1

Okay, so I do not have a strong background per se in computing, nor networking, and I'm really just starting to learn this stuff now, for a relatively small family business of ours. It is rather fascinating and I've got a lot to learn. However, I have recently been playing with OpenVPN server configurations and had some success with bridging. I am working on a routing configuration now. One thing I have spent hours and hours playing with is being able to have a client which is assigned an IP address as such: (10.8.0.6) with the OpenVPN server: (10.8.0.1), having access to JUST ONE INTERNAL LAN IP address for a web application.

Allow me to explain further. On the LAN there is a server at: 192.168.50.100 which is an Apache server hosting a web application for internal usage. For individuals whom work locally, it is all accessible, as one would expect. Port 80 HTTP. Open up a browser and type http :// 192.168.50.100 and bingo, it is there.

However, as we are expanding and having individuals work remotely, we wish to give them access to this web application too (at http :// 192.168.50.100). In bridged mode, this works fine, however, they also get access to all the other networked resources/computers et cetera. Sure, a good firewall helps (we have recently installed a WatchGuard firewall, although only for a few other servers, the web application server is not behind it. Yet.) It seems this should be possible, to do. But, as I'm fumbling my way through this, I could do with a bit of advice, as currently over a routed connection, it is not accessible.

BTW - my question is very familiar to the one posed here:

Connecting a LAN to an OpenVPN server via a windows 7 client gateway

The only difference being.. both computers (including the server for web application) are Windows. And yes, I've disabled all firewalls for all adapters (OpenVPN one as well) (only during testing/experimenting), including Windows Firewall, on gateway computer and Apache server. In the question linked above, the individual found his solution being IPTABLES, however, I'm quite certain that's just a Linux thing. (I've never heard of it before).

Nevertheless, these are the steps I've taken thus far.

  1. Enabled IP Forwarding on the gateway (OpenVPN server) by the registry edit documented in previous link.

  2. Added within server.conf (push "route 192.168.50.0 255.255.255.0")

  3. I've experimented on the gateway computer which is part of the private subnet (192.168.50.*) with various command lines "route ADD 10.8.0.0 MASK ... " et cetera. And I've done them non-persistently and cleared them out afterwards, after testing that they did not work.

So, any further guidance would be greatly appreciated. Sorry for essay form, just wanted to give as much information up front.

Thanks!

John

EDITED AND APPENDED TO ANSWER TESSELATINGHECKLERS ANSWER/QUESTIONS FROM BELOW. (BTW - Thanks for the time TH).

(VPN Client <-> VPN Server): Leaving the Apache server aside for a moment, how far have >you got with the OpenVPN tunnel itself? Does it connect? Can you get any traffic at all >over it, and know it's working? Use ping on the VPN client and try to ping the server >10.8.0.1 and prove you're getting a connection.

Yes, the client can successfully connect to the server using a combination of client specific certificates and authorization (username/password). At this point, yes, traffic is going over it and it is working. Even when all traffic for the client is forced over (I only played around with this setting for testing), so, the web browser traffic is passed through it - it works very well. And as for pinging from VPN client to server 10.8.0.1, it works perfectly.. all four packets return as desired.

(VPN <-> LAN on the VPN server): You have enabled routing in the registry, but is it >working? The OpenVPN server needs an IP address on the 192.168.50.x network.

Yes, I have enabled routing in the registry, but is it working? I do not know. I do not know how to check whether the OpenVPN server has an IP address on the 192.168.50.? Prior to turning the OpenVPN server on.. if I enter "ipconfig /all" at the command line, I see for the Local Area Network adapter that it has an IP address of 192.168.50.10 (static LAN IP). Once the OpenVPN server/service is started, the new adapter now takes an address of 10.8.0.1... and naturally if I type "ipconfig /all", then I see for the two different adapters - two different IP addresses respectively listed moments ago. I can ping from the server to 192.168.50.100 and 192.168.50.100 (and all other servers/computers on the 192.168.50.x network can ping 192.168.50.10)... however, the other servers/computers on the 192.168.50.x network cannot ping the newly connected server at 10.8.0.1 nor the connected VPN client (first client) with address of 10.8.0.6 (as an example).

So, is it a matter of configuring the adapter which has an IP address of 10.8.0.1 to be able to communicate with 192.168.50.x addresses?

What do I need to do to get "The OpenVPN server needs an IP address on the 192.168.50.x network." working? Is this different than the one the actual computer already has on it's default LAN adapter? That is one part that is getting confusing.

If you look in the client's routing table ("route print" at the command line), and/or in >the OpenVPN connection logs, is it picking up the routes to the 192.168.50.x network that >you put in server conf? If so, is the route gateway set to the 10.0.8.1 address of the >OpenVPN server? From the client, can you ping the OpenVPN server on the 192.168.50.x >address?

