guides to create openvpn server in linux?

[metro2012]

Server:

port 1194
proto udp
dev tun
ca keys/ca/ca.crt
cert keys/ca/svr.crt
key keys/ca/svr.key
dh keys/ca/dh2048.pem
server 10.10.10.0 255.255.255.0
crl-verify keys/ca/crl.pem
ifconfig-pool-persist servers/SVR/logs/ipp.txt
cipher AES-128-CBC
user root
group root
status servers/SVR/logs/openvpn-status.log
log-append servers/SVR/logs/openvpn.log
verb 2
mute 20
max-clients 200
management 127.0.0.1 5574
keepalive 10 120
client-config-dir /etc/openvpn/servers/SVR/ccd
client-to-client
comp-lzo
persist-key
persist-tun
ccd-exclusive
push "route 192.168.2.0 255.255.255.0"

Client:

client
proto udp
dev tun
ca ca.crt
dh dh2048.pem
cert nb1600clientremote.crt
key nb1600clientremote.key
remote 123.456.789.012 1194 //My remote public IP
cipher AES-128-CBC
user root
group root
verb 2
mute 20
keepalive 10 120
comp-lzo
persist-key
persist-tun
float
resolv-retry infinite
nobind

[+BudMan MVC]

"that the nb1600 cannot see my public ip anymore. it can see the internet because pinging google works,"

What?? That statement is just gibberish..

Do you mean ping your public IP.. Which one your home one or your work one? see means what? The nb1600 connected to your private side of your network would have no reason ever to "see" your home routers public IP? I have no idea what that statement is suppose to mean even. If you mean ping your public IP while on the private side of your router, this is not really something that is common to be able to do - that would be nat reflection or loopback forwarding, etc. not all routers support that. I don't understand what your trying to convey with that statement.

"is there a possibility of the routing tables in my router overloading and thus not allowing/understanding more connections?"

Again -- this make no sense, routing tables don't have anything to do with connections. State table maybe. Are you still talking about your home internet router or your work internet router, or the is it the nb1600 router at work? Or is that a linux box now?

Did you ever actually forward the port your using on your work internet router to the vpn server on your work network?

Whatever you think was working, I don't think it was to be honest.

As to your ftp problem, yeah if you can load your on local address, and that works on another machine then yes I would agree something wrong with the ftp server on that machine.

[metro2012]

was away from home....

"that the nb1600 cannot see my public ip anymore. it can see the internet because pinging google works,"

What?? That statement is just gibberish..

Do you mean ping your public IP.. Which one your home one or your work one? see means what? The nb1600 connected to your private side of your network would have no reason ever to "see" your home routers public IP? I have no idea what that statement is suppose to mean even. If you mean ping your public IP while on the private side of our router, this is not really something that is common to be able to do - that would be nat reflection or loopback forwarding, etc. not all routers support that. I don't understand what your trying to convey with that statement.

from the nb1600 at my home network, it cannot ping my workplace's public ip. i can ping google (and others as well).

i restarted the router at my workplace and then the nb1600 could ping my workplace's public ip and thus restored the vpn connection.

"is there a possibility of the routing tables in my router overloading and thus not allowing/understanding more connections?"

Again -- this make no sense, routing tables don't have anything to do with connections. State table maybe. Are you still talking about your home internet router or your work internet router, or the is it the nb1600 router at work? Or is that a linux box now?

Did you ever actually forward the port your using on your work internet router to the vpn server on your work network?

the "routing tales in my router" refer to the ones in my workplaces router. i was talking about the router at my workplace.

like i mentioned, i restarted it (the router at my workplace) and it worked instantly.

and yes, the ports are forward.

we are going to try now to chain (with a switch) things of LAN2 and see if they work (they should, just commenting on it) and also see what is wrong with that ftp server.....

ill comment further things :)

thank u for all the help

[+John Teacake MVC]

Which FTP (Server) Program are you using? Just out of curiosity...

[metro2012]

Which FTP (Server) Program are you using? Just out of curiosity...

the one included in windows ce .net

[metro2012]

got another nb1600 as a client and hooked it up to a windows machine to retry the ftp. nothing....

using filezilla as the server and client.

i can ping the 172.16.3.x address and also access thru teamviewer's lan mode but no ftp: hm....odd.

