Hi I am having problems with setting up a VPN to my office. The setup I have is extremely simple and is defined below. AT WORK Internet --- (81.149.184.36) ROUTER (192.168.1.254) --- Files & VPN Server (192.168.1.100) AT HOME Internet --- ROUTER (192.168.0.1) --- Client (192.168.0.5) Client Config client dev tun proto udp remote 81.149.184.36 1194 resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert pwclient.crt key pwclient.key comp-lzo verb 3 Server Config port 1194 proto udp dev tun ca /etc/openvpn/ca.crt cert /etc/openvpn/server.crt key /etc/openvpn/server.key dh /etc/openvpn/dh1024.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "route 192.168.1.0 255.255.255.0" push "redirect-gateway def1" #push "dhcp-option DNS 192.168.1.254" #push "dhcp-option DNS 10.8.0.1" client-to-client keepalive 10 120 comp-lzo persist-key persist-tun status openvpn-status.log log /var/log/openvpn.log log-append /var/log/openvpn.log verb 3 mode server tls-server What I want is simple: 1. To be virtually connected to my work lan via vpn from home (so people can work from home) 2. To route internet access and dns through my home router when necessary 3. To be able to connect to the file shares on the vpn server at work 4. To be able to connect to my work routers http admin configuration pages (not really vital but cant see why it doesnt work) Problems Connecting to VPN is fine and accessing my files is fine. As for #2 and #4, I cannot get these to work. If I try to connect to 192.168.1.100 it connects fine, but when I try 192.168.1.254 it doesnt work. Do I need to manually set this up as a route somehow? As you can see I've been fidling around with the gateway and dns routing commands in the server config but have not been able to get a VPN connection up without losing my internet access at home. With some configs I have dns but no gateway, with others I have a gateway with no dns, and even if I manually set my gateway to point to my local home router ip, it still will not send and receive normal traffic that way. I have also tried NATing traffic through the VPN server to the work router which isnt an ideal solution and doesnt seem to work anyway. I do get given a 10.* ip address when I connect, and I can ping my home router which suggests that internet traffic should be working. Is there something I'm doing wrong here. I noticed that the pseudo network it uses has a subnet mask of 255.255.255.252 does that mean that only 1 client can connect to the vpn at a time? I will definately need multiple users connecting at the same time. Sorry for the VPN ignorance. I'm used to using the VPN on Microsoft Servers, but I think this works a little differently. Thanks for all your help

hi there, try adding a static route for your vpn subnet (10.8.0.0/24) on your work router (192.168.1.254) cheers, michael.

Hi Michael I am using a BT Business Broadband Router at work. When I try to add: Subnet IP: 10.8.0.0 Subnet Mask: 255.255.255.0 Gateway IP: 192.168.1.254 It tells me Error, Invalid Configuration. Is the above what you meant? It could be a problem with the router tho. Perhaps its locked down so you cant add routes or something. Also, do I have to disable routing on my router and use bridge mode? If so, I need NAT and DHCP so its not really an option for me. Thanks Phil

Perhaps if I add this route to the server config? Seems a bit silly that openvpn doesnt already add this route tho. Would it just be route 10.8.0.0 255.255.255.0 192.168.1.254 Thanks Phil

hi philios33, >It tells me Error, Invalid Configuration. Is the above what you meant? yeap.. >Also, do I have to disable routing on my router and use bridge mode? no..doing so means that you need a router to establish your internet connection (and NAT). there are 3 ways to avoid the static route thing on your router. 1) do NAT on your vpn server (that means that traffic comes from vpn will seems to coming from the lan ip of vpn server itself) 2) setup a proxy server inside your lan and use it from your vpn clients... 3)replace the BT router with one that does static routes :) cheers, michael.

>Perhaps if I add this route to the server config? Seems a bit silly that openvpn doesnt already add this route tho. Would it just be >route 10.8.0.0 255.255.255.0 192.168.1.254 no ,dont add this... the problem is that the router sees packets from your vpn net and probably it forwards them to internet (because it doesnt know that they come from your vpn server) thats why the static route is needed. michael.

Ah ok. I have tried #1 in the past with no luck. Is this the right thing to do? Because this doesnt seem to work either. [code] phil@ubuntu:~$ cat /etc/network/interfaces # This file describes the network interfaces available on your system # and how to activate them. For more information, see interfaces(5). # The loopback network interface auto lo iface lo inet loopback # The primary network interface auto eth0 #iface eth0 inet dhcp iface eth0 inet static address 192.168.1.100 netmask 255.255.255.0 gateway 192.168.1.254 phil@ubuntu:~$ sudo iptables-save # Generated by iptables-save v1.3.3 on Mon Feb 28 12:58:53 2011 *nat :PREROUTING ACCEPT [19112:4609087] :POSTROUTING ACCEPT [17575:4532274] :OUTPUT ACCEPT [1563:359748] -A POSTROUTING -s 10.8.0.0/255.255.255.0 -o eth0 -j MASQUERADE -A POSTROUTING -s 10.8.0.0/255.255.255.0 -o eth0 -j MASQUERADE -A POSTROUTING -s 10.8.0.0/255.255.255.0 -o eth0 -j MASQUERADE COMMIT # Completed on Mon Feb 28 12:58:53 2011 # Generated by iptables-save v1.3.3 on Mon Feb 28 12:58:53 2011 *filter :INPUT ACCEPT [4873214:3438921517] :FORWARD ACCEPT [111831:35934249] :OUTPUT ACCEPT [3939015:863992395] COMMIT # Completed on Mon Feb 28 12:58:53 2011 phil@ubuntu:~$ [/code] For some reason it doesnt get listed as a rule when i do iptables -L tho

please show output of iptables -L -t nat michael.

