OpenVPN server na Windows 10

[ tanasko @ 13.08.2018. 08:34 ] @

Nekoliko dana već pokušavam da napravim OpenVPN server na windows 10 mašini na koju bi se povezivali kljijenti sa windows 7, 10, androida... Želim da server i klijent mogu da se "vide" međusobno sa mogućnošću da mogu da vidim share na server mašini ali i da, kada se konektujem sa klijenta, mogu da pristupam normalno intenetu a da mi bude vidljiva IP adresa servera.

Serverski .ovpn file izgleda ovako:

Code:
local 192.168.143.11
port 1194
proto udp4
dev tun
dev-node "server"
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh2048.pem"
ifconfig 10.10.10.1 10.10.10.2
server 10.10.10.0 255.255.255.0
topology subnet
push "topology subnet"
dhcp-option DNS 10.10.10.1
route 10.10.10.1 255.255.255.0
push "route 10.10.10.0 255.255.255.0"
push "route 10.10.10.1 255.255.255.0"
push "route 10.10.10.2 255.255.255.0"
push "route 192.168.143.11 255.255.255.0"
push "route 192.168.143.0 255.255.255.0"
# push "dhcp-option DNS 10.10.10.1"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 208.67.222.222"
# push "redirect-gateway def1"
push "route-gateway 10.10.10.1"
keepalive 10 120
ifconfig-pool-persist ipp.txt
keepalive 10 120
cipher AES-256-GCM
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 4
tls-auth ta.key 0
status openvpn-status.log 20
log openvpn.log
explicit-exit-notify 1

Klijentski .ovpn ovako:

Code:

client
dev tun
proto udp4
# dev-node "leakbusters"
redirect-gateway def1
remote 5.57.x.x 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\leakbuster-naissus.crt"
key "C:\\Program Files\\OpenVPN\\config\\leakbuster-naissus.key"
remote-cert-tls server
tls-auth "C:\\Program Files\\OpenVPN\\config\\ta.key"
comp-lzo
key-direction 1
cipher AES-256-GCM
verb 4
key-direction 1
explicit-exit-notify 1

Log sa klijenta:

Code:

Mon Aug 13 09:09:06 2018 OpenVPN 2.4.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Sep 26 2017
Mon Aug 13 09:09:06 2018 Windows version 6.1 (Windows 7) 64bit
Mon Aug 13 09:09:06 2018 library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.10
Enter Management Password:
Mon Aug 13 09:09:06 2018 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Mon Aug 13 09:09:06 2018 Need hold release from management interface, waiting...
Mon Aug 13 09:09:06 2018 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Mon Aug 13 09:09:06 2018 MANAGEMENT: CMD 'state on'
Mon Aug 13 09:09:06 2018 MANAGEMENT: CMD 'log all on'
Mon Aug 13 09:09:06 2018 MANAGEMENT: CMD 'echo all on'
Mon Aug 13 09:09:06 2018 MANAGEMENT: CMD 'hold off'
Mon Aug 13 09:09:06 2018 MANAGEMENT: CMD 'hold release'
Mon Aug 13 09:09:07 2018 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Aug 13 09:09:07 2018 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Aug 13 09:09:07 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]5.57.x.x:1194
Mon Aug 13 09:09:07 2018 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Aug 13 09:09:07 2018 UDPv4 link local: (not bound)
Mon Aug 13 09:09:07 2018 UDPv4 link remote: [AF_INET]5.57.x.x:1194
Mon Aug 13 09:09:07 2018 MANAGEMENT: >STATE:1534144147,WAIT,,,,,,
Mon Aug 13 09:09:08 2018 MANAGEMENT: >STATE:1534144148,AUTH,,,,,,
Mon Aug 13 09:09:08 2018 TLS: Initial packet from [AF_INET]5.57.x.x:1194, sid=eed0c317 e65f73af
Mon Aug 13 09:09:08 2018 VERIFY OK: depth=1, C=RS, ST=RS, L=Nis, O=Leakbusters, OU=Leakbusters, CN=5.57.x.x, name=Leakbuster, [email protected]
Mon Aug 13 09:09:08 2018 VERIFY KU OK
Mon Aug 13 09:09:08 2018 Validating certificate extended key usage
Mon Aug 13 09:09:08 2018 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Aug 13 09:09:08 2018 VERIFY EKU OK
Mon Aug 13 09:09:08 2018 VERIFY OK: depth=0, C=RS, ST=RS, L=Nis, O=Leakbusters, OU=Leakbusters, CN=Leakbusters, name=Leakbuster, [email protected]
Mon Aug 13 09:09:09 2018 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
Mon Aug 13 09:09:09 2018 [Leakbusters] Peer Connection Initiated with [AF_INET]5.57.x.x:1194
Mon Aug 13 09:09:10 2018 MANAGEMENT: >STATE:1534144150,GET_CONFIG,,,,,,
Mon Aug 13 09:09:10 2018 SENT CONTROL [Leakbusters]: 'PUSH_REQUEST' (status=1)
Mon Aug 13 09:09:10 2018 PUSH: Received control message: 'PUSH_REPLY,topology subnet,route 10.10.10.0 255.255.255.0,route 10.10.10.1 255.255.255.0,route 10.10.10.2 255.255.255.0,route 192.168.143.11 255.255.255.0,route 192.168.143.0 255.255.255.0,dhcp-option DNS 10.10.10.1,route-gateway 10.10.10.1,route-gateway 10.10.10.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.10.10.4 255.255.255.0,peer-id 0,cipher AES-256-GCM'
Mon Aug 13 09:09:10 2018 OPTIONS IMPORT: timers and/or timeouts modified
Mon Aug 13 09:09:10 2018 OPTIONS IMPORT: --ifconfig/up options modified
Mon Aug 13 09:09:10 2018 OPTIONS IMPORT: route options modified
Mon Aug 13 09:09:10 2018 OPTIONS IMPORT: route-related options modified
Mon Aug 13 09:09:10 2018 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon Aug 13 09:09:10 2018 OPTIONS IMPORT: peer-id set
Mon Aug 13 09:09:10 2018 OPTIONS IMPORT: adjusting link_mtu to 1625
Mon Aug 13 09:09:10 2018 OPTIONS IMPORT: data channel crypto options modified
Mon Aug 13 09:09:10 2018 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Mon Aug 13 09:09:10 2018 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Mon Aug 13 09:09:10 2018 interactive service msg_channel=464
Mon Aug 13 09:09:10 2018 ROUTE_GATEWAY 192.168.110.254/255.255.255.0 I=29 HWADDR=e8:39:35:546:98
Mon Aug 13 09:09:10 2018 open_tun
Mon Aug 13 09:09:10 2018 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{5FAFCCB4-03D0-4A10-9169-C4F7932C5471}.tap
Mon Aug 13 09:09:10 2018 TAP-Windows Driver Version 9.21
Mon Aug 13 09:09:10 2018 Set TAP-Windows TUN subnet mode network/local/netmask = 10.10.10.0/10.10.10.4/255.255.255.0 [SUCCEEDED]
Mon Aug 13 09:09:10 2018 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.10.10.4/255.255.255.0 on interface {5FAFCCB4-03D0-4A10-9169-C4F7932C5471} [DHCP-serv: 10.10.10.254, lease-time: 31536000]
Mon Aug 13 09:09:10 2018 Successful ARP Flush on interface [25] {5FAFCCB4-03D0-4A10-9169-C4F7932C5471}
Mon Aug 13 09:09:10 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Mon Aug 13 09:09:10 2018 MANAGEMENT: >STATE:1534144150,ASSIGN_IP,,10.10.10.4,,,,
Mon Aug 13 09:09:15 2018 TEST ROUTES: 6/6 succeeded len=5 ret=1 a=0 u/d=up
Mon Aug 13 09:09:15 2018 C:\Windows\system32\route.exe ADD 5.57.x.x MASK 255.255.255.255 192.168.110.254
Mon Aug 13 09:09:15 2018 Route addition via service succeeded
Mon Aug 13 09:09:15 2018 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.10.10.1
Mon Aug 13 09:09:15 2018 Route addition via service succeeded
Mon Aug 13 09:09:15 2018 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.10.10.1
Mon Aug 13 09:09:15 2018 Route addition via service succeeded
Mon Aug 13 09:09:15 2018 MANAGEMENT: >STATE:1534144155,ADD_ROUTES,,,,,,
Mon Aug 13 09:09:15 2018 C:\Windows\system32\route.exe ADD 10.10.10.0 MASK 255.255.255.0 10.10.10.1
Mon Aug 13 09:09:15 2018 Route addition via service succeeded
Mon Aug 13 09:09:15 2018 C:\Windows\system32\route.exe ADD 10.10.10.1 MASK 255.255.255.0 10.10.10.1
Mon Aug 13 09:09:15 2018 ROUTE: route addition failed using service: The parameter is incorrect. [status=87 if_index=25]
Mon Aug 13 09:09:15 2018 Route addition via service failed
Mon Aug 13 09:09:15 2018 C:\Windows\system32\route.exe ADD 10.10.10.2 MASK 255.255.255.0 10.10.10.1
Mon Aug 13 09:09:15 2018 ROUTE: route addition failed using service: The parameter is incorrect. [status=87 if_index=25]
Mon Aug 13 09:09:15 2018 Route addition via service failed
Mon Aug 13 09:09:15 2018 C:\Windows\system32\route.exe ADD 192.168.143.11 MASK 255.255.255.0 10.10.10.1
Mon Aug 13 09:09:15 2018 ROUTE: route addition failed using service: The parameter is incorrect. [status=87 if_index=25]
Mon Aug 13 09:09:15 2018 Route addition via service failed
Mon Aug 13 09:09:15 2018 C:\Windows\system32\route.exe ADD 192.168.143.0 MASK 255.255.255.0 10.10.10.1
Mon Aug 13 09:09:15 2018 Route addition via service succeeded
Mon Aug 13 09:09:15 2018 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mon Aug 13 09:09:15 2018 Initialization Sequence Completed
Mon Aug 13 09:09:15 2018 MANAGEMENT: >STATE:1534144155,CONNECTED,SUCCESS,10.10.10.4,5.5 7.x.x,1194,,

