Hello,
I have set up an OpenVPN sevrer which it works ok but, I need to push a route to clients to see 192.168.24.0 subnet and I don't know how to do it
Server config:
--------------
port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/swordfish.crt
key /etc/openvpn/swordfish.key
dh /etc/openvpn/dh.pem
server 10.8.0.0 255.255.255.0
push "route 192.168.24.0 255.255.255.0"
client-to-client
keepalive 10 120
tls-auth /etc/openvpn/ta.key 0 # This file is secret
comp-lzo
user nobody
group nobody
persist-key
persist-tun
verb 3
Clients asigns IP: 10.8.0.0 subnet with 10.8.0.5 DHCP Server and 192.168.24.50 DNS Server
When starting server:
Wed Sep 28 09:47:45 2016 OpenVPN 2.3.12 i686-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Aug 24 2016
Wed Sep 28 09:47:45 2016 library versions: OpenSSL 1.0.2i 22 Sep 2016, LZO 2.09
Wed Sep 28 09:47:45 2016 Diffie-Hellman initialized with 2048 bit key
Wed Sep 28 09:47:45 2016 Control Channel Authentication: using '/etc/openvpn/ta.key' as a OpenVPN static key file
Wed Sep 28 09:47:45 2016 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 28 09:47:45 2016 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 28 09:47:45 2016 Socket Buffers: R=[163840->163840] S=[163840->163840]
Wed Sep 28 09:47:45 2016 ROUTE_GATEWAY 8xx.7xx.2xx.3x/255.255.255.240 IFACE=enp6s8 HWADDR=00:00:00:00:00:00
Wed Sep 28 09:47:45 2016 TUN/TAP device tun0 opened
Wed Sep 28 09:47:45 2016 TUN/TAP TX queue length set to 100
Wed Sep 28 09:47:45 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Sep 28 09:47:45 2016 /usr/bin/ip link set dev tun0 up mtu 1500
Wed Sep 28 09:47:45 2016 /usr/bin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Wed Sep 28 09:47:45 2016 /usr/bin/ip route add 10.8.0.0/24 via 10.8.0.2
Wed Sep 28 09:47:45 2016 GID set to nobody
Wed Sep 28 09:47:45 2016 UID set to nobody
Wed Sep 28 09:47:45 2016 UDPv4 link local (bound): [undef]
Wed Sep 28 09:47:45 2016 UDPv4 link remote: [undef]
Wed Sep 28 09:47:45 2016 MULTI: multi_init called, r=256 v=256
Wed Sep 28 09:47:45 2016 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Wed Sep 28 09:47:45 2016 ifconfig_pool_read(), in='Carcalete,10.8.0.4', TODO: IPv6
Wed Sep 28 09:47:45 2016 succeeded -> ifconfig_pool_set()
Wed Sep 28 09:47:45 2016 IFCONFIG POOL LIST
Wed Sep 28 09:47:45 2016 Carcalete,10.8.0.4
Wed Sep 28 09:47:45 2016 Initialization Sequence Completed
Wed Sep 28 09:48:13 2016 8xx.7xx.2xx.3x:4338 TLS: Initial packet from [AF_INET]8xx.7xx.2xx.3x:4338, sid=64ae9afa 85b1f823
Wed Sep 28 09:48:13 2016 8xx.7xx.2xx.3x:4338 VERIFY OK: depth=1, CN=chrisis
Wed Sep 28 09:48:13 2016 8xx.7xx.2xx.3x:4338 VERIFY OK: depth=0, CN=Carcalete
Wed Sep 28 09:48:13 2016 8xx.7xx.2xx.3x:4338 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Sep 28 09:48:13 2016 8xx.7xx.2xx.3x:4338 WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
Wed Sep 28 09:48:13 2016 8xx.7xx.2xx.3x:4338 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 28 09:48:13 2016 8xx.7xx.2xx.3x:4338 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Sep 28 09:48:13 20168xx.7xx.2xx.3x:4338 WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
Wed Sep 28 09:48:13 2016 8xx.7xx.2xx.3x:4338 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 28 09:48:13 2016 8xx.7xx.2xx.3x:4338 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Wed Sep 28 09:48:13 2016 8xx.7xx.2xx.3x:4338 [Carcalete] Peer Connection Initiated with [AF_INET]8xx.7xx.2xx.3x:4338
Wed Sep 28 09:48:13 2016 Carcalete/8xx.7xx.2xx.3x:4338 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Wed Sep 28 09:48:13 2016 Carcalete/88xx.7xx.2xx.3x:4338 MULTI: Learn: 10.8.0.6 -> Carcalete/8xx.7xx.2xx.3x:4338
Wed Sep 28 09:48:13 2016 Carcalete/8xx.7xx.2xx.3x:4338 MULTI: primary virtual IP for Carcalete/8xx.7xx.2xx.3x:4338: 10.8.0.6
Wed Sep 28 09:48:16 2016 Carcalete/8xx.7xx.2xx.3x:4338 PUSH: Received control message: 'PUSH_REQUEST'
Wed Sep 28 09:48:16 2016 Carcalete/8xx.7xx.2xx.3x:4338 send_push_reply(): safe_cap=940
Wed Sep 28 09:48:16 2016 Carcalete/8xx.7xx.2xx.3x:4338 SENT CONTROL [Carcalete]: 'PUSH_REPLY,route 192.168.24.0 255.255.255.0,dhcp-option DNS 192.168.24.50,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Log from client:
Wed Sep 28 09:48:13 2016 OpenVPN 2.3.12 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug 23 2016
Wed Sep 28 09:48:13 2016 Windows version 5.1 (Windows XP) 32bit
Wed Sep 28 09:48:13 2016 library versions: OpenSSL 1.0.1t 3 May 2016, LZO 2.09
Enter Management Password:
Wed Sep 28 09:48:13 2016 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Sep 28 09:48:13 2016 Need hold release from management interface, waiting...
