Able to ping OpenVPN virtual cards, but not the client behind it

Mastiff

I am trying to get OpenVPN up and running again after a few years without using it. But I just cant get to where I want to be. I'm using it as a tunnel between my servers at home and at my cabin, both Windows Server.

Home server:
OpenVPN server
Windows Server 2016 (soon to be 2019)
IP: 192.168.0.1 (I have my reasons to use the 0 series, and it isn't a problem because this tunnel is the only use there will ever be for this setup, so no dangers of a conflict - for my road warrior connections I use Windows' built-in VPN)
OpenVPN adater IP 10.8.0.1

Cabin server ("Hytteserver" in Norwegian)
Windows Server 2019
OpenVN client
IP: 192.168.2.1
OpenVPN adater IP 10.8.0.6 (even if this should really be 10.8.0.4, which I have in my ipp.txt file - so I don't know why that isn't respected)

I can ping both 10.8.0.1 and 192.168.0.1 from the client, and 10.8.0.6 from the server, but not 192.168.2.1. I'm actually not sure if I should set up static routes in Routing and Remote Access on the servers, but a few experiments doesn't show that doing any good.

Here are my configs :

## server.ovpn ##
port 11720
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.0.0 255.255.255.0"
push "dhcp-option DNS 192.168.0.1"
push "dhcp-option DOMAIN mydomain.no"
keepalive 5 10
comp-lzo
max-clients 1
persist-key
persist-tun
status openvpn-status.log

## Hytteserver.ovpn ##
client
proto udp
dev tun
remote my domain redacted 11720
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
ca ca.crt
cert Hytteserver.crt
key Hytteserver.key
comp-lzo
verb 3

On the server I get this log:

Sun Mar 08 15:47:45 2020 OpenVPN 2.4.8 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Oct 31 2019
Sun Mar 08 15:47:45 2020 Windows version 6.2 (Windows 8 or greater) 64bit
Sun Mar 08 15:47:45 2020 library versions: OpenSSL 1.1.0l  10 Sep 2019, LZO 2.10
Sun Mar 08 15:47:45 2020 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Sun Mar 08 15:47:45 2020 open_tun
Sun Mar 08 15:47:45 2020 TAP-WIN32 device [OpenVPN] opened: \\.\Global\{7CED7C37-1DCE-4C1E-8EB9-B98490C7FB53}.tap
Sun Mar 08 15:47:45 2020 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.1/255.255.255.252 on interface {7CED7C37-1DCE-4C1E-8EB9-B98490C7FB53} [DHCP-serv: 10.8.0.2, lease-time: 31536000]
Sun Mar 08 15:47:45 2020 Sleeping for 10 seconds...
Sun Mar 08 15:47:55 2020 Successful ARP Flush on interface [44] {7CED7C37-1DCE-4C1E-8EB9-B98490C7FB53}
Sun Mar 08 15:47:55 2020 Could not determine IPv4/IPv6 protocol. Using AF_INET6
Sun Mar 08 15:47:55 2020 setsockopt(IPV6_V6ONLY=0)
Sun Mar 08 15:47:55 2020 UDPv6 link local (bound): [AF_INET6][undef]:11720
Sun Mar 08 15:47:55 2020 UDPv6 link remote: [AF_UNSPEC]
Sun Mar 08 15:47:55 2020 ifconfig_pool_read(), in='Hytteserver,10.8.0.4', TODO: IPv6
Sun Mar 08 15:47:55 2020 succeeded -> ifconfig_pool_set()
Sun Mar 08 15:47:55 2020 Initialization Sequence Completed
Sun Mar 08 15:48:24 2020 [b]ip address redacted[/b] :37185 peer info: IV_VER=2.4.8
Sun Mar 08 15:48:24 2020 [b]ip address redacted[/b] :37185 peer info: IV_PLAT=win
Sun Mar 08 15:48:24 2020 [b]ip address redacted[/b] :37185 peer info: IV_PROTO=2
Sun Mar 08 15:48:24 2020 [b]ip address redacted[/b] :37185 peer info: IV_NCP=2
Sun Mar 08 15:48:24 2020 [b]ip address redacted[/b] :37185 peer info: IV_LZ4=1
Sun Mar 08 15:48:24 2020 [b]ip address redacted[/b] :37185 peer info: IV_LZ4v2=1
Sun Mar 08 15:48:24 2020 [b]ip address redacted[/b] :37185 peer info: IV_LZO=1
Sun Mar 08 15:48:24 2020 [b]ip address redacted[/b] :37185 peer info: IV_COMP_STUB=1
Sun Mar 08 15:48:24 2020 [b]ip address redacted[/b] :37185 peer info: IV_COMP_STUBv2=1
Sun Mar 08 15:48:24 2020 [b]ip address redacted[/b] :37185 peer info: IV_TCPNL=1
Sun Mar 08 15:48:24 2020 [b]ip address redacted[/b] :37185 peer info: IV_GUI_VER=OpenVPN_GUI_11
Sun Mar 08 15:48:24 2020 [b]ip address redacted[/b] :37185 [Hytteserver] Peer Connection Initiated with [AF_INET6][b]IP Address redacted[/b]::ffff::37185
Sun Mar 08 15:48:24 2020 Hytteserver/[b]IP Address redacted[/b]:37185 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)

