Hello, afterweeks of trying I need desperate help. Thnx in advanced. :shock: [b]Problem:[/b] My problem is that the client once connected with the VPN has no internet. I can't visit web-pages with the client. I wan't all client-trafic go through the VPN-server. [b]Server:[/b] I set up a home VPN server (OpenVPN 2.4) on my windows10-Pro desktop. Windows-firewall is enabled but i allow the openVPN-daemon through the firewall. I tried with turning the firewall off but no succes with that. I made a change in the registry of Window10: IPEnableRouter set to 1. This enables IP-forwarding in windows. The service "routing and remote acces" in Windows10 is running. The server is behind a D-link router. I enabled port-forwarding in the router. I added a static route in the router: Static route in router: Destination network: 172.72.16.0 Mask: 255.255.255.0 Gateway: 192.168.167.103 Metric: 1 Interface: WAN In my server config i push internet-trafic: [i]push "redirect-gateway def1 bypass-dhcp"[/i] ; and i push a dns-server: [i]push "dhcp-option DNS 8.8.8.8"[/i] The server-config is below this post. [b]Client:[/b] The client is a iphone8 with openvpn-installed. The client gets succesfully connected with the server. I can ping the server. I even get acces with te server by remote-desktop (rdesktop app on the iphone). The client is either connected with the internet by its 4G-network from my telecom-provider or with a wireless-wifi connection. The client-config is below. Thnx in advanced for help. [b]Server-config:[/b] [oconf=server]port XXXX proto udp dev tun dev-node Ethernet4 ca XXXX cert XXXX key XXXX dh XXXX ifconfig-pool-persist ipp.txt push "route 192.168.167.0 255.255.255.0" push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 8.8.8.8" client-to-client keepalive 10 120 cipher AES-128-CBC # AES max-clients 2 persist-tun status openvpn-status.log log openvpn.log verb 4[/oconf] [b]Client-config[/b] [oconf=client]client dev tun proto udp remote XXXX XXXX resolv-retry infinite nobind redirect-gateway def1 ca ca.crt cert XXXX.crt key XXXX.key remote-cert-tls server cipher AES-128-CBC verb 3[/oconf]

[url=http://openvpn.net/index.php/open-source/documentation/howto.html#redirect]HOWTO: Routing all client traffic (including web-traffic) through the VPN[/url]

Thnx for the reply! I read the link you posted earlier. I don't see a solution for my problem however. Maybe you can explain the following to me?: In [b]server-config[/b] i have the line [code]push "redirect-gateway def1 bypass-dhcp[/code] What means bypass-dhcp and is it needed for getting internet to the client? In [b]client-config[/b] i have the line [code]redirect-gateway def1[/code]. Is that needed in the client-config or only in the server-config? What i eventually want is that when i am in a open-wifi network i can savely go to the internet through my own vpn-server. But is that possible [u]without [/u]making a routing-route in the server-config for [u]every[/u] wifi-network i am connected to? Do you see any errors in my config-files or can you point me to the right direction as a solution for my client-internet-problem? Thnx in advanced. :)

[quote=hanzie37 post_id=75051 time=1513721460 user_id=42709] Static route in router: Destination network: 172.72.16.0 Mask: 255.255.255.0 Gateway: 192.168.167.103 Metric: 1 Interface: [b]WAN[/b] [/quote][i]Interface: WAN[/i] :?:

Hello TinCanTech, [quote]Interface: WAN[/quote] WAN is the only choice i can make in my router. My router is a D-Link DIR-880L. Don't think thats the problem. Picture below is my setup. Suppose client with ip 67.232.23.5 want's connection to the internet through my vpn on my win10-server with openvpn installed. Is it a problem in the routing tables? Which routes do i have to push to the client(s)? Under my picture is the printed routetable on my windows-10 computer with openvpn installed. [img]http://hzm.linkpc.net/setup.png[/img] [code]IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.167.1 192.168.167.103 291 127.0.0.0 255.0.0.0 On-link 127.0.0.1 331 127.0.0.1 255.255.255.255 On-link 127.0.0.1 331 127.255.255.255 255.255.255.255 On-link 127.0.0.1 331 172.72.16.0 255.255.255.0 On-link 192.168.167.103 36 172.72.16.0 255.255.255.0 172.72.16.2 172.72.16.1 291 172.72.16.0 255.255.255.252 On-link 172.72.16.1 291 172.72.16.1 255.255.255.255 On-link 172.72.16.1 291 172.72.16.3 255.255.255.255 On-link 172.72.16.1 291 172.72.16.255 255.255.255.255 On-link 192.168.167.103 291 192.168.133.0 255.255.255.0 On-link 192.168.133.1 291 192.168.133.1 255.255.255.255 On-link 192.168.133.1 291 192.168.133.255 255.255.255.255 On-link 192.168.133.1 291 192.168.167.0 255.255.255.0 On-link 192.168.167.103 291 192.168.167.103 255.255.255.255 On-link 192.168.167.103 291 192.168.167.255 255.255.255.255 On-link 192.168.167.103 291 192.168.255.0 255.255.255.0 On-link 192.168.255.1 291 192.168.255.1 255.255.255.255 On-link 192.168.255.1 291 192.168.255.255 255.255.255.255 On-link 192.168.255.1 291 224.0.0.0 240.0.0.0 On-link 127.0.0.1 331 224.0.0.0 240.0.0.0 On-link 172.72.16.1 291 224.0.0.0 240.0.0.0 On-link 192.168.255.1 291 224.0.0.0 240.0.0.0 On-link 192.168.133.1 291 224.0.0.0 240.0.0.0 On-link 192.168.167.103 291 255.255.255.255 255.255.255.255 On-link 127.0.0.1 331 255.255.255.255 255.255.255.255 On-link 172.72.16.1 291 255.255.255.255 255.255.255.255 On-link 192.168.255.1 291 255.255.255.255 255.255.255.255 On-link 192.168.133.1 291 255.255.255.255 255.255.255.255 On-link 192.168.167.103 291[/code] Thnx in advanced! :)

windows 10 is not a server , although you can run openvpn in client and/or server mode on it , you have to enable routing & remote access services on it to make it forward packets to your lan gateway, which if i remember correctly is some hack in the windows registry keys https://answers.microsoft.com/en-us/windows/forum/windows_7-networking/how-to-enable-ip-routing-in-windows-7/8970e722-e947-460d-80d5-fd6ffc850f3f?auth=1

