SOLVED OpenVPN

[Dan_UK]

Hello,

I am tryig to setup openvpn to allow remote Windows PC's running softphones to connect to PiAF3

System details are:

Date and Time = 201410062132
PIAF color = GREEN
Asterisk Status = ONLINE
Dahdi Status = ONLINE
MySql Status = ONLINE
SSH Status = ONLINE
Apache Status = ONLINE
Iptables Status = ONLINE
Ip6tables Status = ONLINE
Fail2ban Status = ONLINE
IP Connect Status = ONLINE
Free Disk Space = ADEQUATE
Free Memory = ADEQUATE
NTPD Status = ONLINE
Sendmail Status = ONLINE
Samba Status = OFFLINE
Webmin Status = ONLINE
Ethernet 0 Status = ONLINE
Ethernet 1 Status = N/A
Wlan Status = N/A
PIAF Installed Version = 3.0.6.5
Freepbx Version = 2.11.0.38 2.11
Running Asterisk =
Asterisk Source Version = 11.12.0
Dahdi Source = 2.10.0
Libpri Source = 1.4.15
System Verified = *NOT VERIFIED*
Unknown-be-**-**-**-02-6a on *.*.*.* - eth0
CentOS release 6.5 (Final) :32 Bit Kernel: 2.6.32-431.29.2.el6.i686

I have OpenVPN installed and running on the server with the following details in server.conf:

port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.99.99.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 172.16.0.0 255.255.255.0"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /etc/openvpn/openvpn-status.log
log /etc/openvpn/openvpn.log
verb 3
mute 20

And the client.ovpn file contains;

client
dev tun
proto udp
remote MY-FQDN 1194
resolv-retry infinite
persist-key
persist-tun
ca ca.crt
cert Ext601.crt
key Ext601.key
comp-lzo
verb 3

VPN Client succesfully connects and registers the softphone extension with Asterisk however the Windows PC does not have web browsing capability whilst connected to the VPN.

I am assuming it is something wrong with my server.conf settings but having spent most of the day trying various settings found elsewhere on the interet whithout success i am hoping someone could share a working server.conf to get web broser capability restored on my windows pc's.

 

[rjaiswal]

Can you use nslookup and see if you can resolve domain names while connected to the vpn?

 

[Dan_UK]

Hello,

nslookup returned a timeout error confirming not internet access.

Looking at this again this morning after a good nights sleep i noticed that i had; push "route 172.16.0.0 255.255.255.0" in server.conf with 172.16.0.0 being my LAN.
Changed this to; push "route 10.99.99.0.0 255.255.255.0" and i now have a connection to the VPN which assigns me the IP 10.99.99.6 and i can also browse the internet whilst connected to the VPN.

Looking at the FreePBX System Status page under networks i see eth0 & tun0 devices. When i register my softphone over the VPN & dial *43 eth0 receive & transmit both kick into life with tun0 staying at 0.0KB/s which makes me think that although i appear to have a VPN connection in place the traffic is not being sent over the VPN.

Although i appear to have achieved my initial problem of getting a VPN connection with web access on the windows pc i am not 100% confident my setup is performing correctly or in the best manner so any input would be greatly appreciated.

Thanks
Dan

 

[Dan_UK]

My mistake, i still had the softphone registering to the LAN address of the PBX, changed it 10.99.99.1 which is the vpn server address and the tun0 device now comes to life when i dial *43.

 

[AndyInNYC]

Dan_UK,

Would you do me a favor and look at the CLI with sip and rtp (or is it rpt) debug on?
Look to see if the traffic from/to your extensions is ONLY using the vpn ip (i.e. follow the info from a call). I have Yealink's connected via VPN and while the VPN is used, the debug info shows the public IP of the phone's connection point. I've had to add these IPs to my whitelist - which defeats the purpose.

There is a command which traps all traffic in the vpn (but I have the wrong notepad in front of me to remember) which I want to try next, but I want to see if I'm the only one having the problem - which is often the case <g>.

Additionally, make sure on your PBX that under Advanced SIP settings you add the IP of the VPN to the local networks. This should help with NAT issues since the phone is now 'local'.

Andrew

 

[Dan_UK]

AndyInNYC - Not sure where i enable sip/rtp debug? Had a quick look in FreePBX advanced settings but see nothing there?

