Openvpn options error server directive network netmask combination is invalid

Hello,

I’m running instances of OpenVPN on 2 different machines, both are running debian wheezy, OpenVPN is 2.3.10.

Each machine has 2 instances, 1 for udp and 1 for tcp. What I’m trying to do is increase the size of my subnets in case I ever need more connections using the server line in the config. However, when increasing both configs to a subnet mask of 255.255.248.0, I get the following errors when restarting the OpenVPN service on one of my servers:

ovpn-server.01.udp[9029]: ERROR: Linux route delete command failed: external program exited with error status: 7
ovpn-server.01.udp[9029]: Linux ip addr del failed: external program exited with error status: 255
ovpn-server.02.tcp[9047]: ERROR: Linux route delete command failed: external program exited with error status: 7
ovpn-server.02.tcp[9047]: Linux ip addr del failed: external program exited with error status: 255
ovpn-server.01.udp[9088]: ERROR: Linux route delete command failed: external program exited with error status: 7
ovpn-server.01.udp[9088]: Linux ip addr del failed: external program exited with error status: 255
ovpn-server.02.tcp[9116]: ERROR: Linux route delete command failed: external program exited with error status: 7
ovpn-server.02.tcp[9116]: Linux ip addr del failed: external program exited with error status: 255
ovpn-server.01.udp[9213]: Options error: --server directive network/netmask combination is invalid
ovpn-server.01.udp[9213]: Use --help for more information.
ovpn-server.02.tcp[9217]: Options error: --server directive network/netmask combination is invalid
ovpn-server.02.tcp[9217]: Use --help for more information.
ovpn-server.01.udp[24605]: Options error: --server directive network/netmask combination is invalid
ovpn-server.01.udp[24605]: Use --help for more information.
ovpn-server.02.tcp[24609]: Options error: --server directive network/netmask combination is invalid
ovpn-server.02.tcp[24609]: Use --help for more information.

Increasing only the UDP config to 255.255.248.0 works fine. Also, my other machine works fine as well when I increase both subnets in the configs. I really don’t see how this can be an invalid combination, especially since it works on one machine.

These are the working configs:

UDP:

user    nobody
group   nogroup

dev     tun

local   <removed ip>
port    80
proto   udp

#tun-mtu 1500
#fragment 1300
#mssfix

ca      <removed path>
cert    <removed path>
key     <removed path>  # This file should be kept secret
dh      <removed path>

server  10.66.66.0 255.255.248.0
ifconfig-pool-persist ipp.01.udp.txt

push "redirect-gateway"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

#client-to-client
keepalive 10 120

cipher AES-192-CBC
comp-lzo

persist-tun
persist-key

client-config-dir ccd01udp
ccd-exclusive

verb 0
#log-append      /var/log/openvpn/openvpn.log
#status          /var/log/openvpn/status.log

# pam-auth
#plugin  /usr/lib/openvpn/openvpn-auth-pam.so common-auth
#client-cert-not-required
#username-as-common-name

# management console
management <removed ip> 399

TCP:

user    nobody
group   nogroup

dev     tun

local   <removed ip>
port    443
proto   tcp

#tun-mtu 1500
#fragment 1300
#mssfix

ca      <removed path>
cert    <removed path>
key     <removed path>  # This file should be kept secret
dh      <removed path>

server  10.77.77.0 255.255.255.0
ifconfig-pool-persist ipp.02.tcp.txt

push "redirect-gateway"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

#client-to-client
keepalive 10 120

cipher AES-192-CBC
comp-lzo

persist-tun
persist-key

client-config-dir ccd02tcp
ccd-exclusive

verb 0
#log-append      /var/log/openvpn/openvpn.log
#status          /var/log/openvpn/status.log

# pam-auth
#plugin  /usr/lib/openvpn/openvpn-auth-pam.so common-auth
#client-cert-not-required
#username-as-common-name

# management console
management <removed ip> 400

Страницы: [1] 2 3  Все   Вниз

0 Пользователей и 1 Гость просматривают эту тему.

