As mentioned in the subject, I am facing a new problem. I am able to ping device with IP 10.100.0.10, but I am unable to access it via http/https web administration, it does not load. I can also access web administration of the router with IP 10.100.0.1 from the tunnel Here is rough topology pic: [img]https://i.imgur.com/5jBr710.jpg[/img] Now.. I've done I think everything I found on random guides on the internet that were supposed to solve this problem. 1. Added [i]push "route 10.100.0.0 255.255.255.0"[/i] in the server config, so the remote client (my PC) knows where to route this seemingly unknown network when trying to access it. 2. Added this routing to the cisco router that serves as default GW for the LAN on remote site, so clients from LAN can also with help of default GW route traffic back to the server where openvpn is running: [img]https://i.imgur.com/8HFcUaR.jpg[/img] 3. Added firewall rule on the router to allow traffic from openvpn range 10.100.0.0/24 towards LAN [img]https://i.imgur.com/tTCcvdA.jpg[/img] 4. Enabled IP routing in registry on the server as well as on both interfaces (ethernet and TAP interface) of course the server was rebooted 5. Even tried creating windows firewall rule to allow bidirectional communication between both ranges (10.100.0.0/24 10.100.1.0/24) I am honestly just lost now, no idea what to do next. This is my server config right now, I also tried enabling the topology subnet but it changed nothing in the situation.. [oconf=Server Config]port 1195 proto udp4 dev tun ca "C:\\Program Files\\OpenVPN\\config\\ca.crt" cert "C:\\Program Files\\OpenVPN\\config\\server.crt" key "C:\\Program Files\\OpenVPN\\config\\server.key" dh "C:\\Program Files\\OpenVPN\\config\\dh2048.pem" crl-verify "C:\\Program Files\\OpenVPN\\easy-rsa\\pki\\crl.pem" ;topology subnet server 10.100.1.0 255.255.255.0 push "route 10.100.0.0 255.255.255.0" ifconfig-pool-persist ipp.txt keepalive 10 120 tls-auth ta.key 0 cipher AES-256-CBC persist-key persist-tun status "C:\\Program Files\\OpenVPN\\log\\openvpn-status.log" verb 3 explicit-exit-notify 1 [/oconf]

[quote=xh43k post_id=92416 time=1591819166 user_id=50579] no idea what to do next [/quote]Try disabling ALL related Windblows firewalls.

[quote=TinCanTech post_id=92417 time=1591819428 user_id=37053] [quote=xh43k post_id=92416 time=1591819166 user_id=50579] no idea what to do next [/quote]Try disabling ALL related Windblows firewalls. [/quote] I tried disabling firewall for all three types of networks (private, public and AD) completely, still nothing.

[quote]I am able to ping device with IP 10.100.0.10, but I am unable to access it via http/https web administration, it does not load. I can also access web administration of the router with IP 10.100.0.1 from the tunnel[/quote] So, only http/s doesn't work? Check the web server... Tried other protocols? Also try adding [code]mssfix 1400[/code] to the client config.

Forgot this, [quote] I also tried enabling the topology subnet[/quote] Do yourself a favour and enable it.

[quote=Pippin post_id=92420 time=1591820744 user_id=32724] [quote]I am able to ping device with IP 10.100.0.10, but I am unable to access it via http/https web administration, it does not load. I can also access web administration of the router with IP 10.100.0.1 from the tunnel[/quote] So, only http/s doesn't work? Check the web server... Tried other protocols? Also try adding [code]mssfix 1400[/code] to the client config. [/quote] I did not try other protocols, since the devices I am trying to access are web interfaces of access point and a printer I can ping the printer with IP .10 but cannot access web interface (https). btw, I read that topology subnet is the new default, so no point trying to enable it, it is enabled by default. But just in case, I already tried setting "topology subnet" in config file.. still didn't solve the problem.

[quote]I read that topology subnet is the new default,[/quote] Right. [quote]so no point trying to enable it, it is enabled by default.[/quote] Not right.

[quote=Pippin post_id=92426 time=1591821183 user_id=32724] [quote]I read that topology subnet is the new default,[/quote] Right. [quote]so no point trying to enable it, it is enabled by default.[/quote] Not right. [/quote] ? If it's the new default, and I don't specify topology setting... isn't subnet setting used automatically ? Anyway, I tried with and without topology subnet and there was literally no change, so the problem persists. Might help to try to switch from udp4 to tcp4 ? Or from tun to tap ? I do not want to use bloated tap however even tho it might fix all the problems.

