To begin with, I am not a Network GURU and I’m new to open VPN, so go gently on me… I’m trying to connect remote OpenVPN SIP clients to a home SIP server and make calls between the remote and the local phones as well as route calls out SIP trunks from the SIP server. I am able to get the VPN client to connect but can pass absolutely nothing after that, including pings or even a trace route. It would seem that pings are making it to the OpenVPN client as I can see the UPD packets on the Bridged NTW adapter interface via Wireshark. I suspect that it is a routing issue and possibly a bridging issue. Note: if the SIP server and phones are all on the same subnet as the OpenVPN bridged network (all on 10.10.1.0) I can get the remote phone to connect, but have uni-directional RTP data transfer. The RTP packets leaving the SIP Server side of the network are sent to the local IP address of the remote phone rather than the VPN IP address for which there is not visibility on the VPN 10.10 network. Ultimately I want to connect Yealink SIP clients at a home network. [b] Basic Topology –[/b] [code] Remote Client local IP 192.168.1.141 255.255.255.0 192.168.1.1 OpenVPN Server (Windows 7) NIC1 10.10.1.2 255.255.255.0 10.10.1.1 (Bridged to OpenVPN Tap adapter) NIC2 10.10.2.1 255.255.255.0 10.10.1.1 SIP Server 10.10.2.22 255.255.255.0 10.10.2.1 Home SIP Endpoints 10.10.2.101 255.255.255.0 10.10.2.1 10.10.2.102 255.255.255.0 10.10.2.1 [/code] [b]Server Config...[/b] [code]local 10.10.1.2 port 1194 proto udp dev tap ca c:\\work\\openvpn\\keys\\ca.crt cert c:\\work\\openvpn\\keys\\server.crt key c:\\work\\openvpn\\keys\\server.key dh c:\\work\\openvpn\\keys\\dh1024.pem ifconfig-pool-persist ipp.txt server-bridge 10.10.2.100 255.255.255.0 10.10.2.150 10.10.2.199 server-bridge push "route 10.10.2.0 255.255.255.0" duplicate-cn keepalive 10 120 comp-lzo persist-key persist-tun status openvpn-status.log verb 6 mute 20 [/code] [b]Server “route print”[/b] [code]Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 10.10.1.1 10.10.1.2 266 10.10.0.0 255.255.0.0 On-link 10.10.2.1 266 10.10.1.0 255.255.255.0 On-link 10.10.1.2 266 10.10.1.2 255.255.255.255 On-link 10.10.1.2 266 10.10.1.255 255.255.255.255 On-link 10.10.1.2 266 10.10.2.0 255.255.255.0 On-link 10.10.2.1 20 10.10.2.1 255.255.255.255 On-link 10.10.2.1 266 10.10.2.255 255.255.255.255 On-link 10.10.2.1 266 10.10.255.255 255.255.255.255 On-link 10.10.2.1 266 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 169.254.0.0 255.255.0.0 On-link 169.254.42.43 286 169.254.42.43 255.255.255.255 On-link 169.254.42.43 286 169.254.255.255 255.255.255.255 On-link 169.254.42.43 286 192.16.2.0 255.255.255.0 192.16.2.1 10.10.1.2 20 192.16.2.0 255.255.255.0 192.16.2.1 10.10.2.1 20 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 169.254.42.43 286 224.0.0.0 240.0.0.0 On-link 10.10.2.1 266 224.0.0.0 240.0.0.0 On-link 10.10.1.2 266 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 169.254.42.43 286 255.255.255.255 255.255.255.255 On-link 10.10.2.1 266 255.255.255.255 255.255.255.255 On-link 10.10.1.2 266 [/code][b]Client Config…[/b] [code]client dev tap proto udp remote 70.70.70.70 1194 resolv-retry infinite nobind persist-key persist-tun ca keys/ca.crt cert keys/client1.crt key keys/client1.key comp-lzo[/code] [b]Client “route print”[/b] [code]=========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.148 20 127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1 192.168.1.0 255.255.255.0 192.168.1.148 192.168.1.148 20 192.168.1.148 255.255.255.255 127.0.0.1 127.0.0.1 20 192.168.1.255 255.255.255.255 192.168.1.148 192.168.1.148 20 224.0.0.0 240.0.0.0 192.168.1.148 192.168.1.148 20 255.255.255.255 255.255.255.255 192.168.1.148 192.168.1.148 1 255.255.255.255 255.255.255.255 192.168.1.148 3 1 Default Gateway: 192.168.1.1 ===========================================================================[/code]

