Hi everybody, First, sorry for my poor english, I'm french. [b]Server CONFIG : [/b] I installed openVPN server 2.1.3-2 on a Debian Squeeze. This machine is also a router directly connected to WAN in 193.X.X.X. My private network is in 192.168.10.0/24 Routing is ON Config file : [code]port 1194 proto udp dev tun ca /etc/openvpn/2.0/keys/ca.crt cert /etc/openvpn/2.0/keys/server.crt key /etc/openvpn/2.0/keys/server.key dh /etc/openvpn/2.0/keys/dh1024.pem tls-auth /etc/openvpn/2.0/keys/ta.key 0 server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "redirect-gateway def1 bypass-dhcp" keepalive 10 120 cipher BF-CBC comp-lzo max-clients 2 user nobody group nogroup persist-key persist-tun status openvpn-status.log verb 3 mute 20 [/code] [b]Client CONFIG : [/b] My client machine is connected in a private network in 172.31.33.0/24. On the router behind this machine, the port 1194 is open. Config file : [code]client dev tun proto udp remote 193.XX.XX.XX 1194 resolv-retry infinite nobind user nobody group nogroup persist-key persist-tun mute-replay-warnings ca /etc/openvpn/keys/ca.crt cert /etc/openvpn/keys/***.crt key /etc/openvpn/keys/***.key ns-cert-type server tls-auth /etc/openvpn/keys/ta.key 1 cipher BF-CBC comp-lzo verb 3 mute 20[/code] [b]So, my question :[/b] When I start the server daemon, and make ifconfig, i can see the tun0 interface which have ip 10.8.0.1. I understood that, openvpn's dhcp makes "subnets" in /30 (255.255.255.252) That means that for a first client connection PPTP, the network's address is 10.8.0.0, server's ip 10.8.0.1, client's ip 10.8.0.2 and broadcast address 10.8.0.3. For a second connection, network's address will be 10.8.0.4, server 10.8.0.5, client 10.8.0.6 and broadcast 10.8.0.7... That's ok ? My problem is that when I start now the client daemon, the ip which is attribuate is 10.8.0.6 (so the client's ip of the second subnet) and for this reason, the gateway is 10.8.0.5 (the server's ip of this subnet). That's because I put the line in server.ovpn : [code]push "redirect-gateway def1 bypass-dhcp"[/code] With this configuration, I can ping 10.8.0.1 with 10.8.0.6, everyhting works great, exept the client gateway (so there's no internet on the VPN connection). I tried to configure XP client or Debian client, I have the same problem. On XP : [code]ipconfig /all[/code] says me that the gateway and the dhcp server are 10.8.0.5. Anyone could help me please ?

hi there, to clear things up, the openvpn is SSL based vpn and has nothing to do with PPtP... to the point now, the subneting stuff you mention is correct, you dont have internet because your router (inside vpn network) doesnt know about your vpn subnet.. there are 2 solutions 1)you use NAT on debian from traffic originating the vpn tunnel 2)you add a static route for the vpn subnet on your router. cheers, michael.

Hi, thanks for your answer. I talk about pptp because that's what appears on linux client or server when i make an ifconfig (in tun0 description). If the "subneting stuff are correct", openvpn server should give the ip 10.8.0.2 to my client and there, it should not be any problem of gateway on the client : the server's ip corresponding to 10.8.0.2 is 10.8.0.1... Right now, the gateway that server give to client (10.8.0.5) doesn't exist, I can't ping it. I want : - That the server give to my client 10.8.0.2 ip instead of 10.8.0.6 - And the gateway 10.8.0.1 instead of 10.8.0.5 [quote]1)you use NAT on debian from traffic originating the vpn tunnel[/quote] I forgot to mention that routing is ON on the client too. That's what you mean ? And I also forgot to mention that I use openvpn in router mode, not bridge.

[quote]I talk about pptp because that's what appears on linux client or server when i make an ifconfig (in tun0 description).[/quote] a "default" tun setup creates a linux tunnel device, which is indeed a kernel Point-to-Point interface . It's easy to confuse this with PPTP (note the extra P) which is an entirely different VPN protocol [quote]I want : - That the server give to my client 10.8.0.2 ip instead of 10.8.0.6 - And the gateway 10.8.0.1 instead of 10.8.0.5[/quote] Add [code]topology subnet[/code] to your server config and restart. The client does not need to have routing enabled, but your server-side LAN needs to know where to send replies when VPN traffic comes in. One way to do this is to use masquerading on the server [code]iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE[/code] another option is to add an extra route to the server-side GW/router to ensure that all replies to VPN traffic are sent to the VPN server

