This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL VPN connects, but doesn't route traffic or do much at all

I recently upgraded to ASG 7.500.  Prior to the upgrade, my SSL VPN worked fine; however, after the upgrade, it is no longer working properly.  I downloaded and installed the latest client from the user portal (for Windows 7 RTM x64), and ran it as Administrator.   It connects to my ASG and gives me an IP address from the VPN Pool (SSL), but it doesn't tunnel my network traffic through the VPN connection (for example, my external IP address does not change, like it used to when it was working properly).  The Astaro client shows that it connects properly and everything looks like it's working, but nothing actually happens with the network traffic.

I checked the network addresses and subnet masks of all other VPN Pools (Cisco, IPSec, L2TP, and PPTP) and they are all properly subnetted into non-conflicting and separate networks. (With a /24 subnet mask)

Under Network Security --> NAT, Masquerading, there is a rule to allow VPN Pool (SSL) -> External (WAN).  I have not changed any configuration settings--I have only upgraded to 7.500.

When I view the live SSL VPN log, it shows everything connecting properly and doesn't show any errors.  The last line shows "Peer Connection Initiated with x.x.x.x"

Could it be that my campus is blocking SSL VPN connections somehow?  If I understand correctly, they would have to block port 443 (which my ASG is configured to use for SSL VPN connections), which would also disallow secure connections to web sites, etc.

The problem exhibits itself on both Windows (with the Astaro/OpenVPN client) and Mac OS X using (using Tunnelblick).  I had the VPN working properly with Windows 7 RTM x64 before the upgrade to ASG 7.500.

Any suggestions would be greatly appreciated.

This thread was automatically locked due to age.

0 Ölm over 15 years ago in reply to AngeloC

I use our SSL VPN almost every day, and see no troubles with either the latest openvpn build or our own build connecting from windows 7 to 7.500 or 7.501...

Angelo, then that´s probably due to you are routing only the Astaro network(s) into the SSL VPN tunnel and are NOT using the ANY definition inside the SSL VPN ?
Cancel
Vote Up 0 Vote Down

Cancel
0 Ölm over 15 years ago in reply to bhall7

Is it a bug in OpenVPN or in the Astaro implementation of OpenVPN?

If it really works with the old client but not the new one, then it´s pretty sure a bug in OpenVPn and not in the Astaro SSL VPN CLient implementation.

Besides changing some help texts, menu item descriptions and the graphical logo (i.e. "branding" the OpenVPN client), Astaro does not change much from the "original" client. From what I know, no binaries/code are changed/replaced. This is the reason why you can use the "original" OpenVPN client without problems to connect to a Astaro. Nothing proprietary was implemented from Astaro side.
So if the client is the problem, pretty sure its a bug that also the "original" OpenVPN client has.
Cancel
Vote Up 0 Vote Down

Cancel
0 ScottL over 15 years ago in reply to Ölm

Well I tried the client they recommended. It works fine for me on XP and routes successfully, but it still does NOT work for me at all on a fresh install of Vista(32bit)(even ran as Administrator).

When I get home from work I will see what version of OpenVPN I am running at home (on Vista64bit) because that works. The only thing I did different at home is that I orignally installed the Astaro 1.3 client and when that did not orginally work(this was last year) I also installed whatever 2.x version of OpenVPN was the latest at the time. So basically I have both on the box. So I am not sure what to make of all this.

I did take the internet 0.0.0.0/0 definition out of the list to try and use split tunneling and I can report that it DOES work succesfully. I just dont feel comfortable running split tunnel @ the moment.

-Scott
Cancel
Vote Up 0 Vote Down

Cancel
0 ScottL over 15 years ago in reply to ScottL

Well this is interesting. I brought this Sprint Data Card home with me the one I had been testing with and it looks like I can duplicate the problem on my home PC also. If I run the the OpenVPN client(2.1_rc4) on my PC with my normal broadband connection the VPN connection works fine. So apparently part of my problem is with the Sprint usb Data card and possibly the VPN client.

I guess I'll be digging into this a little more as this had been working fine for the past year or so.

