The issue of server can not ping the client has been discussed several times, but I can not find the flaw though, any suggestions are welcomed :
Please have a look at my problem, this is driving me crazy...
The client can ping the server LAN OK, but not the other way around.
The openvpn server is on an ASUS AC68U router with Merlin firmware ( Merlin 380.64 )
The client is on windows 7, openvpn 2.4.0.0. openvpn gui v11.4.0.0 )
Tunnel get setup OK! (tunnel ip 10.8.0.0).
ASUS LAN IP is 192.168.1.1/24
PC has 192.168.2.220/24
From the PC can i ping the ASUS LAN side, but the ASUS server can not ping the PC client.
PC can also ping the server tunnel end-point 10.8.0.1
The server can NOT ping the client tunnel end-point 10.8.0.2
I have disabled all firewalls on the PC.
The server is setup with
push "route 192.168.1.0 255.255.255.0"
route 192.168.2.0 255.255.255.0
I have a client file: /jffs/configs/openvpn/ccd1/client
with iroute 192.168.2.0 255.255.255.0 (chmod 777 )
I suspect a PC/Windows/client issue, because when I ping from server to client do I see the packets from the server on wireshark on the client PC:
(the screenshot does not tell, but outside the ping, is the only small handshake traffic, when i send 11 ping packets do the show up on wireshark)
The router shows the client is connected OK:
The router also see the client network:
admin@RT-AC68U-DFC8:/tmp/home/root# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.64.64.64 * 255.255.255.255 UH 0 0 0 ppp0
192.168.2.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun21
10.8.0.0 * 255.255.255.0 U 0 0 0 tun21
192.168.1.0 * 255.255.255.0 U 0 0 0 br0
127.0.0.0 * 255.0.0.0 U 0 0 0 lo
default 10.64.64.64 0.0.0.0 UG 0 0 0 ppp0
On the PC client routing also seems OK, Partly because the PC can ping 192.168.1.1, partly because of the routing table:
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.2.1 192.168.2.220 10
10.8.0.0 255.255.255.0 On-link 10.8.0.2 276
10.8.0.2 255.255.255.255 On-link 10.8.0.2 276
10.8.0.255 255.255.255.255 On-link 10.8.0.2 276
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.1.0 255.255.255.0 10.8.0.1 10.8.0.2 20
192.168.2.0 255.255.255.0 On-link 192.168.2.220 266
192.168.2.220 255.255.255.255 On-link 192.168.2.220 266
192.168.2.255 255.255.255.255 On-link 192.168.2.220 266
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.2.220 266
224.0.0.0 240.0.0.0 On-link 10.8.0.2 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.2.220 266
255.255.255.255 255.255.255.255 On-link 10.8.0.2 276
===========================================================================
This is the log on the client side. Do I have a windows problem or a OpenVPN setup issue ? many thanks for any suggestions on what to look for...
Wed Dec 28 13:02:42 2016 OpenVPN 2.4.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Dec 27 2016
Wed Dec 28 13:02:42 2016 Windows version 6.1 (Windows 7) 64bit
Wed Dec 28 13:02:42 2016 library versions: OpenSSL 1.0.2i 22 Sep 2016, LZO 2.09
Enter Management Password:
Wed Dec 28 13:02:43 2016 TCP/UDP: Preserving recently used remote address: [AF_INET]12.123.12.123:1194
Wed Dec 28 13:02:43 2016 UDP link local: (not bound)
Wed Dec 28 13:02:43 2016 UDP link remote: [AF_INET]12.123.12.123:1194
Wed Dec 28 13:02:45 2016 [RT-AC68U] Peer Connection Initiated with [AF_INET]12.123.12.123:1194
Wed Dec 28 13:02:46 2016 WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Wed Dec 28 13:02:46 2016 WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Wed Dec 28 13:02:46 2016 WARNING: cipher with small block size in use, reducing reneg-bytes to 64MB to mitigate SWEET32 attacks.
Wed Dec 28 13:02:46 2016 open_tun
Wed Dec 28 13:02:46 2016 TAP-WIN32 device [Local Area Connection 3] opened: \\.\Global\{8FE83F30-8A37-44C5-B5EF-317BC5819ECB}.tap
Wed Dec 28 13:02:46 2016 Set TAP-Windows TUN subnet mode network/local/netmask = 10.8.0.0/10.8.0.2/255.255.255.0 [SUCCEEDED]
Wed Dec 28 13:02:46 2016 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.2/255.255.255.0 on interface {8FE83F30-8A37-44C5-B5EF-317BC5819ECB} [DHCP-serv: 10.8.0.254, lease-time: 31536000]
Wed Dec 28 13:02:46 2016 Successful ARP Flush on interface [15] {8FE83F30-8A37-44C5-B5EF-317BC5819ECB}
Wed Dec 28 13:02:46 2016 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Wed Dec 28 13:02:51 2016 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists. [status=5010 if_index=15]
Wed Dec 28 13:02:51 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Wed Dec 28 13:02:51 2016 Initialization Sequence Completed
thanks
Fedtmule