[metro2012]

that ftp problem is really bugging me.

to exclude ce, i am connected to the vpn thru windows 7 (lan1) and the file server is located at lan2 which is a windows xp box. i can access this windows xp box in all ways except ftp.

[+BudMan MVC]

And ftp is a complicated protocol - are you using passive or active? Your router prob has a ftp helper that changes the IPs on you ;) It couldn't the internet routers, since your inside an encrypted tunnel. If you are exactly - still not convinced you have the setup actually working the way you think you do.

So your saying you can not even make a control channel connection. This is the first connection on port 21, the data connection is where active or passive come into play. And where the ftp helpers either HELP!! or cause you pain ;)

Here is how ftp works, be it active or passive

http://slacksite.com/other/ftp.html

BTW - what IPs are you giving the clients on the remote end? What is there gateway IP your giving them?

[metro2012]

And ftp is a complicated protocol - are you using passive or active?

default on the filezilla server.

Your router prob has a ftp helper that changes the IPs on you ;)

how do i find this out/remove it/fix it/etc?

So your saying you can not even make a control channel connection. This is the first connection on port 21, the data connection is where active or passive come into play. And where the ftp helpers either HELP!! or cause you pain ;)

Here is how ftp works, be it active or passive

http://slacksite.com/other/ftp.html

no. the only thing i can do is a teamviewer lan connection and ping it. nothing else.

BTW - what IPs are you giving the clients on the remote end? What is there gateway IP your giving them?

the gateway (lan2's ip) is 172.16.3.1 ; the clients are 172.16.3.x

[metro2012]

i believe most ftp servers ( i include filezilla) use passive

[metro2012]

i dont understand what u mean budman when u say u think its not working how it shud. it does what i wanted in the end (except this ftp thing)

[+BudMan MVC]

Maybe your making connection via teamviwer vs the lan connection you say.

If that was the case and you were connecting via the tunnel then everything would work, at min you would make the control connection side of the ftp session.

Unless you have some firewall blocking ports somewhere in between - but seem odd that TV lan connection would work, since that uses port 5938 by default for lan connections. I just did a sniff of my box trying to connect to a lan IP on my network. And it only sent packets on 5938

So why would that oddball port be open, but not very common 21?

If you can not make a control port connection, but tv works - for all I know your going through the teamviewer servers to make the connection.

Are you TV to a different IP then what your trying to FTP too? Maybe this IP your trying to ftp too does not have route or default gateway so it can talk to the nb1600 router?

As to ftp being passive or active - that is the client side not the server side. Sure your server could only support 1 mode.. But you choose what mode you want via the client not the server. And this has nothing to do with a simple control connection to 21.

So if you saying you can not make this connection even - then you have a routing issue, or a firewall issue. Routing could be that the remote side does not know how to get back to you. Or could be your never getting there in the first place.

If you say you can ping the the IP that your trying to ftp to - this points to either you pinging something different than the actual device, or something blocking tcp 21, or IP your trying to hit is not even listening on 21, etc.

So you created a route on your work side internet router (192.168.100.100) for this 172.16.3.x/24 network to hit the 192.168.100.7 interface on your vpn router in the office? So I wonder why in your config for server on this page you state your only pushing route

"push "route 192.168.2.0 255.255.255.0"

So your actual VPN client the nb1600 on the remote side how would it route to 192.168.100.x/24?? You don't push the default connectivity.

push "redirect-gateway def1"

This command tells the vpn client to use the vpn connection as its default route.

Nor do you have that setup in the client config from what you posted.

So you have this remote nb1600 as a openvpn client. It gets a 10.10.10.0/24 IP as its vpn IP, and then it has a 172.16.3.0/24 network hanging off its 2nd interface. how do devices on the 172.16.3.0/24 know how to get to the 192.168.100 network at your work side? From your configs you posted I don't see how that is possible at all.

