Wrong route on client - can't access internal network

carlos_tavares · April 4, 2021, 3:38pm

Hi,

I configure open VPN, on this way.

my internal network is: 192.168.1.0/24

in this configuration my gatway on VPN network should be 192.168.3.1, but when open vpn client creat route, he create whith de previus ip to the one he givi to my client, exemple: my VPN IP 192.168.3.6, my gatway on route:: 192.168.3.5.

Windows route:
192.168.1.0 255.255.255.0 192.168.3.5 192.168.3.6 281
192.168.3.0 255.255.255.0 192.168.3.5 192.168.3.6 281

Open VPN Route:
Fri Apr 02 00:01:28 2021 MANAGEMENT: >STATE:1617332488,ADD_ROUTES,
Fri Apr 02 00:01:28 2021 C:\WINDOWS\system32\route.exe ADD 192.168.1.0 MASK 255.255.255.0 192.168.3.5
Fri Apr 02 00:01:28 2021 Route addition via service succeeded
Fri Apr 02 00:01:28 2021 C:\WINDOWS\system32\route.exe ADD 192.168.3.0 MASK 255.255.255.0 192.168.3.5
Fri Apr 02 00:01:28 2021 Route addition via service succeeded
Fri Apr 02 00:01:28 2021 C:\WINDOWS\system32\route.exe ADD 192.168.1.0 MASK 255.255.255.0 192.168.3.5
Fri Apr 02 00:01:28 2021 ROUTE: route addition failed using service: O objeto já existe. [status=5010 if_index=5]
Fri Apr 02 00:01:28 2021 Route addition via service failed
Fri Apr 02 00:01:28 2021 C:\WINDOWS\system32\route.exe ADD 192.168.3.1 MASK 255.255.255.255 192.168.3.5

any idea to solution ? tks

Andy_Wismer · April 4, 2021, 4:05pm

@carlos_tavares

Hi Carlos

And welcome to the NethServer community!

In my opinion, these will NOT work, if your NethServer is 192.168.1.1/24.

Bildschirmfoto 2021-04-04 um 18.00.25

For all three, you can use 192.168.1.1, which would be correct.

As to the Windows route, WHAT client are you using? Seems not to be Viscosity, IMHO the best OpenVPN client…

I’ve never had routing issues, and I’m using Viscosity for Macs and Windows (For all my clients too!)… I’ll go even further, I never had to bother about routing, the Internal LAN was / is always accessible for OpenVPN clients…

My 2 cents
Andy

carlos_tavares · April 5, 2021, 2:12am

Hi Andy,

When i conect on vpn, my server recive a IP 192.168.3.1, because this i use the DNS on that way.

I Will try use the vicosity, actualy i use the ooen DNS client for Windows.

TKS

carlos_tavares · April 5, 2021, 2:39am

Hi Andy,

I try use the viscosity and hava a same problem.

Tks for your advisor

Andy_Wismer · April 5, 2021, 7:02am

@carlos_tavares

Good Morning Carlos

The 192.168.3.0/24 network serves only one purpose, to let OpenVPN Clients connect to the NethServer, which in turn acts as a router to your “normal” LAN on 192.168.1.0/24.

Just because the Server uses 192.168.3.1 (and also 192.168.3.2…) does NOT mean that any services are available on those IPs…

In fact, normally, clients connecting with OpenVPN can’t even ping each other, less even connect. The IP is “isolated” from others… (Each client gets a special, virtual network with a /29 subnet, only allowing connections to the server - don’t ask me for details…).

This actually seems to show the correct route:

Normally, OpenVPN will allow your Roadwarrior client to reach your LAN (192.168.1.0/24) and any hosts on that LAN (Must have the NethServer as default gateway). You CAN configure more (much more!) options with OpenVPN, like all traffic passes through the VPN. This makes sense for a company, which “protects” notebooks by routing all trafic through the companys site, where there are recoursses like firewalls, virus scanners etc…

Just ignore the 192.168.3.0/24 network on your client when it comes to routing…

My 2 cents
Andy

A working “sample” configuration. The Nethserver is “hosted”, and directly reachable from the Internet. A second, virtual NIC, has the LAN IP 192.168.10.2, this IP is reachable by all clients.