On the client I get this log:

Sun Mar 08 15:48:12 2020 OpenVPN 2.4.8 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Oct 31 2019
Sun Mar 08 15:48:12 2020 Windows version 6.2 (Windows 8 or greater) 64bit
Sun Mar 08 15:48:12 2020 library versions: OpenSSL 1.1.0l  10 Sep 2019, LZO 2.10
Enter Management Password:
Sun Mar 08 15:48:12 2020 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sun Mar 08 15:48:12 2020 Need hold release from management interface, waiting...
Sun Mar 08 15:48:13 2020 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sun Mar 08 15:48:13 2020 MANAGEMENT: CMD 'state on'
Sun Mar 08 15:48:13 2020 MANAGEMENT: CMD 'log all on'
Sun Mar 08 15:48:13 2020 MANAGEMENT: CMD 'echo all on'
Sun Mar 08 15:48:13 2020 MANAGEMENT: CMD 'bytecount 5'
Sun Mar 08 15:48:13 2020 MANAGEMENT: CMD 'hold off'
Sun Mar 08 15:48:13 2020 MANAGEMENT: CMD 'hold release'
Sun Mar 08 15:48:13 2020 MANAGEMENT: >STATE:1583678893,RESOLVE,,,,,,
Sun Mar 08 15:48:13 2020 TCP/UDP: Preserving recently used remote address: [AF_INET][b]IP Address redacted[/b]:11720
Sun Mar 08 15:48:13 2020 Socket Buffers: R=[131072->131072] S=[131072->131072]
Sun Mar 08 15:48:13 2020 UDP link local: (not bound)
Sun Mar 08 15:48:13 2020 UDP link remote: [AF_INET][b]ip address redacted[/b] :11720
Sun Mar 08 15:48:13 2020 MANAGEMENT: >STATE:1583678893,WAIT,,,,,,
Sun Mar 08 15:48:13 2020 MANAGEMENT: >STATE:1583678893,AUTH,,,,,,
Sun Mar 08 15:48:13 2020 TLS: Initial packet from [AF_INET][b]ip address redacted[/b] :11720, sid=8f4a5b57 d00de87e
Sun Mar 08 15:48:13 2020 VERIFY OK: [b]Certificate info redacted[/b]
Sun Mar 08 15:48:13 2020 VERIFY KU OK
Sun Mar 08 15:48:13 2020 Validating certificate extended key usage
Sun Mar 08 15:48:13 2020 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sun Mar 08 15:48:13 2020 VERIFY EKU OK
Sun Mar 08 15:48:13 2020 VERIFY OK: [b]Certificate info redacted[/b]
Sun Mar 08 15:48:13 2020 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
Sun Mar 08 15:48:13 2020 [Server] Peer Connection Initiated with [AF_INET][b]IP Address redacted[/b]:11720
Sun Mar 08 15:48:15 2020 MANAGEMENT: >STATE:1583678895,GET_CONFIG,,,,,,
Sun Mar 08 15:48:15 2020 SENT CONTROL [Server]: 'PUSH_REQUEST' (status=1)
Sun Mar 08 15:48:15 2020 PUSH: Received control message: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,dhcp-option DNS 192.168.0.1,dhcp-option DOMAIN mydomain.no,route 10.8.0.1,topology net30,ping 5,ping-restart 10,ifconfig 10.8.0.6 10.8.0.5,peer-id 0,cipher AES-256-GCM'
Sun Mar 08 15:48:15 2020 OPTIONS IMPORT: timers and/or timeouts modified
Sun Mar 08 15:48:15 2020 OPTIONS IMPORT: --ifconfig/up options modified
Sun Mar 08 15:48:15 2020 OPTIONS IMPORT: route options modified
Sun Mar 08 15:48:15 2020 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Mar 08 15:48:15 2020 OPTIONS IMPORT: peer-id set
Sun Mar 08 15:48:15 2020 OPTIONS IMPORT: adjusting link_mtu to 1625
Sun Mar 08 15:48:15 2020 OPTIONS IMPORT: data channel crypto options modified
Sun Mar 08 15:48:15 2020 Data Channel: using negotiated cipher 'AES-256-GCM'
Sun Mar 08 15:48:15 2020 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sun Mar 08 15:48:15 2020 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sun Mar 08 15:48:15 2020 interactive service msg_channel=0
Sun Mar 08 15:48:15 2020 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 I=16 HWADDR=00:1b:21:ca:5e:fd
Sun Mar 08 15:48:15 2020 open_tun
Sun Mar 08 15:48:15 2020 TAP-WIN32 device [OpenVPN] opened: \\.\Global\{47B3B53A-D6E5-46FA-B6D5-A25AD74DE773}.tap
Sun Mar 08 15:48:15 2020 TAP-Windows Driver Version 9.24 
Sun Mar 08 15:48:15 2020 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {47B3B53A-D6E5-46FA-B6D5-A25AD74DE773} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Sun Mar 08 15:48:15 2020 Successful ARP Flush on interface [34] {47B3B53A-D6E5-46FA-B6D5-A25AD74DE773}
Sun Mar 08 15:48:15 2020 MANAGEMENT: >STATE:1583678895,ASSIGN_IP,,10.8.0.6,,,,
Sun Mar 08 15:48:20 2020 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Sun Mar 08 15:48:20 2020 MANAGEMENT: >STATE:1583678900,ADD_ROUTES,,,,,,
Sun Mar 08 15:48:20 2020 C:\Windows\system32\route.exe ADD 192.168.0.0 MASK 255.255.255.0 10.8.0.5
Sun Mar 08 15:48:20 2020 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Sun Mar 08 15:48:20 2020 Route addition via IPAPI succeeded [adaptive]
Sun Mar 08 15:48:20 2020 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Sun Mar 08 15:48:20 2020 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Sun Mar 08 15:48:20 2020 Route addition via IPAPI succeeded [adaptive]
Sun Mar 08 15:48:20 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sun Mar 08 15:48:20 2020 Initialization Sequence Completed
Sun Mar 08 15:48:20 2020 MANAGEMENT: >STATE:1583678900,CONNECTED,SUCCESS,10.8.0.6,[b]ip address redacted[/b] ,11720,,

