can't find openvpn key folder

prasanta · 09-21-2009, 10:45 AM

Oh, you have the following,

Home LAN (Private IP)-> Gateway (Both LAN IP, WAN IP) -> Internet.

Your VPN server is sitting,

Home LAN (Private IP)-> VPN server (Private IP) -> Gateway (Both LAN IP, WAN IP) -> Internet.

You are on the same LAN? In that case I don't think OpenVPN will work. Anyway I am not sure what is blocking the traffic. Can you do an ssh to outside server?

Regards,

--
Prasanta

qwertyjjj · 09-21-2009, 10:49 AM

Quote:

Originally Posted by prasanta

Oh, you have the following,

Home LAN (Private IP)-> Gateway (Both LAN IP, WAN IP) -> Internet.

Your VPN server is sitting,

Home LAN (Private IP)-> VPN server (Private IP) -> Gateway (Both LAN IP, WAN IP) -> Internet.

You are on the same LAN? In that case I don't think OpenVPN will work. Anyway I am not sure what is blocking the traffic. Can you do an ssh to outside server?

Regards,

--
Prasanta

No, the server is on another site, completely different network.
Home PC connected to ISP gateway with WAN IP 86.xxx.xxx.xxx
I then start the VPN to connect to my server
It connects and I am given the IP 10.8.0.6
I can ping 10.8.0.1
My server has it's own WAN IP of 88.xxx.xxx.xxx
However, when I open up a client browser and go the site www.whatsmyip.org it still gives me 86.xxx.xxx.xxx
The VPN connection means that that site should be showing my IP as 88.xxx.xxx.xxx but it is not doing this.

prasanta · 09-21-2009, 11:12 AM

Yes, that true. The outgoing IP address should be 88.x.x.x. Something is meesy in the client side I assume, not sure but. Could you check the default gateway on the client machine. It should be in 10.8.x.x.

Regards,

--
Prasanta

qwertyjjj · 09-21-2009, 11:21 AM

Quote:

Originally Posted by prasanta

Yes, that true. The outgoing IP address should be 88.x.x.x. Something is meesy in the client side I assume, not sure but. Could you check the default gateway on the client machine. It should be in 10.8.x.x.

Regards,

--
Prasanta

This is my Windows client IPConfig:
http://www.sidekicker.net/connect2.jpg

prasanta · 09-21-2009, 11:46 AM

I hope this post helps,

http://openvpn.net/archive/openvpn-u.../msg00234.html

Just add the default gateway and check.

Regards,

--
Prasanta

qwertyjjj · 09-21-2009, 11:57 AM

Quote:

Originally Posted by prasanta

I hope this post helps,

http://openvpn.net/archive/openvpn-u.../msg00234.html

Just add the default gateway and check.

Regards,

--
Prasanta

I added this to the server.conf

Code:

push "redirect-gateway def1"
push "dhcp-option DNS 10.8.0.1"

However, now when I start openvpn I get:

Code:

[root@localhost keys]# Mon Sep 21 17:56:22 2009 OpenVPN 2.0.9 i386-redhat-linux-gnu [SSL] [LZO] [EPOLL] built on Mar  8 2007
Mon Sep 21 17:56:22 2009 Diffie-Hellman initialized with 1024 bit key
Mon Sep 21 17:56:22 2009 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Sep 21 17:56:22 2009 TCP/UDP: Socket bind failed on local address [undef]:1194: Address already in use
Mon Sep 21 17:56:22 2009 Exiting

When I add this to the client config, the VPN connects but I cannot browse any websites at all:
--redirect-gateway

prasanta · 09-21-2009, 12:00 PM

I don't think that is going to help. Anyway please do try. Since the process is already running you are getting this error.

ps aux| grep openvpn

Kill the process using `kill` command. And start the server again.

Regards,

--
Prasanta

qwertyjjj · 09-21-2009, 12:07 PM

Quote:

Originally Posted by prasanta

I don't think that is going to help. Anyway please do try. Since the process is already running you are getting this error.

ps aux| grep openvpn

Kill the process using `kill` command. And start the server again.

