Thanks Jan! Yes it works!
# ping -c 5 10.8.0.1 PING 10.8.0.1 (10.8.0.1): 56 data bytes 64 bytes from 10.8.0.1: seq=0 ttl=64 time=24.932 ms 64 bytes from 10.8.0.1: seq=1 ttl=64 time=26.336 ms 64 bytes from 10.8.0.1: seq=2 ttl=64 time=14.127 ms 64 bytes from 10.8.0.1: seq=3 ttl=64 time=33.588 ms 64 bytes from 10.8.0.1: seq=4 ttl=64 time=16.227 ms --- 10.8.0.1 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max = 14.127/23.042/33.588 ms But I want to access to 192.168.1.0/24 network, need I create route in the shell or in the OpenVPN configuration? Best regards. 2015-05-18 15:43 GMT+02:00 Jan Just Keijser <[email protected]>: > On 18/05/15 15:29, Josu Lazkano wrote: >> >> Thanks both! >> >> I try with server-client mode: >> >> server configuration (192.168.1.1/24) >> >> # cat /etc/config/openvpn >> >> config openvpn 'myvpn' >> option enabled '1' >> option dev 'tun' >> option port '1194' >> option proto 'udp' >> option log '/tmp/openvpn.log' >> option verb '3' >> option ca '/etc/openvpn/ca.crt' >> option cert '/etc/openvpn/my-server.crt' >> option key '/etc/openvpn/my-server.key' >> option server '10.8.0.0 255.255.255.0' >> option ifconfig '10.8.0.1 10.8.0.2' >> option dh '/etc/openvpn/dh512.pem' >> >> client configuration (192.168.2.1/24) >> >> # cat /etc/config/openvpn >> >> config openvpn 'myvpn' >> option enabled '1' >> option dev 'tun' >> option proto 'udp' >> option log '/tmp/openvpn.log' >> option verb '3' >> option ca '/etc/openvpn/ca.crt' >> option cert '/etc/openvpn/my-client.crt' >> option key '/etc/openvpn/my-client.key' >> option client '1' >> option remote_cert_tls 'server' >> option ifconfig '10.8.0.2 10.8.0.1' >> option remote 'MYHOST 1194' >> >> This is the server log file: >> >> Mon May 18 14:31:41 2015 OpenVPN 2.3.6 mips-openwrt-linux-gnu [SSL >> (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jan 6 2015 >> Mon May 18 14:31:41 2015 library versions: OpenSSL 1.0.2a 19 Mar 2015, LZO >> 2.08 >> Mon May 18 14:31:41 2015 WARNING: --keepalive option is missing from >> server config >> Mon May 18 14:31:41 2015 Diffie-Hellman initialized with 512 bit key >> Mon May 18 14:31:41 2015 Socket Buffers: R=[163840->131072] >> S=[163840->131072] >> Mon May 18 14:31:41 2015 TUN/TAP device tun0 opened >> Mon May 18 14:31:41 2015 TUN/TAP TX queue length set to 100 >> Mon May 18 14:31:41 2015 do_ifconfig, tt->ipv6=0, >> tt->did_ifconfig_ipv6_setup=0 >> Mon May 18 14:31:41 2015 /sbin/ifconfig tun0 10.8.0.1 pointopoint >> 10.8.0.2 mtu 1500 >> Mon May 18 14:31:41 2015 /sbin/route add -net 10.8.0.0 netmask >> 255.255.255.0 gw 10.8.0.2 >> Mon May 18 14:31:41 2015 UDPv4 link local (bound): [undef] >> Mon May 18 14:31:41 2015 UDPv4 link remote: [undef] >> Mon May 18 14:31:41 2015 MULTI: multi_init called, r=256 v=256 >> Mon May 18 14:31:41 2015 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0 >> Mon May 18 14:31:41 2015 Initialization Sequence Completed >> ###client connection##### >> Mon May 18 14:32:14 2015 85.84.148.223:1194 TLS: Initial packet from >> [AF_INET]85.84.148.223:1194, sid=07aaea2a afa2bb55 >> Mon May 18 14:32:14 2015 85.84.148.223:1194 VERIFY OK: depth=1, C=ES, >> ST=Gipuzkoa, L=Zarautz, O=Mitxelena, OU=MYHOST, CN=Mitxelena