iptables Configuration

user7743

Hello all,

I am in the process of setting up a new openvpn system. This is something totally new to me so apologies for any silly questions or oversights. I have been searching but not been able to find anything that directly answers my questions. In this case, openvpn is being retrofitted to my "router" PC this is running Debian Squeeze. The router already works forwarding traffic from the internal network to the outside world using masquerading. The router has two NIC's and is connected directly to the internet via eth0. The router gets its IP for eth0 dynamically form my ISP and I have a dyddns account to update a DNS record.
The internal NIC is a bridge set up to link eth1 which is physically connected to the internal switch, wlan0 which is a wireless card running hostapd and finally tap0 for openvpn. The device br0 has the static address of 10.0.8.1.
I can connect to the openvpn server from the internal network without problem. My issue is exposing openvpn to the outside world and getting the packets flowing through my router and firewall correctly.
Given my configuration and my understanding, I assume openvpn would be listening on br0 and therefore I would need to use iptables to forward the traffic from eth0 1194 to br0 1194? I have done this with the following rule.

iptables -t nat -A PREROUTING -p udp -i eth0 --dport 1194 -j DNAT --to-destination 10.0.8.1:1194

I also have the following rules (the only other port exposed on eth0 is 22 for the ssh server)

iptables -A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -j RED_ALLOW_IN
iptables -A INPUT -i eth0 -p udp -m udp --dport 1194 -m state --state NEW -j RED_ALLOW_IN
iptables -A RED_ALLOW_IN -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m tcp --dport 22 -m state --state NEW -j RED_ALLOW_OUT
iptables -A OUTPUT -o eth0 -p udp -m udp --dport 1194 -m state --state NEW -j RED_ALLOW_OUT
iptables -N RED_ALLOW_OUT

iptables -A INPUT -i tap+ -j ACCEPT
iptables -A OUTPUT -o tap+ -j ACCEPT
iptables -A FORWARD -i tap+ -j ACCEPT

When trying to connect, the logs below are produced. Can anyone give me a hint as to what I am missing on the iptables side of things. Many thanks in advance.

