Hello,
I've been at this for more than 6 hours now and I'm at my wits' end; I'd really appreciate your help.
Everything seems to be working okay except that after connection to the server is established I lose my Internet connectivity.
The server is my VPS running
Ubuntu TLS 10.04 TLS.
The client is running
Windows XP SP3.
Here is the
server config file:
port 1194
reneg-sec 0
proto udp
dev tun
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
client-to-client
duplicate-cn
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log /var/log/openvpn.log
Here is the
client config file
client
dev tun
proto udp
remote xxx.xxx.xxx.xxx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
comp-lzo
verb 3
redirect-gateway
script-security 2
This is the
client connection log:
Sat Feb 18 18:23:47 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Sat Feb 18 18:23:47 2012 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Sat Feb 18 18:23:47 2012 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sat Feb 18 18:23:48 2012 LZO compression initialized
Sat Feb 18 18:23:48 2012 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sat Feb 18 18:23:48 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sat Feb 18 18:23:48 2012 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Feb 18 18:23:48 2012 Local Options hash (VER=V4): '41690919'
Sat Feb 18 18:23:48 2012 Expected Remote Options hash (VER=V4): '530fdded'
Sat Feb 18 18:23:48 2012 UDPv4 link local: [undef]
Sat Feb 18 18:23:48 2012 UDPv4 link remote: xxx.xxx.xxx.xxx:1194
Sat Feb 18 18:23:48 2012 TLS: Initial packet from xxx.xxx.xxx.xxx:1194, sid=8cf92bcb fff96aab
Sat Feb 18 18:23:50 2012 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=name/emailAddress=me@myhost.mydomain
Sat Feb 18 18:23:50 2012 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=name/emailAddress=me@myhost.mydomain
Sat Feb 18 18:23:58 2012 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Feb 18 18:23:58 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 18 18:23:58 2012 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Feb 18 18:23:58 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 18 18:23:58 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sat Feb 18 18:23:58 2012 [hostname] Peer Connection Initiated with xxx.xxx.xxx.xxx:1194
Sat Feb 18 18:24:00 2012 SENT CONTROL [hostname]: 'PUSH_REQUEST' (status=1)
Sat Feb 18 18:24:00 2012 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Sat Feb 18 18:24:00 2012 OPTIONS IMPORT: timers and/or timeouts modified
Sat Feb 18 18:24:00 2012 OPTIONS IMPORT: --ifconfig/up options modified
Sat Feb 18 18:24:00 2012 OPTIONS IMPORT: route options modified
Sat Feb 18 18:24:00 2012 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sat Feb 18 18:24:01 2012 ROUTE default_gateway=10.119.8.2
Sat Feb 18 18:24:01 2012 TAP-WIN32 device [MyTap] opened: \\.\Global\{1D627CE3-F979-417E-B5F8-59B4B2ED195F}.tap
Sat Feb 18 18:24:01 2012 TAP-Win32 Driver Version 9.9
Sat Feb 18 18:24:01 2012 TAP-Win32 MTU=1500
Sat Feb 18 18:24:01 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {1D627CE3-F979-417E-B5F8-59B4B2ED195F} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Sat Feb 18 18:24:01 2012 Successful ARP Flush on interface [1376260] {1D627CE3-F979-417E-B5F8-59B4B2ED195F}
Sat Feb 18 18:24:06 2012 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Sat Feb 18 18:24:06 2012 C:\WINDOWS\system32\route.exe ADD xxx.xxx.xxx.xxx MASK 255.255.255.255 10.119.8.2
Sat Feb 18 18:24:06 2012 ROUTE: route addition failed using CreateIpForwardEntry: The parameter is incorrect. [status=87 if_index=2359301]
Sat Feb 18 18:24:06 2012 Route addition via IPAPI failed [adaptive]
Sat Feb 18 18:24:06 2012 Route addition fallback to route.exe
Sat Feb 18 18:24:06 2012 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Sat Feb 18 18:24:06 2012 Route addition via IPAPI succeeded [adaptive]
Sat Feb 18 18:24:06 2012 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Sat Feb 18 18:24:06 2012 Route addition via IPAPI succeeded [adaptive]
Sat Feb 18 18:24:06 2012 C:\WINDOWS\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.5
Sat Feb 18 18:24:06 2012 Route addition via IPAPI succeeded [adaptive]
Sat Feb 18 18:24:06 2012 Initialization Sequence Completed
Here is the the result of
netstat -rn before connection:
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 1c 23 55 62 8f ...... Realtek RTL8168C(P)/8111C(P) PCI-E Gigabit Ethernet NIC - Packet Scheduler Miniport
0x150004 ...00 ff 1d 62 7c e3 ...... TAP-Win32 Adapter V9 - Packet Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.100 20
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.1.0 255.255.255.0 192.168.1.100 192.168.1.100 20
192.168.1.100 255.255.255.255 127.0.0.1 127.0.0.1 20
192.168.1.255 255.255.255.255 192.168.1.100 192.168.1.100 20
224.0.0.0 240.0.0.0 192.168.1.100 192.168.1.100 20
255.255.255.255 255.255.255.255 192.168.1.100 150004 1
255.255.255.255 255.255.255.255 192.168.1.100 192.168.1.100 1
Default Gateway: 192.168.1.1
===========================================================================
Persistent Routes:
None
Route Table
Here is the the result of
netstat -rn after connection:
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 1c 23 55 62 8f ...... Realtek RTL8168C(P)/8111C(P) PCI-E Gigabit Ethernet NIC - Packet Scheduler Miniport
0x150004 ...00 ff 1d 62 7c e3 ...... TAP-Win32 Adapter V9 - Packet Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 128.0.0.0 10.8.0.9 10.8.0.10 1
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.100 20
10.8.0.0 255.255.255.0 10.8.0.9 10.8.0.10 1
10.8.0.8 255.255.255.252 10.8.0.10 10.8.0.10 30
10.8.0.10 255.255.255.255 127.0.0.1 127.0.0.1 30
10.255.255.255 255.255.255.255 10.8.0.10 10.8.0.10 30
xxx.xxx.xxx.xxx 255.255.255.255 192.168.1.1 192.168.1.100 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
128.0.0.0 128.0.0.0 10.8.0.9 10.8.0.10 1
192.168.1.0 255.255.255.0 192.168.1.100 192.168.1.100 20
192.168.1.100 255.255.255.255 127.0.0.1 127.0.0.1 20
192.168.1.255 255.255.255.255 192.168.1.100 192.168.1.100 20
224.0.0.0 240.0.0.0 10.8.0.10 10.8.0.10 30
224.0.0.0 240.0.0.0 192.168.1.100 192.168.1.100 20
255.255.255.255 255.255.255.255 10.8.0.10 10.8.0.10 1
255.255.255.255 255.255.255.255 192.168.1.100 192.168.1.100 1
Default Gateway: 10.8.0.9
===========================================================================
Persistent Routes:
None
Route Table
Here is the result of
iptables -L -t nat:
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- 10.8.0.0/24 anywhere to:xxx.xxx.xxx.xxx
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
xxx.xxx.xxx.xxx being the server's IP.
