OpenVPN doesn't return subnet mask correctly

[jeffwji]

Hi, recently I have set up my first OpenVPN server. But when I logged in, I could n't go any where. After spent some time, I found vpn server did return correct subnet mask, the following is the information received from the server:

–-----------------------
  Connection-specific DNS Suffix  . :
  Description . . . . . . . . . . . : TAP-Windows Adapter V9
  Physical Address. . . . . . . . . : 00-FF-37-C7-BC-5E
  DHCP Enabled. . . . . . . . . . . : Yes
  Autoconfiguration Enabled . . . . : Yes
  Link-local IPv6 Address . . . . . : fe80::e80d:159:929:c916%15(Preferred)
  IPv4 Address. . . . . . . . . . . : 10.10.3.10(Preferred)
  Subnet Mask . . . . . . . . . . . : 255.255.255.252
  Lease Obtained. . . . . . . . . . : June-23-13 12:32:08 AM
  Lease Expires . . . . . . . . . . : June-23-14 12:32:08 AM
  Default Gateway . . . . . . . . . :
  DHCP Server . . . . . . . . . . . : 10.10.3.9
  DHCPv6 IAID . . . . . . . . . . . : 251723575
  DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-E4-04-B5-00-1A-A0-BE-E8-4B

DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                      fec0:0:0:ffff::2%1
                                      fec0:0:0:ffff::3%1
  NetBIOS over Tcpip. . . . . . . . : Enabled

Apparently, the subnet mask has been set to 30, no gateway has been returned. But I set the tunnel network as 10.10.3.0/24 and local network is blank. is there anything else possibly effects to this value? I have the WAN from DHCP, LAN's address is 10.10.1.1/24 and one VLAN set to 10.10.2.1/28.

Any help is appreciate.

Jeff

[jeffwji]

That's the openvpn client log:

–------------
Sun Jun 23 00:31:55 2013 DEPRECATED OPTION: --tls-remote, please update your configuration
Sun Jun 23 00:31:55 2013 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Jun  3 2013
Sun Jun 23 00:32:05 2013 Control Channel Authentication: using 'efw-udp-1194-tls.key' as a OpenVPN static key file
Sun Jun 23 00:32:05 2013 UDPv4 link local (bound): [undef]
Sun Jun 23 00:32:05 2013 UDPv4 link remote: [AF_INET]192.168.137.83:1194
Sun Jun 23 00:32:05 2013 WARNING: this configuration may cache passwords in memory – use the auth-nocache option to prevent this
Sun Jun 23 00:32:06 2013 [vpnuser] Peer Connection Initiated with [AF_INET]192.168.137.83:1194
Sun Jun 23 00:32:08 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Jun 23 00:32:08 2013 open_tun, tt->ipv6=0
Sun Jun 23 00:32:08 2013 TAP-WIN32 device [Local Area Connection 2] opened: \.\Global{37C7BC5E-7CD9-4933-9E3B-70A67DF1412E}.tap
Sun Jun 23 00:32:08 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.10.3.10/255.255.255.252 on interface {37C7BC5E-7CD9-4933-9E3B-70A67DF1412E} [DHCP-serv: 10.10.3.9, lease-time: 31536000]
Sun Jun 23 00:32:08 2013 Successful ARP Flush on interface [15] {37C7BC5E-7CD9-4933-9E3B-70A67DF1412E}
Sun Jun 23 00:32:13 2013 Initialization Sequence Completed
–-------------------

[jeffwji]

Nobody know this problem?

To reduce the complication, I set up a test server, which only has basic router and openvpn, set them with the same IPs, and keep other config as default, the problem has been reproduced. Now I'm thinking probably is because the VM? I'm using it in ESXi 5.1, what I should pay particular attention?

[rubic]

http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html

[Nachtfalke]

@rubic:

http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html

That is exactly the point.

Make sure you run the OpenVPN client on Windows machines as "Administrator" and make sure you set allo rules on the firewall –> OpenVPN tab.

[jeffwji]

@Nachtfalke:

@rubic:

http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html

That is exactly the point.

Make sure you run the OpenVPN client on Windows machines as "Administrator" and make sure you set allo rules on the firewall –> OpenVPN tab.

Actually the vpn client is running under administrator.

[jeffwji]

@rubic:

http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html

For the explanation, a 252 subnet is just normal. but it still not resolves my problem as the dns and gateway are still empty, I think at least I should receive them, because I can get them when I connect to my office by an other certificate.

And the client keeps saying "write to TUN/TAP  [State=AT?c Err=[c:\users\samuli\tap-windows-github\src\tapdrvr.c/2475] #O=12 Tx=[4204,0] Rx=[489,100] IrpQ=[1,1,16] PktQ=[0,3,64] InjQ=[0,1,16]]: The data area passed to a system call is too small.   (code=122)". I'm not sure does it cause the problem?

[marvosa]

Post your server1.conf, so we can take a look.

[jeffwji]

@marvosa:

Post your server1.conf, so we can take a look.

dev ovpns1
dev-type tun
dev-node /dev/tun1
writepid /var/run/openvpn_server1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-128-CBC
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local 192.168.137.83
tls-server
server 10.10.8.16 255.255.255.240
client-config-dir /var/etc/openvpn-csc
username-as-common-name
auth-user-pass-verify /var/etc/openvpn/server1.php via-env
tls-verify /var/etc/openvpn/server1.tls-verify.php
lport 1194
management /var/etc/openvpn/server1.sock unix
client-to-client
ca /var/etc/openvpn/server1.ca
cert /var/etc/openvpn/server1.cert
key /var/etc/openvpn/server1.key
dh /etc/dh-parameters.1024
tls-auth /var/etc/openvpn/server1.tls-auth 0
comp-lzo
persist-remote-ip
float

[jeffwji]

Hi Marvosa

Do I have to add more rule except the default "* to *" under openvpn tab? To make sure I can access the management GUI, I added "10.10.8.16/28 to *" to LAN, is it necessary?

