• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

OpenVPN Problem

jmcoreymv

Diamond Member
Here's my goal:
There are two computers, A and B, both running WinXP SP2 Pro. Both have fast internet connections but B is behind a firewall that only lets a select few ports through (such as 80). A is behind a home NAT router. A's network is 192.168.0.0/8 which has the NAT router on it as well (192.168.0.1).

What I want to do is setup OpenVPN server on A, and OpenVPN client on B. Then I want to tunnel a VPN connection from B to A and then use A's internet to serve all my internet requests at B.

What I've done so far:

I've setup the software on both computers and generated all the necessary authentication keys. I setup the VPN tunnel so that the server is 10.8.0.1 and the client is 10.8.0.6 when connected.

The problem:

The OpenVPN client says that it is connected and was assigned 10.8.0.6, however it cannot ping the VPN server (10.8.0.1). I have disabled all firewalls for now to make sure that is not affecting it. When I check ipconfig for the client, the VPN network adapter IP is in the 169 range so it did not pickup the 10.8.0.6 for some reason. Also on the VPN server, which is assigned 10.8.0.1, Windows XP did not tie 10.8.0.1 to the TAP adapter either. I've tried following the HOWTO on the OpenVPN site exactly but I am still having issues.

Server config file: (for people who have used OpenVPN)

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.0.0 255.255.255.0"
;push "redirect-gateway"
push "dhcp-option DNS 10.8.0.1"
push "dhcp-option WINS 10.8.0.1"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

Client config file:

client
dev tun
proto udp
remote 192.168.0.7 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
comp-lzo
verb 3
route-delay 10

Server Log File Output:

Wed Dec 14 18:45:10 2005 OpenVPN 2.0.5 Win32-MinGW [SSL] [LZO] built on Nov 2 2005
Wed Dec 14 18:45:10 2005 Diffie-Hellman initialized with 1024 bit key
Wed Dec 14 18:45:10 2005 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Dec 14 18:45:10 2005 TAP-WIN32 device [Local Area Connection 3] opened: \\.\Global\{1272A83A-F7E8-416B-9818-94C93E69BA6E}.tap
Wed Dec 14 18:45:10 2005 TAP-Win32 Driver Version 8.1
Wed Dec 14 18:45:10 2005 TAP-Win32 MTU=1500
Wed Dec 14 18:45:10 2005 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.1/255.255.255.252 on interface {1272A83A-F7E8-416B-9818-94C93E69BA6E} [DHCP-serv: 10.8.0.2, lease-time: 31536000]
Wed Dec 14 18:45:10 2005 Sleeping for 10 seconds...
Wed Dec 14 18:45:20 2005 Successful ARP Flush on interface [3] {1272A83A-F7E8-416B-9818-94C93E69BA6E}
Wed Dec 14 18:45:20 2005 route ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.2
Wed Dec 14 18:45:20 2005 Warning: route gateway is not reachable on any active network adapters: 10.8.0.2
Wed Dec 14 18:45:20 2005 Route addition via IPAPI failed
Wed Dec 14 18:45:20 2005 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Dec 14 18:45:20 2005 UDPv4 link local (bound): [undef]:1194
Wed Dec 14 18:45:20 2005 UDPv4 link remote: [undef]
Wed Dec 14 18:45:20 2005 MULTI: multi_init called, r=256 v=256
Wed Dec 14 18:45:20 2005 IFCONFIG POOL: base=10.8.0.4 size=62
Wed Dec 14 18:45:20 2005 IFCONFIG POOL LIST
Wed Dec 14 18:45:20 2005 client1,10.8.0.4
Wed Dec 14 18:45:20 2005 Initialization Sequence Completed
Wed Dec 14 18:47:01 2005 MULTI: multi_create_instance called
Wed Dec 14 18:47:01 2005 192.168.0.5:1634 Re-using SSL/TLS context
Wed Dec 14 18:47:01 2005 192.168.0.5:1634 LZO compression initialized
Wed Dec 14 18:47:01 2005 192.168.0.5:1634 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Dec 14 18:47:01 2005 192.168.0.5:1634 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Dec 14 18:47:01 2005 192.168.0.5:1634 Local Options hash (VER=V4): '530fdded'
Wed Dec 14 18:47:01 2005 192.168.0.5:1634 Expected Remote Options hash (VER=V4): '41690919'
Wed Dec 14 18:47:01 2005 192.168.0.5:1634 TLS: Initial packet from 192.168.0.5:1634, sid=dcd67c45 5fb6213b
Wed Dec 14 18:47:01 2005 192.168.0.5:1634 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=Test/CN=OpenVPN-CA/emailAddress=test@mail.com
Wed Dec 14 18:47:01 2005 192.168.0.5:1634 VERIFY OK: depth=0, /C=US/ST=CA/O=Test/CN=client1/emailAddress=test@mail.com
Wed Dec 14 18:47:01 2005 192.168.0.5:1634 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Dec 14 18:47:01 2005 192.168.0.5:1634 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Dec 14 18:47:01 2005 192.168.0.5:1634 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Dec 14 18:47:01 2005 192.168.0.5:1634 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Dec 14 18:47:01 2005 192.168.0.5:1634 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Dec 14 18:47:01 2005 192.168.0.5:1634 [client1] Peer Connection Initiated with 192.168.0.5:1634
Wed Dec 14 18:47:01 2005 client1/192.168.0.5:1634 MULTI: Learn: 10.8.0.6 -> client1/192.168.0.5:1634
Wed Dec 14 18:47:01 2005 client1/192.168.0.5:1634 MULTI: primary virtual IP for client1/192.168.0.5:1634: 10.8.0.6
Wed Dec 14 18:47:02 2005 client1/192.168.0.5:1634 PUSH: Received control message: 'PUSH_REQUEST'
Wed Dec 14 18:47:02 2005 client1/192.168.0.5:1634 SENT CONTROL [client1]: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,dhcp-option DNS 10.8.0.1,dhcp-option WINS 10.8.0.1,route 10.8.0.1,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