Give me a pointer as to where i enable it but for now here is the CLI without debug on;

-- Executing [*43@from-internal:1] Answer("SIP/100-00000003", "") in new stack
> 0xa146dc8 -- Probation passed - setting RTP source address to 10.99.99.6:8000
-- Executing [*43@from-internal:2] Macro("SIP/100-00000003", "user-callerid,") in new stack
-- Executing [s@macro-user-callerid:1] Set("SIP/100-00000003", "TOUCH_MONITOR=1412705926.3") in new stack
-- Executing [s@macro-user-callerid:2] Set("SIP/100-00000003", "AMPUSER=100") in new stack
-- Executing [s@macro-user-callerid:3] GotoIf("SIP/100-00000003", "0?report") in new stack
-- Executing [s@macro-user-callerid:4] ExecIf("SIP/100-00000003", "1?Set(REALCALLERIDNUM=100)") in new stack
-- Executing [s@macro-user-callerid:5] Set("SIP/100-00000003", "AMPUSER=100") in new stack
-- Executing [s@macro-user-callerid:6] GotoIf("SIP/100-00000003", "0?limit") in new stack
-- Executing [s@macro-user-callerid:7] Set("SIP/100-00000003", "AMPUSERCIDNAME=Ext100") in new stack
-- Executing [s@macro-user-callerid:8] GotoIf("SIP/100-00000003", "0?report") in new stack
-- Executing [s@macro-user-callerid:9] Set("SIP/100-00000003", "AMPUSERCID=100") in new stack
-- Executing [s@macro-user-callerid:10] Set("SIP/100-00000003", "__DIAL_OPTIONS=Ttr") in new stack
-- Executing [s@macro-user-callerid:11] Set("SIP/100-00000003", "CALLERID(all)="Ext100" <100>") in new stack
-- Executing [s@macro-user-callerid:12] GotoIf("SIP/100-00000003", "0?limit") in new stack
-- Executing [s@macro-user-callerid:13] ExecIf("SIP/100-00000003", "0?Set(GROUP(concurrency_limit)=100)") in new stack
-- Executing [s@macro-user-callerid:14] GosubIf("SIP/100-00000003", "7?sub-ccss,s,1(from-internal,*43)") in new stack
-- Executing [s@sub-ccss:1] ExecIf("SIP/100-00000003", "0?Return()") in new stack
-- Executing [s@sub-ccss:2] Set("SIP/100-00000003", "CCSS_SETUP=TRUE") in new stack
-- Executing [s@sub-ccss:3] GosubIf("SIP/100-00000003", "0?monitor_config,1(from-internal,*43):monitor_default,1(from-internal,*43)") in new stack
-- Executing [monitor_default@sub-ccss:1] GotoIf("SIP/100-00000003", "0?is_exten") in new stack
-- Executing [monitor_default@sub-ccss:2] StackPop("SIP/100-00000003", "") in new stack
-- Executing [monitor_default@sub-ccss:3] Return("SIP/100-00000003", "FALSE") in new stack
-- Executing [s@macro-user-callerid:15] GotoIf("SIP/100-00000003", "0?continue") in new stack
-- Executing [s@macro-user-callerid:16] Set("SIP/100-00000003", "__TTL=64") in new stack
-- Executing [s@macro-user-callerid:17] GotoIf("SIP/100-00000003", "1?continue") in new stack
-- Goto (macro-user-callerid,s,28)
-- Executing [s@macro-user-callerid:28] Set("SIP/100-00000003", "CALLERID(number)=100") in new stack
-- Executing [s@macro-user-callerid:29] Set("SIP/100-00000003", "CALLERID(name)=Ext100") in new stack
-- Executing [s@macro-user-callerid:30] Set("SIP/100-00000003", "CDR(cnum)=100") in new stack
-- Executing [s@macro-user-callerid:31] Set("SIP/100-00000003", "CDR(cnam)=Ext100") in new stack
-- Executing [s@macro-user-callerid:32] Set("SIP/100-00000003", "CHANNEL(language)=en") in new stack
-- Executing [*43@from-internal:3] Wait("SIP/100-00000003", "1") in new stack
-- Executing [*43@from-internal:4] Playback("SIP/100-00000003", "demo-echotest") in new stack
-- <SIP/100-00000003> Playing 'demo-echotest.gsm' (language 'en')
-- Executing [*43@from-internal:5] Echo("SIP/100-00000003", "") in new stack
== Spawn extension (from-internal, *43, 5) exited non-zero on 'SIP/100-00000003'
-- Executing [h@from-internal:1] Hangup("SIP/100-00000003", "") in new stack
== Spawn extension (from-internal, h, 1) exited non-zero on 'SIP/100-00000003'

 

[AndyInNYC]

In the CLI (after typing asterisk -vvvvvr (you set the number of 'v') type
sip set debug on
rtp set debug on

afterward, do sip set debug off and then rtp set debug off

Andrew

 

[Dan_UK]

As requested here is the CLI info with Debug on.

Got RTP packet from 10.99.99.6:8000 (type 00, seq 056171, ts 236330934, len 000160)
Sent RTP packet to 10.99.99.6:8000 (type 00, seq 015685, ts 016480, len 000160)

<--- SIP read from UDP:10.99.99.6:63861 --->
BYE sip:*[email protected]:5060 SIP/2.0
Via: SIP/2.0/UDP 10.99.99.6:63861;branch=z9hG4bK-d8754z-accfce61614c3777-1---d8754z-
Max-Forwards: 70
Contact: <sip:[email protected]:63861;transport=UDP>
To: <sip:*[email protected];transport=UDP>;tag=as038b5278
From: <sip:[email protected];transport=UDP>;tag=62360641
Call-ID: NjQ3MDQxMDg4OTg3N2Q2Y2MzNzAzY2YxMGYzYTBmNGQ.
CSeq: 3 BYE
User-Agent: Z 3.6.25251 r25476
Authorization: Digest username="100",realm="asterisk",nonce="50b25c73",uri="sip:*[email protected]:5060",response="d47fd5c30162512bac7719cc43b34303",algorithm=MD5
Content-Length: 0

<------------->
--- (11 headers 0 lines) ---
Sending to 10.99.99.6:63861 (no NAT)
Scheduling destruction of SIP dialog 'NjQ3MDQxMDg4OTg3N2Q2Y2MzNzAzY2YxMGYzYTBmNGQ.' in 6400 ms (Method: BYE)

<--- Transmitting (no NAT) to 10.99.99.6:63861 --->
SIP/2.0 200 OK
Via: SIP/2.0/UDP 10.99.99.6:63861;branch=z9hG4bK-d8754z-accfce61614c3777-1---d8754z-;received=10.99.99.6
From: <sip:[email protected];transport=UDP>;tag=62360641
To: <sip:*[email protected];transport=UDP>;tag=as038b5278
Call-ID: NjQ3MDQxMDg4OTg3N2Q2Y2MzNzAzY2YxMGYzYTBmNGQ.
CSeq: 3 BYE
Server: FPBX-2.11.0(11.12.0)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0


<------------>

<--- SIP read from UDP:10.99.99.6:63861 --->
PUBLISH sip:[email protected];transport=UDP SIP/2.0
Via: SIP/2.0/UDP 10.99.99.6:63861;branch=z9hG4bK-d8754z-e53ff412e5aab997-1---d8754z-
Max-Forwards: 70
Contact: <sip:[email protected]:63861;transport=UDP>
To: <sip:[email protected];transport=UDP>
From: <sip:[email protected];transport=UDP>;tag=23089c4e
Call-ID: MjViZmQ4OWExM2NjOGQ0YjY4NDE0YzU5ZWZhYTFkYzQ.
CSeq: 1 PUBLISH
Expires: 600
Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, REFER, MESSAGE, OPTIONS, INFO, SUBSCRIBE
Content-Type: application/pidf+xml
Supported: replaces, norefersub, extended-refer, timer, X-cisco-serviceuri
User-Agent: Z 3.6.25251 r25476
Event: presence
Allow-Events: presence, kpml
Content-Length: 256

<?xml version="1.0" encoding="UTF-8"?>
<presence xmlns="urn:ietfarams:xml:nsidf" entity="sip:[email protected];transport=UDP"> <tuple id="100" > <status><basic>open</basic></status> <note>Online</note> </tuple>
</presence>
<------------->
--- (16 headers 3 lines) ---
Sending to 10.99.99.6:63861 (no NAT)

<--- Transmitting (no NAT) to 10.99.99.6:63861 --->
SIP/2.0 489 Bad Event
Via: SIP/2.0/UDP 10.99.99.6:63861;branch=z9hG4bK-d8754z-e53ff412e5aab997-1---d8754z-;received=10.99.99.6
From: <sip:[email protected];transport=UDP>;tag=23089c4e
To: <sip:[email protected];transport=UDP>;tag=as4f3fd03d
Call-ID: MjViZmQ4OWExM2NjOGQ0YjY4NDE0YzU5ZWZhYTFkYzQ.
CSeq: 1 PUBLISH
Server: FPBX-2.11.0(11.12.0)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0


<------------>
Really destroying SIP dialog 'MjViZmQ4OWExM2NjOGQ0YjY4NDE0YzU5ZWZhYTFkYzQ.' Method: PUBLISH