server.log

Wed May 16 11:23:55 2012 us=163650 Current Parameter Settings:
Wed May 16 11:23:55 2012 us=164035   config = '/etc/openvpn/server.conf'
Wed May 16 11:23:55 2012 us=164131   mode = 1
Wed May 16 11:23:55 2012 us=164219   persist_config = DISABLED
Wed May 16 11:23:55 2012 us=164305   persist_mode = 1
Wed May 16 11:23:55 2012 us=164389   show_ciphers = DISABLED
Wed May 16 11:23:55 2012 us=164474   show_digests = DISABLED
Wed May 16 11:23:55 2012 us=164560   show_engines = DISABLED
Wed May 16 11:23:55 2012 us=164644   genkey = DISABLED
Wed May 16 11:23:55 2012 us=164731   key_pass_file = '[UNDEF]'
Wed May 16 11:23:55 2012 us=164817   show_tls_ciphers = DISABLED
Wed May 16 11:23:55 2012 us=164903 Connection profiles [default]:
Wed May 16 11:23:55 2012 us=164989   proto = udp
Wed May 16 11:23:55 2012 us=165077   local = '[UNDEF]'
Wed May 16 11:23:55 2012 us=165161   local_port = 1194
Wed May 16 11:23:55 2012 us=165248   remote = '[UNDEF]'
Wed May 16 11:23:55 2012 us=165335   remote_port = 1194
Wed May 16 11:23:55 2012 us=165419   remote_float = DISABLED
Wed May 16 11:23:55 2012 us=165504   bind_defined = DISABLED
Wed May 16 11:23:55 2012 us=165590   bind_local = ENABLED
Wed May 16 11:23:55 2012 us=165676   connect_retry_seconds = 5
Wed May 16 11:23:55 2012 us=165761   connect_timeout = 10
Wed May 16 11:23:55 2012 us=165846   connect_retry_max = 0
Wed May 16 11:23:55 2012 us=165932   socks_proxy_server = '[UNDEF]'
Wed May 16 11:23:55 2012 us=166017   socks_proxy_port = 0
Wed May 16 11:23:55 2012 us=166101   socks_proxy_retry = DISABLED
Wed May 16 11:23:55 2012 us=166193 Connection profiles END
Wed May 16 11:23:55 2012 us=166280   remote_random = DISABLED
Wed May 16 11:23:55 2012 us=166366   ipchange = '[UNDEF]'
Wed May 16 11:23:55 2012 us=166450   dev = 'tap'
Wed May 16 11:23:55 2012 us=166536   dev_type = '[UNDEF]'
Wed May 16 11:23:55 2012 us=166621   dev_node = '[UNDEF]'
Wed May 16 11:23:55 2012 us=166708   lladdr = '[UNDEF]'
Wed May 16 11:23:55 2012 us=166792   topology = 1
Wed May 16 11:23:55 2012 us=166877   tun_ipv6 = DISABLED
Wed May 16 11:23:55 2012 us=166962   ifconfig_local = '[UNDEF]'
Wed May 16 11:23:55 2012 us=167048   ifconfig_remote_netmask = '[UNDEF]'
Wed May 16 11:23:55 2012 us=167133   ifconfig_noexec = DISABLED
Wed May 16 11:23:55 2012 us=167219   ifconfig_nowarn = DISABLED
Wed May 16 11:23:55 2012 us=167367   shaper = 0
Wed May 16 11:23:55 2012 us=167456   tun_mtu = 1500
Wed May 16 11:23:55 2012 us=167544   tun_mtu_defined = ENABLED
Wed May 16 11:23:55 2012 us=167630   link_mtu = 1500
Wed May 16 11:23:55 2012 us=167714   link_mtu_defined = DISABLED
Wed May 16 11:23:55 2012 us=167800   tun_mtu_extra = 32
Wed May 16 11:23:55 2012 us=167885   tun_mtu_extra_defined = ENABLED
Wed May 16 11:23:55 2012 us=167972   fragment = 0
Wed May 16 11:23:55 2012 us=168056   mtu_discover_type = -1
Wed May 16 11:23:55 2012 us=168141   mtu_test = 0
Wed May 16 11:23:55 2012 us=168227   mlock = DISABLED
Wed May 16 11:23:55 2012 us=168312   keepalive_ping = 10
Wed May 16 11:23:55 2012 us=168397   keepalive_timeout = 120
Wed May 16 11:23:55 2012 us=168482   inactivity_timeout = 0
Wed May 16 11:23:55 2012 us=168568   ping_send_timeout = 10
Wed May 16 11:23:55 2012 us=168652   ping_rec_timeout = 240
Wed May 16 11:23:55 2012 us=168737   ping_rec_timeout_action = 2
Wed May 16 11:23:55 2012 us=168823   ping_timer_remote = DISABLED
Wed May 16 11:23:55 2012 us=168907   remap_sigusr1 = 0
Wed May 16 11:23:55 2012 us=168993   explicit_exit_notification = 0
Wed May 16 11:23:55 2012 us=169078   persist_tun = ENABLED
Wed May 16 11:23:55 2012 us=169163   persist_local_ip = DISABLED
