[Solved] Connect more than one client at the same time

elmoxol

Hi

I have a server and 2 client working perfect separately.
But how i can connect both client at the same time? How i have to set up my server to accept 2 connections at the same time?
When the second client is connected while the first one is connected it receives the same IP than first one and the first one is disconnected.

I tried adding "max-clients 2" to server config file with no luck.

Thks in advance
Elmo

TinCanTech

See --duplicate-cn in The Manual v23x :geek:

elmoxol

TinCanTech wroteSee --duplicate-cn in The Manual v23x :geek:

Not supposed to be unsafe?
furthermore, my clients have no the same common name...

Just replying here will be better TinCanTech... because of that i opened a new topic...

thks again

elmoxol

OK, i solved it adding duplicate-cn in my server config file. But why i have to use it if my client have differente names? I mean clients certs are differente, each one have yours:
Client1.crt - Client1.key
Client2.crt - Client2.key

Another question, how can i say one of this client to be different config?
i.e For my Android client redirect all traffic through VPN and not for my Work PC.

I was reading about creating folders for different clients but i dont undestand anything!
<create-config-client ccd> and tried creating a folder with my android client cert name with a file also named as client cert.ovpn but did not work... dont know...

Thks a lot

TinCanTech

elmoxol wrotewhy i have to use it if my client have differente names? I mean clients certs are differente, each one have yours:
Client1.crt - Client1.key
Client2.crt - Client2.key

Clearly you have done something wrong .. like used the same client for both devices.

elmoxol wroteI was reading about creating folders for different clients but i dont undestand anything!

I advise you create a new PKI and do it carefully.

I would advise you read the entire HOWTO.

elmoxol

just a moment...

elmoxol

Yes, you're right..again. Sorry, my mistake.. again.
I build them again with different common names (i set them up with server's name because i did not take care, so...) Now is working fine without duplicate-cn... fuck, sorry.

So now i am trying to set android client config in a different way that work's PC. I want my android client redirects all traffic through VPN Server so i create a folder in .\openvpn\config\ named clients, and inside i set up a file with Android's common name in order to get a different set up.
I said in that:
push "redirect-gateway def1"
push "dchp-option DNS 8.8.8.8"
and received again "bar source address from client 192.168.181.10, packet dropped" message.
And can not go to the internet in my Android. 192.168.181.10 is my android's wlan ip.
Works PC connected at the same time works fine. (not going all traffic through VPN)
thks again
Elmo

TinCanTech

elmoxol wroteYes, you're right..again. Sorry, my mistake.. again.

and received again "bar source address from client 192.168.181.10, packet dropped" message.
And can not go to the internet in my Android. 192.168.181.10 is my android's wlan ip.

Again .. the HOWTO explains:
HOWTO: Expanding the scope of the VPN to include additional machines

elmoxol

it is pushed in server.opvn file. But i configured it again in specific client file, just in case, but did not work.
Can access shares but not going to the internet. i dont understand anything at this point.

i wrote in client specific file:
push redirect-gateway ...
push dhcp option dns ...
push route 10.0.0.0 255.255.255.0 (home lan)

thks

elmoxol

Hi,
nevermind. All is fine with OVPN ... fails my internet connection sharing at home.
I use internet connection sharing at home to go to the internet through VPN with my Android client. The problem is it fails in a minute, dont know why. If a unshare and share it again, it works fine for a few seconds. After that chrome in Android said ERR_NETWORK_CHANGED and can not go to the internet again. If a unshare and share it again it works... so the problem is not my OVPN config but my internet sharing connection at home (W10).

thks very much for your fantastic help.
Cheers,
Elmo

TinCanTech

I would be interested to know if you find out the cause and if/how you fix it.

Thank you for your positive feedback 8-)

elmoxol

Hi everyone,

I finished so all tasks with OVPN. You can mark as solved this topic.

