VPN Connected, but no ping reply

jlabuelo

Hi all

I have a problem that as I can see in this forum happens quite often, however I was not able to find a solution that fits our situation.

Problem is that we have a Ubuntu Server acting as VPN server, Windows XP machines running as clients with OpenVPN are able to get connected to the VPN and work normally, but it is not the same for Windows7 or Windows 2003 machines, where the same client configuration is not working.

Both types of machines, "Windows XP" and "WK3 & W7", are able to get connected to the VPN, and get an ip assigned to them, but the machines of OS "WK3 or W7" they are not able to ping the server (neither the server to ping them) or to get access to anything shared in the VPN, altough the XP ones they work correctly. As I said, client configuration is the same and they are behind the same router and under the same LAN.

The Ubuntu Server Configuration is this one
VPN Network Interface 10.8.0.1

server.conf configuration file
-----------------------

local 10.224.106.229
port 1194
proto udp
dev tun
;dev-node MyTap
ca ca.crt
cert servidor.crt
key servidor.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt

;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
;push "route 192.168.10.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"
;client-config-dir ccd
;route 192.168.40.128 255.255.255.248
;client-config-dir ccd
;route 10.9.0.0 255.255.255.252
;learn-address ./script
;push "redirect-gateway"
;push "dhcp-option DNS 10.8.0.1"
;push "dhcp-option WINS 10.8.0.1"
;client-to-client
;duplicate-cn
keepalive 10 120

;tls-auth ta.key 0 # This file is secret
;cipher BF-CBC # Blowfish (default)
;cipher AES-128-CBC # AES
;cipher DES-EDE3-CBC # Triple-DES

comp-lzo
;max-clients 100
;user nobody
;group nobody

persist-key
persist-tun
status openvpn-status.log
;log openvpn.log
;log-append openvpn.log
verb 3
;mute 20

The configuration file used in the client machine (Which works in XP but not in W7 or WK3)
----------------------------------------

client

;dev tap
dev tun

;dev-node MyTap
;proto tcp
proto udp

remote Server_IP_ADDRESS 1194
;remote my-server-2 1194
;remote-random

resolv-retry infinite
nobind

;user nobody
;group nobody

persist-key
persist-tun

;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]

;mute-replay-warnings

ca ca.crt
cert cliente.crt
key cliente.key

ns-cert-type server
;tls-auth ta.key 1
;cipher x

comp-lzo
verb 3
;mute 20

The result of the comand netstat -rn in the client ( Windows7):
===========================================================================
ILista de interfaces
19...00 ff 3b 75 3d 63 ......TAP-Win32 Adapter V9
17...4c ed de 24 05 ce ......Microsoft Virtual WiFi Miniport Adapter
16...4c ed de 24 05 ce ......Adaptador de red Broadcom 802.11n
14...00 50 b6 4b 62 b4 ......ASIX AX88772A USB2.0 to Fast Ethernet Adapter
12...00 23 18 36 94 93 ......Intel(R) 82577LC Gigabit Network Connection
1...........................Software Loopback Interface 1
21...00 00 00 00 00 00 00 e0 Adaptador ISATAP de Microsoft
24...00 00 00 00 00 00 00 e0 Adaptador ISATAP de Microsoft #2
13...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
22...00 00 00 00 00 00 00 e0 Adaptador ISATAP de Microsoft #3
23...00 00 00 00 00 00 00 e0 Adaptador ISATAP de Microsoft #4
20...00 00 00 00 00 00 00 e0 Adaptador ISATAP de Microsoft #5
===========================================================================

IPv4 Tabla de enrutamiento
===========================================================================
Rutas activas:
Destino de red Máscara de red Puerta de enlace Interfaz Métrica
0.0.0.0 0.0.0.0 192.168.2.1 192.168.2.180 20
10.8.0.4 255.255.255.252 En vínculo 10.8.0.6 286
10.8.0.6 255.255.255.255 En vínculo 10.8.0.6 286
10.8.0.7 255.255.255.255 En vínculo 10.8.0.6 286
127.0.0.0 255.0.0.0 En vínculo 127.0.0.1 306
127.0.0.1 255.255.255.255 En vínculo 127.0.0.1 306
127.255.255.255 255.255.255.255 En vínculo 127.0.0.1 306
192.168.2.0 255.255.255.0 En vínculo 192.168.2.180 276
192.168.2.180 255.255.255.255 En vínculo 192.168.2.180 276
192.168.2.255 255.255.255.255 En vínculo 192.168.2.180 276
224.0.0.0 240.0.0.0 En vínculo 127.0.0.1 306
224.0.0.0 240.0.0.0 En vínculo 10.8.0.6 286
224.0.0.0 240.0.0.0 En vínculo 192.168.2.180 276
255.255.255.255 255.255.255.255 En vínculo 127.0.0.1 306
255.255.255.255 255.255.255.255 En vínculo 10.8.0.6 286
255.255.255.255 255.255.255.255 En vínculo 192.168.2.180 276
===========================================================================
Rutas persistentes:
Ninguno

Any ideas about what we should do to get the WK3 and W7 machines to be able to get connected to the VPN and work normally?

maikcat

can you also post the output of netstat -nr on your server?

are you running your win 7 clients with admin rights?

