Using Internet with OpenVPN on Windows 7, how?

Marty

Hello everyone, I'm trying to create a OpenVPN connection using La Fonera 2.0n as server.
I've been able to connect successfully with it and I've also been able to surf the Internet through the OpenVPN connection with Ubuntu (using VMware on the Windows 7 computer).
Now, I'm having many difficulties on doing the same stuff directly in Windows 7...how can I do it?

I've installed OpenVPN Gui, configured the client, connected and saw the green lights on, but then it doesn't use the OpenVPN connection to access the internet.

This is the client configuration file:

client
dev tun
proto udp
remote ***.***.***.*** 1194
resolv-retry infinite
nobind
;user nobody
;group nogroup
persist-key
persist-tun
ca ca_fon.crt
cert fon.crt
key fon.key
ns-cert-type server
comp-lzo
verb 3
float
route 192.168.10.0 255.255.255.0

Where 192.168.10.1 is the gateway's IP.
On the Win7 pc I've disabled also the firewall but nothing changes...
Do you have any suggestions? 🙂

Thank you!!

Mimiko

Where 192.168.10.1 is the gateway's IP.

Gateway of whom?

Do you run OpenVPN GUI as elevated? i.e right click -> Run as administrator.

Show OpenVPN server config and openvpn log of win7 client.

Marty

192.168.10.1 is the LAN IP address where the SERVER is located

Yeah, I'm running it as administrator.

Here is the log:

Sat Aug 06 19:59:23 2011 OpenVPN 2.2.0 Win32-MSVC++ [SSL] [LZO2] built on Apr 26 2011
Sat Aug 06 19:59:23 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sat Aug 06 19:59:24 2011 LZO compression initialized
Sat Aug 06 19:59:24 2011 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sat Aug 06 19:59:24 2011 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sat Aug 06 19:59:25 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Aug 06 19:59:25 2011 Local Options hash (VER=V4): '41690919'
Sat Aug 06 19:59:25 2011 Expected Remote Options hash (VER=V4): '530fdded'
Sat Aug 06 19:59:25 2011 UDPv4 link local: [undef]
Sat Aug 06 19:59:25 2011 UDPv4 link remote: ***.***.***.***:****
Sat Aug 06 19:59:25 2011 TLS: Initial packet from ***.***.***.***:****, sid=b5746bd4 96383080
Sat Aug 06 19:59:25 2011 VERIFY OK: depth=1, /C=DE/ST=DE/L=Hamburg/O=Fonera/CN=Fonera/emailAddress=me@myhost.mydomain
Sat Aug 06 19:59:25 2011 VERIFY OK: nsCertType=SERVER
Sat Aug 06 19:59:25 2011 VERIFY OK: depth=0, /C=DE/ST=DE/L=Hamburg/O=Fonera/CN=Fonera/emailAddress=me@myhost.mydomain
Sat Aug 06 19:59:26 2011 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Aug 06 19:59:26 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Aug 06 19:59:26 2011 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Aug 06 19:59:26 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Aug 06 19:59:26 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sat Aug 06 19:59:26 2011 [Fonera] Peer Connection Initiated with ***.***.***.***:****
Sat Aug 06 19:59:28 2011 SENT CONTROL [Fonera]: 'PUSH_REQUEST' (status=1)
Sat Aug 06 19:59:28 2011 PUSH: Received control message: 'PUSH_REPLY,route 192.168.10.0 255.255.255.0 10.8.0.5,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Sat Aug 06 19:59:28 2011 OPTIONS IMPORT: timers and/or timeouts modified
Sat Aug 06 19:59:28 2011 OPTIONS IMPORT: --ifconfig/up options modified
Sat Aug 06 19:59:28 2011 OPTIONS IMPORT: route options modified
Sat Aug 06 19:59:28 2011 ROUTE default_gateway=192.168.1.1
Sat Aug 06 19:59:28 2011 TAP-WIN32 device [Connessione alla rete locale (LAN) 3] opened: \\.\Global\{AFF2E216-EC8C-423A-8B9D-66DB8862B20D}.tap
Sat Aug 06 19:59:28 2011 TAP-Win32 Driver Version 9.8 
Sat Aug 06 19:59:28 2011 TAP-Win32 MTU=1500
Sat Aug 06 19:59:28 2011 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {AFF2E216-EC8C-423A-8B9D-66DB8862B20D} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Sat Aug 06 19:59:28 2011 Successful ARP Flush on interface [26] {AFF2E216-EC8C-423A-8B9D-66DB8862B20D}
Sat Aug 06 19:59:33 2011 TEST ROUTES: 3/3 succeeded len=3 ret=1 a=0 u/d=up
Sat Aug 06 19:59:33 2011 C:\WINDOWS\system32\route.exe ADD 192.168.10.0 MASK 255.255.255.0 10.8.0.5
Sat Aug 06 19:59:33 2011 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sat Aug 06 19:59:33 2011 Route addition via IPAPI succeeded [adaptive]
Sat Aug 06 19:59:33 2011 C:\WINDOWS\system32\route.exe ADD 192.168.10.0 MASK 255.255.255.0 10.8.0.5
Sat Aug 06 19:59:33 2011 ROUTE: route addition failed using CreateIpForwardEntry: L'oggetto esiste già.   [status=5010 if_index=26]
Sat Aug 06 19:59:33 2011 Route addition via IPAPI failed [adaptive]
Sat Aug 06 19:59:33 2011 Route addition fallback to route.exe
Impossibile aggiungere la route: L'oggetto esiste gi….
Sat Aug 06 19:59:33 2011 C:\WINDOWS\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Sat Aug 06 19:59:33 2011 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sat Aug 06 19:59:33 2011 Route addition via IPAPI succeeded [adaptive]
Sat Aug 06 19:59:33 2011 Initialization Sequence Completed