So your remote computer/device on 172.16.3.14 say, knows that its gateway is the 172.16.3.1 interface of the nb1600.. But how does the nb1600 know to route the traffic through the vpn connection? You only pushed a route to 192.168.2.0/24 -- from your configs posted I don't see the commands to tell the remote vpn client to use the vpn connection as its default route. And even if you did. As I have stated before WHY YOU NEED TO UNDERSTAND the remote network this nb1600 is sitting on is maybe its 1st (wan interface) is connected to a 192.168.100.0/24 network -- So sure it can make a connection to your openvpn server. But how its it going to route traffic for clients on its 172.16.3 network through the vpn connection to get to a 192.168.100 network when it has a interface directly connected to that network already - so its just going to route traffic out that interface.

So from your box on the work network, lets see a traceroute to this 172.16.3.x device. And then from the device you say you can TV too on the 172.16.3 network -- lets see a traceroute back to your 192.168.100.x network.

[+BudMan MVC]

So for example, here at work and using openvpn to my home network.

So my box here is on 10.56.41.89 - to get to box on my home 192.168.1.0/24 network it uses its vpn connection to get to the 192.168.1.0/24

Ethernet adapter ovpn:

Connection-specific DNS Suffix . : local.lan

Description . . . . . . . . . . . : TAP-Win32 Adapter V9

Physical Address. . . . . . . . . : 00-FF-79-1A-85-63

Dhcp Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IP Address. . . . . . . . . . . . : 10.0.200.6

Subnet Mask . . . . . . . . . . . : 255.255.255.252

Default Gateway . . . . . . . . . :

DHCP Server . . . . . . . . . . . : 10.0.200.5

DNS Servers . . . . . . . . . . . : 192.168.1.253

Lease Obtained. . . . . . . . . . : Tuesday, July 10, 2012 10:01:29 AM

Lease Expires . . . . . . . . . . : Wednesday, July 10, 2013 10:01:29 AM

trimmed down route table to show the route to the 192.168.1.0/24 network

Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       10.56.41.1     10.56.41.89       10
       10.0.200.0    255.255.255.0       10.0.200.5      10.0.200.6       1
       10.0.200.4  255.255.255.252       10.0.200.6      10.0.200.6       30
       10.0.200.6  255.255.255.255        127.0.0.1       127.0.0.1       30
       10.56.41.0    255.255.255.0      10.56.41.89     10.56.41.89       10
      10.56.41.89  255.255.255.255        127.0.0.1       127.0.0.1       10
   10.255.255.255  255.255.255.255       10.0.200.6      10.0.200.6       30
   10.255.255.255  255.255.255.255      10.56.41.89     10.56.41.89       10
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      192.168.1.0    255.255.255.0       10.0.200.5      10.0.200.6       1

See the last route there -- saying hey to get to 192.168.1.0, use your 10.0.200.6 interface and talk to 10.0.200.5

D:\>tracert 192.168.1.100

Tracing route to i5-w7.local.lan [192.168.1.100]

over a maximum of 30 hops:

1 377 ms 373 ms 369 ms 10.0.200.1

2 370 ms 370 ms 373 ms i5-w7.local.lan [192.168.1.100]

Now I think you might be confused with the 10.0.200.1 address in that trace? That is the IP address of my pfsense router on the 10.0.200.0 network, the .5 is only the endpoint of the vpn tunnel. Once it hits that it gets routed to the interface 10.0.200.1. VPN tunnels can be a bit odd ;) Here for example is off my pfsense router that is running open, showing its interface that has the 10.0.200.1 address

ovpns1: flags=8051<up,pointopoint,running,multicast> metric 0 mtu 1500
        options=80000<linkstate>
        inet6 fe80::250:56ff:fe00:2%ovpns1 prefixlen 64 scopeid 0xb
        inet 10.0.200.1 --> 10.0.200.2 netmask 0xffffffff
        nd6 options=3<performnud,accept_rtadv>
        Opened by PID 15262

Which is actually a pointtopoint to 10.0.200.2 :) Like I said this stuff can be a bit odd.