Страницы: [1] 2 3  Все   Вверх

Options error server directive network netmask combination is invalid

Pretty green with all this router stuff. Followed the wizard for OpenVPN and exported. Cannot connect and the logs give this:

Options error: —server directive network/netmask combination is invalid

Where did I go wrong?

Also found that the service is not starting
php-fpm 32757 OpenVPN failed to start

My tunnel is set to 192.168.1.200/24 if that helps any

Anyone? All I really want to do is be able to remote to my pfsense box from work.

YT videos and tutorials make this seem easy, but clearly something is wrong. Seems to be that way with a lot of the pfsense stuff, which tells me the problem is me. Frustration is high, please help!

My tunnel is set to 192.168.1.200/24 if that helps any

That is not a network — that is a HOST 192.168.1.0/24 would be a network. Keep in mind your tunnel needs to be different than your lan..

192.168.1.200/29 would be valid.. .200 would be the wire/network, .201 would be first host address .206 last host while .207 would be broadcast. You could also have /28 or /30 at .200 for the wire.

An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don’t Chat/PM me for help, unless mod related
SG-4860 22.05 | Lab VMs CE 2.6, 2.7

My thinking is that to connect to my network, the server has to have an IP within my network’s range which is 192.168.1.1/24.

Why does 192.168.1.200/24 not work but 192.168.1.200/29 does?

My thinking is that to connect to my network, the server has to have an IP within my network’s range which is 192.168.1.1/24.

Why does 192.168.1.200/24 not work but 192.168.1.200/29 does?

Actually anything in the 192.168.1.1/24 should not be used if that is a LAN on either side.. Use something else. 172.16.1.0/30 is a choice that would work. Its just for the tunnel.

Your LAN should not be within the subnet of the opposite LAN either.

Triggering snowflakes one by one..

Appreciate the replies. I can just literally make up an address as long as it’s outside my network? so confused.

172.16.1.0/30 doesn’t work. Threw an error in the logs that it has to be less than 29. So now the service starts — yay! So from an outside PC with the certificate, do I connect to 172.16.1.0 now?

@acs259 Because 192.168.1.200/29 is a valid /29 network address. 192.168.1.200/24 is not (192.168.1.0/24 is)

If your LAN is the default 192.168.1.1/24 you need to use something else.

I can just literally make up an address as long as it’s outside my network?

Not necessarily. There is a range of addresses reserved for private usage. You will commonly see this called RFC1918.

10.0.0.0/8 (10.0.0.0 — 10.255.255.255)
172.16.0.0/12 (172.16.0.0 — 172.31.255.255)
192.168.0.0/16 (192.168.0.0 — 192.168.255.255)

Here’s a random one for your tunnel network: 172.22.184.0/24

In order for a router to route between networks the networks have to be different.

You can’t have one network 192.168.1.0/24 and another 192.168.1.200/29 in most cases because all of the hosts on 192.168.1.0/24 will think all of the addresses in the /29 (192.168.1.200 — 192.168.1.207) would be reachable on the local subnet and traffic for them would be attempted there instead of being forwarded to the router for routing.

Chattanooga, Tennessee, USA
The pfSense Book is free of charge!
DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
Do Not Chat For Help! NO_WAN_EGRESS(TM)

@acs259 No. You connect to the WAN address. Your client will then be assigned a tunnel address in 172.16.1.0/29. Use the Client export package to create a client config.

A remote access OpenVPN server has to be a /29 or larger else openVPN will consider the connection to be point-to-point, not point-to-multipoint.

Chattanooga, Tennessee, USA
The pfSense Book is free of charge!
DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
Do Not Chat For Help! NO_WAN_EGRESS(TM)

Exported to a USB drive and threw that in a laptop connected to a cell phone hotspot. It fails to install OpenVPN and ends. I can connect the laptop to my network, log into pfsense, and run it from there and it works, but I won’t be able to do that from work.

