Topology subnet with routed LAN not working, routing issue?

maxburn

Currently I'm not able to reach LAN IP addresses from the server, seems like a routing issue?? Is the routed LANs setup different for topology subnet, I can't see why it would be? I had it working with the old net30 but can't get it here. If someone has this working I would really like to see client/server known working config files.

I'm using topology SUBNETto get a decent number of clients; https://community.openvpn.net/openvpn/wiki/Concepts-Addressing
I also need routed LANs with client to client https://community.openvpn.net/openvpn/wiki/RoutedLans

Server is on Windows
Clients are Ubiquiti Edgerouters

Currently the VPN comes up but I can't reach the routers LAN side, but not seeing anything obvious in the logs. Help?

### This file compatible with topology SUBNET
### Remember to edit LAN addressing for server below

### Connection info
proto tcp-server
port 1194
mode server
keepalive 10 120

### encryption info
tls-server
remote-cert-eku "TLS Web Client Authentication"
cipher AES-256-CBC
ca "windows path"
cert "windows path"
key "windows path"
dh "windows path"

### authentication
tls-auth "windows path" 0

### Compression "compress" new standard, 
# lz4 best performance, lzo backwards compatibility
# Seems ER does not support new command or lz4
;compress lz4
comp-lzo

### Network 
dev tun
topology "subnet"
push "topology subnet"
# with this server always grabs 10.8.0.253 
ifconfig 10.8.0.253 255.255.255.0
push "route-gateway 10.8.0.253"
;server 10.8.0.0 255.255.255.0  # not needed?
route-gateway 10.8.0.253
# Push routes to connecting clients, they need to know how to route to other LANs
push "route 10.107.101.0 255.255.255.0"
push "route 10.107.102.0 255.255.255.0"
;push "route 10.107.103.0 255.255.255.0"
;push "route 10.107.104.0 255.255.255.0"
;push "route 10.107.105.0 255.255.255.0"
;push "route 10.107.106.0 255.255.255.0"
;push "route 10.107.107.0 255.255.255.0"
# Allow LAN routing between clients
client-to-client
# Allow the server to route traffic to client LANs
route 10.107.101.0 255.255.255.0
route 10.107.102.0 255.255.255.0
;route 10.107.103.0 255.255.255.0
;route 10.107.104.0 255.255.255.0
;route 10.107.105.0 255.255.255.0
;route 10.107.106.0 255.255.255.0
;route 10.107.107.0 255.255.255.0
# ovpn server pushes config info to clients from files in ccd dir. 
# Matches are based on CN in connecting key, so CN in key must match file name exactly. 
# Static VPN addressing and Client LAN routing is controlled in these files.
# client configuration directory (home is config dir, so rel path ok here)
client-config-dir ccd

# FYI; VPN DHCP server is on 10.8.0.254
ifconfig-pool 10.8.0.220 10.8.0.250 255.255.255.0
# for reconnecting roadwarrior clients try to issue same IP
ifconfig-pool-persist ipp.txt

### Logging
# OpenVPN log goes to C:\Program Files\OpenVPN\log\* whatever this ovpn file is named
# 0 is silent, except for fatal errors
# 3 default?
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 3
# read this to see what clients are connected
status "C:\\Program Files\\OpenVPN\\log\\openvpn-status.log"

CCD 1

iroute 10.107.101.0 255.255.255.0
ifconfig-push 10.8.0.1 255.255.255.0

CCD 2 etc

iroute 10.107.102.0 255.255.255.0
ifconfig-push 10.8.0.2 255.255.255.0

client1.ovpn

# This file compatible with topology SUBNET
# Intended for Ubiquiti ERX or similar
client

# Connection setup
# server ports xxx etc.
proto tcp-client
remote example.com xxx

# Encryption 
cipher AES-256-CBC
tls-client
remote-cert-eku "TLS Web Server Authentication"
# -Windows roadwarrior
;ca "windows path"
;cert "windows path"
;key "windows path"
# -Ubiquiti EdgeRouter
ca /path/
cert /path/
key /path/

# Authentication
tls-auth /path 1

# Compression "compress" new standard, (not supported in edgerouter??)
# lz4 best performance, lzo backwards compatibility
;compress lz4
comp-lzo

