1

I've been using OpenVPN for a year and a half on this server, and never had any issues. Today, I restarted the server (I do this about once a month), and suddenly I can't access webpages or file shares that are on the server through VPN (but they work through local 192.x.x.x address). If I'm on the server itself, then I can access it's share drive though \\10.8.0.1\Share, and it's websites at https://10.8.0.1, it just doesn't seem to be accessibly to anyone else connect via VPN. The other computers on VPN can communicate with each other though. I've looked through the firewall logs, and it doesn't seem that the connections are even getting to the server -- there's neither DROP nor ALLOW in the server logs relevant to the VPN connections.

I'm not sure what information to provide, so here's the VPN status (from desktop)

Thu Mar 26 13:03:33 2020 OpenVPN 2.4.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 26 2018
Thu Mar 26 13:03:33 2020 Windows version 6.2 (Windows 8 or greater) 64bit
Thu Mar 26 13:03:33 2020 library versions: OpenSSL 1.1.0h  27 Mar 2018, LZO 2.10
Thu Mar 26 13:03:33 2020 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Mar 26 13:03:33 2020 Need hold release from management interface, waiting...
Thu Mar 26 13:03:34 2020 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Mar 26 13:03:34 2020 MANAGEMENT: CMD 'state on'
Thu Mar 26 13:03:34 2020 MANAGEMENT: CMD 'log all on'
Thu Mar 26 13:03:34 2020 MANAGEMENT: CMD 'echo all on'
Thu Mar 26 13:03:34 2020 MANAGEMENT: CMD 'bytecount 5'
Thu Mar 26 13:03:34 2020 MANAGEMENT: CMD 'hold off'
Thu Mar 26 13:03:34 2020 MANAGEMENT: CMD 'hold release'
Thu Mar 26 13:03:34 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:1194
Thu Mar 26 13:03:34 2020 Socket Buffers: R=[65536->65536] S=[65536->65536]
Thu Mar 26 13:03:34 2020 UDP link local: (not bound)
Thu Mar 26 13:03:34 2020 UDP link remote: [AF_INET]x.x.x.x:1194
Thu Mar 26 13:03:34 2020 MANAGEMENT: >STATE:1585242214,WAIT,,,,,,
Thu Mar 26 13:03:34 2020 MANAGEMENT: >STATE:1585242214,AUTH,,,,,,
Thu Mar 26 13:03:34 2020 TLS: Initial packet from [AF_INET]x.x.x.x:1194, sid=fda4bf51 c3904f17
Thu Mar 26 13:03:34 2020 VERIFY OK: depth=1, C=CA, ST=ON, L=xxx, O=xxx, OU=Software, CN=xxx, name=xxx, emailAddress=xxx@xxx.com
Thu Mar 26 13:03:34 2020 VERIFY KU OK
Thu Mar 26 13:03:34 2020 Validating certificate extended key usage
Thu Mar 26 13:03:34 2020 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Thu Mar 26 13:03:34 2020 VERIFY EKU OK
Thu Mar 26 13:03:34 2020 VERIFY OK: depth=0, C=CA, ST=ON, L=xxx, O=xxx, OU=Software, CN=xxx, name=xxx, emailAddress=xxx@xxx.com
Thu Mar 26 13:03:34 2020 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
Thu Mar 26 13:03:34 2020 [server] Peer Connection Initiated with [AF_INET]x.x.x.x:1194
Thu Mar 26 13:03:35 2020 MANAGEMENT: >STATE:1585242215,GET_CONFIG,,,,,,
Thu Mar 26 13:03:35 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Mar 26 13:03:35 2020 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.22 10.8.0.21,peer-id 7,cipher AES-256-GCM'
Thu Mar 26 13:03:35 2020 OPTIONS IMPORT: timers and/or timeouts modified
Thu Mar 26 13:03:35 2020 OPTIONS IMPORT: --ifconfig/up options modified
Thu Mar 26 13:03:35 2020 OPTIONS IMPORT: route options modified
Thu Mar 26 13:03:35 2020 OPTIONS IMPORT: peer-id set
Thu Mar 26 13:03:35 2020 OPTIONS IMPORT: adjusting link_mtu to 1625
Thu Mar 26 13:03:35 2020 OPTIONS IMPORT: data channel crypto options modified
Thu Mar 26 13:03:35 2020 Data Channel: using negotiated cipher 'AES-256-GCM'
Thu Mar 26 13:03:35 2020 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Mar 26 13:03:35 2020 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Mar 26 13:03:35 2020 interactive service msg_channel=692
Thu Mar 26 13:03:35 2020 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 I=12 HWADDR=8c:ec:4b:5e:2b:63
Thu Mar 26 13:03:35 2020 open_tun
Thu Mar 26 13:03:35 2020 TAP-WIN32 device [Ethernet 3] opened: \\.\Global\{17046649-FA88-415D-90C4-F5C62416022E}.tap
Thu Mar 26 13:03:35 2020 TAP-Windows Driver Version 9.21 
Thu Mar 26 13:03:35 2020 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.22/255.255.255.252 on interface {17046649-FA88-415D-90C4-F5C62416022E} [DHCP-serv: 10.8.0.21, lease-time: 31536000]
Thu Mar 26 13:03:35 2020 Successful ARP Flush on interface [6] {17046649-FA88-415D-90C4-F5C62416022E}
Thu Mar 26 13:03:35 2020 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Thu Mar 26 13:03:35 2020 MANAGEMENT: >STATE:1585242215,ASSIGN_IP,,10.8.0.22,,,,
Thu Mar 26 13:03:41 2020 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Thu Mar 26 13:03:41 2020 MANAGEMENT: >STATE:1585242221,ADD_ROUTES,,,,,,
Thu Mar 26 13:03:41 2020 C:\WINDOWS\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.21
Thu Mar 26 13:03:41 2020 Route addition via service succeeded
Thu Mar 26 13:03:41 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Mar 26 13:03:41 2020 Initialization Sequence Completed
Thu Mar 26 13:03:41 2020 MANAGEMENT: >STATE:1585242221,CONNECTED,SUCCESS,10.8.0.22,209.91.141.42,1194,,

