Hello I installed OpenVPN for a customer and I have au problem : The server (a real server, not virtualized), Mandriva 2009.0, is configured as this : [code] proto tcp (I have no choice at the moment) port 1194 dev tun server 10.8.0.0 255.255.255.0 push "route 192.0.100.0 255.255.255.0" [/code] My network is 192.168.0.0/24, the network of my customer is 192.0.100.0/24 and openvpn one is 10.8.0.0/24 My customer's router has ip 192.0.100.51 No problems with clients connexion, they obtain their ip address 10.8.0.0/24 and connect to vpn. The problem : when openvpn is started, intranet server ('ip 192.0.100.254) is not accessible anymore. - Clients connected on the vpn can't ping neither 10.8.0.1, nor 192.0.100.254, nor 192.0.100.51, nor stations on local network - Stations on local network can ping other stations, the router, but not the server - The server can ping nothing All the time the same response from ping : timeout If I stop openvpn all become ok again. And when I configure openvpn with [code] push "route ip.bidon 255.255.255.0" [/code] it works as well, the server is accessible. I also tried to configure openvpn with [code] server 192.0.100.0 255.255.255.0 [/code] server not accessible again... In fact, as soon as there has 192.0.100.0 somewhere it no longer works It seems to be a routing problem, but where ? Thanks by admance for your help PS : it's perhaps not important, but it worked at first. Problems started when I configured Samba as wins server and I added push "dhcp-option WINS 192.0.100.254" in openvpn config file. I put everything back but the problem is still there. PS 2 : there's no firewall nowhere PS 3 : I hope my english is not too horrible;) Let me know if so... server.conf: [code] port 1194 proto tcp dev tun ca ca.crt cert server_name.crt key server_name.key dh dh1024.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "route 192.0.100.0 255.255.255.0" keepalive 10 120 comp-lzo persist-key persist-tun status openvpn-status.log verb 3 [/code] client.conf: [code] client dev tun proto tcp remote 87.240.85.82 1194 resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert client_name.crt key client_name.key ns-cert-type server comp-lzo verb 3 [/code]

[RESOLVED] Routing (?) problem

Djerem

Hello

I installed OpenVPN for a customer and I have au problem :

The server (a real server, not virtualized), Mandriva 2009.0, is configured as this :

proto tcp (I have no choice at the moment) 
port 1194 
dev tun 
server 10.8.0.0 255.255.255.0 
push "route 192.0.100.0 255.255.255.0"

My network is 192.168.0.0/24, the network of my customer is 192.0.100.0/24 and openvpn one is 10.8.0.0/24
My customer's router has ip 192.0.100.51
No problems with clients connexion, they obtain their ip address 10.8.0.0/24 and connect to vpn.

The problem : when openvpn is started, intranet server ('ip 192.0.100.254) is not accessible anymore.

- Clients connected on the vpn can't ping neither 10.8.0.1, nor 192.0.100.254, nor 192.0.100.51, nor stations on local network
- Stations on local network can ping other stations, the router, but not the server
- The server can ping nothing
All the time the same response from ping : timeout

If I stop openvpn all become ok again. And when I configure openvpn with

push "route ip.bidon 255.255.255.0"

it works as well, the server is accessible.

I also tried to configure openvpn with

server 192.0.100.0 255.255.255.0

server not accessible again...

In fact, as soon as there has 192.0.100.0 somewhere it no longer works

It seems to be a routing problem, but where ?

Thanks by admance for your help

PS : it's perhaps not important, but it worked at first. Problems started when I configured Samba as wins server and I added push "dhcp-option WINS 192.0.100.254" in openvpn config file. I put everything back but the problem is still there.

PS 2 : there's no firewall nowhere

PS 3 : I hope my english is not too horrible;) Let me know if so...

server.conf:

port 1194
proto tcp
dev tun
ca ca.crt
cert server_name.crt
key server_name.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.0.100.0 255.255.255.0"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

client.conf:

client
dev tun
proto tcp
remote 87.240.85.82 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client_name.crt
key client_name.key
ns-cert-type server
comp-lzo
verb 3

janjust

the configuration option

push "route 192.0.100.0 255.255.255.0"

causes the network 192.0.100/24 to be routed over the VPN to your server - is this really what you want? Isn't this network at your client's side?

PS your english is much better than some posters here ;-)

maikcat

hi there,

please dont double post

https://forums.openvpn.net/topic9870.html

Michael.

Djerem

janjust : Thanks form my english 😉
Non, it is not what I want. I want 192.0.100.0/24 network to be accessible by vpn clients that are on 10.8.0.0/24 network.
So what I need to put in push ? route 10.8.0.0 ? I confess that routing is not the thing where I am the best ...

maikcat: sorry, I didn't see that messages need to be moderated so I believed that my first post was lost.

