Route problems in Windows 7/2008 (SOLVED)

pmw

Hello,

at first, this is my first post here, so hello to all. And second, sorry about my english, I hope you will understand me.

Anyway, here's my problem:

I have Linux-server with OpenVPN-server. There are multiple computers connected to it, mostly Linux- and Windows XP -computers. They all have 10.0.0.x addresses, server has 10.0.0.1.
Everything works, I can ping example from 10.0.0.56 to 10.0.0.60, it works fine.

But now, I've updated some computers from XP to Windows 7, I also have added few Windows 2008 servers.

All these 7's and 2008's have routing problems with openvpn. I'm using openvpn-gui and openvpn as Service. I always can ping default route, 10.0.0.1, but not anything else. I can't see anything else as 10.0.0.1, and no-one can see me. I have exactly the same config as XP/linux computers have. I haven't changed anything, except OS.

So, what I've tried so far in my Windows 7/2008 computers:

- Installed openvpn as administrator, with VistaX -mode etc.
- Running openvpn as administrator
- Tried to disable all firewalls
- Tried to set all vpn ip-addresses by hand
- Added "route-method exe;route-delay 2" and "script-security 2 system" commands to config
- Ran openvpn with multiple differentkind of users
- win-sys env
- Openvpn log doesn't say any errors on route-commands.

Nothing works.

I've googled many many hours to solve this problem. It seems that many users have exactly the same problem. Is there any way to solve this? I've used always latest version of openvpn and openvpn-gui. Nothing works.

Thanks for advice!!

Mimiko

Show the routing table and ipconfig /all on windows7 client. Also post the log of this client.

pmw

ipconfig´:

ipconfig /all

Windows IP-määritykset

        Isäntänimi  . . . . . . . . . . . : Teivolainen
        Ensisijainen DNS-liite  . . . . . :
        Solmutyyppi . . . . . . . . . . . : Hybridi
        IP-reititys käytössä  . . . . . . : Ei
        WINS-välityspalvelin käytössä . . : Ei

Ethernet-sovitin Lähiverkkoyhteys 5:

        Yhteyskohtainen DNS-liite . . . . :
        Kuvaus  . . . . . . . . . . . . . : VirtualBox Host-Only Ethernet Adapte
r
        Fyysinen osoite . . . . . . . . . : 08-00-27-00-18-97
        DHCP käytössä . . . . . . . . . . : Kyllä
        Automaattinen määritys käytössä . : Kyllä
   Autom. määrityksen IPv4-osoite. . : 169.254.93.169(Ensisijainen)
        Aliverkon peite . . . . . . . . . : 255.255.0.0
        Oletusyhdyskäytävä. . . . . . . . :
   NetBIOS TCP/IP:n päällä . . . . . : Käytössä

Ethernet-sovitin OpenVPN:

        Yhteyskohtainen DNS-liite . . . . :
        Kuvaus  . . . . . . . . . . . . . : TAP-Win32 Adapter V9 #2
        Fyysinen osoite . . . . . . . . . : 00-FF-6D-A6-62-A4
        DHCP käytössä . . . . . . . . . . : Kyllä
        Automaattinen määritys käytössä . : Kyllä
   IPv4-osoite . . . . . . . . . . . : 10.0.0.50(Ensisijainen)
        Aliverkon peite . . . . . . . . . : 255.255.255.0
        Käyttölupa myönnetty  . . . . . . : 9. joulukuuta 2011 16:45:12
        Käyttölupa vanhenee . . . . . . : 8. joulukuuta 2012 16:45:12
        Oletusyhdyskäytävä. . . . . . . . :
        DHCP-palvelin . . . . . . . . . . : 10.0.0.0
   NetBIOS TCP/IP:n päällä . . . . . : Käytössä

Ethernet-sovitin Lähiverkkoyhteys 3:

        Laitteen tila . . . . . . . . . . : Ei kytketty
        Yhteyskohtainen DNS-liite . . . . :
        Kuvaus  . . . . . . . . . . . . . : TAP-Win32 Adapter V9
        Fyysinen osoite . . . . . . . . . : 00-FF-FC-2B-0D-97
        DHCP käytössä . . . . . . . . . . : Kyllä
        Automaattinen määritys käytössä . : Kyllä

Ethernet-sovitin Lähiverkkoyhteys 2:

        Laitteen tila . . . . . . . . . . : Ei kytketty
        Yhteyskohtainen DNS-liite . . . . :
        Kuvaus  . . . . . . . . . . . . . : Marvell Yukon 88E8056 PCI-E Gigabit
Ethernet Controller #2
        Fyysinen osoite . . . . . . . . . : 20-CF-30-1F-E2-A5
        DHCP käytössä . . . . . . . . . . : Kyllä
        Automaattinen määritys käytössä . : Kyllä

Ethernet-sovitin Lähiverkkoyhteys:

        Yhteyskohtainen DNS-liite . . . . :
        Kuvaus  . . . . . . . . . . . . . : Marvell Yukon 88E8056 PCI-E Gigabit
Ethernet Controller
        Fyysinen osoite . . . . . . . . . : 20-CF-30-1F-E2-A6
        DHCP käytössä . . . . . . . . . . : Kyllä
        Automaattinen määritys käytössä . : Kyllä
   IPv4-osoite . . . . . . . . . . . : 192.168.1.33(Ensisijainen)
        Aliverkon peite . . . . . . . . . : 255.255.255.0
        Käyttölupa myönnetty  . . . . . . : 9. joulukuuta 2011 16:45:05
        Käyttölupa vanhenee . . . . . . : 12. joulukuuta 2011 16:45:04
        Oletusyhdyskäytävä. . . . . . . . : 192.168.1.1
        DHCP-palvelin . . . . . . . . . . : 192.168.1.1
        DNS-palvelimet  . . . . . . . . . : 192.168.1.1
   NetBIOS TCP/IP:n päällä . . . . . : Käytössä

Address 192.168.1.33 is my LAN-address.
Address 10.0.0.50 is my VPN-address.

IPv4 -reititystaulukko
===========================================================================
Active Routes:
Verkkokohde        Verkon peite          Yhdyskäytävä     Liittymä  Metric-arvo
          0.0.0.0          0.0.0.0      192.168.1.1     192.168.1.33     20
         10.0.0.0    255.255.255.0   Linkin määrittämä         10.0.0.50    286
         10.0.0.0    255.255.255.0         10.0.0.1        10.0.0.50     31
        10.0.0.50  255.255.255.255   Linkin määrittämä         10.0.0.50    286
       10.0.0.255  255.255.255.255   Linkin määrittämä         10.0.0.50    286
        127.0.0.0        255.0.0.0   Linkin määrittämä         127.0.0.1    306
        127.0.0.1  255.255.255.255   Linkin määrittämä         127.0.0.1    306
  127.255.255.255  255.255.255.255   Linkin määrittämä         127.0.0.1    306
      169.254.0.0      255.255.0.0   Linkin määrittämä    169.254.93.169    276
   169.254.93.169  255.255.255.255   Linkin määrittämä    169.254.93.169    276
  169.254.255.255  255.255.255.255   Linkin määrittämä    169.254.93.169    276
      192.168.1.0    255.255.255.0   Linkin määrittämä      192.168.1.33    276
     192.168.1.33  255.255.255.255   Linkin määrittämä      192.168.1.33    276
    192.168.1.255  255.255.255.255   Linkin määrittämä      192.168.1.33    276
        224.0.0.0        240.0.0.0   Linkin määrittämä         127.0.0.1    306
        224.0.0.0        240.0.0.0   Linkin määrittämä    169.254.93.169    276
        224.0.0.0        240.0.0.0   Linkin määrittämä         10.0.0.50    286
        224.0.0.0        240.0.0.0   Linkin määrittämä      192.168.1.33    276
  255.255.255.255  255.255.255.255   Linkin määrittämä         127.0.0.1    306
  255.255.255.255  255.255.255.255   Linkin määrittämä    169.254.93.169    276
  255.255.255.255  255.255.255.255   Linkin määrittämä         10.0.0.50    286
  255.255.255.255  255.255.255.255   Linkin määrittämä      192.168.1.33    276
===========================================================================
Jatkuvat reitit:
  Ei mitään

Fri Dec 09 17:22:37 2011 OpenVPN 2.2.1 Win32-MSVC++ [SSL] [LZO2] built on Jul  1 2011
Fri Dec 09 17:22:37 2011 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Fri Dec 09 17:22:37 2011 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Fri Dec 09 17:22:37 2011 NOTE: --script-security method='system' is deprecated due to the fact that passed parameters will be subject to shell expansion
Fri Dec 09 17:22:38 2011 LZO compression initialized
Fri Dec 09 17:22:38 2011 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Dec 09 17:22:38 2011 Socket Buffers: R=[8192->8192] S=[8192->8192]
Fri Dec 09 17:22:38 2011 Data Channel MTU parms [ L:1574 D:1400 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Fri Dec 09 17:22:38 2011 Local Options hash (VER=V4): 'd79ca330'
Fri Dec 09 17:22:38 2011 Expected Remote Options hash (VER=V4): 'f7df56b8'
Fri Dec 09 17:22:38 2011 UDPv4 link local: [undef]
Fri Dec 09 17:22:38 2011 UDPv4 link remote: *censored*:1194
Fri Dec 09 17:22:38 2011 TLS: Initial packet from *censored*:1194, sid=df15ea5c b399dbf1
Fri Dec 09 17:22:38 2011 VERIFY OK: depth=1, *censored*
Fri Dec 09 17:22:38 2011 VERIFY OK: depth=0, *censored*
Fri Dec 09 17:22:38 2011 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Dec 09 17:22:38 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Dec 09 17:22:38 2011 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Dec 09 17:22:38 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Dec 09 17:22:38 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Fri Dec 09 17:22:38 2011 [tulppaani] Peer Connection Initiated with *censored*:1194
Fri Dec 09 17:22:41 2011 SENT CONTROL [tulppaani]: 'PUSH_REQUEST' (status=1)
Fri Dec 09 17:22:41 2011 PUSH: Received control message: 'PUSH_REPLY,route 10.0.0.0 255.255.255.0 10.0.0.1,route-gateway 10.0.0.1,ping 10,ping-restart 120,ifconfig 10.0.0.50 255.255.255.0'
Fri Dec 09 17:22:41 2011 OPTIONS IMPORT: timers and/or timeouts modified
Fri Dec 09 17:22:41 2011 OPTIONS IMPORT: --ifconfig/up options modified
Fri Dec 09 17:22:41 2011 OPTIONS IMPORT: route options modified
Fri Dec 09 17:22:41 2011 OPTIONS IMPORT: route-related options modified
Fri Dec 09 17:22:41 2011 ROUTE default_gateway=192.168.1.1
Fri Dec 09 17:22:41 2011 TAP-WIN32 device [OpenVPN] opened: \\.\Global\{6DA662A4-278B-44EC-BE6E-FC43A41CD7A2}.tap
Fri Dec 09 17:22:41 2011 TAP-Win32 Driver Version 9.8 
Fri Dec 09 17:22:41 2011 TAP-Win32 MTU=1500
Fri Dec 09 17:22:41 2011 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.0.0.50/255.255.255.0 on interface {6DA662A4-278B-44EC-BE6E-FC43A41CD7A2} [DHCP-serv: 10.0.0.0, lease-time: 31536000]
Fri Dec 09 17:22:41 2011 Successful ARP Flush on interface [16] {6DA662A4-278B-44EC-BE6E-FC43A41CD7A2}
Fri Dec 09 17:22:41 2011 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Fri Dec 09 17:22:41 2011 C:\WINDOWS\system32\route.exe ADD 10.0.0.0 MASK 255.255.255.0 10.0.0.1
 OK!
Fri Dec 09 17:22:41 2011 Initialization Sequence Completed
Fri Dec 09 17:22:40 2011 Start net commands...
Fri Dec 09 17:22:40 2011 C:\WINDOWS\system32\net.exe stop dnscache
DNS-asiakas -palvelu pys„ytet„„n..
DNS-asiakas -palvelua ei voitu pys„ytt„„.
Fri Dec 09 17:22:45 2011 C:\WINDOWS\system32\net.exe start dnscache
Pyydetty palvelu on jo k„ynnistetty.
Lis„„ Ohjeita saat kirjoittamalla NET HELPMSG 2182.
Fri Dec 09 17:22:45 2011 ERROR: Windows ipconfig command failed: returned error code 2
Fri Dec 09 17:22:45 2011 C:\WINDOWS\system32\ipconfig.exe /flushdns
Windows IP-m„„ritykset
DNS-tulkintatoiminnon v„limuistin tyhjent„minen onnistui.
Fri Dec 09 17:22:45 2011 C:\WINDOWS\system32\ipconfig.exe /registerdns
Windows IP-m„„ritykset
Tietokoneen kaikkien sovittimien DNS-resurssitietueiden rekister”inti on aloitettu. Kaikki virheet kirjataan tapahtumalokiin 15 minuutin kuluttua.
Fri Dec 09 17:22:48 2011 End net commands...