[code] phil@ubuntu:~$ sudo iptables -L -t nat Password: Chain PREROUTING (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination MASQUERADE all -- 10.8.0.0/24 anywhere MASQUERADE all -- 10.8.0.0/24 anywhere MASQUERADE all -- 10.8.0.0/24 anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination phil@ubuntu:~$ [/code] I think I did it 3 times by accident cos I didnt think it was saving

nat is right... did you enable ip forwarding? cheers, michael.

No. Sorry I'm a bit of a noob. Didnt know you had to do that. I will check it tonight when I get home and thanks for all your help. Phil [code] phil@ubuntu:~$ cat /proc/sys/net/ipv4/ip_forward 0 phil@ubuntu:~$ vim /etc/sysctl.conf phil@ubuntu:~$ sudo vim /etc/sysctl.conf phil@ubuntu:~$ phil@ubuntu:~$ sudo sysctl -p /etc/sysctl.conf net.ipv4.ip_forward = 1 phil@ubuntu:~$ phil@ubuntu:~$ cat /proc/sys/net/ipv4/ip_forward 1 phil@ubuntu:~$ [/code]

No internet access when VPN connected

philios33

Not sure why that bridge is there. Is that created by openvpn?

phil@ubuntu:/files$ brctl show
bridge name	bridge id		STP enabled	interfaces
br0		8000.000874ae447c	no		eth0
							tap0

My networking settings dont say anything about a bridge. I would rather fix this issue by removing the bridge stuff but dont know how.

Thanks

Phil

janjust

you could try doing a

ifconfig br0 down
brctl stop
brctl delbr br0

philios33

Thanks Janjust,

That fixed the problem after locally restarting networking with

sudo /etc/init.d/networking restart

Woo, so I can ping other clients on the work LAN from home. Thanks everyone.

I have one final problem tho. The whole reason I have set this up is so that my boss can vpn in from home and get his X drive to work. He works with the same laptop at work and from home. The X drive is a samba share on the vpn server machine (192.168.1.100). The problem is that his home subnet is 192.168.1.0 which is the same as the work LAN. I dont have this problem because my home subnet is 192.168.0.0. He says he cant ping 192.168.1.100 when he's on the vpn. I guess thats because the traffic is being told to go via the local router interface (he has no 192.168.1.100 on his local network). I understand that there is probably a 10.something IP address I can use, but I really dont want to have to set up two drives on his laptop (one for home, and one for work). Is there any way I can force a single IP address such as (192.168.1.100) to go via the VPN? I would be here for ages fidling with route commands, so just wondering whether this is possible and the command to use.

Thanks

Phil

philios33

Hi All

Finally figured out whats happening. I decided to change my home subnet to 192.168.1.0/24 to replicate the problem my boss was having. Turns out that because of the line

push "route 192.168.1.0 255.255.255.0"

in the server config, it tells the client that any ip on this subnet should route through the vpn. This obviouly breaks the gateway to the internet (192.168.1.1). To fix this I simply had to remove this route and add my VPN server ip (192.168.1.100) and Work Router ip (192.168.1.254) as full /32 routes.

#push "route 192.168.1.0 255.255.255.0"
push "route 192.168.1.100 255.255.255.255"
push "route 192.168.1.254 255.255.255.255"

I understand that this doesnt give me full access to my work network unless I manually add each work ip to the server.conf list, but the pros of this method outweigh the cons in my opinion. I can access the internet and the samba share at work and at home. This method will work whatever the home users local subnet is. I will let you guys know if I have anymore problems, but I think I've cracked it. Thanks for the help.

Phil

joseuzin1976

how can I speed up the vpn conection becouse is very slow with the route mode???

janjust

define "slow". How did you measure performance?
Also, in bridged mode it is often even slower.
For starters, try adding

fragment 1300

to both client and server to see if that speeds things up.

joseuzin1976

in the show status

Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Socket Buffers: R=[8192->8192] S=[8192->8192]
Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Local Options hash (VER=V4): '41690919'
Expected Remote Options hash (VER=V4): '530fdded'
PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
--ifconfig/up options modified
route options modified
ROUTE default_gateway=192.168.0.1
TAP-WIN32 device [Conexión de área local 3] opened: \\.\Global\{34053DF8-1B9C-4569-86AF-2DB83BB0103C}.tap
TAP-Win32 Driver Version 9.7
TAP-Win32 MTU=1500
Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {34053DF8-1B9C-4569-86AF-2DB83BB0103C} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Successful ARP Flush on interface [3] {34053DF8-1B9C-4569-86AF-2DB83BB0103C}
TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Route: Waiting for TUN/TAP interface to come up...
TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Route addition via IPAPI succeeded [adaptive]
Initialization Sequence Completed

joseuzin1976

thanks for the answer i read in the manual that when i have conection problems i have to set
tun-mtu 1500
fragment 1300
mssfix

and

comp-lzo no for no compression and better performance, i´ll try it later.

aftab

Here the one i used for a very long time this one still working http://www.thefreevpn.net/free-vpn-service/

« Previous Page