OpenVPN and Android/Windows Client -- No IP Address

mkruluts

Ok. I may have posted this in the wrong part of the forum and don't know how to delete my other post. I have a situation where OpenVPN is the only thing that will allow me to get VPN working with my router and Android device. I have installed it on a windows server 2003 box but moved it to a windows xp box when I thought that was the reason why it wasn't working. Unfortunately my problem still persists. I don't know if its in the configurations or what, but for some reason my android phone will connect but will not assign me a IP for me to access resources on my remote network. Port forwarding is also set in the router for UDP on 1194. Please take a look at the below setup and let me know what I am doing wrong.

The following is what my server.opvpn file contains:

## server.ovpn ##
local 192.168.0.128
port 1194
proto udp
mssfix 1400
push "dhcp-option DNS 68.87.75.198" ## DNS from ISP
push "dhcp-option DNS 68.87.64.150" ## DNS from ISP
dev tun
ca ca.crt
cert widget.crt
key widget.key
dh dh1024.pem
server 192.168.10.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway 192.168.0.1"
keepalive 10 120
comp-lzo
max-clients 4
persist-key
persist-tun
status openvpn-status.log
verb 3

The following is what my client.opvpn file contains:

## kti.ovpn ##
client
proto udp
dev tun
remote kti-online.net 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert kti.crt
key kti.key
comp-lzo
verb 3

Here are some screen shots of my setup for OpenVPN:

Mimiko

Add to the server's config a route to local lan, otherwise client will not find 192.168.0.1:

push "route 192.168.0.0 255.255.255.0"

Also, try TCP port.

mkruluts

I tried both of your options, but still nothing. Any more ideas? I no virtually nothing about OpenVPN and I will try anything.

Mimiko

Can you get any logs of OpenVPN from Android?

mkruluts

Log-append command:
Thu Oct 6 06:47:27 2011 OpenVPN 2.1.1 i686-pc-linux-gnu [SSL] [LZO2] [EPOLL] built on Feb 2 2010
Thu Oct 6 06:47:27 2011 MANAGEMENT: TCP Socket listening on 127.0.0.1:37613
Thu Oct 6 06:47:27 2011 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Thu Oct 6 06:47:27 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Oct 6 06:47:27 2011 WARNING: file 'kti.key' is group or others accessible
Thu Oct 6 06:47:27 2011 LZO compression initialized
Thu Oct 6 06:47:27 2011 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Oct 6 06:47:27 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Oct 6 06:47:27 2011 Local Options hash (VER=V4): '41690919'
Thu Oct 6 06:47:27 2011 Expected Remote Options hash (VER=V4): '530fdded'
Thu Oct 6 06:47:27 2011 Socket Buffers: R=[110592->131072] S=[110592->131072]
Thu Oct 6 06:47:27 2011 UDPv4 link local: [undef]
Thu Oct 6 06:47:27 2011 UDPv4 link remote: 24.3.151.187:1194
Thu Oct 6 06:47:40 2011 MANAGEMENT: Client connected from 127.0.0.1:37613
Thu Oct 6 06:47:40 2011 MANAGEMENT: CMD 'state'
Thu Oct 6 06:47:40 2011 MANAGEMENT: CMD 'state on'
Thu Oct 6 06:47:40 2011 MANAGEMENT: CMD 'bytecount 0'
Thu Oct 6 06:47:57 2011 MANAGEMENT: CMD 'signal SIGTERM'
Thu Oct 6 06:47:57 2011 TCP/UDP: Closing socket
Thu Oct 6 06:47:57 2011 SIGTERM[hard,] received, process exiting
Thu Oct 6 06:47:57 2011 MANAGEMENT: >STATE:1317898077,EXITING,SIGTERM,,

Status command:
OpenVPN STATISTICS
Updated,Thu Oct 6 07:01:03 2011
TUN/TAP read bytes,0
TUN/TAP write bytes,0
TCP/UDP read bytes,4424
TCP/UDP write bytes,4085
Auth read bytes,64
pre-compress bytes,0
post-compress bytes,0
pre-decompress bytes,0
post-decompress bytes,0
END

mkruluts

Sorry the last Log-append command wasn't complete... Here is the full log after connected:

