I have a working openvpn client / server setup and want to expand the scope of the VPN so some of the computers on the server network are accessible by the VPN clients. I have read the how-to documentation and the notes in the sample server config files but still have some questions. I understand that I can set up routing so that the server's entire subnet is included into the VPN. My question is, does this mean that these computers are accessible by the client on the same IP's as they use on the server's network? Or do they get reassigned IP's from the VPN's subnet mask? For example: Server's network ip = 192.168.1.1 Terminal's network ip = 192.168.1.2 Server's VPN ip = 10.8.0.1 Terminal's VPN ip = 10.8.0.3 ~OR~ 192.168.1.2? Thanks, Max.

hi there, if you use routing (tun) then your openvpn virtual interface *must* have different ip subnet range. to manage the access that clients have to your internal net you can do it by: 1)iptables (firewall) 2)simply configure routing correctly iptables are not openvpn component and exists in linux. routing can be configured by you. Michael.

So considering my vpn interface uses IP's like 10.8.0.1 (for the server), how will that translate to the client? With routing set up what would they have to type in to access another computer on the remote network through the vpn? Also we are running ovpn on windows so is there a way round that?

hi there, your clients will get an ip from that subnet (10.8.0.0/24) you must configure your server to push a route to your clients for your internal lan like push "route 192.168.1.0 255.255.255.0" also you must enable ipforwarding to your openvpn server (its a registry key in windows) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IPEnableRouter set this to 1 also you must configure your pcs inside your lan to route packets for 10.8.0.0/24 net through openvpn server... then your clients will have to use lan pc ips to access them f.e 192.168.1.20 Michael.

Thanks. So [b]do I need an entry like "internal lan like push "route 192.168.1.0 255.255.255.0" for each of the terminals on the servers network[/b]? F.e. if there is there are 2 terminals with the ips 192.168.1.25 and 1292.168.1.82 do I need to put the following in the server config file: push route 192.168.1.25 255.255.255.0 push route 192.168.1.82 255.255.255.0 Once i do this [b]how will I know what IP to use on the VPN client side to access the terminals on the servers network[/b]? And you say "then your clients will have to use lan pc ips to access them f.e 192.168.1.20". [b]What happens if the client uses the same ip's as the ones that are allocated to the VPN? Or is that handled by their DHCP[/b]? Sorry for so many questions, this is my first time properly using ovpn! :D Thanks. Max

hi there, when you use the server directive inside openvpn, it automatically *gives* out ip addresses to connected clients (check out --mode directive) so if you want your client to have access to your lan simply add push "route 192.168.1.0 255.255.255.0" to your openvpn server config file, such addition is *global* means that everyone that connects recieves the above static route. if you want to give access to one ip you add push "route 192.168.1.10 255.255.255.255" to complex things more for you ,you can use ccd files and push settings to each client seperately... i know its complicated ,but thats the way it is setting up vpn involves both tcp/ip knowledge and some cryptology as well... feel free to ask... Michael.

Okay thanks. I have changed the registry key and added that line to the server config file and the client's config file. After connecting the client, how do I know what ip to use to access the machines on the server's network?

hi there, can you post client/server config so i can help you out.. Michael

hi there, >push "route 192.168.3.0 255.255.255.255" the client cant push routes to server.... what exactly do you want to do anyway? lan to lan connection? your client gets ip from 10.8.0.0 range,the first one gets 10.8.0.6 , second 10.8.0.10 and so on Michael.

I read somewhere that on the client you had to route "reply" traffic through the vpn so added the clause to the client too. Taken it out now. On connecting the client the log shows the route commands are being received with: [code]Push: Received control message: "PUSH_REPLY,ROUTE 192.168.3.0 255.255.255.0 .........." ... Route: CreateIPForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4 Route addition via IPAPI succeeded [adaptive][/code] On the client I tried pinging 192.168.3.3 (a machine address on the server network) and it didnt work. Also the ipp.txt file had no references for server machine ip's. How do I know what IP address to use on the client machine to access them? Max.

Network scope

maxmumford

Thanks, I have added:

push "route add 10.8.0.0 mask 255.255.255.0 192.168.3.2 -p"

To my server .ovpn config file, restarted the service, connected a client and can ping 10.8.0.1, but cannot ping 192.168.3.3

I also tried setting the client's IP to 10.8.0.6, subnet 255.0.0.0 and default gateway to 192.168.3.2 and tried to ping 192.168.3.3 with no luck.

maikcat

hi there,

maybe i confused you,

the route add 10.8.0.0 mask 255.255.255.0 192.168.3.2 -p

was meant to executed inside a dos prompt on your terminal server
not to enter it inside openvpn config file.. :?

Michael

maxmumford

Ok, I have taken it out of the config file, ran that command in an elevated command prompt with the reply, "OK!" so the route was added. Then restarted the service.

Then connected the client and pinged 10.8.0.1 successfully but 192.168.3.2 & 192.168.3.3 unsuccessfully.

maikcat

did you enabled ip forwading on openvpn server?

can you also post the output of netstat -nr on your client?

Michael

maxmumford

IP forwarding is enabled as per this article:

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q230082

Here is the output of netstat -nr on the connected client:

===========================================================================
Interface List
 17...00 ff 16 6c 1e 91 ......TAP-Win32 Adapter V9
 15...e0 2a 82 a4 7e 68 ......Broadcom 4313 802.11b/g/n
 14...e0 2a 82 94 4a fa ......Bluetooth Device (Personal Area Network)
  1...........................Software Loopback Interface 1
 11...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
 12...00 00 00 00 00 00 00 e0 Microsoft 6to4 Adapter
 20...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
 18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
 16...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.7.1     192.168.7.16     30
         10.8.0.1  255.255.255.255         10.8.0.5         10.8.0.6     30
         10.8.0.4  255.255.255.252         On-link          10.8.0.6    286
         10.8.0.6  255.255.255.255         On-link          10.8.0.6    286
         10.8.0.7  255.255.255.255         On-link          10.8.0.6    286
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.7.0    255.255.255.0         On-link      192.168.7.16    286
     192.168.7.16  255.255.255.255         On-link      192.168.7.16    286
    192.168.7.255  255.255.255.255         On-link      192.168.7.16    286
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link          10.8.0.6    286
        224.0.0.0        240.0.0.0         On-link      192.168.7.16    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link          10.8.0.6    286
  255.255.255.255  255.255.255.255         On-link      192.168.7.16    286
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
          0.0.0.0          0.0.0.0      192.168.3.1  Default 
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
 16     58 ::/0                     On-link
  1    306 ::1/128                  On-link
 16     58 2001::/32                On-link
 16    306 2001:0:5ef5:79fb:1c5e:265d:3f57:f8ef/128
                                    On-link
 17    286 fe80::/64                On-link
 15    286 fe80::/64                On-link
 16    306 fe80::/64                On-link
 16    306 fe80::1c5e:265d:3f57:f8ef/128
                                    On-link
 15    286 fe80::2106:e596:f97:36d4/128
                                    On-link
 17    286 fe80::5def:d999:53db:8bd8/128
                                    On-link
  1    306 ff00::/8                 On-link
 16    306 ff00::/8                 On-link
 17    286 ff00::/8                 On-link
 15    286 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

By the way, was I right to run the command on the computer labeled "OpenVPN Server" in the network diagram?

maikcat

>By the way, was I right to run the command on the computer labeled "OpenVPN Server" in the network diagram?

err...no
you should run it on "terminal" or any other computer you wish your client can see..

ps: i also noticed this

Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 192.168.3.1 Default

can you please re-post server config..?

Michael

maxmumford

Here is the server config:

local 192.168.3.2
port 48141
proto tcp
dev tun
ca "C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\server.crt"
key "C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\server.key" 
dh "C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\dh1024.pem" 
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

Do I need to remove that route from the openvpn server then?

After adding the route to a couple of network computers I still cannot ping them even with the firewalls disabled :/

maikcat

hi there,

add this to openvpn server config

push "route 192.168.3.0 255.255.255.0"

restart openvpn service and try again

Michael.

maxmumford

maikcat wrotehi there,

add this to openvpn server config

push "route 192.168.3.0 255.255.255.0"

restart openvpn service and try again

Michael.

That did it! Thanks for all your help, it is really very appreciated.

All the best!
Max.

maikcat

glad to helped you

Closing topic

Michael.

« Previous Page