Now from a box on my 192.168.1.0 network to get back to this 10.56 box

Its not going to work - that side has no route or understanding how to get to a 10.56 network. It would push it out its default route (internet) - which is never going to be able to get to a private 10.56 network.

budman@ubuntu:~$ traceroute 10.56.41.89

traceroute to 10.56.41.89 (10.56.41.89), 30 hops max, 60 byte packets

1 pfsense.local.lan (192.168.1.253) 3.140 ms 2.999 ms 2.950 ms

2 * * *

3 * * *

4 * * *

But it knows how to get to 10.0.200 network.

budman@ubuntu:~$ traceroute 10.0.200.6

traceroute to 10.0.200.6 (10.0.200.6), 30 hops max, 60 byte packets

1 pfsense.local.lan (192.168.1.253) 2.964 ms 2.895 ms 2.790 ms

2 10.0.200.6 (10.0.200.6) 750.272 ms 750.240 ms 750.168 ms

Here is the route table from the pfsense (openvpn server) router at my home site.

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            24.13.xx.xx       UGS         0   241811    em1
10.0.200.0/24      10.0.200.2         UGS         0    39238 ovpns1
10.0.200.1         link#11            UHS         0        0    lo0
10.0.200.2         link#11            UH          0        0 ovpns1
24.13.xxx.0/21     link#2             U           0    31340    em1
24.13.xxx.58       link#2             UHS         0        0    lo0
127.0.0.1          link#6             UH          0      256    lo0
192.168.1.0/24     link#1             U           0   230687    em0
192.168.1.253      link#1             UHS         0        0    lo0

There is no route to the 10.56, so if clients that are using this box as it gateway try and go to a 10.56.41 network this router does not know to send it down the vpn connection. So where would it go, it would go down my internet connection which is the default route.

Mine is a much easier setup, but see how there can be routing issues.. My remote side does not know how to get to 10.56.41.x

The setup your trying to do is a very convoluted setup.. But what your trying to do is similar to my 192.168.1.0 home network trying to get to a 10.56.41.0/24 network. Both endpoints of your vpn, server and client are inside private networks behind nat. And then on one side your trying to route to clients on the server side connection on that vpn servers wan interface. And from your posts, your not even aware of the network setup on the remote side, and you don't think you even need too? Which tells me your not understanding these basic routing concepts.

Your going to have problems with this sort of setup, and you really need to understand what the network range your putting the remote side on is, so that you don't run into conflicts.

Not sure how much farther we can go with this, maybe you can readdress what your doing after you have had some time to study for your CCNA? You had mentioned that earlier in the thread.</performnud,accept_rtadv></linkstate></up,pointopoint,running,multicast>

[metro2012]

wow that was a huge post...........im going to try to analize it and answer some things (if I can....)

[metro2012]

If you can not make a control port connection, but tv works - for all I know your going through the teamviewer servers to make the connection.

this seems unlikely as (to avoid this in any way shape or form) i put the "accept exclusively" option,

Are you TV to a different IP then what your trying to FTP too? Maybe this IP your trying to ftp too does not have route or default gateway so it can talk to the nb1600 router?

if it didnt have the route/default gateway, how could i ping it? the tv thing was stupid and just to try it out, but pinging it?

As to ftp being passive or active - that is the client side not the server side. Sure your server could only support 1 mode.. But you choose what mode you want via the client not the server. And this has nothing to do with a simple control connection to 21.

i ment that u could limit it on the server side rite?? i might have explained it wrong, srry.

i am using a default instalation meaning that it is out of the box which i think uses passive.

So if you saying you can not make this connection even - then you have a routing issue, or a firewall issue. Routing could be that the remote side does not know how to get back to you. Or could be your never getting there in the first place.

no. filezilla (server) says when some ip trys to connect and it doesnt say anything

If you say you can ping the the IP that your trying to ftp to - this points to either you pinging something different than the actual device, or something blocking tcp 21, or IP your trying to hit is not even listening on 21, etc.

i see u refer to tcp 21; openvpn uses udp. nothing to do with this rite?

So you created a route on your work side internet router (192.168.100.100) for this 172.16.3.x/24 network to hit the 192.168.100.7 interface on your vpn router in the office? So I wonder why in your config for server on this page you state your only pushing route

"push "route 192.168.2.0 255.255.255.0"

tis is something i neighter cannot answer (nor can the "tech guy") as it is copy paste.

where did u get "192.168.100.7" from? or is is just some ip u made up on the spot?

So your actual VPN client the nb1600 on the remote side how would it route to 192.168.100.x/24?? You don't push the default connectivity.

push "redirect-gateway def1"

This command tells the vpn client to use the vpn connection as its default route.