Thu Oct 6 06:47:27 2011 OpenVPN 2.1.1 i686-pc-linux-gnu [SSL] [LZO2] [EPOLL] built on Feb 2 2010
Thu Oct 6 06:47:27 2011 MANAGEMENT: TCP Socket listening on 127.0.0.1:37613
Thu Oct 6 06:47:27 2011 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Thu Oct 6 06:47:27 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Oct 6 06:47:27 2011 WARNING: file 'kti.key' is group or others accessible
Thu Oct 6 06:47:27 2011 LZO compression initialized
Thu Oct 6 06:47:27 2011 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Oct 6 06:47:27 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Oct 6 06:47:27 2011 Local Options hash (VER=V4): '41690919'
Thu Oct 6 06:47:27 2011 Expected Remote Options hash (VER=V4): '530fdded'
Thu Oct 6 06:47:27 2011 Socket Buffers: R=[110592->131072] S=[110592->131072]
Thu Oct 6 06:47:27 2011 UDPv4 link local: [undef]
Thu Oct 6 06:47:27 2011 UDPv4 link remote: 24.3.151.187:1194
Thu Oct 6 06:47:40 2011 MANAGEMENT: Client connected from 127.0.0.1:37613
Thu Oct 6 06:47:40 2011 MANAGEMENT: CMD 'state'
Thu Oct 6 06:47:40 2011 MANAGEMENT: CMD 'state on'
Thu Oct 6 06:47:40 2011 MANAGEMENT: CMD 'bytecount 0'
Thu Oct 6 06:47:57 2011 MANAGEMENT: CMD 'signal SIGTERM'
Thu Oct 6 06:47:57 2011 TCP/UDP: Closing socket
Thu Oct 6 06:47:57 2011 SIGTERM[hard,] received, process exiting
Thu Oct 6 06:47:57 2011 MANAGEMENT: >STATE:1317898077,EXITING,SIGTERM,,
Thu Oct 6 07:11:13 2011 OpenVPN 2.1.1 i686-pc-linux-gnu [SSL] [LZO2] [EPOLL] built on Feb 2 2010
Thu Oct 6 07:11:13 2011 MANAGEMENT: TCP Socket listening on 127.0.0.1:44718
Thu Oct 6 07:11:13 2011 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Thu Oct 6 07:11:13 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Oct 6 07:11:13 2011 WARNING: file 'kti.key' is group or others accessible
Thu Oct 6 07:11:13 2011 LZO compression initialized
Thu Oct 6 07:11:13 2011 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Oct 6 07:11:13 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Oct 6 07:11:13 2011 Local Options hash (VER=V4): '41690919'
Thu Oct 6 07:11:13 2011 Expected Remote Options hash (VER=V4): '530fdded'
Thu Oct 6 07:11:13 2011 Socket Buffers: R=[110592->131072] S=[110592->131072]
Thu Oct 6 07:11:13 2011 UDPv4 link local: [undef]
Thu Oct 6 07:11:13 2011 UDPv4 link remote: 24.3.151.187:1194
Thu Oct 6 07:11:14 2011 TLS: Initial packet from 24.3.151.187:1194, sid=85f4bf63 93e3bd80
Thu Oct 6 07:11:14 2011 VERIFY OK: depth=1, /C=US/ST=PA/L=Pittsburgh/O=KTI/OU=Android/CN=Administrator/emailAddress=mkruluts@comcast.net
Thu Oct 6 07:11:14 2011 VERIFY OK: depth=0, /C=US/ST=PA/O=KTI/OU=Android/CN=widget.kti-online.net.local/emailAddress=mkruluts@comcast.net
Thu Oct 6 07:11:15 2011 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Oct 6 07:11:15 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Oct 6 07:11:15 2011 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Oct 6 07:11:15 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Oct 6 07:11:15 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Oct 6 07:11:15 2011 [widget.kti-online.net.local] Peer Connection Initiated with 24.3.151.187:1194
Thu Oct 6 07:11:17 2011 SENT CONTROL [widget.kti-online.net.local]: 'PUSH_REQUEST' (status=1)
Thu Oct 6 07:11:18 2011 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 68.87.75.198,dhcp-option DNS 68.87.64.150,route 192.168.0.0 255.255.255.0,redirect-gateway 192.168.0.1,route 192.168.10.1,topology net30,ping 10,ping-restart 120,ifconfig 192.168.10.6 192.168.10.5'
Thu Oct 6 07:11:18 2011 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:3: route (2.1.1)
Thu Oct 6 07:11:18 2011 Options error: unknown --redirect-gateway flag: 192.168.0.1
Thu Oct 6 07:11:18 2011 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:5: route (2.1.1)
Thu Oct 6 07:11:18 2011 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:9: ifconfig (2.1.1)
Thu Oct 6 07:11:18 2011 OPTIONS IMPORT: timers and/or timeouts modified
Thu Oct 6 07:11:18 2011 OPTIONS IMPORT: --ifconfig/up options modified
Thu Oct 6 07:11:18 2011 OPTIONS IMPORT: route options modified
Thu Oct 6 07:11:18 2011 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Oct 6 07:11:18 2011 ROUTE default_gateway=10.164.40.49
Thu Oct 6 07:11:18 2011 TUN/TAP device tun0 opened
Thu Oct 6 07:11:18 2011 TUN/TAP TX queue length set to 100
