Can't access ip addresses on server's network.

Betamaxx

I am trying to do something very simple. All I want to do is to connect 192.168.8.188 on the client's network to 192.168.1.138 on the server's network. I used the Pi VPN implementation, and it looks like it doesn't provide this sort of access by default. These IP addresses are IP phones that will be connecting to each other directly. Please help! I really need to get my phone system up and running.

dev tun
proto udp
port <port>
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server_6xDu7TjL6L68ab7v.crt
key /etc/openvpn/easy-rsa/pki/private/server_6xDu7TjL6L68ab7v.key
dh /etc/openvpn/easy-rsa/pki/dh4096.pem
topology subnet
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OPenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 0.0.0.0 "
# Set your primary domain name server address for clients
push "dhcp-option DNS 209.244.0.3"
push "dhcp-option DNS 209.244.0.4"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
keepalive 10 120
remote-cert-tls client
tls-version-min 1.2
tls-auth /etc/openvpn/easy-rsa/pki/ta.key 0
cipher AES-256-CBC

client
dev tun
proto udp
remote <server's address>
resolv-retry infinite
nobind
persist-key
persist-tun
key-direction 1
remote-cert-tls server
tls-version-min 1.2
verify-x509-name server_6xDu7TjL6L68ab7v name
cipher AES-256-CBC
auth SHA256
comp-lzo
verb 1

Palazzo77

Hi,
Really fresh on this forum so not sure am writing on the right board!

I’m facing connection issues to ALL the ITALY servers.
Error displayed is:
2017-12-13 23:04:20 Transport Error: PolarSSL: SSL read error : X509 - Certificate verification failed, e.g. CRL, CA or signature check failed
2017-12-13 23:04:20 EVENT: CERT_VERIFY_FAIL PolarSSL: SSL read error : X509 - Certificate verification failed, e.g. CRL, CA or signature check failed [ERR]

Can someone help me on this?? I’m abroad and really need to log in into one of the italian servers.

Many thanks!!

Betamaxx

Hey, can you please post in a separate thread about your issue? Thanks in advance.

TinCanTech

@ Betamaxx please see HOWTO: Expanding the scope of the VPN to include additional machines

And don't use:

push "route 0.0.0.0 "

@ Palazzo77 please see HOWTO: Request Help !

Betamaxx

Thanks for the reply, but I don't know what to put after

push "route

Could somebody please help me figure out what route to push?

TinCanTech

TinCanTech wrote And don't use:

push "route 0.0.0.0 "

Betamaxx wrote I don't know what to put

Put this

# push "route 0.0.0.0 " # This is now unused

TinCanTech wrote @ Betamaxx please see HOWTO: Expanding the scope of the VPN to include additional machines

Betamaxx

I have tried commenting out that line, and nmap shows the phone to be up with all of its ports closed, when I know for a fact that it has two or three ports open. I read the guide and find the applicible section so vague that I am unable to find anything actionable.