Wed May 16 11:23:55 2012 us=169248   persist_remote_ip = DISABLED
Wed May 16 11:23:55 2012 us=169333   persist_key = ENABLED
Wed May 16 11:23:55 2012 us=169418   mssfix = 1450
Wed May 16 11:23:55 2012 us=169502   passtos = DISABLED
Wed May 16 11:23:55 2012 us=169589   resolve_retry_seconds = 1000000000
Wed May 16 11:23:55 2012 us=169673   username = '[UNDEF]'
Wed May 16 11:23:55 2012 us=169759   groupname = '[UNDEF]'
Wed May 16 11:23:55 2012 us=169844   chroot_dir = '[UNDEF]'
Wed May 16 11:23:55 2012 us=169975   cd_dir = '/etc/openvpn'
Wed May 16 11:23:55 2012 us=170064   writepid = '/var/run/openvpn.server.pid'
Wed May 16 11:23:55 2012 us=170160   up_script = '[UNDEF]'
Wed May 16 11:23:55 2012 us=170248   down_script = '[UNDEF]'
Wed May 16 11:23:55 2012 us=170335   down_pre = DISABLED
Wed May 16 11:23:55 2012 us=170420   up_restart = DISABLED
Wed May 16 11:23:55 2012 us=170505   up_delay = DISABLED
Wed May 16 11:23:55 2012 us=170590   daemon = ENABLED
Wed May 16 11:23:55 2012 us=170675   inetd = 0
Wed May 16 11:23:55 2012 us=170757   log = ENABLED
Wed May 16 11:23:55 2012 us=170843   suppress_timestamps = DISABLED
Wed May 16 11:23:55 2012 us=171006   nice = 0
Wed May 16 11:23:55 2012 us=171092   verbosity = 6
Wed May 16 11:23:55 2012 us=171178   mute = 0
Wed May 16 11:23:55 2012 us=171263   gremlin = 0
Wed May 16 11:23:55 2012 us=171408   status_file = '/var/log/openvpn-status.log'
Wed May 16 11:23:55 2012 us=171496   status_file_version = 1
Wed May 16 11:23:55 2012 us=171583   status_file_update_freq = 60
Wed May 16 11:23:55 2012 us=171667   occ = ENABLED
Wed May 16 11:23:55 2012 us=171753   rcvbuf = 65536
Wed May 16 11:23:55 2012 us=171839   sndbuf = 65536
Wed May 16 11:23:55 2012 us=171922   sockflags = 0
Wed May 16 11:23:55 2012 us=172009   fast_io = DISABLED
Wed May 16 11:23:55 2012 us=172094   lzo = 7
Wed May 16 11:23:55 2012 us=172178   route_script = '[UNDEF]'
Wed May 16 11:23:55 2012 us=172262   route_default_gateway = '[UNDEF]'
Wed May 16 11:23:55 2012 us=172347   route_default_metric = 0
Wed May 16 11:23:55 2012 us=172431   route_noexec = DISABLED
Wed May 16 11:23:55 2012 us=172516   route_delay = 0
Wed May 16 11:23:55 2012 us=172600   route_delay_window = 30
Wed May 16 11:23:55 2012 us=172685   route_delay_defined = DISABLED
Wed May 16 11:23:55 2012 us=172770   route_nopull = DISABLED
Wed May 16 11:23:55 2012 us=172857   route_gateway_via_dhcp = DISABLED
Wed May 16 11:23:55 2012 us=172945   max_routes = 100
Wed May 16 11:23:55 2012 us=173031   allow_pull_fqdn = DISABLED
Wed May 16 11:23:55 2012 us=173117   management_addr = '[UNDEF]'
Wed May 16 11:23:55 2012 us=173202   management_port = 0
Wed May 16 11:23:55 2012 us=173287   management_user_pass = '[UNDEF]'
Wed May 16 11:23:55 2012 us=173372   management_log_history_cache = 250
Wed May 16 11:23:55 2012 us=173461   management_echo_buffer_size = 100
Wed May 16 11:23:55 2012 us=173548   management_write_peer_info_file = '[UNDEF]'
Wed May 16 11:23:55 2012 us=173636   management_client_user = '[UNDEF]'
Wed May 16 11:23:55 2012 us=173724   management_client_group = '[UNDEF]'
Wed May 16 11:23:55 2012 us=173809   management_flags = 0
Wed May 16 11:23:55 2012 us=173895   shared_secret_file = '[UNDEF]'
Wed May 16 11:23:55 2012 us=173983   key_direction = 0
Wed May 16 11:23:55 2012 us=174068   ciphername_defined = ENABLED
Wed May 16 11:23:55 2012 us=174155   ciphername = 'BF-CBC'
Wed May 16 11:23:55 2012 us=174241   authname_defined = ENABLED
Wed May 16 11:23:55 2012 us=174329   authname = 'SHA1'
Wed May 16 11:23:55 2012 us=174415   prng_hash = 'SHA1'
Wed May 16 11:23:55 2012 us=174501   prng_nonce_secret_len = 16
Wed May 16 11:23:55 2012 us=174589   keysize = 0
Wed May 16 11:23:55 2012 us=174674   engine = DISABLED
Wed May 16 11:23:55 2012 us=174760   replay = ENABLED
Wed May 16 11:23:55 2012 us=174847   mute_replay_warnings = DISABLED
Wed May 16 11:23:55 2012 us=174934   replay_window = 64
Wed May 16 11:23:55 2012 us=175019   replay_time = 15
Wed May 16 11:23:55 2012 us=175103   packet_id_file = '[UNDEF]'
Wed May 16 11:23:55 2012 us=175190   use_iv = ENABLED
Wed May 16 11:23:55 2012 us=175276   test_crypto = DISABLED
Wed May 16 11:23:55 2012 us=175418   tls_server = ENABLED
Wed May 16 11:23:55 2012 us=175507   tls_client = DISABLED
Wed May 16 11:23:55 2012 us=175593   key_method = 2
Wed May 16 11:23:55 2012 us=175682   ca_file = '/etc/pki/ca.pem'
Wed May 16 11:23:55 2012 us=175767   ca_path = '[UNDEF]'
Wed May 16 11:23:55 2012 us=175853   dh_file = '/etc/pki/dh.pem'
Wed May 16 11:23:55 2012 us=175941   cert_file = '/etc/pki/cert.pem'
Wed May 16 11:23:55 2012 us=176071   priv_key_file = '/etc/pki/key.pem'
Wed May 16 11:23:55 2012 us=176163   pkcs12_file = '[UNDEF]'
Wed May 16 11:23:55 2012 us=176251   cipher_list = '[UNDEF]'
Wed May 16 11:23:55 2012 us=176338   tls_verify = '[UNDEF]'
Wed May 16 11:23:55 2012 us=176424   tls_remote = '[UNDEF]'
Wed May 16 11:23:55 2012 us=176510   crl_file = '[UNDEF]'
Wed May 16 11:23:55 2012 us=176597   ns_cert_type = 0
Wed May 16 11:23:55 2012 us=176684   remote_cert_ku[i] = 0
Wed May 16 11:23:55 2012 us=176770   remote_cert_ku[i] = 0
Wed May 16 11:23:55 2012 us=176856   remote_cert_ku[i] = 0
Wed May 16 11:23:55 2012 us=176942   remote_cert_ku[i] = 0
Wed May 16 11:23:55 2012 us=177029   remote_cert_ku[i] = 0
Wed May 16 11:23:55 2012 us=177116   remote_cert_ku[i] = 0
Wed May 16 11:23:55 2012 us=177203   remote_cert_ku[i] = 0
Wed May 16 11:23:55 2012 us=177289   remote_cert_ku[i] = 0
Wed May 16 11:23:55 2012 us=177376   remote_cert_ku[i] = 0
Wed May 16 11:23:55 2012 us=177461   remote_cert_ku[i] = 0
Wed May 16 11:23:55 2012 us=177546   remote_cert_ku[i] = 0
Wed May 16 11:23:55 2012 us=177631   remote_cert_ku[i] = 0
Wed May 16 11:23:55 2012 us=177717   remote_cert_ku[i] = 0
Wed May 16 11:23:55 2012 us=177804   remote_cert_ku[i] = 0
Wed May 16 11:23:55 2012 us=177890   remote_cert_ku[i] = 0
Wed May 16 11:23:55 2012 us=177978   remote_cert_ku[i] = 0
Wed May 16 11:23:55 2012 us=178063   remote_cert_eku = '[UNDEF]'
Wed May 16 11:23:55 2012 us=178150   tls_timeout = 2
Wed May 16 11:23:55 2012 us=178235   renegotiate_bytes = 0
Wed May 16 11:23:55 2012 us=178321   renegotiate_packets = 0
Wed May 16 11:23:55 2012 us=178408   renegotiate_seconds = 3600
Wed May 16 11:23:55 2012 us=178496   handshake_window = 60
Wed May 16 11:23:55 2012 us=178580   transition_window = 3600
Wed May 16 11:23:55 2012 us=178665   single_session = DISABLED
Wed May 16 11:23:55 2012 us=178749   push_peer_info = DISABLED
Wed May 16 11:23:55 2012 us=178834   tls_exit = DISABLED
Wed May 16 11:23:55 2012 us=178921   tls_auth_file = '[UNDEF]'
Wed May 16 11:23:55 2012 us=179008   pkcs11_protected_authentication = DISABLED
Wed May 16 11:23:55 2012 us=179094   pkcs11_protected_authentication = DISABLED
Wed May 16 11:23:55 2012 us=179180   pkcs11_protected_authentication = DISABLED
Wed May 16 11:23:55 2012 us=179268   pkcs11_protected_authentication = DISABLED
Wed May 16 11:23:55 2012 us=179412   pkcs11_protected_authentication = DISABLED
Wed May 16 11:23:55 2012 us=179501   pkcs11_protected_authentication = DISABLED
Wed May 16 11:23:55 2012 us=179589   pkcs11_protected_authentication = DISABLED
Wed May 16 11:23:55 2012 us=179675   pkcs11_protected_authentication = DISABLED
Wed May 16 11:23:55 2012 us=179761   pkcs11_protected_authentication = DISABLED
Wed May 16 11:23:55 2012 us=179850   pkcs11_protected_authentication = DISABLED
Wed May 16 11:23:55 2012 us=179937   pkcs11_protected_authentication = DISABLED
Wed May 16 11:23:55 2012 us=180024   pkcs11_protected_authentication = DISABLED
Wed May 16 11:23:55 2012 us=180111   pkcs11_protected_authentication = DISABLED
Wed May 16 11:23:55 2012 us=180198   pkcs11_protected_authentication = DISABLED
Wed May 16 11:23:55 2012 us=180284   pkcs11_protected_authentication = DISABLED
Wed May 16 11:23:55 2012 us=180370   pkcs11_protected_authentication = DISABLED
Wed May 16 11:23:55 2012 us=180458   pkcs11_private_mode = 00000000
Wed May 16 11:23:55 2012 us=180544   pkcs11_private_mode = 00000000
Wed May 16 11:23:55 2012 us=180631   pkcs11_private_mode = 00000000
Wed May 16 11:23:55 2012 us=180719   pkcs11_private_mode = 00000000
Wed May 16 11:23:55 2012 us=180808   pkcs11_private_mode = 00000000
Wed May 16 11:23:55 2012 us=180895   pkcs11_private_mode = 00000000
Wed May 16 11:23:55 2012 us=180983   pkcs11_private_mode = 00000000
Wed May 16 11:23:55 2012 us=181071   pkcs11_private_mode = 00000000
Wed May 16 11:23:55 2012 us=181159   pkcs11_private_mode = 00000000
Wed May 16 11:23:55 2012 us=181248   pkcs11_private_mode = 00000000
Wed May 16 11:23:55 2012 us=181336   pkcs11_private_mode = 00000000
Wed May 16 11:23:55 2012 us=181463   pkcs11_private_mode = 00000000
Wed May 16 11:23:55 2012 us=181553   pkcs11_private_mode = 00000000
Wed May 16 11:23:55 2012 us=181641   pkcs11_private_mode = 00000000
Wed May 16 11:23:55 2012 us=181728   pkcs11_private_mode = 00000000
Wed May 16 11:23:55 2012 us=181813   pkcs11_private_mode = 00000000
Wed May 16 11:23:55 2012 us=181900   pkcs11_cert_private = DISABLED
Wed May 16 11:23:55 2012 us=181986   pkcs11_cert_private = DISABLED
Wed May 16 11:23:55 2012 us=182072   pkcs11_cert_private = DISABLED
Wed May 16 11:23:55 2012 us=182159   pkcs11_cert_private = DISABLED
Wed May 16 11:23:55 2012 us=182245   pkcs11_cert_private = DISABLED
Wed May 16 11:23:55 2012 us=182330   pkcs11_cert_private = DISABLED
Wed May 16 11:23:55 2012 us=182416   pkcs11_cert_private = DISABLED
Wed May 16 11:23:55 2012 us=182504   pkcs11_cert_private = DISABLED
Wed May 16 11:23:55 2012 us=182589   pkcs11_cert_private = DISABLED
Wed May 16 11:23:55 2012 us=182674   pkcs11_cert_private = DISABLED
Wed May 16 11:23:55 2012 us=182760   pkcs11_cert_private = DISABLED
Wed May 16 11:23:55 2012 us=182845   pkcs11_cert_private = DISABLED
Wed May 16 11:23:55 2012 us=182931   pkcs11_cert_private = DISABLED
Wed May 16 11:23:55 2012 us=183017   pkcs11_cert_private = DISABLED
Wed May 16 11:23:55 2012 us=183102   pkcs11_cert_private = DISABLED
Wed May 16 11:23:55 2012 us=183188   pkcs11_cert_private = DISABLED
Wed May 16 11:23:55 2012 us=183276   pkcs11_pin_cache_period = -1
Wed May 16 11:23:55 2012 us=183416   pkcs11_id = '[UNDEF]'
Wed May 16 11:23:55 2012 us=183505   pkcs11_id_management = DISABLED
Wed May 16 11:23:55 2012 us=183615   server_network = 0.0.0.0
Wed May 16 11:23:55 2012 us=183714   server_netmask = 0.0.0.0
Wed May 16 11:23:55 2012 us=183812   server_bridge_ip = 10.0.8.1
Wed May 16 11:23:55 2012 us=183912   server_bridge_netmask = 255.255.255.0
Wed May 16 11:23:55 2012 us=184011   server_bridge_pool_start = 10.0.8.150
Wed May 16 11:23:55 2012 us=184109   server_bridge_pool_end = 10.0.8.150
Wed May 16 11:23:55 2012 us=184196   push_entry = 'route-gateway 10.0.8.1'
Wed May 16 11:23:55 2012 us=184281   push_entry = 'ping 10'
Wed May 16 11:23:55 2012 us=184366   push_entry = 'ping-restart 120'
Wed May 16 11:23:55 2012 us=184453   ifconfig_pool_defined = ENABLED
Wed May 16 11:23:55 2012 us=184551   ifconfig_pool_start = 10.0.8.150
Wed May 16 11:23:55 2012 us=184651   ifconfig_pool_end = 10.0.8.150
Wed May 16 11:23:55 2012 us=184749   ifconfig_pool_netmask = 255.255.255.0
Wed May 16 11:23:55 2012 us=184835   ifconfig_pool_persist_filename = 'ipp.txt'
Wed May 16 11:23:55 2012 us=184921   ifconfig_pool_persist_refresh_freq = 600
Wed May 16 11:23:55 2012 us=185007   n_bcast_buf = 256
Wed May 16 11:23:55 2012 us=185092   tcp_queue_limit = 64
Wed May 16 11:23:55 2012 us=185177   real_hash_size = 256
Wed May 16 11:23:55 2012 us=185262   virtual_hash_size = 256
Wed May 16 11:23:55 2012 us=185348   client_connect_script = '[UNDEF]'
Wed May 16 11:23:55 2012 us=185434   learn_address_script = '[UNDEF]'
Wed May 16 11:23:55 2012 us=185520   client_disconnect_script = '[UNDEF]'
Wed May 16 11:23:55 2012 us=185607   client_config_dir = '[UNDEF]'
Wed May 16 11:23:55 2012 us=185692   ccd_exclusive = DISABLED
Wed May 16 11:23:55 2012 us=185777   tmp_dir = '[UNDEF]'
Wed May 16 11:23:55 2012 us=185863   push_ifconfig_defined = DISABLED
Wed May 16 11:23:55 2012 us=185962   push_ifconfig_local = 0.0.0.0
Wed May 16 11:23:55 2012 us=186058   push_ifconfig_remote_netmask = 0.0.0.0
Wed May 16 11:23:55 2012 us=186143   enable_c2c = DISABLED
Wed May 16 11:23:55 2012 us=186229   duplicate_cn = DISABLED
Wed May 16 11:23:55 2012 us=186314   cf_max = 0
Wed May 16 11:23:55 2012 us=186400   cf_per = 0
Wed May 16 11:23:55 2012 us=186484   max_clients = 1024
Wed May 16 11:23:55 2012 us=186570   max_routes_per_client = 256
Wed May 16 11:23:55 2012 us=186657   auth_user_pass_verify_script = '[UNDEF]'
Wed May 16 11:23:55 2012 us=186744   auth_user_pass_verify_script_via_file = DISABLED
Wed May 16 11:23:55 2012 us=186830   ssl_flags = 0
Wed May 16 11:23:55 2012 us=187018   port_share_host = '[UNDEF]'
Wed May 16 11:23:55 2012 us=187108   port_share_port = 0
Wed May 16 11:23:55 2012 us=187194   client = DISABLED
Wed May 16 11:23:55 2012 us=187278   pull = DISABLED
Wed May 16 11:23:55 2012 us=187421   auth_user_pass_file = '[UNDEF]'
Wed May 16 11:23:55 2012 us=187524 OpenVPN 2.1.3 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Feb 20 2012
Wed May 16 11:23:55 2012 us=188288 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Wed May 16 11:23:55 2012 us=188728 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed May 16 11:23:55 2012 us=749886 Diffie-Hellman initialized with 2048 bit key
Wed May 16 11:23:55 2012 us=756303 /usr/bin/openssl-vulnkey -q -b 2048 -m <modulus omitted>
Wed May 16 11:23:57 2012 us=314571 TLS-Auth MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed May 16 11:23:57 2012 us=314841 Socket Buffers: R=[112640->131072] S=[112640->131072]
Wed May 16 11:23:57 2012 us=330184 TUN/TAP device tap1 opened
Wed May 16 11:23:57 2012 us=330385 TUN/TAP TX queue length set to 100
Wed May 16 11:23:57 2012 us=330631 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Wed May 16 11:23:57 2012 us=336464 UDPv4 link local (bound): [undef]
Wed May 16 11:23:57 2012 us=336683 UDPv4 link remote: [undef]
Wed May 16 11:23:57 2012 us=336799 MULTI: multi_init called, r=256 v=256
Wed May 16 11:23:57 2012 us=337180 IFCONFIG POOL: base=10.0.8.150 size=1
Wed May 16 11:23:57 2012 us=337391 IFCONFIG POOL LIST
Wed May 16 11:23:57 2012 us=337498 User,10.0.8.150
Wed May 16 11:23:57 2012 us=337680 Initialization Sequence Completed
Wed May 16 11:24:52 2012 us=864709 MULTI: multi_create_instance called
Wed May 16 11:24:52 2012 us=865044 109.43.0.17:8333 Re-using SSL/TLS context
Wed May 16 11:24:52 2012 us=865236 109.43.0.17:8333 LZO compression initialized
Wed May 16 11:24:52 2012 us=866121 109.43.0.17:8333 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed May 16 11:24:52 2012 us=866252 109.43.0.17:8333 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Wed May 16 11:24:52 2012 us=866454 109.43.0.17:8333 Local Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed May 16 11:24:52 2012 us=866546 109.43.0.17:8333 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed May 16 11:24:52 2012 us=866995 109.43.0.17:8333 Local Options hash (VER=V4): 'f7df56b8'
Wed May 16 11:24:52 2012 us=867207 109.43.0.17:8333 Expected Remote Options hash (VER=V4): 'd79ca330'
Wed May 16 11:24:52 2012 us=867602 109.43.0.17:8333 UDPv4 READ [14] from [AF_INET]109.43.0.17:8333: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Wed May 16 11:24:52 2012 us=867840 109.43.0.17:8333 TLS: Initial packet from [AF_INET]109.43.0.17:8333, sid=6252458e f24e9f48
Wed May 16 11:24:52 2012 us=868162 109.43.0.17:8333 UDPv4 WRITE [26] to [AF_INET]109.43.0.17:8333: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ 0 ] pid=0 DATA len=0
Wed May 16 11:24:52 2012 us=868501 109.43.0.17:8333 write UDPv4 []: Operation not permitted (code=1)
Wed May 16 11:24:55 2012 us=63538 109.43.0.17:8333 UDPv4 WRITE [14] to [AF_INET]109.43.0.17:8333: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ ] pid=0 DATA len=0
Wed May 16 11:24:55 2012 us=63920 109.43.0.17:8333 write UDPv4 []: Operation not permitted (code=1)
Wed May 16 11:24:57 2012 us=43034 109.43.0.17:8333 UDPv4 READ [14] from [AF_INET]109.43.0.17:8333: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Wed May 16 11:24:57 2012 us=44048 109.43.0.17:8333 UDPv4 WRITE [22] to [AF_INET]109.43.0.17:8333: P_ACK_V1 kid=0 [ 0 ]
Wed May 16 11:24:57 2012 us=44466 109.43.0.17:8333 write UDPv4 []: Operation not permitted (code=1)
Wed May 16 11:24:57 2012 us=44947 109.43.0.17:8333 UDPv4 READ [14] from [AF_INET]109.43.0.17:8333: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Wed May 16 11:24:57 2012 us=45289 109.43.0.17:8333 UDPv4 WRITE [22] to [AF_INET]109.43.0.17:8333: P_ACK_V1 kid=0 [ 0 ]
Wed May 16 11:24:57 2012 us=45537 109.43.0.17:8333 write UDPv4 []: Operation not permitted (code=1)
Wed May 16 11:24:59 2012 us=192248 109.43.0.17:8333 UDPv4 WRITE [14] to [AF_INET]109.43.0.17:8333: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ ] pid=0 DATA len=0
Wed May 16 11:24:59 2012 us=192650 109.43.0.17:8333 write UDPv4 []: Operation not permitted (code=1)
Wed May 16 11:24:59 2012 us=826722 109.43.0.17:8333 UDPv4 READ [14] from [AF_INET]109.43.0.17:8333: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Wed May 16 11:24:59 2012 us=827201 109.43.0.17:8333 UDPv4 WRITE [22] to [AF_INET]109.43.0.17:8333: P_ACK_V1 kid=0 [ 0 ]
Wed May 16 11:24:59 2012 us=827469 109.43.0.17:8333 write UDPv4 []: Operation not permitted (code=1)
Wed May 16 11:25:07 2012 us=158219 109.43.0.17:8333 UDPv4 WRITE [14] to [AF_INET]109.43.0.17:8333: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ ] pid=0 DATA len=0
Wed May 16 11:25:07 2012 us=158545 109.43.0.17:8333 write UDPv4 []: Operation not permitted (code=1)
Wed May 16 11:25:23 2012 us=457069 109.43.0.17:8333 UDPv4 WRITE [14] to [AF_INET]109.43.0.17:8333: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ ] pid=0 DATA len=0
Wed May 16 11:25:23 2012 us=457403 109.43.0.17:8333 write UDPv4 []: Operation not permitted (code=1)
Wed May 16 11:25:52 2012 us=878712 109.43.0.17:8333 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Wed May 16 11:25:52 2012 us=878908 109.43.0.17:8333 TLS Error: TLS handshake failed
Wed May 16 11:25:52 2012 us=879449 109.43.0.17:8333 SIGUSR1[soft,tls-error] received, client-instance restarting

