OpenVPN, Kerio Winroute, Windows APIPA.

Mimiko

Hello.

I run into a problem when trying to stop Automatic Private IP Addressing (APIPA), implemented in windows. By default, OpenVPN adapter has no IP and is in DHP mode. When APIPA is working, on OpenVPN startup, VPN adapter is connected and it gets to IP's first from windows in range 169.254.0.0-169.254.255.255, second from OpenVP service in defined range.

With this configuration Kerio Winroute shows only first IP (169.254.x.x) and is correctly routing all needed and configured trafic thru VPN adapter.

Using APIPA brings come problems with route and iroute command in OpenVPN, when not all routes are addedd correctly. Thats why I decided to disable APIPA for VPN adapter.

After disabling APIPA, OpenVPN route and iroute issues are gone, but Kerio Winroute does not detect correctly or whatever for VPN adapter, and none trafic is permitted. OpenVPN connection is established, but other trafic is blocked.

So I came back to enable APIPA and add a 'route-delay' statement in config file of OpenVPN.

Will be this some how resolved? I would like to disable APIPA.

maikcat

hi there,

>By default, OpenVPN adapter has no IP and is in DHP mode

openvpn adapter shows as "connected" when the service is up and running,
that means that you have created configuration file for openvpn
and usually telling it in which mode it runs (server,ptp).
because of that it usually gets an ip from that mode.

what config did you used?
because i never used winroute ,can you explain what you are trying
to achieve?

cheers,

Michael.

Mimiko

Hello maikcat.

I've already achieved what I wanted: Connect branch offices to central office and make a VPN for accessing companys servers.

But to clarify the things. That is servers main configuration:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 192.168.3.0 255.255.255.0
ifconfig-pool-persist ipp.txt
route-delay 60 60
push "route x.x.0.0 255.255.0.0" # Server's internal network
client-config-dir ccd
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
ip-win32 ipapi
script-security 2

route x1.y1.0.0 255.255.0.0 # Branch office 1's internal network
push "route x1.y1.0.0 255.255.0.0"

route x2.y2.0.0 255.255.0.0 # Branch office 2's internal network
push "route x2.y2.0.0 255.255.0.0"

Client's configuration:

client
dev tun
proto udp
remote a.b.c.d
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
comp-lzo
keepalive 10 120
route-delay 20 60

Yes, I know that adapter is connected when service is runnig. 🙂

In Kerio Winroute routing rules are defined per adapter, not per IP it gets. When windows APIPA is enabled, after OpenVPN service is started, routes are added to route table. But when APIPA is disabled, after starting OpenVPN service routes are not added to route table. I'm not sure who adds routes to route table: kerio or windows. Most likely is kerio's job.