Hello. In my first post i stated that i enabled ip- forwarding within the registry and ran the remote-service. So this is also not the problem. Can you look to the route-tables. On which device must which routes exist? Thnx. ;)

i don't see any obvious issues with the routing table , but [quote=hanzie37 post_id=75051 time=1513721460 user_id=42709] Static route in router: Destination network: 172.72.16.0 Mask: 255.255.255.0 Gateway: 192.168.167.103 Metric: 1 Interface: [b]WAN[/b] [/quote] as [b]TinCanTech[/b] also pointed out , i also think this is not correct ... and it has two problems 1. 172.72.16.0/24 [b]is not[/b] a private subnet 2. your static route basically tells your router to forward traffic for 172.72.16.0/24 to 192.168.167.103 on WAN interface ... which is connected to your ISP not your LAN, so it will fail. Note: you should also try to use "topology subnet" instead of the default "topology net30" , in my opinion it makes things simpler to setup,debug... it's just cleaner :) IPv4 private space https://en.wikipedia.org/wiki/Private_network#Private_IPv4_address_spaces

Thans you all! I am gonna look into this. Hope i can solve it. I let you now how far i get. Thnx!

Hello, [quote]172.72.16.0/24 is not a private subnet[/quote] You're right: changed the subnet to [b]172.16.1.0/24[/b] [quote]your static route basically tells your router to forward traffic for 172.72.16.0/24 to 192.168.167.103 on WAN interface ... which is connected to your ISP not your LAN, so it will fail.[/quote] In my D-link router i changed the static route to: Destination network: [b]172.16.1.0 [/b] Mask: [b]255.255.255.0 [/b] Gateway: [b]172.16.1.1[/b] [quote] you should also try to use "topology subnet" instead of the default "topology net30"[/quote] I added the line topology subnet in my server.conf :( With above changes no succes getting client internet go through te VPN. :shock: I can connect, connect to remote desktop, but i can’t visite webpages or ping any ip-adresses on the www. I can ping the server and computers in the subnet! Does anybody know what i can do further? Drives me nuts! Thnx in advanced.

[quote]Destination network: 172.16.1.0 Mask: 255.255.255.0 Gateway: 172.16.1.1[/quote] still wrong , since your router is not connected to that network it can't send traffic to 172.16.1.1

No internet through VPN-server

hanzie42

Thnx again for you're time and help !! 🙂 :!:

I disabled windows firewall on my win10-computer which is running openvpn-server. I also disabled firewall on DD-WRT router.

I ran wireshark and noticed below:

9	1.012668	172.16.1.4	8.8.8.8	ICMP	98	Echo (ping) request  id=0x2cd9, seq=52/13312, ttl=63 (no response found!)

Notice the no response found! !!

Belowe are the lines in wireshark that follow:

10	1.330485	192.168.167.1	192.168.167.103	UDP	131	55053 → 1855 Len=89
11	1.330637	172.16.1.4	8.8.8.8	DNS	79	Standard query 0xd6d0 A app-measurement.com

What is the conclusion when reading this? What does this mean? No ping-answer from 8.8.8.8 ??

Please help me further, thnx in advanced!

TiTex

as i told you before , you can't get a response from outside your network if your don't have nat enabled 🙂
if you want send me the teamviewer id/passwd and i'll try to help you

hanzie42

Hello,

With NAT do you mean enable network-sharing?
I enabled this with following settings:

Control Panel
Network and Sharing Center
Local Area Connection
Properties
Sharing
Tick the box "Allow other network users to connect through this computer's Internet connection"
From the drop-down list select "Local Area Connection 2", or whatever is the connection name of your TAP server connection.

But when i wanna start the openvpn-server i get following error:

Sun Dec 31 10:56:19 2017 us=977204 NETSH: C:\WINDOWS\system32\netsh.exe interface ip set address Ethernet4 dhcp
Sun Dec 31 10:56:20 2017 us=99599 ERROR: netsh command failed: returned error code 1

@Titex, i tried to sent the teamviewer ID/Passwd but that wasn't possible. When you send me a message when youre online and ready to help i sent the ID/Passwd. THNNX Alot!! 🙂

TiTex

send it on email titex[at]ilogicgroup[dot]org
i don't mean internet sharing , that (nat) has to be done on your router

TiTex

sorry dude , there must be something else going on there since even between client and server there are connectivity problems
we'll see some other times
in the meantime , just wanted to say that you can also configure openvpn server on the dd-wrt firmware

happy new year to everybody!

hanzie42

Thnx to all and especially TiTex for time and help!!

Happy to hear that there are no obvious config-errors in OpenVPN and in the router settings and Windows-setup. Try to look further next year 😉

Maybe setting up openvpn in the router instead of Windows will help.

Thnx again and happy newyear to all!

« Previous Page