Nor do you have that setup in the client config from what you posted.

So you have this remote nb1600 as a openvpn client. It gets a 10.10.10.0/24 IP as its vpn IP, and then it has a 172.16.3.0/24 network hanging off its 2nd interface. how do devices on the 172.16.3.0/24 know how to get to the 192.168.100 network at your work side? From your configs you posted I don't see how that is possible at all.

So your remote computer/device on 172.16.3.14 say, knows that its gateway is the 172.16.3.1 interface of the nb1600.. But how does the nb1600 know to route the traffic through the vpn connection? You only pushed a route to 192.168.2.0/24 -- from your configs posted I don't see the commands to tell the remote vpn client to use the vpn connection as its default route. And even if you did. As I have stated before WHY YOU NEED TO UNDERSTAND the remote network this nb1600 is sitting on is maybe its 1st (wan interface) is connected to a 192.168.100.0/24 network -- So sure it can make a connection to your openvpn server. But how its it going to route traffic for clients on its 172.16.3 network through the vpn connection to get to a 192.168.100 network when it has a interface directly connected to that network already - so its just going to route traffic out that interface.

So from your box on the work network, lets see a traceroute to this 172.16.3.x device. And then from the device you say you can TV too on the 172.16.3 network -- lets see a traceroute back to your 192.168.100.x network.

did u read what i put in the ccd configuration? there is additional routes there specified which may answeer all ur questions (not sure because like i said its simply copy/paste, nothing more)

[metro2012]

So for example, here at work and using openvpn to my home network.

So my box here is on 10.56.41.89 - to get to box on my home 192.168.1.0/24 network it uses its vpn connection to get to the 192.168.1.0/24

Ethernet adapter ovpn:

Connection-specific DNS Suffix . : local.lan

Description . . . . . . . . . . . : TAP-Win32 Adapter V9

Physical Address. . . . . . . . . : 00-FF-79-1A-85-63

Dhcp Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IP Address. . . . . . . . . . . . : 10.0.200.6

Subnet Mask . . . . . . . . . . . : 255.255.255.252

Default Gateway . . . . . . . . . :

DHCP Server . . . . . . . . . . . : 10.0.200.5

DNS Servers . . . . . . . . . . . : 192.168.1.253

Lease Obtained. . . . . . . . . . : Tuesday, July 10, 2012 10:01:29 AM

Lease Expires . . . . . . . . . . : Wednesday, July 10, 2013 10:01:29 AM

trimmed down route table to show the route to the 192.168.1.0/24 network

this is also something that has "bothered" me.....on a pc to the openvpn server connection, i cant see usnig ipconfig my private vpn ip (which lets say would be 10.10.10.9). i think it shows blank for both that ip and the default gateway. ill post that tommorow.

Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       10.56.41.1     10.56.41.89       10
       10.0.200.0    255.255.255.0       10.0.200.5      10.0.200.6       1
       10.0.200.4  255.255.255.252       10.0.200.6      10.0.200.6       30
       10.0.200.6  255.255.255.255        127.0.0.1       127.0.0.1       30
       10.56.41.0    255.255.255.0      10.56.41.89     10.56.41.89       10
      10.56.41.89  255.255.255.255        127.0.0.1       127.0.0.1       10
   10.255.255.255  255.255.255.255       10.0.200.6      10.0.200.6       30
   10.255.255.255  255.255.255.255      10.56.41.89     10.56.41.89       10
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      192.168.1.0    255.255.255.0       10.0.200.5      10.0.200.6       1

ive always misunderstood/confused routes but i always thought of them as how to get to different networks via what gateways (or routers). i am sorry if i am mistaken.

Now I think you might be confused with the 10.0.200.1 address in that trace? That is the IP address of my pfsense router on the 10.0.200.0 network, the .5 is only the endpoint of the vpn tunnel. Once it hits that it gets routed to the interface 10.0.200.1. VPN tunnels can be a bit odd ;) Here for example is off my pfsense router that is running open, showing its interface that has the 10.0.200.1 address

ovpns1: flags=8051<up,pointopoint,running,multicast> metric 0 mtu 1500
        options=80000<linkstate>
        inet6 fe80::250:56ff:fe00:2%ovpns1 prefixlen 64 scopeid 0xb
        inet 10.0.200.1 --> 10.0.200.2 netmask 0xffffffff
        nd6 options=3<performnud,accept_rtadv>
        Opened by PID 15262

Which is actually a pointtopoint to 10.0.200.2 :) Like I said this stuff can be a bit odd.

its not odd, i call it wanting to take a knife and slice thru your vanes....