CA, >> name=EasyRSA, emailAddress=MYMAIL >> Mon May 18 14:32:14 2015 85.84.148.223:1194 VERIFY OK: depth=0, C=ES, >> ST=Gipuzkoa, L=Zarautz, O=Mitxelena, OU=MYHOST, CN=my-client, >> name=EasyRSA, emailAddress=MYMAIL >> Mon May 18 14:32:14 2015 85.84.148.223:1194 Data Channel Encrypt: >> Cipher 'BF-CBC' initialized with 128 bit key >> Mon May 18 14:32:14 2015 85.84.148.223:1194 Data Channel Encrypt: >> Using 160 bit message hash 'SHA1' for HMAC authentication >> Mon May 18 14:32:14 2015 85.84.148.223:1194 Data Channel Decrypt: >> Cipher 'BF-CBC' initialized with 128 bit key >> Mon May 18 14:32:14 2015 85.84.148.223:1194 Data Channel Decrypt: >> Using 160 bit message hash 'SHA1' for HMAC authentication >> Mon May 18 14:32:14 2015 85.84.148.223:1194 Control Channel: TLSv1, >> cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 512 bit RSA >> Mon May 18 14:32:14 2015 85.84.148.223:1194 [my-client] Peer >> Connection Initiated with [AF_INET]85.84.148.223:1194 >> Mon May 18 14:32:14 2015 my-client/85.84.148.223:1194 MULTI_sva: pool >> returned IPv4=10.8.0.6, IPv6=(Not enabled) >> Mon May 18 14:32:14 2015 my-client/85.84.148.223:1194 MULTI: Learn: >> 10.8.0.6 -> my-client/85.84.148.223:1194 >> Mon May 18 14:32:14 2015 my-client/85.84.148.223:1194 MULTI: primary >> virtual IP for my-client/85.84.148.223:1194: 10.8.0.6 >> Mon May 18 14:32:17 2015 my-client/85.84.148.223:1194 PUSH: Received >> control message: 'PUSH_REQUEST' >> Mon May 18 14:32:17 2015 my-client/85.84.148.223:1194 >> send_push_reply(): safe_cap=940 >> Mon May 18 14:32:17 2015 my-client/85.84.148.223:1194 SENT CONTROL >> [my-client]: 'PUSH_REPLY,route 10.8.0.1,topology net30,ifconfig >> 10.8.0.6 10.8.0.5' (status=1) >> >> This is the client log file: >> >> Mon May 18 14:32:14 2015 OpenVPN 2.3.6 mips-openwrt-linux-gnu [SSL >> (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jan 6 2015 >> Mon May 18 14:32:14 2015 library versions: OpenSSL 1.0.2a 19 Mar 2015, LZO >> 2.08 >> Mon May 18 14:32:14 2015 WARNING: using --pull/--client and --ifconfig >> together is probably not what you want >> Mon May 18 14:32:14 2015 Socket Buffers: R=[163840->131072] >> S=[163840->131072] >> Mon May 18 14:32:14 2015 UDPv4 link local (bound): [undef] >> Mon May 18 14:32:14 2015 UDPv4 link remote: [AF_INET]85.86.X.X:1194 >> Mon May 18 14:32:14 2015 TLS: Initial packet from >> [AF_INET]85.86.X.X:1194, sid=e6644868 82fc1c45 >> Mon May 18 14:32:14 2015 VERIFY OK: depth=1, C=ES, ST=Gipuzkoa, >> L=Zarautz, O=Mitxelena, OU=MYHOST, CN=Mitxelena CA, name=EasyRSA, >> emailAddress=MYMAIL >> Mon May 18 14:32:14 2015 Validating certificate key usage >> Mon May 18 14:32:14 2015 ++ Certificate has key usage 00a0, expects 00a0 >> Mon May 18 14:32:14 2015 VERIFY KU OK >> Mon May 18 14:32:14 2015 Validating certificate extended key usage >> Mon May 18 14:32:14 2015 ++ Certificate has EKU (str) TLS Web Server >> Authentication, expects TLS Web Server Authentication >> Mon May 18 14:32:14 2015 VERIFY EKU OK >> Mon May 18 14:32:14 2015 VERIFY OK: depth=0, C=ES, ST=Gipuzkoa, >> L=Zarautz, O=Mitxelena, OU=MYHOST, CN=my-server, name=EasyRSA, >> emailAddress=MYMAIL >> Mon May 18 14:32:14 