Konekcija se uspostavi, ali niti se IP adresa klijenta promeni, niti mogu da vidim mrežu i šerove na serveru.

Gde grešim?

_{[Ovu poruku je menjao tanasko dana 13.08.2018. u 13:42 GMT+1]}

_{[Ovu poruku je menjao tanasko dana 13.08.2018. u 13:43 GMT+1]}

_{[Ovu poruku je menjao tanasko dana 13.08.2018. u 13:44 GMT+1]}

[ bachi @ 13.08.2018. 10:02 ] @

server

local 192.168.143.11 - ovo si bindovao OpenVPN na koji adapter? Imaš li ih više ili samo jedan na tom serveru?

port 1194 - ok

proto udp4 - ok

dev tun - ok

dev-node "server" - Ne treba navodnici i onda OpenVPN adapter na serveru treba da se zove server. Ovo se inače radi *samo* ako imaš više OpenVPN instanci i želiš da određeni konfiguracioni fajl vežeš na određeni adapter, u suprotom je nepotrebno.

ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh2048.pem"

ifconfig 10.10.10.1 10.10.10.2 - kako si stavio za da topology da je subnet, onda ide ifconfig 10.10.10.1 255.255.255.0, ali ovo NE IDE u serversku konfuguraciju!!!
server 10.10.10.0 255.255.255.0 - ok
topology subnet -ok
push "topology subnet" - ok

dhcp-option DNS 10.10.10.1 - čemu ovo?

route 10.10.10.1 255.255.255.0 - ????????

push "route 10.10.10.0 255.255.255.0" - ok, ali nepotrebno, jer je to već oređen VPN subnet server 10.10.10.0 255.255.255.0 linijom

push "route 10.10.10.1 255.255.255.0" - ???????
push "route 10.10.10.2 255.255.255.0" - ???????

push "route 192.168.143.11 255.255.255.0" - ????????????
push "route 192.168.143.0 255.255.255.0" - ok, ali trebaš da naznačiš i IP adresu rutera, pretpostavljam da je 192.168.143.1? Takođe, ako misliš da ti klijenti iz subneta u kome je servera mogu da pristupaju OpenVPN klijentima na 10.10.10.0/24 subnetu (OpenVPN klijentima), onda na externom ruterz za 192.168.143.0/24 subnet treba da dodaš statičku rutu ka 10.10.10.0/24 subnetu pre ip adrese gatewaya 192.168.143.11 (ovo je lan ip adresa openvpn servera i ona treba da bude statička, odnosno da se ne menja).
# push "dhcp-option DNS 10.10.10.1"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 208.67.222.222"
# push "redirect-gateway def1"
push "route-gateway 10.10.10.1" - ne treba
keepalive 10 120
ifconfig-pool-persist ipp.txt
keepalive 10 120
cipher AES-256-GCM
comp-lzo - ovo može i comp-lz4 a može i comp-lz4 adaptive
persist-key
persist-tun
status openvpn-status.log
verb 4
tls-auth ta.key 0
status openvpn-status.log 20
log openvpn.log
explicit-exit-notify 1

Ukoliko želiš da se klijenti vide međusobno, potrebno je u server konfiguracionom fajlu dodati: client-to-client

klijent
client
dev tun
proto udp4
# dev-node "leakbusters" - navodnici jok.
redirect-gateway def1 - svestan si da ovim SAV saobraćaj preusmeravaš preko OpenVPNa? ako da, dodaj bypass dhcp u nastavku linije da bi klijent mogao da obnovi dhcp adresu od lokalnog dhcp servera.
remote 5.57.x.x 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\leakbuster-naissus.crt"
key "C:\\Program Files\\OpenVPN\\config\\leakbuster-naissus.key"
remote-cert-tls server
tls-auth "C:\\Program Files\\OpenVPN\\config\\ta.key"
comp-lzo
key-direction 1
cipher AES-256-GCM
verb 4
key-direction 1
explicit-exit-notify 1

_{[Ovu poruku je menjao bachi dana 13.08.2018. u 11:13 GMT+1]}

_{[Ovu poruku je menjao bachi dana 13.08.2018. u 11:17 GMT+1]}

[ tanasko @ 13.08.2018. 12:40 ] @

@bachi Hvala na brzom odgovoru. Inače nameravam da dignem dva servera, pa su zato i neke predradnje. Da li ću sa ovim tvojim izmenama moći sve što sam naveo u prvom postu- da promenim spoljnu IP adresu klijenta, i da se mreže "vide"? ;-)

[ bachi @ 13.08.2018. 12:42 ] @

Ako ti je spoljna IP adresa dinamička, onda treba da otvoriš nalog na servisu tipa no-ip i da držiš na serveru njihov softver koji će da updatuje nešto.no-ip.org na novu IP adresu, a u klijent konfig ćeš za remote staviti nešto.no-ip.org, a ne da gađaju IP adresu.

