Hello World Test - How To Make This Work?

AnotherTaffer

I am starting to learn about OpenVPN from the ground up, using the OpenVPN Cookbook for guidance, in the hope of implementing a home server setup, but I am having extreme difficulty connecting the two machines I am working with and need some guidance, please, with this basic command-line connectivity test:

Setup: Windows 7 x64 PC // Linux Fedora 27 (Server Edition) Laptop (this is to be the webserver)

Launch the server (listening)-side OpenVPN process for the TUN-style network:
[root@server]# openvpn --ifconfig 10.200.0.1 10.200.0.2 --dev tun

Then launch the client-side OpenVPN process:
[WinClient] C:\>:\Program Files\OpenVPN\bin\openvpn.exe" --ifconfig 10.200.0.2 10.200.0.1 --dev tun\
--remote openvpnserver.example.com

I have eventually managed (with both the machines on the same 192 subnet) to get this to the point where I am getting an error message of: The local and remote VPN endpoints cannot use the first or last address within a given 255.255.255.252 subnet

Using advice given in this post: https://forums.openvpn.net/viewtopic.php?t=8406, I have tried to use ifconfig-push, but this cannot be used in this context; so, how do I go about making this work, keeping this as simple as possible and command-line only?

TinCanTech

AnotherTaffer wrote Using advice given in this post: https://forums.openvpn.net/viewtopic.php?f=30&t=8406

maikcat wrotewithout configs,its a little difficult to help you out..

Michael.

Please see:
HOWTO: Request Help !

AnotherTaffer

There are no configs at this point, - that's why I did not post any and why I made the command-line distinction: at this point I am trying to establish a simple connection from one machine to the another as part of improving and building-on my understanding of the software and, according to the book, this is about as basic as it gets (beyond pinging the machines to ensure that they are able to talk to each other in the first place).

AnotherTaffer

Just to expand a little: trying to run the server side of the above from the Windows machine results in an error message like that shown below...

Wed Feb 07 01:00:31 2018 There is a problem in your selection of --ifconfig endpoints [local=192.168.1.10, remote=192.168.1.11]. The local and remote VPN endpoints cannot use the first or last address within a given 255.255.255.252 subnet.
This is a limitation of --dev tun when used with the TAP-WIN32 driver. Try 'openvpn --show-valid-subnets' option for more info.

...whilst trying to run the client on the Windows side results in:

Wed Feb 07 01:00:31 2018 There is a problem in your selection of --ifconfig endpoints [local=192.168.1.11, remote=192.168.1.10]. The local and remote VPN endpoints cannot use the first or last address within a given 255.255.255.252 subnet. This is a limitation of --dev tun when used with the TAP-WIN32 driver. Try 'openvpn --show-valid-subnets' option for more info.

Running the server side of the code from the Linux machine appears to work fine.

AnotherTaffer

Right, read the HOW TO: Request Help ! - all checkboxes ticked, - what now? - The manual also clearly states that OpenVPN can be run command line, and the guide I am using in conjunction with the manual is an acknowledged reference work. I am effectively stuck on word one of line one and am asking for nothing more than getting it working so I can continue studying it and, in turn, help others in a similar situation. Why is that wrong?

Also, the only part that works with the above setup is running the server side on the Linux box. - Windows will not work either as a client or a server which, in turn, rules out the Linux box as a client. The error given (by Windows, as a client) is:

Wed Feb 07 01:00:31 2018 There is a problem in your selection of --ifconfig endpoints [local=192.168.1.10, remote=192.168.1.11]. The local and remote VPN endpoints cannot use the first or last address within a given 255.255.255.252 subnet. This is a limitation of --dev tun when used with the TAP-WIN32 driver. Try 'openvpn --show-valid-subnets' option for more info.

The above is not supposed to happen, and the 192 subnet is a valid subnet.

TinCanTech

AnotherTaffer wrote This is a limitation of --dev tun when used with the TAP-WIN32 driver.
Try 'openvpn --show-valid-subnets' option for more info.

:roll:

AnotherTaffer

Thanks, - I did (before posting, I might add), - it showed that 192 is not a valid subnet, so I checked online and found that it is. I then switched the subnet to a 10.x.x.x subnet and hit exactly the same problem....

