openVpN Linux (server) Window (client)

[James Knott]

William Muriithi wrote:
> Hi,
> 
> Sorry, I think the email above had some error. Looking closely, it did
> not also work on Linux client. Both Windows and Linux client are at
> par as far as VPN is concerned.
> 
> What is actually happening is I can reach the Virtual IP (10.80.80.1)
> and physical IP (10.1.1.99) of the vpn server. I am however unable to
> reach any other client in the LAN. That imply a routing problem. Below
> is my server routes
> 
> #/sbin/ip route
> 10.80.80.2 dev tun0  proto kernel  scope link  src 10.80.80.1
> 10.80.80.0/24 via 10.80.80.2 dev tun0
> 10.1.1.0/24 dev eth0  proto kernel  scope link  src 10.1.1.99
> 169.254.0.0/16 dev eth0  scope link
> default via 10.1.1.1 dev eth0
> 
> The 10.80.80.xx network is what is issued to the VPN clients. The
> 10.1.1.x network is what is used in the LAN. The VPN server is not in
> line, that is the default gateway and VPN server are different. On the
> default gateway (A window box), I applied this route.
> 
> route ADD 10.80.80.0 MASK 255.255.255.0 10.1.1.99 -p
> 
>>From this Window box, I can ping 10.80.80.1 and can not reach
> connected clients. What could I be missing here?

You configure the route in the OpenVPN config file.
Here's mine:

# Edit this file, and save to a .ovpn extension
# so that OpenVPN will activate it when run
# as a service.

# Change 'myremote' to be your remote host,
# or comment out to enter a listening
# server mode.

remote my.network.net

# Uncomment this line to use a different
# port number than the default of 1194.
; port 1194
port 1194

# Choose one of three protocols supported by
# OpenVPN.  If left commented out, defaults
# to udp.
; proto [tcp-server | tcp-client | udp]
proto udp

# You must specify one of two possible network
# protocols, 'dev tap' or 'dev tun' to be used
# on both sides of the connection.  'tap' creates
# a VPN using the ethernet protocol while 'tun'
# uses the IP protocol.  You must use 'tap'
# if you are ethernet bridging or want to route
# broadcasts.  'tun' is somewhat more efficient
# but requires configuration of client software
# to not depend on broadcasts.  Some platforms
# such as Solaris, OpenBSD, and Mac OS X only
# support 'tun' interfaces, so if you are
# connecting to such a platform, you must also
# use a 'tun' interface on the Windows side.

# Enable 'dev tap' or 'dev tun' but not both!
dev tun

# This is a 'dev tap' ifconfig that creates
# a virtual ethernet subnet.
# 10.3.0.1 is the local VPN IP address
# and 255.255.255.0 is the VPN subnet.
# Only define this option for 'dev tap'.
# ifconfig 10.3.0.1 255.255.255.0

# This is a 'dev tun' ifconfig that creates
# a point-to-point IP link.
# 10.1.0.1 is the local VPN IP address and
# 10.1.0.2 is the remote VPN IP address.
# Only define this option for 'dev tun'.
# Make sure to include the "tun-mtu" option
# on the remote machine, but swap the order
# of the ifconfig addresses.
;tun-mtu 1500
ifconfig 10.1.0.2 10.1.0.1

# If you have fragmentation issues or misconfigured
# routers in the path which block Path MTU discovery,
# lower the TCP MSS and internally fragment non-TCP
# protocols.
;fragment 1300
;mssfix

# If you have set up more than one TAP-Win32 adapter
# on your system, you must refer to it by name.
;dev-node my-tap

# You can generate a static OpenVPN key
# by selecting the Generate Key option
# in the start menu.
#
# You can also generate key.txt manually
# with the following command:
#   openvpn --genkey --secret key.txt
#
# key must match on both ends of the connection,
# so you should generate it on one machine and
# copy it to the other over a secure medium.
# Place key.txt in the same directory as this
# config file.
secret static.key

# Uncomment this section for a more reliable
# detection when a system loses its connection.
# For example, dial-ups or laptops that travel
# to other locations.
#
# If this section is enabled and "myremote"
# above is a dynamic DNS name (i.e. dyndns.org),
# OpenVPN will dynamically "follow" the IP
# address of "myremote" if it changes.
; ping-restart 60
; ping-timer-rem
; persist-tun
; persist-key
; resolv-retry 86400

# keep-alive ping
ping 10

# enable LZO compression
#comp-lzo

# moderate verbosity
verb 4
mute 10

route 172.16.1.0 255.255.255.0 10.1.0.1
#push "redirect-gateway"

BTW, the IP addresses listed above are secret, so don't mention them to 
anyone.  ;-)

-- 
Use OpenOffice.org <http://www.openoffice.org>
--
The Toronto Linux Users Group.      Meetings: http://gtalug.org/
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://gtalug.org/wiki/Mailing_lists