168.0.125 255.255.255.0 192.168.0.200 192.168.0.210

If you gave up then why are you using server-bridge ?

Start your VPN server then post route -n and brctl show

valpal

Sorry if I wasn't clear, I 'gave up' using sample script to defines bridge interface br0 , and instead changed my etc/network/interfaces file as the following:
----
# Bridge interface
auto lo
iface lo inet loopback

auto br0
iface br0 inet dhcp
bridge_ports eth0

iface eth0 inet manual
up ip link set $IFACE up promisc on
down ip link set $IFACE down promisc off
-----

here are "route -n" and "brctl show ":

# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.0.1 0.0.0.0 UG 0 0 0 br0
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 br0

# brctl show
bridge name bridge id STP enabled interfaces
br0 8000.001c7ecadd21 no eth0

Thank you.

Traffic

Add your TAP to your bridge ...
:roll:

valpal

Oops... that seems important... thanks you...

I did: brctl addif br0 tap0

# brctl show
bridge name bridge id STP enabled interfaces
br0 8000.001c7ecadd21 no eth0
tap0

restarted client... still can't ping server (192.168.0.125) from client.

valpal

Is that 'disabled' under tap0 of any concern ?

#brctl showstp br0
br0
bridge id 8000.001c7ecadd21
designated root 8000.001c7ecadd21
root port 0 path cost 0
max age 20.00 bridge max age 20.00
hello time 2.00 bridge hello time 2.00
forward delay 15.00 bridge forward delay 15.00
ageing time 300.00
hello timer 1.95 tcn timer 0.00
topology change timer 0.00 gc timer 64.36
flags

eth0 (1)
port id 8001 state forwarding
designated root 8000.001c7ecadd21 path cost 19
designated bridge 8000.001c7ecadd21 message age timer 0.00
designated port 8001 forward delay timer 0.00
designated cost 0 hold timer 0.94
flags

tap0 (2)
port id 8002 state disabled
designated root 8000.001c7ecadd21 path cost 100
designated bridge 8000.001c7ecadd21 message age timer 0.00
designated port 8002 forward delay timer 0.00
designated cost 0 hold timer 0.00
flags

Traffic

Restart openvpn server ..
:mrgreen:

valpal

It may sound ridiculous... but I am struggling here... hope you have some more patience left for me.

first I tried to restart network interface and got a good reminder why I 'opted out' from using scripts - it got me disconnected and I had to take a trip home to bring server's network up...

Restarting vpn server on ubuntu using 'service openvpn restart' removes tap0 from bridge, so I am back where I started; Restarting using 'service openvpn soft-restart' or by running 'openvpn server.conf' did not do anything. I need to do some reading here... I understand that my goal now is to see 'state forwarding' under tap0... will focus on getting it.

Thank you.

valpal

Got this resolved, thank you.
I ended up creating tap0 adapter in etc/network/if-pre-up.d/ as described here: http://ubuntuforums.org/showthread.php?t=1067247

now tap0 is forwarding, vpn client connects, and I can see/ping computers in my home network - all good!

So far I can confirm that everything works perfectly when I connect using internet from hotspot on my phone, next I will try to connect from client's guest network. Hope it will work.

Thanks again.

gucci_archivist

valpal wrote Got this resolved, thank you.
I ended up creating tap0 adapter in etc/network/if-pre-up.d/ as described here: http://ubuntuforums.org/showthread.php?t=1067247

now tap0 is forwarding, vpn client connects, and I can see/ping computers in my home network - all good!

So far I can confirm that everything works perfectly when I connect using internet from hotspot on my phone, next I will try to connect from client's guest network. Hope it will work.

Thanks again.

@valpal, you never let us know if you were able to connect from the client's guest network. In all seriousness, this post helped me. Thanks!