# Network setup
dev tun
;topology subnet
;pull

# Logging level
verb 3

##### from old config, do I even need this?
#resolv-retry infinite
#nobind
#persist-key
#persist-tun
#remote-cert-tls server
#comp-lzo

Server Log

Mon Dec 18 11:32:27 2017 OpenVPN 2.4.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Sep 26 2017
Mon Dec 18 11:32:27 2017 Windows version 6.1 (Windows 7) 64bit
Mon Dec 18 11:32:27 2017 library versions: OpenSSL 1.0.2l  25 May 2017, LZO 2.10
Mon Dec 18 11:32:27 2017 Diffie-Hellman initialized with 4096 bit key
Mon Dec 18 11:32:27 2017 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 18 11:32:27 2017 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 18 11:32:27 2017 interactive service msg_channel=0
Mon Dec 18 11:32:27 2017 ROUTE_GATEWAY 192.168.xxx.xxx/255.255.255.0 I=12 HWADDR=xxx
Mon Dec 18 11:32:27 2017 open_tun
Mon Dec 18 11:32:27 2017 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{3xxx}.tap
Mon Dec 18 11:32:27 2017 TAP-Windows Driver Version 9.21 
Mon Dec 18 11:32:27 2017 Set TAP-Windows TUN subnet mode network/local/netmask = 10.8.0.0/10.8.0.253/255.255.255.0 [SUCCEEDED]
Mon Dec 18 11:32:27 2017 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.253/255.255.255.0 on interface {xxx} [DHCP-serv: 10.8.0.254, lease-time: 31536000]
Mon Dec 18 11:32:27 2017 Sleeping for 10 seconds...
Mon Dec 18 11:32:37 2017 Successful ARP Flush on interface [23] {xxx}
Mon Dec 18 11:32:37 2017 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Mon Dec 18 11:32:37 2017 C:\Windows\system32\route.exe ADD 10.107.101.0 MASK 255.255.255.0 10.8.0.253
Mon Dec 18 11:32:37 2017 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Mon Dec 18 11:32:37 2017 Route addition via IPAPI succeeded [adaptive]
Mon Dec 18 11:32:37 2017 C:\Windows\system32\route.exe ADD 10.107.102.0 MASK 255.255.255.0 10.8.0.253
Mon Dec 18 11:32:37 2017 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Mon Dec 18 11:32:37 2017 Route addition via IPAPI succeeded [adaptive]
Mon Dec 18 11:32:37 2017 Could not determine IPv4/IPv6 protocol. Using AF_INET6
Mon Dec 18 11:32:37 2017 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Dec 18 11:32:37 2017 setsockopt(IPV6_V6ONLY=0)
Mon Dec 18 11:32:37 2017 Listening for incoming TCP connection on [AF_INET6][undef]:1194
Mon Dec 18 11:32:37 2017 TCPv6_SERVER link local (bound): [AF_INET6][undef]:1194
Mon Dec 18 11:32:37 2017 TCPv6_SERVER link remote: [AF_UNSPEC]
Mon Dec 18 11:32:37 2017 MULTI: multi_init called, r=256 v=256
