Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN doesn't return subnet mask correctly

    Scheduled Pinned Locked Moved OpenVPN
    27 Posts 5 Posters 18.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      jeffwji
      last edited by

      @Nachtfalke:

      @rubic:

      http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html

      That is exactly the point.

      Make sure you run the OpenVPN client on Windows machines as "Administrator" and make sure you set allo rules on the firewall –> OpenVPN tab.

      Actually the vpn client is running under administrator.

      1 Reply Last reply Reply Quote 0
      • J
        jeffwji
        last edited by

        @rubic:

        http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html

        For the explanation, a 252 subnet is just normal. but it still not resolves my problem as the dns and gateway are still empty, I think at least I should receive them, because I can get them when I connect to my office by an other certificate.

        And the client keeps saying "write to TUN/TAP  [State=AT?c Err=[c:\users\samuli\tap-windows-github\src\tapdrvr.c/2475] #O=12 Tx=[4204,0] Rx=[489,100] IrpQ=[1,1,16] PktQ=[0,3,64] InjQ=[0,1,16]]: The data area passed to a system call is too small.   (code=122)". I'm not sure does it cause the problem?

        1 Reply Last reply Reply Quote 0
        • M
          marvosa
          last edited by

          Post your server1.conf, so we can take a look.

          1 Reply Last reply Reply Quote 0
          • J
            jeffwji
            last edited by

            @marvosa:

            Post your server1.conf, so we can take a look.

            dev ovpns1
            dev-type tun
            dev-node /dev/tun1
            writepid /var/run/openvpn_server1.pid
            #user nobody
            #group nobody
            script-security 3
            daemon
            keepalive 10 60
            ping-timer-rem
            persist-tun
            persist-key
            proto udp
            cipher AES-128-CBC
            up /usr/local/sbin/ovpn-linkup
            down /usr/local/sbin/ovpn-linkdown
            local 192.168.137.83
            tls-server
            server 10.10.8.16 255.255.255.240
            client-config-dir /var/etc/openvpn-csc
            username-as-common-name
            auth-user-pass-verify /var/etc/openvpn/server1.php via-env
            tls-verify /var/etc/openvpn/server1.tls-verify.php
            lport 1194
            management /var/etc/openvpn/server1.sock unix
            client-to-client
            ca /var/etc/openvpn/server1.ca
            cert /var/etc/openvpn/server1.cert
            key /var/etc/openvpn/server1.key
            dh /etc/dh-parameters.1024
            tls-auth /var/etc/openvpn/server1.tls-auth 0
            comp-lzo
            persist-remote-ip
            float

            1 Reply Last reply Reply Quote 0
            • J
              jeffwji
              last edited by

              Hi Marvosa

              Do I have to add more rule except the default "* to *" under openvpn tab? To make sure I can access the management GUI, I added "10.10.8.16/28 to *" to LAN, is it necessary?

              Jeff

              1 Reply Last reply Reply Quote 0
              • M
                marvosa
                last edited by

                Ok, from your original post, "when I logged in, I could n't go any where", meaning… you can't reach anything on your LAN?

                Well, here's the mystery:

                Your tunnel network is 10.10.8.16/28, so I'm not sure how your virtual adapter is getting an IP of 10.10.3.10... do you have multiple servers configured?  Are you sure you're connecting to the right server?  Check Status -> OpenVPN... make sure you're connecting to the right server... because you should receive a virtual address in the 10.10.8.17 - 10.10.8.30 range.

                I do not see any routes back to your LAN (e.g. push "route 192.168.50.0 255.255.255.0")  or a "max-clients" statement... so there are some missing elements in your config.  Go back thru your config (VPN -> OpenVPN) and double check that it's configured correctly for your network.... the "Tunnel Settings" section in particular.... from what I can tell you have left at least the Local Network and Concurrent connections fields empty.

                Firewall rules, if you have an any/any (|||||) in place that's all you need on your openvpn tab… remove anything else.

                It looks like you're double NATing, post a network map so we can see how your network is configured.