The setup your trying to do is a very convoluted setup.. But what your trying to do is similar to my 192.168.1.0 home network trying to get to a 10.56.41.0/24 network. Both endpoints of your vpn, server and client are inside private networks behind nat. And then on one side your trying to route to clients on the server side connection on that vpn servers wan interface. And from your posts, your not even aware of the network setup on the remote side, and you don't think you even need too? Which tells me your not understanding these basic routing concepts.

i understand that the setup im trying to accomplish is very....odd in the sense that usually its a PC to a remote network.

Your going to have problems with this sort of setup, and you really need to understand what the network range your putting the remote side on is, so that you don't run into conflicts.

Not sure how much farther we can go with this, maybe you can readdress what your doing after you have had some time to study for your CCNA? You had mentioned that earlier in the thread.</performnud,accept_rtadv></linkstate></up,pointopoint,running,multicast>

yes, in octuber im going to take a 3 month prepartoy course for the ccna exam.....im obviously not ready at all but i hope the course can clear things up....a lot....

thank u for all ur help. ill reread this again tommorow and post any other information (more so about that 10.10.10.x address not showing up)

[metro2012]

OK, here we go.....more information.

my boss took home another (completely different) nb1600 and i preconfigured it for his home network. he plugged it in, simply set the 172.16.3.1 and 172.16.3.x gateway/ip on the machine hooked up to lan2 (another windows ce net machine) and it perfectly worked. the odd thing about it, is that ftp worked too (anon). he was very happy as there was no configuration needed what so ever.

onto other topics: i mentioned that i did not have a 10.10.10.x address. my mistake. ipconfig /all show me.....

this is from my pc:

Adaptador de Ethernet Conexi?n de ?rea local 2:

Sufijo DNS espec?fico para la conexi?n. . :

Descripci?n . . . . . . . . . . . . . . . : TAP-Win32 Adapter V8

Direcci?n f?sica. . . . . . . . . . . . . : **-**-**-**-** (I know its virutal but....)

DHCP habilitado . . . . . . . . . . . . . : s?

Configuraci?n autom?tica habilitada . . . : s?

V?nculo: direcci?n IPv6 local. . . : fe80::b848:4935:d6d8:d78f%23(Preferido)

Direcci?n IPv4. . . . . . . . . . . . . . : 10.10.10.113(Preferido)

M?scara de subred . . . . . . . . . . . . : 255.255.255.252

Concesi?n obtenida. . . . . . . . . . . . : mi?rcoles, 11 de julio de 2012 9:45:58

La concesi?n expira . . . . . . . . . . . : jueves, 11 de julio de 2013 9:45:57

Puerta de enlace predeterminada . . . . . :

Servidor DHCP . . . . . . . . . . . . . . : 10.10.10.114

IAID DHCPv6 . . . . . . . . . . . . . . . : 385941414

DUID de cliente DHCPv6. . . . . . . . . . : **-**-**-**-** (I know its virutal but....)

Servidores DNS. . . . . . . . . . . . . . : fec0:0:0:ffff::1%1

fec0:0:0:ffff::2%1

fec0:0:0:ffff::3%1

NetBIOS sobre TCP/IP. . . . . . . . . . . : habilitado

This is correct.

On to other things, like the routuing issue that was brought up.....

when i make a nb1600 certificate, i put the following lines in where it says "ccd file contents":

ifconfig-push 10.10.10.237 10.10.10.238

iroute 172.16.3.0 255.255.255.0

push "redirect-gateway"

push "dhcp-option DNS 10.10.10.1"

Im going to try to tell u what i THINK each line means.

