headers
Holger Stratmann | 1 Sep 2006 02:17
Picon

problem reaching server side subnet

Hello everybody,

I have a little problem configuring the routing to (or from?!) the 
"remote subnet".
On my own computer (WinXP), I use ethernet bridging and everything works 
just perfectly :-)

Now I want to install OpenVPN on a computer in the office and of course 
all the available "servers" don't have WinXP, but Win 2000 or Win 2003 
SBS (Small Business Server?).
I guess that means I cannot use ethernet bridging? Too bad :-(
Unfortunately, I'm not familiar with "routing configuration".

Can anybody help me please? :-)

I have the server (A), a machine on the server's subnet (B) and the 
client (C, WinXP).

I have configured the server and the client and I can connect.

The server's "internal IP" is 192.168.2.240, B has 192.168.2.200.
When connected, the client gets the IP 10.8.0.6.
 From the client, I can ping 10.8.0.1 AND I can also ping 192.168.2.240. 
I guess that's a good start...

However, I can NOT ping 192.168.2.200 (which, unfortunately, is the only 
thing that currently really matters...)
On the server, I added this:
push "route 192.168.2.0 255.255.255.0"
(Continue reading)

Permalink | Reply | 4 comments |
headers
한승기 | 1 Sep 2006 06:35
Picon

IPX Packet drop?

I try to make gaming network like hamachi for our guild.
It's almost done except one things.

I can connect someone who using private lan with NAT.

like this.

[192.168.0.x]<-192.168.0.1(router) <- ovpn server <- me
[192.168.0.x]

but I can't connect opposite.

[192.168.0.x]->192.168.0.1(router) -> ovpn server -> me
[192.168.0.x]

so, i check up some properties. and i found follow.

everything fine we are not connected by the game.

but when i got message like 'connection from 192.168.0.x blah~' from
my game server.

ping response is suddenly grow up very high. (about 2000~3000ms)
and few second later, it's turn to timeout messages.

and then, we try to terminate game app. it turns back to normal.

how can i solve that problem? if we use hamachi instead. it works fine under

every situation. so, i have no idea.
(Continue reading)

Permalink | Reply | 1 comment |
headers
Sturla Holm Hansen | 1 Sep 2006 07:43
Picon

Re: ifconfig-push

If I try to put in a netmask instead of the last 10.8.0.x I get an error
in /var/log/daemon.log that this needs to be an ip not a netmask.
After some reading I tried to put "ifconfig-push 10.8.0.x 10.8.0.1" in all
the clients ccd-files, this seemed to work as all the clients now got the
ip I had assigned in the ccd-file for that client, but only one client can
route the local subnet.
All clients have access to the servers subnet, but only one client-subnet
has access to the server-subnet.
The routing-table on the server says:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.8.0.2        *               255.255.255.255 UH    0      0        0 tun0
81.191.132.0    *               255.255.255.0   U     0      0        0 eth1
10.13.13.0      10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.13.10.0      *               255.255.255.0   U     0      0        0 tun1
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
192.168.0.0     *               255.255.255.0   U     0      0        0 eth0
10.14.15.0      10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.14.14.0      10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.10.10.0      *               255.255.255.0   U     0      0        0 tun1
default         <my public ip>  0.0.0.0         UG    0      0        0 eth1

10.13.13.0, 10.14.14.0 and 10.14.15.0 are client-subnets for clients 1,2
and 3.
I have no idea what 10.13.10.0 and 10.10.10.0 is or where it comes from, I
don't understand what 10.8.0.2 is either.

My server.conf-file is:
(Continue reading)

Permalink | Reply | 3 comments |
headers
Sturla Holm Hansen | 1 Sep 2006 07:58
Picon

Re: ifconfig-push

Sorry to have bothered you all, for some stupid reason it just started to
work after I sent the last mail, if anyone sees an obvious flaw in my
setup or have suggestions for improvements I would still appreciate it
though :)
Oh, and another thing: I saw this in the documentation once but can't seem
to find it again: How do you route between client-subnets, so that a
computer in the subnet of client1 can reach a computer in the subnet of
client2 that is?

Cheerio

Sturla

On Fri, September 1, 2006 07:43, Sturla Holm Hansen wrote:
> If I try to put in a netmask instead of the last 10.8.0.x I get an error
> in /var/log/daemon.log that this needs to be an ip not a netmask.
> After some reading I tried to put "ifconfig-push 10.8.0.x 10.8.0.1" in all
> the clients ccd-files, this seemed to work as all the clients now got the
> ip I had assigned in the ccd-file for that client, but only one client can
> route the local subnet.
> All clients have access to the servers subnet, but only one client-subnet
> has access to the server-subnet.
> The routing-table on the server says:
>
> Kernel IP routing table
> Destination     Gateway         Genmask         Flags Metric Ref    Use
> Iface
> 10.8.0.2        *               255.255.255.255 UH    0      0        0
> tun0
> 81.191.132.0    *               255.255.255.0   U     0      0        0
(Continue reading)

Permalink | Reply | 2 comments |
headers
Konstantin Boyandin | 1 Sep 2006 11:35
Picon

OpenVPN bridge mode problems: Windows client disrupts connectivity

Greetings,

I have used OpenVPN in route mode, and everything went quite well. Now
I try to set up the bridge mode, since Windows users wish to see their
domain in network neighborhood and so on.

