[Closed] OpenVPN with Windows internal networking

webeindustry

Hi there,

I have mashed together a couple of guides to get my setup working as I like.

I followed this DO guide omitting a couple of steps relating to internet traffic. This setup is not meant for internet traffic, it's for a service on another port.

https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-16-04

I also used this guide to create a tunnel through the VPN and onto a second interface which would be assigned to an internal network.

https://community.openvpn.net/openvpn/wiki/BridgingAndRouting

So I have tested the setup and results are as follows. I can use my key on a remote machine to connect to vpn. At this point I can ping the eth1, eth0, and tun IP's. I can't get into any windows machines which are connected to the eth0 internal network.

Furthermore, none of my windows machines will ping each other. I think maybe my issue is less with openvpn and more with having a lack of skill hooking up a windows network through a mere switch. Something simple is missing.

If I were to statically assign IP with subnet in linux to this switch I would be able to ping. This isn't the case for windows machines so far.

How do I go about figuring this out?

I manually assign an IP address starting with 192.168.0.2 for my windows machines. Subnet is 255.255.255.0. No matter which value I set for default gateway it does not connect ,I have tried 192.168.0.1, 192.168.0.254, 10.8.0.1

webeindustry

Here is my server.conf:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh2048.pem
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.0.0 255.255.255.0"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
key-direction 0
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

My goal is to securely connect an artist to a remote render farm. The program is sketchup we're using v-ray distributed rendering. We can connect without the VPN. Servers are at my residence which has static IP block and fiber 300/300mbps package. It works well; however as is anyone can connect to the service and that's not okay.

So if I assign a static IP to each server the remote user can connect no issue. What I am trying to setup is a single static IP to the OpenVPN, then internal networking on the second NIC which connects to the same switch the other windows machines use.

Here is the current network scheme:

76.213.x.x public IP via enp6s0 on OpenVPN box
10.8.0.1 tun0 on OpenVPN
192.168.0.1 enp3s0 on OpenVPN box
192.168.0.2 Network Adapter 1 on Windows Client 1
192.168.0.3 Network Adapter 1 on Windows Client 2

If I ping 192.168.0.3 on WC1 there is no response, and vice versa.
If I ping 76.213.x.x, 192.168.0.1, 10.8.0.1 from a client connected to vpn there is resolution.
If I ping 76.213.x.x, 192.168.0.1, 10.8.0.1 from WCx there is no response.

So the network is established up to the point of interaction with WCx, and amongst WCx themselves.

TinCanTech

NOTE:

Your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet. Or any other LAN which uses the same subnet ...

:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

You are advised to change your server LAN to a more unique RFC1918 compliant subnet. f.e 192.168.143.0/24

webeindustry

Nonissue, my gateway only uses 192.168.1.x for DHCP.

I switched to 192.168.2.x with no change whatsoever...

webeindustry

Well I got the WCx computers to ping each other after disabling windows firewall, which is acceptable as they will not be connecting to internet.

I apply these firewall rules and still have no luck going from the OpenVPN to LAN machines, or from client connected to VPN to LAN machines.

iptables -I FORWARD -i tun0 -o enp3s0 -s 10.8.0.0/24 -d 192.168.2.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -I FORWARD -i tun0 -o enp6s0          -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -I FORWARD -i eth0 -o enp6s0 -s 192.168.2.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -t nat -I POSTROUTING -o enp6s0 -s 10.8.0.0/24 -j MASQUERADE
iptables -t nat -I POSTROUTING -o enp6s0 -s 192.168.2.0/24 -j MASQUERADE

webeindustry

crap, there's an eth0 in there. I will reboot and try again.