Djerem

So, I tried to set push "192.168.0.0 255.255.255.0", but no more results; the server 192.0.100.254 works fine now, but client can't join 192.0.100.0 network.

I think I badly explained :

- The workstation where OpenVPN Client is installed is on 192.168.0.0
- The workstation where OpenVPN Server is installed is on 192.0.100.0, as all other workstations in the office of my client
- The virtual network created by OpenVPN is 10.8.0.0

Finaly, I want my workstation on 192.168.0.0 can contact any workstations on 192.0.100.0, exactly as if it was one of any workstation present in the office of my customer.

Is the role of push "route ..." not to say at the client what network(s) need(s) to be joinable ?

janjust

aha, so the server is at 192.0.100 indeed - in that case you will want to push

push "route 192.0.100.0 255.255.255.0"

to your clients; if that breaks the server after the connection comes up then check the routing tables after the client has connected.

Also, remember that the remote network will not know anything about your local network or the VPN network; you can overcome this using masquerading or by setting up the appropriate return routes on the server-side LAN GW.

Djerem

push "route 192.0.100.0 255.255.255.0" is what I tried first time, and it worked well for a time (until I try make Samba a wins server and I add push "dhcp-option WINS 192.0.100.0 255.255.255.0" in server.conf. But for now I removed all theses settings, samba as wins and push optionin openvpn, so it should work as before no ?).

Now, with this setting (push "route 192.0.100.0 255.255.255.0"), the server is down even if no client is connected. Here is "route" results :

Without push "route 192.0.100.0 255.255.255.0":

10.8.0.2        *               255.255.255.255 UH    0      0        0 tun0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
192.0.100.0     *               255.255.255.0   U     5      0        0 eth0
link-local      *               255.255.0.0     U     5      0        0 eth0
default         192.0.100.51    0.0.0.0         UG    5      0        0 eth0

With push "route 192.0.100.0 255.255.255.0":

110.8.0.5        *               255.255.255.255 UH    0      0        0 tun1
10.8.0.1        10.8.0.5        255.255.255.255 UGH   0      0        0 tun1
10.8.0.2        *               255.255.255.255 UH    0      0        0 tun0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
192.0.100.0     10.8.0.5        255.255.255.0   UG    0      0        0 tun1
192.0.100.0     *               255.255.255.0   U     5      0        0 eth0
link-local      *               255.255.0.0     U     5      0        0 eth0
default         192.0.100.51    0.0.0.0         UG    5      0        0 eth0

Without push "route 192.0.100.0 255.255.255.0" and client connected:

10.8.0.5        *               255.255.255.255 UH    0      0        0 tun1
10.8.0.1        10.8.0.5        255.255.255.255 UGH   0      0        0 tun1
10.8.0.2        *               255.255.255.255 UH    0      0        0 tun0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
192.0.100.0     *               255.255.255.0   U     5      0        0 eth0
link-local      *               255.255.0.0     U     5      0        0 eth0
default         192.0.100.51    0.0.0.0         UG    5      0        0 eth0

With push "route 192.0.100.0 255.255.255.0" and client connected:

10.8.0.5        *               255.255.255.255 UH    0      0        0 tun1
10.8.0.1        10.8.0.5        255.255.255.255 UGH   0      0        0 tun1
10.8.0.2        *               255.255.255.255 UH    0      0        0 tun0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
192.0.100.0     10.8.0.5        255.255.255.0   UG    0      0        0 tun1
192.0.100.0     *               255.255.255.0   U     5      0        0 eth0
link-local      *               255.255.0.0     U     5      0        0 eth0
default         192.0.100.51    0.0.0.0         UG    5      0        0 eth0

PS: for now it's not important that remote network can see vpn or local network.

Djerem

Is the fact that proto is tcp and not udp could cause this problem ?

janjust

your server setup seems screwed up; with the 'push' statement added but with no client connected your routing table is

110.8.0.5 * 255.255.255.255 UH 0 0 0 tun1
10.8.0.1 10.8.0.5 255.255.255.255 UGH 0 0 0 tun1
10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
192.0.100.0 10.8.0.5 255.255.255.0 UG 0 0 0 tun1

??? there's two tun adapters there. How are you starting OpenVPN ? check for *conf files in /etc/openvpn and make sure they are not ALL autostarted when running some init.d script.

Djerem

It works !!!

The "client.conf" was in /etc/openvpn with server.conf. I moved it and it's ok.

Thanks a lot for you help, I never though of it myself...