Hi, On 18/05/15 16:04, Josu Lazkano wrote: > Thanks Jan! > > Yes it works! > > # ping -c 5 10.8.0.1 > PING 10.8.0.1 (10.8.0.1): 56 data bytes > 64 bytes from 10.8.0.1: seq=0 ttl=64 time=24.932 ms > 64 bytes from 10.8.0.1: seq=1 ttl=64 time=26.336 ms > 64 bytes from 10.8.0.1: seq=2 ttl=64 time=14.127 ms > 64 bytes from 10.8.0.1: seq=3 ttl=64 time=33.588 ms > 64 bytes from 10.8.0.1: seq=4 ttl=64 time=16.227 ms > > --- 10.8.0.1 ping statistics --- > 5 packets transmitted, 5 packets received, 0% packet loss > round-trip min/avg/max = 14.127/23.042/33.588 ms > > But I want to access to 192.168.1.0/24 network, need I create route in > the shell or in the OpenVPN configuration? >
I'd normally add it to the openvpn configuration push "route 192.168.1.0 255.255.255.0" but I am not sure how this would then be stored in an OpenWRT config file. You'll also have to make sure that the return route is known on the server side - if the openwrt acts as the LAN's default gateway then you're all set. HTH, JJK > 2015-05-18 15:43 GMT+02:00 Jan Just Keijser <[email protected]>: >> On 18/05/15 15:29, Josu Lazkano wrote: >>> Thanks both! >>> >>> I try with server-client mode: >>> >>> server configuration (192.168.1.1/24) >>> >>> # cat /etc/config/openvpn >>> >>> config openvpn 'myvpn' >>> option enabled '1' >>> option dev 'tun' >>> option port '1194' >>> option proto 'udp' >>> option log '/tmp/openvpn.log' >>> option verb '3' >>> option ca '/etc/openvpn/ca.crt' >>> option cert '/etc/openvpn/my-server.crt' >>> option key '/etc/openvpn/my-server.key' >>> option server '10.8.0.0 255.255.255.0' >>> option ifconfig '10.8.0.1 10.8.0.2' >>> option dh '/etc/openvpn/dh512.pem' >>> >>> client configuration (192.168.2.1/24) >>> >>> # cat /etc/config/openvpn >>> >>> config openvpn 'myvpn' >>> option enabled '1' >>> option dev 'tun' >>> option proto 'udp' >>> option log '/tmp/openvpn.log' >>> option verb '3' >>> option ca '/etc/openvpn/ca.crt' >>> option cert '/etc/openvpn/my-client.crt' >>> option key '/etc/openvpn/my-client.key' >>> option client '1' >>> option remote_cert_tls 'server' >>> option ifconfig '10.8.0.2 10.8.0.1' >>> option remote 'MYHOST 1194' >>> >>> This is the server log file: >>> >>> Mon May 18 14:31:41 2015 OpenVPN 2.3.6 mips-openwrt-linux-gnu [SSL >>> (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jan 6 2015 >>> Mon May 18 14:31:41 2015 library versions: OpenSSL 1.0.2a 19 Mar 2015, LZO >>> 2.08 >>> Mon May 18 14:31:41 2015 WARNING: --keepalive option is missing from >>> server config >>> Mon May 18 14:31:41 2015 Diffie-Hellman initialized with 512 bit key >>> Mon May 18 14:31:41 2015 Socket Buffers: R=[163840->131072] >>> S=[163840->131072] >>> Mon May 18 14:31:41 2015 TUN/TAP device tun0 opened >>> Mon May 18 14:31:41 2015 TUN/TAP TX queue length set to 100 >>> Mon May 18 14:31:41 2015 do_ifconfig, tt->ipv6=0, >>> tt->did_ifconfig_ipv6_setup=0 >>> Mon May 18 14:31:41 2015 /sbin/ifconfig tun0 10.8.0.1 pointopoint >>> 10.8.0.2 mtu 1500 >>> Mon May 18 14:31:41 2015 /sbin/route add -net 10.8.0.0 netmask >>> 255.255.255.0 gw 10.8.0.2 >>> Mon May 18 14:31:41 2015 UDPv4 link local (bound): [undef] >>> Mon May 18 14:31:41 2015 UDPv4 link remote: [undef] >>> Mon May 18 14:31:41 2015 MULTI: multi_init called, r=256 v=256 >>> Mon May 18 14:31:41 2015 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0 >>> Mon May 18 14:31:41 2015 Initialization