[quote=xh43k post_id=92416 time=1591819166 user_id=50579] I've done I think everything I found on [b]random guides[/b] on the internet that were supposed to solve this problem [/quote] :roll: Please see the official howto ,, which can be found here: https://forums.openvpn.net/viewtopic.php?f=30&t=22603

[quote] isn't subnet setting used automatically ? [/quote] That could potentially break existing setups, so no. https://community.openvpn.net/openvpn/wiki/Topology Forget about TAP, find and fix the problem. [quote=TinCanTech post_id=92429 time=1591821935 user_id=37053] [quote=xh43k post_id=92416 time=1591819166 user_id=50579] I've done I think everything I found on [b]random guides[/b] on the internet that were supposed to solve this problem [/quote] :roll: [/quote] That just won't die :)

[quote=Pippin post_id=92430 time=1591822453 user_id=32724] [quote=TinCanTech post_id=92429 time=1591821935 user_id=37053] [quote=xh43k post_id=92416 time=1591819166 user_id=50579] I've done I think everything I found on [b]random guides[/b] on the internet that were supposed to solve this problem [/quote] :roll: [/quote] That just won't die :) [/quote]At least @[b]xh43k[/b] had the [i]balls[/i] to state it 8-) [quote=xh43k post_id=92416 time=1591819166 user_id=50579] Added this routing to the [b]cisco router[/b] [/quote]maybe you did this [i]incorrectly[/i] ..

Remote clients can access resources on the OVPN server and also access main router, but cannot access other LAN clients.

xh43k

300000 wrote what dns server from openvpn you push to openvpn client , check that first

I push no default gw or dns servers whatsoever, since it's split tunnel vpn.
I am able to ping the IP 10.100.0.10 without problems, just unable to actually access the web interface that runs on it from VPN.
When I connect to the server 10.100.0.2 via rdp, I can access the 10.100.0.10 without problems.

So there must be something that's blocking my vpn subnet IP (10.100.1.4) from accessing LAN devices via http/https protocols..

I checked firewall logs on both server as well as default GW (router) and seemingly all traffic is being passed between both subnets without problems..

Could it be that the devices I am trying to access are refusing connections from other than LAN subnets ?

300000

you need try tracert first from client to see . if it stop at address openvpn server it meant your server not working good .

open cmd and typre

tracert 10.100.0.10 and if it stop at 10.100.1.1 it mean your openvpn server not nat

xh43k

Well...

>tracert 10.100.0.10

Tracing route to 10.100.0.10 over a maximum of 30 hops

  1    27 ms    27 ms    27 ms  xxxxxxx [10.100.1.1]
  2    29 ms    28 ms    29 ms  10.100.0.10

Trace complete.

Also testing of ports works...

PS C:\Users\xxxxxx> Test-NetConnection 10.100.0.10 -Port 80                                                                                                                                                                                                                                                                                                    ComputerName     : 10.100.0.10
RemoteAddress    : 10.100.0.10
RemotePort       : 80
InterfaceAlias   : Local Area Connection 2
SourceAddress    : 10.100.1.2
TcpTestSucceeded : True

PS C:\Users\xxxxxx> Test-NetConnection 10.100.0.10 -Port 443
ComputerName     : 10.100.0.10
RemoteAddress    : 10.100.0.10
RemotePort       : 443
InterfaceAlias   : Local Area Connection 2
SourceAddress    : 10.100.1.2
TcpTestSucceeded : True

But still cannot access the web interface via ANY browser..

And when I try to telnet 10.100.0.10 port 80/443 I get this:

HTTP/1.0 408 Request Timeout                                                                                            
Content-Length: 19                                                                                                                                                                                                                              408 Request Timeout

Connection to host lost.

300000

try to restart web server , everything works as normal so nothing wrong with it network is ok ,

xh43k

Soooo I think I have some movement.. I didnt restart anything, but I disabled SPI (Stateful Packet Inspection) on the cisco router.. and boom, connection now works.

I wonder if there is any way on how to allow such connection from VPN subnet to LAN subnet without triggering SPI and forcing it to cancel the connection.

Pippin

You should read Cisco's docs or seek their support 😉

But ok,
Does it have an option that looks something like "Clear DF bit", "Reject/block/drop fragmented packets"?

TinCanTech

And definitely disable *all* Windblows Fireballs :mrgreen:

« Previous Page