Client unable to connect to server LAN's problematic host

cslew

Hi all. This is my first post. Before I start, thank you very much for reading and offering and help/advise.

Currently, I'm in a rather interesting/frustrating situation. My VPN is able to establish connections with almost any hosts on the VPN server LAN (eg. FTP, VNC, Telnet) without a problem except for a particular host.

I attempted to troubleshoot the problem by disabling the firewall on that problematic host but it doesn't help.
There are no problems if the connection comes from within the LAN itself.

Here is my set up:
OpenVPN server running on Windows XP - enabled IP forwarding and disabled firewall to ensure firewall i not the root of the problem
LAN IP: 192.168.1.0/24
OpenVPN IP: 10.8.0.0/24
Client LAN: I've tried using my mobile phone and 3G mobile broadband dongle and made sure the IPs are not in the same subnet prevent any IP address conflicts.

How should I begin troubleshooting the problem?

maikcat

hi there,

first post your server/client configs
second post server and client logs
third tell us what openvpn versions are you using on both server/client
fourth do you have tcp/ip tools on your client? (ping,traceroute etc)

Michael.

cslew

Sever configs

local 192.168.1.174
port 1194
proto udp
mssfix 1400
push "dhcp-option DNS <dns ip>"
push "dhcp-option DNS <dns ip 2>"
push "route 192.168.1.0 255.255.255.0"
dev tun
ca "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\server.crt"
key "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\server.key"
dh "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\dh1024.pem"
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
keepalive 10 120
cipher BF-CBC
comp-lzo
max-clients 100
persist-key
persist-tun
status openvpn-status.log
verb 3

Client config

client
dev tun
proto udp
remote <wan address> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\client1.crt"
key "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\client1.key"
ns-cert-type server
cipher BF-CBC
comp-lzo
verb 3