Sequence Completed >>> ###client connection##### >>> Mon May 18 14:32:14 2015 85.84.148.223:1194 TLS: Initial packet from >>> [AF_INET]85.84.148.223:1194, sid=07aaea2a afa2bb55 >>> Mon May 18 14:32:14 2015 85.84.148.223:1194 VERIFY OK: depth=1, C=ES, >>> ST=Gipuzkoa, L=Zarautz, O=Mitxelena, OU=MYHOST, CN=Mitxelena CA, >>> name=EasyRSA, emailAddress=MYMAIL >>> Mon May 18 14:32:14 2015 85.84.148.223:1194 VERIFY OK: depth=0, C=ES, >>> ST=Gipuzkoa, L=Zarautz, O=Mitxelena, OU=MYHOST, CN=my-client, >>> name=EasyRSA, emailAddress=MYMAIL >>> Mon May 18 14:32:14 2015 85.84.148.223:1194 Data Channel Encrypt: >>> Cipher 'BF-CBC' initialized with 128 bit key >>> Mon May 18 14:32:14 2015 85.84.148.223:1194 Data Channel Encrypt: >>> Using 160 bit message hash 'SHA1' for HMAC authentication >>> Mon May 18 14:32:14 2015 85.84.148.223:1194 Data Channel Decrypt: >>> Cipher 'BF-CBC' initialized with 128 bit key >>> Mon May 18 14:32:14 2015 85.84.148.223:1194 Data Channel Decrypt: >>> Using 160 bit message hash 'SHA1' for HMAC authentication >>> Mon May 18 14:32:14 2015 85.84.148.223:1194 Control Channel: TLSv1, >>> cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 512 bit RSA >>> Mon May 18 14:32:14 2015 85.84.148.223:1194 [my-client] Peer >>> Connection Initiated with [AF_INET]85.84.148.223:1194 >>> Mon May 18 14:32:14 2015 my-client/85.84.148.223:1194 MULTI_sva: pool >>> returned IPv4=10.8.0.6, IPv6=(Not enabled) >>> Mon May 18 14:32:14 2015 my-client/85.84.148.223:1194 MULTI: Learn: >>> 10.8.0.6 -> my-client/85.84.148.223:1194 >>> Mon May 18 14:32:14 2015 my-client/85.84.148.223:1194 MULTI: primary >>> virtual IP for my-client/85.84.148.223:1194: 10.8.0.6 >>> Mon May 18 14:32:17 2015 my-client/85.84.148.223:1194 PUSH: Received >>> control message: 'PUSH_REQUEST' >>> Mon May 18 14:32:17 2015 my-client/85.84.148.223:1194 >>> send_push_reply(): safe_cap=940 >>> Mon May 18 14:32:17 2015 my-client/85.84.148.223:1194 SENT CONTROL >>> [my-client]: 'PUSH_REPLY,route 10.8.0.1,topology net30,ifconfig >>> 10.8.0.6 10.8.0.5' (status=1) >>> >>> This is the client log file: >>> >>> Mon May 18 14:32:14 2015 OpenVPN 2.3.6 mips-openwrt-linux-gnu [SSL >>> (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jan 6 2015 >>> Mon May 18 14:32:14 2015 library versions: OpenSSL 1.0.2a 19 Mar 2015, LZO >>> 2.08 >>> Mon May 18 14:32:14 2015 WARNING: using --pull/--client and --ifconfig >>> together is probably not what you want >>> Mon May 18 14:32:14 2015 Socket Buffers: R=[163840->131072] >>> S=[163840->131072] >>> Mon May 18 14:32:14 2015 UDPv4 link local (bound): [undef] >>> Mon May 18 14:32:14 2015 UDPv4 link remote: [AF_INET]85.86.X.X:1194 >>> Mon May 18 14:32:14 2015 TLS: Initial packet from >>> [AF_INET]85.86.X.X:1194, sid=e6644868 82fc1c45 >>> Mon May 18 14:32:14 2015 VERIFY OK: depth=1, C=ES, ST=Gipuzkoa, >>> L=Zarautz, O=Mitxelena, OU=MYHOST, CN=Mitxelena CA, name=EasyRSA, >>> emailAddress=MYMAIL >>> Mon May 18 14:32:14 2015 Validating certificate key usage >>> Mon May 18 14:32:14 2015 ++ Certificate has key usage 00a0, expects 00a0 >>> Mon May 18 14:32:14 2015 VERIFY KU OK >>> Mon May 18 14:32:14 2015 Validating certificate extended key usage >>> Mon May 18 14:32:14 2015 ++ Certificate has EKU (str) TLS Web Server >>> Authentication, expects TLS Web Server Authentication >>> Mon May 18 14:32:14 2015 VERIFY EKU OK >>> Mon May 18 14:32:14 2015 