Line 1: This simply gives a ip in the tunnel. teh tech guy told me that i could only use determined ips such as this:

10.10.10.236 NOT USABLE

10.10.10.237 USABLE

10.10.10.238 USABLE

10.10.10.239 NOT USABLE

10.10.10.240 NOT USABLE

10.10.10.241 USABLE

10.10.10.242 USABLE

10.10.10.243 NOT USABLE

he told me that the first afress in the set (such as 10.10.10.236) were network address (like when u put 10.10.10.0) and the last in the set (such as 10.10.10.239) is a broadcast address (like 10.10.10.255 moving on....

Line 2: This represents the network on LAN2 which i want to see when i connect remotely

Line 3: No idea at all.

Line 4: if the ips on line 1 cannt be assigned it uses this ip to get a ip address from dhcp (i do no thave a dhcp server at that ip)

now this is the setup of a certifcate when im on a pc trying to connect and give support (ccd file contents)

ifconfig-push 10.10.10.113 10.10.10.114

iroute 192.168.0.0 255.255.255.0

push "route 192.168.0.0 255.255.0.0"

push "route 172.16.0.0 255.255.0.0"

Line 1: same as line 1 above

Line 2: the network I AM on

Line 3 and 4: the lans i want to see

[metro2012]

(setting that aside for a moment)

ive set up two different nb1600 with the first's lan2 set to 172.16.3.1 and the second's lan2 set to 172.16.2.1 with a submask (both) of 255.255.255.0 in theory they shouldnt see each other.

problem is that they do and this is not wanted. how can i avoid this or limit it? might have to do with the post i said before so.....

[+BudMan MVC]

The option

client-to-client

is normally used to allow clients to talk to each other. Which you have listed in your config you posted a few posts back.

Have not had chance to read you other posts yet.

[metro2012]

The option

client-to-client

is normally used to allow clients to talk to each other. Which you have listed in your config you posted a few posts back.

Have not had chance to read you other posts yet.

ill try to disable that server side and see if i (a admin) can access all of them and the clients cant access each other. thank u.

[metro2012]

yup, it was that in the server config "client-to-client" but i just want some to have that ability and not all. the problem is that when i enable that server side, it is enabled for all. the tech support should have access to all but the clients should nto have access to anything. how can i configure this?

[+BudMan MVC]

If they are at your location, the server side of the vpn - they would have access to all remote connections coming in. Its just the clients to your server can not talk to other clients.

[metro2012]

If they are at your location, the server side of the vpn - they would have access to all remote connections coming in. Its just the clients to your server can not talk to other clients.

the thing is that all clients that connect to the openvpn server are just that: clients. i need to seperate them into 2 groups: admins which have access to all and the others which only have access to their subnet (172.16.3.x should not access 172.16.2.x) right now afaik i am only making admin type of accounts. client-to-client enables talking to each other, like i commented it.

how can i limit this??

[+BudMan MVC]

What???

The computers at the office site are not clients. So your saying people need to connect via vpn -- from where? And connect to all the vpn sites, but you don't want vpn sites to be able to talk to vpn sites?

We have been going at this for almost 8 pages now, for what a couple of weeks - and you have yet to actually give details of WHAT you want. It has been like pulling teeth to get any info.

I post up what I think your talking about, and you say yeah!! Thats its, then 2 post laters - no thats not it, we want X. Then I explain how I understand X, and you say yup thats it. Then you say no its not really X it's Y.

I am not sure if its just language issue or just that you don't really know what you want.

[metro2012]

What???

The computers at the office site are not clients. So your saying people need to connect via vpn -- from where? And connect to all the vpn sites, but you don't want vpn sites to be able to talk to vpn sites?

if i connect to the openvpn server at my office, that makes me a client right? i have to connect to that server in order to access the rest....

We have been going at this for almost 8 pages now, for what a couple of weeks - and you have yet to actually give details of WHAT you want. It has been like pulling teeth to get any info.

basically remote support being able to access a common network (which would be a vpn tunnel)

I post up what I think your talking about, and you say yeah!! Thats its, then 2 post laters - no thats not it, we want X. Then I explain how I understand X, and you say yup thats it. Then you say no its not really X it's Y.

i consider it more like pi......yeah its 3.14159 but thats not the value 100%.......... its complicated

I am not sure if its just language issue or just that you don't really know what you want.

im completely sure what i want but it must be a language issue that i cannot express correctly.....

more drawings:

network 1 should be able to access 2 3 and 4. the others should not access anyone else except 1