Takođe ćeš klijentima dodati jedan red i staviti: float.

[ tanasko @ 13.08.2018. 12:50 ] @

U principu jeste dinamička, ali ne pamtim kada se zadni put promenila. Znam za no-ip i imam nalog, ali ga nisam skoro koristio baš zbog tog. Pretpostavljam da je to zato što preko mog kablovskog interneta imam i telefon.

[ tanasko @ 13.08.2018. 18:27 ] @

Novi server.ovpn:

Code:
local 192.168.143.11
port 1194
proto udp4
dev tun
# dev-node "server"

ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh2048.pem"

server 10.10.10.0 255.255.255.0
topology subnet
push "topology subnet"
client-to-client

push "route 192.168.143.0 255.255.255.0"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 208.67.222.222"

keepalive 10 120
ifconfig-pool-persist ipp.txt
keepalive 10 120
cipher AES-256-GCM
auth SHA256
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 5
tls-auth ta.key 0
status openvpn-status.log 20
log openvpn.log
explicit-exit-notify 1

novi client .ovpn:

Code:
lient
dev tun
proto udp4
redirect-gateway def1 bypass-dhcp
remote 5.57.7x.x 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ping 15
ping-restart 0
ping-timer-rem
reneg-sec 0
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\leakbuster-naissus.crt"
key "C:\\Program Files\\OpenVPN\\config\\leakbuster-naissus.key"
# dh "C:\\Program Files\\OpenVPN\\config\\dh2048.pem"
tls-auth "C:\\Program Files\\OpenVPN\\config\\ta.key" 1
comp-lzo
cipher AES-256-GCM
auth SHA256
verb 5
explicit-exit-notify 1

client .log file

Code:
Mon Aug 13 18:28:40 2018 us=184815 OpenVPN 2.4.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 26 2018
Mon Aug 13 18:28:40 2018 us=184815 Windows version 6.2 (Windows 8 or greater) 64bit
Mon Aug 13 18:28:40 2018 us=184815 library versions: OpenSSL 1.1.0h  27 Mar 2018, LZO 2.10
Mon Aug 13 18:28:40 2018 us=185814 WARNING: --ping should normally be used with --ping-restart or --ping-exit
Mon Aug 13 18:28:40 2018 us=185814 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Aug 13 18:28:40 2018 us=189812 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Aug 13 18:28:40 2018 us=189812 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Aug 13 18:28:40 2018 us=189812 LZO compression initializing
Mon Aug 13 18:28:40 2018 us=189812 Control Channel MTU parms [ L:1622 D:1172 EF:78 EB:0 ET:0 EL:3 ]
Mon Aug 13 18:28:40 2018 us=190812 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Mon Aug 13 18:28:40 2018 us=190812 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1550,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-GCM,auth [null-digest],keysize 256,tls-auth,key-method 2,tls-client'
Mon Aug 13 18:28:40 2018 us=190812 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1550,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-GCM,auth [null-digest],keysize 256,tls-auth,key-method 2,tls-server'
Mon Aug 13 18:28:40 2018 us=190812 TCP/UDP: Preserving recently used remote address: [AF_INET]5.57.74.x.x:1194
Mon Aug 13 18:28:40 2018 us=190812 Socket Buffers: R=[65536->65536] S=[65536->65536]
Mon Aug 13 18:28:40 2018 us=190812 UDPv4 link local: (not bound)
Mon Aug 13 18:28:40 2018 us=191811 UDPv4 link remote: [AF_INET]5.57.x.x:1194
Mon Aug 13 18:29:40 2018 us=841196 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Aug 13 18:29:40 2018 us=841196 TLS Error: TLS handshake failed
Mon Aug 13 18:29:40 2018 us=841196 TCP/UDP: Closing socket
Mon Aug 13 18:29:40 2018 us=841196 SIGUSR1[soft,tls-error] received, process restarting
Mon Aug 13 18:29:40 2018 us=842113 Restart pause, 5 second(s)
Mon Aug 13 18:29:45 2018 us=842725 WARNING: --ping should normally be used with --ping-restart or --ping-exit
Mon Aug 13 18:29:45 2018 us=842725 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Aug 13 18:29:45 2018 us=842725 Re-using SSL/TLS context
Mon Aug 13 18:29:45 2018 us=842725 LZO compression initializing
Mon Aug 13 18:29:45 2018 us=842725 Control Channel MTU parms [ L:1622 D:1172 EF:78 EB:0 ET:0 EL:3 ]
Mon Aug 13 18:29:45 2018 us=842725 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Mon Aug 13 18:29:45 2018 us=842725 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1550,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-GCM,auth [null-digest],keysize 256,tls-auth,key-method 2,tls-client'
Mon Aug 13 18:29:45 2018 us=842725 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1550,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-GCM,auth [null-digest],keysize 256,tls-auth,key-method 2,tls-server'
Mon Aug 13 18:29:45 2018 us=842725 TCP/UDP: Preserving recently used remote address: [AF_INET]5.57.74.x.x:1194
Mon Aug 13 18:29:45 2018 us=843683 Socket Buffers: R=[65536->65536] S=[65536->65536]
Mon Aug 13 18:29:45 2018 us=843683 UDPv4 link local: (not bound)
Mon Aug 13 18:29:45 2018 us=843683 UDPv4 link remote: [AF_INET]5.57.74.x.x:1194
Mon Aug 13 18:30:45 2018 us=766857 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Aug 13 18:30:45 2018 us=766857 TLS Error: TLS handshake failed
Mon Aug 13 18:30:45 2018 us=766857 TCP/UDP: Closing socket
Mon Aug 13 18:30:45 2018 us=766857 SIGUSR1[soft,tls-error] received, process restarting
Mon Aug 13 18:30:45 2018 us=766857 Restart pause, 5 second(s)
Mon Aug 13 18:30:50 2018 us=767676 WARNING: --ping should normally be used with --ping-restart or --ping-exit
Mon Aug 13 18:30:50 2018 us=767676 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Aug 13 18:30:50 2018 us=767676 Re-using SSL/TLS context
Mon Aug 13 18:30:50 2018 us=767676 LZO compression initializing
Mon Aug 13 18:30:50 2018 us=767676 Control Channel MTU parms [ L:1622 D:1172 EF:78 EB:0 ET:0 EL:3 ]
Mon Aug 13 18:30:50 2018 us=767676 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Mon Aug 13 18:30:50 2018 us=767676 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1550,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-GCM,auth [null-digest],keysize 256,tls-auth,key-method 2,tls-client'
Mon Aug 13 18:30:50 2018 us=767676 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1550,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-GCM,auth [null-digest],keysize 256,tls-auth,key-method 2,tls-server'
Mon Aug 13 18:30:50 2018 us=767676 TCP/UDP: Preserving recently used remote address: [AF_INET]5.57.x.x:1194
Mon Aug 13 18:30:50 2018 us=768685 Socket Buffers: R=[65536->65536] S=[65536->65536]
Mon Aug 13 18:30:50 2018 us=768685 UDPv4 link local: (not bound)
Mon Aug 13 18:30:50 2018 us=768685 UDPv4 link remote: [AF_INET]5.57.x.x:1194
Mon Aug 13 18:31:51 2018 us=50068 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Aug 13 18:31:51 2018 us=50068 TLS Error: TLS handshake failed
Mon Aug 13 18:31:51 2018 us=50068 TCP/UDP: Closing socket
Mon Aug 13 18:31:51 2018 us=50068 SIGUSR1[soft,tls-error] received, process restarting

@bachi sada nema konekcije uopšte.

