LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 04-16-2019, 01:51 PM   #1
drobe504
LQ Newbie
 
Registered: Apr 2019
Posts: 2

Rep: Reputation: Disabled
OpenVpn Authenticates but cannot connect to LAN


I'm attempting to connect to a company vpn. I have 3 machines running:
OSX: connects fine via tunnelblick
Windows: connects fine via OpenVPN client gui
ArchLinux: using openvpn, authenticates succeeds, but does not allow me to access the company LAN, or at least not web traffic.

I've disabled both router and computer firewalls with no success.

All 3 machines are using this config:
Code:
auth SHA256
auth-nocache
auth-user-pass
ca /etc/openvpn/client/ca.crt
cipher AES-256-CBC
client
dev tun
hand-window 15
mute 20
mute-replay-warnings
nobind
persist-key
persist-tun
remote vpn.myvpn.io 1194 udp
remote vpn.myvpn.io 443 tcp-client
remote-cert-tls server
resolv-retry infinite
tls-crypt /etc/openvpn/client/tc.key
verb 3
verify-x509-name *.myvpn.io name
Code:
sudo openvpn /etc/openvpn/client/client.conf
yields
Code:
Tue Apr 16 13:49:14 2019 WARNING: file '/etc/openvpn/client/tc.key' is group or others accessible
Tue Apr 16 13:49:14 2019 OpenVPN 2.4.7 [git:makepkg/2b8aec62d5db2c17+] x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 19 2019
Tue Apr 16 13:49:14 2019 library versions: OpenSSL 1.1.1b  26 Feb 2019, LZO 2.10
Enter Auth Username: dan
Enter Auth Password: ****************
Tue Apr 16 13:49:17 2019 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Tue Apr 16 13:49:17 2019 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Apr 16 13:49:17 2019 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Tue Apr 16 13:49:17 2019 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Apr 16 13:49:17 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]52.2.209.3:1194
Tue Apr 16 13:49:17 2019 Socket Buffers: R=[212992->212992] S=[212992->212992]
Tue Apr 16 13:49:17 2019 UDP link local: (not bound)
Tue Apr 16 13:49:17 2019 UDP link remote: [AF_INET]52.2.209.3:1194
Tue Apr 16 13:49:17 2019 TLS: Initial packet from [AF_INET]52.2.209.3:1194, sid=d26b565d 82d80d65
Tue Apr 16 13:49:17 2019 VERIFY OK: depth=2, C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
Tue Apr 16 13:49:17 2019 VERIFY OK: depth=1, C=BE, O=GlobalSign nv-sa, CN=AlphaSSL CA - SHA256 - G2
Tue Apr 16 13:49:17 2019 VERIFY KU OK
Tue Apr 16 13:49:17 2019 Validating certificate extended key usage
Tue Apr 16 13:49:17 2019 ++ Certificate has EKU (str) TLS Web Server Authentication, expects
TLS Web Server Authentication
Tue Apr 16 13:49:17 2019 VERIFY EKU OK
Tue Apr 16 13:49:17 2019 VERIFY X509NAME OK: OU=Domain Control Validated, CN=*.myvpn.io
Tue Apr 16 13:49:17 2019 VERIFY OK: depth=0, OU=Domain Control Validated, CN=*.myvpn.io
Tue Apr 16 13:49:18 2019 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Apr 16 13:49:18 2019 [*.mpvpn.io] Peer Connection Initiated with [AF_INET]52.2.209.3:1194
Tue Apr 16 13:49:19 2019 SENT CONTROL [*.myvpn.io]: 'PUSH_REQUEST' (status=1)
Tue Apr 16 13:49:19 2019 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 172.20.0.2,dhcp-option DOMAIN myvpn.io,route 10.0.80.0 255.255.255.128,route 10.106.157.0 255.255.255.240,route 10.106.196.64 255.255.255.192,route 10.32.16.0 255.255.255.248,route 10.32.180.128 255.255.255.248,route 10.32.20.48 255.255.255.248,route 10.32.80.128 255.255.255.192,route 172.20.0.0 255.255.0.0,route 172.23.16.0 255.255.254.0,route-gateway 172.23.1.1,topology subnet,ping 10,ping-restart 120,ifconfig 172.23.1.24 255.255.255.128,peer-id 12,cipher AES-256-GCM'
Tue Apr 16 13:49:19 2019 OPTIONS IMPORT: timers and/or timeouts modified
Tue Apr 16 13:49:19 2019 OPTIONS IMPORT: --ifconfig/up options modified
Tue Apr 16 13:49:19 2019 OPTIONS IMPORT: route options modified
Tue Apr 16 13:49:19 2019 OPTIONS IMPORT: route-related options modified
Tue Apr 16 13:49:19 2019 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Apr 16 13:49:19 2019 OPTIONS IMPORT: peer-id set
Tue Apr 16 13:49:19 2019 OPTIONS IMPORT: adjusting link_mtu to 1624
Tue Apr 16 13:49:19 2019 OPTIONS IMPORT: data channel crypto options modified
Tue Apr 16 13:49:19 2019 Data Channel: using negotiated cipher 'AES-256-GCM'
Tue Apr 16 13:49:19 2019 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Apr 16 13:49:19 2019 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Apr 16 13:49:19 2019 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=enp3s0 HWADDR=30:9c:23:1b:07:0d
Tue Apr 16 13:49:19 2019 TUN/TAP device tun0 opened
Tue Apr 16 13:49:19 2019 TUN/TAP TX queue length set to 100
Tue Apr 16 13:49:19 2019 /usr/bin/ip link set dev tun0 up mtu 1500
Tue Apr 16 13:49:19 2019 /usr/bin/ip addr add dev tun0 172.23.1.24/25 broadcast 172.23.1.127
Tue Apr 16 13:49:19 2019 /usr/bin/ip route add 10.0.80.0/25 via 172.23.1.1
Tue Apr 16 13:49:19 2019 /usr/bin/ip route add 10.106.157.0/28 via 172.23.1.1
Tue Apr 16 13:49:19 2019 /usr/bin/ip route add 10.106.196.64/26 via 172.23.1.1
Tue Apr 16 13:49:19 2019 /usr/bin/ip route add 10.32.16.0/29 via 172.23.1.1
Tue Apr 16 13:49:19 2019 /usr/bin/ip route add 10.32.180.128/29 via 172.23.1.1
Tue Apr 16 13:49:19 2019 /usr/bin/ip route add 10.32.20.48/29 via 172.23.1.1
Tue Apr 16 13:49:19 2019 /usr/bin/ip route add 10.32.80.128/26 via 172.23.1.1
Tue Apr 16 13:49:19 2019 /usr/bin/ip route add 172.20.0.0/16 via 172.23.1.1
Tue Apr 16 13:49:19 2019 /usr/bin/ip route add 172.23.16.0/23 via 172.23.1.1
Tue Apr 16 13:49:19 2019 Initialization Sequence Completed