                Also, looking at your client log.... you're attempting to connect to 192.168.137.83:1194, which according to your server1.conf is your external IP... are you trying to test from inside your network?  If so, that's not going to work... something's not adding up... at any rate... according to this -> "DHCP IP/netmask of 10.10.3.10/255.255.255.252" you're connecting to the wrong server... because you should be seeing something in the 10.10.8.17 - 10.10.8.30 according to your server1.conf.

                1 Reply Last reply Reply Quote 0
                • J
                  jeffwji
                  last edited by

                  Hi Marvosa

                  Thanks you for your reply. I re-installed the server, so the IP changed, now it's 10.10.8.16/28, which before is 10.10.3…. I thought about to set a static router for vpn network, but I can't see where is the place in the openvpn setting, but a "Redirect gateway", which I don't think it's necessary to be checked.(actually is I'm not very understand what means "Force all client generated traffice through the tunnel"). And in the "system->routing" page, 192.168.137.83 is the default gateway. 192.168.137.0 is my test network which connects to the WAN interface.

                  As I don't know how to post a picture, I'll try my best to describe the aspect:

                  Draft:
                  |  Test network  |       |                                   PFSENSE                                                   |
                  192.168.137.0/24 <==> WAN (DHCP:192.168.137.83) ==> LAN (Static:10.10.8.1; net:10.10.8.0/28; DHCP enabled)
                                                                                         ==> OpenVPN (Tunnel: 10.10.8.16/28; Interface: WAN; Device mode: tun; Local network: empty; Redirect gateway: unckecked.)

                  Rule:
                   WAN: None. (allowed to be connected from private network)
                   OpenVPN: All *
                   LAN: net to any.

                  Gateway:
                   192.168.137.83(default)

                  Result:
                   LAN net is able to access management UI (10.10.8.1) and the world.
                   OpenVPN got 10.10.8.19, but couldn't talks to any IP but the client it self.

                  1 Reply Last reply Reply Quote 0
                  • M
                    marvosa
                    last edited by

                    So, your LAN is 10.10.8.0/28, but you will not be able to access your network until you add something to the "Local Network" field.  Set your "Local Network" 10.10.8.0/28.

                    The "Redirect Gateway" option is for doing full tunnel vs split tunnel…if it's checked, all internet traffic from the client-side will be routed thru the VPN instead of using it's own connection.  If left un-checked, only traffic destined for 10.10.8.0/28 will be routed thru the VPN.... everything else will use the clients own connection.

                    1 Reply Last reply Reply Quote 0
                    • J
                      jeffwji
                      last edited by

                      So you think that's because my openvpn is too close to the LAN network? How if I change the OpenVPN to 10.10.9.0/24? will it works for the empty local network? But I'm confused as I separated the vpn and lan by sub-network mask, it doesn't work?

                      Jeff

                      1 Reply Last reply Reply Quote 0
                      • J
                        jeffwji
                        last edited by

                        Ok! I get it!! if the vpn tunnel is not within the LAN range, you have to name the local network! that's it! Thank you Marvosa!

                        1 Reply Last reply Reply Quote 0
                        • M
                          marvosa
                          last edited by

                          Well… you are sort of making it hard on your self with the subnets you've chosen, but changing the tunnel network is not the problem.  The main issue is the "Local Network" field is blank, so your clients are getting the routes they need.

                          1 Reply Last reply Reply Quote 0
                          • M
                            marvosa
                            last edited by

                            Jeffwji, Sort of :)  Actually in a routed VPN solution, the tunnel network can NOT be within the LAN range… which is why you need to name the local network... so your clients know that packets destined for the 10.10.8.0/28 network need to be routed over the VPN.

                            1 Reply Last reply Reply Quote 0
                            • J
                              jeffwji
                              last edited by

                              Sorry, I'm back again. :-[

                              I'm now able to visit the management UI from VPN network, that means I'm able to access 10.10.8.1. Then I did the two tests:

                              1. Created a machine on LAN net, which the IP is 10.10.8.5
                              2. Created a VLAN which the net is 10.10.8.32/28(Gateway 33), and setup a machine on 10.10.8.35.

