I followed the Easy Windows Guide several times... but I'm unable to reach clients on the server side whatsoever .
I'm running the server on a Windows 10 Pro VM running on a QNAP. Routing service is running, and also enabled IP forwarding in the registry.
Connection works, I can also ping (and RDP) the server from a remote client. But that's about it.
Server config:
port 1717
proto udp
dev tun
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh2048.pem"
server 172.18.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 172.17.0.0 255.255.0.0"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
cipher AES-256-CBC
persist-key
persist-tun
status openvpn-status.log
verb 3
explicit-exit-notify 1
Client config:
client
dev tun
proto udp
remote 144.178.71.238 1717
remote 89.200.69.140 1717
resolv-retry infinite
nobind
persist-key
persist-tun
ca "D:\\Data\\Bureaublad\\VPN\\ca.crt"
cert "D:\\Data\\Bureaublad\\VPN\\client1.crt"
key "D:\\Data\\Bureaublad\\VPN\\client1.key"
remote-cert-tls server
tls-auth ta.key 1
cipher AES-256-CBC
verb 3
Server log:
Wed Aug 05 20:07:51 2020 OpenVPN 2.4.9 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 16 2020
Wed Aug 05 20:07:51 2020 Windows version 6.2 (Windows 8 or greater) 64bit
Wed Aug 05 20:07:51 2020 library versions: OpenSSL 1.1.1f 31 Mar 2020, LZO 2.10
Enter Management Password:
Wed Aug 05 20:07:51 2020 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Aug 05 20:07:51 2020 Need hold release from management interface, waiting...
Wed Aug 05 20:07:51 2020 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Aug 05 20:07:51 2020 MANAGEMENT: CMD 'state on'
Wed Aug 05 20:07:51 2020 MANAGEMENT: CMD 'log all on'
Wed Aug 05 20:07:52 2020 MANAGEMENT: CMD 'echo all on'
Wed Aug 05 20:07:52 2020 MANAGEMENT: CMD 'bytecount 5'
Wed Aug 05 20:07:52 2020 MANAGEMENT: CMD 'hold off'
Wed Aug 05 20:07:52 2020 MANAGEMENT: CMD 'hold release'
Wed Aug 05 20:07:52 2020 Diffie-Hellman initialized with 2048 bit key
Wed Aug 05 20:07:52 2020 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 05 20:07:52 2020 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 05 20:07:52 2020 interactive service msg_channel=0
Wed Aug 05 20:07:52 2020 ROUTE_GATEWAY 172.17.17.251/255.255.255.0 I=13 HWADDR=52:54:00:a1:f6:52
Wed Aug 05 20:07:52 2020 open_tun
Wed Aug 05 20:07:52 2020 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{36BFA01E-CD65-40C6-9784-BEBA49C773E8}.tap
Wed Aug 05 20:07:52 2020 TAP-Windows Driver Version 9.24
Wed Aug 05 20:07:52 2020 Notified TAP-Windows driver to set a DHCP IP/netmask of 172.18.0.1/255.255.255.252 on interface {36BFA01E-CD65-40C6-9784-BEBA49C773E8} [DHCP-serv: 172.18.0.2, lease-time: 31536000]
Wed Aug 05 20:07:52 2020 Sleeping for 10 seconds...
Wed Aug 05 20:08:02 2020 Successful ARP Flush on interface [26] {36BFA01E-CD65-40C6-9784-BEBA49C773E8}
Wed Aug 05 20:08:02 2020 MANAGEMENT: >STATE:1596658082,ASSIGN_IP,,172.18.0.1,,,,