Route print:

_{[Ovu poruku je menjao tanasko dana 14.08.2018. u 09:50 GMT+1]}

[ bachi @ 13.08.2018. 18:43 ] @

server

local 192.168.143.11
port 1194
proto udp4
dev tun
# dev-node "server"

ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh2048.pem"

server 10.10.10.0 255.255.255.0
topology subnet
push "topology subnet"
client-to-client

push "route 192.168.143.0 255.255.255.0"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 208.67.222.222"

keepalive 10 120
ifconfig-pool-persist ipp.txt
keepalive 10 120 - ovo si duplirao
cipher AES-256-GCM
auth SHA256
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 5
tls-auth ta.key 0 - ovo treba isto puna putanja do ta.key fajla, dakle "C:\\Program Files\\OpenVPN\\config\\ta.key"
status openvpn-status.log 20
log openvpn.log
explicit-exit-notify 1

klijent

lient - typo. :) treba client
dev tun
proto udp4
redirect-gateway def1 bypass-dhcp
remote 5.57.7x.x 1194
resolv-retry infinite
float
nobind
persist-key
persist-tun
keepalive 10 120
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\leakbuster-naissus.crt"
key "C:\\Program Files\\OpenVPN\\config\\leakbuster-naissus.key"
tls-auth "C:\\Program Files\\OpenVPN\\config\\ta.key" 1
comp-lzo
cipher AES-256-GCM
auth SHA256
verb 5
explicit-exit-notify 1

Takođe, jesi li prosledio port na NAT ruteru sa javne IP adrese na lokalnu na port 1194 ? Kao i da si na firewallu u samom windowsu dozvolio dolazni saobraćaj na port 1194?

[ tanasko @ 14.08.2018. 09:01 ] @

Isti problem. Kad odem na http://canyouseeme.org/ na primer, i probam da li je otvoren 1194 port, dobijem server time-out. Probao sam ostale otvorene portove na ruteru preko iste (i http://www.portchecktool.com/), oni su svi zeleni- prihvataju konekciju.
Ne bih rekao da je problem do rutera, pre će biti da je windows firewall problem.

[img]https://1drv.ms/u/s!Atuoan02eLvflowQZM25N3jcDAJWTw[/img]

Nisam više imao vremena ni živaca, pa ću se danas popodne pozabaviti problemom. Možda ću da resetujem firewall, pa iz početka, jer izgleda da gledam u konfiguraciju i ne vidim nešto očigledno.

[ bachi @ 14.08.2018. 10:11 ] @

Na serverskoj strani, da li si openvpn startovao kao servis?

[ anon70939 @ 14.08.2018. 10:21 ] @

bachi je doktor za OpenVPN, pa mi ostali nema sta tu da se mesamo savetima :).

Ja sam podešavao OpenVPN i na Windows i Linux mašinama, i ok je to radilo, ali poslušao sam Bachijev zlatan savet, i na virtualci instalirao pfSense koji mi sluzi samo za openvpn...
Uz wizard podesis OpenVPN server za 2 minuta bukvalno. Kreiras usere i exportujes sertifikate uz par klikova. Firewall podesavas isto tako lako. Lako vidim na dashboard widgetima ko je nakačen i koju IP je dobio, koliko arči protoka i sl. Ko zna šta sve još može :)
Nisam jos imao potrebe za vise instanci OpenVPN servera, ali verovatno jednako lako.
Ne vidim više ni jedan jedini razlog vise da OpenVPN drzim na nekoj Linux ili Windows mašini.

Prvo sam probao na nekoj Hyper-V mašini na serveru u office i super je radilo, ali sam sada stavio na Hetzner za 2,49€ mesečno da ne bih brinuo o stabilnosti neta, struji i sličn.

[ bachi @ 14.08.2018. 10:27 ] @

Mešajte se slobodno, peče me vugla već dva dana, moguće da sam nešto prevideo i ja.

[ tanasko @ 14.08.2018. 11:13 ] @

Citat:

bachi:
Na serverskoj strani, da li si openvpn startovao kao servis?

Naravno, autostart konekcija server.ovpn

Ovo https://bbuckman.github.io/openvpn/2018/05/29/openvpn-windows-10.html sam koristio kao tutorijal

Verovatno ću popodne iz početka sa deinstalacijom svega, resetom firewall-a na podrazumevana podešavanja... jer ako @bachi nije nešto video, šta ja da tražim tu

_{[Ovu poruku je menjao tanasko dana 14.08.2018. u 12:25 GMT+1]}

[ tanasko @ 14.08.2018. 11:28 ] @

Interesantno je da mi radi ProtonVPN preko OpenVPN-a a ovo nikako da proradi. Zbunjuje me zato onaj rezultat na http://canyouseeme.org/ gde nikako da mi pozeleni port 1194

[ anon70939 @ 14.08.2018. 12:53 ] @

pa udp port ti je, nije tcp.
ne radi mi taj link da vidim sta se s njim moze.

Da ti nije otvoren port, u klijentskim logovima bi video da ne moze da se konektuje

Okaci log klijenta sa kojim lokusavas da se nakacis

Gore u ovom logu koliko vidim imas neke errore vezane za TLS.
Proveri te sertifikate jesu li OK.

meni je pravilo jednom problem, isto po uputstvu nekom sam radio, i razlika u odnosu na uputstvo je da sam morao da stavim full putanje do sertifikata i na server conf i na klijentskoj strani.

Ima u openvpn dokumentaciji tacno kako putanja treba da izgleda u win

edit:
sad vidim da ti je bachi odgovorio za putanju u postu posle tog tvog loga. Pretpostavljam da si to ispravio.
Uploafuj logove i sa servera i sa klijenta :)

_{[Ovu poruku je menjao CoyoteKG dana 14.08.2018. u 14:07 GMT+1]}

[ tanasko @ 15.08.2018. 06:55 ] @

još jednom:

server:

Code:
local 192.168.143.11
port 1194
proto udp4
dev tun
# dev-node "server"

ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh2048.pem"

server 10.10.10.0 255.255.255.0
topology subnet
push "topology subnet"
client-to-client

push "route 192.168.143.0 255.255.255.0"
push "dhcp-option DNS 10.10.10.1"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 208.67.222.222"

keepalive 10 120
ifconfig-pool-persist ipp.txt
cipher AES-256-GCM
auth SHA256
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
tls-auth "C:\\Program Files\\OpenVPN\\config\\ta.key" 0
status openvpn-status.log 20
log openvpn.log
explicit-exit-notify 1

klijent:

Code:
client
dev tun
proto udp4
redirect-gateway def1 bypass-dhcp
remote 5.57.x.x 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ping 15
ping-restart 0
ping-timer-rem
reneg-sec 0
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\leakbuster-naissus.crt"
key "C:\\Program Files\\OpenVPN\\config\\leakbuster-naissus.key"
tls-auth "C:\\Program Files\\OpenVPN\\config\\ta.key" 1
comp-lzo
cipher AES-256-GCM
auth SHA256
verb 3
explicit-exit-notify 1

log klijenta:

Code:
Wed Aug 15 07:34:55 2018 OpenVPN 2.4.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Sep 26 2017
Wed Aug 15 07:34:55 2018 Windows version 6.1 (Windows 7) 64bit
Wed Aug 15 07:34:55 2018 library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.10
Enter Management Password:
Wed Aug 15 07:34:55 2018 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Aug 15 07:34:55 2018 Need hold release from management interface, waiting...
Wed Aug 15 07:34:55 2018 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Aug 15 07:34:55 2018 MANAGEMENT: CMD 'state on'
Wed Aug 15 07:34:55 2018 MANAGEMENT: CMD 'log all on'
Wed Aug 15 07:34:55 2018 MANAGEMENT: CMD 'echo all on'
Wed Aug 15 07:34:55 2018 MANAGEMENT: CMD 'hold off'
Wed Aug 15 07:34:55 2018 MANAGEMENT: CMD 'hold release'
Wed Aug 15 07:34:55 2018 WARNING: --ping should normally be used with --ping-restart or --ping-exit
Wed Aug 15 07:34:55 2018 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Wed Aug 15 07:34:56 2018 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Wed Aug 15 07:34:56 2018 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Wed Aug 15 07:34:56 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]5.57..x.x:1194
Wed Aug 15 07:34:56 2018 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Aug 15 07:34:56 2018 UDPv4 link local: (not bound)
Wed Aug 15 07:34:56 2018 UDPv4 link remote: [AF_INET]5.57.x.x:1194
Wed Aug 15 07:34:56 2018 MANAGEMENT: >STATE:1534311296,WAIT,,,,,,
Wed Aug 15 07:34:56 2018 MANAGEMENT: >STATE:1534311296,AUTH,,,,,,
Wed Aug 15 07:34:56 2018 TLS: Initial packet from [AF_INET]5.57.x.x:1194, sid=7198e0f5 ce026d32
Wed Aug 15 07:34:56 2018 VERIFY OK: depth=1, C=RS, ST=RS, L=Nis, O=Leakbusters, OU=Leakbusters, CN=5.57.x.x, name=Leakbuster, [email protected]
Wed Aug 15 07:34:56 2018 VERIFY OK: depth=0, C=RS, ST=RS, L=Nis, O=Leakbusters, OU=Leakbusters, CN=Leakbusters, name=Leakbuster, [email protected]
Wed Aug 15 07:34:58 2018 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
Wed Aug 15 07:34:58 2018 [Leakbusters] Peer Connection Initiated with [AF_INET]5.57.x.x:1194
Wed Aug 15 07:34:59 2018 MANAGEMENT: >STATE:1534311299,GET_CONFIG,,,,,,
Wed Aug 15 07:34:59 2018 SENT CONTROL [Leakbusters]: 'PUSH_REQUEST' (status=1)
Wed Aug 15 07:34:59 2018 PUSH: Received control message: 'PUSH_REPLY,topology subnet,route 192.168.143.0 255.255.255.0,dhcp-option DNS 10.10.10.1,dhcp-option DNS 1.1.1.1,dhcp-option DNS 208.67.222.222,route-gateway 10.10.10.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.10.10.4 255.255.255.0,peer-id 0,cipher AES-256-GCM'
Wed Aug 15 07:34:59 2018 OPTIONS IMPORT: timers and/or timeouts modified
Wed Aug 15 07:34:59 2018 OPTIONS IMPORT: --ifconfig/up options modified
Wed Aug 15 07:34:59 2018 OPTIONS IMPORT: route options modified
Wed Aug 15 07:34:59 2018 OPTIONS IMPORT: route-related options modified
Wed Aug 15 07:34:59 2018 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Aug 15 07:34:59 2018 OPTIONS IMPORT: peer-id set
Wed Aug 15 07:34:59 2018 OPTIONS IMPORT: adjusting link_mtu to 1625
Wed Aug 15 07:34:59 2018 OPTIONS IMPORT: data channel crypto options modified
Wed Aug 15 07:34:59 2018 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Wed Aug 15 07:34:59 2018 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Wed Aug 15 07:34:59 2018 interactive service msg_channel=348
Wed Aug 15 07:34:59 2018 ROUTE_GATEWAY 192.168.110.254/255.255.255.0 I=26 HWADDR=e8:39:35:54:d6:98
Wed Aug 15 07:34:59 2018 ROUTE: bypass_host_route[0]=192.168.11.11
Wed Aug 15 07:34:59 2018 open_tun
Wed Aug 15 07:34:59 2018 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{5FAFCCB4-03D0-4A10-9169-C4F7932C5471}.tap
Wed Aug 15 07:34:59 2018 TAP-Windows Driver Version 9.21
Wed Aug 15 07:34:59 2018 Set TAP-Windows TUN subnet mode network/local/netmask = 10.10.10.0/10.10.10.4/255.255.255.0 [SUCCEEDED]
Wed Aug 15 07:34:59 2018 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.10.10.4/255.255.255.0 on interface {5FAFCCB4-03D0-4A10-9169-C4F7932C5471} [DHCP-serv: 10.10.10.254, lease-time: 31536000]
Wed Aug 15 07:34:59 2018 Successful ARP Flush on interface [29] {5FAFCCB4-03D0-4A10-9169-C4F7932C5471}
Wed Aug 15 07:34:59 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Wed Aug 15 07:34:59 2018 MANAGEMENT: >STATE:1534311299,ASSIGN_IP,,10.10.10.4,,,,
Wed Aug 15 07:35:05 2018 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Wed Aug 15 07:35:05 2018 C:\Windows\system32\route.exe ADD 5.57.x.x MASK 255.255.255.255 192.168.110.254
Wed Aug 15 07:35:05 2018 Route addition via service succeeded
Wed Aug 15 07:35:05 2018 C:\Windows\system32\route.exe ADD 192.168.11.11 MASK 255.255.255.255 192.168.110.254
Wed Aug 15 07:35:05 2018 Route addition via service succeeded
Wed Aug 15 07:35:05 2018 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.10.10.1
Wed Aug 15 07:35:05 2018 Route addition via service succeeded
Wed Aug 15 07:35:05 2018 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.10.10.1
Wed Aug 15 07:35:05 2018 Route addition via service succeeded
Wed Aug 15 07:35:05 2018 MANAGEMENT: >STATE:1534311305,ADD_ROUTES,,,,,,
Wed Aug 15 07:35:05 2018 C:\Windows\system32\route.exe ADD 192.168.143.0 MASK 255.255.255.0 10.10.10.1
Wed Aug 15 07:35:05 2018 Route addition via service succeeded
Wed Aug 15 07:35:05 2018 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Aug 15 07:35:05 2018 Initialization Sequence Completed
Wed Aug 15 07:35:05 2018 MANAGEMENT: >STATE:1534311305,CONNECTED,SUCCESS,10.10.10.4,5.57.x.x,1194,,
Wed Aug 15 07:45:15 2018 SIGTERM received, sending exit notification to peer
Wed Aug 15 07:45:16 2018 C:\Windows\system32\route.exe DELETE 192.168.143.0 MASK 255.255.255.0 10.10.10.1
Wed Aug 15 07:45:16 2018 Route deletion via service succeeded
Wed Aug 15 07:45:16 2018 C:\Windows\system32\route.exe DELETE 5.57.x.x MASK 255.255.255.255 192.168.110.254
Wed Aug 15 07:45:16 2018 Route deletion via service succeeded
Wed Aug 15 07:45:16 2018 C:\Windows\system32\route.exe DELETE 192.168.11.11 MASK 255.255.255.255 192.168.110.254
Wed Aug 15 07:45:16 2018 Route deletion via service succeeded
Wed Aug 15 07:45:16 2018 C:\Windows\system32\route.exe DELETE 0.0.0.0 MASK 128.0.0.0 10.10.10.1
Wed Aug 15 07:45:16 2018 Route deletion via service succeeded
Wed Aug 15 07:45:16 2018 C:\Windows\system32\route.exe DELETE 128.0.0.0 MASK 128.0.0.0 10.10.10.1
Wed Aug 15 07:45:16 2018 Route deletion via service succeeded
Wed Aug 15 07:45:16 2018 Closing TUN/TAP interface

Konektujem se, vidim lokalne šerove, ali mi se IP adresa klijenta ne menja. Interesantno je da u network statusu servera (TAP adapter 10.10.10.1) stoji da je DHCP server 10.10.10.254 ali ga NEMA!
pingujem i sa servera 10.10.10.1 i 10.10.10.4 ali ne i 10.10.10.254. Možda je to?

