OpenVPN installation and configuration on Centos and Windows

ergec

Hello,
First of all this is my first attempt to build a VPN. Here is a basic diagram what I want to do.

And This is what I've done so far.

*Installed OpenVPN on CentOS 5.4
*Created necessary certificate files
*Installed client on windows machine
*Put certificate files under installation folder

Note that I did some changes in config files but I'm sure that I'm missing many stuff. Anyway at the end client tool somehow connects to my CentOS and I can see packets on CentOS using this command

tcpdump -n port 1194

Screenshot from client

Now

What should I do now to be able to ping my server 192.168.123.33 and all other PC in the same network?

Thanks in advance

Regards
Ergec

Edit: I updated the port from 1723 to 1194

maikcat

hi there,

please post both server/client configs...

Michael

ergec

Here are the files

server.conf
http://www.mediafire.com/?iwf7u8ay3cvpdww

client.ovpn
http://www.mediafire.com/?xz326koukt8k1ua

maikcat

your server.conf

port 1194
proto udp
dev tun
ca ca.crt
cert ovpnsrv1.crt
key ovpnsrv1.key # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

you must add to it

push "route 192.168.123.0 255.255.255.0"

and enable ip forwading on centos ,also create the appropriate firewall rule

the pcs on 192.168.253.x net ,what gateway they have?

ps:what sestatus returns?

Michael

ergec

Hello,
Ok I added this line
push "route 192.168.123.0 255.255.255.0"

IP Forwarding is enabled too
sysctl -p
net.ipv4.ip_forward = 1

About this line "server 10.8.0.0 255.255.255.0" do I need to change anything there because I didn't add it and I don't have IPs like 10.8.*.*

You asked "the pcs on 192.168.253.x net ,what gateway they have?"
I don't have 192.168.253.x IP range at all. Where did you see this?
I only have 192.168.1.x range on client side and 192.168.123.x range on server side.

SELinux and all firewalls on server, routers, and client are all disabled for now.
sestatus returns
SELinux status: disabled

Thanks for your interest
Regards
Ergec

ergec

Check this screenshot too it may help. Isn't this adapter supposed to be connected?

maikcat

hi there,

typo error about 253 network...sorry
i meant about 123.x subnet

your connection will show as connected when its connects and gets ip address

with the route addition can you ping the lan ip of your server?

if you issue a netstat -nr on your client ,do you see the route for 192.168.123.x network?

Michael.

ergec

I have Linksys E1000 router on 192.168.123.x

After I added route I restarted openvpn and reconnected client but cannot ping 192.168.123.33 . And network adapter is still "unplugged"

C:\Documents and Settings\Administrator>netstat -nr

This is the output of netstat -nr

C:\Documents and Settings\Administrator>netstat -nr

IPv4 Route Table
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 ff 46 72 5e cf ...... TeamViewer VPN Adapter
0x30003 ...7a 79 7b f0 50 1b ...... Hamachi Network Interface
0xb0006 ...00 21 5e 4e b8 0c ...... Broadcom NetXtreme Gigabit Ethernet
0xb0007 ...00 ff 29 49 23 91 ...... TAP-Win32 Adapter V9
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.100     10
          5.0.0.0        255.0.0.0      5.71.124.46      5.71.124.46     20
      5.71.124.46  255.255.255.255        127.0.0.1        127.0.0.1     20
    5.255.255.255  255.255.255.255      5.71.124.46      5.71.124.46     20
        127.0.0.0        255.0.0.0        127.0.0.1        127.0.0.1      1
      169.254.0.0      255.255.0.0  169.254.152.239  169.254.152.239     30
      169.254.0.0      255.255.0.0   169.254.214.56   169.254.214.56     30
  169.254.152.239  255.255.255.255        127.0.0.1        127.0.0.1     30
   169.254.214.56  255.255.255.255        127.0.0.1        127.0.0.1     30
  169.254.255.255  255.255.255.255  169.254.152.239  169.254.152.239     30
  169.254.255.255  255.255.255.255   169.254.214.56   169.254.214.56     30
      192.168.1.0    255.255.255.0    192.168.1.100    192.168.1.100     10
    192.168.1.100  255.255.255.255        127.0.0.1        127.0.0.1     10
    192.168.1.255  255.255.255.255    192.168.1.100    192.168.1.100     10
        224.0.0.0        240.0.0.0      5.71.124.46      5.71.124.46     20
        224.0.0.0        240.0.0.0  169.254.152.239  169.254.152.239     30
        224.0.0.0        240.0.0.0   169.254.214.56   169.254.214.56     30
        224.0.0.0        240.0.0.0    192.168.1.100    192.168.1.100     10
  255.255.255.255  255.255.255.255      5.71.124.46      5.71.124.46      1
  255.255.255.255  255.255.255.255  169.254.152.239  169.254.152.239      1
  255.255.255.255  255.255.255.255   169.254.214.56   169.254.214.56      1
  255.255.255.255  255.255.255.255    192.168.1.100    192.168.1.100      1
Default Gateway:       192.168.1.1
===========================================================================
Persistent Routes:
  None