2015 Data Channel Encrypt: Cipher 'BF-CBC' >> initialized with 128 bit key >> Mon May 18 14:32:14 2015 Data Channel Encrypt: Using 160 bit message >> hash 'SHA1' for HMAC authentication >> Mon May 18 14:32:14 2015 Data Channel Decrypt: Cipher 'BF-CBC' >> initialized with 128 bit key >> Mon May 18 14:32:14 2015 Data Channel Decrypt: Using 160 bit message >> hash 'SHA1' for HMAC authentication >> Mon May 18 14:32:14 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 >> DHE-RSA-AES256-SHA, 512 bit RSA >> Mon May 18 14:32:14 2015 [my-server] Peer Connection Initiated with >> [AF_INET]85.86.X.X:1194 >> Mon May 18 14:32:17 2015 SENT CONTROL [my-server]: 'PUSH_REQUEST' >> (status=1) >> Mon May 18 14:32:17 2015 PUSH: Received control message: >> 'PUSH_REPLY,route 10.8.0.1,topology net30,ifconfig 10.8.0.6 10.8.0.5' >> Mon May 18 14:32:17 2015 OPTIONS IMPORT: --ifconfig/up options modified >> Mon May 18 14:32:17 2015 OPTIONS IMPORT: route options modified >> Mon May 18 14:32:17 2015 TUN/TAP device tun0 opened >> Mon May 18 14:32:17 2015 TUN/TAP TX queue length set to 100 >> Mon May 18 14:32:17 2015 do_ifconfig, tt->ipv6=0, >> tt->did_ifconfig_ipv6_setup=0 >> Mon May 18 14:32:17 2015 /sbin/ifconfig tun0 10.8.0.6 pointopoint >> 10.8.0.5 mtu 1500 >> Mon May 18 14:32:17 2015 /sbin/route add -net 10.8.0.1 netmask >> 255.255.255.255 gw 10.8.0.5 >> Mon May 18 14:32:17 2015 Initialization Sequence Completed >> >> The problem is that in the client side the IPs are not well. This is >> server tun0 interface: >> >> # ifconfig tun0 >> tun0 Link encap:UNSPEC HWaddr >> 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 >> inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255 >> UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 >> RX packets:0 errors:0 dropped:0 overruns:0 frame:0 >> TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 >> collisions:0 txqueuelen:100 >> RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) >> >> This is in the client side: >> >> # ifconfig tun0 >> tun0 Link encap:UNSPEC HWaddr >> 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 >> inet addr:10.8.0.6 P-t-P:10.8.0.5 Mask:255.255.255.255 >> UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 >> RX packets:0 errors:0 dropped:0 overruns:0 frame:0 >> TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 >> collisions:0 txqueuelen:100 >> RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) >> >> I am missing something? >> >> > in a 'default' setup this is exactly what you're supposed to see :) > don't try to ping the 10.8.0.5 interface, ping the 10.8.0.1 interface > instead. If you can reach that address then your VPN is functioning. > > > HTH, > > JJK > -- Josu Lazkano ------------------------------------------------------------------------------ One dashboard for servers and applications across Physical-Virtual-Cloud Widest out-of-the-box monitoring support with 50+ applications Performance metrics, stats and reports that give you Actionable Insights Deep dive visibility with transaction tracing using APM Insight. http://ad.doubleclick.net/ddm/clk/290420510;117567292;y _______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users
