Almost working Configuration

[JimFlint]

Hello,
I have a strange problem which I think is more likely a Windows issue.
The config I have is an office with an Ubuntu server running openvpn (as a server) and also a windows file server.
My first and second laptops CAN CONNECT and browse the windows server (using the IP address).

My problem is that the third laptop can connect and PING the server, but fails to access the file shares using explorer.

Please Help !!

JF

[george]

Are you pinging the file server by name? How are you trying to access the shares?

[JimFlint]

No by IP address,
at the command prompt, this woks

Code: Select all

ping 192.168.0.3

but in explorer, this does not

Code: Select all

\\192.168.0.3

Just to be clear this is only on one out of three laptops

Thanks

[george]

Please post your server and client configs, as well as a the client connection log, (please set to verb 4 in cleint config), and the output of route print from the problem laptop.

[JimFlint]

Hi,
Here are the configs, with some details obvuscated

Server Config

Code: Select all

dev tun 
local 192.168.16.1 
server 10.250.16.0 255.255.255.0 
keepalive 20 105 
topology subnet 
push "route 192.168.16.0 255.255.255.0" 
tls-server 
dh dh1024.pem 
ca ca.crt 
cert oak.crt 
key oak.key
reneg-sec 60
comp-lzo
verb 3

Client Config

Code: Select all

dev tun1
remote 212.159.X.Y
client
ca ca.crt
dh dh1024.pem
cert ian.crt
key ian.key
reneg-sec 60
comp-lzo
verb 3

Print Route

C:\Windows\system32>route print
===========================================================================
Interface List
19...00 ff 94 6c e1 6c ......TAP-Win32 Adapter V9
10...00 22 19 f7 78 e3 ......Broadcom NetLink (TM) Gigabit Ethernet
9...00 22 fb 97 76 72 ......Intel(R) WiFi Link 5100 AGN
1...........................Software Loopback Interface 1
11...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
20...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.17.254 192.168.17.101 25
10.10.10.0 255.255.255.0 192.168.250.254 192.168.17.101 26
10.250.16.0 255.255.255.0 On-link 10.250.16.3 286
10.250.16.3 255.255.255.255 On-link 10.250.16.3 286
10.250.16.255 255.255.255.255 On-link 10.250.16.3 286
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.17.0 255.255.255.0 On-link 192.168.17.101 281
192.168.17.101 255.255.255.255 On-link 192.168.17.101 281
192.168.17.255 255.255.255.255 On-link 192.168.17.101 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.250.16.3 286
224.0.0.0 240.0.0.0 On-link 192.168.17.101 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.250.16.3 286
255.255.255.255 255.255.255.255 On-link 192.168.17.101 281
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
11 58 ::/0 On-link
1 306 ::1/128 On-link
11 58 2001::/32 On-link
11 306 2001:0:5ef5:79fd:1c19:59e:3f57:ee9a/128
On-link
19 286 fe80::/64 On-link
9 281 fe80::/64 On-link
11 306 fe80::/64 On-link
11 306 fe80::1c19:59e:3f57:ee9a/128
On-link
19 286 fe80::3177:ddb:dfb1:414a/128
On-link
9 281 fe80::dc2d:b2a:fd4a:72b9/128
On-link
1 306 ff00::/8 On-link
11 306 ff00::/8 On-link
19 286 ff00::/8 On-link
9 281 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

