Openvpn – connected but can’t access network openVPN NAS

network-attached-storageopenvpn

We are a small engineering office of about 30 people. When I set-up my QNAP NAS TS219P+ as an openVPN server, I can connect to the network remotely but can't access anything inside the network. Bit of background:

initially used PPTP and that worked fine
have tried from multiple systems (Win. 10 – our main target OS – with
openVPN GUI; mac OS X with tunnelblick) which leads me to believe
it's on the server end rather than the client end
simply can't access/ping any local resources (e.g. NAS login page)

Few details:

router forwards UDP port 1194 to the NAS (as per openVPN setup),
which leads me to believe it's a setup/config issue on the NAS end
all users have 'openVPN'
ticked in 'connection privileges' everything's on the same subnet
mask (LAN infrastructure and openVPN IP address pool)

Few interesting things once I'm connected (via VPN) to the network:

the computer is visible from the 'connection list', but with an IP outside of the IP address pool as specified in the openVPN IP address pool)
I can ping the IP address of the computer that's VPN'ed in, but response times are extremely slow (~600ms)

Any help would be much appreciated!

Best Answer

It's difficult to answer without the log information. I had a similar problem on a QNAP TS-493 ProII and the solution was to change the tun device from QNAP's default tunXXXX to simply tun in the .ovpn file.

Related Solutions

Openvpn – How to diagnose / fix an OpenVPN setup which works from inside of LAN but doesn not work from WAN side of router

You have changed your client.ovpn to use the WAN address instead of 192.168.10.184 right?

Anyway, as to testing. On your server why not just do a tcpdump for udp/1194 tcpdump -qni any port 1194. and see if any connection attempts are actually getting to the server from the outside. If they are not something is wrong with your firewall or NAT settings on your border device.

Also check out your /var/log/syslog. Usually openvpn log entries will appear there when a client tries to connect.

Windows – How access remote network with OpenVPN

Routes on both sides of the VPN tunnel are required.

Also IP Routing must be enabled on the server. For example on Windows 7:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
"IPEnableRouter"=dword:00000001

Lets assume the following IPs and subnets:

Client side subnet 192.168.0.0/24
Client IP 192.168.0.2
Client VPN IP 10.8.0.2
Server side subnet 155.0.0.0/16
Server IP 155.0.0.68
Server VPN IP 10.8.0.1

Keys

Create a set of keys for the server and clients. Check the README in the OpenVPN installation dir ..\OpenVPN\easy-rsa\README.txt for instructions how to generate those.

Server side configuration

Add the following lines to the server config file:

port 1194
proto udp
dev tun
topology subnet
server 10.8.0.0 255.255.255.0
client-config-dir C:\\OpenVPN\\config\\ccd
route 192.168.0.0 255.255.255.0 10.8.0.2
ca C:\\OpenVPN\\config\\ca.crt
cert C:\\OpenVPN\\config\\server.crt
key C:\\OpenVPN\\config\\server.key
dh C:\\OpenVPN\\config\\dh1024.pem
keepalive 10 60
comp-lzo
persist-key
persist-tun
status C:\\OpenVPN\\config\\openvpn-status-tun.log 20
log C:\\OpenVPN\\config\\openvpn-tun.log
verb 3

Replace the paths with the respective installation directory.

Add a custom client config file on the server:

Create a directory ccd in the same directory as the server config file and in there a config file named after the CN (Common Name) of the client's certificate.

Check the client certificate and look for this line (CN=<client_name>):

Subject: C=CH, ST=State, L=City, O=org, OU=unit, CN=client1/name=EasyRSA/emailAddress=root@localhost

In this example the file will be named client1 (without an extension), add the following lines to the file:

ifconfig-push 10.8.0.2 255.255.255.0
push "route 155.0.0.0 255.255.0.0 10.8.0.1"
iroute 192.168.0.0 255.255.255.0

ifconfig-push will give a static IP to this client
push "route ..." pushes the route to reach the server side subnet to the client
iroute generates an internal route in OpenVPN to the client's subnet

Client side configuration

Add the following lines to the client config file:

client
dev tun
proto udp
remote 155.0.0.68 1194
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
ca C:\\OpenVPN\\config\\client1.crt
cert C:\\OpenVPN\\config\\client1.crt
key C:\\OpenVPN\\config\\client1.key
remote-cert-tls server

Replace the paths with your installation directory.

Additional Routes

This setup works if the server running OpenVPN is also a router and set as the default-gateway on all the clients on the server-side subnet.

In the case a dedicated router exists, add the following static routes to it (or add them on all of the clients) to reach the VPN subnet and the subnet of client1.

Static server-side subnet routes:

Destination        Gateway             Genmask
192.168.0.0        155.0.0.68          255.255.255.0
10.8.0.0           155.0.0.68          255.255.255.0

For additional hints on this topic, see this answer.