[HELP] 'PUSH_REPLY,redirect-gateway def1 (status=1)

adm1n

Hello Forum ...
:-)

This is my first post.
I am really sorry for my bad grammar,
I am not speak or writing in English regularly.
But, please..., look at my problem and and help me to solve it.

I have a VPN server, assume the IP address of this server is: 333.333.333.333
I have a friend and he got this IP from his ISP: 444.444.444.444

My friend has a strange habit. Without any reasons or purposes that I can understand, he always uses a program called "UltraSurf" http://ultrasurf.us/ before connecting to the vpn server. And to connect to the UltraSurf server, he also uses a proxy server. So, the connection diagram of my friend look like this picture:

Assume UltraSurf server IP is: 555.555.555.555
And the proxy server IP is: 666.666.666.666
Just as additional information, UltraSurf works by creating a LOCAL http proxy on port 9666.

I am using CentOS release 6.2 as my VPN server.
VPN version OpenVPN 2.2.1 i386-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Sep 12 2011

ifconfig command result:

eth0      Link encap:Ethernet  HWaddr 00:0C:29:2C:FF:CB
          inet addr:333.333.333.333  Bcast:[masked]  Mask:255.255.255.0
          inet6 addr: fe80::20c:29ff:fe2c:xxxc/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:54734342 errors:0 dropped:0 overruns:0 frame:0
          TX packets:41472182 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:310481905 (296.0 MiB)  TX bytes:2983555473 (2.7 GiB)
          Interrupt:18 Base address:0x2000

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:3930 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3930 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:297664 (290.6 KiB)  TX bytes:297664 (290.6 KiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.10.10.1  P-t-P:10.10.10.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:728028 errors:0 dropped:0 overruns:0 frame:0
          TX packets:870356 errors:0 dropped:988 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:97144696 (92.6 MiB)  TX bytes:662429938 (631.7 MiB)

route -n command result:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.10.10.2      0.0.0.0         255.255.255.255 UH    0      0        0 tun0
333.333.333.0   0.0.0.0         255.255.255.0   U     0      0        0 eth0
10.10.10.0      10.10.10.2      255.255.255.0   UG    0      0        0 tun0
0.0.0.0         333.333.333.1   0.0.0.0         UG    0      0        0 eth0

iptables -t nat -L command:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  10.10.10.0/24        anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

iptables -L command result:

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     all  --  10.10.10.0/24        anywhere
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain fail2ban-SSH (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

server.conf file :

port 443
proto tcp
dev tun
ca easy-rsa/2.0/keys/ca.crt
cert easy-rsa/2.0/keys/server.crt
key easy-rsa/2.0/keys/server.key  # This file should be kept secret
dh easy-rsa/2.0/keys/dh1024.pem
server 10.10.10.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
# client-to-client
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
log /var/log/vpn1.log
status /var/log/vpn1.status
verb 3

ERROR log on the server side when my friend trying to connect to:

16:58:08  MULTI: multi_create_instance called
16:58:08  Re-using SSL/TLS context
16:58:08  LZO compression initialized
16:58:08  Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
16:58:08  Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
16:58:08  Local Options hash (VER=V4): 'c0103fa8'
16:58:08  Expected Remote Options hash (VER=V4): '69109d17'
16:58:08  TCP connection established with 555.555.555.555:30084
16:58:08  TCPv4_SERVER link local: [undef]
16:58:08  TCPv4_SERVER link remote: 555.555.555.555:30084
16:58:11  555.555.555.555:30084 TLS: Initial packet from 555.555.555.555:30084, sid=569a7a29 b8afe27f
16:58:21  555.555.555.555:30084 CRL CHECK OK: /C=ID/ST=DKI/L=JKT/O=VPN_OK/OU=VPN/CN=myown_vpn/name=VPN1/emailAddress=mymail@null
16:58:21  555.555.555.555:30084 VERIFY OK: depth=1, /C=ID/ST=DKI/L=JKT/O=VPN_OK/OU=VPN/CN=myown_vpn/name=VPN1/emailAddress=mymail@null
16:58:21  555.555.555.555:30084 CRL CHECK OK: /C=ID/ST=DKI/L=JKT/O=VPN_OK/OU=VPN/CN=friend_crt/name=VPN1/emailAddress=mymail@null
16:58:21  555.555.555.555:30084 VERIFY OK: depth=0, /C=ID/ST=DKI/L=JKT/O=VPN_OK/OU=VPN/CN=friend_crt/name=VPN1/emailAddress=mymail@null
16:58:25  555.555.555.555:30084 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
16:58:25  555.555.555.555:30084 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
16:58:25  555.555.555.555:30084 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
16:58:25  555.555.555.555:30084 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
16:58:26  555.555.555.555:30084 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
16:58:26  555.555.555.555:30084 [friend_crt] Peer Connection Initiated with 555.555.555.555:30084
16:58:26  friend_crt/555.555.555.555:30084 MULTI: Learn: 10.10.10.26 -> friend_crt/555.555.555.555:30084
16:58:26  friend_crt/555.555.555.555:30084 MULTI: primary virtual IP for friend_crt/555.555.555.555:30084: 10.10.10.26
16:58:28  friend_crt/555.555.555.555:30084 PUSH: Received control message: 'PUSH_REQUEST'
16:58:28  friend_crt/555.555.555.555:30084 SENT CONTROL [friend_crt]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.10.10.1,topology net30,ping 10,ping-restart 120,ifconfig 10.10.10.26 10.10.10.25' (status=1)
16:59:17  friend_crt/555.555.555.555:30084 Connection reset, restarting [0]
16:59:17  friend_crt/555.555.555.555:30084 SIGUSR1[soft,connection-reset] received, client-instance restarting
16:59:17  TCP/UDP: Closing socket

