topic Re: OpenVPN in Tech Help - Software/Hardware etc

OpenVPN

chenks76 — Mon, 31 Oct 2016 13:03:32 GMT

anyone here using OpenVPN?

installed server on windows 10 using this tutorial (https://community.openvpn.net/openvpn/w ... dows_Guide)
installed the client on my android phone, copied the certs across and it connects up OK.
the phone gets a 10.8.x.x. IP address.
all good so far it seems.

however, i can't seem to see any of my local network devices when connected to the VPN, which are on the 192.168.x.x IP range.
do i need to do some more config for this to work?
i'm using a billion 8800NL router (with the appropriate UDP port open).

Re: OpenVPN

Anonymous — Mon, 31 Oct 2016 13:45:41 GMT

This is normally done using the VPN's profile where you add the new local network and mask to the list of accessible networks but where or how it's done using this software I can't say. But knowing this might help.

Re: OpenVPN

chenks76 — Mon, 31 Oct 2016 16:06:03 GMT

hmmmmm
the tutorial made no mention of that, but then i'm assuming the tutorial was to simply get the VPN working, which essentially it does.

Re: OpenVPN

Mml — Mon, 31 Oct 2016 19:15:48 GMT

If your subnet mask is 255.0.0.0 when connected to VPN then no wonder you cannot connect to devices on 192.168.x.x range. I would suggest either bringing these 2 ranges closer together - say, 192.168.1.x for LAN, 192.168.2.x for VPN, and use a subnet mask 255.255.254.0 - or create a bridged connection between VPN and LAN on your Win10 machine (of which I'm not too confident to advise, but in theory this is what is required).

Re: OpenVPN

chenks76 — Mon, 31 Oct 2016 19:57:53 GMT

openvpn gave me no options to set IP and/or subnet.

when connected to VPN
IP 10.8.0.x
subnet 255.255.255.252

when connected to local LAN
192.168.1.x
subnet 255.255.255.0

Re: OpenVPN

mssystems — Tue, 01 Nov 2016 10:16:49 GMT

.252 is a 30 bit subnet mask, which means you have exactly two host addresses. 10.8.0.1 and 10.8.0.2. That is not, in itself, a problem.

My experience with Open VPN is with Red Hat and Vyos/Vyatta rather than Windows.

Open VPN is presented as a routing interface, a little like a separate ethernet card. Traffic from the localhost is sent via the loopback interface (127.0.0.1), to the routing table, which applies the subnet mask to the destination address in the packet header and forwards to the Open VPN interface on the encrypted subnet.

If you can reach the server and ping it's 192.168.1.x address, but can not reach other devices on the subnet, you need 'forwarding' to be enabled on the server and you need the devices on the local subnet to forward packets bound for the encrypted subnet, to the server. That probably means adding an entry to the routing tables on those other devices.

The DOS commands,

>route print

>route add

Are your friends.

Re: OpenVPN

chenks76 — Tue, 01 Nov 2016 10:57:52 GMT

whilst connect to the VPN on my mobile

local IP 10.8.0.6
i can't ping 192.168.1.50 (which is the local IP of the windows 10 system that is running openvpn).
i can't ping 10.8.0.1 (which is the VPN local IP of the windows 10 system running openvpn).

Re: OpenVPN

mssystems — Tue, 01 Nov 2016 11:21:57 GMT

There will be a config file on the server. AIUI, on Windows it's named server.ovpn by default.

Look for the line that starts

server

And is followed by an IP and mask. You probably want to use

server 10.8.0.0 255.255.255.0

If there is a line which starts

server-bridge

You probably want to comment that out by inserting a semi colon ; in front of it.

And to connect to other devices on the 192.168.1.0 subnet, you would need

push "route 192.168.1.0 255.255.255.0"

Ref. https://openvpn.net/index.php/open-source/documentation/howto.html#server

Re: OpenVPN

chenks76 — Tue, 01 Nov 2016 12:03:01 GMT

in my server.ovpn file i have

server 10.8.0.0 255.255.255.0
server-bridge is already commented out
the push routes section has no current routes. i have added that line to the ovpn file.

i shall resart and see what happens.

