Hi guys, i´m new here but i need some help.
I have one openvpn server running with 3 freeBsd clients very well. I just try to add another client but with Windows Server. The configuration of certificates and .conf files just like ok. the connection are stablish but the client do noto receive the default gateway and so it can ping to server or vice-versa.
Here is my server configuration to this client:
dev tap
port 1192
proto udp
server 192.168.240.0 255.255.255.0
ifconfig-pool-persist ipp-cec.txt
ca /usr/local/etc/openvpn/keys/ca.crt
cert /usr/local/etc/openvpn/keys/ca.crt
key /usr/local/etc/openvpn/keys/ca.key
dh /usr/local/etc/openvpn/keys/dh1024.pem
client-config-dir ccd-cloud
push "route 192.168.11.0 255.255.255.0"
comp-lzo
log-append /var/log/openvpn.log
ping-timer-rem
persist-tun
persist-key
verb 3
keepalive 10 120
group nobody
daemon
mute 20
and here the client side:
client
dev tap
proto udp
remote x.x.x.x
port 1192
nobind
persist-key
persist-tun
verb 3
pull
keepalive 10 120
ca ca.crt
cert cloud.crt
key cloud.key
Here is the log on client side:
Mon Jan 23 17:04:32 2017 TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:1192
Mon Jan 23 17:04:32 2017 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Jan 23 17:04:32 2017 UDP link local: (not bound)
Mon Jan 23 17:04:32 2017 UDP link remote: [AF_INET]x.x.x.x:1192
Mon Jan 23 17:04:32 2017 MANAGEMENT: >STATE:1485198272,WAIT,,,,,,
Mon Jan 23 17:04:32 2017 MANAGEMENT: >STATE:1485198272,AUTH,,,,,,
Mon Jan 23 17:04:32 2017 TLS: Initial packet from [AF_INET]x.x.x.x:1192, sid=5d0cd44f 4b805abd
Mon Jan 23 17:04:32 2017 VERIFY OK: depth=0, C=BR, ST=SC, L=XXX, O=XXX, CN=XXXCA, emailAddress=xxx@xxx.com
Mon Jan 23 17:04:32 2017 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1573', remote='link-mtu 1574'
Mon Jan 23 17:04:32 2017 WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
Mon Jan 23 17:04:32 2017 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon Jan 23 17:04:32 2017 [DentalPrev CA] Peer Connection Initiated with [AF_INET]x.x.x.x:1192
Mon Jan 23 17:04:33 2017 MANAGEMENT: >STATE:1485198273,GET_CONFIG,,,,,,
Mon Jan 23 17:04:33 2017 SENT CONTROL [DentalPrev CA]: 'PUSH_REQUEST' (status=1)
Mon Jan 23 17:04:33 2017 PUSH: Received control message: 'PUSH_REPLY,route 192.168.11.0 255.255.255.0,route-gateway 192.168.240.1,ping 10,ping-restart 120,route 192.168.11.0 255.255.255.0,route-gateway 192.168.240.1,ifconfig 192.168.240.25 255.255.255.0'
Mon Jan 23 17:04:33 2017 OPTIONS IMPORT: timers and/or timeouts modified
Mon Jan 23 17:04:33 2017 OPTIONS IMPORT: --ifconfig/up options modified
Mon Jan 23 17:04:33 2017 OPTIONS IMPORT: route options modified
Mon Jan 23 17:04:33 2017 OPTIONS IMPORT: route-related options modified
Mon Jan 23 17:04:33 2017 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jan 23 17:04:33 2017 WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Mon Jan 23 17:04:33 2017 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jan 23 17:04:33 2017 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jan 23 17:04:33 2017 WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Mon Jan 23 17:04:33 2017 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jan 23 17:04:33 2017 WARNING: cipher with small block size in use, reducing reneg-bytes to 64MB to mitigate SWEET32 attacks.
Mon Jan 23 17:04:33 2017 Preserving previous TUN/TAP instance: Local Area Connection 3
Mon Jan 23 17:04:33 2017 Initialization Sequence Completed
Mon Jan 23 17:04:33 2017 MANAGEMENT: >STATE:1485198273,CONNECTED,SUCCESS,192.168.240.25,x.x.x.x,1192,,
The client gets:
ip: 192.168.240.25
Mask: 255.255.255.0
Gateway: none
Route to 192.168.11.0 using gateway 192.168.240.1 and interface 192.168.240.25
Route to 192.168.240.0 using gateway 192.168.240.25 and interface 192.168.240.25.
Thank´s for help and sorry bad english.