No change with:

iptables -I FORWARD -i tun0 -o enp3s0 -s 10.8.0.0/24 -d 192.168.2.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -I FORWARD -i tun0 -o enp6s0 -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -I FORWARD -i enp3s0 -o enp6s0 -s 192.168.2.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -t nat -I POSTROUTING -o enp6s0 -s 10.8.0.0/24 -j MASQUERADE
iptables -t nat -I POSTROUTING -o enp6s0 -s 192.168.2.0/24 -j MASQUERADE

Anyone have a clue? I'm out of ideas at this point.

webeindustry

It must be something to the firewall. I will patiently wait a reply while doing some homework.

Thanks!

http://imgur.com/a/GKxab

TinCanTech

From your server config:

webeindustry wrote

dev tun

which means you need routes:
HOWTO: Expanding the scope of the VPN to include additional machines

Or, you can make all your 192.168.x.x machines clients on the VPN as well .. (easy)

webeindustry

There's no reason to make each windows rig on the LAN connect directly to the VPN.

This is my current route table on the OpenVPN server:

root@openvpn:/etc/openvpn# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         7x.xx.xx.xx     0.0.0.0         UG    0      0        0 enp6s0
10.8.0.0        *               255.255.255.0   U     0      0        0 tun0
7x.xx.xx.xx     *               255.255.255.248 U     0      0        0 enp6s0
192.168.2.0     *               255.255.255.0   U     0      0        0 enp3s0

I will look through that guide to add the correct routes. Thank You.

webeindustry

I looked through that guide, can't find anything applicable at all. It's referring to the client side, nothing to do with the LAN.

webeindustry

For more information, see the OpenVPN Management Interface Documentation.

Expanding the scope of the VPN to include additional machines on either the client or server subnet.

Including multiple machines on the server side when using a routed VPN (dev tun)

Once the VPN is operational in a point-to-point capacity between client and server, it may be desirable to expand the scope of the VPN so that clients can reach multiple machines on the server network, rather than only the server machine itself.

For the purpose of this example, we will assume that the server-side LAN uses a subnet of 10.66.0.0/24 and the VPN IP address pool uses 10.8.0.0/24 as cited in the server directive in the OpenVPN server configuration file.

First, you must advertise the 10.66.0.0/24 subnet to VPN clients as being accessible through the VPN. This can easily be done with the following server-side config file directive:

push "route 10.66.0.0 255.255.255.0"
Next, you must set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24) to the OpenVPN server (this is only necessary if the OpenVPN server and the LAN gateway are different machines).

Make sure that you've enabled IP and TUN/TAP forwarding on the OpenVPN server machine.

All of this is already done and posted above. You can see my firewall rules to enable IP and TUN forwarding, and you can see my line for push "route ..." in the server.conf

TinCanTech

Every machine that is not a VPN client needs a route to the VPN. (It's called routing)

webeindustry

Are you going to continue to act like a jerk or actually help?

TinCanTech

This is a support forum for OpenVPN ..

If you need to learn routing try google or buy one of the many excellent books available here from our website:
https://openvpn.net/index.php/open-source/books.html

Good luck

webeindustry

Great, you have been no help whatsover, and a complete jerk from the first post. Thanks for that.

TinCanTech

You have all the information you need ..

For an explanation of why see: http://catb.org/~esr/faqs/smart-questions.html

You can also hire my services : tincanteksup <at> gmail

webeindustry

I see... continue to be a jerk, and then have the nerve to post your for hire sign at the end.

Absolutely ridiculous.

TinCanTech

You have no idea how difficult it is to teach people , who do not listen and then start throwing insults , like you ..

And why should I teach you routing .. for free ?

I have already provided all the information you need .. and you still insist on behaving as you do.

Hence, if you want professional support you can contact me.

Otherwise, you have the entire internet at your disposal via google.

webeindustry

That's preposterous. You have suggested multiple times things which were not at all on topic and not the best solution. You're not a teacher, and you're certainly not knowledgeable enough to help out.

TinCanTech

You know nothing, either about me or your own predicament .. which is why you behave like a brat.

I have over 4,000 post here and on other sites like superuser .. I know exactly how many people I have helped.