<--- SIP read from UDP:10.99.99.6:63861 --->
SUBSCRIBE sip:[email protected];transport=UDP SIP/2.0
Via: SIP/2.0/UDP 10.99.99.6:63861;branch=z9hG4bK-d8754z-e19fb4b94b1ba241-1---d8754z-
Max-Forwards: 70
Contact: <sip:[email protected]:63861;transport=UDP>
To: <sip:[email protected];transport=UDP>
From: <sip:[email protected];transport=UDP>;tag=dd57991a
Call-ID: ZjQ2ZjNkN2Q2NGY5NDI5YWQ4NDcyZjE3ZjkyMzk3MDI.
CSeq: 1 SUBSCRIBE
Expires: 600
Accept: application/watcherinfo+xml
Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, REFER, MESSAGE, OPTIONS, INFO, SUBSCRIBE
Supported: replaces, norefersub, extended-refer, timer, X-cisco-serviceuri
User-Agent: Z 3.6.25251 r25476
Event: presence.winfo
Allow-Events: presence, kpml
Content-Length: 0

<------------->
--- (16 headers 0 lines) ---
Sending to 10.99.99.6:63861 (no NAT)
Creating new subscription
Sending to 10.99.99.6:63861 (no NAT)
list_route: hop: <sip:[email protected]:63861;transport=UDP>
Found peer '100' for '100' from 10.99.99.6:63861

<--- Transmitting (no NAT) to 10.99.99.6:63861 --->
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 10.99.99.6:63861;branch=z9hG4bK-d8754z-e19fb4b94b1ba241-1---d8754z-;received=10.99.99.6
From: <sip:[email protected];transport=UDP>;tag=dd57991a
To: <sip:[email protected];transport=UDP>;tag=as551c4e86
Call-ID: ZjQ2ZjNkN2Q2NGY5NDI5YWQ4NDcyZjE3ZjkyMzk3MDI.
CSeq: 1 SUBSCRIBE
Server: FPBX-2.11.0(11.12.0)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm="asterisk", nonce="694597f9"
Content-Length: 0


<------------>
Scheduling destruction of SIP dialog 'ZjQ2ZjNkN2Q2NGY5NDI5YWQ4NDcyZjE3ZjkyMzk3MDI.' in 6400 ms (Method: SUBSCRIBE)
== Spawn extension (from-internal, *43, 4) exited non-zero on 'SIP/100-0000000a'
-- Executing [h@from-internal:1] Hangup("SIP/100-0000000a", "") in new stack
== Spawn extension (from-internal, h, 1) exited non-zero on 'SIP/100-0000000a'

<--- SIP read from UDP:10.99.99.6:63861 --->
SUBSCRIBE sip:[email protected];transport=UDP SIP/2.0
Via: SIP/2.0/UDP 10.99.99.6:63861;branch=z9hG4bK-d8754z-aca2e18d4dcac18e-1---d8754z-
Max-Forwards: 70
Contact: <sip:[email protected]:63861;transport=UDP>
To: <sip:[email protected];transport=UDP>
From: <sip:[email protected];transport=UDP>;tag=dd57991a
Call-ID: ZjQ2ZjNkN2Q2NGY5NDI5YWQ4NDcyZjE3ZjkyMzk3MDI.
CSeq: 2 SUBSCRIBE
Expires: 600
Accept: application/watcherinfo+xml
Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, REFER, MESSAGE, OPTIONS, INFO, SUBSCRIBE
Supported: replaces, norefersub, extended-refer, timer, X-cisco-serviceuri
User-Agent: Z 3.6.25251 r25476
Authorization: Digest username="100",realm="asterisk",nonce="694597f9",uri="sip:[email protected];transport=UDP",response="f60b882b1329afcbde02a7162f1ebd17",algorithm=MD5
Event: presence.winfo
Allow-Events: presence, kpml
Content-Length: 0

<------------->
--- (17 headers 0 lines) ---
Creating new subscription
Sending to 10.99.99.6:63861 (no NAT)
Found peer '100' for '100' from 10.99.99.6:63861

<--- Transmitting (no NAT) to 10.99.99.6:63861 --->
SIP/2.0 489 Bad Event
Via: SIP/2.0/UDP 10.99.99.6:63861;branch=z9hG4bK-d8754z-aca2e18d4dcac18e-1---d8754z-;received=10.99.99.6
From: <sip:[email protected];transport=UDP>;tag=dd57991a
To: <sip:[email protected];transport=UDP>;tag=as551c4e86
Call-ID: ZjQ2ZjNkN2Q2NGY5NDI5YWQ4NDcyZjE3ZjkyMzk3MDI.
CSeq: 2 SUBSCRIBE
Server: FPBX-2.11.0(11.12.0)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0