Wed Aug 05 20:08:02 2020 MANAGEMENT: >STATE:1596658082,ADD_ROUTES,,,,,,
Wed Aug 05 20:08:02 2020 C:\Windows\system32\route.exe ADD 172.18.0.0 MASK 255.255.255.0 172.18.0.2
Wed Aug 05 20:08:02 2020 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Wed Aug 05 20:08:02 2020 Route addition via IPAPI succeeded [adaptive]
Wed Aug 05 20:08:02 2020 Could not determine IPv4/IPv6 protocol. Using AF_INET6
Wed Aug 05 20:08:02 2020 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Aug 05 20:08:02 2020 setsockopt(IPV6_V6ONLY=0)
Wed Aug 05 20:08:02 2020 UDPv6 link local (bound): [AF_INET6][undef]:1717
Wed Aug 05 20:08:02 2020 UDPv6 link remote: [AF_UNSPEC]
Wed Aug 05 20:08:02 2020 MULTI: multi_init called, r=256 v=256
Wed Aug 05 20:08:02 2020 IFCONFIG POOL: base=172.18.0.4 size=62, ipv6=0
Wed Aug 05 20:08:02 2020 ifconfig_pool_read(), in='client1,172.18.0.4', TODO: IPv6
Wed Aug 05 20:08:02 2020 succeeded -> ifconfig_pool_set()
Wed Aug 05 20:08:02 2020 IFCONFIG POOL LIST
Wed Aug 05 20:08:02 2020 client1,172.18.0.4
Wed Aug 05 20:08:02 2020 Initialization Sequence Completed
Wed Aug 05 20:08:02 2020 MANAGEMENT: >STATE:1596658082,CONNECTED,SUCCESS,172.18.0.1,,,,
Client log:
⏎5-8-2020 22:14:01 Frame=512/2048/512 mssfix-ctrl=1250
⏎5-8-2020 22:14:01 UNUSED OPTIONS
5 [resolv-retry] [infinite]
6 [nobind]
7 [persist-key]
8 [persist-tun]
16 [verb] [3]
⏎5-8-2020 22:14:01 Contacting 144.178.71.238:1717 via UDP
⏎5-8-2020 22:14:01 Connecting to [144.178.71.238]:1717 (144.178.71.238) via UDPv4
⏎5-8-2020 22:14:01 EVENT: RESOLVE ⏎5-8-2020 22:14:01 EVENT: WAIT ⏎5-8-2020 22:14:11 Server poll timeout, trying next remote entry...
⏎5-8-2020 22:14:11 EVENT: RECONNECTING ⏎5-8-2020 22:14:11 EVENT: RESOLVE ⏎5-8-2020 22:14:11 Contacting 89.200.69.140:1717 via UDP
⏎5-8-2020 22:14:11 EVENT: WAIT ⏎5-8-2020 22:14:11 Connecting to [89.200.69.140]:1717 (89.200.69.140) via UDPv4
⏎5-8-2020 22:14:11 EVENT: CONNECTING ⏎5-8-2020 22:14:11 Tunnel Options:V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client
⏎5-8-2020 22:14:11 Creds: UsernameEmpty/PasswordEmpty
⏎5-8-2020 22:14:11 Peer Info:
IV_GUI_VER=OCmacOS_3.1.3-713
IV_VER=3.git::f225fcd0
IV_PLAT=win
IV_NCP=2
IV_TCPNL=1
IV_PROTO=2
IV_AUTO_SESS=1
⏎5-8-2020 22:14:11 VERIFY OK : depth=0
cert. version : 3
serial number : 01
issuer name : C=NL, ST=LB, L=Nieuwstadt, O=AutoMates.media, OU=changeme, CN=server, ??=changeme, emailAddress=info@automates.media
subject name : C=NL, ST=LB, L=Nieuwstadt, O=AutoMates.media, OU=changeme, CN=server, ??=changeme, emailAddress=info@automates.media
issued on : 2020-08-05 18:44:05
expires on : 2030-08-03 18:44:05
signed using : RSA with SHA-256
RSA key size : 4096 bits
basic constraints : CA=false
cert. type : SSL Server
key usage : Digital Signature, Key Encipherment
ext key usage : TLS Web Server Authentication
⏎5-8-2020 22:14:12 SSL Handshake: TLSv1.2/TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
⏎5-8-2020 22:14:12 Session is ACTIVE
⏎5-8-2020 22:14:12 Sending PUSH_REQUEST to server...
