Hi, I can connect from a windows 7 machine to my openvpn server with a new assigned ip address. But I can not connect machines in my private network. A ping try to any network component results to "Destination host unreachable" I disabled the firewall on windows but it did not solve the problem. Any idea what the problem is? Thanks

please post your client+server config files , plus , give is a hint to which hosts you are trying to reach on which end of the VPN tunnel.

The openvpn server is a debian squeeze virtual machine (KVM). I use bridge connection. The ip address of openvpn server is 10.182.78.23 and the gateway 10.182.78.1 server.conf: [code] port 4891 proto tcp dev tap ca /etc/openvpn/easy-rsa/keys/ca.crt cert /etc/openvpn/easy-rsa/keys/openvpnserver.crt key /etc/openvpn/easy-rsa/keys/openvpnserver.key dh /etc/openvpn/easy-rsa/keys/dh1024.pem ifconfig-pool-persist ipp.txt server-bridge 10.182.78.1 255.255.255.0 10.182.78.236 10.182.78.245 push "route 10.182.78.0 255.255.255.0" keepalive 10 120 comp-lzo persist-key persist-tun status /var/log/openvpn-status.log verb 3 [/code] And the clinet.ovpn is [code] client dev tap proto tcp remote me.homelinux.com 4891 resolv-retry infinite nobind pkcs12 me.p12 ns-cert-type server comp-lzo verb 3 [/code] I use also this script for bridging: [code] ### BEGIN INIT INFO # Provides: bridge # Required-Start: $remote_fs $syslog # Required-Stop: $remote_fs $syslog # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: Start daemon at boot time # Description: Enable service provided by daemon. ### END INIT INFO #!/bin/bash # Create global variables # Define Bridge Interface br="br0" # Define list of TAP interfaces to be bridged, # for example tap="tap0 tap1 tap2". tap="tap0" # Define physical ethernet interface to be bridged # with TAP interface(s) above. eth="eth0" eth_ip="10.182.78.23" eth_netmask="255.255.255.0" eth_broadcast="10.182.78.255" gw="10.182.78.1" start_bridge () { ################################# # Set up Ethernet bridge on Linux # Requires: bridge-utils ################################# for t in $tap; do openvpn --mktun --dev $t done for t in $tap; do ifconfig $t 0.0.0.0 promisc up done ifconfig $eth 0.0.0.0 promisc up brctl addbr $br brctl addif $br $eth for t in $tap; do brctl addif $br $t done ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast up route add default gw $gw $br } stop_bridge () { #################################### # Tear Down Ethernet bridge on Linux #################################### ifconfig $br down brctl delbr $br for t in $tap; do openvpn --rmtun --dev $t done ifconfig $eth $eth_ip netmask $eth_netmask broadcast $eth_broadcast up route add default gw $gw $eth } case "$1" in start) echo -n "Starting Bridge" start_bridge ;; stop) echo -n "Stopping Bridge" stop_bridge ;; restart) stop_bridge sleep 2 start_bridge ;; *) echo "Usage: $0 {start|stop|restart}" >&2 exit 1 ;; esac [/code]

first of all, ask yourself if you really need bridging. Bridging is only required for forwarding broadcast and non-IP based traffic. If neither are required then you're better off without bridging. Second, you wrote[quote]The ip address of openvpn server is 10.182.78.23 and the gateway 10.182.78.1[/quote] yet your server-bridge mentions 10.182.78.1 ; try changing the server-bridge line to [code]server-bridge 10.182.78.23 255.255.255.0 10.182.78.236 10.182.78.245[/code] the first IP address should always be equal to the IP of the bridge itself. finally, when using bridging you must [b]explicitly[/b] specify which 'tap' adapter you wish to use. In your case this would mean [code]dev tap0[/code]

janjust, thank you! Your instructions helped me. I had earlier changed those parameters but not at the same time. What I do not understand yet, is that the windows client dose not still have a default gateway. An ipconifg in windows results to: .... IPv4 Address.................. : 10.182.78.236 Subnet mask.................. : 255.255.255.0 Default Gateway............. : I chose for bridging because I need an ip address of my private network to reach other components in the network. I read somewhere without bridging I do not get an ip address from the openvpn. If I am wrong could you explain me what I can do with tunneling, please. Nogmaals bedankt!

a default GW is assigned only if you use something like [code]push "redirect-gateway def1"[/code] on the server; otherwise the tap-win32 adapter is not assigned a GW address; routing to the 10.182.78.0/24 network will still work, however.

Hello, the same problem appears again on my vpn server, a xen VM. I can connect to the server but can not connect to the subnetwork. All before mentionned issues are now correct. Any ideas?! Deb

is routing enabled on the VPN server? is there a firewall blocking things?

The server configuration: [code] port 1194 proto tcp dev tap0 ca keys/ca.crt cert keys/openvpnServer.crt key keys/openvpnServer.key dh keys/dh1024.pem ifconfig-pool-persist ipp.txt server-bridge 10.18.87.23 255.255.255.0 10.18.87.150 10.18.87.155 push "route 10.18.87.0 255.255.255.0" status openvpn-status.log verb 3 [/code] The client config file: [code] client dev tap0 porto tcp remote me.homelinux.com 1194 resolv-retry-infinite nobind ca keys/ca.crt cert keys/client.crt key keys/client.key ns-cert-type server comp-lzo verb 3 [/code] The firewall allows access: Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination

deb, you don't need to push the server's bridge IP mask: push "route 10.18.87.0 255.255.255.0". The routes are added automatically, when client gets the IP for tap-adapter.

no connection to subnetwork after openvpn connection

[deleted]

sorry! I was confused.
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug eth0
iface eth0 inet static
address 10.18.87.20
netmask 255.255.255.0
network 10.18.87.0
broadcast 10.18.87.255
gateway 10.18.87.1
# dns-* options are implemented by the resolvconf package, if installed
dns-nameservers 8.8.8.8

janjust

and how is the xen bridging configured? try enabling proxy_arp on the Xen dom0:

echo 1 >/proc/sys/net/ipv4/conf/default/proxy_arp

and restart the bridge+openvpn server; then try the ping from the VPN client again.

[deleted]

after restarting vpn server on the client:
ping -c 2 10.18.87.21
PING 10.18.87.21 (10.18.87.21) 56(84) bytes of data.

--- 10.18.87.21 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1007ms

janjust

is it possible to run the same openvpn config on the xen host itself (the .20 host) ? does it work in that case?

[deleted]

Thank you for the effort! It is not possible to install openvpn on .20.

« Previous Page