Hi, Please excuse my lack of expertise in networking. I've read several posts on this forum and on google, but couldn't resolve the issue. I feel like I am pretty close to getting OpenVPN set up the way I want. I am hoping to resolve the last issue of not being able to access the internet when VPN is connected. OpenVPN server is installed on a Windows 10 PC in an office. OpenVPN client is installed on a laptop I carry around while I am out in the field. I want to access Windows Samba share on the Windows 10 PC through VPN, but allow rest of internet traffic to NOT go through the VPN Server. As of now, I can access the Samba share when VPN is connected, but I have no internet. I am not sure if it has something to do with the client not having a default gateway for the TAP adapter, or that IP forwarding is only enabled on the Server. Server subnet is 192.168.2.1, Server LAN ip is 192.168.2.10, Client subnet is 10.62.81.1, client LAN ip is 10.62.81.15, VPN subnet is 10.8.0.0, client VPN ip is 10.8.0.2, server VPN ip is 10.8.0.1. The Config files are below. Any help on this is GREATLY appreciated! [oconf=Server Config] dev tun dev-node OpenVPN ca "C:\\Program Files\\OpenVPN\\config\\ca.crt" cert "C:\\Program Files\\OpenVPN\\config\\server.crt" key "C:\\Program Files\\OpenVPN\\config\\server.key" # This file should be kept secret dh "C:\\Program Files\\OpenVPN\\config\\dh2048.pem" topology subnet server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "route 10.8.0.1 255.255.255.0" push "route 10.8.0.0 255.255.255.0" push "route 192.168.2.1 255.255.255.0" push "route-metric 512" push "redirect-gateway def1" push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4" keepalive 10 120 tls-auth "C:\\Program Files\\OpenVPN\\config\\ta.key" 0 cipher AES-256-CBC comp-lzo max-clients 2 persist-key persist-tun status openvpn-status.log verb 4 explicit-exit-notify 1 [/oconf] [oconf=Client config] client dev tun proto udp4 remote xxxxxx.ddns.net 1194 resolv-retry infinite nobind persist-key persist-tun comp-lzo remote-cert-tls server key-direction 1 cipher AES-256-CBC verb 4 -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- -----BEGIN PRIVATE KEY----- -----END PRIVATE KEY----- -----BEGIN OpenVPN Static key V1----- -----END OpenVPN Static key V1----- [/oconf]

[quote=kevinpride post_id=88395 time=1576197997 user_id=47752] I want to access Windows Samba share on the Windows 10 PC through VPN, but allow rest of internet traffic to NOT go through the VPN Server. As of now, I can access the Samba share when VPN is connected, but I have no internet [/quote]You are almost there. Change these: [quote=kevinpride post_id=88395 time=1576197997 user_id=47752] [code]#push "route 10.8.0.1 255.255.255.0" # Not required #push "route 10.8.0.0 255.255.255.0" # Not required push "route 192.168.2.1 255.255.255.0" # This is correct but See note 1 #push "route-metric 512" # Not required #push "redirect-gateway def1" # Not required #push "dhcp-option DNS 8.8.8.8" # See note 2 #push "dhcp-option DNS 8.8.4.4" # See note 2[/code] [/quote]Notes: [list=1][*]192.168.2.0/24 is a common subnet and could cause you routing conflicts in the future. It is recommended that you change your server LAN to something more unique. eg: 192.168.147.0/24 [*]These will not work as you expect on Windows. You will be setting your DNS servers to 8.8.8.8 & 8.8.4.4 but they will [b]not[/b] be routed through the VPN. If you want your DNS to use the VPN in Windows you must use --block-outside-dns (Can be pushed)[/list]

OMG you are a lifesaver. I changed the subnet according to your note 1 to 192.168.150.0/24. I also added push "block-outside-dns", and commented out the other push lines as you suggested. Now, when connected to VPN, I have internet access, and my public IP shows I am accessing internet NOT through the VPN, which is what I wanted. Unfortunately, I now DON'T have access to the Samba shares for some reason. Any ideas that may help in getting access back to the Samba shares? Thanks so much!!

[quote=kevinpride post_id=88409 time=1576250818 user_id=47752] I changed the subnet according to your note 1 to 192.168.150.0/24 [/quote]You must actually change that subnet on your server LAN and all the devices (eg: Printer) connected to that LAN, not just change the line in the config ;)

Duh, sorry. I changed the server LAN and all devices on the LAN to 10.32.55.100. The server lan ip is now 10.32.55.110. However I still don't have access to the Samba share. I am really puzzled as to what happened. Again, your help is appreciated greatly! [oconf=Server config] port 2592 proto udp4 dev tun dev-node OpenVPN ca "C:\\Program Files\\OpenVPN\\config\\ca.crt" cert "C:\\Program Files\\OpenVPN\\config\\server.crt" key "C:\\Program Files\\OpenVPN\\config\\server.key" # This file should be kept secret dh "C:\\Program Files\\OpenVPN\\config\\dh2048.pem" topology subnet server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "route 10.32.55.110 255.255.255.0" push "block-outside-dns" keepalive 10 120 tls-auth "C:\\Program Files\\OpenVPN\\config\\ta.key" 0 # This file is secret cipher AES-256-CBC comp-lzo max-clients 2 persist-key persist-tun status openvpn-status.log verb 4 explicit-exit-notify 1 [/oconf]

Can you ping 10.8.0.1 and 10.32.55.100 from the client ?

I can ping 10.8.0.1, but not 10.32.55.100. Thanks for really helping me through this process. It has been a rough few days, lol.

[quote=kevinpride post_id=88415 time=1576303148 user_id=47752] I can ping 10.8.0.1, but not 10.32.55.100 [/quote]Check that IP Forwarding is enabled. And double check your firewall allows it.

I enabled IP forwarding by going to regedit HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters] and changing IPEnableRouter to "1". I am not sure how to make sure the firewall allows IP forwarding. I only have Windows firewall. I tried accessing the Samba share while the firewall was turned off, and I still couldn't access the Samba share. I did create Windows firewall rules to allow all the File and Printer Sharing, and ports 135-139, 445 for both TCP and UDP. I did port forwarding on my router as well, for ports 135-139,445,2592 as well. I also checked to make sure Routing and Remote Access Service is enabled and Automatic. I really appreciate your help here again.

Have you considered using a sensible OS for your server .. ?

I am a novice at best outside of the Windows environment unfortunately. I was hoping the setup I need could be accommodated by Windows. Are you suggesting a Linux OS? If so, which one, and are there any common pitfalls I should watch out for? Thanks again.

Loading...

Something went wrong while trying to load the full version of this site. Try hard-refreshing this page to fix the error.

OpenVPN connects and has LAN access, but no internet

« Previous Page