This is my friend's client.conf file:

client
dev tun
proto tcp
remote 333.333.333.333 443
nobind
persist-key
persist-tun
ca ca.crt
cert friend_crt.crt
key friend_crt.key
ns-cert-type server
connect-retry 5
http-proxy 127.0.0.1 9666 ## since UltraSurf works by making LOCAL http proxy
http-proxy-option VERSION 1.0
http-proxy-option AGENT Opera/9.8 (J2ME/MIDP; Opera Mini/4.4.29476/28.1914; U; en)
http-proxy-retry 5
http-proxy-timeout 120
http-proxy-timeout 12
route-delay 2
route-metric 512
route-method exe
route 0.0.0.0 0.0.0.0
comp-lzo
suppress-timestamps
verb 3

My friend log from his computer when he connecting to my vpn server:

OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
LZO compression initialized
Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Socket Buffers: R=[8192->8192] S=[8192->8192]
Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Local Options hash (VER=V4): '69109d17'
Expected Remote Options hash (VER=V4): 'c0103fa8'
Attempting to establish TCP connection with 127.0.0.1:9666
TCP connection established with 127.0.0.1:9666
Send to HTTP proxy: 'CONNECT 333.333.333.333:443 HTTP/1.0'
HTTP proxy returned: 'HTTP/1.0 200 Connection established'
TCPv4_CLIENT link local: [undef]
TCPv4_CLIENT link remote: 127.0.0.1:9666
TLS: Initial packet from 127.0.0.1:9666, sid=567ce230 5684b303
VERIFY OK: depth=1, /C=ID/ST=DKI/L=JKT/O=VPN_OK/OU=VPN/CN=myown_vpn/name=VPN1/emailAddress=mymail@null
VERIFY OK: nsCertType=SERVER
VERIFY OK: depth=0, /C=ID/ST=DKI/L=JKT/O=VPN_OK/OU=VPN/CN=server/name=VPN1/emailAddress=mymail@null
Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
[server] Peer Connection Initiated with 127.0.0.1:9666
SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.10.10.1,topology net30,ping 10,ping-restart 120,ifconfig 10.10.10.26 10.10.10.25'
OPTIONS IMPORT: timers and/or timeouts modified
OPTIONS IMPORT: --ifconfig/up options modified
OPTIONS IMPORT: route options modified
OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
ROUTE default_gateway=444.444.444.444
TAP-WIN32 device [VPN] opened: \\.\Global\{62E70935-C34D-400A-B55D-AC5ED52945DA}.tap
TAP-Win32 Driver Version 9.9 
TAP-Win32 MTU=1500
Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.10.10.26/255.255.255.252 on interface {62E70935-C34D-400A-B55D-AC5ED52945DA} [DHCP-serv: 10.10.10.25, lease-time: 31536000]
Successful ARP Flush on interface [2] {62E70935-C34D-400A-B55D-AC5ED52945DA}
TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Route: Waiting for TUN/TAP interface to come up...
TEST ROUTES: 3/3 succeeded len=2 ret=1 a=0 u/d=up
C:\WINDOWS\system32\route.exe ADD 127.0.0.1 MASK 255.255.255.255 444.444.444.444
The route addition failed: The parameter is incorrect.
C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.10.10.25
C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.10.10.25
WARNING: potential route subnet conflict between local LAN [444.444.444.444/255.255.255.255] and remote VPN [0.0.0.0/0.0.0.0]
C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 0.0.0.0 10.10.10.25 METRIC 512
C:\WINDOWS\system32\route.exe ADD 10.10.10.1 MASK 255.255.255.255 10.10.10.25 METRIC 512
Initialization Sequence Completed
Connection reset, restarting [0]
TCP/UDP: Closing socket
SIGUSR1[soft,connection-reset] received, process restarting
Restart pause, 5 second(s)

I can connect to my vpn server using a "normal" proxy,
I mean not the local proxy like that done by my friend using UltraSurf.

I don't know what this error and how to fix the problem:

16:58:28  friend_crt/555.555.555.555:30084 SENT CONTROL [friend_crt]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.10.10.1,topology net30,ping 10,ping-restart 120,ifconfig 10.10.10.26 10.10.10.25' (status=1)

And what about this warning?

WARNING: potential route subnet conflict between local LAN [444.444.444.444/255.255.255.255] and remote VPN [0.0.0.0/0.0.0.0]

Any help or suggestion would be much appreciated.
Thank you.

/* edit 20/07/2012 : Correcting The Post Subject */

Mimiko

The problem lies in the fact that your friend double proxies. In order redirect-gateway def1 to work properly routing table must not route packets for openvpn server thru vpn itself. In this case, not only openvpn server's ip must not be routed thru vpn, but also the proxies address. So, leaving the config as is, the friend must also add this route:

route.exe ADD 666.666.666.666 MASK 255.255.255.255 444.444.444.444