Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My configuration of openvpn looks clean, but it's not working.

My server.conf:

proto udp
dev tun
ca keys/ca.crt
cert keys/bux-vpn-server.crt
key keys/bux-vpn-server.key  # This file should be kept secret
dh keys/dh1024.pem
server 10.66.77.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

When i execute:

/etc/openvpn# openvpn server.conf
Wed Feb 29 12:36:06 2012 OpenVPN 2.1.3 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Oct 22 2010
Wed Feb 29 12:36:06 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Feb 29 12:36:06 2012 Diffie-Hellman initialized with 1024 bit key
Wed Feb 29 12:36:06 2012 /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Wed Feb 29 12:36:06 2012 TLS-Auth MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Feb 29 12:36:06 2012 Socket Buffers: R=[124928->131072] S=[124928->131072]
Wed Feb 29 12:36:06 2012 ROUTE default_gateway=188.165.248.254
Wed Feb 29 12:36:06 2012 TUN/TAP device tun0 opened
Wed Feb 29 12:36:06 2012 TUN/TAP TX queue length set to 100
Wed Feb 29 12:36:06 2012 /sbin/ifconfig tun0 10.66.77.1 pointopoint 10.66.77.2 mtu 1500
Wed Feb 29 12:36:06 2012 /sbin/route add -net 10.66.77.0 netmask 255.255.255.0 gw 10.66.77.2
Wed Feb 29 12:36:06 2012 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Wed Feb 29 12:36:06 2012 GID set to nogroup
Wed Feb 29 12:36:06 2012 UID set to nobody
Wed Feb 29 12:36:06 2012 UDPv4 link local (bound): [undef]
Wed Feb 29 12:36:06 2012 UDPv4 link remote: [undef]
Wed Feb 29 12:36:06 2012 MULTI: multi_init called, r=256 v=256
Wed Feb 29 12:36:06 2012 IFCONFIG POOL: base=10.66.77.4 size=62
Wed Feb 29 12:36:06 2012 IFCONFIG POOL LIST
Wed Feb 29 12:36:06 2012 bux,10.66.77.4
Wed Feb 29 12:36:06 2012 Initialization Sequence Completed

If i connect with my client:

Wed Feb 29 12:37:30 2012 MULTI: multi_create_instance called
Wed Feb 29 12:37:30 2012 82.249.148.88:59397 Re-using SSL/TLS context
Wed Feb 29 12:37:30 2012 82.249.148.88:59397 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Feb 29 12:37:30 2012 82.249.148.88:59397 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Wed Feb 29 12:37:30 2012 82.249.148.88:59397 Local Options hash (VER=V4): '239669a8'
Wed Feb 29 12:37:30 2012 82.249.148.88:59397 Expected Remote Options hash (VER=V4): '3514370b'
Wed Feb 29 12:37:30 2012 82.249.148.88:59397 TLS: Initial packet from [AF_INET]82.249.148.88:59397, sid=3298ab9d 116d730e
Wed Feb 29 12:37:31 2012 82.249.148.88:59397 VERIFY OK: depth=1, /C=FR/ST=FR/L=Paris/O=bux/CN=bux-CA/emailAddress=sevajol.bastien@gmail.com
Wed Feb 29 12:37:31 2012 82.249.148.88:59397 VERIFY OK: depth=0, /C=FR/ST=FR/L=Peyruis/O=bux/CN=bux/emailAddress=sevajol.bastien@gmail.com
Wed Feb 29 12:37:31 2012 82.249.148.88:59397 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1541', remote='link-mtu 1542'
Wed Feb 29 12:37:31 2012 82.249.148.88:59397 WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
Wed Feb 29 12:37:31 2012 82.249.148.88:59397 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Feb 29 12:37:31 2012 82.249.148.88:59397 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 29 12:37:31 2012 82.249.148.88:59397 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Feb 29 12:37:31 2012 82.249.148.88:59397 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 29 12:37:31 2012 82.249.148.88:59397 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Feb 29 12:37:31 2012 82.249.148.88:59397 [bux] Peer Connection Initiated with [AF_INET]82.249.148.88:59397
Wed Feb 29 12:37:31 2012 bux/82.249.148.88:59397 MULTI: Learn: 10.66.77.6 -> bux/82.249.148.88:59397
Wed Feb 29 12:37:31 2012 bux/82.249.148.88:59397 MULTI: primary virtual IP for bux/82.249.148.88:59397: 10.66.77.6
Wed Feb 29 12:37:34 2012 bux/82.249.148.88:59397 PUSH: Received control message: 'PUSH_REQUEST'
Wed Feb 29 12:37:34 2012 bux/82.249.148.88:59397 SENT CONTROL [bux]: 'PUSH_REPLY,route 10.66.77.1,topology net30,ping 10,ping-restart 120,ifconfig 10.66.77.6 10.66.77.5' (status=1)

My client configuration:

client
dev tun
proto udp
remote 188.165.xxx.xxx 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca /home/bux/openvpn/ca.crt
cert /home/bux/openvpn/bux.crt
key /home/bux/openvpn/bux.key
ns-cert-type server
comp-lzo
verb 3

The connection is etablished on my client, but it's impossible to use it. Is there something wrong in my configuration ?

Edit 2: It look like comp-lzo was missing in server configuration. Now i can ping 10.66.77.1 with success.

share|improve this question
    
can you ping the gateway ? –  Lucas Kauffman Feb 29 '12 at 11:57
    
How do you intent to use the VPN? Are you trying to access the server's LAN? You'll need to push routes for that (and make sure the server is configured to allow ip forwarding). –  cjc Feb 29 '12 at 12:10
    
It doesn't like: PING 10.66.77.0 (10.66.77.0) 56(84) bytes of data. --- 10.66.77.0 ping statistics --- 6 packets transmitted, 0 received, 100% packet loss, time 5039ms –  bux Feb 29 '12 at 12:12
    
@cjc: The server is not on the LAN of client. push route and ip forwarding ? I can connect, it look like ip forwarding is good no ? (what is push routes ?) –  bux Feb 29 '12 at 12:13
    
@bux You should do a ping to 10.66.77.1 (or, do an ifconfig tun0 on the server to make sure you have the right VPN IP for the server). Ping to 10.66.77.0 isn't going to work. So, what I asking about: how do you intent to use the VPN? Are you just connecting to the server, or to the machines on the server's LAN? –  cjc Feb 29 '12 at 12:44
show 10 more comments

1 Answer

Which OS you use for client? If it is windows 7, then you must run VPN Client as administrator or routes wont be added to the client.

Also, I don't see in server.conf which routes are pushed to client... Somewhere on config file you must specify which routes will be available trough the tunnel. Down is some basic example.

push "route ip.add.of.route sub.net.mask.route"

push "redirect-gateway def1"

Regards,

share|improve this answer
    
I don't think it's a routing issue, at least not with the tests he's run. He can't ping the VPN server's tun interface from the client, yet the tunnel is clearly established in the logs. It feels like a firewall issue. Once that's fixed, adding routes will help him get to other machines on the server's LAN, but we have to get through the first hurdle. –  cjc Feb 29 '12 at 14:47
    
I will check firewall first to be sure. –  bux Feb 29 '12 at 15:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.