Wed Sep 28 09:48:13 2016 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Sep 28 09:48:13 2016 MANAGEMENT: CMD 'state on'
Wed Sep 28 09:48:13 2016 MANAGEMENT: CMD 'log all on'
Wed Sep 28 09:48:13 2016 MANAGEMENT: CMD 'hold off'
Wed Sep 28 09:48:13 2016 MANAGEMENT: CMD 'hold release'
Wed Sep 28 09:48:13 2016 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Wed Sep 28 09:48:13 2016 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 28 09:48:13 2016 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 28 09:48:13 2016 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Sep 28 09:48:13 2016 UDPv4 link local: [undef]
Wed Sep 28 09:48:13 2016 UDPv4 link remote: [AF_INET]8xx.7xx.2xx.3x:1194
Wed Sep 28 09:48:13 2016 MANAGEMENT: >STATE:1475045293,WAIT,,,
Wed Sep 28 09:48:13 2016 MANAGEMENT: >STATE:1475045293,AUTH,,,
Wed Sep 28 09:48:13 2016 TLS: Initial packet from [AF_INET]8xx.7xx.2xx.3x:1194, sid=66267438 b667db6b
Wed Sep 28 09:48:13 2016 VERIFY OK: depth=1, CN=chrisis
Wed Sep 28 09:48:13 2016 Validating certificate key usage
Wed Sep 28 09:48:13 2016 ++ Certificate has key usage 00a0, expects 00a0
Wed Sep 28 09:48:13 2016 VERIFY KU OK
Wed Sep 28 09:48:13 2016 Validating certificate extended key usage
Wed Sep 28 09:48:13 2016 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Wed Sep 28 09:48:13 2016 VERIFY EKU OK
Wed Sep 28 09:48:13 2016 VERIFY OK: depth=0, CN=chrisis
Wed Sep 28 09:48:13 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Sep 28 09:48:13 2016 WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
Wed Sep 28 09:48:13 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 28 09:48:13 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Sep 28 09:48:13 2016 WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
Wed Sep 28 09:48:13 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 28 09:48:13 2016 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Wed Sep 28 09:48:13 2016 [cristu] Peer Connection Initiated with [AF_INET]82.78.234.37:1194
Wed Sep 28 09:48:14 2016 MANAGEMENT: >STATE:1475045294,GET_CONFIG,,,
Wed Sep 28 09:48:16 2016 SENT CONTROL [cristu]: 'PUSH_REQUEST' (status=1)
Wed Sep 28 09:48:16 2016 PUSH: Received control message: 'PUSH_REPLY,route 192.168.24.0 255.255.255.0,dhcp-option DNS 192.168.24.50,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Wed Sep 28 09:48:16 2016 OPTIONS IMPORT: timers and/or timeouts modified
Wed Sep 28 09:48:16 2016 OPTIONS IMPORT: --ifconfig/up options modified
Wed Sep 28 09:48:16 2016 OPTIONS IMPORT: route options modified
Wed Sep 28 09:48:16 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Sep 28 09:48:16 2016 ROUTE_GATEWAY 192.168.1.3/255.255.255.0 I=65540 HWADDR=08:00:27:25:a9:5b
Wed Sep 28 09:48:16 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Sep 28 09:48:16 2016 MANAGEMENT: >STATE:1475045296,ASSIGN_IP,,10.8.0.6,
Wed Sep 28 09:48:16 2016 open_tun, tt->ipv6=0
Wed Sep 28 09:48:16 2016 TAP-WIN32 device [vpn] opened: \\.\Global\{B55F4118-C623-4372-9295-E3C526F84D13}.tap
Wed Sep 28 09:48:16 2016 TAP-Windows Driver Version 9.9
Wed Sep 28 09:48:16 2016 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {B55F4118-C623-4372-9295-E3C526F84D13} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Wed Sep 28 09:48:16 2016 Successful ARP Flush on interface [65541] {B55F4118-C623-4372-9295-E3C526F84D13}
Wed Sep 28 09:48:21 2016 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Wed Sep 28 09:48:21 2016 MANAGEMENT: >STATE:1475045301,ADD_ROUTES,,,
Wed Sep 28 09:48:21 2016 C:\WINDOWS\system32\route.exe ADD 192.168.24.0 MASK 255.255.255.0 10.8.0.5
Wed Sep 28 09:48:21 2016 Route addition via IPAPI succeeded [adaptive]
Wed Sep 28 09:48:21 2016 C:\WINDOWS\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.5
Wed Sep 28 09:48:21 2016 Route addition via IPAPI succeeded [adaptive]
Wed Sep 28 09:48:21 2016 Initialization Sequence Completed
Wed Sep 28 09:48:21 2016 MANAGEMENT: >STATE:1475045301,CONNECTED,SUCCESS,10.8.0.6,82.78.234.37
Ping on 10.8.0.1 works ok, but ping on host from 192.168.24.0 network doesn't reply anything.
How do I see 192.168.24.0 subnet on my VPN client ? What elese should I set up ?
Thanxs