I then rebooted my router and restarted my systems (both the Windows and the Linux system) ...and still hit the same problem, following which I disabled all firewalls and ipfilters, restarted / rebooted all and ...still hit the same problem.

TinCanTech

See --topology in The Manual v24x

AnotherTaffer

Thanks, but that does not appear to be working for my setup, either.

Without --topology subnet:

openvpn --ifconfig 1.1.1.10 1.1.1.11 --dev tun
Wed Feb 07 21:59:33 2018 disabling NCP mode (--ncp-disable) because not in P2MP client or server mode
Wed Feb 07 21:59:33 2018 OpenVPN 2.4.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO]
[LZ4] [PKCS11] [AEAD] built on Sep 26 2017
Wed Feb 07 21:59:33 2018 Windows version 6.1 (Windows 7) 64bit
Wed Feb 07 21:59:33 2018 library versions: OpenSSL 1.0.2l  25 May 2017, LZO 2.10

Wed Feb 07 21:59:33 2018 ******* WARNING *******: All encryption and authentication features disabled -- All data will be tunnelled as clear text and will not be protected against man-in-the-middle changes. PLEASE DO RECONSIDER THIS CONFIGURATION!

Wed Feb 07 21:59:33 2018 There is a problem in your selection of --ifconfig endpoints [local=1.1.1.10, remote=1.1.1.11].  The local and remote VPN endpoints can not use the first or last address within a given 255.255.255.252 subnet.  This is a limitation of --dev tun when used with the TAP-WIN32 driver.  Try 'openvpn -
-show-valid-subnets' option for more info.
Wed Feb 07 21:59:33 2018 Exiting due to fatal error

With --topology subnet:

openvpn --topology subnet --ifconfig 1.1.1.10 1.1.1.11 --dev tun
Wed Feb 07 22:09:24 2018 disabling NCP mode (--ncp-disable) because not in P2MP
client or server mode
Wed Feb 07 22:09:24 2018 OpenVPN 2.4.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO]
[LZ4] [PKCS11] [AEAD] built on Sep 26 2017
Wed Feb 07 22:09:24 2018 Windows version 6.1 (Windows 7) 64bit
Wed Feb 07 22:09:24 2018 library versions: OpenSSL 1.0.2l  25 May 2017, LZO 2.10

Wed Feb 07 22:09:24 2018 ******* WARNING *******: All encryption and authenticat
ion features disabled -- All data will be tunnelled as clear text and will not be protected against man-in-the-middle changes. PLEASE DO RECONSIDER THIS CONFIGURATION!

Wed Feb 07 22:09:24 2018 open_tun
Wed Feb 07 22:09:24 2018 TAP-WIN32 device [Local Area Connection 6] opened: \\.\
Global\{B1A13B50-22A1-48D4-980B-7105480DBA9B}.tap
Wed Feb 07 22:09:24 2018 Set TAP-Windows TUN subnet mode network/local/netmask =
 1.1.1.10/1.1.1.10/1.1.1.11 [SUCCEEDED]
Wed Feb 07 22:09:24 2018 ERROR: --ip-win32 dynamic [offset] : offset is outside of --ifconfig subnet
Wed Feb 07 22:09:24 2018 Exiting due to fatal error

The above error appears to need --ifconfig-push to push a particular IP address, but I cannot figure out how to add this without causing an immediate, and terminal, error.

AnotherTaffer

--topology mode should also work with --mode-server...

openvpn --mode-server --topology subnet --dev tun
Options error: Unrecognized option or missing or extra parameter(s) in [CMD-LINE
]:1: mode-server (2.4.4)

openvpn --server-network 1.1.1.10 255.255.255.0 --dev tun
Options error: Unrecognized option or missing or extra parameter(s) in [CMD-LINE
]:1: server-network (2.4.4)

TinCanTech

TinCanTech wrote
AnotherTaffer wrote Using advice given in this post: https://forums.openvpn.net/viewtopic.php?f=30&t=8406

maikcat wrotewithout configs,its a little difficult to help you out..

Michael.

Please see:
HOWTO: Request Help !