Sorry about Finnish texts on commands. If you don't understand something, I'll translate.

Mimiko

Please show a trace to some client on Windows Xp from Win7.

janjust

make sure the tap-win32 adapter is not set to 'public' - if it is, then pings to hosts other than the remote endpoint will fail.

pmw

I couldn't change type of network (public,work,home) first, but I saw that my adapter had no default gateway (10.0.0.1). I inserted it manually, now I can choose type of network. But whatever I choose, it doesnt help. Also control panel says that adapter has no internet-connection, wrong or right?

Tracert from Windows 7 machine to default gateway(linux server, which works fine)

C:\Users\Petteri>tracert 10.0.0.1

seurataan reitti isäntään TULPPAANI [10.0.0.1]
enintään 30 siirräntävälillä:

  1    25 ms    25 ms    24 ms  TULPPAANI [10.0.0.1]

Seuranta suoritettu.

C:\Users\Petteri>ping 10.0.0.1

From Windows 7 machine to linux client.

C:\Users\Petteri>tracert 10.0.0.56

Seurataan reitti isäntään 10.0.0.56 enintään 30 siirräntävälillä

  1  Teivolainen [10.0.0.50]  raportoi: Kohdeisäntään ei saada yhteyttä.

Seuranta suoritettu.

Upper says "cannot to connect".

From another client to Windows 7.

cct:~# traceroute 10.0.0.50
traceroute to 10.0.0.50 (10.0.0.50), 30 hops max, 40 byte packets
 1  10.0.0.1 (10.0.0.1)  1.130 ms  1.102 ms  1.070 ms
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * * *

Not XP but that works fine with other VPN-machines.

And also server's client specific config look like this:

ifconfig-push 10.0.0.50 255.255.255.0

I also tried to add line: route 10.0.0.1 255.255.255.0 10.0.0.0, but it didn't help at all.

Mimiko

Show openvpn servers config files, log and the routing table.

pmw

Server config:

tun-mtu 1500
mssfix 1400
verb 5
float
daemon
proto udp
dev tap
port 1194
writepid /var/run/openvpn/openvpn.pid
mode server
tls-server
keepalive 10 120
ca keys/ca.crt
cert keys/tulppaani.crt
key keys/tulppaani.key  # This file is secret
dh keys/dh1024.pem
server 10.0.0.0 255.255.255.0
route 10.0.0.1 255.255.255.0
ifconfig-pool-persist ipp.txt
user nobody
group nogroup
mute-replay-warnings
log /var/log/openvpn/kk4.log
comp-lzo
push "route 10.0.0.0 255.255.255.0 10.0.0.1"
#push "dhcp-option DNS 10.0.0.1"
client-config-dir ccd
persist-key
persist-tun

Windows 7 server-side client-configuration:

ifconfig-push 10.0.0.50 255.255.255.0

Server log:

Mon Dec 19 01:02:32 2011 91.155.235.236:11656 Re-using SSL/TLS context
Mon Dec 19 01:02:32 2011 91.155.235.236:11656 LZO compression initialized
Mon Dec 19 01:02:33 2011 91.155.235.236:11656 [petteri-tyoasema] Peer Connection Initiated with [AF_INET]91.155.235.236:11656

Route:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.100.0   *               255.255.255.0   U     0      0        0 eth2
10.0.0.0        *               255.255.255.0   U     0      0        0 tap1
default         192.168.100.1   0.0.0.0         UG    0      0        0 eth2

janjust

where did 'tap1' come from:

10.0.0.0 * 255.255.255.0 U 0 0 0 tap1

if this is your first and only openvpn instance then the device would be 'tap0' (from reading your server config). What does

ifconfig -a

show?

pmw

Hi,

there was two VPN-networks some months ago. Other network is disabled todays.
tap1 is just like tap0, only different map name. Firewall has rules for it. This tap1-network works normally with linux and XP- computers.

I've heard that openvpn had awhile ago much problems with new Windows's home/work/public -networksettings. Could it really be that?