The server is located at 10.8.0.1, and my desktop is at 10.8.0.22

Server's configuration file is (removed everything that wasn't a comment):

port 1194
proto udp4
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
# openvpn.exe --show-valid-subnets
client-config-dir ccd
route 10.8.0.18 255.255.255.252     # 
route 10.8.0.26 255.255.255.252     # 
route 10.8.0.38 255.255.255.252     # 
route 10.8.0.6 255.255.255.252      # 
route 10.8.0.14 255.255.255.252     # 
route 10.8.0.34 255.255.255.252     # 
route 10.8.0.10 255.255.255.252     # 
route 10.8.0.54 255.255.255.252     # 
route 10.8.0.82 255.255.255.252     # 
route 10.8.0.86 255.255.255.252     # 
route 10.8.0.22 255.255.255.252     # 
route 10.8.0.86 255.255.255.252     # 
route 10.8.0.90 255.255.255.252     # 
route 10.8.0.94 255.255.255.252     # 
route 10.8.0.98 255.255.255.252     # 
route 10.8.0.30 255.255.255.252     # 
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
verb 4
crl-verify "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\crl.pem"

Files in the ccd folder are all basically the same (with different IPs): ifconfig-push 10.8.0.22 10.8.0.21

Route Table output:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.0.1      192.168.0.9     2
         10.8.0.0    255.255.255.0        10.8.0.21        10.8.0.22    291
        10.8.0.20  255.255.255.252         On-link         10.8.0.22    291
        10.8.0.22  255.255.255.255         On-link         10.8.0.22    291
        10.8.0.23  255.255.255.255         On-link         10.8.0.22    291
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
      192.168.0.0    255.255.255.0         On-link       192.168.0.9    281
      192.168.0.9  255.255.255.255         On-link       192.168.0.9    281
    192.168.0.255  255.255.255.255         On-link       192.168.0.9    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link       192.168.0.9    281
        224.0.0.0        240.0.0.0         On-link         10.8.0.22    291
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link       192.168.0.9    281
  255.255.255.255  255.255.255.255         On-link         10.8.0.22    291
===========================================================================
Persistent Routes:
  None

All computers are running Windows 10, except the server (which runs VPN as a service) is Windows Server 2016.