AnotherTaffer

Thanks, but what are you trying to tell me? - I can cheat any day of the week with someone else's configuration. - I do not want that, - I would like to get this working from the ground-up, starting with the simplest possible tun and tap examples. - These are obviously broken, or deprecated (deprecated, I would guess, seeing as the book is a good few years old), so I am now trying to figure out what the simplest alternatives would be (command-line, because the book moves onto the creation and use of configuration files in a later chapter and sticks with the very simplest of concepts to start with in order to familiarize the reader with the most basic usage first). - I am using the examples given in that post to help me, but they are not working, and the manual lacks actual examples or uses configuration files.

AnotherTaffer

Making some progress (possibly)...

openvpn --topology subnet --server 1.1.1.10 255.255.255.0 -
-dev tun
Options error: --server directive network/netmask combination is invalid

openvpn --topology subnet --server 1.1.1.1 255.255.255.0 --
dev tun
Options error: --server directive network/netmask combination is invalid

openvpn --topology subnet --server 1.1.1.10 1.1.1.11 255.25
5.255.0 --dev tun
Options error: error parsing --server: 255.255.255.0 is not a recognized flag

I cannot figure out how to make that --server directive work - it matches all the examples I can find, what little information there is in the manual, and still will not work.

AnotherTaffer

@TinCanTech: thanks for your help, but this thread can be closed. - A joke is one thing, but whoever put this together is just totally taking the piss. - According the OpenVPN 2 Cookbook:

Shortest setup possible

This recipe will explain the shortest setup possible when using OpenVPN. For this setup two computers are used that are connected over a network (LAN or Internet). we will use both a TUN-style network and a TAP-style network and will focus on the differences between them.

A TUN device is used mostly tor VPN tunnels where only IP-traffic is used. A TAP device allows full Ethernet frames to be passed over the Open VPN tunnel, hence providing support for non-IP based protocols such as IPX and AppleTalk.

While this may seem useless at first glance, it can be very useful to quickly test whether OpenVPN can connect to a remote system.

Getting ready

Install OpenVPN 2.0 or higher on two computers. Make sure the computers are connected over a network. For this recipe, the server computer was running CentOS 5 Linux and OpenVPN 2.1.1 and the client was running Windows XP SP3 and OpenVPN 2.1.1.

How to do it ...
1. we launch the server (listening)-side OpenVPN process tor the TUN-style network:
[root@server]# openvpn --ifconfig 10.200.0.1 10.200.0.2 --dev tun

2. Then we launch the client-side OpenVPN process:

[WinClient] C:\>\Program Piles\OpenVPN\bin\openvpn.exe" --ifconfig 10.200.0.2 10.200.0.1 --dev tun --remote openvpnserver.example.com

I can only say that is quite obviously not so (the Shortest setup possible - or in any way possible at all), and it is quite obvious that either the community knows that this article is complete b*llocks, or there is no real interest in getting new users started with anything outside of simply grabbing other people's scripts and hoping for the best [which is about the best way of causing no end of confusion, wasted time, frustration, and compete ignorance of the basics that there is - well done OpenVPN(!)].

It would take a matter of seconds to give someone an outline solution that would work in this instance, and it is obvious that the person in question (myself) is not a bot, or someone trying to cheat at homework, but someone who is genuinely interested in making this work so they can study it, understand it, and make it work for something. Now, having exhausted the options with broken examples in manuals, and having hit an absolute stone wall on the forums, I will simply become another proponent of proprietary software.

TinCanTech

AnotherTaffer wrote it is obvious that the person in question (myself) is not a bot, or someone trying to cheat at homework, but someone who is genuinely interested in making this work so they can study it, understand it, and make it work for something

and yet you do not understand this :

TinCanTech wrote
TinCanTech wrote
AnotherTaffer wrote Using advice given in this post: https://forums.openvpn.net/viewtopic.php?f=30&t=8406

Please see:
HOWTO: Request Help !

Which boils down to configs and logs as prescribed ..

Or this :

TinCanTech wrote See --topology in The Manual v24x

Or this:

AnotherTaffer wrote Wed Feb 07 01:00:31 2018 There is a problem in your selection of --ifconfig endpoints [local=192.168.1.10, remote=192.168.1.11]. The local and remote VPN endpoints cannot use the first or last address within a given 255.255.255.252 subnet.
This is a limitation of --dev tun when used with the TAP-WIN32 driver. Try 'openvpn --show-valid-subnets' option for more info.

As for this :

AnotherTaffer wrote @TinCanTech: thanks for your help, but this thread can be closed. - A joke is one thing, but whoever put this together is just totally taking the piss. - According the OpenVPN 2 Cookbook:

Shortest setup possible

This recipe will explain the shortest setup possible when using OpenVPN. For this setup two computers are used that are connected over a network (LAN or Internet). we will use both a TUN-style network and a TAP-style network and will focus on the differences between them.

A TUN device is used mostly tor VPN tunnels where only IP-traffic is used. A TAP device allows full Ethernet frames to be passed over the Open VPN tunnel, hence providing support for non-IP based protocols such as IPX and AppleTalk.

While this may seem useless at first glance, it can be very useful to quickly test whether OpenVPN can connect to a remote system.

Getting ready

Install OpenVPN 2.0 or higher on two computers. Make sure the computers are connected over a network. For this recipe, the server computer was running CentOS 5 Linux and OpenVPN 2.1.1 and the client was running Windows XP SP3 and OpenVPN 2.1.1.

How to do it ...
1. we launch the server (listening)-side OpenVPN process tor the TUN-style network:
[root@server]# openvpn --ifconfig 10.200.0.1 10.200.0.2 --dev tun

2. Then we launch the client-side OpenVPN process:

[WinClient] C:\>\Program Piles\OpenVPN\bin\openvpn.exe" --ifconfig 10.200.0.2 10.200.0.1 --dev tun --remote openvpnserver.example.com
I can only say that is quite obviously not so (the Shortest setup possible - or in any way possible at all), and it is quite obvious that either the community knows that this article is complete b*llocks, or there is no real interest in getting new users started with anything outside of simply grabbing other people's scripts and hoping for the best [which is about the best way of causing no end of confusion, wasted time, frustration, and compete ignorance of the basics that there is - well done OpenVPN(!)].

It would take a matter of seconds to give someone an outline solution that would work in this instance, and it is obvious that the person in question (myself) is not a bot, or someone trying to cheat at homework, but someone who is genuinely interested in making this work so they can study it, understand it, and make it work for something. Now, having exhausted the options with broken examples in manuals, and having hit an absolute stone wall on the forums, I will simply become another proponent of proprietary software.

The Author is available to be contacted ..

AnotherTaffer

As no-one on this forum (yes, the OpenVPN forum itself) seems able, or capable of, supplying even just 3 small lines of code to get new users contributing and developing OpenVPN and helping, in turn, to keep the open source community alive and vibrant, I have decided to resolve this issue with the following (as much for my own benefit, and the benefit of others needing to know how to get this working, I might add, as a FY to those who will not help with something as simple as showing someone how to turn something on or how to make the initial connection).

So this is the final (working) solution for anyone needing to connect two machines using network addresses only (no domain configurations and absolutely no remote network or example.com connections whatsoever), with both machines on the same subnet. This is also about the simplest possible connection for anyone looking to get started using OpenVPN.

Setup:

1x Windows personal computer (running Windows 7 Pro x64)

1x Fedora 27 Server Edition laptop

Both machines connected via a router on the same LAN and able to communicate with each other (port 1194 - unless configured to be something different ) with VLAN separation (which is essential for my setup, not only for security considerations, but also for the extra IP address as a result of this configuration). I have also configured the second address, 10.200.0.6, as a static address on the linux box because, otherwise, in VLAN configuration, it will not be locked to that address, which could cause connectivity issues.

- OpenVPN installed on both machines, with the repository version (ie: not built from source on the machine, but downloaded via Yum) installed
- on the linux box

- static.key file generated on the linux box using:

openvpn --genkey --secret static.key

- the above file on my linux box is located in: /etc/openvpn/server or the OpenVPN \config sub-directory on the Windows machine.

- sample.ovpn [v.i.] is stored in an ASCII text file (Notepad / Notepad++ as an editor, not Microsoft Word!) as an .ovpn file
- within the OpenVPN \config sub-directory on the Windows machine and as a .conf file in /etc/openvpn/server on the linux box.

- OpenVPN GUI (Start Button - round object with Windows logo to the bottom left of the screen - All Programs - OpenVPN) is then initiated on the
- Windows machine, resulting in a small icon in the system tray to the bottom right of the screen (screen as viewed by the user). The .ovpn
- config file should then be accessible and editable by right clicking on the icon in order to select it, likewise with the log file.