Server-side ifconfig:

eth2      Link encap:Ethernet  HWaddr 00:50:da:80:1d:7e
          inet addr:192.168.100.10  Bcast:192.168.100.255  Mask:255.255.255.0
          inet6 addr: fe80::250:daff:fe80:1d7e/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:350088880 errors:0 dropped:0 overruns:17939 frame:0
          TX packets:497004441 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:3500981490 (3.2 GiB)  TX bytes:3704858030 (3.4 GiB)
          Interrupt:23 Base address:0x800

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:6879539 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6879539 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:583676097 (556.6 MiB)  TX bytes:583676097 (556.6 MiB)

tap1      Link encap:Ethernet  HWaddr 36:77:75:64:36:48
          inet addr:10.0.0.1  Bcast:10.0.0.255  Mask:255.255.255.0
          inet6 addr: fe80::3477:75ff:fe64:3648/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:18015735 errors:0 dropped:0 overruns:0 frame:0
          TX packets:14250324 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:4001066012 (3.7 GiB)  TX bytes:1734690303 (1.6 GiB)

janjust

Everything looks OK, including the windows connection log.

I've heard that openvpn had awhile ago much problems with new Windows's home/work/public -networksettings. Could it really be that?

might be - the tap-win32 adapter needs to be part of either a home or work network for this to properly work .

Mimiko

In your server's config you have "server 10.0.0.0 255.255.255.0" which by defaul uses net30 network, while for the client you push "ifconfig-push 10.0.0.50 255.255.255.0" a subnet network. Remove the client specific configuration.
Also in the linux check the ip forwarding. It must be enabled.

janjust

@Mimiko:

In your server's config you have "server 10.0.0.0 255.255.255.0" which by defaul uses net30 network, while for the client you push "ifconfig-push 10.0.0.50 255.255.255.0" a subnet network. Remove the client specific configuration.

this is a 'tap' style network , which uses /24 networking by default.
also , it works for a WinXP client and not for a Win7 client, so it is most likely a Win7 specific issue.

Mimiko

From server config:

route 10.0.0.1 255.255.255.0
push "route 10.0.0.0 255.255.255.0 10.0.0.1"

Remove this two lines. Sometimes it get the client confusing.

pmw

Mimiko wroteFrom server config:
route 10.0.0.1 255.255.255.0
push "route 10.0.0.0 255.255.255.0 10.0.0.1"
Remove this two lines. Sometimes it get the client confusing.

Didn't help.

And yes, every other OS's than Win7/2008 are working in VPN-network.

I couldn't find any information of this win7 public/work/home-stuff, is there more info about that?
And I can get default route from server to my Win7 -machine, but still Tap9-device is "unknown type". When I set default route manually, I can set Tap9 to Work-status.

Mimiko

In the server.conf try to add "client-to-client".

pmw

Mimiko wroteIn the server.conf try to add "client-to-client".

Hi. Didn't work, thanks anyway.

I'm not pro here, but it just sounds that problem is not related to server.
If all other clients(linux,xp,98,bsd,etc) works but Windows 7/2008 doesn't, it really sounds that there's something wrong in Win7.

pmw

Hey..

Still back in old topic.

I tried to remake my VPN-network. I created whole new certs, debians, everything. I think I've missed something, because now connection even between linux-clients doesn't work(!).

I think it could be in my netfilter-roles. I just can't figure out what I've missed. But I'm pretty sure something is wrong with my server-setup, not with the clients.

openvpn.conf

proto udp
mode server
tls-server
mute-replay-warnings
log /var/log/openvpn/kk4.log
float
port 58000
dev tap
ca keys/ca.crt
cert keys/server.crt
key keys/server.key
writepid /var/run/openvpn/openvpn.pid
dh keys/dh1024.pem
server 10.0.1.0 255.255.255.0
route 10.0.1.1 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
verb 3

This server-computer has 1 public ip (eth0) and it is making LAN-network with DHCP in eth1. t ap0 is VPN-network with 10.0.1.x pool.