Thu Oct 6 07:11:18 2011 Initialization Sequence Completed
Thu Oct 6 07:11:32 2011 MANAGEMENT: Client connected from 127.0.0.1:44718
Thu Oct 6 07:11:32 2011 MANAGEMENT: CMD 'state'
Thu Oct 6 07:11:32 2011 MANAGEMENT: CMD 'state on'
Thu Oct 6 07:11:32 2011 MANAGEMENT: CMD 'bytecount 3'
Thu Oct 6 07:11:39 2011 MANAGEMENT: CMD 'signal SIGTERM'
Thu Oct 6 07:11:39 2011 TCP/UDP: Closing socket
Thu Oct 6 07:11:39 2011 Closing TUN/TAP interface
Thu Oct 6 07:11:39 2011 SIGTERM[hard,] received, process exiting
Thu Oct 6 07:11:39 2011 MANAGEMENT: >STATE:1317899499,EXITING,SIGTERM,,
Thu Oct 6 07:11:43 2011 OpenVPN 2.1.1 i686-pc-linux-gnu [SSL] [LZO2] [EPOLL] built on Feb 2 2010
Thu Oct 6 07:11:43 2011 MANAGEMENT: TCP Socket listening on 127.0.0.1:12101
Thu Oct 6 07:11:43 2011 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Thu Oct 6 07:11:43 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Oct 6 07:11:43 2011 WARNING: file 'kti.key' is group or others accessible
Thu Oct 6 07:11:43 2011 LZO compression initialized
Thu Oct 6 07:11:43 2011 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Oct 6 07:11:43 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Oct 6 07:11:43 2011 Local Options hash (VER=V4): '41690919'
Thu Oct 6 07:11:43 2011 Expected Remote Options hash (VER=V4): '530fdded'
Thu Oct 6 07:11:43 2011 Socket Buffers: R=[110592->131072] S=[110592->131072]
Thu Oct 6 07:11:43 2011 UDPv4 link local: [undef]
Thu Oct 6 07:11:43 2011 UDPv4 link remote: 24.3.151.187:1194
Thu Oct 6 07:11:44 2011 TLS: Initial packet from 24.3.151.187:1194, sid=58b09f5a 4dd03eab
Thu Oct 6 07:11:44 2011 VERIFY OK: depth=1, /C=US/ST=PA/L=Pittsburgh/O=KTI/OU=Android/CN=Administrator/emailAddress=mkruluts@comcast.net
Thu Oct 6 07:11:44 2011 VERIFY OK: depth=0, /C=US/ST=PA/O=KTI/OU=Android/CN=widget.kti-online.net.local/emailAddress=mkruluts@comcast.net
Thu Oct 6 07:11:45 2011 MANAGEMENT: Client connected from 127.0.0.1:12101
Thu Oct 6 07:11:45 2011 MANAGEMENT: CMD 'state'
Thu Oct 6 07:11:45 2011 MANAGEMENT: CMD 'state on'
Thu Oct 6 07:11:45 2011 MANAGEMENT: CMD 'bytecount 0'
Thu Oct 6 07:11:50 2011 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Oct 6 07:11:50 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Oct 6 07:11:50 2011 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Oct 6 07:11:50 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Oct 6 07:11:50 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Oct 6 07:11:50 2011 [widget.kti-online.net.local] Peer Connection Initiated with 24.3.151.187:1194
Thu Oct 6 07:11:51 2011 MANAGEMENT: >STATE:1317899511,GET_CONFIG,,,
Thu Oct 6 07:11:51 2011 MANAGEMENT: CMD 'bytecount 0'
Thu Oct 6 07:11:52 2011 SENT CONTROL [widget.kti-online.net.local]: 'PUSH_REQUEST' (status=1)
Thu Oct 6 07:11:52 2011 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 68.87.75.198,dhcp-option DNS 68.87.64.150,route 192.168.0.0 255.255.255.0,redirect-gateway 192.168.0.1,route 192.168.10.1,topology net30,ping 10,ping-restart 120,ifconfig 192.168.10.6 192.168.10.5'
Thu Oct 6 07:11:52 2011 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:3: route (2.1.1)
Thu Oct 6 07:11:52 2011 Options error: unknown --redirect-gateway flag: 192.168.0.1
Thu Oct 6 07:11:52 2011 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:5: route (2.1.1)
Thu Oct 6 07:11:52 2011 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:9: ifconfig (2.1.1)
Thu Oct 6 07:11:52 2011 OPTIONS IMPORT: timers and/or timeouts modified
Thu Oct 6 07:11:52 2011 OPTIONS IMPORT: --ifconfig/up options modified
Thu Oct 6 07:11:52 2011 OPTIONS IMPORT: route options modified
Thu Oct 6 07:11:52 2011 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Oct 6 07:11:52 2011 ROUTE default_gateway=10.164.40.49
Thu Oct 6 07:11:52 2011 TUN/TAP device tun0 opened
Thu Oct 6 07:11:52 2011 TUN/TAP TX queue length set to 100
Thu Oct 6 07:11:52 2011 Initialization Sequence Completed
Thu Oct 6 07:11:52 2011 MANAGEMENT: >STATE:1317899512,CONNECTED,SUCCESS,,24.3.151.187
Thu Oct 6 07:11:52 2011 MANAGEMENT: CMD 'bytecount 3'
Thu Oct 6 07:12:03 2011 MANAGEMENT: CMD 'signal SIGTERM'
Thu Oct 6 07:12:03 2011 TCP/UDP: Closing socket
Thu Oct 6 07:12:03 2011 Closing TUN/TAP interface
Thu Oct 6 07:12:04 2011 SIGTERM[hard,] received, process exiting
Thu Oct 6 07:12:04 2011 MANAGEMENT: >STATE:1317899524,EXITING,SIGTERM,,