- vpntest.conf is instantiated on the linux box with the code shown below (in my case), and as detailed above on the Windows machine.

openvpn vpntest.conf

All being well a tunnel will now be established between the two machines, and it will be possible to open an instance of CMD (command-line) on the Windows machine in order to ping the linux box. The linux box will require further configuration in order to make OpenVPN run in the background before it will be possible to ping the client, as it will otherwise remain in the foreground; effectively rendering the machine unusable for anything beyond those services already running in the background.

Observations:

OpenVPN on the Windows side uses a TAP adapter. This makes no difference to whether or not your config is using TAP or TUN, and should not prevent this simple configuration from working.

The two ifconfig IP addresses are not configured on my router, and there is absolutely no need for me to reconfigure my router at all in order to allow their use. - They are part of the same 255.255.255.0 subnet as the other two 10.200.0 addresses (10.200.0.5 and 10.200.0.6), so OpenVPN is allowed to use them via the OpenVPN adapter and DHCP.

The names of the config files follow no mandatory naming conventions beyond common sense, .ovpn file extension on the Windows machine, and a .conf file extension on the linux box.

OpenVPN is extremely pissy about what subnets it will work on, and will even refuse to work on subnets that are allowed under show-valid-subnets. Using non-sequential addresses within a subnet is also highly likely to result in failed connection attempts.

Beware of firewalld and SELinux. SELinux can be tamed until reboot with satanforce, sorry setenforce permissive, and in its /etc/selinux .conf file. I have a firewall and anti-spoof protection both running on the router with no problem, along with a software firewall on the Windows machine, a remote VPN connection, and occasional SSh connections to the linux machine; all of which co-exist quite happily together.

VLAN configuration can involve configuration via the default network adapter on Windows, following initial configuration on the router. Windows 7 does not like tagged VLAN, so an untagged VLAN0 may be a requirement. It is also likely that it will only be possible to add an untagged VLAN0 on the network adapter side following the initial creation of a tagged VLAN1. This is true of Intel adapters, and Windows will need to be connected to the untagged port on the router when configuring the devices on the router.

sample.ovpn:

dev tun
remote 10.200.0.6
ifconfig 10.200.0.1 10.200.0.2
secret static.key
cipher AES-256-CBC
persist-tun
persist-key

vpntest.conf

dev tun
remote 10.200.0.5
ifconfig 10.200.0.2 10.200.0.1
user nobody
group nobody
secret static.key
cipher AES-256-CBC
persist-tun
persist-key

sample.log

Tue Mar 06 00:34:27 2018 disabling NCP mode (--ncp-disable) because not in P2MP client or server mode
Tue Mar 06 00:34:27 2018 OpenVPN 2.4.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Sep 26 2017
Tue Mar 06 00:34:27 2018 Windows version 6.1 (Windows 7) 64bit
Tue Mar 06 00:34:27 2018 library versions: OpenSSL 1.0.2l  25 May 2017, LZO 2.10
Enter Management Password:
Tue Mar 06 00:34:27 2018 open_tun
Tue Mar 06 00:34:27 2018 TAP-WIN32 device [Local Area Connection 6] opened: \\.\Global\{B1A13B50-22A1-48D4-980B-7105480DBA9B}.tap
Tue Mar 06 00:34:27 2018 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.200.0.1/255.255.255.252 on interface {B1A13B50-22A1-48D4-980B-7105480DBA9B} [DHCP-serv: 10.200.0.2, lease-time: 31536000]
Tue Mar 06 00:34:27 2018 Successful ARP Flush on interface [15] {B1A13B50-22A1-48D4-980B-7105480DBA9B}
Tue Mar 06 00:34:27 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Tue Mar 06 00:34:27 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]10.200.0.6:1194
Tue Mar 06 00:34:27 2018 UDP link local (bound): [AF_INET][undef]:1194
Tue Mar 06 00:34:27 2018 UDP link remote: [AF_INET]10.200.0.6:1194
Tue Mar 06 00:34:36 2018 Peer Connection Initiated with [AF_INET]10.200.0.6:1194
Tue Mar 06 00:34:41 2018 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Mar 06 00:34:41 2018 Initialization Sequence Completed