Database Develop

Running OpenVPN on the Kaiser (3G)

I've been struggling with OpenVPN on my Vario III on T-Mobile and hope someone can throw me a bit of a lifeline.
I can connect to my OpenVPN (running on my WRT54GS router) via wifi but the problem is when I try over 3G. Even when I've specified the provider and ticked "exclusive", it manages to connect to my OpenVPN server but I get no further connectivity (to webpages etc).
As said, via wifi this config on my Kaiser works perfectly...
Code:
remote xxxxxx.homeip.net
port 22
dev tap
secret "\\Program files\\OpenVPN\\config\\secret.key"
proto tcp-client
resolv-retry infinite
nobind
comp-lzo
cipher AES-256-CBC
route gateway 192.168.xxx.xxx
redirect-gateway
dhcp-option DNS 192.168.xxx.xxx
but when tried via 3G it seems to have a problem with setting the routing..
Code:
Mon Oct 22 21:58:00 2007 ROUTE: route addition failed using CreateIpForwardEntry: The parameter is incorrect.
Just wondering if there is something either with the T-Mobile network or the Vario III which is specifically stopping me from using OpenVPN
Or are my settings misconfigured?
I've also attached a full copy of the log.
Thanks for any help you can give (Give generously)
CP

Sounds suspiciously like a NAT traversal or proxy issue to me. On the HSDPA network, there's a proxy in the picture. I don't believe that's the case for the Edge network. That could easily be the cause of the problem.

Surely once the connection has been established the NAT issue shouldn't be a problem?
TBH I thought the route addition problem was due to the software being unable to update the local routing table?

NAT traversal issues often manifest themselves as connections that look like they're established, then die immediately. The VPN participants have to know the actual IP addresses of the devices involved, and understand that NAT is happening. Proxies also need to play a role in that process since they're effectively "standing in" for your device. And they may be configured not to permit IPSec traffic at all.
What you've described sounds exactly like NAT traversal issues - the negotiation appears to go just fine, but the actual connection dies on the vine. Since the end points don't have the right data from the negotiation (actual valid addresses to build the tunnel around), the route they try to build is invalid and fails.
In your log, it's impossible to tell since the IP addresses have been all translated to xxx.xxx.xxx.xxx. But I suspect that the ones up until the "TCP connection established with..." message are all displaying valid public IP addresses, and somewhere very shortly after that they start displaying private RFC 1918 addresses.
Proxies + NAT +IPSec = small nightmares. This is one of the reasons SSL VPNs have gained significantly in popularity.

Try Hamachi vpn
https://secure.logmein.com/products/hamachi/vpn.asp
Surur

PerfAlbion said:
In your log, it's impossible to tell since the IP addresses have been all translated to xxx.xxx.xxx.xxx. But I suspect that the ones up until the "TCP connection established with..." message are all displaying valid public IP addresses, and somewhere very shortly after that they start displaying private RFC 1918 addresses.
Click to expand...
Click to collapse
You have PM

Quick update:
I've just connected my Laptop to the internet via my Kaiser using 3G.
Ran OpenVPN and it connected without a problem.
Technically this would suggest that I should be able to connect with my kaiser but theres either a problem with my config or a bug in the PPC openvpn software :S
I haven't tried on UDP yet which will be my next test....
Any ideas?

Blimey, I didn't know there was a PPC client! I'll try it to see if it works with my setup.

Well I can't even get it to talk to my server so won't be able to help !

Fire up the card in your laptop and take a look at the IP address assigned to your machine. Since it's a different service, they may not be passing you through the proxy that's in place for the Kaiser. If you've received a public address, then you're on a "different network" even though both are 3G services.

PerfAlbion said:
Fire up the card in your laptop and take a look at the IP address assigned to your machine. Since it's a different service, they may not be passing you through the proxy that's in place for the Kaiser. If you've received a public address, then you're on a "different network" even though both are 3G services.
Click to expand...
Click to collapse
?? When you connect a laptop via BT to the kaiser, (using internet sharing) it creates a NAT which the traffic is passed over through the 3G service. Essentially using the same service..
Unless you mean the "service" between the windows software & the PPC/WM software is different?
Plus how'd you mean fire up the card in my laptop?
Cheers for your help on this btw.

I'm assuming that the Laptop data service and the PDA data service are treated differently within the AT&T network. While the PDA passes through a proxy, I suspect the laptop does not.
When I say "fire up the laptop card," I mean establish a connection and look at your IP address (ipconfig from a command prompt will show it). It may be a different IP address range than the PDA receives (which you could see using VxIPConfig or VxUtils). Even if it's within the same range, it may be bypassing the proxy.
So while you're using essentially the same technology, I suspect the services are implemented very differently, and that's what we're trying to sort out.

