Setting up special case MultiSinglepoint

dragneel

Hello,
I wanted to set up a Multi-Singlepoint connection and need some help or info. The config should be as follows: The server and all clients should form an own new VPN, which cannot reach the LAN behind all clients (only server and clients can be accessed). Each client uses its own internet connection (internet traffic is not routed through server). So basically all clients can see each other and communicate or reach the server. The server itself is set up on Ubuntu 16.04.1 LTS x32 and all clients use Win7 x64.

Server: The necessary port UDP 1194 is forwarded in the router.
Clients: Firewall rules are set for TAP Adapter and all tested games are allowed.

All clients can ping the server or each other and the network shows all participating clients. Broadcasts are possible tested with the game warcraft3, it works without problems. The problem is if I start games like Borderlands2 or Dying Light it doesn't recognize opened LAN sessions. Do I have to do some binding to the VPN IP? Or is the server/client config faulty? Maybe somebody has an idea.

Server.conf:

mode server
tls-server
local 192.168.178.101 
proto udp            
port 1194          
dev tap0              
ifconfig 192.168.1.1 255.255.255.0                                   
server-bridge 192.168.1.1 255.255.255.0 192.168.1.10 192.168.1.110   
max-clients 100                                                        
ifconfig-pool-persist ipp.txt 0				             
client-to-client					               
ca ca.crt                     
cert xx.dyndns.com.crt   
key xx.dyndns.com.key 
dh dh2048.pem         
tls-auth ta.key 0     
status vpn-status.log 
verb 3                
mute 20               
user vpn_xx
group vpn_xx
persist-key   
persist-tun   
tun-mtu 1500  
tun-mtu-extra 32 
keepalive 10 120

Client.ovpn:

client
tls-client
dev tap
dev-node MyTap
remote xx.dyndns.com
port 1194
proto udp
nobind
ca ca.crt
cert client1.crt
key client1.key
tls-auth ta.key 1
ns-cert-type server
verb 3
mute 20
route-method exe
route-delay 2
persist-key
persist-tun
tun-mtu 1500
tun-mtu-extra 32

openvpn-output message:

Wed Aug 24 17:21:37 2016 OpenVPN 2.3.11 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on May 10 2016
Wed Aug 24 17:21:37 2016 Windows version 6.1 (Windows 7) 64bit
Wed Aug 24 17:21:37 2016 library versions: OpenSSL 1.0.1t  3 May 2016, LZO 2.09
Enter Private Key Password:
Wed Aug 24 17:21:41 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Aug 24 17:21:41 2016 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Wed Aug 24 17:21:41 2016 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 24 17:21:41 2016 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 24 17:21:41 2016 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Aug 24 17:21:41 2016 UDPv4 link local: [undef]
Wed Aug 24 17:21:41 2016 UDPv4 link remote: [AF_INET]217.231.222.73:1194
Wed Aug 24 17:21:41 2016 TLS: Initial packet from [AF_INET]217.231.222.73:1194, sid=463a22d5 378377fd
Wed Aug 24 17:21:41 2016 VERIFY OK: depth=1, C=DE, ST=Unknown, L=Unknown, O=xxx, OU=games, CN=xxxx.dyndns.com CA, name=xx, emailAddress=xxxxx
Wed Aug 24 17:21:41 2016 VERIFY OK: nsCertType=SERVER
Wed Aug 24 17:21:41 2016 VERIFY OK: depth=0, C=DE, ST=Unknown, L=Unknown, O=xxx, OU=games, CN=xxxx.dyndns.com, name=xx, emailAddress=xxxxx
Wed Aug 24 17:21:41 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Aug 24 17:21:41 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 24 17:21:41 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Aug 24 17:21:41 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 24 17:21:41 2016 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AE S256-GCM-SHA384, 2048 bit RSA
Wed Aug 24 17:21:41 2016 [xx.dyndns.com] Peer Connection Initiated with [AF_INET]217.231.222.73:1194
Wed Aug 24 17:21:43 2016 SENT CONTROL [xx.dyndns.com]: 'PUSH_REQUEST' (status=1)
Wed Aug 24 17:21:43 2016 PUSH: Received control message: 'PUSH_REPLY,route-gateway 192.168.1.1,ping 10,ping-restart 120,ifconfig 192.168.1.10 255.255.255.0'
Wed Aug 24 17:21:43 2016 OPTIONS IMPORT: timers and/or timeouts modified
Wed Aug 24 17:21:43 2016 OPTIONS IMPORT: --ifconfig/up options modified
Wed Aug 24 17:21:43 2016 OPTIONS IMPORT: route-related options modified
Wed Aug 24 17:21:43 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Aug 24 17:21:43 2016 open_tun, tt->ipv6=0
Wed Aug 24 17:21:43 2016 TAP-WIN32 device [MyTap] opened: \\.\Global\{F74F9189-5C8F-4DF9-9514-F1CD2A523111}.tap
Wed Aug 24 17:21:43 2016 TAP-Windows Driver Version 9.9
Wed Aug 24 17:21:43 2016 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.1.10/255.255.255.0 on interface {F74F9189-5C8F-4DF9-9514-F1CD2A523111} [DHCP-serv: 192.168.1.0, lease-time: 31536000]
Wed Aug 24 17:21:43 2016 Successful ARP Flush on interface [16] {F74F9189-5C8F-4DF9-9514-F1CD2A523111}
Wed Aug 24 17:21:45 2016 TEST ROUTES: 0/0 succeeded len=0 ret=1 a=0 u/d=up
Wed Aug 24 17:21:45 2016 Initialization Sequence Completed

TinCanTech

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

You are advised to change your server LAN to a more unique RFC1918 compliant subnet. f.e 192.168.143.0/24

dragneel

sure thank you for the reply 🙂 The IP is not the problem at the moment. Since it is only a configuration on the server side it can easily be changed. Thx for the notice.

TinCanTech

You are using 192.168.1.0/24 on your server-bridge and you are passing out IPs in that subnet to your clients.
Probably some of those clients use that subnet .. so you almost certainly have a network conflict or two ..

dragneel

they are all unused whether on clients nor on server side, but I will change them for further usage.
The network is working for File exchanging, Ping, many games (Spellforce, Borderlands 2, Warcraft3, Left 4 dead etc.) but Dying Light seems to be an exception ...
The game itself recommends a NAT.