Client Connection Log

Thu Apr 05 11:09:17 2012 us=933000 renegotiate_bytes = 0
Thu Apr 05 11:09:17 2012 us=933000 renegotiate_packets = 0
Thu Apr 05 11:09:17 2012 us=933000 renegotiate_seconds = 60
Thu Apr 05 11:09:17 2012 us=933000 handshake_window = 60
Thu Apr 05 11:09:17 2012 us=933000 transition_window = 3600
Thu Apr 05 11:09:17 2012 us=933000 single_session = DISABLED
Thu Apr 05 11:09:17 2012 us=933000 push_peer_info = DISABLED
Thu Apr 05 11:09:17 2012 us=933000 tls_exit = DISABLED
Thu Apr 05 11:09:17 2012 us=948000 tls_auth_file = '[UNDEF]'
Thu Apr 05 11:09:17 2012 us=948000 pkcs11_protected_authentication = DISABLED
Thu Apr 05 11:09:17 2012 us=948000 pkcs11_protected_authentication = DISABLED
Thu Apr 05 11:09:17 2012 us=948000 pkcs11_protected_authentication = DISABLED
Thu Apr 05 11:09:17 2012 us=948000 pkcs11_protected_authentication = DISABLED
Thu Apr 05 11:09:17 2012 us=948000 pkcs11_protected_authentication = DISABLED
Thu Apr 05 11:09:17 2012 us=948000 pkcs11_protected_authentication = DISABLED
Thu Apr 05 11:09:17 2012 us=948000 pkcs11_protected_authentication = DISABLED
Thu Apr 05 11:09:17 2012 us=948000 pkcs11_protected_authentication = DISABLED
Thu Apr 05 11:09:17 2012 us=948000 pkcs11_protected_authentication = DISABLED
Thu Apr 05 11:09:17 2012 us=948000 pkcs11_protected_authentication = DISABLED
Thu Apr 05 11:09:17 2012 us=948000 pkcs11_protected_authentication = DISABLED
Thu Apr 05 11:09:17 2012 us=948000 pkcs11_protected_authentication = DISABLED
Thu Apr 05 11:09:17 2012 us=964000 pkcs11_protected_authentication = DISABLED
Thu Apr 05 11:09:17 2012 us=964000 pkcs11_protected_authentication = DISABLED
Thu Apr 05 11:09:17 2012 us=964000 pkcs11_protected_authentication = DISABLED
Thu Apr 05 11:09:17 2012 us=964000 pkcs11_protected_authentication = DISABLED
Thu Apr 05 11:09:17 2012 us=964000 pkcs11_private_mode = 00000000
Thu Apr 05 11:09:17 2012 us=964000 pkcs11_private_mode = 00000000
Thu Apr 05 11:09:17 2012 us=964000 pkcs11_private_mode = 00000000
Thu Apr 05 11:09:17 2012 us=964000 pkcs11_private_mode = 00000000
Thu Apr 05 11:09:17 2012 us=964000 pkcs11_private_mode = 00000000
Thu Apr 05 11:09:17 2012 us=964000 pkcs11_private_mode = 00000000
Thu Apr 05 11:09:17 2012 us=964000 pkcs11_private_mode = 00000000
Thu Apr 05 11:09:17 2012 us=964000 pkcs11_private_mode = 00000000
Thu Apr 05 11:09:17 2012 us=964000 pkcs11_private_mode = 00000000
Thu Apr 05 11:09:17 2012 us=964000 pkcs11_private_mode = 00000000
Thu Apr 05 11:09:17 2012 us=995000 pkcs11_private_mode = 00000000
Thu Apr 05 11:09:17 2012 us=995000 pkcs11_private_mode = 00000000
Thu Apr 05 11:09:17 2012 us=995000 pkcs11_private_mode = 00000000
Thu Apr 05 11:09:17 2012 us=995000 pkcs11_private_mode = 00000000
Thu Apr 05 11:09:17 2012 us=995000 pkcs11_private_mode = 00000000
Thu Apr 05 11:09:17 2012 us=995000 pkcs11_private_mode = 00000000
Thu Apr 05 11:09:17 2012 us=995000 pkcs11_cert_private = DISABLED
Thu Apr 05 11:09:17 2012 us=995000 pkcs11_cert_private = DISABLED
Thu Apr 05 11:09:17 2012 us=995000 pkcs11_cert_private = DISABLED
Thu Apr 05 11:09:17 2012 us=995000 pkcs11_cert_private = DISABLED
Thu Apr 05 11:09:17 2012 us=995000 pkcs11_cert_private = DISABLED
Thu Apr 05 11:09:17 2012 us=995000 pkcs11_cert_private = DISABLED
Thu Apr 05 11:09:17 2012 us=995000 pkcs11_cert_private = DISABLED
Thu Apr 05 11:09:17 2012 us=995000 pkcs11_cert_private = DISABLED
Thu Apr 05 11:09:18 2012 us=11000 pkcs11_cert_private = DISABLED
Thu Apr 05 11:09:18 2012 us=11000 pkcs11_cert_private = DISABLED
Thu Apr 05 11:09:18 2012 us=11000 pkcs11_cert_private = DISABLED
Thu Apr 05 11:09:18 2012 us=11000 pkcs11_cert_private = DISABLED
Thu Apr 05 11:09:18 2012 us=11000 pkcs11_cert_private = DISABLED
Thu Apr 05 11:09:18 2012 us=11000 pkcs11_cert_private = DISABLED
Thu Apr 05 11:09:18 2012 us=11000 pkcs11_cert_private = DISABLED