Michael.

jlabuelo

Hi Michael

You were right for the Windows7, we were running OpenVPN client in Windows 2003 Server as "administrator" and the problem was still there but did not checked in Windows7. Now we have checked in Windows 7 Server and we are able to get connected to the VPN, ping works fine and we are able to get access to the items shared.

However problem still persists in the WK3 machine

Here I pass you the results of the netsat -rn in the server side:
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.224.106.0 0.0.0.0 255.255.254.0 U 0 0 0 eth0
0.0.0.0 10.224.106.1 0.0.0.0 UG 0 0 0 eth0

And also the result of netstat -rn in the wK3 machine (IP assigned 10.8.0.10:
Active Rountes:
Destination Gateway SubNet Mask Interfa
0.0.0.0 192.168.8.1 0.0.0.0 192.168.8.250
0.0.0.0 192.168.8.1 255.255.255.255 192.168.8.250
10.8.0.8 10.8.0.10 255.255.255.252 10.8.0.10
10.8.0.10 127.0.0.1 255.255.255.255 127.0.0.1
10.255.255.255 10.8.0.10 255.255.255.255 10.8.0.10
127.0.0.0 127.0.0.1 255.0.0.0 127.0.0.1
192.168.8.0 192.168.8.250 255.255.255.0 192.168.8.250
192.168.8.250 127.0.0.1 255.255.255.255 127.0.0.1
192.168.8.255 192.168.8.250 255.255.255.255 192.168.8.250
224.0.0.0 10.8.0.10 244.0.0.0 10.8.0.10
224.0.0.0 192.168.8.250 244.0.0.0 192.168.8.250
255.255.255.255 10.8.0.10 255.255.255.255 10.8.0.10
255.255.255.255 192.168.8.250 255.255.255.255 192.168.8.250

maikcat

is RAS enabled on win 2003?

Michael.

jlabuelo

Hi Michael
Thanks for the reply, yes RSA is enable in WK3 machine.

Anything I can provide for a better understanding of the situation for you??

jlabuelo

Hi again

Just in order to provide more information that could help to identify the error for this Windows 2003 Server machine trying to connect the VPN with OpenVPN client.

When we launch OpenVPN Client as administrator in Windows 2003 Server, the conection log shows these messages:

Wed Feb 01 18:23:09 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Wed Feb 01 18:23:09 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Feb 01 18:23:09 2012 LZO compression initialized
Wed Feb 01 18:23:09 2012 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Feb 01 18:23:09 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Feb 01 18:23:09 2012 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Feb 01 18:23:09 2012 Local Options hash (VER=V4): '41690919'
Wed Feb 01 18:23:09 2012 Expected Remote Options hash (VER=V4): '530fdded'
Wed Feb 01 18:23:09 2012 UDPv4 link local: [undef]
Wed Feb 01 18:23:09 2012 UDPv4 link remote: 176.34.235.149:1194
Wed Feb 01 18:23:10 2012 TLS: Initial packet from 176.34.235.149:1194, sid=61f0e523 aa221f0a
Wed Feb 01 18:23:11 2012 VERIFY OK: depth=1, /C=ES/ST=CO/L=Santiago/O=Simply_Smart/CN=Simply_Smart_CA/emailAddress=soporte@simplysmart.es
Wed Feb 01 18:23:11 2012 VERIFY OK: nsCertType=SERVER
Wed Feb 01 18:23:11 2012 VERIFY OK: depth=0, /C=ES/ST=CO/L=Santiago/O=Simply_Smart/CN=servidor/emailAddress=soporte@simplysmart.es
Wed Feb 01 18:23:12 2012 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Feb 01 18:23:12 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 01 18:23:12 2012 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Feb 01 18:23:12 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 01 18:23:12 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Feb 01 18:23:12 2012 [servidor] Peer Connection Initiated with 176.34.235.149:1194
Wed Feb 01 18:23:15 2012 SENT CONTROL [servidor]: 'PUSH_REQUEST' (status=1)
Wed Feb 01 18:23:15 2012 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9'
Wed Feb 01 18:23:15 2012 OPTIONS IMPORT: timers and/or timeouts modified
Wed Feb 01 18:23:15 2012 OPTIONS IMPORT: --ifconfig/up options modified
Wed Feb 01 18:23:15 2012 OPTIONS IMPORT: route options modified
Wed Feb 01 18:23:15 2012 ROUTE default_gateway=192.168.8.1
Wed Feb 01 18:23:15 2012 TAP-WIN32 device [Conexión de área local 3] opened: \\.\Global\{8B9FBB37-FB97-405A-A720-727BE9E24677}.tap
Wed Feb 01 18:23:15 2012 TAP-Win32 Driver Version 9.9
Wed Feb 01 18:23:15 2012 TAP-Win32 MTU=1500
Wed Feb 01 18:23:15 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.10/255.255.255.252 on interface {8B9FBB37-FB97-405A-A720-727BE9E24677} [DHCP-serv: 10.8.0.9, lease-time: 31536000]
Wed Feb 01 18:23:15 2012 NOTE: FlushIpNetTable failed on interface [2424836] {8B9FBB37-FB97-405A-A720-727BE9E24677} (status=1413) : El índice no es válido.
Wed Feb 01 18:23:20 2012 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Wed Feb 01 18:23:20 2012 C:\WINDOWS\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.9
Wed Feb 01 18:23:20 2012 Route addition via IPAPI succeeded [adaptive]
Wed Feb 01 18:23:20 2012 Initialization Sequence Completed
Wed Feb 01 18:24:14 2012 TCP/UDP: Closing socket
Wed Feb 01 18:24:14 2012 C:\WINDOWS\system32\route.exe DELETE 10.8.0.1 MASK 255.255.255.255 10.8.0.9
Wed Feb 01 18:24:14 2012 ROUTE: route deletion failed using DeleteIpForwardEntry: El índice no es válido.
Wed Feb 01 18:24:14 2012 Route deletion via IPAPI failed [adaptive]
Wed Feb 01 18:24:14 2012 Route deletion fallback to route.exe
No se encontr¢ la ruta especificada.
Wed Feb 01 18:24:14 2012 Closing TUN/TAP interface
Wed Feb 01 18:24:14 2012 SIGTERM[hard,] received, process exiting

