can't find openvpn key folder

qwertyjjj · 09-21-2009, 08:25 AM

Quote:

Originally Posted by prasanta

When you are connected to the VPN and start browsing, the IP address that the outside world will see is the address of the outgoing server (external IP of your LAN, in case you have done NAT). In case you are using a proxy server in the LAN, the client should also use the proxy for browsing.

Regards,

--
Prasanta

But this is not what happens.

At present my IP shows as 86.xxx.xxx.1
I then connect by OpenVPN to my server and get given an ip of 10.8.x.x
When I then visit a website on my client it should show the server's IP address of 88.xxx.xxx.xxx but it still shows 86.xxx.xxx.1

prasanta · 09-21-2009, 08:31 AM

Seems like you are not connected to your LAN via VPN. What is the output of `netstat -rn` and does your /etc/resolv.conf file entries remain the same before and after you connect to VPN.

Regards,

--
Prasanta

qwertyjjj · 09-21-2009, 08:40 AM

Quote:

Originally Posted by prasanta

Seems like you are not connected to your LAN via VPN. What is the output of `netstat -rn` and does your /etc/resolv.conf file entries remain the same before and after you connect to VPN.

Regards,

--
Prasanta

This is the client log

Code:

Mon Sep 21 14:35:40 2009 OpenVPN 2.0.9 Win32-MinGW [SSL] [LZO] built on Oct  1 2006
Mon Sep 21 14:35:40 2009 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Mon Sep 21 14:35:40 2009 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Sep 21 14:35:40 2009 LZO compression initialized
Mon Sep 21 14:35:40 2009 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Sep 21 14:35:40 2009 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Sep 21 14:35:40 2009 Local Options hash (VER=V4): '41690919'
Mon Sep 21 14:35:40 2009 Expected Remote Options hash (VER=V4): '530fdded'
Mon Sep 21 14:35:40 2009 UDPv4 link local: [undef]
Mon Sep 21 14:35:40 2009 UDPv4 link remote: 88.xxx.xx.xxx:1194
Mon Sep 21 14:35:41 2009 TLS: Initial packet from 88.xxx.xx.xxx:1194, sid=8ea8c024 d8147039
Mon Sep 21 14:35:41 2009 VERIFY OK: depth=1, /C=UK/ST=UK/L=London/O=namehere/CN=namehere/emailAddress=a@ab.co.uk
Mon Sep 21 14:35:41 2009 VERIFY OK: depth=0, /C=UK/ST=UK/L=London/O=namehere/CN=server/emailAddress=a@ab.co.uk
Mon Sep 21 14:35:42 2009 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Sep 21 14:35:42 2009 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Sep 21 14:35:42 2009 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Sep 21 14:35:42 2009 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Sep 21 14:35:42 2009 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon Sep 21 14:35:42 2009 [server] Peer Connection Initiated with 88.xxx.xx.xxx:1194
Mon Sep 21 14:35:43 2009 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Sep 21 14:35:43 2009 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.1,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Mon Sep 21 14:35:43 2009 OPTIONS IMPORT: timers and/or timeouts modified
Mon Sep 21 14:35:43 2009 OPTIONS IMPORT: --ifconfig/up options modified
Mon Sep 21 14:35:43 2009 OPTIONS IMPORT: route options modified
Mon Sep 21 14:35:43 2009 TAP-WIN32 device [Local Area Connection 5] opened: \\.\Global\{BF8EEE5D-7EE0-4410-9BB6-38E3F0E833CF}.tap
Mon Sep 21 14:35:43 2009 TAP-Win32 Driver Version 8.4 
Mon Sep 21 14:35:43 2009 TAP-Win32 MTU=1500
Mon Sep 21 14:35:43 2009 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {BF8EEE5D-7EE0-4410-9BB6-38E3F0E833CF} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Mon Sep 21 14:35:43 2009 Successful ARP Flush on interface [3] {BF8EEE5D-7EE0-4410-9BB6-38E3F0E833CF}
Mon Sep 21 14:35:43 2009 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Mon Sep 21 14:35:43 2009 Route: Waiting for TUN/TAP interface to come up...
Mon Sep 21 14:35:45 2009 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Mon Sep 21 14:35:45 2009 Route: Waiting for TUN/TAP interface to come up...
Mon Sep 21 14:35:46 2009 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Mon Sep 21 14:35:46 2009 Route: Waiting for TUN/TAP interface to come up...
Mon Sep 21 14:35:47 2009 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Mon Sep 21 14:35:47 2009 Route: Waiting for TUN/TAP interface to come up...
Mon Sep 21 14:35:48 2009 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Mon Sep 21 14:35:48 2009 Route: Waiting for TUN/TAP interface to come up...
Mon Sep 21 14:35:49 2009 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Mon Sep 21 14:35:49 2009 route ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Mon Sep 21 14:35:49 2009 Route addition via IPAPI succeeded
Mon Sep 21 14:35:49 2009 Initialization Sequence Completed

The client is on Windows so there is no resolv file.

netstat -rn on Windows client has:
http://www.sidekicker.net/connect.jpg

prasanta · 09-21-2009, 08:48 AM

I don't see your DNS entries in the log. You are getting an IP. Are you able to ping, 10.8.0.1?