maikcat

if you type ipconfig do you see the vpn interface?

are you using the gui to start the openvpn?

Michael.

maikcat

your client.ovpn

client
dev tun
dev-node "Local Area Connection 7"
proto udp
remote here.is.my.working.hostname 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert ovpnsrv1.crt
key ovpnsrv1.key
ns-cert-type server
comp-lzo
verb 3

can you disable for test the dev-node directive?

ergec

I disabled dev-node too but nothing changed. here is the output of ipconfig.

and yes I'm using gui 1.0.3

C:\Documents and Settings\Administrator>ipconfig

Windows IP Configuration


Ethernet adapter Hamachi:

   Connection-specific DNS Suffix  . :
   IP Address. . . . . . . . . . . . : 5.71.124.46
   Subnet Mask . . . . . . . . . . . : 255.0.0.0
   Default Gateway . . . . . . . . . :

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   IP Address. . . . . . . . . . . . : 192.168.1.100
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.1.1

Ethernet adapter Local Area Connection 7:

   Connection-specific DNS Suffix  . :
   Autoconfiguration IP Address. . . : 169.254.149.142
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . :

Ethernet adapter Local Area Connection 2:

   Connection-specific DNS Suffix  . :
   IP Address. . . . . . . . . . . . : 0.0.0.0
   Subnet Mask . . . . . . . . . . . : 0.0.0.0
   Default Gateway . . . . . . . . . :

C:\Documents and Settings\Administrator>

maikcat

your client doesnt get ip for the vpn interface

can you post logs from your client & server?

Michael

ergec

Client log and Server log are removed for security reasons

maikcat

hi there,

>Tue Jun 28 16:09:46 2011 46.21.56.153:3378 VERIFY ERROR: depth=0, error=unsupported certificate purpose: /C=CY/ST=NA/O=Hyperlife/OU=IT/CN=nicosia.intranet.hyperlife.com.cy/emailAddress=e.senturk@hyperlife.com.cy

this is your problem.... (error=unsupported certificate purpose)

wait a minute...

are you using the SAME cert for both client & server?????

hmmm

you MUST create using build-key command a cert for your client
the one you have created using build-key-server is intented to be used for your server ONLY!!

Michael.

ergec

Michael you are absolutely right 🙂

Now it's connected I can ping 192.168.123.33 but only this not the other PCs. I can't ping or browse 192.168.123.34 or others

Also I can use \\10.8.0.1 or \\192.16.123.33 to see shared folders but not \\server-name, why?

maikcat

to see others inside your openvpn servers lan
you have to configure routing to them so they know where to find 10.8.0.x network.

your name resolving also *dont* works because broadcasts dont pass through vpn tunnel
to solve this you must use wins -or- dns and pass info about them to your clients..

Michael.

ergec

Hello Michael,
Thanks again for your reply. I have these lines in my server config file but seems not enough. I'm still missing something. Configure routing you mean these lines in config file or something else, something to be done on router 192.168.123.254?

push "route 10.8.0.0 255.255.255.0"
push "route 192.168.123.0 255.255.255.0"

About name resolving is not a big deal but I definitely need to access at least ip addresses of other PCs on the network.

Thanks for your help
Ergec

maikcat

hi there,

remove this from your server config

>push "route 10.8.0.0 255.255.255.0"

>something to be done on router 192.168.123.254?

yeap...

add to your router a static route about 10.8.0.0/24 subnet pointing to your openvpn LAN ip

Michael.

ergec

Michael you are Awesome 😃

Everything is working now, I can ping, access shares, web interfaces everything using IPs. All my problems are solved for now.

Thanks you so much 🙂

maikcat

glad to helped you out

closing topic

Michael.