Client can't see server's LAN

opapanik · Post by **opapanik** » Sun May 07, 2017 4:11 pm

Hello everyone,

I recently setup an OpenVPN server (2.4.1) on a Windows 7 Ultimate laptop which is up 24/7, and a connecting client (Android Marschmallow phone, am trying both OpenVPN connect and OpenVPN for Android clients, same results).

The problem:
---------------
The VPN client cannot see the rest of the LAN (pings from the client to LAN machines other than the server are unsuccessful)

Everything else works as expected (client connects, sees the server using both its VPN or LAN IP, sees internet through VPN, LAN machines can see the client)

The problem occurs with or without firewalls enabled, and it doesn't matter how the client connects (WiFi or LTE).

Details of the situation:
----------------------------
Pings from the client to *both* the server's LAN and VPN IP, ok.
Pings from the client to other LAN machines, FAIL. <<< the problem
Pings from LAN machines to the client, ok.
Pings from LAN machines to LAN, ok.

The setup:
-------------
LAN subnet: 10.20.30.0/24
modem/router at 10.20.30.254
server at 10.20.30.10

VPN subnet: 10.20.31.0/24
server gets 10.20.31.1
client gets 10.20.31.2

Extra steps taken:
----------------------
Added route to the router for LAN > VPN. Works, because LAN machines successfully ping the VPN client.

I have enabled routing in server's (Windows 7) registry:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters]
"IPEnableRouter"=dword:00000001

Server configuration:
-------------------------
proto udp4
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh4096.pem
topology subnet
server 10.20.31.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-to-client
keepalive 10 120
cipher AES-256-CBC
persist-key
persist-tun
status openvpn-status.log
verb 6
explicit-exit-notify 1

;push "redirect-gateway def1 bypass-dhcp"
;push "route 10.20.30.0 255.255.255.0 10.20.31.1"
;push "dhcp-option DNS 10.20.31.1"
;push "dhcp-option DNS 10.20.30.254"
;route 10.20.30.0 255.255.255.0 10.20.30.254

The last 5 lines is what I have tried playing with. No results.

Whatever I do, I saw in some log that a vpn gateway is set up as 10.20.31.254 (which does not exist). I suppose its some virtual gateway that openvpn server automatically defines?

Client configuration:
------------------------
client
dev tun
proto udp
remote ---.ddns.net 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
cipher AES-256-CBC
verb 6

About Windows quirks:
---------------------------
Instructions for the windows server case, state that one should make that registry change (which I have done as I say above), and also enabling promiscuous mode on the adapter.
But after searching for that, it seems it only concerns bridged connections, which is not the case here, right? The command "netsh bridge show adapter" shows no adapters on my Windows box.

In any case it seems to me that the server is not able to route VPN > LAN. Could the TAP driver be the culprit? The OS? The NIC?

Any ideas on what might be wrong please?

Logs available on request.

Thank you

TinCanTech · Post by **TinCanTech** » Sun May 07, 2017 4:53 pm

Use --verb 4 and post your logs please.

Post by **Pippin** » Sun May 07, 2017 5:34 pm

Looks like