I am trying to follow this tutorial: https://www.outcoldman.com/en/archive/2014/10/21/ubuntu-as-a-home-server-part-2-openvpn/ . I only need the "access home server" part from it. I did almost everything from the server part, except this one: "To do that you will need to update Routing Tables on your devices, the easiest way to do that will be to add them to your home router (if it supports that). ". I did not find anything about routing tables on my router's admin pages. The router local IP is 192.168.0.1, the server local IP is 192.168.0.186. I have a dynamic DNS, let's call it example.ddns.net. I have the following configurations: This is my server configuration: [code]root@odroid-server:/etc/openvpn# cat odroid.conf | grep "^[^;#]" port 443 proto udp dev tun ca ca.crt cert example.ddns.net.crt key example.ddns.net.key dh dh2048.pem server 10.9.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "route 192.168.0.0 255.255.255.0" push "dhcp-option DNS 192.168.0.1" push "dhcp-option DOMAIN home" client-to-client keepalive 10 120 comp-lzo persist-key persist-tun status openvpn-status.log verb 3[/code] This is my client configuration currently: [code]root@odroid-server:/media/asmedia-hdd/vpn# cat client.conf | grep "^[^;#]" client dev tun proto udp remote my-server-1 1194 resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert client.crt key client.key ns-cert-type server comp-lzo verb 3[/code] I think I have to set "remote" to "example.ddns.net 443" and the "cert" and "key" fields too. My problem is with the routing tables. I guess I have to set them somewhere. The other problem is with the Windows 8.1 client. The default Windows VPN client does no support the usage of the generated keys. At least I did not find any option I could configure that. So I installed the OpenVPN client from here: https://openvpn.net/index.php/open-source/downloads.html . According to the readme file in the config folder, it requires .ovpn configuration files. From the tutorial I have only a .conf file and .crt, .key files, but no .ovpn file. I am not sure what to do about client configuration. Any idea about how to configure the client and the routing tables? (I have no idea what I am doing. :D)

[quote="Traffic"][quote="inf3rno"]The default Windows VPN client does no support the usage of the generated keys[/quote]What ever the [i]default Windows VPN client[/i] is, it is not compatible with openvpn. [quote="inf3rno"]So I installed the OpenVPN client from here: ... [/quote]that is the openvpn client which you need. [quote="inf3rno"]I have no idea what I am doing[/quote]Please read the HOWTO: [url]http://openvpn.net/index.php/open-source/documentation/howto.html[/url] [quote="inf3rno"]The router local IP is 192.168.0.1[/quote]Also, [list]NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create [b]routing conflicts[/b] if you connect to the VPN server from public locations such as internet cafes that use the same subnet.[/list] :arrow: [u]Never[/u] use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!: [list]You are advised to change your server LAN to a more unique [url=http://en.wikipedia.org/wiki/Private_network]RFC1918[/url] compliant subnet. f.e 192.168.143.0/24[/list] Also, ensure [url=https://community.openvpn.net/openvpn/wiki/265-how-do-i-enable-ip-forwarding]IP forwarding[/url] is enabled on your server.[/quote] I enabled IP forwarding on the ubuntu server this way: [code] nano /etc/sysctl.conf net.ipv4.ip_forward = 1 sysctl -p /etc/sysctl.conf[/code] and I added the missing route: [code]route add -net 10.9.0.0 netmask 255.255.255.0 gw 192.168.0.186[/code] I found the client configuration here: https://community.openvpn.net/openvpn/wiki/Easy_Windows_Guide#ClientConfigFiles I managed to connect with the client to the vpn server, but ofc. it does not do what I expected. It overrides the current network (192.168.0.x), which is not necessary a problem. I would be glad if I could use the same local IP-s as I use currently at home. I started a test HTTP server on 192.168.0.186:3002 on the server computer. I can access it without vpn connection. With vpn connection I cannot access it. Is there a way to debug this?

How to configure Windows client to access home server?

inf3rno

I am trying to follow this tutorial: https://www.outcoldman.com/en/archive/2014/10/21/ubuntu-as-a-home-server-part-2-openvpn/ . I only need the "access home server" part from it.