Mon Dec 18 11:32:37 2017 IFCONFIG POOL: base=10.8.0.220 size=31, ipv6=0
Mon Dec 18 11:32:37 2017 IFCONFIG POOL LIST
Mon Dec 18 11:32:37 2017 MULTI: TCP INIT maxclients=60 maxevents=64
Mon Dec 18 11:32:37 2017 Initialization Sequence Completed
Mon Dec 18 11:34:27 2017 TCP connection established with [AF_INET6]::ffff:publicIP:13919
Mon Dec 18 11:34:28 2017 206.74.242.6 TLS: Initial packet from [AF_INET6]::ffff:publicIP:13919, sid=xxx
Mon Dec 18 11:34:29 2017 206.74.242.6 VERIFY OK: depth=1, C=xxxxxxxx
Mon Dec 18 11:34:29 2017 206.74.242.6 Validating certificate extended key usage
Mon Dec 18 11:34:29 2017 206.74.242.6 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Mon Dec 18 11:34:29 2017 206.74.242.6 VERIFY EKU OK
Mon Dec 18 11:34:29 2017 206.74.242.6 VERIFY OK: depth=0, C=xxxxxx
Mon Dec 18 11:34:29 2017 206.74.242.6 peer info: IV_VER=2.3.2
Mon Dec 18 11:34:29 2017 206.74.242.6 peer info: IV_PLAT=linux
Mon Dec 18 11:34:29 2017 206.74.242.6 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Dec 18 11:34:29 2017 206.74.242.6 Outgoing Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 18 11:34:29 2017 206.74.242.6 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Dec 18 11:34:29 2017 206.74.242.6 Incoming Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 18 11:34:30 2017 206.74.242.6 Control Channel: TLSv1, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-SHA, 4096 bit RSA
Mon Dec 18 11:34:30 2017 206.74.242.6 [client1] Peer Connection Initiated with [AF_INET6]::ffff:publicIP:13919
Mon Dec 18 11:34:30 2017 client1/206.74.242.6 OPTIONS IMPORT: reading client specific options from: ccd\client1
Mon Dec 18 11:34:30 2017 client1/206.74.242.6 MULTI: Learn: 10.8.0.1 -> client1/206.74.242.6
Mon Dec 18 11:34:30 2017 client1/206.74.242.6 MULTI: primary virtual IP for client1/206.74.242.6: 10.8.0.1
Mon Dec 18 11:34:30 2017 client1/206.74.242.6 MULTI: internal route 10.107.101.0/24 -> client1/206.74.242.6
Mon Dec 18 11:34:30 2017 client1/206.74.242.6 MULTI: Learn: 10.107.101.0/24 -> client1/206.74.242.6
Mon Dec 18 11:34:30 2017 client1/206.74.242.6 REMOVE PUSH ROUTE: 'route 10.107.101.0 255.255.255.0'
Mon Dec 18 11:34:32 2017 client1/206.74.242.6 PUSH: Received control message: 'PUSH_REQUEST'
Mon Dec 18 11:34:32 2017 client1/206.74.242.6 SENT CONTROL [client1]: 'PUSH_REPLY,topology subnet,route-gateway 10.8.0.253,route 10.107.102.0 255.255.255.0,ping 10,ping-restart 120,ifconfig 10.8.0.1 255.255.255.0' (status=1)

