openvpn server on virtual machine

ghostadmin

I have openvpn running inside vmware workstation with bridging. I can connect to vpn, however i am only able to reach the openvpn server itself, no other machines. Probably this is because virtual machine is using bridging? A physical machine is not possible unfortunately and a small OpenWRT router is also not possible because user management should be possible without the hassle to create user certificates and each user should have its own password.

How this can be achieved? Or do i have a mistake in configuration?
Is there any change if Vmware ESX is used instead of workstation?

I found some articles about bridging interfaces under linux, but this is related to tap, not tun.

For faster reading:
192.168.5.0 LAN
192.168.200.0 VPN Subnet

plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so openvpn
port 1194
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/myserver.crt
key /etc/openvpn/keys/myserver.key
client-cert-not-required #if client uses no own certificate
username-as-common-name #use if above option is enabled
dh /etc/openvpn/keys/dh1024.pem
mode server
tls-server
ifconfig 192.168.200.1 255.255.255.0 # is required for tun
ifconfig-pool 192.168.200.10 192.168.200.20
route 192.168.200.0 255.255.255.0 #vpn network on local tun interface
topology subnet #only 1 subnet for all clients
push "topology subnet"
push "route 192.168.5.0 255.255.255.0"
push "route-gateway 192.168.200.1"
 
push "dhcp-option DNS 192.168.5.1"
push "dhcp-option DOMAIN intern.lan"
 
duplicate-cn #use if client has no individual certificate/key pairs
keepalive 10 60
reneg-sec 0
cipher AES-256-CBC
comp-lzo
max-clients 10
management localhost 7505
persist-key
persist-tun
persist-local-ip
persist-remote-ip
push "persist-tun"
push "persist-key"
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 3

TinCanTech

ghostadmin wroteHow this can be achieved?

HOWTO: For OpenVPN Community Edition

ghostadmin

i wouldnt have asked question if i hadnt read that. Similar config is running fine on freetz but not working here inside a virtual machine.

The route is also set but not working:
192.168.5.0 255.255.255.0 192.168.200.1 192.168.200.2

I also noticed that OpenVPN Access Server works, if i only could see its config as text.

TinCanTech

ghostadmin wrotei wouldnt have asked question if i hadnt read that

Looking at your config, I would say you have not read enough of the HOWTO. Also, this may help: Ethernet Bridging

Using a bridged vpn connection under a bridged VM connection should work, although there may be some TLS issues.

Also, please see:
HOWTO: Request Help !

ghostadmin

One does *never* read enough but there is a point where i came to a halt, no matter how much i read or will read. And again, my config is working in another scenario where openvpn server resides on a physical box. This is more a question about the general possibilites, not detailled configuration. Bridging with tap has one big disadvantage, it works only with windows clients and also it forwards a whole bunch of traffic.
So why access server works and standard openvpn not? is it because access server adds additional NAT ?

openvpn version on server is: 2.3.4-5 and on client: 2.4.0
There are no real problems during connecting
client log:

Wed Mar 01 15:30:18 2017 OpenVPN 2.4.0 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Jan 31 2017
Wed Mar 01 15:30:18 2017 Windows version 6.1 (Windows 7) 32bit
Wed Mar 01 15:30:18 2017 library versions: OpenSSL 1.0.2k  26 Jan 2017, LZO 2.09
Wed Mar 01 15:30:21 2017 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Mar 01 15:30:22 2017 TCP/UDP: Preserving recently used remote address: [AF_INET]84.xxx.53.180:1195
Wed Mar 01 15:30:22 2017 UDP link local: (not bound)
Wed Mar 01 15:30:22 2017 UDP link remote: [AF_INET]84.xxx.53.180:1195
Wed Mar 01 15:30:22 2017 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Mar 01 15:30:22 2017 [TS Series NAS] Peer Connection Initiated with [AF_INET]84.xxx.53.180:1195
Wed Mar 01 15:30:23 2017 open_tun
Wed Mar 01 15:30:23 2017 TAP-WIN32 device [LAN-Verbindung 2] opened: \\.\Global\{06DA0C5B-1D21-47D5-8CDA-2C84AD374277}.tap
Wed Mar 01 15:30:23 2017 Set TAP-Windows TUN subnet mode network/local/netmask = 192.168.200.0/192.168.200.2/255.255.255.0 [SUCCEEDED]
Wed Mar 01 15:30:23 2017 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.200.2/255.255.255.0 on interface {06DA0C5B-1D21-47D5-8CDA-2C84AD374277} [DHCP-serv: 192.168.200.254, lease-time: 31536000]
Wed Mar 01 15:30:23 2017 Successful ARP Flush on interface [19] {06DA0C5B-1D21-47D5-8CDA-2C84AD374277}
Wed Mar 01 15:30:23 2017 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Wed Mar 01 15:30:28 2017 Initialization Sequence Completed

server log:

Wed Mar  1 15:30:25 2017 80.xxx.154.22:22790 TLS: Initial packet from [AF_INET]80.xxx.154.22:22790, sid=78dae3e6 221ffceb
Wed Mar  1 15:30:25 2017 80.xxx.154.22:22790 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Wed Mar  1 15:30:25 2017 80.xxx.154.22:22790 TLS: Username/Password authentication succeeded for username 'trechber' [CN SET]
Wed Mar  1 15:30:25 2017 80.xxx.154.22:22790 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Mar  1 15:30:25 2017 80.xxx.154.22:22790 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Mar  1 15:30:25 2017 80.xxx.154.22:22790 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Mar  1 15:30:25 2017 80.xxx.154.22:22790 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Mar  1 15:30:25 2017 80.xxx.154.22:22790 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Wed Mar  1 15:30:25 2017 80.xxx.154.22:22790 [trechber] Peer Connection Initiated with [AF_INET]80.xxx.154.22:22790
Wed Mar  1 15:30:25 2017 trechber/80.xxx.154.22:22790 MULTI_sva: pool returned IPv4=192.168.200.2, IPv6=(Not enabled)
Wed Mar  1 15:30:25 2017 trechber/80.xxx.154.22:22790 MULTI: Learn: 192.168.200.2 -> trechber/80.xxx.154.22:22790
Wed Mar  1 15:30:25 2017 trechber/80.xxx.154.22:22790 MULTI: primary virtual IP for trechber/80.xxx.154.22:22790: 192.168.200.2
Wed Mar  1 15:30:26 2017 trechber/80.xxx.154.22:22790 PUSH: Received control message: 'PUSH_REQUEST'
Wed Mar  1 15:30:26 2017 trechber/80.xxx.154.22:22790 send_push_reply(): safe_cap=940
Wed Mar  1 15:30:26 2017 trechber/80.xxx.154.22:22790 SENT CONTROL [trechber]: 'PUSH_REPLY,topology subnet,route 192.168.5.0 255.255.255.0,dhcp-option DNS 192.168.5.1,dhcp-option DOMAIN intern.lan,persist-tun,persist-key,route-gateway 192.168.200.1,topology subnet,ping 10,ping-restart 60,ifconfig 192.168.200.2 255.255.255.0' (status=1)

TinCanTech

ghostadmin wroteBridging with tap has one big disadvantage, it works only with windows clients

It works with any device that supports --dev tap (eg. Linux client)

ghostadmin

i think i was looking in the wrong direction. I made a new installation with Debian Jessie on a physical box, guess what, the exakt same problem.
I also totally forgot to set ip forwarding but its still not working.

cat /proc/sys/net/ipv4/ip_forward
1

according to: https://community.openvpn.net/openvpn/wiki/265-how-do-i-enable-ip-forwarding
i enabled also promiscous mode (i thought is only needed for tap)

netstat -i
Kernel-Schnittstellentabelle
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0 1500 0 7346 0 0 0 6051 0 0 0 BMPRU

I used now even a completely different server and client config and after push "redirect-gateway def1" the client also cannot access any internet.

In Debug i can even see udp packets between server and client, no error messages there i can see.

What is blocking packets on server?

That part was working well on old openvpn under freetz:

proto udp
dev tun
port 1195 (i have another openvpn thats why 1195 and not 1194)
server 192.168.200.0 255.255.255.0
topology subnet
push "topology subnet"
push "redirect-gateway def1"
push "route 192.168.5.0 255.255.255.0"

Server and Client are both now running with 2.4.0

ghostadmin

oh dear, the problem was: https://secure-computing.net/wiki/index.php/Graph

with openvpn access server i was not required to do any routes on gateway

TinCanTech

Just so you know .. you are not using a bridged VPN.

Lomax

Just so you know .. you're not remotely helpful.

TinCanTech

@Lomax
Many People have spent many hundreds of hours documenting Openvpn ..
If you don't read the documentation then you are simply lazy and do not deserve any help.
And you are welcome to Learn all that information and provide better help, if you can ..