Regards,

--
Prasanta

qwertyjjj · 09-21-2009, 08:49 AM

Quote:

Originally Posted by prasanta

I don't see your DNS entries in the log. You are getting an IP. Are you able to ping, 10.8.0.1?

Regards,

--
Prasanta

Yes, I can ping 10.8.0.1 from the client.

prasanta · 09-21-2009, 08:56 AM

That means you are able to reach the server. Try connecting any intranet website on your LAN using your LAN proxy, in case you have implemented it. In case you have you are not able to resolve try using the IP.

Regards,

--
Prasanta

qwertyjjj · 09-21-2009, 08:59 AM

Quote:

Originally Posted by prasanta

That means you are able to reach the server. Try connecting any intranet website on your LAN using your LAN proxy, in case you have implemented it. In case you have you are not able to resolve try using the IP.

Regards,

--
Prasanta

You mean from the client browser, connect to the server http proxy and then search for http://myserverip.com/somewebpage.htm

?

prasanta · 09-21-2009, 09:07 AM

Yes, try browsing your any intranet website on your LAN from the client. In case the DNS is not resolving use the IP address.

Regards,

--
Prasanta

qwertyjjj · 09-21-2009, 09:10 AM

Quote:

Originally Posted by prasanta

Yes, try browsing your any intranet website on your LAN from the client. In case the DNS is not resolving use the IP address.

Regards,

--
Prasanta

Ok, if I do that I can reach http://88.xx.xx.xx/sarg but that doesn't mean it's working because it could be using the WAN.
If go to http://127.0.0.1/sarg I get nothing
If I got to http://10.8.0.1/sarg I get nothing.

There is nothing else on my LAN, it is just one server sealed off from any other computers.

prasanta · 09-21-2009, 09:22 AM

The last line should work. In case you are using proxy, use that also to check. What does your `netstat -rn` look like in the server?

Regards,

--
Prasanta

qwertyjjj · 09-21-2009, 09:26 AM

Quote:

Originally Posted by prasanta

The last line should work. In case you are using proxy, use that also to check. What does your `netstat -rn` look like in the server?

Regards,

--
Prasanta

Code:

88.xxx here is the server IP

[root@localhost ~]# netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
10.8.0.2        0.0.0.0         255.255.255.255 UH        0 0          0 tun0
10.8.0.0        10.8.0.2        255.255.255.0   UG        0 0          0 tun0
88.xxx.xxx.0    0.0.0.0         255.255.252.0   U         0 0          0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth0
0.0.0.0         88.xxx.xxx.1    0.0.0.0         UG        0 0          0 eth0
[root@localhost ~]#

prasanta · 09-21-2009, 09:32 AM

Looks fine. That should work. You are using some kind of proxy server?

Regards,

--
Prasanta

qwertyjjj · 09-21-2009, 09:47 AM

Quote:

Originally Posted by prasanta

Looks fine. That should work. You are using some kind of proxy server?

Regards,

--
Prasanta

There is a proxy server on the server but I am not connected to it in my client browser.
When I connect via VPN on the client, the IP address shown should be the server's IP address not my own PC.
http://www.whatsmyip.org

prasanta · 09-21-2009, 09:56 AM

I did not get what you meant to say. Anyway, I hope you have the following situation.

Office LAN -> Firewall (Proxy/VPN) -> Internet

Now, you connect to the box Firewall (Proxy/VPN) from home (client) using VPN.

You get an IP 10.8.X.X from the VPN server. When you try to browse http://10.8.x.x/sarg from the client you are getting an error. Just use proxy in the client machine browser. You need to add an acl on the Proxy Server to route VPN traffic via proxy.

I hope this helps.

Regards,

--
Prasanta

qwertyjjj · 09-21-2009, 10:13 AM

Quote:

Originally Posted by prasanta

I did not get what you meant to say. Anyway, I hope you have the following situation.

Office LAN -> Firewall (Proxy/VPN) -> Internet

Now, you connect to the box Firewall (Proxy/VPN) from home (client) using VPN.

You get an IP 10.8.X.X from the VPN server. When you try to browse http://10.8.x.x/sarg from the client you are getting an error. Just use proxy in the client machine browser. You need to add an acl on the Proxy Server to route VPN traffic via proxy.

I hope this helps.

Regards,

--
Prasanta

No, I am on a home LAN.
Home LAN --> VPN server --> internet
except my internet seems to be
Home LAN --> ISP server --> internet even though it should be going to the VPN first.
I shouldn't have to use a proxy in the client machine browser at all should I to get the server IP address?
If you assume there is no proxy server on the server.
The VPN should work by itself.