I connect but I see the network

kdk-segura

schema
red 1 (company): 199.15.0.0/24, gateway and firewall 199.15.0.254, DNS 199.15.0.1, VPN server 199.15.0.8

red 2(home): 192.168.0.0/24

config server - 199.15.0.8
port 1194
proto udp
dev tun
ca keys/companyvpn/ca.crt
cert keys/companyvpn/company.crt
key keys/companyvpn/company.key
dh keys/companyvpn/dh2048.pem
server 10.7.0.0 255.255.255.0
crl-verify keys/companyvpn/crl.pem
ifconfig-pool-persist servers/CompanyServ/logs/ipp.txt
tls-auth servers/CompanyServ/ta.key 0
cipher AES-256-CBC
user nobody
group nogroup
status servers/CompanyServ/logs/openvpn-status.log
log-append servers/CompanyServ/logs/openvpn.log
verb 3
mute 20
max-clients 3
keepalive 10 120
client-config-dir /etc/openvpn/servers/CompanyServ/ccd
tls-server
comp-lzo
persist-key
persist-tun
ccd-exclusive
script-security 2
push "route 199.15.0.0 255.255.255.0"
push "redirect-gateway"
push "dhcp-option DNS 199.15.0.1"
----------------------------------------------------------
config client 192.168.0.0/24
client
proto udp
dev tun
ca ca.crt
dh dh2048.pem
cert manfred.crt
key manfred.key
remote 201.198.23.56 1194
tls-auth ta.key 1
cipher AES-256-CBC
user nobody
group nogroup
verb 3
mute 20
keepalive 10 120
comp-lzo
persist-key
persist-tun
float
resolv-retry infinite
nobind
----------------------------------------------------------
iptables 199.15.0.254
#!/bin/bash
WAN="eth1"
LAN="eth0"

iptables -F
iptables -X
iptables -Z
iptables -t nat -F
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
#Configuracion VPN
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A FORWARD -o tun+ -j ACCEPT
iptables -A OUTPUT -o tun+ -j ACCEPT
#Fin VPN
/sbin/depmod -a
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_conntrack_ftp
iptables -t nat -A PREROUTING -i $WAN -p udp --dport 1194 -j DNAT --to 199.15.0.8:1194
iptables -A INPUT -i $WAN -m state --state ESTABLISHED,RELATED -j ACCEPT
echo 1 > /proc/sys/net/ipv4/ip_forward
/sbin/iptables -A INPUT -i lo -j ACCEPT
iptables -t nat -A POSTROUTING -s 199.15.0.0/24 -o $WAN -j MASQUERADE
iptables -A FORWARD -s 10.7.0.0/24 -d 199.15.0.0/24 -j ACCEPT
----------------------------------------------------------
error server VPN - Log (action - start server vpn list)
Wed Jan 18 16:43:15 2012 event_wait : Interrupted system call (code=4)
Wed Jan 18 16:43:15 2012 TCP/UDP: Closing socket
Wed Jan 18 16:43:15 2012 /sbin/route del -net 10.7.0.0 netmask 255.255.255.0
SIOCDELRT: Operation not permitted
Wed Jan 18 16:43:15 2012 ERROR: Linux route delete command failed: external program exited with error status: 7
Wed Jan 18 16:43:15 2012 Closing TUN/TAP interface
Wed Jan 18 16:43:15 2012 /sbin/ifconfig tun0 0.0.0.0
SIOCSIFADDR: Permission denied
SIOCSIFFLAGS: Permission denied
Wed Jan 18 16:43:15 2012 Linux ip addr del failed: external program exited with error status: 255
Wed Jan 18 16:43:15 2012 SIGTERM[hard,] received, process exiting
Wed Jan 18 16:43:17 2012 OpenVPN 2.1_rc20 i586-mandriva-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] built on Oct 6 2009
Wed Jan 18 16:43:17 2012 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Wed Jan 18 16:43:17 2012 Diffie-Hellman initialized with 2048 bit key
Wed Jan 18 16:43:17 2012 WARNING: file 'keys/companyvpn/company.key' is group or others accessible
Wed Jan 18 16:43:17 2012 WARNING: file 'servers/CompanyServ/ta.key' is group or others accessible
Wed Jan 18 16:43:17 2012 Control Channel Authentication: using 'servers/CompanyServ/ta.key' as a OpenVPN static key file
Wed Jan 18 16:43:17 2012 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jan 18 16:43:17 2012 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jan 18 16:43:17 2012 TLS-Auth MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Wed Jan 18 16:43:17 2012 ROUTE default_gateway=199.15.0.254
Wed Jan 18 16:43:17 2012 TUN/TAP device tun0 opened
Wed Jan 18 16:43:17 2012 TUN/TAP TX queue length set to 100
Wed Jan 18 16:43:17 2012 /sbin/ifconfig tun0 10.7.0.1 pointopoint 10.7.0.2 mtu 1500
Wed Jan 18 16:43:17 2012 /sbin/route add -net 10.7.0.0 netmask 255.255.255.0 gw 10.7.0.2
Wed Jan 18 16:43:17 2012 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Jan 18 16:43:17 2012 GID set to nogroup
Wed Jan 18 16:43:17 2012 UID set to nobody
Wed Jan 18 16:43:17 2012 Socket Buffers: R=[114688->131072] S=[114688->131072]
Wed Jan 18 16:43:17 2012 UDPv4 link local (bound): [undef]:1194
Wed Jan 18 16:43:17 2012 UDPv4 link remote: [undef]
Wed Jan 18 16:43:17 2012 MULTI: multi_init called, r=256 v=256
Wed Jan 18 16:43:17 2012 IFCONFIG POOL: base=10.7.0.4 size=62
Wed Jan 18 16:43:17 2012 IFCONFIG POOL LIST
Wed Jan 18 16:43:17 2012 manfred,10.7.0.4
Wed Jan 18 16:43:17 2012 Initialization Sequence Completed

