Hey guys
I'm new to all this and have an issue where the solution may be obvious, but I just don't get it right, even after reading a lot articles.
I'm able to connect to the VPN server successfully. But I can't ping/access any other IP/device except the server itself, even with ipforwarding enabled.
This is my setup:
LAN: 192.168.10.x on 255.255.255.0
My Modem/Router: 192.168.10.10
IP of OpenVPN: 192.168.10.107 (running on a Jail on FreeNAS (FreeBSD))
server.conf
local 192.168.10.107
port 8443
proto udp
dev tun
ca /usr/local/etc/openvpn/pki/ca.crt
cert /usr/local/etc/openvpn/pki/issued/VPNJAIL.crt
key /usr/local/etc/openvpn/pki/private/VPNJAIL.key # This file should be kept secret
dh /usr/local/etc/openvpn/pki/dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /usr/local/etc/openvpn/ipp.txt
push "route 192.168.10.0 255.255.255.0"
keepalive 10 120
tls-auth /usr/local/etc/openvpn/pki/private/ta.key 0 # This file is secret
comp-lzo
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
verb 3
ipfw.rules
ipfw -q -f flush
ipfw -q nat 1 config if epair4b
ipfw -q add nat 1 all from 10.8.0.0/24 to any out via epair4b
ipfw -q add nat 1 all from any to any in via epair4b
Stuff in /etc/rc.conf
openvpn_enable="YES"
openvpn_if="tun"
openvpn_configfile="/usr/local/etc/openvpn/server.conf"
openvpn_dir="/usr/local/etc/openvpn/"
cloned_interfaces="tun"
gateway_enable="YES"
firewall_enable="YES"
firewall_script="/usr/local/etc/ipfw.rules"
ifconfig on VPN server
root@vpnjail:/ # ifconfig
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
inet 127.0.0.1 netmask 0xff000000
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
epair4b: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8<VLAN_MTU>
ether 02:ff:70:00:09:0b
inet 192.168.10.107 netmask 0xffffff00 broadcast 192.168.10.255
nd6 options=9<PERFORMNUD,IFDISABLED>
media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
status: active
tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
options=80000<LINKSTATE>
inet 10.8.0.1 --> 10.8.0.2 netmask 0xffffffff
nd6 options=9<PERFORMNUD,IFDISABLED>
Opened by PID 77092
root@vpnjail:/ #
client config
client
dev tun
proto udp
remote [my vpnserver IP] 8443
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert VPNCLIENT.crt
key VPNCLIENT.key
tls-auth ta.key 1
comp-lzo
verb 3
Connection log
Wed Sep 07 11:07:03 2016 OpenVPN 2.3.12 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug 23 2016
Wed Sep 07 11:07:03 2016 Windows version 6.1 (Windows 7) 64bit
Wed Sep 07 11:07:03 2016 library versions: OpenSSL 1.0.1t 3 May 2016, LZO 2.09
Enter Management Password:
Wed Sep 07 11:07:03 2016 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Sep 07 11:07:03 2016 Need hold release from management interface, waiting...
Wed Sep 07 11:07:03 2016 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Sep 07 11:07:03 2016 MANAGEMENT: CMD 'state on'
Wed Sep 07 11:07:03 2016 MANAGEMENT: CMD 'log all on'
Wed Sep 07 11:07:03 2016 MANAGEMENT: CMD 'hold off'
Wed Sep 07 11:07:03 2016 MANAGEMENT: CMD 'hold release'
Wed Sep 07 11:07:03 2016 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Wed Sep 07 11:07:05 2016 MANAGEMENT: CMD 'password [...]'
