Server Ubuntu 18.04 --> client windows XP --> Can't ping lan address

etantonio

Hy,
my server is Ubuntu 18.04 with installed openvpn server

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem
push "route 192.168.0.0 255.255.255.0"
push "route 192.168.2.0 255.255.255.0"
client-config-dir ccd
route 192.168.0.0 255.255.255.0
route 192.168.2.0 255.255.255.0
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
log openvpn.log
management localhost 7505
explicit-exit-notify 1

My client is a computer using windows XP without Firewall and running OpenVPN 2.3.18 i686-w64-mingw32 as Client:

the client config is the following:

client
dev tun
proto udp
sndbuf 0
rcvbuf 0
remote XXX.YYY.ZZ.KK 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
setenv opt block-outside-dns
key-direction 1
verb 3
<ca>
-----BEGIN CERTIFICATE-----
TOP_SECRET
-----END CERTIFICATE-----
</ca>
<cert>
TOP_SECRET
</cert>
<key>
-----BEGIN PRIVATE KEY-----
TOP_SECRET
Zxcq2rogtJDUcY1nSVeNqQ==
-----END PRIVATE KEY-----
</key>
<tls-auth>
TOP_SECRET
</tls-auth>

this is the openvpn-status.log:

OpenVPN CLIENT LIST
Updated,Tue Nov  6 18:08:50 2018
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
client_212_237_33_65,95.243.234.182:21209,3770876,28985349,Tue Nov  6 17:08:30 2018
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
192.168.2.0/24,client_212_237_33_65,95.243.234.182:21209,Tue Nov  6 17:08:30 2018
10.8.0.6,client_212_237_33_65,95.243.234.182:21209,Tue Nov  6 18:08:49 2018
GLOBAL STATS
Max bcast/mcast queue length,1
END

I've no problem pinging from server to client

[b]solergy@Solergy-CS:~$ ping 10.8.0.6
PING 10.8.0.6 (10.8.0.6) 56(84) bytes of data.
64 bytes from 10.8.0.6: icmp_seq=1 ttl=128 time=43.5 ms
[/b]

and from client to server

Esecuzione di Ping 10.8.0.1 con 32 byte di dati:
Risposta da 10.8.0.1: byte=32 durata=42ms TTL=64

but I can't ping the client lan address 192.168.2.155

[b]solergy@Solergy-CS:~$ ping 192.168.2.155
PING 192.168.2.155 (192.168.2.155) 56(84) bytes of data.
^C
--- 192.168.2.155 ping statistics ---
8 packets transmitted, 0 received, 100% packet loss, time 7174ms[/b]

this is the ipconfig/all on windows xp client:

[b]
Scheda Ethernet Connessione alla rete locale (LAN):
        Indirizzo fisico. . . . . . . . . . . : 00-E0-4D-75-3C-C4
        DHCP abilitato. . . . . . . . . . . . : No
        Indirizzo IP. . . . . . . . . . . . . : 192.168.2.155
        Subnet mask . . . . . . . . . . . . . : 255.255.255.0
        Indirizzo IP. . . . . . . . . . . . . : 192.168.0.155
        Subnet mask . . . . . . . . . . . . . : 255.255.255.0
        Indirizzo IP. . . . . . . . . . . . . : 192.168.1.155
        Subnet mask . . . . . . . . . . . . . : 255.255.255.0
        Gateway predefinito . . . . . . . . . : 192.168.1.1
                                                192.168.2.1
        Server DNS . . . . . . . . . . . . .  : 192.168.1.250

Scheda Ethernet Connessione alla rete locale (LAN) 5:

        Suffisso DNS specifico per connessione:
        Descrizione . . . . . . . . . . . . . : TAP-Windows Adapter V9
        Indirizzo fisico. . . . . . . . . . . : 00-FF-F8-C0-F0-1B
        DHCP abilitato. . . . . . . . . . . . : S??
        Configurazione automatica abilitata   : S??
        Indirizzo IP. . . . . . . . . . . . . : 10.8.0.6
        Subnet mask . . . . . . . . . . . . . : 255.255.255.252
        Gateway predefinito . . . . . . . . . : 10.8.0.5
        Server DHCP . . . . . . . . . . . . . : 10.8.0.5
        Server DNS . . . . . . . . . . . . .  : 208.67.222.222
                                                208.67.220.220
[/b]

the log on client side is the following:

