[RESOLVED] Server not working anymore

Singman

Hi everyone,

I have a setup that worked for many months, then I rebooted the server and now, nothing is working 🙂

Server is Ubuntu 9.10. My server IP network is 10.0.0.x (10.0.0.69). VPN IP network is 10.0.8.x.

# uname -a
Linux cerbere 2.6.31-23-generic #75-Ubuntu SMP Fri Mar 18 18:08:39 UTC 2011 i686 GNU/Linux

# cat VPN-Routed.conf
port 1194
proto udp
dev tun0
ca keys/autorite/ca.crt
cert keys/autorite/serverkey.crt
key keys/autorite/serverkey.key
dh keys/autorite/dh1024.pem
server 10.0.8.0 255.255.255.0
crl-verify keys/autorite/crl.pem
ifconfig-pool-persist servers/VPN-Routed/logs/ipp.txt
cipher AES-128-CBC
user nobody
group nogroup
status servers/VPN-Routed/logs/openvpn-status.log
log-append servers/VPN-Routed/logs/openvpn.log
verb 2
mute 20
max-clients 50
management 127.0.0.1 8181
keepalive 10 120
client-config-dir /etc/openvpn/servers/VPN-Routed/ccd
tls-server
client-to-client
comp-lzo
persist-key
persist-tun
ccd-exclusive
push "dhcp-option DNS 10.0.0.32"
push "route 10.0.0.0 255.255.255.0"

Client config (Win Server 2003) :
client
proto udp
dev tun
ca ca.crt
dh dh1024.pem
cert edelcamp.crt
key edelcamp.key
remote extranet.ems-editique.fr 1194
cipher AES-128-CBC
verb 2
mute 20
keepalive 10 120
comp-lzo
persist-key
persist-tun
float
resolv-retry infinite
nobind
route-method exe
route-delay 2

Client log during a connection :
Fri Oct 07 17:19:01 2011 OpenVPN 2.2.1 Win32-MSVC++ [SSL] [LZO2] built on Jul 1 2011
Fri Oct 07 17:19:01 2011 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Fri Oct 07 17:19:01 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Fri Oct 07 17:19:04 2011 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Oct 07 17:19:05 2011 LZO compression initialized
Fri Oct 07 17:19:05 2011 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Oct 07 17:19:05 2011 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Fri Oct 07 17:19:05 2011 Local Options hash (VER=V4): '66096c33'
Fri Oct 07 17:19:05 2011 Expected Remote Options hash (VER=V4): '691e95c7'
Fri Oct 07 17:19:05 2011 UDPv4 link local: [undef]
Fri Oct 07 17:19:05 2011 UDPv4 link remote: 82.239.43.182:1194
Fri Oct 07 17:19:05 2011 VERIFY OK: depth=1, /C=FR/ST=Aquitaine/L=Pessac/O=Office/emailAddress=vpn@ems-editique.fr
Fri Oct 07 17:19:05 2011 VERIFY OK: depth=0, /C=FR/ST=Aquitaine/L=Pessac/O=Office/OU=Office/CN=serverkey/emailAddress=vpn@ems-editique.fr
Fri Oct 07 17:19:05 2011 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Fri Oct 07 17:19:05 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Oct 07 17:19:05 2011 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Fri Oct 07 17:19:05 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Oct 07 17:19:05 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Fri Oct 07 17:19:05 2011 [serverkey] Peer Connection Initiated with 82.239.43.182:1194
Fri Oct 07 17:19:08 2011 TAP-WIN32 device [Connexion au réseau VPN] opened: \\.\Global\{5618B176-74F2-4B5B-A2DC-54BFBB433DCF}.tap
Fri Oct 07 17:19:08 2011 TAP-Win32 MTU=1500
Fri Oct 07 17:19:08 2011 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.0.8.6/255.255.255.252 on interface {5618B176-74F2-4B5B-A2DC-54BFBB433DCF} [DHCP-serv: 10.0.8.5, lease-time: 31536000]
Fri Oct 07 17:19:08 2011 Successful ARP Flush on interface [3] {5618B176-74F2-4B5B-A2DC-54BFBB433DCF}

