Hamachi2 Gateways - Lessons Learned

[J290]

Here are a few things that I've learned in setting up Hamachi Gateways...

• It's easier to install the client on the gateway before creating a Hamachi Network.  This makes it available to select during the "Create Network" wizards.
• At least for gateways, it is easier to create the network from the LogMeIn.com site, not the Hamachi client.
• The Hamachi Client not only runs on all client computers, it also runs on the Gateway computer.
• Running the gateway on VMWare vSphere ESX 4.0 (also ESX 3.x) requires the network adapter in ESX to be configured in "Promiscuous Mode".  If it is not configured, network connectivity on the server VM will be lost when the Hamachi Client on the Gateway is installed.
• Based on the above, I suspect "Promiscuous Mode" would need to be turned on when using a more advanced SOHO or business grade switch like an HP ProCurve.  Consumer grade switches already have it turned on.
• Must "Disable UAC" on Vista and Server 2008.  Google to find out how.  On 2008 this can be done by Start -> Run -> msconfig -> Tools tab -> "Disable UAC"
• I've gotten Hamachi to works on Server 2003, Server 2008, and XP as gateways.
• I've been able to get Hamachi to work as a client on Windows 7 Ultimate, Vista, and XP.
• On Windows 7 Hamachi required my RSA key to be authenticated.  This showed up as a blocked connection.  Right click -> Details... -> then double click Authentication and click "Trusted"
• If the client running on the gateway is "Powered Off" it disconnects all Hamachi connections essentially turning the entire Hamachi Gateway network off.   

Tunnel notes - Under connection "details... " in the Hamachi client

• "Direct" links are the best tunnels and I typically see Round-trip times of 45-60ms where I'm at. 
• "via Relays" is the next best tunnel and I typically see 100-200ms Round-trip times.
• "via Servers" is the slowest and with the free Hamachi product I've seen 500+ms Round-trip times.
• When Hamachi first connects it finds the fastest link then if the fast link drops off for whatever reason, it reconnects with the next fastest tunnel until it connects "via Servers"

Add comments as needed.

John

[mwdeans]

The vmare network cards in promiscuous mode comment was the last clue I needed to fix the issues I was having.  Thank you

[Nitax]

I recently installed Hamachi2 on a Server 2008 R2 machine and while everything seemed fine at first, it messed up the permissions to many of my file shares (See http://social.technet.microsoft.com/Forums/en/windowsserver2008r2general/thread/57d51845-ca42-4862-a....)  This morning I made a "last ditch" effort and disabled UAC (even though this does not seem logical what-so-ever) and the permissions seemed to function normally again.

I am still quite confused as to why this happens.  More importantly, i'm wondering what kind of security holes I am opening up by running with UAC disabled.  Is there any possible way to turn UAC back on and have Hamachi2 function correctly?  

[mccoppin]

I'm still having trouble with the procedure to designate which of my clients is the 'gateway' member versus a guest. Every time I find the obvious place where that should be an available configuration... it's not.

[Kazper]

---

@J290 wrote:

• I've been able to get Hamachi to work as a client on Windows 7 Ultimate, Vista, and XP.

---

Did you have the problem I've discovered with Windows 7 clients and a gateway setup where the client isn't assigned a default gateway and Windows 7 therefore automatically designates the gateway connection as Public (with all the issues this create with Windows firewall, shares, and similar)? If so how did you solve this? Obviously I could disable Windows Firewall or open public connections through it but there are security implications to doing those things...

Great post though!

[Kazper]

---

@mccoppin wrote:

I'm still having trouble with the procedure to designate which of my clients is the 'gateway' member versus a guest. Every time I find the obvious place where that should be an available configuration... it's not.

---

This caused me some grief too... First of all the Gateway computer must be associated with your LogMeIn account - it can't be marked as "(Guest)" when you are logged on on the site here. Then once the computer is associated with the account it should be possible to set it as the gateway by editing the network - again this wasn't quite that easy for me, but by deleting my first attempt and setting up the gateway network here on the site from the beginning (after associating the computer that was to run the gateway) I could designate it during creation.

Hope it helps...

[mattj46]

I recently tried to setup Hamachi on ESXi 4.0 and found this post extremely useful. Thank you  J290.

I was finally able to get it working by creating a new Virtual Switch, enabling it to Promiscuous Mode, and created a Virtual Machine Port Group with Promiscuous Mode enabled as well.

[CCGuy]

A couple of things learned in setting up a gateway on a Windows PC on a LAN with static IPs:

• The "Network Bridge" (go to Windows "Network Connections") must be configured with a static IP on the LAN. Hamachi seems to do that automatically sometimes and sometimes it doesn't.
• Right click on the network name in the Hamachi box on the gateway and select "Gateway Settings", unclick the box to obtain IP settings automatically aand enter a range of IPs on the LAN to be assigned to connecting clients.

(Because of some problem with the Forum, I'm being given someone else's username when I comment.)

[thornrag]

It's unintuitively under the "Add/Remove Members" tab on the "Edit Network" page. Once you click that, the radio buttons to select "Gateway" or "Member" (or Hub or Spoke) appear. It's in the FAQ, but of course you have to know what you're looking for.

[thornrag]

Another lesson learned: these forums don't automatically quote the message you click "Reply" to.

• Installing the client as a Gateway on a server already running RRAS services may require you to re-set interface priorities in the RRAS manager, or existing RRAS clients will be unable to route to your network.