Ok, apologies for the huge amount of data here, but I am really stuck. I am trying to add the ability for remote "Road Warrior" type users to access the VPN from remote sites. The problem came when the remote user was on a network that assigned 192.168.1.X numbers. My VPN was pushing 192.168.1.X as well, so the system didn't know what to do. There was no issue if the remote network used 10.X.X.X or 172.X.X.X.
So following Mimiko's tutorial I tried to set up my config that would push a different IP range and route it accordingly. I of course set up a bridge and edited my OpenVPN file.
So here is my entire setup from start to finish:
First: I have my Cisco router set up to NAT our public address to 192.168.1.250:1194. This is working fine, as I was able to access the VPN before making the "Road Warrior" changes.
My network interfaces are set up like this:
# The loopback network interface
auto lo
iface lo inet loopback
#The primary network interface
auto eth1
iface eth1 inet static
address 192.168.1.250
netmask 255.255.255.0
network 192.168.1.0
broadcast 192.168.1.255
gateway 192.168.1.1
# The bridge network interface
auto br0
iface br0 inet static
address 172.16.1.250
netmask 255.255.255.0
network 172.16.1.0
broadcast 172.16.1.255
gateway 172.16.1.1
bridge_ports eth0
bridge_fd 9
bridge_hello 2
bridge_maxage 12
bridge_stp off
I may be doing the bridge wrong, but a bunch of internet searches have proven unhelpful so if I am, help would be appreciated.
And this is my OpenVPN Config File:
port 1194
proto udp
dev tap0
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 172.16.1.250 255.255.255.0 172.16.1.200 172.16.1.215
push "route 172.16.1.250 255.255.255.0"
route 192.168.1.250 255.255.255.0
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
I have also created a ccd file under /etc/openvpn/ccd/ with the name of the client with:
iroute 172.16.1.250 255.255.255.0
On the client side (I am using Viscosity for Mac) I get this text when trying to connect:
Feb 23 10:52:43: Viscosity 1.3.5 (1051)
Feb 23 10:52:43: Checking reachability status of connection...
Feb 23 10:52:43: Connection is reachable. Starting connection attempt.
Feb 23 10:52:46: OpenVPN 2.2.1 x86_64-apple-darwin10.8.0 [SSL] [LZO2] [PKCS11] [eurephia] built on Aug 1 2011
Feb 23 10:52:45: WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Feb 23 10:52:45: NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Feb 23 10:52:45: Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Feb 23 10:52:45: LZO compression initialized
Feb 23 10:52:45: UDPv4 link local: [undef]
Feb 23 10:52:45: UDPv4 link remote: <[color=#FF0000]public address deleted for privacy[/color]>:1194
Feb 23 10:53:45: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Feb 23 10:53:45: TLS Error: TLS handshake failed
Feb 23 10:53:45: SIGUSR1[soft,tls-error] received, process restarting
Any help with this would be very much appreciated. Thanks in advance for your responses.
And I can't even SSH into the machine anymore. Pretty much done with OpenVPN.