[quote="JimInSRQ"]Okay, I have the OpenVPN connection working and passing data to and from the phones and PC client, thanks for your help. My issue turned out to be the TAP adapter, it was not bridged with the LAN side NIC before starting the OpenVPN server. Now I have an issue with the [url=http://www.voipreview.org/Business_Telephone_Systems/SIP_trunking.aspx]SIP[/url] phone which I will have to address elsewhere. Thanks.[/quote] I am having the exact same issue as you were having above, but my TAP adapter isn't the problem. Anyone else have any other ideas what may be causing it? Thanks in advance, -Jim

How to pass SIP calls over OpenVPN Tunnel

JimInSRQ

To begin with, I am not a Network GURU and I’m new to open VPN, so go gently on me…

I’m trying to connect remote OpenVPN SIP clients to a home SIP server and make calls between the remote and the local phones as well as route calls out SIP trunks from the SIP server.

I am able to get the VPN client to connect but can pass absolutely nothing after that, including pings or even a trace route. It would seem that pings are making it to the OpenVPN client as I can see the UPD packets on the Bridged NTW adapter interface via Wireshark.

I suspect that it is a routing issue and possibly a bridging issue.

Note: if the SIP server and phones are all on the same subnet as the OpenVPN bridged network (all on 10.10.1.0) I can get the remote phone to connect, but have uni-directional RTP data transfer. The RTP packets leaving the SIP Server side of the network are sent to the local IP address of the remote phone rather than the VPN IP address for which there is not visibility on the VPN 10.10 network.

Ultimately I want to connect Yealink SIP clients at a home network.

Basic Topology –

Remote Client
        local IP 192.168.1.141     255.255.255.0     192.168.1.1

OpenVPN Server (Windows 7) 
	NIC1 10.10.1.2     255.255.255.0     10.10.1.1  (Bridged to OpenVPN Tap adapter)
	NIC2 10.10.2.1     255.255.255.0     10.10.1.1

SIP Server
	10.10.2.22     255.255.255.0     10.10.2.1

Home SIP Endpoints
	10.10.2.101     255.255.255.0     10.10.2.1
	10.10.2.102     255.255.255.0     10.10.2.1

Server Config...

local 10.10.1.2
	port 1194
	proto udp
	dev tap
	ca c:\\work\\openvpn\\keys\\ca.crt
	cert c:\\work\\openvpn\\keys\\server.crt
	key c:\\work\\openvpn\\keys\\server.key
	dh c:\\work\\openvpn\\keys\\dh1024.pem
	ifconfig-pool-persist ipp.txt
	server-bridge 10.10.2.100 255.255.255.0 10.10.2.150 10.10.2.199
	server-bridge
	push "route 10.10.2.0 255.255.255.0" 
	duplicate-cn
	keepalive 10 120
	comp-lzo
	persist-key
	persist-tun
	status openvpn-status.log
	verb 6
	mute 20

Server “route print”

Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0     0.0.0.0     10.10.1.1        10.10.1.2    266
        10.10.0.0      255.255.0.0         On-link         10.10.2.1    266
        10.10.1.0    255.255.255.0         On-link         10.10.1.2    266
        10.10.1.2  255.255.255.255         On-link         10.10.1.2    266
      10.10.1.255  255.255.255.255         On-link         10.10.1.2    266
        10.10.2.0    255.255.255.0         On-link         10.10.2.1     20
        10.10.2.1  255.255.255.255         On-link         10.10.2.1    266
      10.10.2.255  255.255.255.255         On-link         10.10.2.1    266
    10.10.255.255  255.255.255.255         On-link         10.10.2.1    266
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      169.254.0.0      255.255.0.0         On-link     169.254.42.43    286
    169.254.42.43  255.255.255.255         On-link     169.254.42.43    286
  169.254.255.255  255.255.255.255         On-link     169.254.42.43    286
       192.16.2.0    255.255.255.0       192.16.2.1        10.10.1.2     20
       192.16.2.0    255.255.255.0       192.16.2.1        10.10.2.1     20
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     169.254.42.43    286
        224.0.0.0        240.0.0.0         On-link         10.10.2.1    266
        224.0.0.0        240.0.0.0         On-link         10.10.1.2    266
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     169.254.42.43    286
  255.255.255.255  255.255.255.255         On-link         10.10.2.1    266
  255.255.255.255  255.255.255.255         On-link         10.10.1.2    266