EdgeRouter Log

ubnt:~$ egrep openvpn /var/log/messages
Dec 18 11:35:07 ubnt openvpn[1435]: OpenVPN 2.3.2 mips-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Aug  3 2017
Dec 18 11:35:07 ubnt openvpn[1435]: Control Channel Authentication: using '/path' as a OpenVPN static key file
Dec 18 11:35:07 ubnt openvpn[1435]: Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Dec 18 11:35:07 ubnt openvpn[1435]: Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Dec 18 11:35:07 ubnt openvpn[1435]: Socket Buffers: R=[87380->131072] S=[16384->131072]
Dec 18 11:35:07 ubnt openvpn[1436]: Attempting to establish TCP connection with [AF_INET]publicipandport [nonblock]
Dec 18 11:35:08 ubnt openvpn[1436]: TCP connection established with [AF_INET]publicipandport 
Dec 18 11:35:08 ubnt openvpn[1436]: TCPv4_CLIENT link local: [undef]
Dec 18 11:35:08 ubnt openvpn[1436]: TCPv4_CLIENT link remote: [AF_INET]publicipandport 
Dec 18 11:35:08 ubnt openvpn[1436]: TLS: Initial packet from [AF_INET]publicipandport , sid=xxxx
Dec 18 11:35:08 ubnt openvpn[1436]: VERIFY OK: depth=1, C=xxxxxx
Dec 18 11:35:08 ubnt openvpn[1436]: Validating certificate extended key usage
Dec 18 11:35:08 ubnt openvpn[1436]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Dec 18 11:35:08 ubnt openvpn[1436]: VERIFY EKU OK
Dec 18 11:35:08 ubnt openvpn[1436]: VERIFY OK: depth=0, C=xxxxxxx
Dec 18 11:35:10 ubnt openvpn[1436]: Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Dec 18 11:35:10 ubnt openvpn[1436]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Dec 18 11:35:10 ubnt openvpn[1436]: Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Dec 18 11:35:10 ubnt openvpn[1436]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Dec 18 11:35:10 ubnt openvpn[1436]: Control Channel: TLSv1, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-SHA, 4096 bit RSA
Dec 18 11:35:10 ubnt openvpn[1436]: [server] Peer Connection Initiated with [AF_INET]publicipandport 
Dec 18 11:35:12 ubnt openvpn[1436]: SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Dec 18 11:35:12 ubnt openvpn[1436]: PUSH: Received control message: 'PUSH_REPLY,topology subnet,route-gateway 10.8.0.253,route 10.107.102.0 255.255.255.0,ping 10,ping-restart 120,ifconfig 10.8.0.1 255.255.255.0'
Dec 18 11:35:12 ubnt openvpn[1436]: OPTIONS IMPORT: timers and/or timeouts modified
Dec 18 11:35:12 ubnt openvpn[1436]: OPTIONS IMPORT: --ifconfig/up options modified
Dec 18 11:35:12 ubnt openvpn[1436]: OPTIONS IMPORT: route options modified
Dec 18 11:35:12 ubnt openvpn[1436]: OPTIONS IMPORT: route-related options modified
Dec 18 11:35:12 ubnt openvpn[1436]: ROUTE_GATEWAY internalip/255.255.255.0 IFACE=eth0 HWADDR=xxxx
Dec 18 11:35:12 ubnt openvpn[1436]: TUN/TAP device vtun0 opened
Dec 18 11:35:12 ubnt openvpn[1436]: TUN/TAP TX queue length set to 100
Dec 18 11:35:12 ubnt openvpn[1436]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Dec 18 11:35:12 ubnt openvpn[1436]: /sbin/ip link set dev vtun0 up mtu 1500
Dec 18 11:35:12 ubnt openvpn[1436]: /sbin/ip addr add dev vtun0 10.8.0.1/24 broadcast 10.8.0.255
Dec 18 11:35:12 ubnt openvpn[1436]: /sbin/ip route add 10.107.102.0/24 via 10.8.0.253
Dec 18 11:35:12 ubnt openvpn[1436]: Initialization Sequence Completed

TinCanTech

Set this up like so:

server 10.8.0.0 255.255.255.0
# ifconfig 10.8.0.253 255.255.255.0

The --server helper function knows what it is doing.

maxburn

TinCanTech wrote Set this up like so:

server 10.8.0.0 255.255.255.0
# ifconfig 10.8.0.253 255.255.255.0

The --server helper function knows what it is doing.

Thanks, this helps tremendously. Seems to be working now but I have to get another router to test client to client out, and re-validate with our use case. Seeing this in the log looks suspicious to me, that next hop address is the same for both?

Sat Dec 30 16:20:00 2017 C:\Windows\system32\route.exe ADD 10.107.101.0 MASK 255.255.255.0 10.8.0.2
Sat Dec 30 16:20:00 2017 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Sat Dec 30 16:20:00 2017 Route addition via IPAPI succeeded [adaptive]
Sat Dec 30 16:20:00 2017 C:\Windows\system32\route.exe ADD 10.107.102.0 MASK 255.255.255.0 10.8.0.2
Sat Dec 30 16:20:00 2017 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Sat Dec 30 16:20:00 2017 Route addition via IPAPI succeeded [adaptive]

I also had to get rid of this;

ifconfig-pool 10.8.0.220 10.8.0.250 255.255.255.0

as it generated error

--server already defines an ifconfig-pool, so you can't also specify --ifconfig-pool explicitly

Can I not put the server VPN IP and DHCP pool somewhere else up in the IP range? That was my goal with this below but it now seems to ignore it and give the server 10.8.0.1 anyway.

ifconfig 10.8.0.253 255.255.255.0

My goal with those two lines was having remote router client1 with 10.8.0.1 (and so on) which is convenient for memory's sake. Plus I want to keep potential roadwarriors VPN IP outside of the range routed clients will be using. I guess I may just have to issue them CCDs as well if not.

maxburn

And should I be avoiding 10.8.0.2 for a client static VPN IP?