I dont believe it!!!
I downloaded VM Net Brower checked what IP addresses were being assigned and connected successfully! Loaded up www.whatismyip.org and it came up with the proxy of my PC at home.
Unfortunately, my phone was running incredibly slow and thought it best to do a soft reset... afterwards no matter what I do, I can't connect. I just cant figure out why or replicate what I did
Argh.. this is getting to me now... next on the agenda is to try changing the port number from 22 to 8080 or 80 and see what happens.

Can A network guru please help me?

I recently moved and am using someones wifi for a while. I have a laptop that connects fine to it but I am wanting to take it one step further. (Please see image for what I want to do.)Thanks for your time..
In general I just want to receive wifi on my laptop and output that with an ethernet cable to a router that will then supply internet to my 360 and htpc. I have tried both Bridge and ICS and neither have worked. Is this possible?

I don't think you can output wifi from a laptop to just any router. I don't even think you can do that. Best bet would be to buy an wi-fi adapter and router

you need a ethernet crossover cable from your laptop to router(you need it) and just follow this how to, just replace the ps2 with a router
http://www.i-hacked.com/content/view/118/62/

Ya I have tried almost everything but using a crossover cable. Thanks for the reply and your time..
One more question, would i need to disable dhcp on my router and assign the ip manually? Just wondering while im at work because I cant mess with it till tonight.

rolls1400 said:
Ya I have tried almost everything but using a crossover cable. Thanks for the reply and your time..
One more question, would i need to disable dhcp on my router and assign the ip manually? Just wondering while im at work because I cant mess with it till tonight.
Click to expand...
Click to collapse
im not sure, im a noob at network things, but just try it with dhcp and if no go then change it. after that, nothing happens, just come back here maybe someone else can help

My bad I'm a noob. I forgot you can use it as an internet bridge.

i wonder how did it go?
ps. if you cant find a crossover cable just make one. you can just cut a regular ethernet cable and cross the wires
just search for it to see witch ones need to be crossed

ultraprimeomega said:
i wonder how did it go?
ps. if you cant find a crossover cable just make one. you can just cut a regular ethernet cable and cross the wires
just search for it to see witch ones need to be crossed
Click to expand...
Click to collapse
1 & 2 (Pair One) and 3 and 6 (Pair Two)
Basically if it is Orange-White, Orange, Green-White, Blue, Blue-White, Green, Brown-White, Brown. On one end the other end needs to be Green-White, Green, Orange-White, Blue, Blue-White, Orange, Brown-White, Brown. Or Vice versa.

Is likely that the problem is the address used (or assygned) from the router.
when you are using the M$ ICS the PC that shares the connection MUST have the 192.168.0.1 address (and not any other address).
So if this is the address already used from the wiwfi router you can't easily share your connection.
So config the router on another address (eg: 10.0.0.1) and then share your connection with the XP machine as usually.

Well for a little update I ended up buying a crossover cable and successfully can connect one device through my laptop. i ended up bridging the connection and its working great. Unfortunately I am still unable to feed internet to the router. I am happy with just connecting one thing at a time but will work on getting the router fixed this weekend. Thanks for all the help guys and ill update if i get the router working.

The Solutor said:
Is likely that the problem is the address used (or assygned) from the router.
when you are using the M$ ICS the PC that shares the connection MUST have the 192.168.0.1 address (and not any other address).
So if this is the address already used from the wiwfi router you can't easily share your connection.
So config the router on another address (eg: 10.0.0.1) and then share your connection with the XP machine as usually.
Click to expand...
Click to collapse
Solutor,
Thanks I will give that a try this weekend, I have 3 PCs and a 360 so I def. want to get the router working. I tried a different subnet on my router a while ago and that didnt work but then again I wasnt as far as I am now. Thanks again

Success!!!
Ok guys here it is:
My laptop was receiving the ip 192.168.200.252 via dhcp from the neighbors wifi. My router(linksys wrt54g) on the other hand was set as default which is
Default Gateway 192.168.1.1
So all I had to do was change the linksys from Dynamic to static ip and add this info:
Internet I.P. Address: 192.168.200.251 (this field was already populated.)
Subnet Mask: 255.255.255.0 (Also already populated.)
Gateway: 192.168.200.1 (Neighbors wifi Router i.p.)
Static DNS: 192.168.200.1 (Use Neighbors DNS settings?)
Thats It. Thanks again for everyones help and hopefully this can help people with this problem down the road

Need to do one of two things... or both?

Ok, well basically my end need is to have my Google Calendar synced to my phone on which I have no service or access to WiFi internet. I'm in Iraq right now, and the only internet I have is via Ethernet.
I am hoping to, at the least, sync my calender over USB. But one thing I'd love to do is share my internet connection to my phone via USB like WinMo does. That way I can mess with new roms and the such while I'm out here. Thing is, it can't have it's own IP address because all IP's are assigned and I have to log in via my browser on my computer once I'm connected. It's a pain in the ass.
But, any help would be great. Thanks!