I did almost everything from the server part, except this one: "To do that you will need to update Routing Tables on your devices, the easiest way to do that will be to add them to your home router (if it supports that). ". I did not find anything about routing tables on my router's admin pages. The router local IP is 192.168.0.1, the server local IP is 192.168.0.186. I have a dynamic DNS, let's call it example.ddns.net. I have the following configurations:

This is my server configuration:

root@odroid-server:/etc/openvpn# cat odroid.conf | grep "^[^;#]"
port 443
proto udp
dev tun
ca ca.crt
cert example.ddns.net.crt
key example.ddns.net.key
dh dh2048.pem
server 10.9.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.0.0 255.255.255.0"
push "dhcp-option DNS 192.168.0.1"
push "dhcp-option DOMAIN home"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

This is my client configuration currently:

root@odroid-server:/media/asmedia-hdd/vpn# cat client.conf | grep "^[^;#]"
client
dev tun
proto udp
remote my-server-1 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
comp-lzo
verb 3

I think I have to set "remote" to "example.ddns.net 443" and the "cert" and "key" fields too.

My problem is with the routing tables. I guess I have to set them somewhere. The other problem is with the Windows 8.1 client. The default Windows VPN client does no support the usage of the generated keys. At least I did not find any option I could configure that. So I installed the OpenVPN client from here: https://openvpn.net/index.php/open-source/downloads.html . According to the readme file in the config folder, it requires .ovpn configuration files. From the tutorial I have only a .conf file and .crt, .key files, but no .ovpn file. I am not sure what to do about client configuration.

Any idea about how to configure the client and the routing tables? (I have no idea what I am doing. 😃)

Traffic

inf3rno wroteThe default Windows VPN client does no support the usage of the generated keys

What ever the default Windows VPN client is, it is not compatible with openvpn.

inf3rno wroteSo I installed the OpenVPN client from here: ...

that is the openvpn client which you need.

inf3rno wroteI have no idea what I am doing

Please read the HOWTO:
http://openvpn.net/index.php/open-source/documentation/howto.html

inf3rno wroteThe router local IP is 192.168.0.1

Also,

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

You are advised to change your server LAN to a more unique RFC1918 compliant subnet. f.e 192.168.143.0/24

Also, ensure IP forwarding is enabled on your server.

inf3rno

Traffic wrote
inf3rno wroteThe default Windows VPN client does no support the usage of the generated keys
What ever the default Windows VPN client is, it is not compatible with openvpn.

inf3rno wroteSo I installed the OpenVPN client from here: ...
that is the openvpn client which you need.

inf3rno wroteI have no idea what I am doing
Please read the HOWTO:
http://openvpn.net/index.php/open-source/documentation/howto.html

inf3rno wroteThe router local IP is 192.168.0.1
Also,
NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

You are advised to change your server LAN to a more unique RFC1918 compliant subnet. f.e 192.168.143.0/24
Also, ensure IP forwarding is enabled on your server.

I enabled IP forwarding on the ubuntu server this way:

	nano /etc/sysctl.conf
		net.ipv4.ip_forward = 1
	sysctl -p /etc/sysctl.conf

and I added the missing route:

route add -net 10.9.0.0 netmask 255.255.255.0 gw 192.168.0.186

I found the client configuration here: https://community.openvpn.net/openvpn/wiki/Easy_Windows_Guide#ClientConfigFiles

I managed to connect with the client to the vpn server, but ofc. it does not do what I expected. It overrides the current network (192.168.0.x), which is not necessary a problem. I would be glad if I could use the same local IP-s as I use currently at home. I started a test HTTP server on 192.168.0.186:3002 on the server computer. I can access it without vpn connection. With vpn connection I cannot access it.

Is there a way to debug this?

inf3rno

As I mentioned in my previous answer, which hasn't showed up yet (probably waiting for moderation), I managed to connect to the vpn server by turning on IP forwarding and configuring the vpn client. It overrides the local network more or less.