Client Log File Output:
Wed Dec 14 18:51:04 2005 OpenVPN 2.0.5 Win32-MinGW [SSL] [LZO] built on Nov 2 2005
Wed Dec 14 18:51:04 2005 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA. OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Wed Dec 14 18:51:04 2005 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Wed Dec 14 18:51:04 2005 LZO compression initialized
Wed Dec 14 18:51:04 2005 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Dec 14 18:51:04 2005 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Dec 14 18:51:04 2005 Local Options hash (VER=V4): '41690919'
Wed Dec 14 18:51:04 2005 Expected Remote Options hash (VER=V4): '530fdded'
Wed Dec 14 18:51:04 2005 UDPv4 link local: [undef]
Wed Dec 14 18:51:04 2005 UDPv4 link remote: 192.168.0.7:1194
Wed Dec 14 18:51:04 2005 TLS: Initial packet from 192.168.0.7:1194, sid=31c92491 49195931
Wed Dec 14 18:51:04 2005 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=Test/CN=OpenVPN-CA/emailAddress=test@mail.com
Wed Dec 14 18:51:04 2005 VERIFY OK: depth=0, /C=US/ST=CA/O=SanFrancisco/CN=server/emailAddress=test@mail.com
Wed Dec 14 18:51:04 2005 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Dec 14 18:51:04 2005 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Dec 14 18:51:04 2005 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Dec 14 18:51:04 2005 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Dec 14 18:51:04 2005 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Dec 14 18:51:04 2005 [server] Peer Connection Initiated with 192.168.0.7:1194
Wed Dec 14 18:51:05 2005 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Dec 14 18:51:05 2005 PUSH: Received control message: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,dhcp-option DNS 10.8.0.1,dhcp-option WINS 10.8.0.1,route 10.8.0.1,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Wed Dec 14 18:51:05 2005 OPTIONS IMPORT: timers and/or timeouts modified
Wed Dec 14 18:51:05 2005 OPTIONS IMPORT: --ifconfig/up options modified
Wed Dec 14 18:51:05 2005 OPTIONS IMPORT: route options modified
Wed Dec 14 18:51:05 2005 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Dec 14 18:51:05 2005 TAP-WIN32 device [Local Area Connection 4] opened: \\.\Global\{50515D19-5E4B-4373-B7A0-46CC94F23C1E}.tap
Wed Dec 14 18:51:05 2005 TAP-Win32 Driver Version 8.1
Wed Dec 14 18:51:05 2005 TAP-Win32 MTU=1500
Wed Dec 14 18:51:05 2005 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {50515D19-5E4B-4373-B7A0-46CC94F23C1E} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Wed Dec 14 18:51:05 2005 Successful ARP Flush on interface [131076] {50515D19-5E4B-4373-B7A0-46CC94F23C1E}
Wed Dec 14 18:51:43 2005 TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Wed Dec 14 18:51:43 2005 Route: Waiting for TUN/TAP interface to come up...
Wed Dec 14 18:51:44 2005 TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Wed Dec 14 18:51:44 2005 route ADD 192.168.0.0 MASK 255.255.255.0 10.8.0.5
Wed Dec 14 18:51:44 2005 Warning: route gateway is not reachable on any active network adapters: 10.8.0.5
Wed Dec 14 18:51:44 2005 Route addition via IPAPI failed
Wed Dec 14 18:51:44 2005 route ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Wed Dec 14 18:51:44 2005 Warning: route gateway is not reachable on any active network adapters: 10.8.0.5
Wed Dec 14 18:51:44 2005 Route addition via IPAPI failed
Wed Dec 14 18:51:44 2005 Initialization Sequence Completed With Errors ( see http://openvpn.net/faq.html#dhcpclientserv )


The first thing I'm trying to fix is that the TAP Win-32 Adapter in windows is not picking up the 10.8.0.6 assigned IP even though DHCP is enabled. Any ideas?
 
Back
Top