Jeff

[marvosa]

Ok, from your original post, "when I logged in, I could n't go any where", meaning… you can't reach anything on your LAN?

Well, here's the mystery:

Your tunnel network is 10.10.8.16/28, so I'm not sure how your virtual adapter is getting an IP of 10.10.3.10... do you have multiple servers configured?  Are you sure you're connecting to the right server?  Check Status -> OpenVPN... make sure you're connecting to the right server... because you should receive a virtual address in the 10.10.8.17 - 10.10.8.30 range.

I do not see any routes back to your LAN (e.g. push "route 192.168.50.0 255.255.255.0")  or a "max-clients" statement... so there are some missing elements in your config.  Go back thru your config (VPN -> OpenVPN) and double check that it's configured correctly for your network.... the "Tunnel Settings" section in particular.... from what I can tell you have left at least the Local Network and Concurrent connections fields empty.

Firewall rules, if you have an any/any (|||||) in place that's all you need on your openvpn tab… remove anything else.

It looks like you're double NATing, post a network map so we can see how your network is configured.

Also, looking at your client log.... you're attempting to connect to 192.168.137.83:1194, which according to your server1.conf is your external IP... are you trying to test from inside your network?  If so, that's not going to work... something's not adding up... at any rate... according to this -> "DHCP IP/netmask of 10.10.3.10/255.255.255.252" you're connecting to the wrong server... because you should be seeing something in the 10.10.8.17 - 10.10.8.30 according to your server1.conf.

[jeffwji]

Hi Marvosa

Thanks you for your reply. I re-installed the server, so the IP changed, now it's 10.10.8.16/28, which before is 10.10.3…. I thought about to set a static router for vpn network, but I can't see where is the place in the openvpn setting, but a "Redirect gateway", which I don't think it's necessary to be checked.(actually is I'm not very understand what means "Force all client generated traffice through the tunnel"). And in the "system->routing" page, 192.168.137.83 is the default gateway. 192.168.137.0 is my test network which connects to the WAN interface.

As I don't know how to post a picture, I'll try my best to describe the aspect:

Draft:
|  Test network  |       |                                   PFSENSE                                                   |
192.168.137.0/24 <==> WAN (DHCP:192.168.137.83) ==> LAN (Static:10.10.8.1; net:10.10.8.0/28; DHCP enabled)
                                                                       ==> OpenVPN (Tunnel: 10.10.8.16/28; Interface: WAN; Device mode: tun; Local network: empty; Redirect gateway: unckecked.)

Rule:
 WAN: None. (allowed to be connected from private network)
 OpenVPN: All *
 LAN: net to any.

Gateway:
 192.168.137.83(default)

Result:
 LAN net is able to access management UI (10.10.8.1) and the world.
 OpenVPN got 10.10.8.19, but couldn't talks to any IP but the client it self.

[marvosa]

So, your LAN is 10.10.8.0/28, but you will not be able to access your network until you add something to the "Local Network" field.  Set your "Local Network" 10.10.8.0/28.

The "Redirect Gateway" option is for doing full tunnel vs split tunnel…if it's checked, all internet traffic from the client-side will be routed thru the VPN instead of using it's own connection.  If left un-checked, only traffic destined for 10.10.8.0/28 will be routed thru the VPN.... everything else will use the clients own connection.

[jeffwji]

So you think that's because my openvpn is too close to the LAN network? How if I change the OpenVPN to 10.10.9.0/24? will it works for the empty local network? But I'm confused as I separated the vpn and lan by sub-network mask, it doesn't work?

Jeff

[jeffwji]

Ok! I get it!! if the vpn tunnel is not within the LAN range, you have to name the local network! that's it! Thank you Marvosa!

[marvosa]

Well… you are sort of making it hard on your self with the subnets you've chosen, but changing the tunnel network is not the problem.  The main issue is the "Local Network" field is blank, so your clients are getting the routes they need.

[marvosa]

Jeffwji, Sort of :)  Actually in a routed VPN solution, the tunnel network can NOT be within the LAN range… which is why you need to name the local network... so your clients know that packets destined for the 10.10.8.0/28 network need to be routed over the VPN.

[jeffwji]

Sorry, I'm back again. :-[

I'm now able to visit the management UI from VPN network, that means I'm able to access 10.10.8.1. Then I did the two tests:

1. Created a machine on LAN net, which the IP is 10.10.8.5
2. Created a VLAN which the net is 10.10.8.32/28(Gateway 33), and setup a machine on 10.10.8.35.

Created two rules for both of the them, allow all the IPs from those two net to go any. Then tried to talk with this two machines from VPN, the first one passed, but the second failed. Why?

[marvosa]

Because 10.10.8.5/28 is in your "Local Network" where as 10.10.8.35/28 is not.

By default, the system only provides routing to what's configured in the "Local Network".  Access to other subnets need to be configured in the "Advanced configuration" section.  Add the following statement to the "Advanced configuration" field:

push "route 10.10.8.32 255.255.255.240"

[jeffwji]

So that means I have to create individual item for each subnet? How about if I have many VLANs, for example, 10.10.8.0/28, 10.10.8.16/28, 10.10.8.32/28… then I create one local network as 10.10.8.0/24, which covers all the VLANs under 8 section, does it work?

Jeff