                              Created two rules for both of the them, allow all the IPs from those two net to go any. Then tried to talk with this two machines from VPN, the first one passed, but the second failed. Why?

                              1 Reply Last reply Reply Quote 0
                              • M
                                marvosa
                                last edited by

                                Because 10.10.8.5/28 is in your "Local Network" where as 10.10.8.35/28 is not.

                                By default, the system only provides routing to what's configured in the "Local Network".  Access to other subnets need to be configured in the "Advanced configuration" section.  Add the following statement to the "Advanced configuration" field:

                                push "route 10.10.8.32 255.255.255.240"

                                1 Reply Last reply Reply Quote 0
                                • J
                                  jeffwji
                                  last edited by

                                  So that means I have to create individual item for each subnet? How about if I have many VLANs, for example, 10.10.8.0/28, 10.10.8.16/28, 10.10.8.32/28… then I create one local network as 10.10.8.0/24, which covers all the VLANs under 8 section, does it work?

                                  Jeff

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    phil.davis
                                    last edited by

                                    @jeffwji:

                                    So that means I have to create individual item for each subnet? How about if I have many VLANs, for example, 10.10.8.0/28, 10.10.8.16/28, 10.10.8.32/28… then I create one local network as 10.10.8.0/24, which covers all the VLANs under 8 section, does it work?

                                    Jeff

                                    Yes, if networks you want to be reachable can all aggregate like this into a single network, then you can specify a single aggregated network as "Local Network". All it does is make a route to whatever you put.
                                    Note: In 2.1-RC you can put a list of networks in "Local Network" and "Remote Network", so you can specify multiple disjoint networks without using the advanced box.

                                    As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                                    If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                                    1 Reply Last reply Reply Quote 0
                                    • J
                                      jeffwji
                                      last edited by

                                      Sounds great! thanks for every one!

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        jeffwji
                                        last edited by

                                        Hi Guys

                                        I'm back!

                                        I upgraded my little virtual network so that it looks be more secure. Now the draft is:

                                        |–------------------NEW ADDED---------------------------|
                                        |--Test outter network --||---------- External firewall----------||--------DMZ--------||--------Internal firewall--------||---Internal network
                                               [192.168.x.x] –--->[ WAN:192.168.137.36||LAN:10.10.1.1 ] <–-10.10.0.0/21---> [ DMZ:10.10.1.2||LAN:10.10.8.1 ]<–---10.10.8.0/21
                                                                          <----------------------- NAT------------------------------->|-OpenVPN(10.10.9.1/24)

                                        Yes, I added an external firewall in front of the old one. Mapped the OpenVPN to the world, and keep every thing on the old firewall as before(except change the name to internal firewall). As what we did, the VPN user is still able to access the now called "internal network"(10.10.8.0/21) via NAT, and I also set a static route on the new external firewall to make the DMZ(10.10.0.0/21) is able to access to 10.10.8.0/21. Now every thing works fine, but the VPN user can't access DMZ. How can I make it works? The current local network for VPN is 10.10.8.0/21, do I have to change it to 10.10.0.0/21? if so, will it lost the accessibility to 8.0/21?

                                        Jeff

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          marvosa
                                          last edited by

                                          You will need to add a route to it via the advanced config field… has this been done?

                                          Also, which DMZ are you trying to access?  Because you have your DMZ's in the same subnet on both firewalls.

                                          1 Reply Last reply Reply Quote 0
                                          • J
                                            jeffwji
                                            last edited by

                                            Right, when I added push "route 10.10.0.0 255.255.248.0" to the advanced, I'm able to access DMZ now. There's only one DMZ, why you think I have two?

                                            And I also have to add  push "route 10.10.8.0 255.255.255.0" to advanced, even though the local network has the same value, otherwise I'll be blocked by 10.10.8.0 section. (Advanced config overrides the local network instead of add-on?)

                                            And also If I put in "10.10.8.0 255.255.248.0", I purposed to be able to access 8.0 to 16.255, but failed. Is it because it covers the VPN subnet?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.