----------------------------------------------------------
log conect client - manfred is now connected
Wed Jan 18 16:45:39 2012 MULTI: multi_create_instance called
Wed Jan 18 16:45:39 2012 187.150.53.84:1353 Re-using SSL/TLS context
Wed Jan 18 16:45:39 2012 187.150.53.84:1353 LZO compression initialized
Wed Jan 18 16:45:39 2012 187.150.53.84:1353 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Wed Jan 18 16:45:39 2012 187.150.53.84:1353 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Jan 18 16:45:39 2012 187.150.53.84:1353 Local Options hash (VER=V4): '162b04de'
Wed Jan 18 16:45:39 2012 187.150.53.84:1353 Expected Remote Options hash (VER=V4): '9e7066d2'
Wed Jan 18 16:45:39 2012 187.150.53.84:1353 TLS: Initial packet from 187.150.53.84:1353, sid=8e682302 45b65c14
Wed Jan 18 16:45:40 2012 187.150.53.84:1353 CRL CHECK OK: /C=CR/ST=CR/L=Costa_Rica/O=company/emailAddress=msegura@company.com
Wed Jan 18 16:45:40 2012 187.150.53.84:1353 VERIFY OK: depth=1, /C=CR/ST=CR/L=Costa_Rica/O=company/emailAddress=msegura@company.com
Wed Jan 18 16:45:40 2012187.150.53.84:1353 CRL CHECK OK: /C=CR/ST=CR/L=Costa_Rica/O=company/OU=Office/CN=manfred/emailAddress=msegura@company.com
Wed Jan 18 16:45:40 2012 187.150.53.84:1353 VERIFY OK: depth=0, /C=CR/ST=CR/L=Costa_Rica/O=company/OU=Office/CN=manfred/emailAddress=msegura@company.com
Wed Jan 18 16:45:40 2012 187.150.53.84:1353 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Jan 18 16:45:40 2012 187.150.53.84:1353 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jan 18 16:45:40 2012 187.150.53.84:1353 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Jan 18 16:45:40 2012 187.150.53.84:1353 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jan 18 16:45:40 2012 187.150.53.84:1353 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Jan 18 16:45:40 2012 187.150.53.84:1353 [manfred] Peer Connection Initiated with 187.150.53.84:1353
Wed Jan 18 16:45:40 2012 manfred/187.150.53.84:1353 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/servers/CompanyServ/ccd/manfred
Wed Jan 18 16:45:40 2012 manfred/187.150.53.84:1353 MULTI: Learn: 10.7.0.6 -> manfred/187.150.53.84:1353
Wed Jan 18 16:45:40 2012 manfred/187.150.53.84:1353 MULTI: primary virtual IP for manfred/187.150.53.84:1353: 10.7.0.6
Wed Jan 18 16:45:42 2012 manfred/187.150.53.84:1353 PUSH: Received control message: 'PUSH_REQUEST'
Wed Jan 18 16:45:42 2012 manfred/187.150.53.84:1353 SENT CONTROL [manfred]: 'PUSH_REPLY,route 199.15.0.0 255.255.255.0,redirect-gateway,dhcp-option DNS 199.15.0.1,route 10.7.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.7.0.6 10.7.0.5' (status=1)

The connection is successful, but I can not see the computers on the network 1. I've done several configurations, but none works. Not sure if it is the firewall, since most of examples have the VPN on the same machine as the gateway, but I have it on another machine on the network, and I'm not sure of the configuration of iptables.

maikcat

but I can not see the computers on the network

what EXACTLY do you mean?

can you ping them?

did you setup their firewall accordingly?
what OS your pcs have?

Michael.

kdk-segura

I can not ping computers..... I've used computers with Windows XP or 7, with the same result, connect to VPN but can not see network computers.

As time on the details of the iptables, just attach the basics and that has to do with VPN, but really do not know if that's the configuration I should do.

My VPN server is another machine other than the gateway.

VPN iptables
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A FORWARD -o tun+ -j ACCEPT
iptables -A OUTPUT -o tun+ -j ACCEPT
iptables -t nat -A PREROUTING -i $WAN -p udp --dport 1194 -j DNAT --to 199.15.0.8:1194
iptables -A FORWARD -s 10.7.0.0/24 -d 199.15.0.0/24 -j ACCEPT

also use squid, I have to configure anything there?

maikcat

for start remove this from your server config file:

push "redirect-gateway"

did you enabled ip forwarding on your server?

if you disable iptables can you ping the lan ip of openvpn server?

post the output of netstat -nr no your windows openvpn client.

Michael.

kdk-segura

1)redirect-gateway - removed

2)I have activated forward my firewall
echo 1 > /proc/sys/net/ipv4/ip_forward

3)disable iptables
I made a new iptables rule with only basic permissions, but still does not ping the client to the corporate network.

4)
Microsoft Windows XP [Versión 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

Tabla de rutas
===========================================================================
ILista de interfaces
0x1 ........................... MS TCP Loopback interface
0x2 ...00 19 d1 04 98 c5 ...... Intel(R) PRO/100 VE Network Connection - Minipue
rto del administrador de paquetes
0x3 ...00 ff 4a e8 0a f1 ...... TAP-Win32 Adapter V9 - Minipuerto del administra
dor de paquetes
===========================================================================
===========================================================================
Rutas activas:
Destino de red - Máscara de red - Puerta de acceso - Interfaz - Métrica
0.0.0.0 - 0.0.0.0 - 192.168.0.1 - 192.168.0.2 - 20
10.7.0.1 - 255.255.255.255 - 10.7.0.5 - 10.7.0.6 - 1
10.7.0.4 - 255.255.255.252 - 10.7.0.6 - 10.7.0.6 - 30
10.7.0.6 - 255.255.255.255 - 127.0.0.1 - 127.0.0.1 - 30
10.255.255.255 - 255.255.255.255 - 10.7.0.6 - 10.7.0.6 - 30
127.0.0.0 - 255.0.0.0 - 127.0.0.1 - 127.0.0.1 - 1
192.168.0.0 - 255.255.255.0 - 192.168.0.2 - 192.168.0.2 - 20
192.168.0.2 - 255.255.255.255 - 127.0.0.1 - 127.0.0.1 - 20
192.168.0.255 - 255.255.255.255 - 192.168.0.2 - 192.168.0.2 - 20
199.15.0.0 - 255.255.255.0 - 10.7.0.5 - 10.7.0.6 - 1
224.0.0.0 - 240.0.0.0 - 10.7.0.6 - 10.7.0.6 - 30
224.0.0.0 - 240.0.0.0 - 192.168.0.2 - 192.168.0.2 - 20
255.255.255.255 - 255.255.255.255 - 10.7.0.6 - 10.7.0.6 - 1
255.255.255.255 - 255.255.255.255 - 192.168.0.2 - 192.168.0.2 - 1
Puerta de enlace predeterminada: 192.168.0.1
===========================================================================
Rutas persistentes:
ninguno

kdk-segura

I can indicate that more should I check, or other tests should be done. I have not been rewritten.

Can you help?

kdk-segura

If you still have not answered my request for help, I think it's because they do not know how to solve the problem or not understood well, so if you are not going to follow please indicate support to seek another alternative.

Thank you.

Mimiko

Please read carefully this guide: https://forums.openvpn.net/topic9465.html and follow one appropiate for you method.

kdk-segura

according to the information, I have to rethink the current configuration, so that makes testing scenarios that are mentioned here.

Thank you very much.