This part I will need to do again. Since posting my question here yesterday, I have spent a bit of time messing around and there are no default routes pushed over. I will do that shortly and revise this post at that point. However, what I can say is that when I did push the route 192.168.50.x.. I definitely could NOT ping the 192.168.50.10 address or any other 192.168.50.x address from the client.

19
  • IPTables is a Linux equivalent to "Windows Firewall", presumably it was on his Apache server, and won't apply to your setup. Apr 23, 2013 at 23:24
  • Thanks for letting me know! :) I did Google it after I wrote my post. Anyway, I will answer your questions below.. I only just saw there was a response.
    – OmniCoder
    Apr 24, 2013 at 16:29
  • Those IP addresses are OK; So your OpenVPN server is configured in both networks, but is not routing between them, and it needs to be. Sounds like your registry change to enable routing/forwarding in Windows hasn't worked, or it could be something in your OpenVPN server config - but I don't know what. If you have a route on your default gateway for 10.8.0.0/24 via 192.168.50.10, then work on routing until a server on your LAN can ping 10.8.0.1. I suspect if you get that going, the VPN clients will start working. (Did you reboot? Do you see "IP Routing Enabled: Yes"" in ipconfig /all?) Apr 24, 2013 at 17:05
  • Can you explain what you mean by having a route on my default gateway for 10.8.0.0/24 via. 192.168.50.10? Do you mean creating a route on the 192.168.50.10 system for 10.8.0.0/24? This is the same system that runs the OpenVPN server and is essentially a "bridge" between the LAN and the connected clients.
    – OmniCoder
    Apr 24, 2013 at 17:08
  • I did reboot after enabling routing. I haven't checked whether I see IP Routing Enabled.. I'll check right now and get back to you. (BTW thanks for all your time helping!!)
    – OmniCoder
    Apr 24, 2013 at 17:09

2 Answers 2

1

You've said a lot about what you want and how you're trying to make it work (and it sounds like your high level plan will work), but nothing about how far you've got and what is/isn't working.

Consider the connection as a journey of several sections, and test each one in sequence with basic ping tests.

(VPN Client <-> VPN Server): Leaving the Apache server aside for a moment, how far have you got with the OpenVPN tunnel itself? Does it connect? Can you get any traffic at all over it, and know it's working? Use ping on the VPN client and try to ping the server 10.8.0.1 and prove you're getting a connection.

(VPN <-> LAN on the VPN server): You have enabled routing in the registry, but is it working? The OpenVPN server needs an IP address on the 192.168.50.x network.

If you look in the client's routing table ("route print" at the command line), and/or in the OpenVPN connection logs, is it picking up the routes to the 192.168.50.x network that you put in server conf? If so, is the route gateway set to the 10.0.8.1 address of the OpenVPN server? From the client, can you ping the OpenVPN server on the 192.168.50.x address?

(Apache <-> Gateway): Check the route back. When you say the "gateway computer", is that the default gateway of the Apache server? If so, on the gateway computer you are right, you will need "route add 10.8.0.0 mask 255.255.255.0 192.168.50.x" where x is the OpenVPN server's address.

Can you ping the OpenVPN server from the Apache server on the 192.168.50.x address? Can you ping it on the 10.8.0.1 address?

(Apache <-> VPN Client): Can you ping the OpenVPN client 10.8.0.6 from the Apache server?

Presumably one of these steps will fail, that will tell you where to look next.

(I think Watchguards come with some licenses for mobile user VPN, btw).

1
  • You're right. I didn't explain about our current results. Essentially, as is, utilizing a routing connection with OpenVPN, the clients connect and they can ping the server (10.8.0.1) and the server can ping the clients at their allocated address (10.8.0.6 - as an example). That part works fine. But, thus far, despite a lot of playing around, the client cannot ping any servers/computers on the LAN (192.168.50.x), whereas, naturally the server can. As there is a limit (which I'm quickly approaching) of characters for comments, I will edit my original post with further information appended.
    – OmniCoder
    Apr 24, 2013 at 16:35
1

Without administrative priviledges, OpenVPN on the client cannot alter the system routing tables. The client can negotiate the connection, but any routes pushed by the server will fail to be created on the client. So pushed routes only work if the user is running OpenVPN as an administrative user.

You should be able to tell by using wireshark or tcpdump on the VPN client whether packets for 192.168.50.100 are being sent out the desired network interface. If not, your routes have not been set up, or are incorrect. You can verify this by using route print on the client.

If routes are pushed to the client, but are failing to be created by OpenVPN, the OpenVPN debug output should show the failure. Increase verbosity by adding verb 4 (higher numbers mean greater verbosity) to your config, or by specifying --verb 4 when invoking openvpn on the command line.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .