OpenVPN

[#1]

is it worth me starting again from scratch then?
i'm at the stage where i don't know what is or isn't configured.

Ps, i've changed those to TXT files

[#2]

I don't want to muddy the waters here but you @chenks76 should use Android’s keychain for your client certificate as it is inherently more secure than the current approach.

Using OpenSSL on Windows create yourself a client certificate bundle :

openssl pkcs12 -export -in client-cert -inkey client-key -certfile ca-root -name OpenVPN -out OpenVPN.p12

When you create this file you’ll be prompted for a password enter something of your choosing but do not forget it as you’ll need it later when you import. You can change the -name or -out values to suit yourself.

Copy the generated OpenVPN.p12 file to your Android device and import this file into your phone’s key chain using the same password as above. Once you’ve imported the file edit your Client.ovpn file and remove the ca, cert and key entries, and re-import the .ovpn file having saved the changes.

Assuming all is well you’ll be prompted for a certificate when you try to connect to OpenVPN so select the OpenVPN certificate and off you go.

Edit:- Corrected typo.

[#3]

don't worry... waters are well and truly muddied already !!

[#4]

I don't want to muddy the waters here but you @chenks76 should use Android’s keychain for your client certificate as it is inherently more secure than the current approach.

OpenVPN being as picky as it is, I would get the damn thing working first.  You can always harden it later.  Trying to harden and fault find at the same time is a recipe for chasing one's tail, in my experience.  Especially if you are not sure what you are trying to achieve and fault finding by C&P, which seems to be the case here.

I have sent chenks76 a bundle of files which should work if they are placed in the right locations.  If that doesn't do it, I need to see some log files.

[#5]

ok tried your files. VPN connects again.
still can't ping 192.168.1.x addresses though.
i now need to look at what you said for router config.

Additionally,

+ Add a rule to the Windows firewall on the OpenVPN server to,
allow all traffic from the subnet 10.8.0.0 mask = 255.255.255.0

+ Add a port forward to the router
UDP 1194 -> 192.168.1.50

To reach other devices on the 192.168.1.0 subnet you will need to

+ Add a static route to the router,
interface = LAN, destination = 10.8.0.0,  mask = 255.255.255.0, gateway = 192.168.1.50
+ Enable IP forwarding on the Windows Open VPN server
There is a registry hack but the easiest way is to enable the Routing and Remote Access service.

1194 UDP is already forwarded, i wouldn't get connected to the VPN otherwise.
windows 10 firewall... where am i adding this route? i don't see anywhere that specifically lets you add a route. you can add an app though?

adding a static route on the router? i'll need to check the billion 8800nl manual to see where that specific section is.
routing and remote access service. this has been enabled and started.

[#6]

@chenks76 - Have you done this, on your Windows 10 machine? If not, enable it an try again.

Also what does the status window show in the Server's GUI?

Here's a link to creating static routes on a Billion router.

Edit:- Added Billion link.

[#7]

as noted, the routing and remote access service is already enabled and running.
that tutorial just seems to show how to enable it ?

i didn't do the registry change though, is that necessary?

[#8]

Well the link does imply it is as it's part of the stepped procedure, so it may be worthwhile checking your entry to see if it's set at 1, and change if needed.

[#9]

done

[#10]

Has doing this made any difference to your connection?

What can and can't you ping?

[#11]

still can't ping any 192.168.1.x address

[#12]

setting up the static route on the router, there is no field for subnet

[#13]

That's the prefix parameter value. Use /24

[#14]

You say in message 50 that the UDP forwarding is already enabled, you'll need to add TCP (1194) to that list as well.

[#15]

---

@Anonymous wrote:

That's the prefix parameter value. Use /24

---

where am i adding this?
in the metric field?

@Anonymous wrote:

You say in message 50 that the UDP forwarding is already enabled, you'll need to add TCP (1194) to that list as well.

openvpn only stated that UDP needed opened, hence why TCP was left closed.
i shall open TCP now

EDIT - i had already set it to TCP/UDP anyway