Mimiko

Can you update the client on Android?

mkruluts

I would if there was a new version. The current OpenVPN binaries are the latest offered by the application. Could it be my tun.ko file?

Mimiko

No, it's clearly seen that OpenVPN on android does not understand push options. So you have to manually configure ip on vpn interface on Android.

mkruluts

Any idea how to do this? Is it just adding a line to the client opvpn file?

Mimiko

I do not have any android to test. So have to figure out for yourself.
In config file you can use "ifconfig".

mkruluts

I don't know the first thing about this stuff. This is why I come to a forum, because I couldn't figure it out for myself, but thanks for the snide remark.

What I can say, is the Android device is a linux based operating system. The OpenVPN binaries are ported from the linux version. The software on the Android device just executes the OpenVPN binaries. I got the log above by putting the following line in client.opvpn file: "log-append /sdcard/openvpn/client_log.log". The application only manages the state of the VPN, nothing else! So I would think that whatever you are asking for can be done using the linux commands for configuring the IP manually. Treat this as a Client(LINUX)/Server(WINDOWS) environment. For the moment, forget this is an Android device, how would you do what you are asking for?

Mimiko

Androind does not run Linux system. It have a variation of the *unix kernel. And is most like java.

As for setting ip, just google it. http://www.cyberciti.biz/faq/linux-change-ip-address/
You will have to set ip to tun adapter.

m4f1050

Im having to set my ip manually, using:

ifconfig tap0 10.0.0.4

how do I set the rest of the configuration?

m4f1050

ok, after I set the IP I had to add the route

route add default gw 10.0.0.1 dev tap0

I can now browse my local network, question is, do I need to use a script for these 2 commands? Why is DHCP and the ROUTE feature not working on OpenVPN android client?