[SOLVED] OPENVPN Works from States, not Europe

apacheguy

Hello all,

I had OPENVPN configured and TESTED on a dd-wrt router in California. I am now living in Spain. I have not changed any configuration, but I now realize that I cannot route traffic through the VPN. The connection is successful as seen below:

Wed Jan 25 06:35:23 2012 OpenVPN 2.2.1 Win32-MSVC++ [SSL] [LZO2] built on Jul  1 2011
Wed Jan 25 06:35:23 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Jan 25 06:35:24 2012 UDPv4 link local: [undef]
Wed Jan 25 06:35:24 2012 UDPv4 link remote: xyx:1195
Wed Jan 25 06:35:38 2012 [server] Peer Connection Initiated with xyx:1195
Wed Jan 25 06:35:40 2012 TAP-WIN32 device [Local Area Connection 4] opened: \\.\Global\{xyx}.tap
Wed Jan 25 06:35:40 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.66.2/255.255.255.0 on interface  [DHCP-serv: 192.168.66.0, lease-time: 31536000]
Wed Jan 25 06:35:40 2012 Successful ARP Flush on interface [18] 
Wed Jan 25 06:36:10 2012 WARNING: potential route subnet conflict between local LAN [192.168.1.0/255.255.255.0] and remote VPN [192.168.1.0/255.255.255.0]
Wed Jan 25 06:36:10 2012 Initialization Sequence Completed

Upon successful connection, I open my browser and it hangs... Then I try to navigate to 192.168.1.1 and I hit the local router in Spain, not the remote router in California. What is going on?

Thanks in advance.

maikcat

WARNING: potential route subnet conflict between local LAN [192.168.1.0/255.255.255.0] and remote VPN [192.168.1.0/255.255.255.0]

without configs, networking info about your setup (client/server)
it is impossible to tell what is wrong...

Michael.

apacheguy

Thanks Michael. Below you can find the client config. The remote config is not accessible to me. However, I don't think this is a config issue since I had previously tested it in California on other remote networks and the VPN connected successfully.

Is there anything that could be blocking VPN traffic from the client side? The router is a netgear CG3100D and as far as I can tell there isn't anything particularly unusual about the firewall.

remote mydomain.com 1195
client
remote-cert-tls server
dev tap
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
float
route-delay 30
ca ca.crt
cert client1.crt
key client1.key
redirect-gateway def1

Additionally, I was seeing the same WARNING message before, but it did not affect connectivity.

maikcat

what ip address range are you using?
if 192.168.1.0 try changing it...

Michael.

janjust

WARNING: potential route subnet conflict between local LAN [192.168.1.0/255.255.255.0] and remote VPN [192.168.1.0/255.255.255.0]

means you've configured your VPN to use 192.16.1.0/24, which is a very commonly used subnet; change the VPN server IP range to a different one (e.g. 192.168.222.0/24) and try again. The reason you did not see this in the US is luck: any site/internet cafe can use any private subnet they like, and 192.168.1.0 is a VERY commonly used on.

apacheguy

@janjust. I agree that is exactly what the message is trying to say. The problem is that I saw the same warning message in the US. Anyway, it is merely a warning message and does not prevent the VPN from working. I am convinced it is not causing the problem.

On another note, I decided to test another VPN solution. I looked at usaip.eu and downloaded their OPENVPN config files. I connected to the server in California using a trial account, and as suspected it connected successfully. However, I am seeing the exact same problem. I cannot browse the internet... it just hangs. Below you will find the connection log from my client for their VPN.