I am pretty sure there is not a way to do what you are asking. Without wifi or and kind of data signal, there is no way to connect the gmail servers to your phone. I am pretty sure that usb is out of the question, which seems to be your only option.
Sorry my friend.

This might help, all you need is linux. You could virtualize it, but idk if you can do that where you are at right now.

any possibility of getting a usb wifi device and setting up Internet Connection Sharing so your phone would have a local ip like 192.168. and share the connection on your computer with your phone???

I don't know exactly how the IP shiz works with ICS, but the ISP out here uses 192.168 IP's. All I know is that the phone would need to not have an IP, or something along those lines, for it to work. IDFK....

If you're in iraq, it might be hard to get your hands on one of these, BUT, in the interests of completeness,
Use of a regular cheap broadband router with integrated wifi WILL do what you are looking to do...
You might need to clone your computer's MAC address to the router's WAN device, then it'll connect to the DHCP server, then using EITHER the computer OR the phone, go to the browser and authenticate.
Note: I don't think that there is really any way to network the phone to the computer using USB, though bluetooth IS an option... it'll be a console-only operation though.
Final option is to get your hands on a wifi device for the computer (can be a USB device) and run it as a NAT, i.e. use iptables.
my95z34 said:
Ok, well basically my end need is to have my Google Calendar synced to my phone on which I have no service or access to WiFi internet. I'm in Iraq right now, and the only internet I have is via Ethernet.
I am hoping to, at the least, sync my calender over USB. But one thing I'd love to do is share my internet connection to my phone via USB like WinMo does. That way I can mess with new roms and the such while I'm out here. Thing is, it can't have it's own IP address because all IP's are assigned and I have to log in via my browser on my computer once I'm connected. It's a pain in the ass.
But, any help would be great. Thanks!
Click to expand...
Click to collapse

lbcoder said:
If you're in iraq, it might be hard to get your hands on one of these, BUT, in the interests of completeness,
Use of a regular cheap broadband router with integrated wifi WILL do what you are looking to do...
You might need to clone your computer's MAC address to the router's WAN device, then it'll connect to the DHCP server, then using EITHER the computer OR the phone, go to the browser and authenticate.
Note: I don't think that there is really any way to network the phone to the computer using USB, though bluetooth IS an option... it'll be a console-only operation though.
Final option is to get your hands on a wifi device for the computer (can be a USB device) and run it as a NAT, i.e. use iptables.
Click to expand...
Click to collapse
They don't care what the MAC is, just IP's. I can get a WiFi router if I need to. But, if I turn off DHCP on the router, does it still need it's own IP address? Or does it just act as a switch? All IP configuration is done on the device, there is no DHCP ran by the ISP.

my95z34 said:
They don't care what the MAC is, just IP's. I can get a WiFi router if I need to. But, if I turn off DHCP on the router, does it still need it's own IP address? Or does it just act as a switch? All IP configuration is done on the device, there is no DHCP ran by the ISP.
Click to expand...
Click to collapse
The cheap broadband router has TWO IP addresses. The public IP address assigned by the ISP's DHCP server (or manually if the ISP doesn't have DHCP), and the PRIVATE IP address used to communicate with the other devices that you hook up to it. It uses NETWORK ADDRESS TRANSLATION (see http://en.wikipedia.org/wiki/Network_address_translation ) to connect the client machines to the public network. To the public network, it appears that there is ONLY ONE machine connecting -- the NAT box (router) itself.
You will leave the DHCP *SERVER* (LAN SIDE) running on the router, you will disable the DHCP *CLIENT* (WAN SIDE) and configure the WAN IP/NETMASK/DNS/GATEWAY to the specifications required by the ISP. You will use the router's WAN port to connect to your ISP, you will use any LAN port to connect to your computer, and you will use the WiFi to connect to your phone. You will then have private IP addresses assigned to your computer and your phone, and these devices will be able to connect through your ISP's network via the router.

So doing that the ISP will see my router as my computer, then both my phone and computer can connect at the same time because they'll have their own private IP?

