(solved) need help - client / server config

ds2k5

Hello,
i try to get a openvpn-server running.
but i have problem with the config.

The User gets the IP: 192.168.22.10 but can not ping any IPs from 10.0.42.0/24. (see the end, Linux client do not get ip)

What did i wrong ?

Here is my config:

LAN = 10.0.42.0 /255.255.255.0
GW = 10.0.42.1

OpenVPN-SRV = 10.0.42.240 / 255.255.255.0
GW = 10.0.42.1

/etc/openvpn/server.conf

mode server
tls-server

local 10.0.42.240 ## ip/hostname of server
port 1194 ## default openvpn port
proto udp

dev tun0

persist-key
persist-tun

#certificates and encryption
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
tls-auth ta.key 0 # This file is secret

cipher BF-CBC # Blowfish (default)
comp-lzo

#DHCP Information
ifconfig-pool-persist ipp.txt
server 172.16.0.0 255.255.255.0

#log and security
user nobody
group nogroup
keepalive 10 120
status openvpn-status.log
log openvpn.log
verb 3

client-to-client
client-config-dir ccd

route 192.168.22.0 255.255.255.0

/etc/openvpn/ccd/user1

ifconfig-push 192.168.22.10 192.168.22.9
iroute 192.168.22.0 255.255.255.0

# netstat -nr
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
172.16.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.22.0 172.16.0.2 255.255.255.0 UG 0 0 0 tun0
10.0.42.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
172.16.0.0 172.16.0.2 255.255.255.0 UG 0 0 0 tun0
0.0.0.0 10.0.42.1 0.0.0.0 UG 0 0 0 eth0

client.ovpn

client
dev tap
remote xxx.xx.xx.xx 1194
nobind
resolv-retry infinite
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
tls-auth ta.key 1
cipher BF-CBC
comp-lzo
verb 3
script-security 2

If i try with a Linux Client i get this:

Wed Oct 5 15:35:51 2011 [server] Peer Connection Initiated with [AF_INET]xxx.xx.xx.xx:1194
Wed Oct 5 15:35:53 2011 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Oct 5 15:35:53 2011 PUSH: Received control message: 'PUSH_REPLY,route 172.16.0.1,topology net30,ping 10,ping-restart 120,ifconfig 192.168.22.10 192.168.22.9'
Wed Oct 5 15:35:53 2011 OPTIONS IMPORT: timers and/or timeouts modified
Wed Oct 5 15:35:53 2011 OPTIONS IMPORT: --ifconfig/up options modified
Wed Oct 5 15:35:53 2011 OPTIONS IMPORT: route options modified
Wed Oct 5 15:35:53 2011 WARNING: Since you are using --dev tap, the second argument to --ifconfig must be a netmask, for example something like 255.255.255.0. (silence this warning with --ifconfig-nowarn)
Wed Oct 5 15:35:53 2011 ROUTE default_gateway=192.112.112.1
Wed Oct 5 15:35:53 2011 OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
Wed Oct 5 15:35:53 2011 OpenVPN ROUTE: failed to parse/resolve route for host/network: 172.16.0.1
Wed Oct 5 15:35:53 2011 TUN/TAP device tap0 opened
Wed Oct 5 15:35:53 2011 TUN/TAP TX queue length set to 100
Wed Oct 5 15:35:53 2011 /sbin/ifconfig tap0 192.168.22.10 netmask 192.168.22.9 mtu 1500 broadcast 255.255.255.254
SIOCSIFNETMASK: Invalid argument
Wed Oct 5 15:35:53 2011 Linux ifconfig failed: external program exited with error status: 1
Wed Oct 5 15:35:53 2011 Exiting

The Windows Client get a IP.

thanks

Mimiko

The User gets the IP: 192.168.22.10 but can not ping any IPs from 10.0.42.0/24.

Because PC on the LAN hase gateway 192.168.22.1, not the OpenVPN server. Read this with the same problem: https://forums.openvpn.net/topic8922.html

Linux client do not get ip

See your log for explanation, its very clearly.

janjust

your client config uses

dev tap

but your server uses

dev tun

change your client config to use 'dev tun' as well and try again.

ds2k5

Thanks to janjust & Mimiko

Here is my working config:

Server

/etc/openvpn/server.conf

mode server
tls-server
local 10.0.42.240
port 1194
proto udp
dev tun0
persist-key
persist-tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
tls-auth ta.key 0
cipher BF-CBC
comp-lzo
ifconfig-pool-persist ipp.txt
server 172.16.0.0 255.255.255.0
user nobody
group nogroup
keepalive 10 120
status openvpn-status.log
log openvpn.log
verb 3
client-config-dir ccd

route 192.168.22.0 255.255.255.0

/etc/openvpn/ccd/client1

ifconfig-push 192.168.22.10 192.168.22.9
iroute 192.168.22.0 255.255.255.0
push route "10.0.42.0 255.255.255.0"

/etc/rc.local

add this lines

# MASQ and IP_Forward
echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Client:

client1.ovpn

client
dev tun
remote xxx.xxx.xxx.xxx 1194
nobind
resolv-retry infinite
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
tls-auth ta.key 1
cipher BF-CBC
comp-lzo
verb 3
script-security 2

Check MASQ & IPForward

iptables -t nat -L -n

cat /proc/sys/net/ipv4/ip_forward

Without masquerading and ipforward the routing will not work!