Client Config…

client
     dev tap
     proto udp
     remote 70.70.70.70 1194
     resolv-retry infinite
     nobind
     persist-key
     persist-tun
     ca keys/ca.crt
     cert keys/client1.crt
     key keys/client1.key
     comp-lzo

Client “route print”

===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1   192.168.1.148       20
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      192.168.1.0    255.255.255.0    192.168.1.148   192.168.1.148       20
    192.168.1.148  255.255.255.255        127.0.0.1       127.0.0.1       20
    192.168.1.255  255.255.255.255    192.168.1.148   192.168.1.148       20
        224.0.0.0        240.0.0.0    192.168.1.148   192.168.1.148       20
  255.255.255.255  255.255.255.255    192.168.1.148   192.168.1.148       1
  255.255.255.255  255.255.255.255    192.168.1.148               3       1
Default Gateway:       192.168.1.1
===========================================================================

Mimiko

I will recomend make a bridge, if you started with that, with NIC2 on Win7. Also home client also make a bridge with internal LAN nic. In that case your phones will be like in the network with SIP server.

Althought in win7 NIC2 doesnot need to have a gw.

JimInSRQ

Mimiko wroteI will recomend make a bridge, if you started with that, with NIC2 on Win7. Also home client also make a bridge with internal LAN nic. In that case your phones will be like in the network with SIP server.

Althought in win7 NIC2 doesnot need to have a gw.

Okay... so I bridged NIC2 with the bridge adapter. Before the bridge NIC2 was 10.10.2.5/255.255.255.0/no GW. After bridging the bridge adapter is 10.10.2.1/255.255.255/no gateway. Before and after starting the OpenVPN server, I am able to ping 10.10.2.22 (IP address of the SIP server) and connect to it using its Java management interface.

After connecting the OpenVPN server, the TAP adapter is joined to the bridge, I believe that this is expected?

I then created a VPN connection on both a PC and a SIP phone. Note that the VPN IP address for both the PC and the phone are in the same subnet as the SIP server.

TO TEST: The SIP server supports TFTP in order that phones may "GET" their configuration, so I attempted a manual get of a config file from the SIP server and a ping of the server IP address, both fail. A wireshark on the 10.10.2.1 bridge adapter shows not data getting to it from the VPN client.

Open to more suggestions.

Mimiko

After connecting the OpenVPN server, the TAP adapter is joined to the bridge, I believe that this is expected?

Yes, LAN interface and tap adapter a boudn toghether into a bridge.

I then created a VPN connection on both a PC and a SIP phone.

The SIP phone supports installing OpenVPN?

JimInSRQ

The SIP phone supports installing OpenVPN?

Yes the phone is manufactured by Yealink which supports the OpenVPN structure. You have to create a very specific tar ball to load the certs and config file, but it does work.

Mimiko

Try a TFTP and a ping from a PC client. May be SIP phone is configured to get access to services only by local interfaces, not virtual.

JimInSRQ

Okay, I have the OpenVPN connection working and passing data to and from the phones and PC client, thanks for your help. My issue turned out to be the TAP adapter, it was not bridged with the LAN side NIC before starting the OpenVPN server.

Now I have an issue with the SIP phone which I will have to address elsewhere. Thanks.

jimm1909

JimInSRQ wroteOkay, I have the OpenVPN connection working and passing data to and from the phones and PC client, thanks for your help. My issue turned out to be the TAP adapter, it was not bridged with the LAN side NIC before starting the OpenVPN server.

Now I have an issue with the SIP phone which I will have to address elsewhere. Thanks.

I am having the exact same issue as you were having above, but my TAP adapter isn't the problem. Anyone else have any other ideas what may be causing it?

Thanks in advance,

-Jim

maimun80

Hi,
I have install openvpn on my asterisk box, and also installed openvpn client on same machine (Laptop) with VoIP client(x-lite and phonerlite). I can ping from OVPN server to client and client to server. and my voip client connect successfully to voip server (register). but I have problem with call. because, when I make a call, both voip clients ringging, and I hang up a phone, there arent voice. I checked with wireshark from both clients, on capture, just only sending packet (rtp) and dont have receiving packet.

so I would like to know, is there example configuration for server.conf (OVPN) and sip.conf (asterisk server)?

thanks you before.

Maimun

Mimiko

You'll have to check the conection between clients, as for VoIP using asterisk, the asteriks acts only as the finding points between clients, the real voice data is transmitted directly between clients, as in torrent-networks.