ifconfig

eth0      Link encap:Ethernet  HWaddr 00:1d:92:6a:68:9a
          inet addr:*deleted*  Bcast:*deleted*  Mask:255.255.192.0
          inet6 addr: fe80::21d:92ff:fe6a:689a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:44925083 errors:2 dropped:0 overruns:0 frame:2
          TX packets:36244260 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:1169869869 (1.0 GiB)  TX bytes:1766505299 (1.6 GiB)

eth1      Link encap:Ethernet  HWaddr 00:00:1c:d7:ee:4d
          inet addr:192.168.100.1  Bcast:192.168.100.255  Mask:255.255.255.0
          inet6 addr: fe80::200:1cff:fed7:ee4d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:40617799 errors:0 dropped:0 overruns:0 frame:0
          TX packets:48840517 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2115895710 (1.9 GiB)  TX bytes:1465379246 (1.3 GiB)
          Interrupt:16 Base address:0xec00

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:2313 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2313 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:110790 (108.1 KiB)  TX bytes:110790 (108.1 KiB)

tap0      Link encap:Ethernet  HWaddr 86:23:64:30:4e:4b
          inet addr:10.0.1.1  Bcast:10.0.1.255  Mask:255.255.255.0
          inet6 addr: fe80::8423:64ff:fe30:4e4b/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2876 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:712621 (695.9 KiB)  TX bytes:930 (930.0 B)

route:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.100.0   *               255.255.255.0   U     0      0        0 eth1
10.0.1.0        *               255.255.255.0   U     0      0        0 tap0
*public-ip*   *               255.255.192.0   U     0      0        0 eth0
default         host*public* 0.0.0.0         UG    0      0        0 eth0

iptables:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request limit: avg 1/min burst 5
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request limit: avg 30/sec burst 30
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:auth
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssmtp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:submission
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imap2
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imaps
REJECT     tcp  --  anywhere             anywhere            multiport dports netbios-ns,netbios-dgm,netbios-ssn reject-with icmp-port-unreachable
REJECT     udp  --  anywhere             anywhere            multiport dports netbios-ns,netbios-dgm,netbios-ssn reject-with icmp-port-unreachable
REJECT     udp  --  62.2.0.0/16          anywhere            udp dpt:domain reject-with icmp-port-unreachable
REJECT     udp  --  81-228-0-0.link.se.telia.net/16  anywhere            udp dpt:domain reject-with icmp-port-unreachable
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere            udp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:nameserver
DROP       tcp  --  148.235.0.0/16       anywhere            tcp dpt:domain
DROP       udp  --  148.235.0.0/16       anywhere            udp dpt:domain
DROP       tcp  --  200.33.146.0/24      anywhere            tcp dpt:domain
DROP       udp  --  200.33.146.0/24      anywhere            udp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere            multiport dports 15000:15050
ACCEPT     udp  --  anywhere             anywhere            multiport dports 15000:15050
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:89
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https
ACCEPT     udp  --  anywhere             anywhere            udp dpt:openvpn
ACCEPT     udp  --  anywhere             anywhere            udp dpt:58000
droplog    all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination
REJECT     tcp  --  anywhere             anywhere            tcp dpts:bootps:bootpc reject-with icmp-port-unreachable
REJECT     udp  --  anywhere             anywhere            udp dpts:bootps:bootpc reject-with icmp-port-unreachable
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            multiport dports netbios-ns,netbios-dgm,netbios-ssn
ACCEPT     udp  --  anywhere             anywhere            multiport dports netbios-ns,netbios-dgm,netbios-ssn
ACCEPT     tcp  --  anywhere             192.168.100.10      tcp dpt:ssh
ACCEPT     tcp  --  192.168.100.10       anywhere            tcp spt:ssh
ACCEPT     tcp  --  anywhere             192.168.100.10      tcp dpt:www
ACCEPT     tcp  --  192.168.100.10       anywhere            tcp spt:www
ACCEPT     tcp  --  anywhere             192.168.100.10      tcp dpt:smtp
ACCEPT     tcp  --  192.168.100.10       anywhere            tcp spt:smtp
ACCEPT     tcp  --  anywhere             192.168.100.10      tcp dpt:auth
ACCEPT     tcp  --  192.168.100.10       anywhere            tcp spt:auth
ACCEPT     tcp  --  anywhere             192.168.100.10      tcp dpt:imap2
ACCEPT     tcp  --  192.168.100.10       anywhere            tcp spt:imap2
ACCEPT     tcp  --  anywhere             192.168.100.10      tcp dpt:imaps
ACCEPT     tcp  --  192.168.100.10       anywhere            tcp spt:imaps
ACCEPT     udp  --  anywhere             192.168.100.10      udp dpt:openvpn
ACCEPT     udp  --  192.168.100.10       anywhere            udp spt:openvpn
ACCEPT     udp  --  anywhere             192.168.100.10      udp dpt:1195
ACCEPT     udp  --  192.168.100.10       anywhere            udp spt:1195
ACCEPT     tcp  --  anywhere             192.168.100.20      tcp dpt:3980
ACCEPT     tcp  --  192.168.100.20       anywhere            tcp spt:3980
ACCEPT     udp  --  anywhere             192.168.100.20      udp dpt:3980
ACCEPT     udp  --  192.168.100.20       anywhere            udp spt:3980
ACCEPT     tcp  --  anywhere             192.168.100.20      tcp dpt:3981
ACCEPT     tcp  --  192.168.100.20       anywhere            tcp spt:3981
ACCEPT     udp  --  anywhere             192.168.100.20      udp dpt:3981
ACCEPT     udp  --  192.168.100.20       anywhere            udp spt:3981
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  *publicip* anywhere
ACCEPT     all  --  192.168.100.1        anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain droplog (1 references)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere            limit: avg 3/hour burst 5 LOG level info
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable

Chain fail2ban-ssh (0 references)
target     prot opt source               destination


Chain PREROUTING (policy ACCEPT 811K packets, 66M bytes)
 pkts bytes target     prot opt in     out     source               destination
  885 54468 DNAT       tcp  --  eth0   any     anywhere             anywhere            tcp dpt:ssh to:192.168.100.10:22
 2644  143K DNAT       tcp  --  eth0   any     anywhere             anywhere            tcp dpt:www to:192.168.100.10:80
   19  1056 DNAT       tcp  --  eth0   any     anywhere             anywhere            tcp dpt:smtp to:192.168.100.10:25
  274 14444 DNAT       tcp  --  eth0   any     anywhere             anywhere            tcp dpt:auth to:192.168.100.10:113
    0     0 DNAT       tcp  --  eth0   any     anywhere             anywhere            tcp dpt:imap2 to:192.168.100.10:143
 4367  227K DNAT       tcp  --  eth0   any     anywhere             anywhere            tcp dpt:imaps to:192.168.100.10:993
   39  1755 DNAT       udp  --  eth0   any     anywhere             anywhere            udp dpt:openvpn to:192.168.100.10:1194
15960  670K DNAT       udp  --  eth0   any     anywhere             anywhere            udp dpt:1195 to:192.168.100.10:1195
    4   208 DNAT       tcp  --  eth0   any     anywhere             anywhere            tcp dpt:3980 to:192.168.100.20:3980
    3    93 DNAT       udp  --  eth0   any     anywhere             anywhere            udp dpt:3980 to:192.168.100.20:3980
    1    52 DNAT       tcp  --  eth0   any     anywhere             anywhere            tcp dpt:3981 to:192.168.100.20:3981
    2    62 DNAT       udp  --  eth0   any     anywhere             anywhere            udp dpt:3981 to:192.168.100.20:3981

Chain POSTROUTING (policy ACCEPT 25472 packets, 1365K bytes)
 pkts bytes target     prot opt in     out     source               destination
 587K   45M MASQUERADE  all  --  any    eth0    192.168.100.0/24     anywhere
    0     0 MASQUERADE  all  --  any    eth1    10.10.0.0/24         anywhere

Chain OUTPUT (policy ACCEPT 1274 packets, 253K bytes)
 pkts bytes target     prot opt in     out     source               destination

I can ping from clients to server, but not from client to client. Not with any client.

Note: there are two VPN-networks here. This new one is in port 58000, not 1194.

pmw

OK I got it. I forgot to add "push-route" command.

Anyway, still I'm not able to communicate with Windows 7/2008 computers. Same thing even I made whole network again.

Does anyone have any clue for this? I can't use openvpn anymore if I can't solve this.

EDIT:

I downloaded newest version of openvpn, nothing changed!!

TheSilentTechie

As information only:
I send PWM a Private Message with a novel about different experience from me, not only VPN experiences. PM in the view that I will not overload this topic and will not discuss this. I thinking PWM will post the result so far the PM was usefully.
But I must post this information, because I thinking he don’t see or became the PM. (This PM is in my outbox!?!? Don’t read or don’t delivered in the last 30h. Sorry, I have no info how it’s work. Perhaps he became only a notification on this topic and not on a PM.)
@PMW: Have you this PM? You are normally answer faster than 30h.