_{[Ovu poruku je menjao tanasko dana 15.08.2018. u 08:11 GMT+1]}

[ bachi @ 15.08.2018. 07:25 ] @

Nije to, tako je po dizajnu da je .254 DHCP server.

Sad smo napredovali, spojio si se na vpn server.

Ovo izbaci iz klijenta: push "dhcp-option DNS 10.10.10.1" jer pretpostavljam da nemaš DNS server na tom računaru.

Kada kažeš da se ne menja IP adresa, gde se ne menja? Idi na whatismyip na google i vidi koja ti je ip adresa nakon što se spojiš na OpenVPN.

Takođe, kada se spojiš, idi na start, kucaj cmd, pa enter i kucaj route print i pastuj mi ovde.

Takođe isto tu odradi tracert 8.8.8.8 i pastuj mi ovde.

[ tanasko @ 15.08.2018. 10:06 ] @

Citat:

Kada kažeš da se ne menja IP adresa, gde se ne menja? Idi na whatismyip na google i vidi koja ti je ip adresa nakon što se spojiš na OpenVPN.

Kad se spojim, uopšte ne mogu na internet. Uredno pingujem 10.10.10.1 i mogu da vidim i pristupim lokalnim deljenim direktorijumima. I obrnuto, sa servera pingujem adresu klijenta i pristupam share- ovima.

U prvom postu sam rekao:

Citat:

Nekoliko dana već pokušavam da napravim OpenVPN server na windows 10 mašini na koju bi se povezivali kljijenti sa windows 7, 10, androida... Želim da server i klijent mogu da se "vide" međusobno sa mogućnošću da mogu da vidim share na server mašini ali i da, kada se konektujem sa klijenta, mogu da pristupam normalno intenetu a da mi bude vidljiva IP adresa servera.

[ tanasko @ 15.08.2018. 10:11 ] @

Pola sam završio uz pomoć @bachi, i hvala mu na tome.

Route print na serveru:

Code:
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0    192.168.143.1   192.168.143.11     35
       10.10.10.0    255.255.255.0         On-link        10.10.10.1    291
       10.10.10.1  255.255.255.255         On-link        10.10.10.1    291
     10.10.10.255  255.255.255.255         On-link        10.10.10.1    291
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
    192.168.143.0    255.255.255.0         On-link    192.168.143.11    291
   192.168.143.11  255.255.255.255         On-link    192.168.143.11    291
  192.168.143.255  255.255.255.255         On-link    192.168.143.11    291
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link        10.10.10.1    291
        224.0.0.0        240.0.0.0         On-link    192.168.143.11    291
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link        10.10.10.1    291
  255.255.255.255  255.255.255.255         On-link    192.168.143.11    291
===========================================================================
Persistent Routes:
  None

Tracert sa servera:

Citat:

Tracing route to google-public-dns-a.google.com [8.8.8.8]
over a maximum of 30 hops:

1 1 ms 1 ms <1 ms 192.168.143.1
2 6 ms 6 ms 5 ms 10.21.255.254
3 6 ms 7 ms 7 ms 93.184.80.1
4 11 ms 7 ms 7 ms 195.178.39.241
5 9 ms 12 ms 10 ms 212.200.7.70
6 9 ms 8 ms 8 ms 212.200.7.67
7 44 ms 48 ms 43 ms 195.66.224.125
8 45 ms 43 ms 45 ms 74.125.242.65
9 * * * Request timed out.
10 43 ms 43 ms 43 ms google-public-dns-a.google.com [8.8.8.8]

Trace complete.

_{[Ovu poruku je menjao tanasko dana 15.08.2018. u 11:46 GMT+1]}

[ bachi @ 15.08.2018. 11:32 ] @

Uh, treba mi sve to, ali sa klijenta, nakon što se spojiš preko VPNa.

[ tanasko @ 15.08.2018. 12:23 ] @

Izvinjavam se, sad sam van kancelarije...moja greška.

[ tanasko @ 16.08.2018. 06:15 ] @

Route print na klijentu:

Code:
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0  192.168.110.254    192.168.110.1     20
          0.0.0.0        128.0.0.0       10.10.10.1       10.10.10.4    276
       5.57.x.x  255.255.255.255  192.168.110.254    192.168.110.1    276
       10.10.10.0    255.255.255.0         On-link        10.10.10.4    276
       10.10.10.4  255.255.255.255         On-link        10.10.10.4    276
     10.10.10.255  255.255.255.255         On-link        10.10.10.4    276
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        128.0.0.0        128.0.0.0       10.10.10.1       10.10.10.4    276
    192.168.11.11  255.255.255.255  192.168.110.254    192.168.110.1    276
    192.168.110.0    255.255.255.0         On-link     192.168.110.1    276
    192.168.110.1  255.255.255.255         On-link     192.168.110.1    276
  192.168.110.255  255.255.255.255         On-link     192.168.110.1    276
    192.168.143.0    255.255.255.0       10.10.10.1       10.10.10.4    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     192.168.110.1    276
        224.0.0.0        240.0.0.0         On-link        10.10.10.4    276
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     192.168.110.1    276
  255.255.255.255  255.255.255.255         On-link        10.10.10.4    276
===========================================================================
Persistent Routes:
  None

tracert ka 8.8.8.8

Code:
C:\Users\nebojsa.tanaskovic>tracert 8.8.8.8

Tracing route to 8.8.8.8 over a maximum of 30 hops

  1    19 ms    15 ms    16 ms  SAINTGEORGE [10.10.1
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4     *        *        *     Request timed out.
  5     *        *        *     Request timed out.
  6     *        *        *     Request timed out.
  7     *        *        *     Request timed out.
  8     *        *        *     Request timed out.
  9     *        *        *     Request timed out.
10     *        *        *     Request timed out.
11     *        *        *     Request timed out.
12     *        *        *     Request timed out.
13     *        *        *     Request timed out.
14     *        *        *     Request timed out.
15     *        *        *     Request timed out.
16     *        *        *     Request timed out.
17     *        *        *     Request timed out.
18     *        *        *     Request timed out.
19     *        *        *     Request timed out.
20     *        *        *     Request timed out.
21     *        *        *     Request timed out.
22     *        *        *     Request timed out.
23     *        *        *     Request timed out.
24     *        *        *     Request timed out.
25     *        *        *     Request timed out.
26     *        *        *     Request timed out.
27     *        *        *     Request timed out.
28     *        *        *     Request timed out.
29     *        *        *     Request timed out.
30     *        *        *     Request timed out.