Thanks in advance for any help!

Last edited by drobe504; 04-16-2019 at 01:55 PM.
 
Old 04-18-2019, 05:42 AM   #2
kaushalpatel1982
Member
 
Registered: Aug 2007
Location: INDIA
Distribution: CentOS, RHEL, Fedora, Debian, Ubuntu, LinuxMint, PCLinuxOS
Posts: 163

Rep: Reputation: 10
1. Check routes added properly in route table
2. try to ping remote gateway : 172.23.1.1
3. try traceroute
4. tcpdump on the PC and check traffic on tun interface
 
1 members found this post helpful.
Old 04-19-2019, 07:27 PM   #3
drobe504
LQ Newbie
 
Registered: Apr 2019
Posts: 2

Original Poster
Rep: Reputation: Disabled
The solution ended up being to use https://github.com/masterkorp/openvp...te-resolv-conf in the config.
 
Old 05-01-2019, 03:54 AM   #4
GarryJones
LQ Newbie
 
Registered: May 2019
Posts: 1

Rep: Reputation: 0
good post. Thanks for sharing with us..
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] xdm authenticates but does not start Xfce catkin Slackware 5 11-22-2012 04:22 AM
problems in freenx -- authenticates but then times out desimo Linux - Networking 3 07-11-2012 06:31 AM
xrdp authenticates but does not load X server (RDP) shadowsnipes Linux - Server 28 03-15-2012 03:08 AM
FC4 + madwifi + wpa_supplicant. Authenticates, but cannot connect to network jspam Linux - Wireless Networking 0 11-05-2005 03:21 AM
pam_mysql authenticates NOUSER cliffb53 Linux - Security 0 01-04-2004 12:47 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 04:04 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration