0

Server config:

port 1194
proto udp
dev tun

dev-node MyTap
server 10.8.0.0 255.255.255.0

ca "C:\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\OpenVPN\\easy-rsa\\keys\\server.crt"
key "C:\\OpenVPN\\easy-rsa\\keys\\server.key"   
dh "C:\\OpenVPN\\easy-rsa\\keys\\dh1024.pem"

push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

;ifconfig-pool-persist ipp.txt

keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

Client config:

client
dev tun
dev-node MyTap
proto udp
remote xx.xx.xx.xx 1194

resolv-retry infinite
nobind
persist-key
persist-tun

ca "C:\\OpenVPN\\config\\ca.crt"
cert "C:\\OpenVPN\\config\\BSCLaptop.crt"
key "C:\\OpenVPN\\config\\BSCLaptop.key"

explicit-exit-notify 2
ns-cert-type server
comp-lzo
verb 5
ping 10
ping-restart 60

route-method exe
route-delay 2

The client and server are in different countries. I can connect without any errors in the logs. I can ping from the server to the client successfully via the VPN network, i.e. on server: ping 10.8.0.6. I can ping from the client to the server successfully via the VPN network, i.e. on client ping 10.8.0.1. However, I can't ping from the client to the server via the server's normal network IP (10.79.79.81) and I can't ping anything else on the server's network, i.e. the gateway/router, or get any internet traffic on the client. The network adapter providing the internet connection to the server has had "Allow other network users to connect through this computer's Internet connection" option checked in the adapter Properties->Sharing and set to the server's Tap adapter. The server has had its "Routing and Remote Access" service started and the key

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters has had its IPEnableRouter setting set to 1 (defualt is 0).

All firewalls are disabled on the Windows server and client machines and within the router the server connect to the internet through. Port 1194 is forwarded to the server from the router it connects to the internet through. All this worked before the server was updated from Win 7 -> Win 10 ;) Now, the two machines can ping each other via their VPN IP addresses only and do nothing more, any ideas?

Thanks.

1
  • If your using windows 7 or 10 this really isn't a server. They have all manner of connection limitations that the server versions such as Windows 2008 Server or higher do. – Citizen Jun 10 '16 at 23:26
1

This sounds like a routing issue and I suspect it is at the client. You firstly need to verify on the client that the packets with a destination of your server network(10.79.79.81 or whatever) are going through the VPN tunnel and not through your normal interface. Check your routing tables or use traceroute to verify.

If this traffic isn't going through the tunnel, then you need to set up your server config to push routes to the client. example from https://openvpn.net/index.php/open-source/documentation/howto.html#examples

# Push routes to the client to allow it
# to reach other private subnets behind
# the server.  Remember that these
# private subnets will also need
# to know to route the OpenVPN client
# address pool (10.8.0.0/255.255.255.0)
# back to the OpenVPN server.
;push "route 192.168.10.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"

Alternatively, configure openvpn to route ALL traffic (if that's what you want) over the VPN.

If they are indeed going to your server then you need to verify that your server knows how to route packets to the network you are trying to reach. The routing stuff can get complicated and I have no idea how suitable windows 7 is for that. You might consider setting the VPN up on a router like pfsense.

1
  • Thanks for the contribution, but as per the redirect-gateway command in the server config listing, all traffic on the client is routed via the VPN. The problem seems to be with the routing on the server side, but I had this exact setup working on the server before the server was upgraded from Win7->Win10 so windows can do it. IP Forwarding and the Routing and Remote Access service is started on the Win10 machine, so everything should be working now afaik... – Paul Caheny Jun 11 '16 at 11:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.