⏎5-8-2020 22:14:12 EVENT: GET_CONFIG ⏎5-8-2020 22:14:12 OPTIONS:
0 [route] [172.17.0.0] [255.255.0.0]
1 [route] [172.18.0.1]
2 [topology] [net30]
3 [ping] [10]
4 [ping-restart] [120]
5 [ifconfig] [172.18.0.6] [172.18.0.5]
6 [peer-id] [0]
7 [cipher] [AES-256-GCM]
⏎5-8-2020 22:14:12 PROTOCOL OPTIONS:
cipher: AES-256-GCM
digest: SHA1
compress: NONE
peer ID: 0
⏎5-8-2020 22:14:12 CAPTURED OPTIONS:
Session Name: 144.178.71.238
Layer: OSI_LAYER_3
Remote Address: 89.200.69.140
Tunnel Addresses:
172.18.0.6/30 -> 172.18.0.5 [net30]
Reroute Gateway: IPv4=0 IPv6=0 flags=[ IPv4 ]
Block IPv6: no
Add Routes:
172.17.0.0/16
172.18.0.1/32
Exclude Routes:
DNS Servers:
Search Domains:
⏎5-8-2020 22:14:12 EVENT: ASSIGN_IP ⏎5-8-2020 22:14:12 SetupClient: transmitting tun setup list to \\.\pipe\agent_ovpnconnect
{
"confirm_event" : "b416000000000000",
"destroy_event" : "c417000000000000",
"tun" :
{
"adapter_domain_suffix" : "",
"add_routes" :
[
{
"address" : "172.17.0.0",
"gateway" : "",
"ipv6" : false,
"metric" : -1,
"net30" : false,
"prefix_length" : 16
},
{
"address" : "172.18.0.1",
"gateway" : "",
"ipv6" : false,
"metric" : -1,
"net30" : false,
"prefix_length" : 32
}
],
"block_ipv6" : false,
"layer" : 3,
"mtu" : 0,
"remote_address" :
{
"address" : "89.200.69.140",
"ipv6" : false
},
"reroute_gw" :
{
"flags" : 256,
"ipv4" : false,
"ipv6" : false
},
"route_metric_default" : -1,
"session_name" : "144.178.71.238",
"tunnel_address_index_ipv4" : 0,
"tunnel_address_index_ipv6" : -1,
"tunnel_addresses" :
[
{
"address" : "172.18.0.6",
"gateway" : "172.18.0.5",
"ipv6" : false,
"metric" : -1,
"net30" : true,
"prefix_length" : 30
}
]
}
}
POST np://[\\.\pipe\agent_ovpnconnect]/tun-setup : 200 OK
TAP ADAPTERS:
guid='{BF7C2A25-442E-42C4-BB07-BD34A257F4DA}' index=21 name='AutoMatesNAS VPN'
Open TAP device "AutoMatesNAS VPN" PATH="\\.\Global\{BF7C2A25-442E-42C4-BB07-BD34A257F4DA}.tap" SUCCEEDED
TAP-Windows Driver Version 9.23
ActionDeleteAllRoutesOnInterface iface_index=21
netsh interface ip set interface 21 metric=1
Ok.
netsh interface ip set address 21 static 172.18.0.6 255.255.255.252 gateway=172.18.0.5 store=active
netsh interface ip add route 172.17.0.0/16 21 172.18.0.5 store=active
Ok.
netsh interface ip add route 172.18.0.1/32 21 172.18.0.5 store=active
Ok.
ipconfig /flushdns
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
TAP handle: 9416000000000000
⏎5-8-2020 22:14:12 Connected via TUN_WIN
⏎5-8-2020 22:14:12 EVENT: CONNECTED 89.200.69.140:1717 (89.200.69.140) via /UDPv4 on TUN_WIN/172.18.0.6/ gw=[172.18.0.5/]⏎
Client routing table:
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.0.1.1 192.0.1.127 50
127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
127.0.0.1 255.255.255.255 On-link 127.0.0.1 331
127.255.255.255 255.255.255.255 On-link 127.0.0.1 331
172.17.0.0 255.255.0.0 172.18.0.5 172.18.0.6 257
172.18.0.1 255.255.255.255 172.18.0.5 172.18.0.6 257
172.18.0.4 255.255.255.252 On-link 172.18.0.6 257
172.18.0.6 255.255.255.255 On-link 172.18.0.6 257
172.18.0.7 255.255.255.255 On-link 172.18.0.6 257
172.18.112.0 255.255.240.0 On-link 172.18.112.1 271
172.18.112.1 255.255.255.255 On-link 172.18.112.1 271
172.18.127.255 255.255.255.255 On-link 172.18.112.1 271
192.0.1.0 255.255.255.0 On-link 192.0.1.127 306
192.0.1.127 255.255.255.255 On-link 192.0.1.127 306
192.0.1.255 255.255.255.255 On-link 192.0.1.127 306
192.168.240.0 255.255.240.0 On-link 192.168.240.1 271
192.168.240.1 255.255.255.255 On-link 192.168.240.1 271
192.168.255.255 255.255.255.255 On-link 192.168.240.1 271
224.0.0.0 240.0.0.0 On-link 127.0.0.1 331
224.0.0.0 240.0.0.0 On-link 172.18.0.6 257
224.0.0.0 240.0.0.0 On-link 192.0.1.127 306
224.0.0.0 240.0.0.0 On-link 172.18.112.1 271
224.0.0.0 240.0.0.0 On-link 192.168.240.1 271
255.255.255.255 255.255.255.255 On-link 127.0.0.1 331
255.255.255.255 255.255.255.255 On-link 172.18.0.6 257
255.255.255.255 255.255.255.255 On-link 192.0.1.127 306
255.255.255.255 255.255.255.255 On-link 172.18.112.1 271
255.255.255.255 255.255.255.255 On-link 192.168.240.1 271
===========================================================================
All the help is welcome 🙂