[b]Tue Nov 06 18:17:17 2018 OpenVPN 2.3.18 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Oct 26 2017
Tue Nov 06 18:17:17 2018 Windows version 5.1 (Windows XP) 32bit
Tue Nov 06 18:17:17 2018 library versions: OpenSSL 1.0.2l  25 May 2017, LZO 2.10
Tue Nov 06 18:17:17 2018 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Nov 06 18:17:17 2018 Need hold release from management interface, waiting...
Tue Nov 06 18:17:17 2018 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Nov 06 18:17:17 2018 MANAGEMENT: CMD 'state on'
Tue Nov 06 18:17:17 2018 MANAGEMENT: CMD 'log all on'
Tue Nov 06 18:17:17 2018 MANAGEMENT: CMD 'hold off'
Tue Nov 06 18:17:17 2018 MANAGEMENT: CMD 'hold release'
Tue Nov 06 18:17:17 2018 Control Channel Authentication: tls-auth using INLINE static key file
Tue Nov 06 18:17:17 2018 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Nov 06 18:17:17 2018 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Nov 06 18:17:17 2018 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Nov 06 18:17:17 2018 UDPv4 link local: [undef]
Tue Nov 06 18:17:17 2018 UDPv4 link remote: [AF_INET]XXX.YYY.33.65:1194
Tue Nov 06 18:17:17 2018 MANAGEMENT: >STATE:1541524637,WAIT,,,
Tue Nov 06 18:17:17 2018 MANAGEMENT: >STATE:1541524637,AUTH,,,
Tue Nov 06 18:17:17 2018 TLS: Initial packet from [AF_INET]XXX.YYY.33.65:1194, sid=e008568c c350d47e
Tue Nov 06 18:17:17 2018 VERIFY OK: depth=1, CN=ChangeMe
Tue Nov 06 18:17:17 2018 Validating certificate key usage
Tue Nov 06 18:17:17 2018 ++ Certificate has key usage  00a0, expects 00a0
Tue Nov 06 18:17:17 2018 VERIFY KU OK
Tue Nov 06 18:17:17 2018 Validating certificate extended key usage
Tue Nov 06 18:17:17 2018 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Nov 06 18:17:17 2018 VERIFY EKU OK
Tue Nov 06 18:17:17 2018 VERIFY OK: depth=0, CN=server
Tue Nov 06 18:17:18 2018 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Nov 06 18:17:18 2018 Data Channel Encrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Nov 06 18:17:18 2018 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Nov 06 18:17:18 2018 Data Channel Decrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Nov 06 18:17:18 2018 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Nov 06 18:17:18 2018 [server] Peer Connection Initiated with [AF_INET]XXX.YYY.33.65:1194
Tue Nov 06 18:17:19 2018 MANAGEMENT: >STATE:1541524639,GET_CONFIG,,,
Tue Nov 06 18:17:20 2018 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue Nov 06 18:17:20 2018 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route 192.168.0.0 255.255.255.0,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5,peer-id 0'
Tue Nov 06 18:17:20 2018 OPTIONS IMPORT: timers and/or timeouts modified
Tue Nov 06 18:17:20 2018 OPTIONS IMPORT: --ifconfig/up options modified
Tue Nov 06 18:17:20 2018 OPTIONS IMPORT: route options modified
Tue Nov 06 18:17:20 2018 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Nov 06 18:17:20 2018 OPTIONS IMPORT: peer-id set
Tue Nov 06 18:17:20 2018 OPTIONS IMPORT: adjusting link_mtu to 1604
Tue Nov 06 18:17:20 2018 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 I=2 HWADDR=00:e0:4d:75:3c:c4
Tue Nov 06 18:17:20 2018 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Nov 06 18:17:20 2018 MANAGEMENT: >STATE:1541524640,ASSIGN_IP,,10.8.0.6,[/b]

instead on server side:

Tue Nov  6 17:08:18 2018 OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Sep  5 2018
Tue Nov  6 17:08:18 2018 library versions: OpenSSL 1.1.0g  2 Nov 2017, LZO 2.08
Tue Nov  6 17:08:18 2018 setsockopt(IPV6_V6ONLY=0)
Tue Nov  6 17:08:18 2018 MANAGEMENT: TCP Socket listening on [AF_INET6]::1:7505
Tue Nov  6 17:08:18 2018 Diffie-Hellman initialized with 2048 bit key
Tue Nov  6 17:08:18 2018 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Nov  6 17:08:18 2018 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Nov  6 17:08:18 2018 ROUTE_GATEWAY 212.237.33.1/255.255.255.0 IFACE=eth0 HWADDR=00:50:56:a6:76:78
Tue Nov  6 17:08:18 2018 TUN/TAP device tun0 opened
Tue Nov  6 17:08:18 2018 TUN/TAP TX queue length set to 100
Tue Nov  6 17:08:18 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Tue Nov  6 17:08:18 2018 /sbin/ip link set dev tun0 up mtu 1500
Tue Nov  6 17:08:18 2018 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Tue Nov  6 17:08:18 2018 /sbin/ip route add 192.168.0.0/24 via 10.8.0.2
Tue Nov  6 17:08:18 2018 /sbin/ip route add 192.168.2.0/24 via 10.8.0.2
Tue Nov  6 17:08:18 2018 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Tue Nov  6 17:08:18 2018 Could not determine IPv4/IPv6 protocol. Using AF_INET
Tue Nov  6 17:08:18 2018 Socket Buffers: R=[212992->212992] S=[212992->212992]
Tue Nov  6 17:08:18 2018 UDPv4 link local (bound): [AF_INET][undef]:1194
Tue Nov  6 17:08:18 2018 UDPv4 link remote: [AF_UNSPEC]
Tue Nov  6 17:08:18 2018 GID set to nogroup
Tue Nov  6 17:08:18 2018 UID set to nobody
Tue Nov  6 17:08:18 2018 MULTI: multi_init called, r=256 v=256
Tue Nov  6 17:08:18 2018 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Tue Nov  6 17:08:18 2018 ifconfig_pool_read(), in='client_XXX_YYY_33_65,10.8.0.2', TODO: IPv6
Tue Nov  6 17:08:18 2018 succeeded -> ifconfig_pool_set()
Tue Nov  6 17:08:18 2018 IFCONFIG POOL LIST
Tue Nov  6 17:08:18 2018 Initialization Sequence Completed
Tue Nov  6 17:08:30 2018 95.243.234.182:21209 TLS: Initial packet from [AF_INET]95.243.234.182:21209, sid=ce2939a4 4ab72a39
Tue Nov  6 17:08:30 2018 95.243.234.182:21209 VERIFY OK: depth=1, CN=ChangeMe
Tue Nov  6 17:08:30 2018 95.243.234.182:21209 VERIFY OK: depth=0, CN=client_XXX_YYY_33_65
Tue Nov  6 17:08:30 2018 95.243.234.182:21209 peer info: IV_VER=2.3.18
Tue Nov  6 17:08:30 2018 95.243.234.182:21209 peer info: IV_PLAT=win
Tue Nov  6 17:08:30 2018 95.243.234.182:21209 peer info: IV_PROTO=2
Tue Nov  6 17:08:30 2018 95.243.234.182:21209 peer info: IV_GUI_VER=OpenVPN_GUI_10
Tue Nov  6 17:08:30 2018 95.243.234.182:21209 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Nov  6 17:08:30 2018 95.243.234.182:21209 Outgoing Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Nov  6 17:08:30 2018 95.243.234.182:21209 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Nov  6 17:08:30 2018 95.243.234.182:21209 Incoming Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Nov  6 17:08:30 2018 95.243.234.182:21209 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Nov  6 17:08:30 2018 95.243.234.182:21209 [client_XXX_YYY_33_65] Peer Connection Initiated with [AF_INET]95.243.234.182:21209