-Scott
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 15 years ago in reply to ScottL

hmm... I've been having trouble with my Sprint card too, but not with 7.501...
Using Linux OpenVPN, my 7.501 SSL VPN works, but connecting to my friend's 7.405 Astaro hasn't been working (connects, but can't ping the firewall or anything else).

I haven't dug into it too deeply yet.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 bhall7 over 15 years ago

Thanks for the suggestion. I have checked with my ISPs (switched from Comcast to another local provider recently), and they are not blocking anything. I've also tried connecting from the client on multiple different ISPs.

Thinking about buying a Cisco ASA 5505 soon.
Cancel
Vote Up 0 Vote Down

Cancel
0 t-work over 15 years ago in reply to bhall7

My sales people are killing me: same problem here, also.
After I tested the new client successfully by myself I distributed the new client to everyone last Friday.
Since that my phone didn't stop ringing.

The problem is the missing routes to the internal networks.
Following workaround helped with all clients I tested until now (WinXP as well as Win 7):

route add IP.OF.INTERNAL.NETWORK MASK MASK.OF.INTERNAL.NETWORK GATEWAY.OF.VPN.CONNECTION

You get GATEWAY.OF.VPN.CONNECTION by copying the IP Address of the DHCP server of the Astaro VPN Client Network Interface.

Still the rest of the network traffic will NOT pass the Astaro - what can be a security issue.

In the VPN-Client logs all route additions succeed, so i believe that there is an issue with the whole config due to the necessary route additions are not even attempted. Perhaps the new client/server has problems with network-groups being present in "local networks" - just into the blue as I can't test it at the moment.
Also the manual changes in the vpnconf did not help.

I will open a case with Astaro as soon as possible.
Cancel
Vote Up 0 Vote Down

Cancel
0 bhall7 over 15 years ago in reply to t-work

Thank you very much for the reply, but where do you add this route and how do you make this change?

Thanks!
Cancel
Vote Up 0 Vote Down

Cancel
0 t-work over 15 years ago in reply to bhall7

Hi bhall7,

you have to enter the route manually at every connect (gateway and IP changes eventually).
This works via cmd.
not really a solution but at least a workaround.

greetings,

Thomas
Cancel
Vote Up 0 Vote Down

Cancel
0 ClarkDaughtrey over 15 years ago

Try this:

SSL client connects but no traffic routes

After connecting with the ssl client the connection status shows green. However traffic flow doesn't appear to occur. This is due to the route commands not having administrative priveleges on windows systems when run as a limited user account.

In the Astaro SSL client log the following error regarding routes will be shown:
Route addition fallback to route.exe

Setting administrator rights to a program:

STEP ONE

=======================

In Wordpad, open the following file: c:\Program Files\Astaro\Astaro SSL VPN Client\config\(user credentials)

Then, go to the bottom of the file and add the following lines:

route-method exe

route-delay 2

STEP TWO

=======================

Next up is to change the Astaro VPN client to always run as an administrator. Go to this location with Windows Explorer:

c:\Program Files\Astaro\Astaro SSL VPN Client\bin\

Highlight the file openvpn-gui.exe and then right-click. Choose properties. Click the "Compatibility" tab and check the checkbox "Run this program as an administrator" and click ok.

STEP THREE

======================

We now need to remove the Astaro VPN Client from startup, otherwise it will be blocked because of "Administrative Behavior".

- Click START ---> RUN and type msconfig and then click OPEN

- Click the STARTUP Tab and uncheck openvpn-gui

- When you restart your PC again, it will ask if you want to run msconfig again, just check the appropriate checkboxes so it will not do that in the future.

STEP FOUR

=======================

Click START ---> ALL PROGRAMS ---> ASTARO SSL VPN ---> ASTARO VPN Client

Right click the traffic light and choose connect.

After authenticating, you should be able to access network resources
Cancel
Vote Up 0 Vote Down

Cancel

SSL VPN connects, but doesn't route traffic or do much at all

Submitted a Tech Support Case lately from the Support Portal?