Setting up an OpenVPN Windows 10 server and Linux client

[bontchev]

Hello folks,

I've spent several days trying to set up an OpenVPN server and failing miserably, so I am in an urgent need for help. Let me explain you what my situation and needs are and what I have done.

I need to set up an OpenVPN server running on a Windows 10 machine. The clients would be on Windows 10 and Linux machines eventually, but right now I urgently need to connect one Linux client. "Urgently", meaning I'm on a deadline and have a couple of weeks to get it working flawlessly.

The purpose of the VPN is to keep the Internet connection of the clients secure even if they are using untrustworthy Internet providers (think public hotspots, etc.). The clients do not need to access assets on a LAN, each other, etc.

The server needs to be able to run unattended. That is, if the machine it runs on is rebooted for some reason (like a power failure), the server has to start automatically without any human intervention like manually starting services or programs or clicking on things like "Connect".

These are my needs and they are non-negotiable. Please do not waste my time and yours by suggesting me to do something else. In particular:

• Do not tell me to use the VPN server that is built in Windows 10.
• Do not tell me to install the server on a different OS (e.g., Linux), physical or in the cloud.
• Do not tell me to use a paid VPN provider; I need to run the server on a metal we own and trust.
• Do not tell me to use a different VPN server software, unless you are 100% certain that what I need cannot be done with OpenVPN.

Sorry if the above sounds a bit harsh, but I've already got "advices" like these from different people that have tried to help me and I'd like to save everybody's time by avoiding them. If you're still with me, here is what I have been doing so far.

I was following mostly this guide for setting up an OpenVPN server on Windows.

Something that is not covered by the guide and that wasted me two days full of frustration. When you are installing the software, make sure you check "OpenVPN RSA Certificate Management Scripts". It is not checked by default and if these are not installed, the above guide is mostly useless, because it uses them.



So, I went like "where the blazes is this easy-rsa folder the guide is talking about?!". It wasn't helpful that when I went googling for it, some site suggested that this is no longer part of the OpenVPN distribution and pointed me to a GitHub page, which is clearly designed for Linux, supports commands different from the ones in the guide and asks you to install some Linux-on-Windows crap like mksh and, generally, WTF?!

Anyway. After installing the scripts, the guide started making sense.

One more thing. Initially I installed the package as a regular user (who knows the administrator password, in order to get past the UAC) and I've put it in the default directory. This was probably a mistake. Trying to do anything serious on Windows as a regular user is a f*cking nightmare and trying to modify things in "Program Files" is a f*cking nightmare even if you are Administrator.

So, I ended up scrapping everything, logging in as Administrator and installing the software in "C:\OpenVPN". It might be a good idea to modify the guide and the installer to account for such things.

I made sure that the OpenVPN service is running and is set on Automatic.





I modified the firewall configuration to allow UDP port 1194 in both directions and turned off the firewall for the TAP network.





BTW, by default the OpenVPN service isn't started and is set to Manual. This probably needs to be fixed.

I have also set up the location of the config files and the logs to be "C:\OpenVPN\config" and "C:\OpenVPN\log" respectively in the OpenVPN GUI, instead of the default in the user directory (C:\Users\Administrator\OpenVPN). I am a bit unsure about this and about the main purpose of the GUI as a whole. If it is meant to control the server, then the config and log files should not be in a user directory. If, OTOH, it is meant to control a client, then I probably shouldn't have installed it on the server at all.

At this point the TAP driver is installed, but Windows reports that the "cable is unplugged" on that network.



Not sure what this means but it doesn't sound good. Ignoring this problem for now, continuing with the installation.

I modified the file vars.bat not just the way mentioned in the guide but also to reflect the actual OpenVPN directory (which is NOT in "Program Files"). You might want to modify the guide to cover this part or, even better, make the installer set up this environment variable. I also modified the DH key to use 2048 bits instead of 1024.

The sample config files (*.ovpn) use Linux end-of-line marks. This makes it practically impossible to edit them with Notepad. Come on, folks, fix this. It's a Windows installation package, you can afford to put Windows text files inside! (Yes, I know that I can use another editor to edit them, but, sriously, WTF.)

When editing the server.ovpn file, it's not quite clear to me what to do about the "TUN/TAP" section. By default, it is set to "tun". Should I change it to "tap"? Especially given that the TAP interface doesn't seem to be working?

I set the ca, cert, key, dh and ifconfig-pool-persist parts to point to corresponding files in the C:\OpenVPN\config directory:

Code: Select all

ca "C:\\OpenVPN\\config\\ca.crt"
cert "C:\\OpenVPN\\config\\server.crt"
key "C:\\OpenVPN\\config\\server.key"
dh "C:\\OpenVPN\\config\\dh2048.pem"
ifconfig-pool-persist "C:\\OpenVPN\\config\\ipp.txt"

The guide doesn't say anything about this, but I also created a ta.key file with openvpn, because I remember from my previous attempts that without it I was getting error messages about its absence:

Code: Select all

tls-auth "C:\\OpenVPN\\config\\ta.key" 0

I also pointed the log files to the "C:\OpenVPN\log" directory:

Code: Select all

status "C:\\OpenVPN\\log\\openvpn-status.log"
log "C:\\OpenVPN\\log\\openvpn.log"

Again, the guide doesn't say anything about this (ipp.txt, ta.key, openvpn-status.log, openvpn.log); maybe it should.

I didn't touch any of the other configuration options; I don't understand most of them anyway.

I edited the client.ovpn file as described in the guide - but mostly as an exercise; not because I intend to use it right now. Remember, my first priority is to connect a Linux client, and there I have a nice GUI applet for setting up such stuff. I'll just remember to copy the client CRT and KEY files, and ta.key, and also set the corresponding ta option in the client to 1 (it is 0 on the server).

The guide then goes to say that I should copy the ca.crt, dh1024.pem, server.crt, server.key, and server.ovpn files from the C:\Program Files\OpenVPN\easy-rsa\ directory to the config directory on the server. This is wrong. There are no such files (except server.ovpn) in the easy-rsa directory. They are in the "keys" subdirectory of that directory (or whatever else you might have named it in vars.bat). Consider modifying the guide to reflect this.

The guide then says to start the OpenVPN GUI and double-click on the icon in the tray to connect. This is fine and dandy (I clicked, and it connected) - but I want the server to be able to run unattended, remember? What is going to happen if the server reboots and there is nobody around to log in as administrator and click on any icons??

The guide doesn't mention it, but I think I need to copy the file ta.key to the client, too.

Both the server and the client are behind a NAT. I created a firewall rule on the client, opening UDP port 1194 in both directions. I also opened this port on the router of the server. Do I need to do the same for the client(s)?

The server has static IP addresses - both external (assigned by the ISP) and internal (assigned by the router), so at least that part won't be a problem.

Sadly, the client does not want to connect. Syslog of the client:

Code: Select all

Feb 19 15:25:46 vesselin-pc NetworkManager[1246]: <info> Starting VPN service 'openvpn'...
Feb 19 15:25:46 vesselin-pc NetworkManager[1246]: <info> VPN service 'openvpn' started (org.freedesktop.NetworkManager.openvpn), PID 21508
Feb 19 15:25:46 vesselin-pc NetworkManager[1246]: <info> VPN service 'openvpn' appeared; activating connections
Feb 19 15:25:46 vesselin-pc nm-openvpn[21511]: OpenVPN 2.3.2 i686-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec  1 2014
Feb 19 15:25:46 vesselin-pc nm-openvpn[21511]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Feb 19 15:25:46 vesselin-pc nm-openvpn[21511]: Control Channel Authentication: using '/home/bontchev/.openvpn/ta.key' as a OpenVPN static key file
Feb 19 15:25:46 vesselin-pc nm-openvpn[21511]: UDPv4 link local: [undef]
Feb 19 15:25:46 vesselin-pc nm-openvpn[21511]: UDPv4 link remote: [AF_INET]195.96.252.188:1194
Feb 19 15:26:26 vesselin-pc nm-openvpn[21511]: SIGTERM[hard,] received, process exiting
Feb 19 15:26:31 vesselin-pc NetworkManager[1246]: <info> VPN service 'openvpn' disappeared

NMap suggests that the server is listening:

Code: Select all

Starting Nmap 6.40 ( http://nmap.org ) at 2017-02-19 15:30 EET
Nmap scan report for mail.x.x.bg (195.x.x.188)
Host is up (0.0050s latency).
PORT     STATE         SERVICE
1194/udp open|filtered openvpn

However, there is no log for the client on the server. Furthermore, the server log suggests that it is using IPv6. It should be using IPv4. I even explicitly disabled the IPv6 support of the server in Windows 10:

Code: Select all

Sun Feb 19 14:55:25 2017 Could not determine IPv4/IPv6 protocol. Using AF_INET6
Sun Feb 19 14:55:25 2017 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sun Feb 19 14:55:25 2017 setsockopt(IPV6_V6ONLY=0)
Sun Feb 19 14:55:25 2017 UDPv6 link local (bound): [AF_INET6][undef]:1194
Sun Feb 19 14:55:25 2017 UDPv6 link remote: [AF_UNSPEC]
Sun Feb 19 14:55:25 2017 MULTI: multi_init called, r=256 v=256
Sun Feb 19 14:55:25 2017 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0

Any ideas what to do here? Do I need to open UDP port 1194 in the firewall of the client and/or in the NAT of the client? The latter generally won't be possible; where the client goes, it might not have control over the router.

Basically, I am stuck at this point. The client doesn't connect and I have no idea why. Any help would be appreciated.

[TinCanTech]

Please see:

• HOWTO: For OpenVPN Community Edition
• HOWTO: Routing all client traffic (including web-traffic) through the VPN

Also, set --verb 4 in your configs and then post your complete (sanitized) server and client config and log files.

[bontchev]

Please see:
HOWTO: For OpenVPN Community Edition

Sorry, I fail to see which particular part of this huge page is relevant to my problem. Could you be a bit more specific, please?

HOWTO: Routing all client traffic (including web-traffic) through the VPN

This is interesting and it is what I would want to implement eventually. Unfortunately, there are parts in it which I do not understand. For instance:

The server will need to be configured to deal with this traffic somehow, such as by NATing it to the internet, or routing it through the server site's HTTP proxy.

"Somehow"? Like, how? The example that follows it is for Linux - but, as I wrote in my original message, my server is running on Windows 10; what do I have to do there? Some rule on the firewall, I guess, but what exactly?

Also,

For example:

Code: Select all

push "dhcp-option DNS 10.8.0.1"

will configure Windows clients (or non-Windows clients with some extra server-side scripting) to use 10.8.0.1 as their DNS server.

Again, this is rather vague. My client is Linux, not Windows. What exactly is meant by "some extra server-side scripting"?

Anyway, I am not getting that far. My problem isn't that not all traffic is routed through the VPN, but that the client cannot contact the VPN at all.

Also, set --verb 4 in your configs and then post your complete (sanitized) server and client config and log files.

Config file of the server:

Code: Select all

port 1194
proto udp
dev tun
ca "C:\\OpenVPN\\config\\ca.crt"
cert "C:\\OpenVPN\\config\\server.crt"
key "C:\\OpenVPN\\config\\server.key"
dh "C:\\OpenVPN\\config\\dh2048.pem"
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist "C:\\OpenVPN\\config\\ipp.txt"
keepalive 10 120
tls-auth "C:\\OpenVPN\\config\\ta.key" 0 # This file is secret
cipher AES-256-CBC
persist-key
persist-tun
status "C:\\OpenVPN\\log\\openvpn-status.log"
log "C:\\OpenVPN\\log\\openvpn.log"
verb 4
explicit-exit-notify 1

Log file of the server when told to re-connect:

Code: Select all

Mon Feb 20 02:15:53 2017 MANAGEMENT: CMD 'signal SIGHUP'
Mon Feb 20 02:15:55 2017 C:\Windows\system32\route.exe DELETE 10.8.0.0 MASK 255.255.255.0 10.8.0.2
Mon Feb 20 02:15:55 2017 Route deletion via IPAPI succeeded [adaptive]
Mon Feb 20 02:15:55 2017 Closing TUN/TAP interface
Mon Feb 20 02:15:55 2017 SIGHUP[hard,] received, process restarting
Mon Feb 20 02:15:55 2017 MANAGEMENT: >STATE:1487549755,RECONNECTING,SIGHUP,,,,,
Mon Feb 20 02:15:55 2017 us=367696 Current Parameter Settings:
Mon Feb 20 02:15:55 2017 us=367696   config = 'server.ovpn'
Mon Feb 20 02:15:55 2017 us=367696   mode = 1
Mon Feb 20 02:15:55 2017 us=367696   show_ciphers = DISABLED
Mon Feb 20 02:15:55 2017 us=367696   show_digests = DISABLED
Mon Feb 20 02:15:55 2017 us=368697   show_engines = DISABLED
Mon Feb 20 02:15:55 2017 us=368697   genkey = DISABLED
Mon Feb 20 02:15:55 2017 us=368697   key_pass_file = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=368697   show_tls_ciphers = DISABLED
Mon Feb 20 02:15:55 2017 us=368697   connect_retry_max = 0
Mon Feb 20 02:15:55 2017 us=368697 Connection profiles [0]:
Mon Feb 20 02:15:55 2017 us=368697   proto = udp
Mon Feb 20 02:15:55 2017 us=368697   local = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=368697   local_port = '1194'
Mon Feb 20 02:15:55 2017 us=368697   remote = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=368697   remote_port = '1194'
Mon Feb 20 02:15:55 2017 us=368697   remote_float = DISABLED
Mon Feb 20 02:15:55 2017 us=368697   bind_defined = DISABLED
Mon Feb 20 02:15:55 2017 us=368697   bind_local = ENABLED
Mon Feb 20 02:15:55 2017 us=369698   bind_ipv6_only = DISABLED
Mon Feb 20 02:15:55 2017 us=369698   connect_retry_seconds = 5
Mon Feb 20 02:15:55 2017 us=369698   connect_timeout = 120
Mon Feb 20 02:15:55 2017 us=369698   socks_proxy_server = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=369698   socks_proxy_port = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=369698   tun_mtu = 1500
Mon Feb 20 02:15:55 2017 us=369698   tun_mtu_defined = ENABLED
Mon Feb 20 02:15:55 2017 us=369698   link_mtu = 1500
Mon Feb 20 02:15:55 2017 us=369698   link_mtu_defined = DISABLED
Mon Feb 20 02:15:55 2017 us=369698   tun_mtu_extra = 0
Mon Feb 20 02:15:55 2017 us=369698   tun_mtu_extra_defined = DISABLED
Mon Feb 20 02:15:55 2017 us=369698   mtu_discover_type = -1
Mon Feb 20 02:15:55 2017 us=369698   fragment = 0
Mon Feb 20 02:15:55 2017 us=369698   mssfix = 1450
Mon Feb 20 02:15:55 2017 us=370699   explicit_exit_notification = 1
Mon Feb 20 02:15:55 2017 us=370699 Connection profiles END
Mon Feb 20 02:15:55 2017 us=370699   remote_random = DISABLED
Mon Feb 20 02:15:55 2017 us=370699   ipchange = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=370699   dev = 'tun'
Mon Feb 20 02:15:55 2017 us=370699   dev_type = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=370699   dev_node = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=370699   lladdr = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=371699   topology = 1
Mon Feb 20 02:15:55 2017 us=371699   ifconfig_local = '10.8.0.1'
Mon Feb 20 02:15:55 2017 us=371699   ifconfig_remote_netmask = '10.8.0.2'
Mon Feb 20 02:15:55 2017 us=371699   ifconfig_noexec = DISABLED
Mon Feb 20 02:15:55 2017 us=371699   ifconfig_nowarn = DISABLED
Mon Feb 20 02:15:55 2017 us=371699   ifconfig_ipv6_local = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=371699   ifconfig_ipv6_netbits = 0
Mon Feb 20 02:15:55 2017 us=372699   ifconfig_ipv6_remote = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=372699   shaper = 0
Mon Feb 20 02:15:55 2017 us=372699   mtu_test = 0
Mon Feb 20 02:15:55 2017 us=372699   mlock = DISABLED
Mon Feb 20 02:15:55 2017 us=372699   keepalive_ping = 10
Mon Feb 20 02:15:55 2017 us=372699   keepalive_timeout = 120
Mon Feb 20 02:15:55 2017 us=373700   inactivity_timeout = 0
Mon Feb 20 02:15:55 2017 us=373700   ping_send_timeout = 10
Mon Feb 20 02:15:55 2017 us=373700   ping_rec_timeout = 240
Mon Feb 20 02:15:55 2017 us=373700   ping_rec_timeout_action = 2
Mon Feb 20 02:15:55 2017 us=373700   ping_timer_remote = DISABLED
Mon Feb 20 02:15:55 2017 us=373700   remap_sigusr1 = 0
Mon Feb 20 02:15:55 2017 us=373700   persist_tun = ENABLED
Mon Feb 20 02:15:55 2017 us=373700   persist_local_ip = DISABLED
Mon Feb 20 02:15:55 2017 us=373700   persist_remote_ip = DISABLED
Mon Feb 20 02:15:55 2017 us=373700   persist_key = ENABLED
Mon Feb 20 02:15:55 2017 us=373700   passtos = DISABLED
Mon Feb 20 02:15:55 2017 us=373700   resolve_retry_seconds = 1000000000
Mon Feb 20 02:15:55 2017 us=373700   resolve_in_advance = DISABLED
Mon Feb 20 02:15:55 2017 us=373700   username = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=373700   groupname = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=373700   chroot_dir = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=373700   cd_dir = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=374701   writepid = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=374701   up_script = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=374701   down_script = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=374701   down_pre = DISABLED
Mon Feb 20 02:15:55 2017 us=374701   up_restart = DISABLED
Mon Feb 20 02:15:55 2017 us=374701   up_delay = DISABLED
Mon Feb 20 02:15:55 2017 us=374701   daemon = DISABLED
Mon Feb 20 02:15:55 2017 us=374701   inetd = 0
Mon Feb 20 02:15:55 2017 us=374701   log = ENABLED
Mon Feb 20 02:15:55 2017 us=374701   suppress_timestamps = DISABLED
Mon Feb 20 02:15:55 2017 us=374701   machine_readable_output = DISABLED
Mon Feb 20 02:15:55 2017 us=375702   nice = 0
Mon Feb 20 02:15:55 2017 us=375702   verbosity = 4
Mon Feb 20 02:15:55 2017 us=375702   mute = 0
Mon Feb 20 02:15:55 2017 us=375702   gremlin = 0
Mon Feb 20 02:15:55 2017 us=375702   status_file = 'C:\OpenVPN\log\openvpn-status.log'
Mon Feb 20 02:15:55 2017 us=375702   status_file_version = 1
Mon Feb 20 02:15:55 2017 us=375702   status_file_update_freq = 60
Mon Feb 20 02:15:55 2017 us=375702   occ = ENABLED
Mon Feb 20 02:15:55 2017 us=375702   rcvbuf = 0
Mon Feb 20 02:15:55 2017 us=375702   sndbuf = 0
Mon Feb 20 02:15:55 2017 us=375702   sockflags = 0
Mon Feb 20 02:15:55 2017 us=375702   fast_io = DISABLED
Mon Feb 20 02:15:55 2017 us=375702   comp.alg = 0
Mon Feb 20 02:15:55 2017 us=375702   comp.flags = 0
Mon Feb 20 02:15:55 2017 us=375702   route_script = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=376703   route_default_gateway = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=376703   route_default_metric = 0
Mon Feb 20 02:15:55 2017 us=376703   route_noexec = DISABLED
Mon Feb 20 02:15:55 2017 us=376703   route_delay = 0
Mon Feb 20 02:15:55 2017 us=376703   route_delay_window = 30
Mon Feb 20 02:15:55 2017 us=376703   route_delay_defined = DISABLED
Mon Feb 20 02:15:55 2017 us=376703   route_nopull = DISABLED
Mon Feb 20 02:15:55 2017 us=376703   route_gateway_via_dhcp = DISABLED
Mon Feb 20 02:15:55 2017 us=376703   allow_pull_fqdn = DISABLED
Mon Feb 20 02:15:55 2017 us=376703   route 10.8.0.0/255.255.255.0/default (not set)/default (not set)
Mon Feb 20 02:15:55 2017 us=376703   management_addr = '127.0.0.1'
Mon Feb 20 02:15:55 2017 us=376703   management_port = '25340'
Mon Feb 20 02:15:55 2017 us=376703   management_user_pass = 'stdin'
Mon Feb 20 02:15:55 2017 us=377705   management_log_history_cache = 250
Mon Feb 20 02:15:55 2017 us=377705   management_echo_buffer_size = 100
Mon Feb 20 02:15:55 2017 us=377705   management_write_peer_info_file = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=377705   management_client_user = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=377705   management_client_group = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=377705   management_flags = 6
Mon Feb 20 02:15:55 2017 us=378704   shared_secret_file = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=378704   key_direction = 1
Mon Feb 20 02:15:55 2017 us=378704   ciphername = 'AES-256-CBC'
Mon Feb 20 02:15:55 2017 us=378704   ncp_enabled = ENABLED
Mon Feb 20 02:15:55 2017 us=378704   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
Mon Feb 20 02:15:55 2017 us=378704   authname = 'SHA1'
Mon Feb 20 02:15:55 2017 us=378704   prng_hash = 'SHA1'
Mon Feb 20 02:15:55 2017 us=378704   prng_nonce_secret_len = 16
Mon Feb 20 02:15:55 2017 us=378704   keysize = 0
Mon Feb 20 02:15:55 2017 us=378704   engine = DISABLED
Mon Feb 20 02:15:55 2017 us=378704   replay = ENABLED
Mon Feb 20 02:15:55 2017 us=378704   mute_replay_warnings = DISABLED
Mon Feb 20 02:15:55 2017 us=378704   replay_window = 64
Mon Feb 20 02:15:55 2017 us=378704   replay_time = 15
Mon Feb 20 02:15:55 2017 us=379704   packet_id_file = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=379704   use_iv = ENABLED
Mon Feb 20 02:15:55 2017 us=379704   test_crypto = DISABLED
Mon Feb 20 02:15:55 2017 us=379704   tls_server = ENABLED
Mon Feb 20 02:15:55 2017 us=379704   tls_client = DISABLED
Mon Feb 20 02:15:55 2017 us=379704   key_method = 2
Mon Feb 20 02:15:55 2017 us=379704   ca_file = 'C:\OpenVPN\config\ca.crt'
Mon Feb 20 02:15:55 2017 us=379704   ca_path = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=379704   dh_file = 'C:\OpenVPN\config\dh2048.pem'
Mon Feb 20 02:15:55 2017 us=379704   cert_file = 'C:\OpenVPN\config\server.crt'
Mon Feb 20 02:15:55 2017 us=379704   extra_certs_file = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=379704   priv_key_file = 'C:\OpenVPN\config\server.key'
Mon Feb 20 02:15:55 2017 us=379704   pkcs12_file = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=380705   cryptoapi_cert = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=380705   cipher_list = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=380705   tls_verify = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=380705   tls_export_cert = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=380705   verify_x509_type = 0
Mon Feb 20 02:15:55 2017 us=380705   verify_x509_name = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=380705   crl_file = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=380705   ns_cert_type = 0
Mon Feb 20 02:15:55 2017 us=380705   remote_cert_ku[i] = 0
Mon Feb 20 02:15:55 2017 us=380705   remote_cert_ku[i] = 0
Mon Feb 20 02:15:55 2017 us=380705   remote_cert_ku[i] = 0
Mon Feb 20 02:15:55 2017 us=380705   remote_cert_ku[i] = 0
Mon Feb 20 02:15:55 2017 us=380705   remote_cert_ku[i] = 0
Mon Feb 20 02:15:55 2017 us=381706   remote_cert_ku[i] = 0
Mon Feb 20 02:15:55 2017 us=381706   remote_cert_ku[i] = 0
Mon Feb 20 02:15:55 2017 us=381706   remote_cert_ku[i] = 0
Mon Feb 20 02:15:55 2017 us=381706   remote_cert_ku[i] = 0
Mon Feb 20 02:15:55 2017 us=381706   remote_cert_ku[i] = 0
Mon Feb 20 02:15:55 2017 us=382706   remote_cert_ku[i] = 0
Mon Feb 20 02:15:55 2017 us=382706   remote_cert_ku[i] = 0
Mon Feb 20 02:15:55 2017 us=382706   remote_cert_ku[i] = 0
Mon Feb 20 02:15:55 2017 us=382706   remote_cert_ku[i] = 0
Mon Feb 20 02:15:55 2017 us=382706   remote_cert_ku[i] = 0
Mon Feb 20 02:15:55 2017 us=382706   remote_cert_ku[i] = 0
Mon Feb 20 02:15:55 2017 us=382706   remote_cert_eku = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=382706   ssl_flags = 0
Mon Feb 20 02:15:55 2017 us=382706   tls_timeout = 2
Mon Feb 20 02:15:55 2017 us=382706   renegotiate_bytes = -1
Mon Feb 20 02:15:55 2017 us=382706   renegotiate_packets = 0
Mon Feb 20 02:15:55 2017 us=382706   renegotiate_seconds = 3600
Mon Feb 20 02:15:55 2017 us=382706   handshake_window = 60
Mon Feb 20 02:15:55 2017 us=383712   transition_window = 3600
Mon Feb 20 02:15:55 2017 us=383712   single_session = DISABLED
Mon Feb 20 02:15:55 2017 us=383712   push_peer_info = DISABLED
Mon Feb 20 02:15:55 2017 us=383712   tls_exit = DISABLED
Mon Feb 20 02:15:55 2017 us=383712   tls_auth_file = 'C:\OpenVPN\config\ta.key'
Mon Feb 20 02:15:55 2017 us=383712   tls_crypt_file = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=383712   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:15:55 2017 us=383712   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:15:55 2017 us=383712   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:15:55 2017 us=383712   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:15:55 2017 us=383712   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:15:55 2017 us=384707   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:15:55 2017 us=384707   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:15:55 2017 us=384707   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:15:55 2017 us=384707   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:15:55 2017 us=384707   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:15:55 2017 us=384707   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:15:55 2017 us=384707   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:15:55 2017 us=384707   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:15:55 2017 us=384707   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:15:55 2017 us=384707   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:15:55 2017 us=384707   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:15:55 2017 us=384707   pkcs11_private_mode = 00000000
Mon Feb 20 02:15:55 2017 us=384707   pkcs11_private_mode = 00000000
Mon Feb 20 02:15:55 2017 us=384707   pkcs11_private_mode = 00000000
Mon Feb 20 02:15:55 2017 us=384707   pkcs11_private_mode = 00000000
Mon Feb 20 02:15:55 2017 us=384707   pkcs11_private_mode = 00000000
Mon Feb 20 02:15:55 2017 us=385708   pkcs11_private_mode = 00000000
Mon Feb 20 02:15:55 2017 us=385708   pkcs11_private_mode = 00000000
Mon Feb 20 02:15:55 2017 us=385708   pkcs11_private_mode = 00000000
Mon Feb 20 02:15:55 2017 us=385708   pkcs11_private_mode = 00000000
Mon Feb 20 02:15:55 2017 us=385708   pkcs11_private_mode = 00000000
Mon Feb 20 02:15:55 2017 us=386709   pkcs11_private_mode = 00000000
Mon Feb 20 02:15:55 2017 us=386709   pkcs11_private_mode = 00000000
Mon Feb 20 02:15:55 2017 us=386709   pkcs11_private_mode = 00000000
Mon Feb 20 02:15:55 2017 us=386709   pkcs11_private_mode = 00000000
Mon Feb 20 02:15:55 2017 us=386709   pkcs11_private_mode = 00000000
Mon Feb 20 02:15:55 2017 us=386709   pkcs11_private_mode = 00000000
Mon Feb 20 02:15:55 2017 us=386709   pkcs11_cert_private = DISABLED
Mon Feb 20 02:15:55 2017 us=386709   pkcs11_cert_private = DISABLED
Mon Feb 20 02:15:55 2017 us=386709   pkcs11_cert_private = DISABLED
Mon Feb 20 02:15:55 2017 us=386709   pkcs11_cert_private = DISABLED
Mon Feb 20 02:15:55 2017 us=386709   pkcs11_cert_private = DISABLED
Mon Feb 20 02:15:55 2017 us=386709   pkcs11_cert_private = DISABLED
Mon Feb 20 02:15:55 2017 us=386709   pkcs11_cert_private = DISABLED
Mon Feb 20 02:15:55 2017 us=386709   pkcs11_cert_private = DISABLED
Mon Feb 20 02:15:55 2017 us=386709   pkcs11_cert_private = DISABLED
Mon Feb 20 02:15:55 2017 us=386709   pkcs11_cert_private = DISABLED
Mon Feb 20 02:15:55 2017 us=386709   pkcs11_cert_private = DISABLED
Mon Feb 20 02:15:55 2017 us=386709   pkcs11_cert_private = DISABLED
Mon Feb 20 02:15:55 2017 us=387709   pkcs11_cert_private = DISABLED
Mon Feb 20 02:15:55 2017 us=387709   pkcs11_cert_private = DISABLED
Mon Feb 20 02:15:55 2017 us=387709   pkcs11_cert_private = DISABLED
Mon Feb 20 02:15:55 2017 us=387709   pkcs11_cert_private = DISABLED
Mon Feb 20 02:15:55 2017 us=387709   pkcs11_pin_cache_period = -1
Mon Feb 20 02:15:55 2017 us=387709   pkcs11_id = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=387709   pkcs11_id_management = DISABLED
Mon Feb 20 02:15:55 2017 us=387709   server_network = 10.8.0.0
Mon Feb 20 02:15:55 2017 us=387709   server_netmask = 255.255.255.0
Mon Feb 20 02:15:55 2017 us=388710   server_network_ipv6 = ::
Mon Feb 20 02:15:55 2017 us=388710   server_netbits_ipv6 = 0
Mon Feb 20 02:15:55 2017 us=388710   server_bridge_ip = 0.0.0.0
Mon Feb 20 02:15:55 2017 us=388710   server_bridge_netmask = 0.0.0.0
Mon Feb 20 02:15:55 2017 us=388710   server_bridge_pool_start = 0.0.0.0
Mon Feb 20 02:15:55 2017 us=389711   server_bridge_pool_end = 0.0.0.0
Mon Feb 20 02:15:55 2017 us=389711   push_entry = 'route 10.8.0.1'
Mon Feb 20 02:15:55 2017 us=389711   push_entry = 'topology net30'
Mon Feb 20 02:15:55 2017 us=389711   push_entry = 'ping 10'
Mon Feb 20 02:15:55 2017 us=389711   push_entry = 'ping-restart 120'
Mon Feb 20 02:15:55 2017 us=389711   ifconfig_pool_defined = ENABLED
Mon Feb 20 02:15:55 2017 us=390712   ifconfig_pool_start = 10.8.0.4
Mon Feb 20 02:15:55 2017 us=390712   ifconfig_pool_end = 10.8.0.251
Mon Feb 20 02:15:55 2017 us=390712   ifconfig_pool_netmask = 0.0.0.0
Mon Feb 20 02:15:55 2017 us=390712   ifconfig_pool_persist_filename = 'C:\OpenVPN\config\ipp.txt'
Mon Feb 20 02:15:55 2017 us=390712   ifconfig_pool_persist_refresh_freq = 600
Mon Feb 20 02:15:55 2017 us=391714   ifconfig_ipv6_pool_defined = DISABLED
Mon Feb 20 02:15:55 2017 us=391714   ifconfig_ipv6_pool_base = ::
Mon Feb 20 02:15:55 2017 us=391714   ifconfig_ipv6_pool_netbits = 0
Mon Feb 20 02:15:55 2017 us=391714   n_bcast_buf = 256
Mon Feb 20 02:15:55 2017 us=391714   tcp_queue_limit = 64
Mon Feb 20 02:15:55 2017 us=391714   real_hash_size = 256
Mon Feb 20 02:15:55 2017 us=391714   virtual_hash_size = 256
Mon Feb 20 02:15:55 2017 us=391714   client_connect_script = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=391714   learn_address_script = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=391714   client_disconnect_script = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=392713   client_config_dir = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=392713   ccd_exclusive = DISABLED
Mon Feb 20 02:15:55 2017 us=392713   tmp_dir = 'C:\Users\ADMINI~1\AppData\Local\Temp\'
Mon Feb 20 02:15:55 2017 us=392713   push_ifconfig_defined = DISABLED
Mon Feb 20 02:15:55 2017 us=392713   push_ifconfig_local = 0.0.0.0
Mon Feb 20 02:15:55 2017 us=393714   push_ifconfig_remote_netmask = 0.0.0.0
Mon Feb 20 02:15:55 2017 us=393714   push_ifconfig_ipv6_defined = DISABLED
Mon Feb 20 02:15:55 2017 us=393714   push_ifconfig_ipv6_local = ::/0
Mon Feb 20 02:15:55 2017 us=393714   push_ifconfig_ipv6_remote = ::
Mon Feb 20 02:15:55 2017 us=393714   enable_c2c = DISABLED
Mon Feb 20 02:15:55 2017 us=394714   duplicate_cn = DISABLED
Mon Feb 20 02:15:55 2017 us=394714   cf_max = 0
Mon Feb 20 02:15:55 2017 us=394714   cf_per = 0
Mon Feb 20 02:15:55 2017 us=394714   max_clients = 1024
Mon Feb 20 02:15:55 2017 us=394714   max_routes_per_client = 256
Mon Feb 20 02:15:55 2017 us=394714   auth_user_pass_verify_script = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=394714   auth_user_pass_verify_script_via_file = DISABLED
Mon Feb 20 02:15:55 2017 us=394714   auth_token_generate = DISABLED
Mon Feb 20 02:15:55 2017 us=394714   auth_token_lifetime = 0
Mon Feb 20 02:15:55 2017 us=394714   client = DISABLED
Mon Feb 20 02:15:55 2017 us=395715   pull = DISABLED
Mon Feb 20 02:15:55 2017 us=395715   auth_user_pass_file = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=395715   show_net_up = DISABLED
Mon Feb 20 02:15:55 2017 us=395715   route_method = 0
Mon Feb 20 02:15:55 2017 us=395715   block_outside_dns = DISABLED
Mon Feb 20 02:15:55 2017 us=395715   ip_win32_defined = DISABLED
Mon Feb 20 02:15:55 2017 us=395715   ip_win32_type = 3
Mon Feb 20 02:15:55 2017 us=395715   dhcp_masq_offset = 0
Mon Feb 20 02:15:55 2017 us=396716   dhcp_lease_time = 31536000
Mon Feb 20 02:15:55 2017 us=396716   tap_sleep = 10
Mon Feb 20 02:15:55 2017 us=396716   dhcp_options = DISABLED
Mon Feb 20 02:15:55 2017 us=396716   dhcp_renew = DISABLED
Mon Feb 20 02:15:55 2017 us=396716   dhcp_pre_release = DISABLED
Mon Feb 20 02:15:55 2017 us=396716   dhcp_release = DISABLED
Mon Feb 20 02:15:55 2017 us=396716   domain = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=396716   netbios_scope = '[UNDEF]'
Mon Feb 20 02:15:55 2017 us=396716   netbios_node_type = 0
Mon Feb 20 02:15:55 2017 us=396716   disable_nbt = DISABLED
Mon Feb 20 02:15:55 2017 us=397717 OpenVPN 2.4.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Jan 31 2017
Mon Feb 20 02:15:55 2017 us=397717 Windows version 6.2 (Windows 8 or greater) 64bit
Mon Feb 20 02:15:55 2017 us=397717 library versions: OpenSSL 1.0.2k  26 Jan 2017, LZO 2.09
Mon Feb 20 02:15:55 2017 us=397717 Restart pause, 5 second(s)
Mon Feb 20 02:16:00 2017 us=400914 Diffie-Hellman initialized with 2048 bit key
Mon Feb 20 02:16:00 2017 us=404917 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb 20 02:16:00 2017 us=404917 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb 20 02:16:00 2017 us=404917 TLS-Auth MTU parms [ L:1621 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Mon Feb 20 02:16:00 2017 us=405917 interactive service msg_channel=0
Mon Feb 20 02:16:00 2017 us=407919 ROUTE_GATEWAY 192.168.100.1/255.255.255.0 I=8 HWADDR=18:03:73:27:52:63
Mon Feb 20 02:16:00 2017 us=407919 open_tun
Mon Feb 20 02:16:00 2017 us=408919 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{2989F87F-BAAC-4EEC-86C1-10B754BA3FD3}.tap
Mon Feb 20 02:16:00 2017 us=408919 TAP-Windows Driver Version 9.21 
Mon Feb 20 02:16:00 2017 us=408919 TAP-Windows MTU=1500
Mon Feb 20 02:16:00 2017 us=410921 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.1/255.255.255.252 on interface {2989F87F-BAAC-4EEC-86C1-10B754BA3FD3} [DHCP-serv: 10.8.0.2, lease-time: 31536000]
Mon Feb 20 02:16:00 2017 us=410921 Sleeping for 10 seconds...
Mon Feb 20 02:16:10 2017 us=411137 Successful ARP Flush on interface [2] {2989F87F-BAAC-4EEC-86C1-10B754BA3FD3}
Mon Feb 20 02:16:10 2017 us=413146 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Mon Feb 20 02:16:10 2017 us=413146 MANAGEMENT: >STATE:1487549770,ASSIGN_IP,,10.8.0.1,,,,
Mon Feb 20 02:16:10 2017 us=413146 MANAGEMENT: >STATE:1487549770,ADD_ROUTES,,,,,,
Mon Feb 20 02:16:10 2017 us=413146 C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.2
Mon Feb 20 02:16:10 2017 us=415145 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=35 and dwForwardType=4
Mon Feb 20 02:16:10 2017 us=415145 Route addition via IPAPI succeeded [adaptive]
Mon Feb 20 02:16:10 2017 us=415145 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
Mon Feb 20 02:16:10 2017 us=415145 Could not determine IPv4/IPv6 protocol. Using AF_INET6
Mon Feb 20 02:16:10 2017 us=415145 Socket Buffers: R=[65536->65536] S=[65536->65536]
Mon Feb 20 02:16:10 2017 us=415145 setsockopt(IPV6_V6ONLY=0)
Mon Feb 20 02:16:10 2017 us=416147 UDPv6 link local (bound): [AF_INET6][undef]:1194
Mon Feb 20 02:16:10 2017 us=416147 UDPv6 link remote: [AF_UNSPEC]
Mon Feb 20 02:16:10 2017 us=416147 MULTI: multi_init called, r=256 v=256
Mon Feb 20 02:16:10 2017 us=416147 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Mon Feb 20 02:16:10 2017 us=416147 IFCONFIG POOL LIST
Mon Feb 20 02:16:10 2017 us=416147 Initialization Sequence Completed
Mon Feb 20 02:16:10 2017 us=416147 MANAGEMENT: >STATE:1487549770,CONNECTED,SUCCESS,10.8.0.1,,,,

Config file of the client:

Code: Select all

client
dev tun
proto udp
remote 195.96.252.188 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /home/bontchev/.openvpn/nlcv-ca.crt
cert /home/bontchev/.openvpn/bontchev-pc.crt
key /home/bontchev/.openvpn/bontchev-pc.key
remote-cert-tls server
tls-auth /home/bontchev/.openvpn/ta.key 1
cipher AES-256-CBC
verb 4

Log "file" of the client when trying to connect:

Code: Select all

Mon Feb 20 02:19:20 2017 us=985158 Current Parameter Settings:
Mon Feb 20 02:19:20 2017 us=985243   config = '/home/bontchev/Work/bontchev-pc.ovpn'
Mon Feb 20 02:19:20 2017 us=985261   mode = 0
Mon Feb 20 02:19:20 2017 us=985275   persist_config = DISABLED
Mon Feb 20 02:19:20 2017 us=985288   persist_mode = 1
Mon Feb 20 02:19:20 2017 us=985300   show_ciphers = DISABLED
Mon Feb 20 02:19:20 2017 us=985312   show_digests = DISABLED
Mon Feb 20 02:19:20 2017 us=985325   show_engines = DISABLED
Mon Feb 20 02:19:20 2017 us=985337   genkey = DISABLED
Mon Feb 20 02:19:20 2017 us=985349   key_pass_file = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=985361   show_tls_ciphers = DISABLED
Mon Feb 20 02:19:20 2017 us=985373 Connection profiles [default]:
Mon Feb 20 02:19:20 2017 us=985386   proto = udp
Mon Feb 20 02:19:20 2017 us=985398   local = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=985411   local_port = 0
Mon Feb 20 02:19:20 2017 us=985432   remote = '195.96.252.188'
Mon Feb 20 02:19:20 2017 us=985443   remote_port = 1194
Mon Feb 20 02:19:20 2017 us=985454   remote_float = DISABLED
Mon Feb 20 02:19:20 2017 us=985465   bind_defined = DISABLED
Mon Feb 20 02:19:20 2017 us=985475   bind_local = DISABLED
Mon Feb 20 02:19:20 2017 us=985486   connect_retry_seconds = 5
Mon Feb 20 02:19:20 2017 us=985496   connect_timeout = 10
Mon Feb 20 02:19:20 2017 us=985507   connect_retry_max = 0
Mon Feb 20 02:19:20 2017 us=985518   socks_proxy_server = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=985528   socks_proxy_port = 0
Mon Feb 20 02:19:20 2017 us=985539   socks_proxy_retry = DISABLED
Mon Feb 20 02:19:20 2017 us=985550   tun_mtu = 1500
Mon Feb 20 02:19:20 2017 us=985560   tun_mtu_defined = ENABLED
Mon Feb 20 02:19:20 2017 us=985571   link_mtu = 1500
Mon Feb 20 02:19:20 2017 us=985581   link_mtu_defined = DISABLED
Mon Feb 20 02:19:20 2017 us=985603   tun_mtu_extra = 0
Mon Feb 20 02:19:20 2017 us=985637   tun_mtu_extra_defined = DISABLED
Mon Feb 20 02:19:20 2017 us=985717   mtu_discover_type = -1
Mon Feb 20 02:19:20 2017 us=985731   fragment = 0
Mon Feb 20 02:19:20 2017 us=985741   mssfix = 1450
Mon Feb 20 02:19:20 2017 us=985752   explicit_exit_notification = 0
Mon Feb 20 02:19:20 2017 us=985762 Connection profiles END
Mon Feb 20 02:19:20 2017 us=985773   remote_random = DISABLED
Mon Feb 20 02:19:20 2017 us=985783   ipchange = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=985794   dev = 'tun'
Mon Feb 20 02:19:20 2017 us=985804   dev_type = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=985815   dev_node = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=985825   lladdr = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=985836   topology = 1
Mon Feb 20 02:19:20 2017 us=985846   tun_ipv6 = DISABLED
Mon Feb 20 02:19:20 2017 us=985857   ifconfig_local = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=985867   ifconfig_remote_netmask = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=985878   ifconfig_noexec = DISABLED
Mon Feb 20 02:19:20 2017 us=985889   ifconfig_nowarn = DISABLED
Mon Feb 20 02:19:20 2017 us=985899   ifconfig_ipv6_local = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=985910   ifconfig_ipv6_netbits = 0
Mon Feb 20 02:19:20 2017 us=985920   ifconfig_ipv6_remote = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=985931   shaper = 0
Mon Feb 20 02:19:20 2017 us=985941   mtu_test = 0
Mon Feb 20 02:19:20 2017 us=985951   mlock = DISABLED
Mon Feb 20 02:19:20 2017 us=985962   keepalive_ping = 0
Mon Feb 20 02:19:20 2017 us=985972   keepalive_timeout = 0
Mon Feb 20 02:19:20 2017 us=985983   inactivity_timeout = 0
Mon Feb 20 02:19:20 2017 us=985993   ping_send_timeout = 0
Mon Feb 20 02:19:20 2017 us=986004   ping_rec_timeout = 0
Mon Feb 20 02:19:20 2017 us=986014   ping_rec_timeout_action = 0
Mon Feb 20 02:19:20 2017 us=986025   ping_timer_remote = DISABLED
Mon Feb 20 02:19:20 2017 us=986036   remap_sigusr1 = 0
Mon Feb 20 02:19:20 2017 us=986046   persist_tun = ENABLED
Mon Feb 20 02:19:20 2017 us=986057   persist_local_ip = DISABLED
Mon Feb 20 02:19:20 2017 us=986067   persist_remote_ip = DISABLED
Mon Feb 20 02:19:20 2017 us=986116   persist_key = ENABLED
Mon Feb 20 02:19:20 2017 us=986131   passtos = DISABLED
Mon Feb 20 02:19:20 2017 us=986143   resolve_retry_seconds = 1000000000
Mon Feb 20 02:19:20 2017 us=986154   username = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986166   groupname = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986177   chroot_dir = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986189   cd_dir = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986200   writepid = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986211   up_script = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986223   down_script = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986235   down_pre = DISABLED
Mon Feb 20 02:19:20 2017 us=986246   up_restart = DISABLED
Mon Feb 20 02:19:20 2017 us=986257   up_delay = DISABLED
Mon Feb 20 02:19:20 2017 us=986269   daemon = DISABLED
Mon Feb 20 02:19:20 2017 us=986280   inetd = 0
Mon Feb 20 02:19:20 2017 us=986291   log = DISABLED
Mon Feb 20 02:19:20 2017 us=986303   suppress_timestamps = DISABLED
Mon Feb 20 02:19:20 2017 us=986314   nice = 0
Mon Feb 20 02:19:20 2017 us=986326   verbosity = 4
Mon Feb 20 02:19:20 2017 us=986337   mute = 0
Mon Feb 20 02:19:20 2017 us=986357   gremlin = 0
Mon Feb 20 02:19:20 2017 us=986367   status_file = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986378   status_file_version = 1
Mon Feb 20 02:19:20 2017 us=986388   status_file_update_freq = 60
Mon Feb 20 02:19:20 2017 us=986398   occ = ENABLED
Mon Feb 20 02:19:20 2017 us=986408   rcvbuf = 65536
Mon Feb 20 02:19:20 2017 us=986418   sndbuf = 65536
Mon Feb 20 02:19:20 2017 us=986428   mark = 0
Mon Feb 20 02:19:20 2017 us=986438   sockflags = 0
Mon Feb 20 02:19:20 2017 us=986449   fast_io = DISABLED
Mon Feb 20 02:19:20 2017 us=986459   lzo = 0
Mon Feb 20 02:19:20 2017 us=986469   route_script = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986479   route_default_gateway = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986489   route_default_metric = 0
Mon Feb 20 02:19:20 2017 us=986500   route_noexec = DISABLED
Mon Feb 20 02:19:20 2017 us=986510   route_delay = 0
Mon Feb 20 02:19:20 2017 us=986520   route_delay_window = 30
Mon Feb 20 02:19:20 2017 us=986530   route_delay_defined = DISABLED
Mon Feb 20 02:19:20 2017 us=986541   route_nopull = DISABLED
Mon Feb 20 02:19:20 2017 us=986552   route_gateway_via_dhcp = DISABLED
Mon Feb 20 02:19:20 2017 us=986562   max_routes = 100
Mon Feb 20 02:19:20 2017 us=986614   allow_pull_fqdn = DISABLED
Mon Feb 20 02:19:20 2017 us=986631   management_addr = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986637   management_port = 0
Mon Feb 20 02:19:20 2017 us=986644   management_user_pass = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986650   management_log_history_cache = 250
Mon Feb 20 02:19:20 2017 us=986657   management_echo_buffer_size = 100
Mon Feb 20 02:19:20 2017 us=986663   management_write_peer_info_file = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986670   management_client_user = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986677   management_client_group = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986683   management_flags = 0
Mon Feb 20 02:19:20 2017 us=986689   shared_secret_file = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986696   key_direction = 2
Mon Feb 20 02:19:20 2017 us=986703   ciphername_defined = ENABLED
Mon Feb 20 02:19:20 2017 us=986709   ciphername = 'AES-256-CBC'
Mon Feb 20 02:19:20 2017 us=986715   authname_defined = ENABLED
Mon Feb 20 02:19:20 2017 us=986722   authname = 'SHA1'
Mon Feb 20 02:19:20 2017 us=986728   prng_hash = 'SHA1'
Mon Feb 20 02:19:20 2017 us=986734   prng_nonce_secret_len = 16
Mon Feb 20 02:19:20 2017 us=986740   keysize = 0
Mon Feb 20 02:19:20 2017 us=986747   engine = DISABLED
Mon Feb 20 02:19:20 2017 us=986753   replay = ENABLED
Mon Feb 20 02:19:20 2017 us=986759   mute_replay_warnings = DISABLED
Mon Feb 20 02:19:20 2017 us=986766   replay_window = 64
Mon Feb 20 02:19:20 2017 us=986772   replay_time = 15
Mon Feb 20 02:19:20 2017 us=986778   packet_id_file = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986784   use_iv = ENABLED
Mon Feb 20 02:19:20 2017 us=986791   test_crypto = DISABLED
Mon Feb 20 02:19:20 2017 us=986797   tls_server = DISABLED
Mon Feb 20 02:19:20 2017 us=986804   tls_client = ENABLED
Mon Feb 20 02:19:20 2017 us=986810   key_method = 2
Mon Feb 20 02:19:20 2017 us=986817   ca_file = '/home/bontchev/.openvpn/nlcv-ca.crt'
Mon Feb 20 02:19:20 2017 us=986823   ca_path = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986829   dh_file = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986836   cert_file = '/home/bontchev/.openvpn/bontchev-pc.crt'
Mon Feb 20 02:19:20 2017 us=986842   priv_key_file = '/home/bontchev/.openvpn/bontchev-pc.key'
Mon Feb 20 02:19:20 2017 us=986849   pkcs12_file = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986855   cipher_list = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986862   tls_verify = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986868   tls_export_cert = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986874   verify_x509_type = 0
Mon Feb 20 02:19:20 2017 us=986881   verify_x509_name = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986887   crl_file = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=986893   ns_cert_type = 0
Mon Feb 20 02:19:20 2017 us=986900   remote_cert_ku[i] = 160
Mon Feb 20 02:19:20 2017 us=986906   remote_cert_ku[i] = 136
Mon Feb 20 02:19:20 2017 us=986912   remote_cert_ku[i] = 0
Mon Feb 20 02:19:20 2017 us=986919   remote_cert_ku[i] = 0
Mon Feb 20 02:19:20 2017 us=986925   remote_cert_ku[i] = 0
Mon Feb 20 02:19:20 2017 us=986931   remote_cert_ku[i] = 0
Mon Feb 20 02:19:20 2017 us=986937   remote_cert_ku[i] = 0
Mon Feb 20 02:19:20 2017 us=986943   remote_cert_ku[i] = 0
Mon Feb 20 02:19:20 2017 us=986949   remote_cert_ku[i] = 0
Mon Feb 20 02:19:20 2017 us=986955   remote_cert_ku[i] = 0
Mon Feb 20 02:19:20 2017 us=986962   remote_cert_ku[i] = 0
Mon Feb 20 02:19:20 2017 us=986968   remote_cert_ku[i] = 0
Mon Feb 20 02:19:20 2017 us=986974   remote_cert_ku[i] = 0
Mon Feb 20 02:19:20 2017 us=986980   remote_cert_ku[i] = 0
Mon Feb 20 02:19:20 2017 us=986986   remote_cert_ku[i] = 0
Mon Feb 20 02:19:20 2017 us=986992   remote_cert_ku[i] = 0
Mon Feb 20 02:19:20 2017 us=986999   remote_cert_eku = 'TLS Web Server Authentication'
Mon Feb 20 02:19:20 2017 us=987005   ssl_flags = 0
Mon Feb 20 02:19:20 2017 us=987012   tls_timeout = 2
Mon Feb 20 02:19:20 2017 us=987018   renegotiate_bytes = 0
Mon Feb 20 02:19:20 2017 us=987024   renegotiate_packets = 0
Mon Feb 20 02:19:20 2017 us=987031   renegotiate_seconds = 3600
Mon Feb 20 02:19:20 2017 us=987037   handshake_window = 60
Mon Feb 20 02:19:20 2017 us=987044   transition_window = 3600
Mon Feb 20 02:19:20 2017 us=987050   single_session = DISABLED
Mon Feb 20 02:19:20 2017 us=987056   push_peer_info = DISABLED
Mon Feb 20 02:19:20 2017 us=987062   tls_exit = DISABLED
Mon Feb 20 02:19:20 2017 us=987107   tls_auth_file = '/home/bontchev/.openvpn/ta.key'
Mon Feb 20 02:19:20 2017 us=987133   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:19:20 2017 us=987142   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:19:20 2017 us=987151   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:19:20 2017 us=987158   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:19:20 2017 us=987166   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:19:20 2017 us=987173   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:19:20 2017 us=987180   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:19:20 2017 us=987187   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:19:20 2017 us=987195   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:19:20 2017 us=987202   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:19:20 2017 us=987209   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:19:20 2017 us=987217   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:19:20 2017 us=987224   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:19:20 2017 us=987231   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:19:20 2017 us=987238   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:19:20 2017 us=987252   pkcs11_protected_authentication = DISABLED
Mon Feb 20 02:19:20 2017 us=987264   pkcs11_private_mode = 00000000
Mon Feb 20 02:19:20 2017 us=987271   pkcs11_private_mode = 00000000
Mon Feb 20 02:19:20 2017 us=987279   pkcs11_private_mode = 00000000
Mon Feb 20 02:19:20 2017 us=987286   pkcs11_private_mode = 00000000
Mon Feb 20 02:19:20 2017 us=987293   pkcs11_private_mode = 00000000
Mon Feb 20 02:19:20 2017 us=987300   pkcs11_private_mode = 00000000
Mon Feb 20 02:19:20 2017 us=987307   pkcs11_private_mode = 00000000
Mon Feb 20 02:19:20 2017 us=987314   pkcs11_private_mode = 00000000
Mon Feb 20 02:19:20 2017 us=987322   pkcs11_private_mode = 00000000
Mon Feb 20 02:19:20 2017 us=987329   pkcs11_private_mode = 00000000
Mon Feb 20 02:19:20 2017 us=987336   pkcs11_private_mode = 00000000
Mon Feb 20 02:19:20 2017 us=987343   pkcs11_private_mode = 00000000
Mon Feb 20 02:19:20 2017 us=987350   pkcs11_private_mode = 00000000
Mon Feb 20 02:19:20 2017 us=987357   pkcs11_private_mode = 00000000
Mon Feb 20 02:19:20 2017 us=987364   pkcs11_private_mode = 00000000
Mon Feb 20 02:19:20 2017 us=987371   pkcs11_private_mode = 00000000
Mon Feb 20 02:19:20 2017 us=987379   pkcs11_cert_private = DISABLED
Mon Feb 20 02:19:20 2017 us=987386   pkcs11_cert_private = DISABLED
Mon Feb 20 02:19:20 2017 us=987393   pkcs11_cert_private = DISABLED
Mon Feb 20 02:19:20 2017 us=987400   pkcs11_cert_private = DISABLED
Mon Feb 20 02:19:20 2017 us=987407   pkcs11_cert_private = DISABLED
Mon Feb 20 02:19:20 2017 us=987414   pkcs11_cert_private = DISABLED
Mon Feb 20 02:19:20 2017 us=987422   pkcs11_cert_private = DISABLED
Mon Feb 20 02:19:20 2017 us=987429   pkcs11_cert_private = DISABLED
Mon Feb 20 02:19:20 2017 us=987436   pkcs11_cert_private = DISABLED
Mon Feb 20 02:19:20 2017 us=987443   pkcs11_cert_private = DISABLED
Mon Feb 20 02:19:20 2017 us=987450   pkcs11_cert_private = DISABLED
Mon Feb 20 02:19:20 2017 us=987457   pkcs11_cert_private = DISABLED
Mon Feb 20 02:19:20 2017 us=987464   pkcs11_cert_private = DISABLED
Mon Feb 20 02:19:20 2017 us=987471   pkcs11_cert_private = DISABLED
Mon Feb 20 02:19:20 2017 us=987478   pkcs11_cert_private = DISABLED
Mon Feb 20 02:19:20 2017 us=987485   pkcs11_cert_private = DISABLED
Mon Feb 20 02:19:20 2017 us=987493   pkcs11_pin_cache_period = -1
Mon Feb 20 02:19:20 2017 us=987500   pkcs11_id = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=987507   pkcs11_id_management = DISABLED
Mon Feb 20 02:19:20 2017 us=987526   server_network = 0.0.0.0
Mon Feb 20 02:19:20 2017 us=987537   server_netmask = 0.0.0.0
Mon Feb 20 02:19:20 2017 us=987554   server_network_ipv6 = ::
Mon Feb 20 02:19:20 2017 us=987578   server_netbits_ipv6 = 0
Mon Feb 20 02:19:20 2017 us=987588   server_bridge_ip = 0.0.0.0
Mon Feb 20 02:19:20 2017 us=987596   server_bridge_netmask = 0.0.0.0
Mon Feb 20 02:19:20 2017 us=987604   server_bridge_pool_start = 0.0.0.0
Mon Feb 20 02:19:20 2017 us=987612   server_bridge_pool_end = 0.0.0.0
Mon Feb 20 02:19:20 2017 us=987620   ifconfig_pool_defined = DISABLED
Mon Feb 20 02:19:20 2017 us=987628   ifconfig_pool_start = 0.0.0.0
Mon Feb 20 02:19:20 2017 us=987640   ifconfig_pool_end = 0.0.0.0
Mon Feb 20 02:19:20 2017 us=987651   ifconfig_pool_netmask = 0.0.0.0
Mon Feb 20 02:19:20 2017 us=987658   ifconfig_pool_persist_filename = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=987666   ifconfig_pool_persist_refresh_freq = 600
Mon Feb 20 02:19:20 2017 us=987673   ifconfig_ipv6_pool_defined = DISABLED
Mon Feb 20 02:19:20 2017 us=987681   ifconfig_ipv6_pool_base = ::
Mon Feb 20 02:19:20 2017 us=987688   ifconfig_ipv6_pool_netbits = 0
Mon Feb 20 02:19:20 2017 us=987696   n_bcast_buf = 256
Mon Feb 20 02:19:20 2017 us=987703   tcp_queue_limit = 64
Mon Feb 20 02:19:20 2017 us=987710   real_hash_size = 256
Mon Feb 20 02:19:20 2017 us=987717   virtual_hash_size = 256
Mon Feb 20 02:19:20 2017 us=987724   client_connect_script = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=987732   learn_address_script = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=987739   client_disconnect_script = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=987746   client_config_dir = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=987753   ccd_exclusive = DISABLED
Mon Feb 20 02:19:20 2017 us=987761   tmp_dir = '/tmp'
Mon Feb 20 02:19:20 2017 us=987768   push_ifconfig_defined = DISABLED
Mon Feb 20 02:19:20 2017 us=987776   push_ifconfig_local = 0.0.0.0
Mon Feb 20 02:19:20 2017 us=987783   push_ifconfig_remote_netmask = 0.0.0.0
Mon Feb 20 02:19:20 2017 us=987791   push_ifconfig_ipv6_defined = DISABLED
Mon Feb 20 02:19:20 2017 us=987798   push_ifconfig_ipv6_local = ::/0
Mon Feb 20 02:19:20 2017 us=987807   push_ifconfig_ipv6_remote = ::
Mon Feb 20 02:19:20 2017 us=987814   enable_c2c = DISABLED
Mon Feb 20 02:19:20 2017 us=987821   duplicate_cn = DISABLED
Mon Feb 20 02:19:20 2017 us=987828   cf_max = 0
Mon Feb 20 02:19:20 2017 us=987835   cf_per = 0
Mon Feb 20 02:19:20 2017 us=987842   max_clients = 1024
Mon Feb 20 02:19:20 2017 us=987849   max_routes_per_client = 256
Mon Feb 20 02:19:20 2017 us=987857   auth_user_pass_verify_script = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=987864   auth_user_pass_verify_script_via_file = DISABLED
Mon Feb 20 02:19:20 2017 us=987871   port_share_host = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=987879   port_share_port = 0
Mon Feb 20 02:19:20 2017 us=987886   client = ENABLED
Mon Feb 20 02:19:20 2017 us=987893   pull = ENABLED
Mon Feb 20 02:19:20 2017 us=987900   auth_user_pass_file = '[UNDEF]'
Mon Feb 20 02:19:20 2017 us=987908 OpenVPN 2.3.2 i686-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec  1 2014
Mon Feb 20 02:19:20 2017 us=988644 Control Channel Authentication: using '/home/bontchev/.openvpn/ta.key' as a OpenVPN static key file
Mon Feb 20 02:19:20 2017 us=988663 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb 20 02:19:20 2017 us=988673 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb 20 02:19:20 2017 us=988755 Control Channel MTU parms [ L:1557 D:166 EF:66 EB:0 ET:0 EL:0 ]
Mon Feb 20 02:19:20 2017 us=988790 Socket Buffers: R=[163840->131072] S=[163840->131072]
Mon Feb 20 02:19:20 2017 us=988813 Data Channel MTU parms [ L:1557 D:1450 EF:57 EB:4 ET:0 EL:0 ]
Mon Feb 20 02:19:20 2017 us=988832 Local Options String: 'V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Mon Feb 20 02:19:20 2017 us=992387 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Mon Feb 20 02:19:20 2017 us=992437 Local Options hash (VER=V4): 'ed844052'
Mon Feb 20 02:19:20 2017 us=992467 Expected Remote Options hash (VER=V4): '8a244582'
Mon Feb 20 02:19:20 2017 us=992492 UDPv4 link local: [undef]
Mon Feb 20 02:19:20 2017 us=992521 UDPv4 link remote: [AF_INET]195.96.252.188:1194
Mon Feb 20 02:20:20 2017 us=691078 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Feb 20 02:20:20 2017 us=691124 TLS Error: TLS handshake failed
Mon Feb 20 02:20:20 2017 us=691204 TCP/UDP: Closing socket
Mon Feb 20 02:20:20 2017 us=691231 SIGUSR1[soft,tls-error] received, process restarting
Mon Feb 20 02:20:20 2017 us=691244 Restart pause, 2 second(s)
Mon Feb 20 02:20:22 2017 us=692546 Re-using SSL/TLS context
Mon Feb 20 02:20:22 2017 us=692677 Control Channel MTU parms [ L:1557 D:166 EF:66 EB:0 ET:0 EL:0 ]
Mon Feb 20 02:20:22 2017 us=692729 Socket Buffers: R=[163840->131072] S=[163840->131072]
Mon Feb 20 02:20:22 2017 us=692760 Data Channel MTU parms [ L:1557 D:1450 EF:57 EB:4 ET:0 EL:0 ]
Mon Feb 20 02:20:22 2017 us=692830 Local Options String: 'V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Mon Feb 20 02:20:22 2017 us=692856 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1557,tun-mtu 1500,proto UDPv4,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Mon Feb 20 02:20:22 2017 us=692891 Local Options hash (VER=V4): 'ed844052'
Mon Feb 20 02:20:22 2017 us=692921 Expected Remote Options hash (VER=V4): '8a244582'
Mon Feb 20 02:20:22 2017 us=692942 UDPv4 link local: [undef]
Mon Feb 20 02:20:22 2017 us=692964 UDPv4 link remote: [AF_INET]195.96.252.188:1194
^CMon Feb 20 02:20:32 2017 us=729095 event_wait : Interrupted system call (code=4)
Mon Feb 20 02:20:32 2017 us=729236 TCP/UDP: Closing socket
Mon Feb 20 02:20:32 2017 us=729265 SIGINT[hard,] received, process exiting

[TinCanTech]

the client cannot contact the VPN at all.

I guess you have setup your networking wrong ..

[bontchev]

"Wrong" in what way, please? I have opened UDP port 1194 in both directions on the server's firewall and the server's router. There is no LAN; the server is connected directly to the router and nothing else. I have turned off the server firewall for the TAP interface. Where else should I look? Do I need to do anything special about the client? Like open this port on its firewall and router? Anything else? And why does nmap show that the server at this IP is listening to this port but the client cannot connect to it?

Anything about my other questions? With all due respect, but "here is a huge list of how-tos" and "you must be doing something wrong" isn't exactly helpful...

[bontchev]

OK, I have partial success. I am now physically in the same room where the server is. I have rebooted its router and now the client connects - to a certain degree. Authentication is successful. However, another error occurs:

Code: Select all

Mon Feb 20 12:57:32 2017 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec  1 2014
Mon Feb 20 12:57:32 2017 WARNING: file '/home/bontchev/.openvpn/bontchev-pc.key' is group or others accessible
Mon Feb 20 12:57:32 2017 WARNING: file '/home/bontchev/.openvpn/ta.key' is group or others accessible
Mon Feb 20 12:57:32 2017 Control Channel Authentication: using '/home/bontchev/.openvpn/ta.key' as a OpenVPN static key file
Mon Feb 20 12:57:32 2017 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb 20 12:57:32 2017 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb 20 12:57:32 2017 Socket Buffers: R=[212992->131072] S=[212992->131072]
Mon Feb 20 12:57:32 2017 UDPv4 link local: [undef]
Mon Feb 20 12:57:32 2017 UDPv4 link remote: [AF_INET]195.96.252.188:1194
Mon Feb 20 12:57:32 2017 TLS: Initial packet from [AF_INET]195.96.252.188:1194, sid=0cf7c49c a521cbc3
Mon Feb 20 12:57:32 2017 VERIFY OK: depth=1, C=BG, L=Sofia, O=BAS, OU=NLCV, CN=Pandora, name=OpenVPN-CA, emailAddress=office@nlcv.bas.bg
Mon Feb 20 12:57:32 2017 Validating certificate key usage
Mon Feb 20 12:57:32 2017 ++ Certificate has key usage  00a0, expects 00a0
Mon Feb 20 12:57:32 2017 VERIFY KU OK
Mon Feb 20 12:57:32 2017 Validating certificate extended key usage
Mon Feb 20 12:57:32 2017 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Feb 20 12:57:32 2017 VERIFY EKU OK
Mon Feb 20 12:57:32 2017 VERIFY OK: depth=0, C=BG, L=Sofia, O=BAS, OU=NLCV, CN=server, name=Pandora, emailAddress=office@nlcv.bas.bg
Mon Feb 20 12:57:32 2017 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Feb 20 12:57:32 2017 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb 20 12:57:32 2017 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Feb 20 12:57:32 2017 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb 20 12:57:32 2017 Control Channel: TLSv1, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-SHA, 2048 bit RSA
Mon Feb 20 12:57:32 2017 [server] Peer Connection Initiated with [AF_INET]195.96.252.188:1194
Mon Feb 20 12:57:34 2017 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Feb 20 12:57:34 2017 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Mon Feb 20 12:57:34 2017 OPTIONS IMPORT: timers and/or timeouts modified
Mon Feb 20 12:57:34 2017 OPTIONS IMPORT: --ifconfig/up options modified
Mon Feb 20 12:57:34 2017 OPTIONS IMPORT: route options modified
Mon Feb 20 12:57:34 2017 ROUTE_GATEWAY 192.168.100.1/255.255.255.0 IFACE=wlan0 HWADDR=10:0b:a9:9f:de:f0
Mon Feb 20 12:57:34 2017 ERROR: Cannot ioctl TUNSETIFF tun: Operation not permitted (errno=1)
Mon Feb 20 12:57:34 2017 Exiting due to fatal error

Something seems to be wrong with the TAP/TUN interface? Any ideas what to do?

[TinCanTech]

You probably need to be root (sudo)

Also,

OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec 1 2014

Please update ..

[bontchev]

You probably need to be root (sudo)

Yeah. With sudo, the connection is established and holds - and when connecting with the applet, I don't even need sudo.

The client can now ping the server over the VPN (10.8.0.1) and itself (10.8.0.6). The server logs the connection and the assigned IP addres in ips.txt. Problem is, the client can no longer reach any external IPs. I have changed the server config to route all the client traffic but I guess I'm missing the parts that the HOWTO is handwaving about.

In addition, we seem to have completely borked our setup somehow. I can no longer connect remotely - neither to the server (RDP, FTP), nor to the client (SSH, SFTP, SSCP). So, I cannot experiment any further without going there physically again and fixing this godawful mess first.

We also discovered that when the service is running on the server, the GUI cannot connect. If we stop the service (and set it to manual, as the installer does), when the server is rebooted, the GUI starts but doesn't connect automatically. This is unacceptable and I have no idea how to fix this, but I'm not that far yet; I still can't get the client to work properly even when the server is running and connected.

Also,

OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec 1 2014

Please update ..

According to apt-get, I have the latest version. I guess nothing newer is in the repositories and recompiling from sources is very, very low on my list of priorities right now.

[TinCanTech]

https://community.openvpn.net/openvpn/w ... twareRepos

[bontchev]

OK, the most we have achieved so far is this:

• Server establishes the VPN successfully.
• Client connects to the server and authenticates (server logs the connection).
• Client can ping the server (10.8.0.1) and itself (10.8.0.6).
• Client can do DNS resolution over the VPN (e.g., nslookup site shows the IP of the site).

That's it. Sadly, as soon as the client connects to the VPN, it loses access to all external IPs. According to route, the server routes the VPN traffic to its router. Either something stops the traffic from leaving the router, or the responses are not routed back to the VPN.

We did a bunch of Window-sy stuff like enabling RAS, enabling routing in the Registry and whatnot - to no avail. I'm very close to the "f*ck it" point. I had a short chat with a professional sysadmin, hoping to get some help. He said, "I wasted three weeks with this crap a few months ago and gave up; it's unusable. We ended up using the VPN server built into Windows 10".

Sadly, that's not acceptable to us. Tomorrow or the day after I'll try one additional idea with bridged networking interfaces. If that doesn't work either, I was recommended SoftEther, which is supposed to be a better VPN that is compatible with OpenVPN. Couldn't find a Linux client, but apparently one can use the OpenVPN client for Linux to connect to a SoftEther server. Also, a colleague seemed to remember that one of our routers has a built-in Cisco VPN. I've never set up a Cisco VPN server before, but I've used Cisco VPN clients many times and they are nice and user-friendly - nothing like the incomprehensible ugly kludge that OpenVPN has turned out to be. If neither of these approaches work, I give up.

[bontchev]

https://community.openvpn.net/openvpn/w ... twareRepos

Sigh... Just like everything else OpenVPN-related, this instruction just has to be too complicated and incomprehensible.

What exactly do I need to get?! The page says there are binaries only for Debian and Ubuntu. Well, the client is running Mint (Rosa), which is based on Ubuntu, which itself is based on Debian. So, what the blazes do I need to get?? Was it so hard to have some sort of intelligent tool that examines what OS flavor/version you have and gets the right thing from the repository automatically?

Screw it. I'm not touching this crap until my OS's official repository decides that I need an update and provides the right update compatible with the exact OS version/flavor I have. I have enough trouble as it is to worry whether I've picked the right Ubuntu (or maybe Debian?) flavor that is most similar in the eyes of the OpenVPN developers to what I have and whether I've made some kind of mistake and things aren't working because I've picked the wrong flavor.

[TinCanTech]

I am in an urgent need for help

Screw it. I'm not touching this crap

quitter ..



Two points:

• This is a Free Project .. supported by Volunteers .. nobody gets paid.
• If you want to pay me: tincanteksup <at> gmail

[300000]

this is my setup and working if you like you can follow as below and hope it can helf you

open service and turn on routing and remote service


open regedit and find the way to tcpip and make ipenablerouter 1


let go to network and sharing centel and setting something on that , make sure change the name network card connec to internet and openvpn networ card




right click on internet netword card and click share then click setting input some data as picture and click ok . make sure ip address is ip of you server run openvpn ,


click on openvpn network card and in put some data as picture




add this line on your server config

ip-win32 manual

you should try to put google dns first insteal your dns server , just add this line to your server config

push "dhcp-option DNS 8.8.4.4 "

and the last thing is turn on all three openvpn server in automatic



rerstart your computer and it will works out for you on first try

it is better to run on tcp than udp , tcp is more faster than udp

if you speed to slow just add thic one on you server config

sndbuf 399999
rcvbuf 399999
push "sndbuf 399999 "
push "rcvbuf 399999 "
push "route-method exe"

[TinCanTech]

Nice guide

But:

it is better to run on tcp than udp , tcp is more faster than udp

UDP is faster than TCP.

[300000]

tcp will run faster if client on very far or on mobile network . because tcp will make sure the data delivery . it only add overhead some bit .

in very shor distance it is ok to run on udp .

[TinCanTech]

Technically, UDP is always faster than TCP.

If you have network issues then that is a completely different problem ..
TCP may be able to help but that does not make it faster.