Hi there, I have mashed together a couple of guides to get my setup working as I like. I followed this DO guide omitting a couple of steps relating to internet traffic. This setup is not meant for internet traffic, it's for a service on another port. [url]https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-16-04[/url] I also used this guide to create a tunnel through the VPN and onto a second interface which would be assigned to an internal network. [url]https://community.openvpn.net/openvpn/wiki/BridgingAndRouting[/url] So I have tested the setup and results are as follows. I can use my key on a remote machine to connect to vpn. At this point I can ping the eth1, eth0, and tun IP's. I can't get into any windows machines which are connected to the eth0 internal network. Furthermore, none of my windows machines will ping each other. I think maybe my issue is less with openvpn and more with having a lack of skill hooking up a windows network through a mere switch. Something simple is missing. If I were to statically assign IP with subnet in linux to this switch I would be able to ping. This isn't the case for windows machines so far. How do I go about figuring this out? I manually assign an IP address starting with 192.168.0.2 for my windows machines. Subnet is 255.255.255.0. No matter which value I set for default gateway it does not connect ,I have tried 192.168.0.1, 192.168.0.254, 10.8.0.1

Here is my server.conf: [code]port 1194 proto udp dev tun ca ca.crt cert server.crt key server.key # This file should be kept secret dh dh2048.pem topology subnet server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "route 192.168.0.0 255.255.255.0" keepalive 10 120 tls-auth ta.key 0 # This file is secret key-direction 0 comp-lzo user nobody group nogroup persist-key persist-tun status openvpn-status.log verb 3 [/code] My goal is to securely connect an artist to a remote render farm. The program is sketchup we're using v-ray distributed rendering. We can connect without the VPN. Servers are at my residence which has static IP block and fiber 300/300mbps package. It works well; however as is anyone can connect to the service and that's not okay. So if I assign a static IP to each server the remote user can connect no issue. What I am trying to setup is a single static IP to the OpenVPN, then internal networking on the second NIC which connects to the same switch the other windows machines use. Here is the current network scheme: 76.213.x.x public IP via enp6s0 on OpenVPN box 10.8.0.1 tun0 on OpenVPN 192.168.0.1 enp3s0 on OpenVPN box 192.168.0.2 Network Adapter 1 on Windows Client 1 192.168.0.3 Network Adapter 1 on Windows Client 2 If I ping 192.168.0.3 on WC1 there is no response, and vice versa. If I ping 76.213.x.x, 192.168.0.1, 10.8.0.1 from a client connected to vpn there is resolution. If I ping 76.213.x.x, 192.168.0.1, 10.8.0.1 from WCx there is no response. So the network is established up to the point of interaction with WCx, and amongst WCx themselves.

NOTE:[list]Your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create [b]routing conflicts[/b] if you connect to the VPN server from public locations such as internet cafes that use the same subnet. Or [b]any other[/b] LAN which uses the same subnet ...[/list] :arrow: [u]Never[/u] use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!: [list]You are advised to change your server LAN to a more unique [url=http://en.wikipedia.org/wiki/Private_network]RFC1918[/url] compliant subnet. f.e 192.168.143.0/24[/list]

Nonissue, my gateway only uses 192.168.1.x for DHCP. I switched to 192.168.2.x with no change whatsoever...

Well I got the WCx computers to ping each other after disabling windows firewall, which is acceptable as they will not be connecting to internet. I apply these firewall rules and still have no luck going from the OpenVPN to LAN machines, or from client connected to VPN to LAN machines. [code]iptables -I FORWARD -i tun0 -o enp3s0 -s 10.8.0.0/24 -d 192.168.2.0/24 -m conntrack --ctstate NEW -j ACCEPT iptables -I FORWARD -i tun0 -o enp6s0 -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT iptables -I FORWARD -i eth0 -o enp6s0 -s 192.168.2.0/24 -m conntrack --ctstate NEW -j ACCEPT iptables -t nat -I POSTROUTING -o enp6s0 -s 10.8.0.0/24 -j MASQUERADE iptables -t nat -I POSTROUTING -o enp6s0 -s 192.168.2.0/24 -j MASQUERADE [/code]

crap, there's an eth0 in there. I will reboot and try again. No change with: [quote]iptables -I FORWARD -i tun0 -o enp3s0 -s 10.8.0.0/24 -d 192.168.2.0/24 -m conntrack --ctstate NEW -j ACCEPT iptables -I FORWARD -i tun0 -o enp6s0 -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT iptables -I FORWARD -i enp3s0 -o enp6s0 -s 192.168.2.0/24 -m conntrack --ctstate NEW -j ACCEPT iptables -t nat -I POSTROUTING -o enp6s0 -s 10.8.0.0/24 -j MASQUERADE iptables -t nat -I POSTROUTING -o enp6s0 -s 192.168.2.0/24 -j MASQUERADE[/quote] Anyone have a clue? I'm out of ideas at this point.