Server Log :
Fri Oct 7 17:19:19 2011 88.191.78.144:1091 Re-using SSL/TLS context
Fri Oct 7 17:19:19 2011 88.191.78.144:1091 LZO compression initialized
Fri Oct 7 17:19:19 2011 88.191.78.144:1091 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Oct 7 17:19:19 2011 88.191.78.144:1091 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Fri Oct 7 17:19:19 2011 88.191.78.144:1091 Local Options hash (VER=V4): '691e95c7'
Fri Oct 7 17:19:19 2011 88.191.78.144:1091 Expected Remote Options hash (VER=V4): '66096c33'
Fri Oct 7 17:19:19 2011 88.191.78.144:1091 CRL CHECK OK: /C=FR/ST=Aquitaine/L=Pessac/O=Office/emailAddress=vpn@ems-editique.fr
Fri Oct 7 17:19:19 2011 88.191.78.144:1091 VERIFY OK: depth=1, /C=FR/ST=Aquitaine/L=Pessac/O=Office/emailAddress=vpn@ems-editique.fr
Fri Oct 7 17:19:19 2011 88.191.78.144:1091 CRL CHECK OK: /C=FR/ST=Aquitaine/L=Pessac/O=Office/OU=Office/CN=dedibox1/emailAddress=vpn@ems-editique.fr
Fri Oct 7 17:19:19 2011 88.191.78.144:1091 VERIFY OK: depth=0, /C=FR/ST=Aquitaine/L=Pessac/O=Office/OU=Office/CN=dedibox1/emailAddress=vpn@ems-editique.fr
Fri Oct 7 17:19:19 2011 88.191.78.144:1091 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Fri Oct 7 17:19:19 2011 88.191.78.144:1091 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Oct 7 17:19:19 2011 88.191.78.144:1091 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Fri Oct 7 17:19:19 2011 88.191.78.144:1091 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Oct 7 17:19:19 2011 88.191.78.144:1091 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Fri Oct 7 17:19:19 2011 88.191.78.144:1091 [dedibox1] Peer Connection Initiated with 88.191.78.144:1091

Tests on client side :
route print

IPv4 Table de routage
===========================================================================
Liste d'Interfaces
0x1 ........................... MS TCP Loopback interface
0x2 ...00 e0 f4 19 e9 d8 ...... Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC
- VirtualBox Bridged Networking Driver Miniport
0x3 ...00 ff 56 18 b1 76 ...... TAP-Win32 Adapter V9
0x4 ...08 00 27 00 e4 52 ...... VirtualBox Host-Only Ethernet Adapter
===========================================================================
===========================================================================
Itinéraires actifs :
Destination réseau Masque réseau Adr. passerelle Adr. interface Métrique
0.0.0.0 0.0.0.0 88.191.78.1 88.191.78.144 1
10.0.0.0 255.255.255.0 10.0.8.5 10.0.8.6 1
10.0.8.0 255.255.255.0 10.0.8.5 10.0.8.6 1
10.0.8.4 255.255.255.252 10.0.8.6 10.0.8.6 30
10.0.8.6 255.255.255.255 127.0.0.1 127.0.0.1 30
10.255.255.255 255.255.255.255 10.0.8.6 10.0.8.6 30
88.191.78.0 255.255.255.0 88.191.78.144 88.191.78.144 20
88.191.78.144 255.255.255.255 127.0.0.1 127.0.0.1 20
88.255.255.255 255.255.255.255 88.191.78.144 88.191.78.144 20
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.56.0 255.255.255.0 192.168.56.1 192.168.56.1 20
192.168.56.1 255.255.255.255 127.0.0.1 127.0.0.1 20
192.168.56.255 255.255.255.255 192.168.56.1 192.168.56.1 20
224.0.0.0 240.0.0.0 10.0.8.6 10.0.8.6 30
224.0.0.0 240.0.0.0 88.191.78.144 88.191.78.144 20
224.0.0.0 240.0.0.0 192.168.56.1 192.168.56.1 20
255.255.255.255 255.255.255.255 10.0.8.6 10.0.8.6 1
255.255.255.255 255.255.255.255 88.191.78.144 88.191.78.144 1
255.255.255.255 255.255.255.255 192.168.56.1 192.168.56.1 1
Passerelle par défaut : 88.191.78.1
===========================================================================
Itinéraires persistants :
Aucun

ping 10.0.0.32
C:\Documents and Settings\Administrateur>ping 10.0.0.32

Envoi d'une requête 'Ping' 10.0.0.32 avec 32 octets de données :

Délai d'attente de la demande dépassé.
Délai d'attente de la demande dépassé.
Délai d'attente de la demande dépassé.
Délai d'attente de la demande dépassé.

Statistiques Ping pour 10.0.0.32:
Paquets : envoyés = 4, reçus = 0, perdus = 4 (perte 100%),

Ping from client to the VPN server :
C:\Documents and Settings\Administrateur>ping 10.0.0.69

Envoi d'une requête 'Ping' 10.0.0.69 avec 32 octets de données :

Réponse de 10.0.0.69 : octets=32 temps=39 ms TTL=64
Réponse de 10.0.0.69 : octets=32 temps=39 ms TTL=64
Réponse de 10.0.0.69 : octets=32 temps=38 ms TTL=64
Réponse de 10.0.0.69 : octets=32 temps=39 ms TTL=64

Statistiques Ping pour 10.0.0.69:
Paquets : envoyés = 4, reçus = 4, perdus = 0 (perte 0%),
Durée approximative des boucles en millisecondes :
Minimum = 38ms, Maximum = 39ms, Moyenne = 38ms

Any idea ?

Thanks

Mimiko

Check and show iptables roules on server.

Singman

# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Mimiko

If 10.0.0.32 exists and on that host 10.0.0.69 is not default gateway, then the 10.0.0.32 does not know where to respond and the echoes to ping does not come back. On the host 10.0.0.32 add a route for 10.0.8.0/24 to 10.0.0.69.

Singman

Well, empy rules, dont know why. I have added a few rules, so it's showing :

# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp dpt:openvpn

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Singman

Thanks, that worked.
The change was not on the OpenVPN server but on the windows server 🙂