<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv=Content-Type content="text/html; charset=us-ascii"> <meta name=Generator content="Microsoft Word 11 (filtered medium)"> <o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags" name="PersonName"/>  <style>  </style>  </head> <body lang=EN-US link=blue vlink=purple> <div class=Section1> Dear All,<o:p></o:p> <o:p> </o:p> First, let me apologize as it may not be a right topic to ask here. I hope, some of you have come across and solved the same problem already.<o:p></o:p> <o:p> </o:p> I’ve been having problem with OpenVPN server on my FC4 box and client on my XP box. I could connect from the client to the server but could not ping.<o:p></o:p> <o:p> </o:p> My connection diagram looks like this:<o:p></o:p> <o:p> </o:p> <o:p> </o:p> Client1 <---> Mikrotik (with NAT) <---> FC4 (OpenVPN Server) <---> CISCO 7206 <---> Client2<o:p></o:p> | <o:p></o:p> Client3<o:p></o:p> <o:p> </o:p> If I tried to connect from Client3 (without passing through the Router or Mikrotik NAT), it is fine; they can ping each other. However, when I try to connect from Client1 (through Mikrotik 2.9 with NAT) or Client2 (from outside through my border Router with IOS 12.0), they cannot ping each other.<o:p></o:p> <o:p> </o:p> For Client1, I’m quite sure, it is the problem of Mikrotik firewall/NAT rules. For Client2, it may be the Router access-list policy. I’m desperate in how to resolve this after searching through the Web for a while, esp. the OpenVPN web site. I hope, some of you have had the same experience and would help me out.<o:p></o:p> <o:p> </o:p> Here is my server config (on FC4):<o:p></o:p> ---<o:p></o:p> port 1194<o:p></o:p> proto udp<o:p></o:p> dev tun<o:p></o:p> server 192.168.99.0 255.255.255.0<o:p></o:p> ifconfig 192.168.99.1 255.255.255.0<o:p></o:p> #ifconfig-pool-persist ipp.txt<o:p></o:p> mode server<o:p></o:p> ca /etc/openvpn/easy-rsa/keys/ca.crt<o:p></o:p> cert /etc/openvpn/easy-rsa/keys/vpnserver.crt<o:p></o:p> key /etc/openvpn/easy-rsa/keys/vpnserver.key # This file should be kept secret<o:p></o:p> dh /etc/openvpn/easy-rsa/keys/dh1024.pem<o:p></o:p> #duplicate-cn<o:p></o:p> #client-config-dir /etc/openvpn/ccd<o:p></o:p> push "route 202.79.24.64 255.255.255.192"<o:p></o:p> push "route 202.79.24.128 255.255.255.192"<o:p></o:p> user nobody<o:p></o:p> group nobody<o:p></o:p> keepalive 10 120<o:p></o:p> comp-lzo<o:p></o:p> persist-key<o:p></o:p> persist-tun<o:p></o:p> log-append /etc/openvpn/openvpn.log<o:p></o:p> status /etc/openvpn/openvpn-status.log<o:p></o:p> verb 3<o:p></o:p> ---<o:p></o:p> <o:p> </o:p> Here is a client config (on Windows XP):<o:p></o:p> ---<o:p></o:p> client<o:p></o:p> dev tun<o:p></o:p> proto udp<o:p></o:p> remote 202.79.24.151 1194<o:p></o:p> resolv-retry infinite<o:p></o:p> nobind<o:p></o:p> persist-key<o:p></o:p> persist-tun<o:p></o:p> ca ca.crt<o:p></o:p> cert client1.crt<o:p></o:p> key client1.key<o:p></o:p> comp-lzo<o:p></o:p> verb 3<o:p></o:p> ---<o:p></o:p> <o:p> </o:p> Here is the log on server when a client connects:<o:p></o:p> ---<o:p></o:p> Fri Mar 3 10:28:49 2006 OpenVPN 2.0.5 i386-redhat-linux-gnu [SSL] [LZO] [EPOLL] built on Nov 4 2005<o:p></o:p> Fri Mar 3 10:28:49 2006 Diffie-Hellman initialized with 1024 bit key<o:p></o:p> Fri Mar 3 10:28:49 2006 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]<o:p></o:p> Fri Mar 3 10:28:49 2006 TUN/TAP device tun0 opened<o:p></o:p> Fri Mar 