yaronmunz
Hello,
1/ I have a new server, in google cloud that has 2 network interfaces, and I can not connect with OpenVPN.
This server has 2 external IP addresses.
(To another server in GCE that has 1 network interface i can connect from the same client without problems)
2/ Google firewall rules allow Open VPN access.
3/ I took the client config file, changed the IP address to the 1st external IP, could NOT connect.
Then, changed to the 2nd external IP, could NOT connect.
Please advise what could be the problem here.
Regards,
Yaron
Here are some config/log files:
a/ Server config file:
;local a.b.c.d
port 1194
proto tcp
dev tun
dev-node TAP
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
;topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
;server-bridge
;push "route 192.168.10.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"
;client-config-dir ccd
;route 192.168.40.128 255.255.255.248
;client-config-dir ccd
;route 10.9.0.0 255.255.255.252
;learn-address ./script
;push "redirect-gateway def1 bypass-dhcp"
;push "dhcp-option DNS 208.67.222.222"
;push "dhcp-option DNS 208.67.220.220"
;client-to-client
;duplicate-cn
keepalive 10 120
cipher AES-256-CBC
;compress lz4-v2
;push "compress lz4-v2"
;comp-lzo
;max-clients 100
;user nobody
;group nobody
persist-key
persist-tun
status openvpn-status.log
;log openvpn.log
;log-append openvpn.log
verb 3
;mute 20
b/ client config file:
(I changed the remote real ip address to xxx.xxx.xxx.xxx for security reasons)
# [server.cong]
client
dev tun
proto tcp
remote xxx.xxx.xxx.xxx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ca "C:\\Program Files\\OpenVPN\\config\\keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\keys\\yaron.crt"
key "C:\\Program Files\\OpenVPN\\config\\keys\\yaron.key"
# ns-cert-type server
remote-cert-tls server
comp-lzo
verb 4
route-nopull
route 80.179.55.190 255.255.255.255
c/ server ipconfig/all :
Windows IP Configuration
Host Name . . . . . . . . . . . . : my-srv1
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : c.my-app.internal
Ethernet adapter TAP:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TAP-Windows Adapter V9
Physical Address. . . . . . . . . : 00-FF-1E-E1-B6-A7
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 10.8.0.1(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.252
Lease Obtained. . . . . . . . . . : Tuesday, October 31, 2017 10:56:14 PM
Lease Expires . . . . . . . . . . : Wednesday, October 31, 2018 10:56:14 PM
Default Gateway . . . . . . . . . :
DHCP Server . . . . . . . . . . . : 10.8.0.2
NetBIOS over Tcpip. . . . . . . . : Enabled
Ethernet adapter my-subnetwork-2:
Connection-specific DNS Suffix . : c.my-app.internal
Description . . . . . . . . . . . : Red Hat VirtIO Ethernet Adapter #2
Physical Address. . . . . . . . . : 42-01-AC-10-00-02
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 172.16.0.2(Preferred)
Subnet Mask . . . . . . . . . . . : 255.240.0.0
Lease Obtained. . . . . . . . . . : Monday, October 30, 2017 7:33:41 AM
Lease Expires . . . . . . . . . . : Thursday, November 2, 2017 7:33:41 AM
Default Gateway . . . . . . . . . : 172.16.0.1
DHCP Server . . . . . . . . . . . : 169.254.169.254
DNS Servers . . . . . . . . . . . : 172.16.0.1
NetBIOS over Tcpip. . . . . . . . : Enabled
Ethernet adapter my-subnetwork:
Connection-specific DNS Suffix . : c.my-app.internal
Description . . . . . . . . . . . : Red Hat VirtIO Ethernet Adapter
Physical Address. . . . . . . . . : 42-01-0A-00-00-02
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 10.0.0.2(Preferred)
Subnet Mask . . . . . . . . . . . : 255.128.0.0
Lease Obtained. . . . . . . . . . : Monday, October 30, 2017 7:33:41 AM
Lease Expires . . . . . . . . . . : Thursday, November 2, 2017 7:33:41 AM
Default Gateway . . . . . . . . . : 10.0.0.1
DHCP Server . . . . . . . . . . . : 169.254.169.254
DNS Servers . . . . . . . . . . . : 10.0.0.1
NetBIOS over Tcpip. . . . . . . . : Enabled
d/ server log file:
Tue Oct 31 22:56:14 2017 OpenVPN 2.4.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Sep 26 2017
Tue Oct 31 22:56:14 2017 Windows version 6.2 (Windows 8 or greater) 64bit
Tue Oct 31 22:56:14 2017 library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.10
Tue Oct 31 22:56:14 2017 Diffie-Hellman initialized with 2048 bit key
Tue Oct 31 22:56:14 2017 interactive service msg_channel=0
Tue Oct 31 22:56:14 2017 ROUTE_GATEWAY 10.0.0.1/255.128.0.0 I=12 HWADDR=42:01:0a:00:00:02
Tue Oct 31 22:56:14 2017 open_tun
Tue Oct 31 22:56:14 2017 TAP-WIN32 device [TAP] opened: \\.\Global\{1EE1B6A7-806C-4EDC-82AB-DBB290CCA2F5}.tap
Tue Oct 31 22:56:14 2017 TAP-Windows Driver Version 9.21
Tue Oct 31 22:56:14 2017 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.1/255.255.255.252 on interface {1EE1B6A7-806C-4EDC-82AB-DBB290CCA2F5} [DHCP-serv: 10.8.0.2, lease-time: 31536000]
Tue Oct 31 22:56:14 2017 Sleeping for 10 seconds...
Tue Oct 31 22:56:24 2017 Successful ARP Flush on interface [26] {1EE1B6A7-806C-4EDC-82AB-DBB290CCA2F5}
Tue Oct 31 22:56:24 2017 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Tue Oct 31 22:56:24 2017 C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.2
Tue Oct 31 22:56:24 2017 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Oct 31 22:56:24 2017 Route addition via IPAPI succeeded [adaptive]
Tue Oct 31 22:56:24 2017 Could not determine IPv4/IPv6 protocol. Using AF_INET6
Tue Oct 31 22:56:24 2017 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Oct 31 22:56:24 2017 setsockopt(IPV6_V6ONLY=0)
Tue Oct 31 22:56:24 2017 Listening for incoming TCP connection on [AF_INET6][undef]:1194
Tue Oct 31 22:56:24 2017 TCPv6_SERVER link local (bound): [AF_INET6][undef]:1194
Tue Oct 31 22:56:24 2017 TCPv6_SERVER link remote: [AF_UNSPEC]
Tue Oct 31 22:56:24 2017 MULTI: multi_init called, r=256 v=256
Tue Oct 31 22:56:24 2017 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Tue Oct 31 22:56:24 2017 ifconfig_pool_read(), in='yaron,10.8.0.4', TODO: IPv6
Tue Oct 31 22:56:24 2017 succeeded -> ifconfig_pool_set()
Tue Oct 31 22:56:24 2017 IFCONFIG POOL LIST
Tue Oct 31 22:56:24 2017 yaron,10.8.0.4
Tue Oct 31 22:56:24 2017 MULTI: TCP INIT maxclients=60 maxevents=64
Tue Oct 31 22:56:24 2017 Initialization Sequence Completed
e/ google cloud firewall relevant rules:
open-vpn-new Apply to all IP ranges: 0.0.0.0/0 tcp:1194 Allow 1000 my-subnetwork
open-vpn-new-2 Apply to all IP ranges: 0.0.0.0/0 tcp:1194 Allow 1000 my-subnetwork-2