Trace complete.

Log sa klijenta:

Code:
Thu Aug 16 07:03:45 2018 OpenVPN 2.4.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Sep 26 2017
Thu Aug 16 07:03:45 2018 Windows version 6.1 (Windows 7) 64bit
Thu Aug 16 07:03:45 2018 library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.10
Enter Management Password:
Thu Aug 16 07:03:45 2018 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Aug 16 07:03:45 2018 Need hold release from management interface, waiting...
Thu Aug 16 07:03:45 2018 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Aug 16 07:03:45 2018 MANAGEMENT: CMD 'state on'
Thu Aug 16 07:03:45 2018 MANAGEMENT: CMD 'log all on'
Thu Aug 16 07:03:45 2018 MANAGEMENT: CMD 'echo all on'
Thu Aug 16 07:03:45 2018 MANAGEMENT: CMD 'hold off'
Thu Aug 16 07:03:45 2018 MANAGEMENT: CMD 'hold release'
Thu Aug 16 07:03:45 2018 WARNING: --ping should normally be used with --ping-restart or --ping-exit
Thu Aug 16 07:03:45 2018 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Thu Aug 16 07:03:45 2018 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Aug 16 07:03:45 2018 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Aug 16 07:03:45 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]5.57.x.x:1194
Thu Aug 16 07:03:45 2018 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Aug 16 07:03:45 2018 UDPv4 link local: (not bound)
Thu Aug 16 07:03:45 2018 UDPv4 link remote: [AF_INET]5.57.74.x.x:1194
Thu Aug 16 07:03:45 2018 MANAGEMENT: >STATE:1534395825,WAIT,,,,,,
Thu Aug 16 07:03:45 2018 MANAGEMENT: >STATE:1534395825,AUTH,,,,,,
Thu Aug 16 07:03:45 2018 TLS: Initial packet from [AF_INET]5.57.x.x:1194, sid=8c9f7315 6eb4682f
Thu Aug 16 07:03:45 2018 VERIFY OK: depth=1, C=RS, ST=RS, L=Nis, O=Leakbusters, OU=Leakbusters, CN=5.57.x.x, name=Leakbuster, [email protected]
Thu Aug 16 07:03:45 2018 VERIFY OK: depth=0, C=RS, ST=RS, L=Nis, O=Leakbusters, OU=Leakbusters, CN=Leakbusters, name=Leakbuster, [email protected]
Thu Aug 16 07:03:45 2018 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
Thu Aug 16 07:03:45 2018 [Leakbusters] Peer Connection Initiated with [AF_INET]5.57.x.x:1194
Thu Aug 16 07:03:47 2018 MANAGEMENT: >STATE:1534395827,GET_CONFIG,,,,,,
Thu Aug 16 07:03:47 2018 SENT CONTROL [Leakbusters]: 'PUSH_REQUEST' (status=1)
Thu Aug 16 07:03:47 2018 PUSH: Received control message: 'PUSH_REPLY,topology subnet,route 192.168.143.0 255.255.255.0,dhcp-option DNS 1.1.1.1,dhcp-option DNS 208.67.222.222,route-gateway 10.10.10.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.10.10.4 255.255.255.0,peer-id 0,cipher AES-256-GCM'
Thu Aug 16 07:03:47 2018 OPTIONS IMPORT: timers and/or timeouts modified
Thu Aug 16 07:03:47 2018 OPTIONS IMPORT: --ifconfig/up options modified
Thu Aug 16 07:03:47 2018 OPTIONS IMPORT: route options modified
Thu Aug 16 07:03:47 2018 OPTIONS IMPORT: route-related options modified
Thu Aug 16 07:03:47 2018 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Aug 16 07:03:47 2018 OPTIONS IMPORT: peer-id set
Thu Aug 16 07:03:47 2018 OPTIONS IMPORT: adjusting link_mtu to 1625
Thu Aug 16 07:03:47 2018 OPTIONS IMPORT: data channel crypto options modified
Thu Aug 16 07:03:47 2018 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Aug 16 07:03:47 2018 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Aug 16 07:03:47 2018 interactive service msg_channel=352
Thu Aug 16 07:03:47 2018 ROUTE_GATEWAY 192.168.110.254/255.255.255.0 I=26 HWADDR=e8:39:35:54:d6:98
Thu Aug 16 07:03:47 2018 ROUTE: bypass_host_route[0]=192.168.11.11
Thu Aug 16 07:03:47 2018 open_tun
Thu Aug 16 07:03:47 2018 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{5FAFCCB4-03D0-4A10-9169-C4F7932C5471}.tap
Thu Aug 16 07:03:47 2018 TAP-Windows Driver Version 9.21
Thu Aug 16 07:03:47 2018 Set TAP-Windows TUN subnet mode network/local/netmask = 10.10.10.0/10.10.10.4/255.255.255.0 [SUCCEEDED]
Thu Aug 16 07:03:47 2018 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.10.10.4/255.255.255.0 on interface {5FAFCCB4-03D0-4A10-9169-C4F7932C5471} [DHCP-serv: 10.10.10.254, lease-time: 31536000]
Thu Aug 16 07:03:47 2018 Successful ARP Flush on interface [29] {5FAFCCB4-03D0-4A10-9169-C4F7932C5471}
Thu Aug 16 07:03:47 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Thu Aug 16 07:03:47 2018 MANAGEMENT: >STATE:1534395827,ASSIGN_IP,,10.10.10.4,,,,
Thu Aug 16 07:03:52 2018 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Thu Aug 16 07:03:52 2018 C:\Windows\system32\route.exe ADD 5.57.x.x MASK 255.255.255.255 192.168.110.254
Thu Aug 16 07:03:52 2018 Route addition via service succeeded
Thu Aug 16 07:03:52 2018 C:\Windows\system32\route.exe ADD 192.168.11.11 MASK 255.255.255.255 192.168.110.254
Thu Aug 16 07:03:52 2018 Route addition via service succeeded
Thu Aug 16 07:03:52 2018 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.10.10.1
Thu Aug 16 07:03:52 2018 Route addition via service succeeded
Thu Aug 16 07:03:52 2018 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.10.10.1
Thu Aug 16 07:03:52 2018 Route addition via service succeeded
Thu Aug 16 07:03:52 2018 MANAGEMENT: >STATE:1534395832,ADD_ROUTES,,,,,,
Thu Aug 16 07:03:52 2018 C:\Windows\system32\route.exe ADD 192.168.143.0 MASK 255.255.255.0 10.10.10.1
Thu Aug 16 07:03:52 2018 Route addition via service succeeded
Thu Aug 16 07:03:52 2018 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Aug 16 07:03:52 2018 Initialization Sequence Completed
Thu Aug 16 07:03:52 2018 MANAGEMENT: >STATE:1534395832,CONNECTED,SUCCESS,10.10.10.4,5.57.x.x,1194,,

Uredno pingujem i vidim šerove na serverskoj strani, ali uopšte nemam pristup internetu.

_{[Ovu poruku je menjao tanasko dana 16.08.2018. u 08:01 GMT+1]}

[ bachi @ 16.08.2018. 11:04 ] @

Nemaš pristup Internetu jer ti server koji je u stvari Windows 10 klijentska mašina koja nema RRAS kao server što ima, ne vrši NAT rutiranje između adaptera koji ide na net i openvpn adaptera.