There are a couple of messages that dont know what they mean exactly and if they can be the problem, and if so, how to solve them

Wed Feb 01 18:23:15 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.10/255.255.255.252 on interface {8B9FBB37-FB97-405A-A720-727BE9E24677} [DHCP-serv: 10.8.0.9, lease-time: 31536000]
Wed Feb 01 18:23:15 2012 NOTE: FlushIpNetTable failed on interface [2424836] {8B9FBB37-FB97-405A-A720-727BE9E24677} (status=1413) : Index not valid.

Wed Feb 01 18:24:14 2012 ROUTE: route deletion failed using DeleteIpForwardEntry: Not a valid Index.
Wed Feb 01 18:24:14 2012 Route deletion via IPAPI failed [adaptive]
Wed Feb 01 18:24:14 2012 Route deletion fallback to route.exe
Route has not been found.

Thanks a lot

iTijn

Hi Anybody found a solution to this issue?
I'm experiencing the exact same thing.

Open VPN server is running on Synology NAS with default plugin.
Mac machine connects and works fine. (using tunnel Blick)
Windows 7 (x64) Machine connects fine but can't connect to anything in the lan.

Mac uses Tunnelblick
Win7 uses Open VPN (openvpn-install-2.3.0-I001-x86_64.exe)
Both machines use the same config file:

dev tun
tls-client

remote ######## 1194

# If redirect-gateway is enabled, the client will redirect it's
# default network gateway through the VPN.
# It means the VPN connection will firstly connect to the VPN Server
# and then to the internet.
# (Please refer to the manual of OpenVPN for more information.)

# redirect-gateway

pull

proto udp
script-security 2

ca ca.crt

comp-lzo

reneg-sec 0

auth-user-pass

PC connection Log:

Tue Jan 22 23:54:53 2013 OpenVPN 2.3.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Jan  8 2013
Enter Management Password:
Tue Jan 22 23:55:00 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Tue Jan 22 23:55:00 2013 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue Jan 22 23:55:00 2013 UDPv4 link local (bound): [undef]
Tue Jan 22 23:55:00 2013 UDPv4 link remote: [AF_INET]########:1194
Tue Jan 22 23:55:06 2013 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Jan 22 23:55:06 2013 [Snake Oil CA] Peer Connection Initiated with [AF_INET]########:1194
Tue Jan 22 23:55:08 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Jan 22 23:55:08 2013 open_tun, tt->ipv6=0
Tue Jan 22 23:55:08 2013 TAP-WIN32 device [Local Area Connection 4] opened: \\.\Global\{######}.tap
Tue Jan 22 23:55:08 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.10/255.255.255.252 on interface {######} [DHCP-serv: 10.8.0.9, lease-time: 31536000]
Tue Jan 22 23:55:08 2013 Successful ARP Flush on interface [27] {########}
Tue Jan 22 23:55:13 2013 Initialization Sequence Completed

For privacy reasons some info in the log is masked by a bunch of ######

All help appricated