Tue Nov  6 17:08:30 2018 client_XXX_YYY_33_65/95.243.234.182:21209 OPTIONS IMPORT: reading client specific options from: ccd/client_XXX_YYY_33_65
Tue Nov  6 17:08:30 2018 client_XXX_YYY_33_65/95.243.234.182:21209 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Tue Nov  6 17:08:30 2018 client_XXX_YYY_33_65/95.243.234.182:21209 MULTI: Learn: 10.8.0.6 -> client_XXX_YYY_33_65/95.243.234.182:21209
Tue Nov  6 17:08:30 2018 client_XXX_YYY_33_65/95.243.234.182:21209 MULTI: primary virtual IP for client_XXX_YYY_33_65/95.243.234.182:21209: 10.8.0.6
Tue Nov  6 17:08:30 2018 client_XXX_YYY_33_65/95.243.234.182:21209 MULTI: internal route 192.168.2.0/24 -> client_XXX_YYY_33_65/95.243.234.182:21209
Tue Nov  6 17:08:30 2018 client_XXX_YYY_33_65/95.243.234.182:21209 MULTI: Learn: 192.168.2.0/24 -> client_XXX_YYY_33_65/95.243.234.182:21209
Tue Nov  6 17:08:30 2018 client_XXX_YYY_33_65/95.243.234.182:21209 REMOVE PUSH ROUTE: 'route 192.168.2.0 255.255.255.0'
Tue Nov  6 17:08:33 2018 client_XXX_YYY_33_65/95.243.234.182:21209 PUSH: Received control message: 'PUSH_REQUEST'
Tue Nov  6 17:08:33 2018 client_XXX_YYY_33_65/95.243.234.182:21209 SENT CONTROL [client_XXX_YYY_33_65]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route 192.168.0.0 255.255.255.0,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5,peer-id 0' (status=1)
Tue Nov  6 17:08:41 2018 MULTI: Learn: 192.168.2.90 -> client_XXX_YYY_33_65/95.243.234.182:21209
Tue Nov  6 17:08:41 2018 MULTI: Learn: 192.168.2.91 -> client_XXX_YYY_33_65/95.243.234.182:21209
Tue Nov  6 17:10:19 2018 MULTI: Learn: 192.168.2.155 -> client_XXX_YYY_33_65/95.243.234.182:21209
Tue Nov  6 17:22:19 2018 MULTI: Learn: 192.168.2.155 -> client_XXX_YYY_33_65/95.243.234.182:21209
Tue Nov  6 18:08:30 2018 client_XXX_YYY_33_65/95.243.234.182:21209 TLS: soft reset sec=0 bytes=32629867/-1 pkts=60769/0
Tue Nov  6 18:08:30 2018 client_XXX_YYY_33_65/95.243.234.182:21209 VERIFY OK: depth=1, CN=ChangeMe
Tue Nov  6 18:08:30 2018 client_XXX_YYY_33_65/95.243.234.182:21209 VERIFY OK: depth=0, CN=client_XXX_YYY_33_65
Tue Nov  6 18:08:30 2018 client_XXX_YYY_33_65/95.243.234.182:21209 peer info: IV_VER=2.3.18
Tue Nov  6 18:08:30 2018 client_XXX_YYY_33_65/95.243.234.182:21209 peer info: IV_PLAT=win
Tue Nov  6 18:08:30 2018 client_XXX_YYY_33_65/95.243.234.182:21209 peer info: IV_PROTO=2
Tue Nov  6 18:08:30 2018 client_XXX_YYY_33_65/95.243.234.182:21209 peer info: IV_GUI_VER=OpenVPN_GUI_10
Tue Nov  6 18:08:30 2018 client_XXX_YYY_33_65/95.243.234.182:21209 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Nov  6 18:08:30 2018 client_XXX_YYY_33_65/95.243.234.182:21209 Outgoing Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Nov  6 18:08:30 2018 client_XXX_YYY_33_65/95.243.234.182:21209 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Nov  6 18:08:30 2018 client_XXX_YYY_33_65/95.243.234.182:21209 Incoming Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Nov  6 18:08:30 2018 client_XXX_YYY_33_65/95.243.234.182:21209 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Nov  6 18:14:59 2018 MULTI: Learn: 192.168.2.155 -> client_XXX_YYY_33_65/95.243.234.182:21209