3 10:28:49 2006 /sbin/ip link set dev tun0 up mtu 1500<o:p></o:p> Fri Mar 3 10:28:49 2006 /sbin/ip addr add dev tun0 local 192.168.99.1 peer 192.168.99.2<o:p></o:p> Fri Mar 3 10:28:50 2006 /sbin/ip route add 192.168.99.0/24 via 192.168.99.2<o:p></o:p> Fri Mar 3 10:28:50 2006 Data Channel MTU parms [ L:1542 D:1400 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]<o:p></o:p> Fri Mar 3 10:28:50 2006 GID set to nobody<o:p></o:p> Fri Mar 3 10:28:50 2006 UID set to nobody<o:p></o:p> Fri Mar 3 10:28:50 2006 UDPv4 link local (bound): [undef]:1194<o:p></o:p> Fri Mar 3 10:28:50 2006 UDPv4 link remote: [undef]<o:p></o:p> Fri Mar 3 10:28:50 2006 MULTI: multi_init called, r=256 v=256<o:p></o:p> Fri Mar 3 10:28:50 2006 IFCONFIG POOL: base=192.168.99.4 size=62<o:p></o:p> Fri Mar 3 10:28:50 2006 Initialization Sequence Completed<o:p></o:p> Fri Mar 3 10:29:08 2006 MULTI: multi_create_instance called<o:p></o:p> Fri Mar 3 10:29:08 2006 202.79.24.158:1566 Re-using SSL/TLS context<o:p></o:p> Fri Mar 3 10:29:08 2006 202.79.24.158:1566 LZO compression initialized<o:p></o:p> Fri Mar 3 10:29:08 2006 202.79.24.158:1566 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]<o:p></o:p> Fri Mar 3 10:29:08 2006 202.79.24.158:1566 Data Channel MTU parms [ L:1542 D:1400 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]<o:p></o:p> Fri Mar 3 10:29:08 2006 202.79.24.158:1566 Local Options hash (VER=V4): '530fdded'<o:p></o:p> Fri Mar 3 10:29:08 2006 202.79.24.158:1566 Expected Remote Options hash (VER=V4): '41690919'<o:p></o:p> Fri Mar 3 10:29:08 2006 202.79.24.158:1566 TLS: Initial packet from 202.79.24.158:1566, sid=e379c074 060c9d72<o:p></o:p> Fri Mar 3 10:29:08 2006 202.79.24.158:1566 VERIFY OK: depth=1, /C=KH/ST=KD/L=PP/O=WICAM.NET/OU=Base/CN=vpnserver/emailAddress=<st1:PersonName w:st="on">vidol@wicam.com.kh</st1:PersonName><o:p></o:p> Fri Mar 3 10:29:08 2006 202.79.24.158:1566 VERIFY OK: depth=0, /C=KH/ST=KD/O=WICAM.NET/OU=Base/CN=vidol/emailAddress=<st1:PersonName w:st="on">vidol@wicam.com.kh</st1:PersonName><o:p></o:p> Fri Mar 3 10:29:08 2006 202.79.24.158:1566 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key<o:p></o:p> Fri Mar 3 10:29:08 2006 202.79.24.158:1566 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication<o:p></o:p> Fri Mar 3 10:29:08 2006 202.79.24.158:1566 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key<o:p></o:p> Fri Mar 3 10:29:08 2006 202.79.24.158:1566 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication<o:p></o:p> Fri Mar 3 10:29:08 2006 202.79.24.158:1566 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA<o:p></o:p> Fri Mar 3 10:29:08 2006 202.79.24.158:1566 [vidol] Peer Connection Initiated with 202.79.24.158:1566<o:p></o:p> Fri Mar 3 10:29:08 2006 vidol/202.79.24.158:1566 MULTI: Learn: 192.168.99.6 -> vidol/202.79.24.158:1566<o:p></o:p> Fri Mar 3 10:29:08 2006 vidol/202.79.24.158:1566 MULTI: primary virtual IP for vidol/202.79.24.158:1566: 192.168.99.6<o:p></o:p> Fri Mar 3 10:29:09 2006 vidol/202.79.24.158:1566 PUSH: Received control message: 'PUSH_REQUEST'<o:p></o:p> Fri Mar 3 10:29:09 2006 vidol/202.79.24.158:1566 SENT CONTROL [vidol]: 'PUSH_REPLY,route 202.79.24.64 255.255.255.192,route 202.79.24.128 255.255.255.192,route 192.168.99.1,ping 10,ping-restart 120,ifconfig 192.168.99.6 192.168.99.5' (status=1)<o:p></o:p> ---<o:p></o:p> <o:p> </o:p> <o:p> </o:p> Thank you,<o:p></o:p> Khem<o:p></o:p> </div> </body> </html>