Thanks. [quote]Add Code: topology subnet to your server config and restart.[/quote] I tryed that, and now my client have the ip 10.8.0.4... This is less normal than before, this is the ip of the second subnet :D . That's what ifconfig says me (i tried first only on the server, and, on server and client:) BEFORE changing, on client: [quote]inet adr :10.8.0.6 P-t-P : 10.8.0.5[/quote] AFTER : [quote]inet adr : 10.8.0.4 P-t-P : 10.8.0.4[/quote] BEFORE changing, on server: [quote]inet adr :10.8.0.1 P-t-P : 10.8.0.2[/quote] AFTER : [quote]inet adr : 10.8.0.1 P-t-P : 10.8.0.1[/quote] :? [quote]The client does not need to have routing enabled,[/quote] Debian don't need that to route between eth0 and tun0 ? [quote]but your server-side LAN needs to know where to send replies when VPN traffic comes in. One way to do this is to use masquerading on the server[/quote] Thanks for the type. (there's actually no machine on LAN server, it's a lan for testing, the things that I want for the moment, is to configure client to route internet traffic over VPN connexion).

remove the line [code]ifconfig-pool-persist ipp.txt[/code] from the server config file; otherwise just delete the 'ipp.txt' file and restart the server. IMHO the 'ifconfig-pool-persist' option is used far too often.

I made it empty just before, that's not the problem. But i will remove this line. Another idea ?

what happens when the first client connects? what is shown in the server log file? the first client should be assigned the address 10.8.0.2 after a restart of the openvpn server.

So : 1° I rebooted client and server 2° Connected client 3° Watched /etc/openvpn/openvpn-status.log and saw that the last entry was my last friday's tests, so i rm -Rf the file to be recreated. 4° I reconnected the client : nothing appears in openvpn-status.log 5° Watched in /var/log/daemon.log : and saw these lines : [code]Apr 5 13:19:43 openvpn openvpn[2004]: MULTI: Learn: 10.8.0.4 -> client1/193.XX.XX.XX:44710 Apr 5 13:19:43 openvpn openvpn[2004]: MULTI: primary virtual IP for client1/193.XX.XX.XX:44710: 10.8.0.4 Apr 5 13:19:45 openvpn openvpn[2004]: client1/193.XX.XX.XX:44710 PUSH: Received control message: 'PUSH_REQUEST' Apr 5 13:19:45 openvpn openvpn[2004]: client1/193.XX.XX.XX:44710 SENT CONTROL [client1]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.4 255.255.255.0' (status=1)[/code] 6° "route" on client [code]openvpn.local 193.50.49.1 255.255.255.255 UGH 0 0 0 eth0 193.50.49.0 * 255.255.255.0 U 1 0 0 eth0 10.8.0.0 * 255.255.255.0 U 0 0 0 tun0 [b]default 10.8.0.1[/b] 128.0.0.0 UG 0 0 0 tun0 128.0.0.0 10.8.0.1 128.0.0.0 UG 0 0 0 tun0 default 193.50.49.1 0.0.0.0 UG 0 0 0 eth0[/code] In blod, my gateway for tun0, why does the client not have internet working through the vpn tunnel ? Pings works fine, 10.8.0.1 to 10.8.0.4 and reverse.

did you restart the server with the 'ifconfig-pool-persist' line disabled? if you can ping 10.8.0.1 from the client then the first part of the VPN is working. The fact that you don't have internet access via the VPN is a routing issue ; how is routing done on the server side? are you using NAT/masquerading?

Ping works well before all thoses things (10.8.0.1 - 10.8.0.6) but i thought that when ips will work in couple (server .1 client .2) gateway will be by default 10.8.0.1 so internet will works through the vpn. I forget to disable ifconfig-pool-persistent, but if ipp.txt is empty it's not important ? I don't use NAT/masquerading, because I thought that it is important only for LAN clients server side... I try masquerading and disable ifconfig-pool-persistent... and give you route of server if it doesn't work. Thanks a lot

Addressing and DNS problems

kiwijuice

Bypass-dns option doesn't work.

janjust

the openvpn server can push out a new DNS server but the linux clients don't pick it up automatically; you'll need an openvpn plugin or script like 'update-resolv-conf' for that (or use NetworkManager, which also does it for you, IIRC)

kiwijuice

Ouch, didn't understand well.

On my client I use Network Manager, and it manages my dhcp and my resolv.conf.

or use NetworkManager, which also does it for you

Do I have to do anything ?
The problem is that, clients will be every OS, linux, windows, osx... so i will try update-resolv-conf.