What? You’re going to need to offer more information than that. Hard to say what windows permissions you need to enable. Windows problem.

Once it’s installed it should be installed. You shouldn’t need the installer again until you want to update it.

Chattanooga, Tennessee, USA
The pfSense Book is free of charge!
DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
Do Not Chat For Help! NO_WAN_EGRESS(TM)

I can connect the laptop to my network, log into pfsense, and run it from there and it works, but I won’t be able to do that from work.

I have no idea what that even means.

Chattanooga, Tennessee, USA
The pfSense Book is free of charge!
DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
Do Not Chat For Help! NO_WAN_EGRESS(TM)

Did Client Export to a USB drive. Put USB in a laptop outside my network and ran the installer. It fails saying OpenVPN could not be found.

I connected the laptop to wifi on my network and logged into pfsense and ran the exact same installer and it worked.

So it should be installed and you should be good to go.

Chattanooga, Tennessee, USA
The pfSense Book is free of charge!
DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
Do Not Chat For Help! NO_WAN_EGRESS(TM)

On the laptop, yes. How do I get things installed on my work PC? (again, thanks for helping)

ok, laptop VPN works and was able to log into pfsense. Uninstalled OpenVPN and re-ran the exported EXE and it installed OpenVPN. So I think I should be good to go now.

Thank you so much to those who pitched in. This is pretty much the first success with anything other than base configuration that I have gotten to work. Still a little confused about the subnetting stuff above, but I’ll take this as a win.

Источник

Почему не меняется IP после подключения к VPN?

Доброе время суток.
Я учусь настраивать VPN на Linux Debian.

port 1194
proto tcp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh2048.pem
server 93.189.42.0 255.255.255.0
push «redirect-gateway eth0»
push «dhcp-option DNS 8.8.8.8»
ifconfig-pool-persist ipp.txt
keepalive 10 120
tls-auth /etc/openvpn/ta.key 0
cipher DES-EDE3-CBC
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
tmp-dir /etc/openvpn/tmp

dev tun
proto tcp
remote 93.189.42.## 1194
route-delay 3
client
tls-client
ns-cert-type server
ca C:\cert\ca.crt
cert C:\cert\user.crt
key C:\cert\user.key
tls-auth C:\cert\ta.key 1
cipher DES-EDE3-CBC
comp-lzo
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ping-restart 120
ping 10
status C:\cert\certopenvpn-status.log
log C:\cert\openvpn.log
verb 3

iptables -t nat -A POSTROUTING -s 93.189.42.0/24 -o eth0 -j MASQUERADE

Сервер запускается успешно. Клиент подключается тоже успешно.
Но при попытки загрузить какую-то страницу, браузер ресолвит хостнейм секунды 2-3, а потом загружает страницу.
Но проблема в том, что IP НЕ меняется на IP VPN.

Подскажите, где я намудрил, и как исправить.

Источник

OpenVPN статический ip на клиенте.

Настраиваю OpenVPN и хочу задать конкретный ip для сервера пишу в конфиге ifconfig 10.8.0.200 255.255.255.0 а он мне все равно назначает 10.8.0.1 И еще хочу хочу устанавливать ip клиента на самом клиенте аналогично прописываю ifconfig 10.8.0.1 255.255.255.0 получаю все равно ip с сервера 10.8.0.2. Конфиги дефолтные только dev tap и ifconfig 10.8.0.200 255.255.255.0 на сервере и ifconfig 10.8.0.1 255.255.255.0 на клиенте добавлено. Что я делаю не так?

там написано, и почему сервер получает такой адрес

The server itself will take the «.1» address of the given network for use as the server-side endpoint of the local TUN/TAP interface.