Thu Apr 05 11:09:18 2012 us=11000 pkcs11_cert_private = DISABLED
Thu Apr 05 11:09:18 2012 us=11000 pkcs11_pin_cache_period = -1
Thu Apr 05 11:09:18 2012 us=11000 pkcs11_id = '[UNDEF]'
Thu Apr 05 11:09:18 2012 us=11000 pkcs11_id_management = DISABLED
Thu Apr 05 11:09:18 2012 us=11000 server_network = 0.0.0.0
Thu Apr 05 11:09:18 2012 us=11000 server_netmask = 0.0.0.0
Thu Apr 05 11:09:18 2012 us=11000 server_bridge_ip = 0.0.0.0
Thu Apr 05 11:09:18 2012 us=11000 server_bridge_netmask = 0.0.0.0
Thu Apr 05 11:09:18 2012 us=26000 server_bridge_pool_start = 0.0.0.0
Thu Apr 05 11:09:18 2012 us=26000 server_bridge_pool_end = 0.0.0.0
Thu Apr 05 11:09:18 2012 us=26000 ifconfig_pool_defined = DISABLED
Thu Apr 05 11:09:18 2012 us=26000 ifconfig_pool_start = 0.0.0.0
Thu Apr 05 11:09:18 2012 us=26000 ifconfig_pool_end = 0.0.0.0
Thu Apr 05 11:09:18 2012 us=26000 ifconfig_pool_netmask = 0.0.0.0
Thu Apr 05 11:09:18 2012 us=26000 ifconfig_pool_persist_filename = '[UNDEF]'
Thu Apr 05 11:09:18 2012 us=26000 ifconfig_pool_persist_refresh_freq = 600
Thu Apr 05 11:09:18 2012 us=26000 n_bcast_buf = 256
Thu Apr 05 11:09:18 2012 us=26000 tcp_queue_limit = 64
Thu Apr 05 11:09:18 2012 us=26000 real_hash_size = 256
Thu Apr 05 11:09:18 2012 us=26000 virtual_hash_size = 256
Thu Apr 05 11:09:18 2012 us=26000 client_connect_script = '[UNDEF]'
Thu Apr 05 11:09:18 2012 us=26000 learn_address_script = '[UNDEF]'
Thu Apr 05 11:09:18 2012 us=42000 client_disconnect_script = '[UNDEF]'
Thu Apr 05 11:09:18 2012 us=42000 client_config_dir = '[UNDEF]'
Thu Apr 05 11:09:18 2012 us=42000 ccd_exclusive = DISABLED
Thu Apr 05 11:09:18 2012 us=42000 tmp_dir = 'C:\Users\Ian\AppData\Local\Temp\'
Thu Apr 05 11:09:18 2012 us=42000 push_ifconfig_defined = DISABLED
Thu Apr 05 11:09:18 2012 us=42000 push_ifconfig_local = 0.0.0.0
Thu Apr 05 11:09:18 2012 us=42000 push_ifconfig_remote_netmask = 0.0.0.0
Thu Apr 05 11:09:18 2012 us=42000 enable_c2c = DISABLED
Thu Apr 05 11:09:18 2012 us=42000 duplicate_cn = DISABLED
Thu Apr 05 11:09:18 2012 us=42000 cf_max = 0
Thu Apr 05 11:09:18 2012 us=42000 cf_per = 0
Thu Apr 05 11:09:18 2012 us=42000 max_clients = 1024
Thu Apr 05 11:09:18 2012 us=42000 max_routes_per_client = 256
Thu Apr 05 11:09:18 2012 us=42000 auth_user_pass_verify_script = '[UNDEF]'
Thu Apr 05 11:09:18 2012 us=42000 auth_user_pass_verify_script_via_file = DISABLED
Thu Apr 05 11:09:18 2012 us=58000 ssl_flags = 0
Thu Apr 05 11:09:18 2012 us=58000 client = ENABLED
Thu Apr 05 11:09:18 2012 us=58000 pull = ENABLED
Thu Apr 05 11:09:18 2012 us=58000 auth_user_pass_file = '[UNDEF]'
Thu Apr 05 11:09:18 2012 us=58000 show_net_up = DISABLED
Thu Apr 05 11:09:18 2012 us=58000 route_method = 0
Thu Apr 05 11:09:18 2012 us=58000 ip_win32_defined = DISABLED
Thu Apr 05 11:09:18 2012 us=58000 ip_win32_type = 3
Thu Apr 05 11:09:18 2012 us=58000 dhcp_masq_offset = 0
Thu Apr 05 11:09:18 2012 us=58000 dhcp_lease_time = 31536000
Thu Apr 05 11:09:18 2012 us=58000 tap_sleep = 0
Thu Apr 05 11:09:18 2012 us=58000 dhcp_options = DISABLED
Thu Apr 05 11:09:18 2012 us=58000 dhcp_renew = DISABLED
Thu Apr 05 11:09:18 2012 us=58000 dhcp_pre_release = DISABLED
Thu Apr 05 11:09:18 2012 us=58000 dhcp_release = DISABLED
Thu Apr 05 11:09:18 2012 us=58000 domain = '[UNDEF]'
Thu Apr 05 11:09:18 2012 us=58000 netbios_scope = '[UNDEF]'
Thu Apr 05 11:09:18 2012 us=89000 netbios_node_type = 0
Thu Apr 05 11:09:18 2012 us=89000 disable_nbt = DISABLED
Thu Apr 05 11:09:18 2012 us=89000 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Thu Apr 05 11:09:18 2012 us=89000 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA. OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Thu Apr 05 11:09:18 2012 us=89000 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Thu Apr 05 11:09:18 2012 us=89000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Apr 05 11:09:18 2012 us=338000 LZO compression initialized