Server log

Tue Jun 28 19:24:03 2011 OpenVPN 2.0.9 Win32-MinGW [SSL] [LZO] built on Oct 1 2006
Tue Jun 28 19:24:04 2011 Diffie-Hellman initialized with 1024 bit key
Tue Jun 28 19:24:04 2011 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Jun 28 19:24:04 2011 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{2781F343-1B77-454D-A906-B49807ECFEC4}.tap
Tue Jun 28 19:24:04 2011 TAP-Win32 Driver Version 8.4
Tue Jun 28 19:24:04 2011 TAP-Win32 MTU=1500
Tue Jun 28 19:24:04 2011 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.1/255.255.255.252 on interface {2781F343-1B77-454D-A906-B49807ECFEC4} [DHCP-serv: 10.8.0.2, lease-time: 31536000]
Tue Jun 28 19:24:04 2011 Sleeping for 10 seconds...
Tue Jun 28 19:24:14 2011 Successful ARP Flush on interface [5] {2781F343-1B77-454D-A906-B49807ECFEC4}
Tue Jun 28 19:24:14 2011 route ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.2
Tue Jun 28 19:24:14 2011 Route addition via IPAPI succeeded
Tue Jun 28 19:24:14 2011 Data Channel MTU parms [ L:1542 D:1400 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Jun 28 19:24:14 2011 UDPv4 link local (bound): 192.168.1.174:1194
Tue Jun 28 19:24:14 2011 UDPv4 link remote: [undef]
Tue Jun 28 19:24:14 2011 MULTI: multi_init called, r=256 v=256
Tue Jun 28 19:24:14 2011 IFCONFIG POOL: base=10.8.0.4 size=62
Tue Jun 28 19:24:14 2011 IFCONFIG POOL LIST
Tue Jun 28 19:24:14 2011 client1,10.8.0.4
Tue Jun 28 19:24:14 2011 Initialization Sequence Completed
Tue Jun 28 19:25:13 2011 MULTI: multi_create_instance called
Tue Jun 28 19:25:13 2011 <ip of vpn client>:2572 Re-using SSL/TLS context
Tue Jun 28 19:25:13 2011 <ip of vpn client>:2572 LZO compression initialized
Tue Jun 28 19:25:13 2011 <ip of vpn client>:2572 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Jun 28 19:25:13 2011 <ip of vpn client>:2572 Data Channel MTU parms [ L:1542 D:1400 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Jun 28 19:25:13 2011 <ip of vpn client>:2572 Local Options hash (VER=V4): '530fdded'
Tue Jun 28 19:25:13 2011 <ip of vpn client>:2572 Expected Remote Options hash (VER=V4): '41690919'
Tue Jun 28 19:25:13 2011 <ip of vpn client>:2572 TLS: Initial packet from <ip of vpn client>:2572, sid=841d2547 90354bef
Tue Jun 28 19:25:18 2011 <ip of vpn client>:2572 VERIFY OK: depth=1, <removed>
Tue Jun 28 19:25:18 2011 <ip of vpn client>:2572 VERIFY OK: depth=0, <removed>
Tue Jun 28 19:25:19 2011 <ip of vpn client>:2572 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jun 28 19:25:19 2011 <ip of vpn client>:2572 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jun 28 19:25:19 2011 <ip of vpn client>:2572 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jun 28 19:25:19 2011 <ip of vpn client>:2572 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jun 28 19:25:19 2011 <ip of vpn client>:2572 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Jun 28 19:25:19 2011 <ip of vpn client>:2572 [client1] Peer Connection Initiated with <ip of vpn client>:2572
Tue Jun 28 19:25:19 2011 client1/<ip of vpn client>:2572 MULTI: Learn: 10.8.0.6 -> client1/<ip of vpn client>:2572
Tue Jun 28 19:25:19 2011 client1/<ip of vpn client>:2572 MULTI: primary virtual IP for client1/<ip of vpn client>:2572: 10.8.0.6
Tue Jun 28 19:25:21 2011 client1/<ip of vpn client>:2572 PUSH: Received control message: 'PUSH_REQUEST'
Tue Jun 28 19:25:21 2011 client1/<ip of vpn client>:2572 SENT CONTROL [client1]: 'PUSH_REPLY,dhcp-option DNS <ip of dns>,dhcp-option DNS <ip of dns 2>,route 192.168.1.0 255.255.255.0,redirect-gateway def1,route 10.8.0.1,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

Client log

Tue Jun 28 19:25:04 2011 OpenVPN 2.1.1 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Dec 11 2009
Tue Jun 28 19:25:04 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Jun 28 19:25:04 2011 LZO compression initialized
Tue Jun 28 19:25:04 2011 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Jun 28 19:25:05 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Jun 28 19:25:05 2011 Local Options hash (VER=V4): '41690919'
Tue Jun 28 19:25:05 2011 Expected Remote Options hash (VER=V4): '530fdded'
Tue Jun 28 19:25:05 2011 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Jun 28 19:25:05 2011 UDPv4 link local: [undef]
Tue Jun 28 19:25:05 2011 UDPv4 link remote: x.x.x.x:1194
Tue Jun 28 19:25:06 2011 TLS: Initial packet from x.x.x.x:1194, sid=ef655c4b c2124be2
Tue Jun 28 19:25:08 2011 VERIFY OK: depth=1, <removed>
Tue Jun 28 19:25:08 2011 VERIFY OK: nsCertType=SERVER
Tue Jun 28 19:25:08 2011 VERIFY OK: depth=0, <removed>NS
Tue Jun 28 19:25:11 2011 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jun 28 19:25:11 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jun 28 19:25:11 2011 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jun 28 19:25:11 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jun 28 19:25:11 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Jun 28 19:25:11 2011 [Server] Peer Connection Initiated with x.x.x.x:1194
Tue Jun 28 19:25:14 2011 SENT CONTROL [Server]: 'PUSH_REQUEST' (status=1)
Tue Jun 28 19:25:14 2011 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS x.x.x.x,dhcp-option DNS x.x.x.x,route 192.168.1.0 255.255.255.0,redirect-gateway def1,route 10.8.0.1,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Tue Jun 28 19:25:14 2011 OPTIONS IMPORT: timers and/or timeouts modified
Tue Jun 28 19:25:14 2011 OPTIONS IMPORT: --ifconfig/up options modified
Tue Jun 28 19:25:14 2011 OPTIONS IMPORT: route options modified
Tue Jun 28 19:25:14 2011 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Jun 28 19:25:14 2011 ROUTE default_gateway=10.27.218.129
Tue Jun 28 19:25:14 2011 TAP-WIN32 device [Local Area Connection 6] opened: \\.\Global\{E5BAF8B6-7BCA-4879-9960-ADAF86E627F4}.tap
Tue Jun 28 19:25:14 2011 TAP-Win32 Driver Version 9.6
Tue Jun 28 19:25:14 2011 TAP-Win32 MTU=1500
Tue Jun 28 19:25:14 2011 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {E5BAF8B6-7BCA-4879-9960-ADAF86E627F4} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Tue Jun 28 19:25:14 2011 Successful ARP Flush on interface [30] {E5BAF8B6-7BCA-4879-9960-ADAF86E627F4}
Tue Jun 28 19:25:19 2011 TEST ROUTES: 3/3 succeeded len=2 ret=1 a=0 u/d=up
Tue Jun 28 19:25:19 2011 C:\WINDOWS\system32\route.exe ADD x.x.x.x MASK 255.255.255.255 10.27.218.129
Tue Jun 28 19:25:19 2011 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=50 and dwForwardType=4
Tue Jun 28 19:25:19 2011 Route addition via IPAPI succeeded [adaptive]
Tue Jun 28 19:25:19 2011 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Tue Jun 28 19:25:19 2011 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Jun 28 19:25:19 2011 Route addition via IPAPI succeeded [adaptive]
Tue Jun 28 19:25:19 2011 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Tue Jun 28 19:25:19 2011 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Jun 28 19:25:19 2011 Route addition via IPAPI succeeded [adaptive]
Tue Jun 28 19:25:19 2011 C:\WINDOWS\system32\route.exe ADD 192.168.1.0 MASK 255.255.255.0 10.8.0.5
Tue Jun 28 19:25:19 2011 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Jun 28 19:25:19 2011 Route addition via IPAPI succeeded [adaptive]
Tue Jun 28 19:25:19 2011 C:\WINDOWS\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Tue Jun 28 19:25:19 2011 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Jun 28 19:25:19 2011 Route addition via IPAPI succeeded [adaptive]
Tue Jun 28 19:25:19 2011 Initialization Sequence Completed

Versions: OpenVPN GUI v1.0.3 (for both)

TCP/IP tools: Yes!

Thank you !

maikcat

ok then,

first look everything appears ok

can you ping 10.8.0.1 from your client?
can you ping 192.168.1.174 from your client?

can you ping any other host from 192.168.1.x network?

Michael.

cslew

can you ping 10.8.0.1 from your client?

yes

can you ping 192.168.1.174 from your client?

yes

can you ping any other host from 192.168.1.x network?

i cant. I did a tcpdump with wireshark, the ping did went into the hosts, and the hosts replied. but the replies never reached the vpn client. i assumed this is not an issue right now since i'm still able to establish ftps, vncs session with them.

maikcat

you must a route to your server side pcs like:

route add 10.8.0.0 netmask 255.255.255.0 gw lan-ip-of-openvpn-server

and configure their firewall (if any)

Michael.

cslew

maikcat, thank you. Adding the route solved the problem.

Although I still do not understand why some hosts do not need the route to be added for the VNC, FTP etc. sessions to work.

Thank you very much

maikcat

ok then

closing topic

Michael.