и как правильно назначить клиенту статический адрес

OpenVPN’s internal client IP address selection algorithm works as follows:

1 — Use —client-connect script generated file for static IP (first choice). 2 — Use —client-config-dir file for static IP (next choice). 3 — Use —ifconfig-pool allocation for dynamic IP (last choice).

Это я прекрасно знаю, но мне нужно задавать ip именно на клиенте! Все клиенты подключаются под одним ключом. У меня несколько устройств которые сидят за натом, и доступа до них из нета нет. Мне надо что бы они прокидывали vpn на сервер и я мог к ним обращаться по vpn ip. Эти устройства должны всегда иметь один и тодже ip, что бы я мог из идентифицировать.
устр. 1 — 10.8.0.1
устр. 2 — 10.8.0.2
.
А сервер должен быть фикс ip 10.8.0.255 например.

Дай им разные ключи.

И в /24 сетке (а она, судя по всему, у тебя именно такая) хост не имеет морального права на ip 10.8.0.255, это широковещательный адрес.

Нет такой возможности.

10.8.0.255 для сервера это не суть можно и 10.8.0.254 только как такой задать?

Тогда, емнип, в конфиге на клиентской стороне:

Но вообще, использовать один ключ для нескольких клиентов — порочная практика. Если он скомпрометирован, при отзыве доступ теряют все.

Я это понимаю но таковы условия, и мне не в силу их менять. Задачу приходится решать при таких вводных.

ifconfig client-ip server-ip не помогло!

Это не в консоли, а в конфиге на клиенте, на всякий случай уточняю.

Если все равно не помогает — покажи логи клиента и сервера, только отвечу уже завтра.

насчет фиксированого ипа сервера:
в мане написано что сервер всегда берет .1 адрес, тоесть можно поменять только подсеть
с помощью client-config-dir и ifconfig-push каждому клиенту можно задать уникальный адрес но есть нюанс-пары адресов фиксированые, в мане приведены пары [ 1, 2] [ 5, 6] [ 9, 10] [ 13, 14] и тд(на деле пары начинаются с 5-6 выдаваться)
уникальность клиента определяется похоже только по имени, так что раз ты не можешь дать всем разные имена-присвоить фиксированые ипы не получится
как вариант костыль-пускай устройства подключаются как попало, и стучаться на .1 адрес каким то уникальным образом чтобы можно было их отличить, да хоть на веб сервер запрос шлют вида blabla.php?client=user1 и тд, а скрипт куда нибудь это записывает

в логах клиента
.
WARNING: using —pull/—client and —ifconfig together is probably not what you want
.
как бы намекает что нельзя в конфиге одновременно указывать client и ifconfig.

Я использую dev tap.
После подключения я руками меняю ip на клеенте и на сервере на такие какие мне надо и все работает. Я просто не верю что такая мощная вещь как OpenVPN имеет такие ограничения. Оч. это странно. И я не могу сразу задать ip на интерфейсах какие мне надо.

еще как вариант-разные порты подключения для разных устройств
получается 3 конфига сервера с тремя разными значениями port и подсетями, настраиваешь каждое устройство чтобы подключалось на свой порт. жирно только получается по одному интерфейсу на одно устройство со своей подсетью

тоесть заданные из опенвпн значение не проходят? а если руками в консоли поменять через ifconfig значения то все начинает работать?

если сам плохо разбираешься, лучше помолчи. Ни о —duplicate-cn, ни о разнице между —topology net30 и —topology subnet ты не знаешь, так что не лезь

OpenSource. Зато бесплатно ©

Используй up-скрипты на установление соединения

так и сделал на серваке а конфиг добавил на клеенте Работает, но это костыли какие-то товарищи я вам скажу.

сменил бы на iproute2. ifconfig deprecated же

А по поводу костыльности — не поленись, сперва поищи, а потом спроси в пользовательской расссылке OpenVPN http://sourceforge.net/mail/?group_id=48978

То есть на сервере вы указываете и ″ifconfig″ и ″server″?