It must be something to the firewall. I will patiently wait a reply while doing some homework. Thanks! [url]http://imgur.com/a/GKxab[/url]

From your server config:[quote="webeindustry"][code]dev tun[/code][/quote]which means you need routes: [url=http://openvpn.net/index.php/open-source/documentation/howto.html#scope]HOWTO: Expanding the scope of the VPN to include additional machines[/url] Or, you can make all your 192.168.x.x machines clients on the VPN as well .. (easy)

There's no reason to make each windows rig on the LAN connect directly to the VPN. This is my current route table on the OpenVPN server: [code]root@openvpn:/etc/openvpn# route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default 7x.xx.xx.xx 0.0.0.0 UG 0 0 0 enp6s0 10.8.0.0 * 255.255.255.0 U 0 0 0 tun0 7x.xx.xx.xx * 255.255.255.248 U 0 0 0 enp6s0 192.168.2.0 * 255.255.255.0 U 0 0 0 enp3s0 [/code] I will look through that guide to add the correct routes. Thank You.

I looked through that guide, can't find anything applicable at all. It's referring to the client side, nothing to do with the LAN.

[quote] For more information, see the OpenVPN Management Interface Documentation. Expanding the scope of the VPN to include additional machines on either the client or server subnet. Including multiple machines on the server side when using a routed VPN (dev tun) Once the VPN is operational in a point-to-point capacity between client and server, it may be desirable to expand the scope of the VPN so that clients can reach multiple machines on the server network, rather than only the server machine itself. For the purpose of this example, we will assume that the server-side LAN uses a subnet of 10.66.0.0/24 and the VPN IP address pool uses 10.8.0.0/24 as cited in the server directive in the OpenVPN server configuration file. First, you must advertise the 10.66.0.0/24 subnet to VPN clients as being accessible through the VPN. This can easily be done with the following server-side config file directive: push "route 10.66.0.0 255.255.255.0" Next, you must set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24) to the OpenVPN server (this is only necessary if the OpenVPN server and the LAN gateway are different machines). Make sure that you've enabled IP and TUN/TAP forwarding on the OpenVPN server machine.[/quote] All of this is already done and posted above. You can see my firewall rules to enable IP and TUN forwarding, and you can see my line for push "route ..." in the server.conf

[Closed] OpenVPN with Windows internal networking

disqualified

Crazy man .. you don't even know your own gateway:

webeindustry wroteNonissue, my gateway only uses 192.168.1.x for DHCP

but your network is:

webeindustry wroteHere is the current network scheme:

76.213.x.x public IP via enp6s0 on OpenVPN box
10.8.0.1 tun0 on OpenVPN
192.168.0.1 enp3s0 on OpenVPN box
192.168.0.2 Network Adapter 1 on Windows Client 1
192.168.0.3 Network Adapter 1 on Windows Client 2

Not possible to help .. especially with the attitude ..

Keep up the good work TCT :mrgreen:

webeindustry

I'm sorry, what? I don't know my own gateway?

You people are very weird, and obviously incompetent.

I'm finding much more help elsewhere.

int3nt

webeindustry wroteI'm sorry, what? I don't know my own gateway?

The evidence does support that.

webeindustry wroteI'm finding much more help elsewhere.

TinCanTech wroteyou have the entire internet at your disposal via google

We can help with Openvpn .. if you can post accurate details.

Traffic

webeindustry wroteI followed this DO guide

Always start with the official howto:
https://openvpn.net/index.php/open-source/documentation/howto.html

webeindustry

int3nt wrote
webeindustry wroteI'm sorry, what? I don't know my own gateway?
The evidence does support that.

webeindustry wroteI'm finding much more help elsewhere.
TinCanTech wroteyou have the entire internet at your disposal via google
We can help with Openvpn .. if you can post accurate details.

No. The evidence supports that guy not having a clue what he's talking about.

I'm done with this forum. There's a clear lack of intuition and common sense vibe going on here.

My network is setup, and I will not be coming here again.

« Previous Page