<------------>
Really destroying SIP dialog 'ZjQ2ZjNkN2Q2NGY5NDI5YWQ4NDcyZjE3ZjkyMzk3MDI.' Method: SUBSCRIBE
Really destroying SIP dialog 'NjQ3MDQxMDg4OTg3N2Q2Y2MzNzAzY2YxMGYzYTBmNGQ.' Method: BYE
Reliably Transmitting (no NAT) to 10.99.99.6:63861:
OPTIONS sip:[email protected]:63861;rinstance=87117ef74d780b17;transport=UDP SIP/2.0
Via: SIP/2.0/UDP 10.99.99.1:5060;branch=z9hG4bK46bfe900
Max-Forwards: 70
From: "Unknown" <sip:[email protected]>;tag=as74db7fb8
To: <sip:[email protected]:63861;rinstance=87117ef74d780b17;transport=UDP>
Contact: <sip:[email protected]:5060>
Call-ID: [email protected]:5060
CSeq: 102 OPTIONS
User-Agent: FPBX-2.11.0(11.12.0)
Date: Tue, 07 Oct 2014 19:10:56 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0


---

<--- SIP read from UDP:10.99.99.6:63861 --->
SIP/2.0 200 OK
Via: SIP/2.0/UDP 10.99.99.1:5060;branch=z9hG4bK46bfe900
Contact: <sip:10.99.99.6:63861>
To: <sip:[email protected]:63861;rinstance=87117ef74d780b17;transport=UDP>;tag=d835a038
From: "Unknown"<sip:[email protected]>;tag=as74db7fb8
Call-ID: [email protected]:5060
CSeq: 102 OPTIONS
Accept: application/sdp, application/sdp
Accept-Language: en
Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, REFER, MESSAGE, OPTIONS, INFO, SUBSCRIBE
Supported: replaces, norefersub, extended-refer, timer, X-cisco-serviceuri
User-Agent: Z 3.6.25251 r25476
Allow-Events: presence, kpml
Content-Length: 0

<------------->
--- (14 headers 0 lines) ---
Really destroying SIP dialog '[email protected]:5060' Method: OPTIONS
Reliably Transmitting (no NAT) to 10.99.99.6:63861:
OPTIONS sip:[email protected]:63861;rinstance=87117ef74d780b17;transport=UDP SIP/2.0
Via: SIP/2.0/UDP 10.99.99.1:5060;branch=z9hG4bK5daeef49
Max-Forwards: 70
From: "Unknown" <sip:[email protected]>;tag=as07462ab7
To: <sip:[email protected]:63861;rinstance=87117ef74d780b17;transport=UDP>
Contact: <sip:[email protected]:5060>
Call-ID: [email protected]:5060
CSeq: 102 OPTIONS
User-Agent: FPBX-2.11.0(11.12.0)
Date: Tue, 07 Oct 2014 19:11:56 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0


---

<--- SIP read from UDP:10.99.99.6:63861 --->
SIP/2.0 200 OK
Via: SIP/2.0/UDP 10.99.99.1:5060;branch=z9hG4bK5daeef49
Contact: <sip:10.99.99.6:63861>
To: <sip:[email protected]:63861;rinstance=87117ef74d780b17;transport=UDP>;tag=2959d63b
From: "Unknown"<sip:[email protected]>;tag=as07462ab7
Call-ID: [email protected]:5060
CSeq: 102 OPTIONS
Accept: application/sdp, application/sdp
Accept-Language: en
Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, REFER, MESSAGE, OPTIONS, INFO, SUBSCRIBE
Supported: replaces, norefersub, extended-refer, timer, X-cisco-serviceuri
User-Agent: Z 3.6.25251 r25476
Allow-Events: presence, kpml
Content-Length: 0

<------------->
--- (14 headers 0 lines) ---
Really destroying SIP dialog '[email protected]:5060' Method: OPTIONS
Unknown-be-a0-c5-8c-02-6a*CLI>

 

[AndyInNYC]

There's no rpt info. The best way I know of to do this is to start putty with logging.
log in and make a call from extension 100 to a phone off the PBX.
Exit putty and do a search for 2 things - 1 the phone # (and do a search and replace) and 2 the public IP of extension 100 - if it shows up sanitize that.

Then post a snippet - or tell me "nope, mine works as expected".

Thanks.

Andrew