Thu Feb 02 05:56:02 2012 OpenVPN 2.2.1 Win32-MSVC++ [SSL] [LZO2] built on Jul  1 2011
Thu Feb 02 05:56:06 2012 WARNING: --ping should normally be used with --ping-restart or --ping-exit
Thu Feb 02 05:56:06 2012 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu Feb 02 05:56:06 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Feb 02 05:56:06 2012 Control Channel MTU parms [ L:1575 D:140 EF:40 EB:0 ET:0 EL:0 ]
Thu Feb 02 05:56:06 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Feb 02 05:56:06 2012 Data Channel MTU parms [ L:1575 D:1450 EF:43 EB:4 ET:32 EL:0 ]
Thu Feb 02 05:56:06 2012 Local Options hash (VER=V4): '10f35004'
Thu Feb 02 05:56:06 2012 Expected Remote Options hash (VER=V4): 'a917298a'
Thu Feb 02 05:56:06 2012 Attempting to establish TCP connection with 184.22.232.195:993
Thu Feb 02 05:56:10 2012 TCP connection established with 184.22.232.195:993
Thu Feb 02 05:56:10 2012 TCPv4_CLIENT link local: [undef]
Thu Feb 02 05:56:10 2012 TCPv4_CLIENT link remote: 184.22.232.195:993
Thu Feb 02 05:56:10 2012 TLS: Initial packet from 184.22.232.195:993, sid=4a9ba36b db253bd6
Thu Feb 02 05:56:10 2012 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Feb 02 05:56:11 2012 VERIFY OK: depth=1, /C=US/ST=NA/L=USAIP/O=USAIP/emailAddress=info@usaip.eu
Thu Feb 02 05:56:11 2012 VERIFY OK: depth=0, /C=US/ST=NA/O=USAIP/OU=usaip/CN=usaip/emailAddress=info@usaip.eu
Thu Feb 02 05:56:12 2012 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 02 05:56:12 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 02 05:56:12 2012 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 02 05:56:12 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 02 05:56:12 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Feb 02 05:56:12 2012 [usaip] Peer Connection Initiated with 184.22.232.195:993
Thu Feb 02 05:56:14 2012 SENT CONTROL [usaip]: 'PUSH_REQUEST' (status=1)
Thu Feb 02 05:56:19 2012 SENT CONTROL [usaip]: 'PUSH_REQUEST' (status=1)
Thu Feb 02 05:56:24 2012 SENT CONTROL [usaip]: 'PUSH_REQUEST' (status=1)
Thu Feb 02 05:56:24 2012 PUSH: Received control message: 'PUSH_REPLY,ping 20,ping-restart 60,route-gateway 172.31.255.254,ifconfig 172.31.156.107 255.255.0.0'
Thu Feb 02 05:56:24 2012 OPTIONS IMPORT: timers and/or timeouts modified
Thu Feb 02 05:56:24 2012 OPTIONS IMPORT: --ifconfig/up options modified
Thu Feb 02 05:56:24 2012 OPTIONS IMPORT: route-related options modified
Thu Feb 02 05:56:24 2012 ROUTE default_gateway=192.168.1.1
Thu Feb 02 05:56:24 2012 TAP-WIN32 device [Local Area Connection 4] opened: \\.\Global\{A6818917-76E8-4D8D-AA2E-95E9B86EBCFD}.tap
Thu Feb 02 05:56:24 2012 TAP-Win32 Driver Version 9.8 
Thu Feb 02 05:56:24 2012 TAP-Win32 MTU=1500
Thu Feb 02 05:56:24 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 172.31.156.107/255.255.0.0 on interface {A6818917-76E8-4D8D-AA2E-95E9B86EBCFD} [DHCP-serv: 172.31.0.0, lease-time: 31536000]
Thu Feb 02 05:56:24 2012 Successful ARP Flush on interface [18] {A6818917-76E8-4D8D-AA2E-95E9B86EBCFD}
Thu Feb 02 05:56:44 2012 TEST ROUTES: 32/32 succeeded len=32 ret=1 a=0 u/d=up
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 184.22.232.0 MASK 255.255.255.128 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 184.22.232.128 MASK 255.255.255.192 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 184.22.232.192 MASK 255.255.255.254 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 184.22.232.194 MASK 255.255.255.255 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 184.22.0.0 MASK 255.255.128.0 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 184.22.128.0 MASK 255.255.192.0 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 184.22.192.0 MASK 255.255.224.0 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 184.22.224.0 MASK 255.255.248.0 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 184.0.0.0 MASK 255.240.0.0 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 184.16.0.0 MASK 255.252.0.0 