The setup:

Intranet network: 10.0.0/24
OpenVPN server intranet address: 10.0.0.24
OpenVPN internal network: 10.111.0/24
OPenVPN server OS: FC5

Here is the set up data.

First, this is the script to start bridging:

====== script below
modprobe tun
modprobe bridge

openvpn --mktun --dev tap0

brctl addbr br0
brctl setfd br0 0
brctl addif br0 eth0
brctl addif br0 tap0

ifconfig tap0 0.0.0.0 promisc up
ifconfig eth0 0.0.0.0 promisc up
(Continue reading)

Permalink | Reply | 2 comments |
headers
Les Mikesell | 1 Sep 2006 14:41
Picon

Re: OpenVPN bridge mode problems: Windows client disrupts connectivity

On Fri, 2006-09-01 at 04:35, Konstantin Boyandin wrote:

> I have used OpenVPN in route mode, and everything went quite well. Now
> I try to set up the bridge mode, since Windows users wish to see their
> domain in network neighborhood and so on.

Isn't setting up a common WINs server enough to make this happen
on a routed network?

--

-- 
  Les Mikesell
   lesmikesell <at> gmail.com

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
Permalink | Reply | 0 comments |
headers
RichardJQ | 1 Sep 2006 14:43

CA same on client and server?

Is it required that the CA for the client be the same as the CA for the 
server?

What I want to have is.
client 1 gets crt from CA x.
server gets crt from CA y.

server and client would trust both x.crt and y.crt.

Is this possible?

Thanks.

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
Permalink | Reply | 1 comment |
headers
Charles Duffy | 1 Sep 2006 14:47
Favicon

Re: Bridging mode works on one Windows client, but not another! Why?

siegfried wrote:
> I have the openvpn server working on my wrt54g/openwrt router. It works 
> with SuSE 10 notebook client and a WinXP Pro client (also a notebook, it 
> is called sales). I have a new notebook also running WinXP Pro (called 
> sheintze) which does not successfully connect. When I look at the server 
> log, I see connection refused when sheintze tries to connect.

I'd need to see the relevant log snippet to be sure, but it sounds like 
the server is having the packets it sends to sheintze rejected. If this 
is the case, it could well be a firewall rule -- either on the host 
itself or somewhere between the two systems. Is sheintze on the same 
network segment you're testing sales from (such that you can rule out 
differences in firewall configuration between the two systems -- such as 
a buggy NAT implementation at one end)? If so, does it have any 
3rd-party network security software installed (which might be preventing 
incoming connections without having OpenVPN, or the port it uses, 
explicitly on a whitelist)?

A tool like Wireshark (formerly Ethereal) should make it straightforward 
for you to see if packets from the server ever reach the client, or to 
view packet dumps made with tcpdump on your OpenWRT unit itself.

Are you using TCP or UDP? If it's an overly restrictive firewall or a 
router with an iffy NAT implementation, switching to TCP might provide a 
workaround (at a cost in performance and reliability).

> I installed openvpn on sales this spring. I don’t know what version – 
> how do I tell?

Look at the messages printed at the beginning of the OpenVPN connect log.
(Continue reading)

Permalink | Reply | 0 comments |
headers
Maciej Gawinecki | 1 Sep 2006 14:48
Picon

Re: RMI works in one direction in VPN

Unfortunately I have to use this RMI-based application. Setting 
/"java.rmi.server.hostname"/ system property at the server side fixed 
that problem.

Thank you for your support
Maciej

Charles Duffy napisał(a):
> First, a moment of personal opinion:
> 
> In terms of how its over-the-wire behavior is designed, Java RMI is 
> *absolutely horrific*. There's no excuse whatsoever -- in this day of 
> ubiquitous NAT -- for a network protocol to require that the remote side 
> initiate a separate connection in the opposite direction using an 
> address the server provides as the location it thinks it lives at.
> 
> 
> You can work around this (not for getting through NAT, but for the 
> multihomed server providing the wrong address to give to the client as 
> the place to initiate the callback from -- which is quite possibly what 
> you're seeing) by setting java.rmi.server.hostname to the IP address of 
> the server on the VPN. See 
> http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4880793 for some 
> general background and info and useful links and such.
> 
> Also -- it's been a while (over a year now) since I last dealt with 
> this, so I may remember the issues a bit differently than they actually 
> are. What I *do* recall is that Java RMI is an evil, evil, horrible... 
> oh, well, you get the idea. And that setting java.rmi.server.hostname to 
> the right address is important for getting it working correctly when the
(Continue reading)

Permalink | Reply | 0 comments |
headers
Charles Duffy | 1 Sep 2006 14:54
Favicon

Re: problem reaching server side subnet

Holger Stratmann wrote:
> Is 192.168.0.5 correct as a gateway? I cannot ping that one.

Yes. See http://openvpn.net/faq.html#slash30

> The other thing I noticed is this:
> # Push routes to the client to allow it
> # to reach other private subnets behind
> # the server.  Remember that these
> # private subnets will also need
> # to know to route the OpenVPN client
> # address pool (10.8.0.0/255.255.255.0)
> # back to the OpenVPN server.
> 
> How would I do that?
> I don't currently have access to the server's DHCP-config.
> Do I have to add the route to each computer on the server's subnet?

See http://openvpn.net/howto.html#scope

Instead of adding the route to each computer on the subnet, you can add 
it only to the system which is acting as default gateway for that subnet.

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
Permalink | Reply | 3 comments |

Gmane