Thu Apr 05 11:09:18 2012 us=338000 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Apr 05 11:09:18 2012 us=354000 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Apr 05 11:09:18 2012 us=354000 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Apr 05 11:09:18 2012 us=354000 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Thu Apr 05 11:09:18 2012 us=354000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Apr 05 11:09:18 2012 us=354000 Local Options hash (VER=V4): '41690919'
Thu Apr 05 11:09:18 2012 us=354000 Expected Remote Options hash (VER=V4): '530fdded'
Thu Apr 05 11:09:18 2012 us=354000 UDPv4 link local (bound): [undef]:1194
Thu Apr 05 11:09:18 2012 us=354000 UDPv4 link remote: 212.159.X.Y:1194
Thu Apr 05 11:09:18 2012 us=401000 TLS: Initial packet from 212.159.X.Y:1194, sid=48211930 8336d790
Thu Apr 05 11:09:18 2012 us=697000 VERIFY OK: depth=1, /C=GB/ST=UK/L=Hereford/O=PRS/CN=CA/emailAddress=ian@somewhere.co.uk
Thu Apr 05 11:09:18 2012 us=697000 VERIFY OK: depth=0, /C=GB/ST=UK/L=Hereford/O=PRS/OU=Main_Office/CN=OAK/emailAddress=ian@somewhere.co.uk
Thu Apr 05 11:09:19 2012 us=259000 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Apr 05 11:09:19 2012 us=259000 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 05 11:09:19 2012 us=259000 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Apr 05 11:09:19 2012 us=259000 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 05 11:09:19 2012 us=259000 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Apr 05 11:09:19 2012 us=259000 [OAK] Peer Connection Initiated with 212.159.120.138:1194
Thu Apr 05 11:09:21 2012 us=505000 SENT CONTROL [OAK]: 'PUSH_REQUEST' (status=1)
Thu Apr 05 11:09:21 2012 us=552000 PUSH: Received control message: 'PUSH_REPLY,route 192.168.16.0 255.255.255.0,route-gateway 10.250.16.1,topology subnet,ping 20,ping-restart 105,ifconfig 10.250.16.3 255.255.255.0'
Thu Apr 05 11:09:21 2012 us=552000 OPTIONS IMPORT: timers and/or timeouts modified
Thu Apr 05 11:09:21 2012 us=552000 OPTIONS IMPORT: --ifconfig/up options modified
Thu Apr 05 11:09:21 2012 us=552000 OPTIONS IMPORT: route options modified
Thu Apr 05 11:09:21 2012 us=552000 OPTIONS IMPORT: route-related options modified
Thu Apr 05 11:09:21 2012 us=568000 ROUTE default_gateway=192.168.17.254
Thu Apr 05 11:09:21 2012 us=583000 TAP-WIN32 device [Local Area Connection 5] opened: \\.\Global\{C3BBD31E-9A86-4E7D-BA77-588E1E1182BA}.tap
Thu Apr 05 11:09:21 2012 us=583000 TAP-Win32 Driver Version 9.9
Thu Apr 05 11:09:21 2012 us=583000 TAP-Win32 MTU=1500
Thu Apr 05 11:09:21 2012 us=583000 Set TAP-Win32 TUN subnet mode network/local/netmask = 10.250.16.0/10.250.16.3/255.255.255.0 [SUCCEEDED]
Thu Apr 05 11:09:21 2012 us=583000 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.250.16.3/255.255.255.0 on interface {C3BBD31E-9A86-4E7D-BA77-588E1E1182BA} [DHCP-serv: 10.250.16.254, lease-time: 31536000]
Thu Apr 05 11:09:21 2012 us=599000 NOTE: FlushIpNetTable failed on interface [20] {C3BBD31E-9A86-4E7D-BA77-588E1E1182BA} (status=5) : Access is denied.
Thu Apr 05 11:09:26 2012 us=965000 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Thu Apr 05 11:09:26 2012 us=965000 C:\WINDOWS\system32\route.exe ADD 192.168.16.0 MASK 255.255.255.0 10.250.16.1
Thu Apr 05 11:09:26 2012 us=981000 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=20]
Thu Apr 05 11:09:26 2012 us=981000 Route addition via IPAPI failed [adaptive]
Thu Apr 05 11:09:26 2012 us=981000 Route addition fallback to route.exe
The requested operation requires elevation.
Thu Apr 05 11:09:27 2012 us=215000 ERROR: Windows route add command failed [adaptive]: returned error code 1
Thu Apr 05 11:09:27 2012 us=215000 Initialization Sequence Completed