Proveri opet ono da li si dobro sherovao oko ICSa, mada Windows mašine i nisu nešto za napredno rutiranje. http://www.nat32.com/ bi verovatno rešio ovaj problem, ali nisam siguran da li je program besplatan.

[ tanasko @ 17.08.2018. 06:42 ] @

A da ponovim ovo na windows server 2012 essentials kao server mašinom umesto windows 10? Misliš da bi radilo, imam jedan matori laptop sa kojim ne znam šta ću?

[ bachi @ 17.08.2018. 07:48 ] @

Nisam lično probao, ali ne vidim što ne bi radilo.

Daj mi screnshot kako si odradio ICS na OpenVPN serveru, šta si podelio koju konekciju na koju?

Koji ruter imaš tu gde je server? Možda može na njemu da se nabudži VPN server?

[ bokinet @ 17.08.2018. 08:49 ] @

Koliko se secam u zavisnosti od Windows verzije, recimo Enterprise i Pro bi trebale da imaju Routing and Remote Access service (RRAS) (ali koji je iskljucen tj. disabled).
To proveri u 'Services' delu i ako ga imas u listi samo ga ukljuci i dobices i taj servis da mozes da koristis.

Takodje mozda kod Windows 10 moze da bude i problema sa dolaznim konekcijama kad se digne RRAS te tako evo jos jedan tiket podrske od MS s' tim u vezi.

https://answers.microsoft.com/...b9-02d7-434a-9aab-38d59dfa809e

[ tanasko @ 17.08.2018. 09:00 ] @

@bachi Vidi PP! Trebalo bi da završi posao, nisam još stigao da ga priključim, to ću za vikend.

Pozdrav i hvala svima, naročito @bachi koji se najviše angažovao!

[ tanasko @ 30.08.2018. 06:56 ] @

Priča je dobila epilog. Nabavio sam https://www.asus.com/ca-en/Networking/RT-AC750/ koji ima podršku za OpenVPN server (između ostalog).

Pošto se radi o ruteru koji je naslonjen na Linux, podizanje OpenVPN servera je mnogo lakše i pre svega praktičnije jer ne mora kompjuter da mi bude stalno uključen.

[att_img] - https://1drv.ms/u/s!Atuoan02eLvflo4gA7nDHFvmtPwSlw[att_img]

[ bachi @ 30.08.2018. 10:04 ] @

Tako je i najpametnije. E sad, ne verujem da će moći da izdrži protok u tunelu brži od 10Mb/s zbog procesorske snage.

[ tanasko @ 30.08.2018. 10:49 ] @

Trenutno su njegovi ASUS pandani sa gigabitnim wan i lan portovima, naravno i boljim dual-core procesorom, daleko skuplji. Promeniću ga kad mu dođe vreme i kad malo padnu cene. Sve preporuke za uređaj, interfejs je jednostavno fantastično intuitivan.

Citat:

Network Standard
IEEE 802.11a, IEEE 802.11b, IEEE 802.11g, IEEE 802.11n, IEEE 802.11ac, IPv4, IPv6
Product Segment
AC750 complete AC performance : 300+433 Mbps
Coverage
Medium homes
Data Rate
802.11n : up to 300 Mbps
802.11ac : up to 433 Mbps
Antenna
External 5 dBi antenna x 2
Internal PCB antenna x 1
Transmit/Receive
MIMO technology
2.4 GHz 2 x 2
5 GHz 1 x 1
Memory
8 MB Flash
64 MB RAM
Operating Frequency
2.4 GHz / 5 GHz
Encryption
64-bit WEP, 128-bit WEP, WPA2-PSK, WPA-PSK, WPA-Enterprise , WPA2-Enterprise , Radius with 802.1x, WPS support
Firewall & Access Control
Firewall：SPI intrusion detection
Access control：Guest access, Parental control, Network service filter, URL/Port filter
WAN Connection Type
Internet connection type : Automatic IP, Static IP, PPPoE(MPPE supported), PPTP, L2TP
Dual Link support
Multicast Proxy support
Ports
1 x RJ45 for 10/100 BaseT for WAN, 4 x RJ45 for 10/100 BaseT for LAN
USB 2.0 x 1
Features
SmartQoS
- WMM
- User definable rules for IP/MAC/Port
- Upload and download bandwidth management
- ACK/SYN/FIN/RST/ICMP with highest priority
Parental Control
Guest Network : 2.4 GHz x 3, 5 GHz x 3
VPN server : IPSec Pass-Through, PPTP Pass-Through, L2TP Pass-Through, PPTP Server, OpenVPN Server
VPN client : PPTP client, L2TP client, OpenVPN client
Enhanced media server (AiPlayer app compatible)
- Image : Jpeg
- Audio : mp3, wma, wav, pcm, mp4, lpcm, ogg
- Video : asf, avi, divx, mpeg, mpg, ts, vob, wmv, mkv, mov
AiCloud personal cloud service
3G/4G data sharing
Printer Server
- Multifunctional printer support (Windows only)
- LPR protocol support
Download Master
- Support bt, nzb, http, ed2k
- Support encryption, DHT, PEX and magnet link
- Upload and download bandwidth control
- Download scheduling
AiDisk file server
- Samba and FTP server with account management
IPTV support
Button
WPS Button, Reset Button, Power Button
LED Indicator
USB x 1
LAN x 1
Wi-Fi x 1
WAN x 1
Power x 1
Power Supply
AC Input : 110V~240V(50~60Hz)
DC Output : 12 V with max. 1 A current
OS Support
Windows® 10 86x64
Windows® 8.1 86x64
Windows® 8 , 32bit/64bit
Windows® 7 , 32bit/64bit
Windows® Vista , 32bit/64bit
Windows® 2000 86x64
Windows® XP , 32bit/64bit
Windows® Server 2003
Windows® Server 2008
Mac OS X 10.1
Mac OS X 10.4
Mac OS X 10.5
Mac OS X 10.6
Mac OS X 10.7
Mac OS X 10.8
Mac OS X
Linux Kernel (Support Ubuntu only)
Linux
AndroidTM
Dimensions
189 x 129 x 36 ~ mm (WxDxH) (Without Bezel)
Weight
g
Package Content
．RT-AC51U Wireless-AC750 Cloud Router
．RJ-45 Cable
．Power Adapter
．Quick Start Guide
．Warranty Card
．Support CD (User manual & Utility software)
Operation mode
Wireless router mode
Access point mode

[ tomislav91 @ 07.09.2018. 19:01 ] @

Citat:

tanasko:
Nekoliko dana već pokušavam da napravim OpenVPN server na windows 10 mašini na koju bi se povezivali kljijenti sa windows 7, 10, androida... Želim da server i klijent mogu da se "vide" međusobno sa mogućnošću da mogu da vidim share na server mašini ali i da, kada se konektujem sa klijenta, mogu da pristupam normalno intenetu a da mi bude vidljiva IP adresa servera.

Serverski .ovpn file izgleda ovako:

Klijentski .ovpn ovako:

Log sa klijenta:

Ja ipak mislim, da je najbolje da podignes besplatni PfSense, koji u sebi ima OpenVPN, preko weba ga konfigurises, i skroz je COOL i jednostavnO! :) Pozz!

[ DynDNS @ 17.01.2020. 17:49 ] @

Da li win 10 ima mogusnost openvpn client konekcije bez instalacije dodatnog softvera ?

[ bachi @ 17.01.2020. 18:49 ] @

Ne. Mora da se instalira OpenVPN client.