OpenVPN on Windows 2008 Server RC2

trevor

Hi,
Some of you may seen my previous post about not getting OpenVPN working on Ubuntu. Due to various reasons i changed to a Windows 2008 RC2 server.
I have installed and configured OpenVPN but cannot connect.

Here is an extract from my server log:

Mon Sep 26 20:23:59 2011 us=765000 OpenVPN 2.2.1 Win32-MSVC++ [SSL] [LZO2] built on Jul  1 2011
Mon Sep 26 20:23:59 2011 us=796000 WARNING: --ifconfig-pool-persist will not work with --duplicate-cn
Mon Sep 26 20:23:59 2011 us=828000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Sep 26 20:23:59 2011 us=984000 Cannot open dh1024.pem for DH parameters: error:02001002:system library:fopen:No such file or directory: error:2006D080:BIO routines:BIO_new_file:no such file
Mon Sep 26 20:23:59 2011 us=984000 Exiting
Press any key to continue...

Here is what im getting from my client log:


Mon Sep 26 19:36:56 2011 us=927000 UDPv4 link remote: 109.232.225.241:1194
Mon Sep 26 19:37:56 2011 us=520000 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Sep 26 19:37:56 2011 us=520000 TLS Error: TLS handshake failed
Mon Sep 26 19:37:56 2011 us=520000 TCP/UDP: Closing socket
Mon Sep 26 19:37:56 2011 us=520000 SIGUSR1[soft,tls-error] received, process restarting
Mon Sep 26 19:37:56 2011 us=520000 Restart pause, 2 second(s)
Mon Sep 26 19:37:58 2011 us=532000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Sep 26 19:37:58 2011 us=532000 Re-using SSL/TLS context
Mon Sep 26 19:37:58 2011 us=532000 LZO compression initialized
Mon Sep 26 19:37:58 2011 us=532000 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Sep 26 19:37:58 2011 us=532000 Socket Buffers: R=[253952->253952] S=[81920->81920]
Mon Sep 26 19:37:58 2011 us=532000 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Sep 26 19:37:58 2011 us=532000 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Sep 26 19:37:58 2011 us=532000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Sep 26 19:37:58 2011 us=532000 Local Options hash (VER=V4): '41690919'
Mon Sep 26 19:37:58 2011 us=532000 Expected Remote Options hash (VER=V4): '530fdded'
Mon Sep 26 19:37:58 2011 us=532000 UDPv4 link local: [undef]

Here is my client.conf:

client
dev tun
proto udp
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\spire.crt"
key "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\spire.key"
ns-cert-type server
comp-lzo
verb 4

And finally my server.conf:

port 1194
proto udp
dev tun
ca ca.crt
cert doubleshot.crt
key doubleshot.key  # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
duplicate-cn
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log-append  openvpn.log
verb 4

I've allowed the port in the firewall/even tried turning off the firewall on both machines.

Thanks,

Mimiko

Mon Sep 26 20:23:59 2011 us=796000 WARNING: --ifconfig-pool-persist will not work with --duplicate-cn
Mon Sep 26 20:23:59 2011 us=984000 Cannot open dh1024.pem for DH parameters: error:02001002:system library:fopen:No such file or directory: error:2006D080:BIO routines:BIO_new_file:no such file

Common problem ))
You can not use "ifconfig-pool-persist" with "dublicate-cn" toghether, reading the description of this options in manual is obviuos.

"Cannot open dh1024.pem" - did you generate certificates? The OpenVPN cant find this file in location you specified in config file.

trevor

Thanks for the help, I managed to sort it now. I didnt have the full path to the certificates and files etc.

I can now connect to the VPN server. However, i want all my internet traffic from the client computer to be routed through the VPN server and this isnt happening.
I've found various instructions on the internet about the Routing and Remote Access service in Windows 2008 Server but i cant seem to get this working.

I've also just seen this in my server log.

Wed Sep 28 20:17:23 2011 us=390000 spire/82.3.244.52:51698 Need IPv6 code in mroute_extract_addr_from_packet

I dont want to use IPv6, i want to use IPv4.

Thanks

Mimiko

Need IPv6 code in mroute_extract_addr_from_packet

In the tun adapter configuration uncheck IPv6 protocol.

i want all my internet traffic from the client computer to be routed through the VPN server and this isnt happening.

Read this topic to find some useful information: https://forums.openvpn.net/topic8454.html

trevor

Thanks for the link.
I have followed those instructions with no joy.
I originally had the NAT settings set to public, but changed to private and restarted openvpn on both the server and client with no luck.

Mimiko

Find the internet adapter on the server and share it, selecting as adapter to share with the TUN adapter.

trevor

Internet connection sharing and Routing and remote access cannot be enabled at the same time.
I also tried this before and it didnt work. I dont get a choice of which adapter to share with. Is this because the OpenVPN adapter is the only option?

Mimiko

Internet connection sharing and Routing and remote access cannot be enabled at the same time.

Of course. You must choose the way to share internet.

Share the adapter which have internet (usualy network LAN) with the OpenVPN tun-adapter.

For better results get an firewal and internet sharing 3rd party software.

trevor

As i said before, i have tried that and it didnt work. I have just disabled Routing and Remote Access and gone back to Internet Connection Sharing and it still doesnt work.

I can connect to the server using OpenVPN ok, but nothing is routed through the server

Mimiko

Did you enabled forwarding?

by default IP Forwarding is not enable in Windows 2008

set interface INTERFACE_NUMBER forwarding=enabled

For both adapters.

trevor

Ok it looks like i have it working.
I needed to run the OpenVPN client as an administrator for it to work properly.

Thanks for all the help

Mimiko

I needed to run the OpenVPN client as an administrator for it to work properly.

Oh. Its an implicit needing when running OpenVPN.