[george]

Your first problem:

Code: Select all

Thu Apr 05 11:09:21 2012 us=599000 NOTE: FlushIpNetTable failed on interface [20] {C3BBD31E-9A86-4E7D-BA77-588E1E1182BA} (status=5) : Access is denied. 
Thu Apr 05 11:09:26 2012 us=965000 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Thu Apr 05 11:09:26 2012 us=965000 C:\WINDOWS\system32\route.exe ADD 192.168.16.0 MASK 255.255.255.0 10.250.16.1
Thu Apr 05 11:09:26 2012 us=981000 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=20]
Thu Apr 05 11:09:26 2012 us=981000 Route addition via IPAPI failed [adaptive]
Thu Apr 05 11:09:26 2012 us=981000 Route addition fallback to route.exe
The requested operation requires elevation.
Thu Apr 05 11:09:27 2012 us=215000 ERROR: Windows route add command failed [adaptive]: returned error code 1
Thu Apr 05 11:09:27 2012 us=215000 Initialization Sequence Completed

OpenVPN.exe and OpenVPN-GUI.exe need to be ran as administrator


Your second issue:

No by IP address,
at the command prompt, this woks


Code:

ping 192.168.0.3

but in explorer, this does not


Code:

\\192.168.0.3

Just to be clear this is only on one out of three laptops

Thanks

Note that this may be resolved by the solution for the client issue above. I don't see a route for the 192.168.0.0/24? network being pushed by your server. Try adding this line to the server config:

Code: Select all

push "route 192.168.0.0 255.255.255.0"

[JimFlint]

I have checked (and double checked) that the user is running "As Administrator" - and they ARE.

When I saw the errors you pointed out, I was confused - the "route print" command shows an entry for the 192.168.16.0 network, and the PING command does work.

Also, my apologies, the commands I showed had the wrong subnet , they were
ping 192.168.16.3
and
\\192.168.16.3