client.log

Wed May 16 11:24:38 2012 OpenVPN 2.1.1 i686-pc-linux-gnu [SSL] [LZO2] [EPOLL] built on Jan  7 2012
Wed May 16 11:24:38 2012 MANAGEMENT: TCP Socket listening on 127.0.0.1:30365
Wed May 16 11:24:38 2012 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed May 16 11:24:38 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed May 16 11:24:38 2012 Need password(s) from management interface, waiting...
Wed May 16 11:24:38 2012 MANAGEMENT: Client connected from 127.0.0.1:30365
Wed May 16 11:24:38 2012 MANAGEMENT: CMD 'state'
Wed May 16 11:24:38 2012 MANAGEMENT: CMD 'state on'
Wed May 16 11:24:38 2012 MANAGEMENT: CMD 'bytecount 0'
Wed May 16 11:24:49 2012 MANAGEMENT: CMD 'password [...]'
Wed May 16 11:24:49 2012 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed May 16 11:24:49 2012 WARNING: file '/sdcard/openvpn/client_key.pem' is group or others accessible
Wed May 16 11:24:49 2012 LZO compression initialized
Wed May 16 11:24:49 2012 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed May 16 11:24:49 2012 MANAGEMENT: >STATE:1337160289,RESOLVE,,,
Wed May 16 11:24:51 2012 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Wed May 16 11:24:51 2012 Local Options hash (VER=V4): 'd79ca330'
Wed May 16 11:24:51 2012 Expected Remote Options hash (VER=V4): 'f7df56b8'
Wed May 16 11:24:51 2012 Socket Buffers: R=[112640->131072] S=[112640->131072]
Wed May 16 11:24:51 2012 UDPv4 link local: [undef]
Wed May 16 11:24:51 2012 UDPv4 link remote: x.x.x.x:1194
Wed May 16 11:24:51 2012 MANAGEMENT: >STATE:1337160291,WAIT,,,
Wed May 16 11:24:51 2012 MANAGEMENT: CMD 'bytecount 0'
Wed May 16 11:24:51 2012 MANAGEMENT: CMD 'bytecount 0'
Wed May 16 11:24:52 2012 MANAGEMENT: CMD 'state'
Wed May 16 11:24:52 2012 MANAGEMENT: CMD 'bytecount 0'
Wed May 16 11:24:58 2012 MANAGEMENT: CMD 'signal SIGTERM'
Wed May 16 11:24:58 2012 TCP/UDP: Closing socket
Wed May 16 11:24:58 2012 SIGTERM[hard,] received, process exiting
Wed May 16 11:24:58 2012 MANAGEMENT: >STATE:1337160298,EXITING,SIGTERM,,

Configuration
server.conf

port 1194
proto udp
dev tap
ca /etc/pki/ca.pem
cert /etc/pki/cert.pem
key /etc/pki/key.pem
dh /etc/pki/dh.pem
ifconfig-pool-persist ipp.txt
server-bridge 10.0.8.1 255.255.255.0 10.0.8.150 10.0.8.150
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /var/log/openvpn-status.log
log /var/log/openvpn.log
log-append /var/log/openvpn.log
verb 6

client.conf

client
dev tap
proto udp
remote myserver.dyndns.org 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.pem
cert cert.pem
key key.pem
comp-lzo
verb 5

janjust

your outbound firewall rules don't allow the openvpn server to send traffic back to the client:

Wed May 16 11:24:52 2012 us=868162 109.43.0.17:8333 UDPv4 WRITE [26] to [AF_INET]109.43.0.17:8333: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ 0 ] pid=0 DATA len=0
Wed May 16 11:24:52 2012 us=868501 109.43.0.17:8333 write UDPv4 []: Operation not permitted (code=1)

try it with less restrictive outbound firewall rules ....

user7743

Thanks for the help, I basically started from scratch with my iptables script. It took some time but now it works.

A second problem I worked around that was also causing issue was that in my server config file, I specify the device as tap and not tap0 as was required.

pedroalb

Hi,

can you please post the iptables rules and server.conf that make the openvpn work and made the clients able to ping the network?

Thanks!!