Tue Nov  6 18:16:50 2018 95.243.234.182:22113 TLS: Initial packet from [AF_INET]95.243.234.182:22113, sid=13dfa944 eee1028a
Tue Nov  6 18:16:50 2018 95.243.234.182:22113 VERIFY OK: depth=1, CN=ChangeMe
Tue Nov  6 18:16:50 2018 95.243.234.182:22113 VERIFY OK: depth=0, CN=client_XXX_YYY_33_65
Tue Nov  6 18:16:50 2018 95.243.234.182:22113 peer info: IV_VER=2.3.18
Tue Nov  6 18:16:50 2018 95.243.234.182:22113 peer info: IV_PLAT=win
Tue Nov  6 18:16:50 2018 95.243.234.182:22113 peer info: IV_PROTO=2
Tue Nov  6 18:16:50 2018 95.243.234.182:22113 peer info: IV_GUI_VER=OpenVPN_GUI_10
Tue Nov  6 18:16:50 2018 95.243.234.182:22113 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Nov  6 18:16:50 2018 95.243.234.182:22113 Outgoing Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Nov  6 18:16:50 2018 95.243.234.182:22113 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Nov  6 18:16:50 2018 95.243.234.182:22113 Incoming Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Nov  6 18:16:50 2018 95.243.234.182:22113 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Nov  6 18:16:50 2018 95.243.234.182:22113 [client_XXX_YYY_33_65] Peer Connection Initiated with [AF_INET]95.243.234.182:22113
Tue Nov  6 18:16:50 2018 MULTI: new connection by client 'client_XXX_YYY_33_65' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Tue Nov  6 18:16:50 2018 OPTIONS IMPORT: reading client specific options from: ccd/client_XXX_YYY_33_65
Tue Nov  6 18:16:50 2018 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Tue Nov  6 18:16:50 2018 MULTI: Learn: 10.8.0.6 -> client_XXX_YYY_33_65/95.243.234.182:22113
Tue Nov  6 18:16:50 2018 MULTI: primary virtual IP for client_XXX_YYY_33_65/95.243.234.182:22113: 10.8.0.6
Tue Nov  6 18:16:50 2018 MULTI: internal route 192.168.2.0/24 -> client_XXX_YYY_33_65/95.243.234.182:22113
Tue Nov  6 18:16:50 2018 MULTI: Learn: 192.168.2.0/24 -> client_XXX_YYY_33_65/95.243.234.182:22113
Tue Nov  6 18:16:50 2018 REMOVE PUSH ROUTE: 'route 192.168.2.0 255.255.255.0'
Tue Nov  6 18:16:51 2018 MULTI: Learn: 192.168.2.90 -> client_XXX_YYY_33_65/95.243.234.182:22113
Tue Nov  6 18:16:51 2018 MULTI: Learn: 192.168.2.91 -> client_XXX_YYY_33_65/95.243.234.182:22113
Tue Nov  6 18:16:52 2018 client_XXX_YYY_33_65/95.243.234.182:22113 PUSH: Received control message: 'PUSH_REQUEST'
Tue Nov  6 18:16:52 2018 client_XXX_YYY_33_65/95.243.234.182:22113 SENT CONTROL [client_XXX_YYY_33_65]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route 192.168.0.0 255.255.255.0,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5,peer-id 1' (status=1)
Tue Nov  6 18:17:18 2018 95.243.234.182:22149 TLS: Initial packet from [AF_INET]95.243.234.182:22149, sid=f3cb65f1 469ad525
Tue Nov  6 18:17:18 2018 95.243.234.182:22149 VERIFY OK: depth=1, CN=ChangeMe