Re: OpenVPN

chenks76 — Tue, 01 Nov 2016 12:19:58 GMT

still no luck even after those changes.

Re: OpenVPN

MisterW — Tue, 01 Nov 2016 12:26:25 GMT

Maybe this https://blog.remibergsma.com/2013/01/13/howto-connect-to-hosts-on-a-remote-network-using-openvpn-and-some-routing/ might help

Re: OpenVPN

chenks76 — Tue, 01 Nov 2016 12:32:36 GMT

this is the connection log showing on phone when connected to VPN

Re: OpenVPN

chenks76 — Tue, 01 Nov 2016 12:43:59 GMT

@MisterW wrote:

Maybe this https://blog.remibergsma.com/2013/01/13/howto-connect-to-hosts-on-a-remote-network-using-openvpn-and-some-routing/ might help

hmm, i would need to add a route on the windows 10 system? or on the router?

Re: OpenVPN

mssystems — Tue, 01 Nov 2016 12:51:25 GMT

Can you post your server config file?

I don't need to see any of the comment lines starting # or ;

I do need to see the server directives.

Re: OpenVPN

chenks76 — Tue, 01 Nov 2016 13:33:07 GMT

these are all settings that aren't commented out

port 1194
proto udp
dev tun
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem"
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.1.0 255.255.255.0"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

Re: OpenVPN

mssystems — Tue, 01 Nov 2016 14:04:02 GMT

Try this. Comment out the lines, as shown and add the ifconfig-pool directive.

; ifconfig-pool-persist ipp.txt

; persist-tun

ifconfig-pool 10.8.0.33 10.8.0.46 255.255.255.0

Connect your client and check it get's an IP from the pool, with a 255.255.255.0 netmask, then try pinging the server gateway 10.8.0.1

Re: OpenVPN

chenks76 — Tue, 01 Nov 2016 14:22:52 GMT

whatever that has done has made the server service to start on the windows 10 system
the openvpn server couldn't connect.

i have reverted and the service now starts and connects as previous.

Re: OpenVPN

mssystems — Tue, 01 Nov 2016 15:33:37 GMT

Oh hell, you made me read my notes.

Essentially the problem you have is Open VPN is defaulting to the old "net30" topology which was supposed to be deprecated with Open VPN 2.3. Net30 was required by Windows clients, back in the early days - like for Windows NT 3.1

Have a look on your Open VPN server for a folder named "ccd" which is short for Client Configuration Directory. The Linux path is usually /etc/openvpn/ccd Not a clue where it is on Windows. Anyhow, inside you should find a file corresponding to the CN name on the client's certificate - Often, "client1" Post the contents, as the directives may override the server directive.

You should also be able to find a file called ipp.txt which contains persistent IP mappings, which are written dynamically the first time a client connects. Until you have the tunnel working, it's an idea to delete or rename ipp.txt, each time you restart the server.

Re: OpenVPN

chenks76 — Tue, 01 Nov 2016 15:50:16 GMT

i don't seem to have a folder anywhere called "ccd" nor a file called "ipp.txt"

Re: OpenVPN

mssystems — Wed, 02 Nov 2016 08:16:03 GMT

Oh hell. Now I installed OpenVPN on a Windows 10 VM

You can have the server create an ipp.txt file by specifying a path

ifconfig-pool-persist "C:\\Program Files\\OpenVPN\\config\\ipp.txt"

You can adjust the log level to something more useful for debugging, by altering the verb and mute directives

verb 5
mute 20

I think I might have found your issue, in the sample configuration files. It looks like Windows defaults to net30 unless you specify the topology directive in the server config - The topology directive is deprecated on Linux and does not even get a mention on the man page.

topology subnet

Still waiting for my Android tablet to charge up but in the meantime, give the topology directive a go.