I cannot connect to a local HTTP server on the server computer, but I can connect to my samba shares. I am not sure whether it uses the local connection for that or the vpn. I am not sure how to debug this. I have the following logs (anonimified):

Wed Mar 02 13:31:28 2016 OpenVPN 2.3.10 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Feb  1 2016
Wed Mar 02 13:31:28 2016 Windows version 6.2 (Windows 8 or greater)
Wed Mar 02 13:31:28 2016 library versions: OpenSSL 1.0.1r  28 Jan 2016, LZO 2.09
Enter Management Password:
Wed Mar 02 13:31:28 2016 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Mar 02 13:31:28 2016 Need hold release from management interface, waiting...
Wed Mar 02 13:31:29 2016 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Mar 02 13:31:29 2016 MANAGEMENT: CMD 'state on'
Wed Mar 02 13:31:29 2016 MANAGEMENT: CMD 'log all on'
Wed Mar 02 13:31:29 2016 MANAGEMENT: CMD 'hold off'
Wed Mar 02 13:31:29 2016 MANAGEMENT: CMD 'hold release'
Wed Mar 02 13:31:30 2016 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Mar 02 13:31:30 2016 MANAGEMENT: >STATE:1456921890,RESOLVE,,,
Wed Mar 02 13:31:30 2016 UDPv4 link local: [undef]
Wed Mar 02 13:31:30 2016 UDPv4 link remote: [AF_INET]111.22.333.444:443
Wed Mar 02 13:31:30 2016 MANAGEMENT: >STATE:1456921890,WAIT,,,
Wed Mar 02 13:32:31 2016 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Wed Mar 02 13:32:31 2016 TLS Error: TLS handshake failed
Wed Mar 02 13:32:31 2016 SIGUSR1[soft,tls-error] received, process restarting
Wed Mar 02 13:32:31 2016 MANAGEMENT: >STATE:1456921951,RECONNECTING,tls-error,,
Wed Mar 02 13:32:31 2016 Restart pause, 2 second(s)
Wed Mar 02 13:32:33 2016 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Mar 02 13:32:33 2016 MANAGEMENT: >STATE:1456921953,RESOLVE,,,
Wed Mar 02 13:32:33 2016 UDPv4 link local: [undef]
Wed Mar 02 13:32:33 2016 UDPv4 link remote: [AF_INET]111.22.333.444:443
Wed Mar 02 13:32:33 2016 MANAGEMENT: >STATE:1456921953,WAIT,,,
Wed Mar 02 13:32:33 2016 MANAGEMENT: >STATE:1456921953,AUTH,,,
Wed Mar 02 13:32:33 2016 TLS: Initial packet from [AF_INET]111.22.333.444:443, sid=7ac6d541 4976fb02
Wed Mar 02 13:32:33 2016 VERIFY OK: depth=1, C=xx, ST=xxx, L=xxx, O=xxx, OU=xxx, CN=xxx CA, name=xxx, emailAddress=xxx@xxx.com
Wed Mar 02 13:32:33 2016 Validating certificate key usage
Wed Mar 02 13:32:33 2016 ++ Certificate has key usage  00a0, expects 00a0
Wed Mar 02 13:32:33 2016 VERIFY KU OK
Wed Mar 02 13:32:33 2016 Validating certificate extended key usage
Wed Mar 02 13:32:33 2016 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Wed Mar 02 13:32:33 2016 VERIFY EKU OK
Wed Mar 02 13:32:33 2016 VERIFY OK: depth=0, C=xx, ST=xxx, L=xxx, O=xxx, OU=xxx, CN=example.ddns.net, name=xxx, emailAddress=xxx@xxx.com
Wed Mar 02 13:32:34 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Mar 02 13:32:34 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Mar 02 13:32:34 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Mar 02 13:32:34 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Mar 02 13:32:34 2016 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Mar 02 13:32:34 2016 [example.ddns.net] Peer Connection Initiated with [AF_INET]111.22.333.444:443
Wed Mar 02 13:32:35 2016 MANAGEMENT: >STATE:1456921955,GET_CONFIG,,,
Wed Mar 02 13:32:36 2016 SENT CONTROL [example.ddns.net]: 'PUSH_REQUEST' (status=1)