Internet Sharing with Windows 7... anyone got it working? [SOLVED]

Hi all,
I used to use my Diamond connected via USB and the 'Internet Sharing' function to provide Internet access to my laptop running Vista without any problems whatsoever...
However I have recently upgraded to Vista and don't seem to be getting anywhere... or rather getting somewhere but not far enough!
Specifically, I can connect the Diamond to the laptop via USB and run 'Internet Sharing' on the device. Having hit Connect and connected to the Internet (confirmed my running a browser on the Diamond) the laptop detects a 'Remote NDIS Internet Sharing Device' in the Device Manager. It then adds a connection in Network Connections but seemingly-fails to get any further. It looks like the DHCP requests are falling on deaf ears and without an IP address it's not going to get far beyond that...
Anyone with any ideas? Or, at the very least, could someone confirm that they have got Internet Sharing working with Windows 7, even if they didn't necessarilly have to do anything special?
Regards,
Mathew

Typical... you think you've tried everything, you've exhausted Google and posted a forum post as a last resort plea for help.... Five minutes later you sort it! Mustn't moan I suppose... and in case anyone else hits this problem here's how to sort it:
The problem was calling out to me really - DHCP. I had Layer 2 connectivity but without establishing anything at Layer 3 it simply wasn't going to work so if statically asign the IP address then I could at least rule DHCP out of the equation to see what additional hurdle, if any, had to be then tackled.
The problem was that without knowing the address at the other end (i.e. the Diamond) then I wouldn't know what subnet to put my laptop in. However, this all worked fine on Vista so I fired it up and ran Wireshark (network packet sniffer) and could see that the laptop was being given an IP address from the 192.168.0.0/24 subnet and that the other end (whether that be the Diamond or some virtual device that at least representa it) was sat on 192.168.0.1. Strangely, the other end had a MAC address of 82:00:60:0F:E8:00 and the laptop 80:00:60:0F:E8:00 - whilst they're not globally assigned this must be what Microsoft use on the local link for these types of connections.
So, back to Windows 7, I fired up Internet Sharing and connected to my ISP. I now had a LAN connection listed on the laptop under Network Connections so I forced a static address assignment by right-clicking it and selecting Properties > Internet Protocol Version 4 (TCP/IP) > Properties and assigning the following:
IP Address: 192.168.0.80 (choose anything within 192.168.0.2-254 but stay away from anything you might already have assigned to other connection e.g. wireless/wired Ethernet etc)
Subnet Mask: 255.255.255.0
Default Gateway: 192.168.0.1
DNS Server: 192.168.0.1
Hit OK and then, being the Microsoft way, you will likely need to bruteforce the new application of the new setting by disconnecting and reconnecting the Internet Sharing connection. The LAN connection on the laptop will disappear and reappear, hopefully with a static address assigned (right-click it and select Status - DHCP should be disabled).
I still don't know why DHCP was failing but regardless I've got what I wanted - shared access to the Internet!
Cheers,
Mathew

Nice one, thanks for sharing.

reverse tether, ad-hoc, on mac filtered network?

I have a rooted N1 with cyanogen 5.0.4.1 on it.
I'm studying abroad this semester, and the university I'm at seems to have done everything they could to prevent me from connecting my phone to the internet on their network.
There is a wireless network, but it doesn't reach my room, and there's a proxy; I haven't been able to get any of the various proxy apps to work with it, at all. On a somewhat related note, since moving to cyanogen I'm not able to connect to that network anymore (wpa enterprise, tls/pap/user+pass). No real loss, since it didn't work as I couldn't get the proxy going.
The rooms have ethernet, with a static IP and mac filtering, and of course the same proxy. In addition, on the wired network in the rooms you have to connect to a vpn in order get anything other than the school's intranet
With cyanogen's rom, I have been able to connect my phone to my computer's ad-hoc network by giving it the parameters (IP, gateway, netmask, dns), that were provided to me, but I can't download anything. My only guess as to why that's not working is their static IP/mac filtering combo is not playing nicely.
I haven't ever delved very deeply into networking type stuff such as proxies, ssh tunnels, etc, so these two ideas of mine could be completely unworkable, but what I've been able to come up with is:
1. Is there a way to have my laptop keep handling all the proxy/ip/vpn nonsense, and just route http data to and from my phone? I've never dealt with ssh or anything of that sort, but I run linux so it should be pretty trivial to get it set up on the laptop's side of the equation.
2. Failing that, I'm allowed to have 3 devices with 3 different mac addresses, each of which is given a separate IP address, so I give the people in charge of the network the mac address for my phone and get an IP address for it. Then, connect to my laptop's ad-hoc network, which is on IP #1, and go to the advanced wifi settings on my N1 and set up a static IP with IP #2. Does that work, at all? This of course doesn't account for the vpn at all, but if it does in fact work I'd then move on to that.

What a ****ing brain-buster. Goodluck!

As an update, I can use cyanogen's included tethering ability, in conjunction with ConnectBot, to ssh from my phone to my computer (got that working after a bit of work, and learned something new). However, when I try to set up port forwarding in ConnectBot, it doesn't work; I don't know which ones to forward, whether to choose local or remote, and if I try to forward something below 1024 it gives me an error because of that. Does anybody know what ports I need to forward, and how to do that properly with ConnectBot?