VERIFY OK: depth=0, C=ES, ST=Gipuzkoa, >>> L=Zarautz, O=Mitxelena, OU=MYHOST, CN=my-server, name=EasyRSA, >>> emailAddress=MYMAIL >>> Mon May 18 14:32:14 2015 Data Channel Encrypt: Cipher 'BF-CBC' >>> initialized with 128 bit key >>> Mon May 18 14:32:14 2015 Data Channel Encrypt: Using 160 bit message >>> hash 'SHA1' for HMAC authentication >>> Mon May 18 14:32:14 2015 Data Channel Decrypt: Cipher 'BF-CBC' >>> initialized with 128 bit key >>> Mon May 18 14:32:14 2015 Data Channel Decrypt: Using 160 bit message >>> hash 'SHA1' for HMAC authentication >>> Mon May 18 14:32:14 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 >>> DHE-RSA-AES256-SHA, 512 bit RSA >>> Mon May 18 14:32:14 2015 [my-server] Peer Connection Initiated with >>> [AF_INET]85.86.X.X:1194 >>> Mon May 18 14:32:17 2015 SENT CONTROL [my-server]: 'PUSH_REQUEST' >>> (status=1) >>> Mon May 18 14:32:17 2015 PUSH: Received control message: >>> 'PUSH_REPLY,route 10.8.0.1,topology net30,ifconfig 10.8.0.6 10.8.0.5' >>> Mon May 18 14:32:17 2015 OPTIONS IMPORT: --ifconfig/up options modified >>> Mon May 18 14:32:17 2015 OPTIONS IMPORT: route options modified >>> Mon May 18 14:32:17 2015 TUN/TAP device tun0 opened >>> Mon May 18 14:32:17 2015 TUN/TAP TX queue length set to 100 >>> Mon May 18 14:32:17 2015 do_ifconfig, tt->ipv6=0, >>> tt->did_ifconfig_ipv6_setup=0 >>> Mon May 18 14:32:17 2015 /sbin/ifconfig tun0 10.8.0.6 pointopoint >>> 10.8.0.5 mtu 1500 >>> Mon May 18 14:32:17 2015 /sbin/route add -net 10.8.0.1 netmask >>> 255.255.255.255 gw 10.8.0.5 >>> Mon May 18 14:32:17 2015 Initialization Sequence Completed >>> >>> The problem is that in the client side the IPs are not well. This is >>> server tun0 interface: >>> >>> # ifconfig tun0 >>> tun0 Link encap:UNSPEC HWaddr >>> 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 >>> inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255 >>> UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 >>> RX packets:0 errors:0 dropped:0 overruns:0 frame:0 >>> TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 >>> collisions:0 txqueuelen:100 >>> RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) >>> >>> This is in the client side: >>> >>> # ifconfig tun0 >>> tun0 Link encap:UNSPEC HWaddr >>> 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 >>> inet addr:10.8.0.6 P-t-P:10.8.0.5 Mask:255.255.255.255 >>> UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 >>> RX packets:0 errors:0 dropped:0 overruns:0 frame:0 >>> TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 >>> collisions:0 txqueuelen:100 >>> RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) >>> >>> I am missing something? >>> >>> >> in a 'default' setup this is exactly what you're supposed to see :) >> don't try to ping the 10.8.0.5 interface, ping the 10.8.0.1 interface >> instead. If you can reach that address then your VPN is functioning. >> >> >> HTH, >> >> JJK >> > > ------------------------------------------------------------------------------ One dashboard for servers and applications across Physical-Virtual-Cloud Widest out-of-the-box monitoring support with 50+ applications Performance metrics, stats and reports that give you Actionable Insights Deep dive visibility with transaction tracing using APM Insight. http://ad.doubleclick.net/ddm/clk/290420510;117567292;y _______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users
