Network scope

maxmumford

I have a working openvpn client / server setup and want to expand the scope of the VPN so some of the computers on the server network are accessible by the VPN clients. I have read the how-to documentation and the notes in the sample server config files but still have some questions.

I understand that I can set up routing so that the server's entire subnet is included into the VPN. My question is, does this mean that these computers are accessible by the client on the same IP's as they use on the server's network? Or do they get reassigned IP's from the VPN's subnet mask? For example:

Server's network ip = 192.168.1.1
Terminal's network ip = 192.168.1.2

Server's VPN ip = 10.8.0.1
Terminal's VPN ip = 10.8.0.3 ~OR~ 192.168.1.2?

Thanks,
Max.

maikcat

hi there,

if you use routing (tun) then your openvpn virtual interface *must* have
different ip subnet range.

to manage the access that clients have to your internal net you can
do it by:

1)iptables (firewall)
2)simply configure routing correctly

iptables are not openvpn component and exists in linux.
routing can be configured by you.

Michael.

maxmumford

So considering my vpn interface uses IP's like 10.8.0.1 (for the server), how will that translate to the client? With routing set up what would they have to type in to access another computer on the remote network through the vpn?

Also we are running ovpn on windows so is there a way round that?

maikcat

hi there,

your clients will get an ip from that subnet (10.8.0.0/24)
you must configure your server to push a route to your clients for your
internal lan like push "route 192.168.1.0 255.255.255.0"
also you must enable ipforwarding to your openvpn server (its a registry key in windows)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IPEnableRouter

set this to 1

also you must configure your pcs inside your lan to route packets for 10.8.0.0/24 net through
openvpn server...

then your clients will have to use lan pc ips to access them f.e 192.168.1.20

Michael.

maxmumford

Thanks.

So do I need an entry like "internal lan like push "route 192.168.1.0 255.255.255.0" for each of the terminals on the servers network? F.e. if there is there are 2 terminals with the ips 192.168.1.25 and 1292.168.1.82 do I need to put the following in the server config file:

push route 192.168.1.25 255.255.255.0
push route 192.168.1.82 255.255.255.0

Once i do this how will I know what IP to use on the VPN client side to access the terminals on the servers network?

And you say "then your clients will have to use lan pc ips to access them f.e 192.168.1.20". What happens if the client uses the same ip's as the ones that are allocated to the VPN? Or is that handled by their DHCP?

Sorry for so many questions, this is my first time properly using ovpn! 😃

Thanks.
Max

maikcat

hi there,

when you use the server directive inside openvpn,
it automatically *gives* out ip addresses to connected clients
(check out --mode directive)

so if you want your client to have access to your lan simply add
push "route 192.168.1.0 255.255.255.0"

to your openvpn server config file,
such addition is *global* means that everyone that connects recieves
the above static route.
if you want to give access to one ip you add
push "route 192.168.1.10 255.255.255.255"

to complex things more for you ,you can use ccd files and push settings
to each client seperately...

i know its complicated ,but thats the way it is
setting up vpn involves both tcp/ip knowledge and some cryptology as well...

feel free to ask...

Michael.

maxmumford

Okay thanks. I have changed the registry key and added that line to the server config file and the client's config file. After connecting the client, how do I know what ip to use to access the machines on the server's network?

maikcat

hi there,

can you post client/server config
so i can help you out..

