Server can not ping client in any setup

patjuh112

Hi, first of all thanks for reading. My problem is that whatever i do between whatever server/clients i can not ping the client from the server and i am also in the dark how i can tell the servers behind the vpn server how to get to the other lan.

I'm using a routed configuration to fully link 192.168.1.0/24 with 192.168.10.0/24 on a windows based installation with no firewalls further enabled. Configuration i am using now is below :

Server : Windows 2008 R2 x64
Openvpn version : latest (2.2)
--/ Start of config
## server.ovpn ##
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.10.0 255.255.255.0"
;push "dhcp-option WINS 192.168.0.3"
;push "dhcp-option DNS 192.168.0.3"
keepalive 10 120
comp-lzo
max-clients 4
persist-key
persist-tun
status openvpn-status.log
verb 3
;client-config-dir ccd
route 192.168.1.0 255.255.255.0
route-method exe
route-delay 2
--/ end of config

Client : Windows 2003 std. x86
OpenVPN version : latest (2.2)
--/ Start of config
client
dev tun
;dev-node OpenVPN
proto udp
remote x.x.x.x 1194
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
comp-lzo
verb 3
--/ end of config

Like i mentioned, the weird thing is that i can always ping the server from the client (not the servers in its lan behind it tho) but never the other way around. When i turn the client / server role around between such setup the result is also turned around and the same, server can not ping client. Based on this i feel i'm doing something wrong in my configuration, specifically with routes applied.

The configuration in the ccd directory for client1 is :

iroute 192.168.1.0 255.255.255.0

Any help is appreciated.

maikcat

hi there,

your configs look ok,

did you enable ip forwarding on BOTH openvpn endpoints?

also,

add to your ccd file this:

ifconfig-push 10.8.0.10 10.8.0.9

your client must get 10.8.0.10 ip,if not then your ccd file is not parsed
btw you have a comment for client-config-dir directive.. :?:

firewalls are configured??

Michael.

patjuh112

Hi, this is the same post as the other one (driving me insane), but yes, IP forwarding is enabled through registry on both of which 1 server had it already enabled due to running rras (client side).

patjuh112

ifconfig works on the windows build ?

patjuh112

After adding the changes :

maikcat

ifconfig works on the windows build ?

yeap

i noticed on your screenshot that your cilent get 0.6 ip instead of 0.10
(if you added the ifconfig statement to your ccd file)

this normally means that the ccd file is named incorrectly -or- placed somewhere else -or- the
common name of the cert doesnt match ccd file name...

Michael.