Tue Nov  6 18:17:18 2018 95.243.234.182:22149 VERIFY OK: depth=0, CN=client_XXX_YYY_33_65
Tue Nov  6 18:17:18 2018 95.243.234.182:22149 peer info: IV_VER=2.3.18
Tue Nov  6 18:17:18 2018 95.243.234.182:22149 peer info: IV_PLAT=win
Tue Nov  6 18:17:18 2018 95.243.234.182:22149 peer info: IV_PROTO=2
Tue Nov  6 18:17:18 2018 95.243.234.182:22149 peer info: IV_GUI_VER=OpenVPN_GUI_10
Tue Nov  6 18:17:18 2018 95.243.234.182:22149 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Nov  6 18:17:18 2018 95.243.234.182:22149 Outgoing Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Nov  6 18:17:18 2018 95.243.234.182:22149 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Nov  6 18:17:18 2018 95.243.234.182:22149 Incoming Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Nov  6 18:17:18 2018 95.243.234.182:22149 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Nov  6 18:17:18 2018 95.243.234.182:22149 [client_XXX_YYY_33_65] Peer Connection Initiated with [AF_INET]95.243.234.182:22149
Tue Nov  6 18:17:18 2018 MULTI: new connection by client 'client_XXX_YYY_33_65' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Tue Nov  6 18:17:18 2018 OPTIONS IMPORT: reading client specific options from: ccd/client_XXX_YYY_33_65
Tue Nov  6 18:17:18 2018 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Tue Nov  6 18:17:18 2018 MULTI: Learn: 10.8.0.6 -> client_XXX_YYY_33_65/95.243.234.182:22149
Tue Nov  6 18:17:18 2018 MULTI: primary virtual IP for client_XXX_YYY_33_65/95.243.234.182:22149: 10.8.0.6
Tue Nov  6 18:17:18 2018 MULTI: internal route 192.168.2.0/24 -> client_XXX_YYY_33_65/95.243.234.182:22149
Tue Nov  6 18:17:18 2018 MULTI: Learn: 192.168.2.0/24 -> client_XXX_YYY_33_65/95.243.234.182:22149
Tue Nov  6 18:17:18 2018 REMOVE PUSH ROUTE: 'route 192.168.2.0 255.255.255.0'
Tue Nov  6 18:23:36 2018 OPTIONS IMPORT: reading client specific options from: ccd/client_XXX_YYY_33_65
Tue Nov  6 18:23:36 2018 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Tue Nov  6 18:23:36 2018 MULTI: Learn: 10.8.0.6 -> client_XXX_YYY_33_65/95.243.234.182:22303
Tue Nov  6 18:23:36 2018 MULTI: primary virtual IP for client_XXX_YYY_33_65/95.243.234.182:22303: 10.8.0.6
Tue Nov  6 18:23:36 2018 MULTI: internal route 192.168.2.0/24 -> client_XXX_YYY_33_65/95.243.234.182:22303
Tue Nov  6 18:23:36 2018 MULTI: Learn: 192.168.2.0/24 -> client_XXX_YYY_33_65/95.243.234.182:22303
Tue Nov  6 18:23:36 2018 REMOVE PUSH ROUTE: 'route 192.168.2.0 255.255.255.0'
Tue Nov  6 18:23:37 2018 MULTI: Learn: 192.168.2.90 -> client_XXX_YYY_33_65/95.243.234.182:22303
Tue Nov  6 18:23:39 2018 client_XXX_YYY_33_65/95.243.234.182:22303 PUSH: Received control message: 'PUSH_REQUEST'
Tue Nov  6 18:23:39 2018 client_XXX_YYY_33_65/95.243.234.182:22303 SENT CONTROL [client_XXX_YYY_33_65]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route 192.168.0.0 255.255.255.0,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5,peer-id 1' (status=1)
Tue Nov  6 18:23:41 2018 MULTI: Learn: 192.168.2.91 -> client_XXX_YYY_33_65/95.243.234.182:22303