I have at now all i want working fine. Thks TinCanTech for your time, help and patience. I solved all my problems with your help. Have now server working fine and 2 clients working perfect at the same time:
Work place PC - connected behind a proxy just for using my home PC as local (shares, RDP...)
Android Phone connected routing all traffic through VPN for using home internet connection and shares.

I want to share all configs i have done just in case it helps other people:

First of all say that i dont set up any static route, in my case was not necessary. In order to give access to my network i just share my internet connection at home. (I have an ethernet card only and a tun virtual nic)
I assum you have created all certs and keys you will need (take care to select a different common name for each client cert when prompted build-ca client) So now just left copy each client certs on each client.

My server config says:

# Which local IP address should OpenVPN
# listen on? (optional)
local 0.0.0.0
# Which TCP/UDP port should OpenVPN listen on?
port xxxxx (port number to connect to)
# TCP or UDP server?
proto tcp (i use tcp for accessing behind a proxy, but recommended and much better UDP protocol if possible)
# "dev tun" will create a routed IP tunnel,
# "dev tap" will create an ethernet tunnel.
dev tun
ca ca.crt
cert server.crt
key server.key
client-config-dir yourclientsdir (if wanted)
# Diffie hellman parameters.
# Generate your own with:
# openssl dhparam -out dh2048.pem 2048
dh dh2048.pem (recommended 2048, have to modify key_length in vars file before building dh)
tls-auth ta.key 0 (for more security)
# Configure server mode and supply a VPN subnet
server 10.0.1.0 255.255.255.0 (vpn subnet as you wish)
# Maintain a record of client <-> virtual IP address
ifconfig-pool-persist ipp.txt
push "route 10.0.0.0 255.255.255.0" (home lan subnet)
keepalive 10 120
# Select a cryptographic cipher.
# This config item must be copied to
# the client config file as well.
cipher AES-256-CBC
comp-lzo
# The persist options will try to avoid
# accessing certain resources on restart
# that may no longer be accessible because
# of the privilege downgrade.
persist-key
persist-tun
# Output a short status file showing
# current connections, truncated
# and rewritten every minute.
status openvpn-status.log
# Set the appropriate level of log
# file verbosity.
#
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 4

My work place PC client connects only to home lan through VPN (shares, RDP...) Internet at work:

client
dev tun
proto tcp
remote OpenVPNServerPublicIP Port
resolv-retry infinite
nobind
persist-key
persist-tun
#Proxy config
http-proxy-option VERSION 1.1
http-proxy proxy.domain.name port auth.file basic
ca ca.crt
cert client.crt
key client.key
cipher AES-256-CBC
remote-cert-tls server
tls-auth ta.key 1
comp-lzo
verb 4

Android Client redirects all traffic through VPN, config says:

client
dev tun
proto tcp
remote OpenVPNServerPublicIP Port
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert Androidclient.crt
key Androidclient.key
remote-cert-tls server
tls-auth ta.key 1
cipher AES-256-CBC
comp-lzo
verb 4

For this to work i have needed to create a dir .\openvpn\config\clients folder and inside it create a file (without extension) saying:

push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

And added a line in server.ovpn config file client-config-dir yourclientsdir

And that is all i have done.

I hope it helps other people.

Thank you very much for your help.
OpenVPN is the best i tried! Cheers!

Elmo

elmoxol

TinCanTech wrote I would be interested to know if you find out the cause and if/how you fix it.

Thank you for your positive feedback 8-)

I just set up ICS (internet connection sharing) and Windows Firewall services as automatic (Windows firewall itself is disabled. I dont use it) and restart them. I think something was going on bad with them at the moment so, just restart them and have solved. And also have to allow free total access from vpn subnet to my network in my firewall IDS (not rules really), a system that will be in charge of monitoring the behavior of a network to detect and report any unauthorized intrusions, network attacks... I use Eset's Smart Security. Was blocking some traffic.

Elmo