Regards,

--
Prasanta

Is it the client configuration that I need to change?
I tried adding --redirect-gateway but when I did that, the client connected but I could not view any websites at all - they all returned a host not found error.

qwertyjjj · 09-21-2009, 12:12 PM

Quote:

Originally Posted by prasanta

I don't think that is going to help. Anyway please do try. Since the process is already running you are getting this error.

ps aux| grep openvpn

Kill the process using `kill` command. And start the server again.

Regards,

--
Prasanta

When I add those 2 server configurations and connect via VPN, all websites are now blocked. Does this mean the connection is now going via VPN but perhaps something on the server firewall is blocking access to 10.8.0.6 ?
If the connection was still direct I would be able to see websites but now I get nothing until I disconnect from VPN - then I can browse websites successfully again.

prasanta · 09-21-2009, 12:13 PM

Yes. That might be one cause.

Just use redirect-gateway and then try browsing using the IP, http://10..8.x.x./sarg

http://ubuntuforums.org/showthread.php?t=727471

Regards,

--
Prasanta

qwertyjjj · 09-21-2009, 12:21 PM

Quote:

Originally Posted by prasanta

Yes. That might be one cause.

Just use redirect-gateway and then try browsing using the IP, http://10..8.x.x./sarg

http://ubuntuforums.org/showthread.php?t=727471

Regards,

--
Prasanta

I cannot browse any website on the client.
I cannot browse any 10.8.x.x website.
However, if I connect to http://88.xxx.xxx.xxx/sarg/ then I get a response. This is possibly because my iptables only allows a port 80 connection on that IP address and apache is only listening on that port and that IP address.
What should I add to my iptables to try this, do I need to add 10.x addresses?

I also see this on the server:

Code:

Mon Sep 21 18:09:12 2009 myfirst.cert/86.xxx.xxx.xx:4277 SENT CONTROL [myfirst.cert]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 10.8.0.1,route 10.8.0.1,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Mon Sep 21 18:09:24 2009 myfirst.cert/86.xxx.xxx.xx:4277 MULTI: bad source address from client [192.168.0.2], packet dropped
Mon Sep 21 18:09:24 2009 myfirst.cert/86.xxx.xxx.xx:4277 MULTI: bad source address from client [192.168.0.2], packet dropped
Mon Sep 21 18:09:24 2009 myfirst.cert/86.xxx.xxx.xx:4277 MULTI: bad source address from client [192.168.0.2], packet dropped
Mon Sep 21 18:09:24 2009 myfirst.cert/86.xxx.xxx.xx:4277 MULTI: bad source address from client [192.168.0.2], packet dropped
Mon Sep 21 18:09:24 2009 myfirst.cert/86.xxx.xxx.xx:4277 MULTI: bad source address from client [192.168.0.2], packet dropped
Mon Sep 21 18:09:24 2009 myfirst.cert/86.xxx.xxx.xx:4277 MULTI: bad source address from client [192.168.0.2], packet dropped
Mon Sep 21 18:09:24 2009 myfirst.cert/86.xxx.xxx.xx:4277 MULTI: bad source address from client [192.168.0.2], packet dropped

prasanta · 09-21-2009, 12:29 PM

The VPN server is standalone with public IP address? In that case you need to write a rule, enable ip_forward etc.

Regards,

--
Prasanta

qwertyjjj · 09-21-2009, 12:36 PM

Quote:

Originally Posted by prasanta

The VPN server is standalone with public IP address? In that case you need to write a rule, enable ip_forward etc.

Regards,

--
Prasanta

What do I forward though?
DO I forward any 10.8.0.x IP address?
Or do I only forward port 1147?
And where do I forward it to, just the outgoing ports?

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to 88.xxx.xxx.xxx

or

iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

?

prasanta · 09-21-2009, 12:40 PM

That should do along with doing ip_foward=1.

Regards,

--
Prasanta

qwertyjjj · 09-21-2009, 12:41 PM

Quote:

Originally Posted by prasanta

That should do along with doing ip_foward=1.

Regards,

--
Prasanta

where does ip_forward=1 have to be set?
sysctl -w net.ipv4.ip_forward=1

So, this:
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to 88.xxx.xxx.xxx