Michael

maxmumford

lol, thanks.

here is the server config:

local 192.168.1.x

port xxxx

proto tcp

dev tun

ca "C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\server.crt"
key "C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\server.key"  # This file should be kept secret

dh "C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\dh1024.pem" 

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

keepalive 10 120

comp-lzo

persist-key
persist-tun

status openvpn-status.log

verb 3

push "route 192.168.1.0 255.255.255.255"

Here is a client config:


client

dev tun

proto tcp

remote xxx.xxx.xx.xxx xxxxx

resolv-retry infinite

nobind

persist-key
persist-tun

ca "C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\Ca.crt"
cert "C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\Max.crt"
key "C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\Max.key"

comp-lzo

verb 3

#route back to openvpn server
push "route 192.168.3.0 255.255.255.255"

maikcat

hi there,

>push "route 192.168.3.0 255.255.255.255"

the client cant push routes to server....

what exactly do you want to do anyway? lan to lan connection?

your client gets ip from 10.8.0.0 range,the first one gets 10.8.0.6 , second 10.8.0.10 and so on

Michael.

maxmumford

I read somewhere that on the client you had to route "reply" traffic through the vpn so added the clause to the client too. Taken it out now.

On connecting the client the log shows the route commands are being received with:

Push: Received control message: "PUSH_REPLY,ROUTE 192.168.3.0 255.255.255.0 .........."
...
Route: CreateIPForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Route addition via IPAPI succeeded [adaptive]

On the client I tried pinging 192.168.3.3 (a machine address on the server network) and it didnt work. Also the ipp.txt file had no references for server machine ip's. How do I know what IP address to use on the client machine to access them?

Max.

maikcat

hi there,

your openvpn server lan is 192.168.1.0 and you are pushing route for this
subnet to your clients.

if you want lan-to-lan connectivity, and behind your vpn client is 192.168.3.0 subnet then

you have to do the following:

add to your server config

route "192.168.3.0 255.255.255.0"

also create a ccd file for the certificate that your client uses and add into it

iroute 192.168.3.0 255.255.255.0

enable ip forwading in both (server/client).

when your clients connects it gets a virtual ip of 10.8.0.6 and
your openvpn server automatically routes traffic destined 192.168.3.0 subnet through
your vpn client..

also for testing disable firewall on both server/clients.

>On the client I tried pinging 192.168.3.3 (a machine address on the server network)

based on your configs 192.168.1.x subnet is on your server side...

>here is the server config:
>Code:
>local 192.168.1.x

Michael.

maxmumford

Hey,

Thanks for your reply. I am trying to set up a server to client vpn and allow the client to access other machines on the server's subnet.

I have been a bit inconsistent with IP's subnets in this thread as I originally didn't want to give away too much information but as time passed, circumstances called for it.

My server has local ip 192.168.3.2. VPN clients get IPS like 10.8.0.6.

Update: I CAN ping 192.168.3.2 from a connected client but not 192.168.3.3 - another computer on the server's network. Any obvious reasons for this?

maikcat

hi there,

please provide consistent info for your network

keep in mind that half of errors made are at least stupid.. (i also make stupid errors sometimes).

what gateway your 192.168.3.3 has?
do you have firewall enabled on it?

did you enable ip forward on your openvpn server?

Michael.

maxmumford

keep in mind that half of errors made are at least stupid..

That is most certainly true!!

IP forwarding is on and ping still fails when the firewall is off.

The gateway for the server is 192.168.3.1

maikcat

hi there,

you must add a static route to your servers for the vpn subnet pointing
to your openvpn servers lan ip -or- set to your servers the openvpn servers lan ip as
the default gateway.

Michael.

maxmumford

So for example, in the server config file:

push "route 10.8.0.0 192.168.3.3"

?

Thanks.

maikcat

hi there,

can you please post a mini diagram of your servers so we can help you out..?

Michael.

maxmumford

I want the client to be able to access all terminals on the server network via IP while connected to the VPN.

(Sorry for all the confusion, I have never even needed to know what a subnet is, before my first attempt with openvpn 😛 )

maikcat

ok ,much better now...

you must to your terminal server this

route add 10.8.0.0 mask 255.255.255.0 192.168.3.2 -p (-p to make it persistant)

-or-

add a similar static route to your internet router

-or-

set as default gateway to your pcs 192.168.3.2

Michael.

ps: to test your setup try to ping 10.8.0.1 from your clients if it responds your routing is ok