[/b]

etantonio

It is strange that I can't find a solution to this problem,
I'm not a network administrator but it seems too much complicated for me to understand where's the problem

TinCanTech

etantonio wrote I can't ping the client lan address 192.168.2.155

etantonio wrote this is the ipconfig/all on windows xp client:

Scheda Ethernet Connessione alla rete locale (LAN):
        Indirizzo fisico. . . . . . . . . . . : 00-E0-4D-75-3C-C4
        DHCP abilitato. . . . . . . . . . . . : No
        Indirizzo IP. . . . . . . . . . . . . : 192.168.2.155
        Subnet mask . . . . . . . . . . . . . : 255.255.255.0

Enable IP Forwarding on the client.

etantonio

Thanks for your answer,
ip forwarding is now enabled on the XP client

“HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters --> “IPEnableRouter=1”

But it is not possible to ping from 192.168.1.155 from server (not 192.168.2.155 to simplify analysis),
using wireshark on XP I can see packets from 2xx.3yy.12.54 arrive to XP client

[b]6803	800.091996000	2XX.2YY.33.65	192.168.1.155	ICMP	98	Echo (ping) request  id=0x0775, seq=799/7939, ttl=64 (no response found!)[/b]

but there's no answer to server 2xx.3yy.12.54 .

these are the routes that belongs to windows XP

===========================================================================
Route attive:
Indirizzo rete             Mask             Gateway       Interfac.  Metric
          0.0.0.0        128.0.0.0         10.8.0.1        10.8.0.8       1
          0.0.0.0          0.0.0.0      192.168.1.1   192.168.1.155       20
         10.8.0.0    255.255.255.0         10.8.0.8        10.8.0.8       30
         10.8.0.8  255.255.255.255        127.0.0.1       127.0.0.1       30
   10.255.255.255  255.255.255.255         10.8.0.8        10.8.0.8       30
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
        128.0.0.0        128.0.0.0         10.8.0.1        10.8.0.8       1
      192.168.0.0    255.255.255.0         10.8.0.1        10.8.0.8       1
      192.168.1.0    255.255.255.0    192.168.1.155   192.168.1.155       20
    192.168.1.155  255.255.255.255        127.0.0.1       127.0.0.1       20
    192.168.1.255  255.255.255.255    192.168.1.155   192.168.1.155       20
      192.168.2.0    255.255.255.0         10.8.0.1        10.8.0.8       1
    2xx.3yy.12.54  255.255.255.255      192.168.1.1   192.168.1.155       1
  2xx.3yy.zz.kk  255.255.255.255      192.168.1.1   192.168.1.155       20
        224.0.0.0        240.0.0.0         10.8.0.8        10.8.0.8       30
        224.0.0.0        240.0.0.0    192.168.1.155   192.168.1.155       20
  255.255.255.255  255.255.255.255         10.8.0.8        10.8.0.8       1
  255.255.255.255  255.255.255.255    192.168.1.155   192.168.1.155       1
Gateway predefinito:          10.8.0.1
===========================================================================

by my point of view the right gateway for 2xx.3yy.12.54 have to be 10.8.0.8
but this is directly setted by openvpn I think.

I still can't find the solution.

Antonio

etantonio

There's an update,
it seems that the openvpn server can't ping 192.168.1.155
but another openvpn client on a different device can ping it and viceversa,
so 192.168.1.155 (10.8.0.8 on VPN) can ping 192.168.0.1 (10.8.0.4 on VPN)
this is very interesting but my requirement is that the server have to ping 192.168.1.155 and 192.168.0.1 and this is not available.

This is server conf:

port 1194
proto udp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 5
crl-verify crl.pem
comp-lzo
client-to-client
;duplicate-cn
push "route 192.168.0.0 255.255.255.0"
push "route 192.168.1.0 255.255.255.0"
push "route 192.168.2.0 255.255.255.0"
client-config-dir ccd
route 192.168.0.0 255.255.255.0
route 192.168.1.0 255.255.255.0
route 192.168.2.0 255.255.255.0
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
log          openvpn.log
management localhost 7505
explicit-exit-notify 1

and this is client conf:

client
dev tun
proto udp
sndbuf 0
rcvbuf 0
remote 2XX.2YY.ZZ.WW 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
setenv opt block-outside-dns
key-direction 1
verb 3
comp-lzo
<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----

-----END PRIVATE KEY-----
</key>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
-----END OpenVPN Static key V1-----
</tls-auth>

any idea about where still there's a problem?
Why the client know how to answer to another client but don't know how to answer to the server?
Thanks,
Antonio

TinCanTech

etantonio wrote Thanks for your answer,
ip forwarding is now enabled on the XP client

“HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters --> “IPEnableRouter=1”

But it is not possible to ping from 192.168.1.155 from server (not 192.168.2.155 to simplify analysis),
using wireshark on XP I can see packets from 2xx.3yy.12.54 arrive to XP client

Code: Select all

6803 800.091996000 212.237.33.65 192.168.1.155 ICMP 98 Echo (ping) request id=0x0775, seq=799/7939, ttl=64 (no response found!)

but there's no answer to server 2xx.3yy.12.54

Good

etantonio

Not so good,
I can only ping client to client using ip like 192.168.x.y but it is not possible to ping server to client that is my real requirement.
Antonio

etantonio

Any idea about how I can solve this problem? Or maybe also just how I can investigate the problem?
It seems I'm the only one facing this requirement to use client local ip.

TinCanTech

Your post is very confused but you can try --ccd-exclusive

I recommend you read the manual for that option before you use it.