Wed Mar 02 13:32:36 2016 PUSH: Received control message: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,dhcp-option DNS 192.168.0.1,dhcp-option DOMAIN home,route 10.9.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.9.0.6 10.9.0.5'
Wed Mar 02 13:32:36 2016 OPTIONS IMPORT: timers and/or timeouts modified
Wed Mar 02 13:32:36 2016 OPTIONS IMPORT: --ifconfig/up options modified
Wed Mar 02 13:32:36 2016 OPTIONS IMPORT: route options modified
Wed Mar 02 13:32:36 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Mar 02 13:32:36 2016 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 I=9 HWADDR=xx:xx:xx:xx:xx:xx
Wed Mar 02 13:32:36 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Mar 02 13:32:36 2016 MANAGEMENT: >STATE:1456921956,ASSIGN_IP,,10.9.0.6,
Wed Mar 02 13:32:36 2016 open_tun, tt->ipv6=0
Wed Mar 02 13:32:36 2016 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{AAAAAAAA-1234-1234-1234-FFFFFFFFFFFF}.tap
Wed Mar 02 13:32:36 2016 TAP-Windows Driver Version 9.21 
Wed Mar 02 13:32:36 2016 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.9.0.6/255.255.255.252 on interface {AAAAAAAA-1234-1234-1234-FFFFFFFFFFFF} [DHCP-serv: 10.9.0.5, lease-time: 31536000]
Wed Mar 02 13:32:36 2016 Successful ARP Flush on interface [20] {AAAAAAAA-1234-1234-1234-FFFFFFFFFFFF}
Wed Mar 02 13:32:41 2016 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Wed Mar 02 13:32:41 2016 MANAGEMENT: >STATE:1456921961,ADD_ROUTES,,,
Wed Mar 02 13:32:41 2016 C:\Windows\system32\route.exe ADD 192.168.0.0 MASK 255.255.255.0 10.9.0.5
Wed Mar 02 13:32:41 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Wed Mar 02 13:32:41 2016 Route addition via IPAPI succeeded [adaptive]
Wed Mar 02 13:32:41 2016 C:\Windows\system32\route.exe ADD 10.9.0.0 MASK 255.255.255.0 10.9.0.5
Wed Mar 02 13:32:41 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Wed Mar 02 13:32:41 2016 Route addition via IPAPI succeeded [adaptive]
Wed Mar 02 13:32:41 2016 Initialization Sequence Completed
Wed Mar 02 13:32:41 2016 MANAGEMENT: >STATE:1456921961,CONNECTED,SUCCESS,10.9.0.6,111.22.333.444
Wed Mar 02 14:32:35 2016 TLS: soft reset sec=-1 bytes=95616/0 pkts=1108/0
Wed Mar 02 14:32:35 2016 VERIFY OK: depth=1, C=xx, ST=xxx, L=xxx, O=xxx, OU=xxx, CN=xxx CA, name=xxx, emailAddress=xxx@xxx.com
Wed Mar 02 14:32:35 2016 Validating certificate key usage
Wed Mar 02 14:32:35 2016 ++ Certificate has key usage  00a0, expects 00a0
Wed Mar 02 14:32:35 2016 VERIFY KU OK
Wed Mar 02 14:32:35 2016 Validating certificate extended key usage
Wed Mar 02 14:32:35 2016 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Wed Mar 02 14:32:35 2016 VERIFY EKU OK
Wed Mar 02 14:32:35 2016 VERIFY OK: depth=0, C=xx, ST=xxx, L=xxx, O=xxx, OU=xxx, CN=example.ddns.net, name=xxx, emailAddress=xxx@xxx.com
Wed Mar 02 14:32:35 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Mar 02 14:32:35 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Mar 02 14:32:35 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Mar 02 14:32:35 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Mar 02 14:32:35 2016 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA

Censored:

111.22.333.444 - dynamic IP addr
C=xx, ST=xxx, L=xxx, O=xxx, OU=xxx, CN=xxx, name=xxx, emailAddress=xxx@xxx.com - vpn server details
xx:xx:xx:xx:xx:xx - client computer mac address 
AAAAAAAA-1234-1234-1234-FFFFFFFFFFFF - not sure, probably some connection identifier