EDIT : there's no resolv.conf to update on windows :evil:

I saw in /etc/openvpn server folder that there is a "update-resolv-conf". I will check that. Thanks again

janjust

you'd have to select the right option in the networkmanager to use the DNS server settings from the VPN.
to make sure it works, first edit the /etc/resolv.conf file by hand and check whether DNS then works - there's no need to install/update update-resolv-conf if that does not work first.

kiwijuice

Edit resolv.conf manually works.

In Network Manager, I suppose that the option to change is in "VPN" ? Because everything is grey, the VPN does not appear.

I tryed a little update-resolv-conf. It didn't work, i will try more tomorrow. Have a nice evening 😉

kiwijuice

To fix the problem, i will indicate to client, to configurate their network cards without automatic DNS, by select, for exemple on network manager, "Automatic Address Lonely (DHCP)".

Like that, I can configure, linux, xp, and macos clients. Thanks to you 😉

janjust

if you use

push "dhcp-option DNS a.b.c.d"

the windows and tunnelblick clients will pick it up automatically.

Linux clients using NetworkManager can also be configured to pick them up , if your NetworkManager is new enough (0.8+).
The "default" NetworkManager-openvpn plugin with "IPv4 Settings: Automatic (VPN)" picks up the DNS servers supplied by my VPN server automatically.

kiwijuice

If we give the same client.crt and client.key to all our users, will that work ?

EDIT : i didn't see your message. I will try.

janjust

that is possible, but not advisable.
If you add

duplicate-cn

to your server config you can re-use the same cert+key for all users, but you will also lose the ability to determine which client is doing what. You would also lose the ability to revoke the certificate for a particular client, should it be compromised (e.g. a laptop is stolen).

kiwijuice

to determine which client is doing what

That's not important because, users are students in computing, and will just mount homes via vpn and ldap authentification to access their files. Logs will be in ldap.

You would also lose the ability to revoke the certificate for a particular client, should it be compromised (e.g. a laptop is stolen).

But that's problematic.

I will understand more how certificating works, it's not clear in my mind.
Users can access to a server in sftp and ssh from their homes, maybe, put easy-rsa with "ca.crt" and let they make their own private/public keys with a script that automaticly copy *.crt on openvpn server...

EDIT :

Actually my server has : private/public keys of client and server. (server.crt server.key client.crt client.key) Logically if I remove client.key and server.crt, it will still work.
Client has : private/public keys of client only. (client.crt client.key) but it should have client.key and server.crt ?

So I think that my connexion is now only crypted and not signed... is there a test to know if the connexion is crypted or crypted and signed ?

janjust

if you're relying on ldap authentication then you can avoid using certificates altogether using

client-cert-not-required

but then your only security is the username+password.

BTW, it's also possible to mount shares and run LDAP queries via SSH port forwarding, but that's off-topic 😉

kiwijuice

Look up, i edited my post.

I do a VPN because my boss says me to do 🙂 It's the lonely idea we have now, but we will have others to exploit the VPN by the future.

And I will not do an authentification ldap by the vpn. When VPN is connected, we will mount manually homes like stockage space, just to access files.

We will connect vpn's client on a VLAN "invited" so we don't know what we will make by future. For now, we just want to make it "mechanically operational".

janjust

Actually my server has : private/public keys of client and server. (server.crt server.key client.crt client.key) Logically if I remove client.key and server.crt, it will still work.
Client has : private/public keys of client only. (client.crt client.key) but it should have client.key and server.crt ?

So I think that my connexion is now only crypted and not signed... is there a test to know if the connexion is crypted or crypted and signed ?

the server needs:
* ca.crt
* server.crt
* server.key
the client needs
* ca.crt
* client.crt
* client.key

otherwise the openvpn server and client will simply refuse to start.
As long as you're using default (i.e. are NOT using 'cipher none') then your connections are encrypted and signed.
You can add more security using a 'tls-auth' key , which protects you from some DDoS type of attacks. However, as you are allowing random students to connect the secrecy of the 'tls-auth' key (which is static and shared by all clients) is not good - hence you might as well leave it out.

kiwijuice

I use tls-auth key 😉

Ok, but, if i look this schema, it's not logic. I've made encryption, signing, with a lotus domino server for mail encryption, and client and server kept their own private key (*.key) and exchange their public keys (*.crt)...

Like that

That's to crypt and inverse to sign ?

Don't understand why, client and server kept their own .crt and .key.

EDIT : oh, that's ca.key and ca.crt which make that... ok, sorry.

« Previous Page