Wed Sep 07 11:07:05 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Sep 07 11:07:05 2016 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Wed Sep 07 11:07:05 2016 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 07 11:07:05 2016 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 07 11:07:05 2016 Socket Buffers: R=[8192->8192] S=[64512->64512]
Wed Sep 07 11:07:05 2016 MANAGEMENT: >STATE:1473239225,RESOLVE,,,
Wed Sep 07 11:07:05 2016 UDPv4 link local: [undef]
Wed Sep 07 11:07:05 2016 UDPv4 link remote: [AF_INET][my vpnserver IP]:8443
Wed Sep 07 11:07:05 2016 MANAGEMENT: >STATE:1473239225,WAIT,,,
Wed Sep 07 11:07:05 2016 MANAGEMENT: >STATE:1473239225,AUTH,,,
Wed Sep 07 11:07:05 2016 TLS: Initial packet from [AF_INET][my vpnserver IP]:8443, sid=866e3671 3d1a7781
Wed Sep 07 11:07:05 2016 VERIFY OK: depth=1, CN=Easy-RSA CA
Wed Sep 07 11:07:05 2016 VERIFY OK: depth=0, CN=VPNJAIL
Wed Sep 07 11:07:05 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Sep 07 11:07:05 2016 WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
Wed Sep 07 11:07:05 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 07 11:07:05 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Sep 07 11:07:05 2016 WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
Wed Sep 07 11:07:05 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 07 11:07:05 2016 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Wed Sep 07 11:07:05 2016 [VPNJAIL] Peer Connection Initiated with [AF_INET][my vpnserver IP]:8443
Wed Sep 07 11:07:06 2016 MANAGEMENT: >STATE:1473239226,GET_CONFIG,,,
Wed Sep 07 11:07:08 2016 SENT CONTROL [VPNJAIL]: 'PUSH_REQUEST' (status=1)
Wed Sep 07 11:07:08 2016 PUSH: Received control message: 'PUSH_REPLY,route 192.168.10.0 255.255.255.0,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Wed Sep 07 11:07:08 2016 OPTIONS IMPORT: timers and/or timeouts modified
Wed Sep 07 11:07:08 2016 OPTIONS IMPORT: --ifconfig/up options modified
Wed Sep 07 11:07:08 2016 OPTIONS IMPORT: route options modified
Wed Sep 07 11:07:08 2016 ROUTE_GATEWAY [my client gateway IP]/255.255.255.192 I=14 HWADDR=00:1e:10:1f:18:38
Wed Sep 07 11:07:08 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Sep 07 11:07:08 2016 MANAGEMENT: >STATE:1473239228,ASSIGN_IP,,10.8.0.6,
Wed Sep 07 11:07:08 2016 open_tun, tt->ipv6=0
Wed Sep 07 11:07:08 2016 TAP-WIN32 device [Local Area Connection 3] opened: \\.\Global\{364B73FB-576F-45DE-BEFC-5CD887AE7623}.tap
Wed Sep 07 11:07:08 2016 TAP-Windows Driver Version 9.21
Wed Sep 07 11:07:08 2016 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {364B73FB-576F-45DE-BEFC-5CD887AE7623} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Wed Sep 07 11:07:08 2016 Successful ARP Flush on interface [22] {364B73FB-576F-45DE-BEFC-5CD887AE7623}
Wed Sep 07 11:07:13 2016 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Wed Sep 07 11:07:13 2016 MANAGEMENT: >STATE:1473239233,ADD_ROUTES,,,
Wed Sep 07 11:07:13 2016 C:\Windows\system32\route.exe ADD 192.168.10.0 MASK 255.255.255.0 10.8.0.5
Wed Sep 07 11:07:13 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Wed Sep 07 11:07:13 2016 Route addition via IPAPI succeeded [adaptive]
Wed Sep 07 11:07:13 2016 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Wed Sep 07 11:07:13 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Wed Sep 07 11:07:13 2016 Route addition via IPAPI succeeded [adaptive]
Wed Sep 07 11:07:13 2016 Initialization Sequence Completed
Wed Sep 07 11:07:13 2016 MANAGEMENT: >STATE:1473239233,CONNECTED,SUCCESS,10.8.0.6,[my vpnserver IP]
By the way, running "sysctl net.inet.ip.forwarding=1" on the VPN server returns that ipforwarding is already enabled: 1 -> 1
So when I'm connected to the VPN, I'm able to ping 192.168.10.107. But for example pinging or accessing 192.168.10.25 doesn't work (does work if I do it on the VPN server locally).
Any ideas what I could be doing wrong?
Thanks in advance! :-)