There is something going on with IPv6 which I don't understand, because I have removed the tick in the box on the Open VPN adaters for IPv6 on both seides. Also I see the "Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication" but I assume that isn't the problem since it actually connects. :mrgreen: Can somebody who knows about this please tell me if something comes to mind from this?

Pippin

Search for "enable IP routing on Windows".

Mastiff

Pardon my ignorance (if that's what it is), but isn't that for computers that aren't running Windows Server with the Routing and remote access role configured?

Pippin

Good point, no Windows over here 😉

You want to reach the LAN behind the client?
Your goal is not clear...

PS:
Add

topology subnet

to server config, edit ipp.txt and restart OpenVPN.

Mastiff

I want to reach the entire networks both behind the OpenVPN client and the OpenVPN server. As I said the are both Windows Servers, running Routing and remote access. They have DHCP servers and DNS servers too. So you can think of it as a main office and a branch office that must have a seamless, common network. I make it seamless in use with A hosts in the DNS on both sides, so pinging the name Server on the Hytteserver side will check the DNS server on it's own side, get the IP address 192.168.0.1 for the A host and ping that. From any client of the OpenVPN server's network I need to reach any client of the OpenVPN client's network and vice versa, with all regular network protocols. I believe some types of multicasting isn't working over OpenVPN, but that's not a problem.

And thanks for the topology thing! 🙂 I'll try that tomorrow, the networks are in use the rest of the day.

TinCanTech

Mastiff wrote want to reach the entire networks both behind the OpenVPN client and the OpenVPN server

Then you must read the howto:
https://community.openvpn.net/openvpn/wiki/HOWTO#ExpandingthescopeoftheVPNtoincludeadditionalmachinesoneithertheclientorserversubnet.

Mastiff

OK, I'll do a bit of reading, then. The thing is that I was just putting back in an old configuration that worked before, so there has to be a difference between how Server 2008 and Server 2019/1016 handles this.

Edit: But that is for when pinging both ways works. As I said it doesn't. So that was my question, the rest came as replies to the first reply.

TinCanTech

The configuration files you have posted clearly demonstrate that you have not exposed your client LAN, at this time.

Mastiff

If I'm not mistaken the Windows Server should take care of that. At least it did when I was running the same configuration files on Server 2008, but of course stuff has probably changed in a few years, and this is a bit outside of my area.

Anyway so far I would be happy if I could expose my client to the server. 😉 My wife was done with the network so I could play around a little bit, and I added the topology subnet line to the server configuration. That fixe the wrong IP problem, it's now getting 10.8.0.4 every time. But still I can't ping the client's main address from the server. I can ping (and even use Windows File Sharing) to 10.8.0.4 from the server. But not 192.168.2.1. I have read the one I was pointed to, and the first line is "Once the VPN is operational in a point-to-point capacity between client and server, it may be desirable to expand the scope of the VPN so that clients can reach multiple machines on the server network, rather than only the server machine itself." So I guess I need to be able to ping the server and client on their own subnet addresses from the other side before I go on, right? Not just ping the server on it's own subnet and the client only on it's OpenVPN subnet address.

Edit: If I'm not mistaken it's the push route from the server that makes the client able to ping 192.168.0.1. So I should have a similar "pull" route in a way? Or a push route on the client?

Mastiff

Oh, I found that mistake... I had somehow lost "client-config-dir ccd" from the configuration file! I had the correct configuration in the CCD directory's "Hytteserver" file. :lol: So now I can ping the "physical" subnet of both from the other side. Now I'll try to see if the static routes on the server's RRAS will give me the whole network. :mrgreen:

Mastiff

Up and running. 🙂 Thanks for the pointers! Only problem is that it's slow as dirt. I'll go for that in another thread.