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 184.20.0.0 MASK 255.254.0.0 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 224.0.0.0 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 160.0.0.0 MASK 240.0.0.0 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 176.0.0.0 MASK 248.0.0.0 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 184.22.232.196 MASK 255.255.255.252 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 184.22.232.200 MASK 255.255.255.248 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 184.22.232.208 MASK 255.255.255.240 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 184.22.232.224 MASK 255.255.255.224 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 184.22.233.0 MASK 255.255.255.0 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 184.22.234.0 MASK 255.255.254.0 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 184.22.236.0 MASK 255.255.252.0 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 184.22.240.0 MASK 255.255.240.0 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:44 2012 C:\WINDOWS\system32\route.exe ADD 184.23.0.0 MASK 255.255.0.0 172.31.255.254
Thu Feb 02 05:56:44 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:44 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:45 2012 C:\WINDOWS\system32\route.exe ADD 184.24.0.0 MASK 255.248.0.0 172.31.255.254
Thu Feb 02 05:56:45 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:45 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:45 2012 C:\WINDOWS\system32\route.exe ADD 184.32.0.0 MASK 255.224.0.0 172.31.255.254
Thu Feb 02 05:56:45 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:45 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:45 2012 C:\WINDOWS\system32\route.exe ADD 184.64.0.0 MASK 255.192.0.0 172.31.255.254
Thu Feb 02 05:56:45 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:45 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:45 2012 C:\WINDOWS\system32\route.exe ADD 184.128.0.0 MASK 255.128.0.0 172.31.255.254
Thu Feb 02 05:56:45 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:45 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:45 2012 C:\WINDOWS\system32\route.exe ADD 185.0.0.0 MASK 255.0.0.0 172.31.255.254
Thu Feb 02 05:56:45 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:45 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:45 2012 C:\WINDOWS\system32\route.exe ADD 186.0.0.0 MASK 254.0.0.0 172.31.255.254
Thu Feb 02 05:56:45 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:45 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:45 2012 C:\WINDOWS\system32\route.exe ADD 188.0.0.0 MASK 252.0.0.0 172.31.255.254
Thu Feb 02 05:56:45 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:45 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:45 2012 WARNING: potential route subnet conflict between local LAN [192.168.1.0/255.255.255.0] and remote VPN [192.0.0.0/192.0.0.0]
Thu Feb 02 05:56:45 2012 C:\WINDOWS\system32\route.exe ADD 192.0.0.0 MASK 192.0.0.0 172.31.255.254
Thu Feb 02 05:56:45 2012 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 02 05:56:45 2012 Route addition via IPAPI succeeded [adaptive]
Thu Feb 02 05:56:45 2012 Initialization Sequence Completed

Edit: Also notice that the same warning message pops up even in this case where they are clearly not using the same mask or subnet!

apacheguy

Solved!

It turns out it was an MTU issue. I went into the TAP interface on windows and lowered the MTU to 1400. Now it works.

janjust

Excellent, closing topic.

the warning you were seeing

Thu Feb 02 05:56:45 2012 WARNING: potential route subnet conflict between local LAN [192.168.1.0/255.255.255.0] and remote VPN [192.0.0.0/192.0.0.0]
Thu Feb 02 05:56:45 2012 C:\WINDOWS\system32\route.exe ADD 192.0.0.0 MASK 192.0.0.0 172.31.255.254

means that that provider is pushing out an illegal route - no way they can claim the entire 192.0/192.0.0.0 block (that would make it a /2 address !)