I'll try to get the server conf file too.

Thanks!

Mimiko

route 192.168.10.0 255.255.255.0

Remove this from your client's config, because OpenVPN server pushes this routing.

Also check in your OpenVPN server's config the option:

push "redirect-gateway def1"

It must be present.

Marty

Mimiko wrote
route 192.168.10.0 255.255.255.0
Remove this from your client's config, because OpenVPN server pushes this routing.

Ok, removed. Even though I added that line to make it work from Ubuntu.

Mimiko wroteAlso check in your OpenVPN server's config the option:

push "redirect-gateway def1"

It must be present.

hmm..I don't know where to look for the openvpn server config file (it was created from the Fonera 2.0n user interface). I found an openvpn file in /etc/config/ which contains this:

config 'openvpn' 'openvpn'
	option 'port' '1194'
	option 'proto' 'udp'
	option 'dev' 'tun-ovpn'
	option 'ca' '/etc/openvpn/keys/ca.crt'
	option 'cert' '/etc/openvpn/keys/Fon.crt'
	option 'key' '/etc/openvpn/keys/Fon.key'
	option 'dh' '/etc/openvpn/keys/dh1024.pem'
	option 'server' '10.8.0.0 255.255.255.0'
	option 'ifconfig_pool_persist' '/tmp/ipp.txt'
	option 'keepalive' '10 120'
	option 'comp_lzo' '1'
	option 'max_clients' '2'
	option 'persist_key' '1'
	option 'persist_tun' '1'
	option 'verb' '3'
	option 'status' '/tmp/openvpn.clients 15'
	option 'status_version' '2'
	option 'enable' '1'
	option 'lan' '1'

config 'client' 'fon'
	option 'name' 'fon'

Should I add that line in there?
Thanks for your help!

Mimiko

Oh, you have OpenVPN AS on server. You need to acces the configuration from web interface:
https://remote_server:943/admin
and make configurations there.

Marty

Mimiko wroteOh, you have OpenVPN AS on server. You need to acces the configuration from web interface:
https://remote_server:943/admin
and make configurations there.

Yeah, probably, this is what is on the Fonera http://wiki.fon.com/wiki/Advanced_OpenVPN_Configuration

I've added the line you told me to the Server config file but it wasn't still working, afterwards I added also this line to the Client config (as it says on that previous page)

redirect-gateway

and finally it seems to work! 😃
What do you think about it? Is it correct and secure?

Thanks for your help!

Mimiko

What do you think about it? Is it correct and secure?

Show final server config file with "redirect-gateway". Its strange that adding to server's config didn't make effect. May be you had to restart OpenVPN server.

You can use this option on client as well, but it is not common approach.
As for secure, all internet traffic will go thru secured tunel. After OpenVPN server internet access is same - public.

Marty

Mimiko wrote
What do you think about it? Is it correct and secure?
Show final server config file with "redirect-gateway". Its strange that adding to server's config didn't make effect. May be you had to restart OpenVPN server.

This is the conf file I edited manually:

config 'openvpn' 'openvpn'
	option 'port' '1194'
	option 'proto' 'udp'
	option 'dev' 'tun-ovpn'
	option 'ca' '/etc/openvpn/keys/ca.crt'
	option 'cert' '/etc/openvpn/keys/Fon.crt'
	option 'key' '/etc/openvpn/keys/Fon.key'
	option 'dh' '/etc/openvpn/keys/dh1024.pem'
	option 'server' '10.8.0.0 255.255.255.0'
	option 'ifconfig_pool_persist' '/tmp/ipp.txt'
	option 'keepalive' '10 120'
	option 'comp_lzo' '1'
	option 'max_clients' '2'
	option 'persist_key' '1'
	option 'persist_tun' '1'
	option 'verb' '3'
	option 'status' '/tmp/openvpn.clients 15'
	option 'status_version' '2'
	option 'enable' '1'
	option 'lan' '1'
	option 'redirect_gateway' 'def1'

Mimiko wroteYou can use this option on client as well, but it is not common approach.
As for secure, all internet traffic will go thru secured tunel. After OpenVPN server internet access is same - public.

Perfect, yes I did it in order to be safe when I'm not using my home/office connection. (Internet cafe, hotspots, etc)

Thanks! 😉

Mimiko

I see, you must use on server's config:

option 'push' '"redirect_gateway def1"'