Все клиенты подключаются под одним ключом.

Можешь делать вдоль.

Либо у тебя один ключ на всех, клиент = соединение и IP назначает сервер

Либо индивидуальные ключи, клиент идентифицируется сертификатом или именем и тогда клиент имеет право иметь иметь собственный постоянный IP.

Источник

How do I set up a OpenVPN server on pfsense? I want to be able to VPN in from a labptop when I am on the road. I set up a openvpn server in the openvpn menu. I duplicated that NAT rules for the VPN server. I tried opening the fire wall ports. I also set up the certificates, made a user account (put a certificate on that) as well as turned on the interface. I am thinking my next step has something to do with fixing it so the vpn server process can run but I am not sure why it will not start. I also think my firewall rules should be done better so I don’t leave a port wide open but I’m not sure how.

I cleared all the logs and then tried to start up the VPN server. I got this:

Jun 26 00:30:57     openvpn[26660]: MANAGEMENT: Client connected from /var/etc/openvpn/client1.sock
Jun 26 00:30:57     openvpn[26660]: MANAGEMENT: CMD 'state 1'
Jun 26 00:30:57     openvpn[26660]: MANAGEMENT: Client disconnected
Jun 26 00:30:57     openvpn[34295]: MANAGEMENT: Client connected from /var/etc/openvpn/client3.sock
Jun 26 00:30:57     openvpn[34295]: MANAGEMENT: CMD 'state 1'
Jun 26 00:30:57     openvpn[34295]: MANAGEMENT: CMD 'status 2'
Jun 26 00:30:57     openvpn[34295]: MANAGEMENT: Client disconnected
Jun 26 00:30:57     openvpn[45727]: MANAGEMENT: Client connected from /var/etc/openvpn/client4.sock
Jun 26 00:30:57     openvpn[45727]: MANAGEMENT: CMD 'state 1'
Jun 26 00:30:57     openvpn[45727]: MANAGEMENT: CMD 'status 2'
Jun 26 00:30:57     openvpn[45727]: MANAGEMENT: Client disconnected
Jun 26 00:30:59     openvpn[87234]: Options error: --server directive network/netmask combination is invalid
Jun 26 00:30:59     openvpn[87234]: Use --help for more information.
Jun 26 00:31:10     openvpn[26660]: MANAGEMENT: Client connected from /var/etc/openvpn/client1.sock
Jun 26 00:31:10     openvpn[26660]: MANAGEMENT: CMD 'state 1'
Jun 26 00:31:10     openvpn[34295]: MANAGEMENT: Client connected from /var/etc/openvpn/client3.sock
Jun 26 00:31:10     openvpn[26660]: MANAGEMENT: Client disconnected
Jun 26 00:31:10     openvpn[34295]: MANAGEMENT: CMD 'state 1'
Jun 26 00:31:10     openvpn[34295]: MANAGEMENT: CMD 'status 2'
Jun 26 00:31:10     openvpn[34295]: MANAGEMENT: Client disconnected
Jun 26 00:31:10     openvpn[45727]: MANAGEMENT: Client connected from /var/etc/openvpn/client4.sock
Jun 26 00:31:10     openvpn[45727]: MANAGEMENT: CMD 'state 1'
Jun 26 00:31:10     openvpn[45727]: MANAGEMENT: CMD 'status 2'
Jun 26 00:31:10     openvpn[45727]: MANAGEMENT: Client disconnected

I have a guess that this has something to do with my «IPv4 Tunnel Network» and «IPv4 Local Network/s»

My IPv4 Tunnel Network is: WAN_ip/24

MY IPv4 Local Network/s is: LAN_ip/24

I am not sure this is what is suppose to be here.

edit:
I found two issues. My WAN_ip should not have been my WAN_ip but a made up ip. Also, I was not specifying to for it to get log in account information correctly. I can now connect to the VPN but it gives no internet.