Please let me know if you need any more information.

EDIT: Server also can't communicate with other computers on the VPN; so it seems less likely to be a firewall issue.

Route from Server:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1     192.168.1.60     35
         10.8.0.0    255.255.255.0         10.8.0.2     192.168.1.60     36
         10.8.0.0  255.255.255.252         On-link          10.8.0.1    291
         10.8.0.1  255.255.255.255         On-link          10.8.0.1    291
         10.8.0.3  255.255.255.255         On-link          10.8.0.1    291
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
      192.168.1.0    255.255.255.0         On-link      192.168.1.60    291
     192.168.1.60  255.255.255.255         On-link      192.168.1.60    291
    192.168.1.255  255.255.255.255         On-link      192.168.1.60    291
    192.168.193.0    255.255.255.0         On-link     192.168.193.1    291
    192.168.193.1  255.255.255.255         On-link     192.168.193.1    291
  192.168.193.255  255.255.255.255         On-link     192.168.193.1    291
    192.168.227.0    255.255.255.0         On-link     192.168.227.1    291
    192.168.227.1  255.255.255.255         On-link     192.168.227.1    291
  192.168.227.255  255.255.255.255         On-link     192.168.227.1    291
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link          10.8.0.1    291
        224.0.0.0        240.0.0.0         On-link     192.168.227.1    291
        224.0.0.0        240.0.0.0         On-link     192.168.193.1    291
        224.0.0.0        240.0.0.0         On-link      192.168.1.60    291
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link          10.8.0.1    291
  255.255.255.255  255.255.255.255         On-link     192.168.227.1    291
  255.255.255.255  255.255.255.255         On-link     192.168.193.1    291
  255.255.255.255  255.255.255.255         On-link      192.168.1.60    291
===========================================================================
Persistent Routes:
  None

EDIT2: Tracert from server to another computer on the VPN (physically in the same building) seems odd:

PS C:\Users\Administrator> TRACERT.EXE 10.8.0.18
Tracing route to 10.8.0.18 over a maximum of 30 hops
  1    <1 ms    <1 ms    <1 ms  COMTREND [192.168.1.1]
  2     1 ms    <1 ms    <1 ms  ppp-69-171-101-1.vianet.ca [69.171.101.1]
  3     6 ms     1 ms     1 ms  69.156.254.158
  4     *        *        *     Request timed out.
  5     *        *     69.156.254.158  reports: Destination net unreachable.

Not sure why it's trying to go over the 192 connection, leaving the VPN. Might be a clue?

EDIT 3: Alrighty … I managed to make it work by running route add 10.8.0.0 MASK 255.255.255.0 10.8.0.2 METRIC 3 IF 17; however, I'd have to do this every time the server restarts, which I'd rather not do, obviously.

  • What does iptables -vnL show ? My guess is you have a drop rule (but not a log rule showing the drop) somewhere. – davidgo Mar 26 at 19:37
  • @davidgo, using Windows, so no iptables? The logging is set to show all dropped packets, and all successful connections. Just using Windows Firewall, btw. Also, haven't changed anything in the firewall settings about 6 months. – ChrisMM Mar 26 at 21:52
0

After doing a tracert to one of the computers on the VPN, I noticed it was going over the 192 connection. Looking back at the Route Table for the server, it does show that 10.8.0.0/24 is routed to go over 192.168.1.60 interface, which is obviously incorrect.

Deleting this route, and re-adding the correct one does fix the issue; so I made the following batch file:

route delete 10.8.0.0/24
route add 10.8.0.0 MASK 255.255.255.0 10.8.0.2 METRIC 3

Unfortunately, I need to run this myself at start-up, but at least it's something for now. If someone has a better solution, please do share.

|improve this answer|||||
New contributor
ChrisMM is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • why don't you add and delete permanently -p ? – 4per yesterday
  • I think it is a good practise to point out an interface in the route add command – 4per yesterday
  • @4per, I tried with -p, but it didn't work properly. When I restarted, it was marked in the persistent list, but there's no interface for it (missing the 10.8.0.1), so it seemed to still be going over the 192.168.1.60 interface instead. This is still true when I specify the interface in the route add command. – ChrisMM yesterday

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.