I am new to VPN. So it took me two weeks to finally have a courage to write a question of my own. I spent a good amount of time reading googling and trying to solve this problem on my own before posting here. I did take a class on Computer Network at a university, so if could break things down and explain to me, I will be able to understand it.
There will be a copy of logs/configs at the end.
Background: I am connecting to a private VPN that I do not have admin right to. There is netgear router that connects my machine to the internet. I have not been able to use the vpn any longer than 30 minutes so far. I have contacted the owner of the VPN and was told that it is ISP that is disconnecting the service. I am still doubtful, so I would like to know for sure if that is the case.
Problems:
I would like to solve this following problem first:
"route subnet conflict" From how I see is that the server has unnecessary broad subnet. I do not understand why it is configured such way. I have tried changing the ip address of my router from 192.168.1.1 to 192.168.101.1, but this did not do anything.
Any tip will be greatly appreciated. Thank You.
client.ovpn file:
client
dev tun
proto udp
port 80
remote thisis.remotevpn.net
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert thesecret.crt
key thesecret.key
ns-cert-type server
cipher AES-256-CBC
comp-lzo
verb 3
openvpn output
theUser@t43:~/VPN$ sudo openvpn --config vpn.ovpn
[sudo] password for theUser:
Mon Aug 27 10:33:20 2012 OpenVPN 2.1.3 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Feb 20 2012
Mon Aug 27 10:33:20 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Aug 27 10:33:20 2012 WARNING: file 'thesecret.key' is group or others accessible
Mon Aug 27 10:33:20 2012 /usr/bin/openssl-vulnkey -q -b 2048 -m <modulus omitted>
Mon Aug 27 10:33:21 2012 LZO compression initialized
Mon Aug 27 10:33:21 2012 Control Channel MTU parms [ L:1560 D:140 EF:40 EB:0 ET:0 EL:0 ]
Mon Aug 27 10:33:21 2012 Socket Buffers: R=[87380->131072] S=[16384->131072]
Mon Aug 27 10:33:21 2012 RESOLVE: NOTE: thisis.remotevpn.net resolves to 7 addresses
Mon Aug 27 10:33:21 2012 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Aug 27 10:33:21 2012 Local Options hash (VER=V4): '958c5492'
Mon Aug 27 10:33:21 2012 Expected Remote Options hash (VER=V4): '79ef4284'
Mon Aug 27 10:33:21 2012 Attempting to establish TCP connection with [AF_INET]XXX.XXX.XXX.XXX:80 [nonblock]
Mon Aug 27 10:33:22 2012 TCP connection established with [AF_INET]XXX.XXX.XXX.XXX:80
Mon Aug 27 10:33:22 2012 TCPv4_CLIENT link local: [undef]
Mon Aug 27 10:33:22 2012 TCPv4_CLIENT link remote: [AF_INET]XXX.XXX.XXX.XXX:80
Mon Aug 27 10:33:23 2012 TLS: Initial packet from [AF_INET]XXX.XXX.XXX.XXX:80, sid=f69d4ef4 cb415c9e
Mon Aug 27 10:33:25 2012 VERIFY OK: depth=1, /C=AE/ST=Dubai/L=Dubai/O=remotevpn_fz_llc/CN=remotevpn_fz_llc_CA/emailAddress=info@remotevpn.net
Mon Aug 27 10:33:25 2012 VERIFY OK: nsCertType=SERVER
Mon Aug 27 10:33:25 2012 VERIFY OK: depth=0, /C=SC/ST=Victoria/L=Victoria/O=remotevpn_Bravotelco_llc/CN=hideip-usa18.remotevpn.net/emailAddress=info@remotevpn.net
Mon Aug 27 10:33:30 2012 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Aug 27 10:33:30 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Aug 27 10:33:30 2012 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Aug 27 10:33:30 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Aug 27 10:33:30 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Aug 27 10:33:30 2012 [hideip-usa18.remotevpn.net] Peer Connection Initiated with [AF_INET]XXX.XXX.XXX.XXX:80
Mon Aug 27 10:33:32 2012 SENT CONTROL [hideip-usa18.remotevpn.net]: 'PUSH_REQUEST' (status=1)
Mon Aug 27 10:33:33 2012 PUSH: Received control message: 'PUSH_REPLY,route 0.0.0.0 0.0.0.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.80.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.80.0.10 10.80.0.9'
Mon Aug 27 10:33:33 2012 OPTIONS IMPORT: timers and/or timeouts modified
Mon Aug 27 10:33:33 2012 OPTIONS IMPORT: --ifconfig/up options modified
Mon Aug 27 10:33:33 2012 OPTIONS IMPORT: route options modified
Mon Aug 27 10:33:33 2012 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon Aug 27 10:33:33 2012 ROUTE default_gateway=192.168.1.1
Mon Aug 27 10:33:33 2012 TUN/TAP device tun0 opened
Mon Aug 27 10:33:33 2012 TUN/TAP TX queue length set to 100
Mon Aug 27 10:33:33 2012 /sbin/ifconfig tun0 10.80.0.10 pointopoint 10.80.0.9 mtu 1500
Mon Aug 27 10:33:33 2012 /sbin/route add -net 199.195.212.106 netmask 255.255.255.255 gw 192.168.1.1
Mon Aug 27 10:33:33 2012 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.80.0.9
Mon Aug 27 10:33:33 2012 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.80.0.9
Mon Aug 27 10:33:33 2012 WARNING: potential route subnet conflict between local LAN [192.168.1.0/255.255.255.0] and remote VPN [0.0.0.0/0.0.0.0]
Mon Aug 27 10:33:33 2012 /sbin/route add -net 0.0.0.0 netmask 0.0.0.0 gw 10.80.0.9
Mon Aug 27 10:33:33 2012 WARNING: potential route subnet conflict between local LAN [10.80.0.0/255.255.255.0] and remote VPN [10.80.0.1/255.255.255.255]
Mon Aug 27 10:33:33 2012 /sbin/route add -net 10.80.0.1 netmask 255.255.255.255 gw 10.80.0.9
Mon Aug 27 10:33:33 2012 Initialization Sequence Completed
Mon Aug 27 11:02:55 2012 [hideip-usa18.remotevpn.net] Inactivity timeout (--ping-restart), restarting
Mon Aug 27 11:02:55 2012 TCP/UDP: Closing socket
Mon Aug 27 11:02:55 2012 SIGUSR1[soft,ping-restart] received, process restarting
Mon Aug 27 11:02:55 2012 Restart pause, 5 second(s)
Mon Aug 27 11:03:00 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Aug 27 11:03:00 2012 Re-using SSL/TLS context
Mon Aug 27 11:03:00 2012 LZO compression initialized
Mon Aug 27 11:03:00 2012 Control Channel MTU parms [ L:1560 D:140 EF:40 EB:0 ET:0 EL:0 ]
Mon Aug 27 11:03:00 2012 Socket Buffers: R=[87380->131072] S=[16384->131072]
Mon Aug 27 11:03:00 2012 RESOLVE: NOTE: thisis.remotevpn.net resolves to 7 addresses
Mon Aug 27 11:03:00 2012 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Aug 27 11:03:00 2012 Local Options hash (VER=V4): '958c5492'
Mon Aug 27 11:03:00 2012 Expected Remote Options hash (VER=V4): '79ef4284'
Mon Aug 27 11:03:00 2012 Attempting to establish TCP connection with [AF_INET]XXX.XXX.XXX.XXX:80 [nonblock]
Mon Aug 27 11:03:10 2012 TCP: connect to [AF_INET]XXX.XXX.XXX.XXX:80 failed, will try again in 5 seconds: Connection timed out
Mon Aug 27 11:03:15 2012 RESOLVE: NOTE: thisis.remotevpn.net resolves to 7 addresses
Mon Aug 27 11:03:25 2012 TCP: connect to [AF_INET]YYY.YYY.YYY.YYY:80 failed, will try again in 5 seconds: Connection timed out
Mon Aug 27 11:03:30 2012 RESOLVE: NOTE: thisis.remotevpn.net resolves to 7 addresses
Mon Aug 27 11:03:40 2012 TCP: connect to [AF_INET]XXX.XXX.XXX.XXX:80 failed, will try again in 5 seconds: Connection timed out
Mon Aug 27 11:03:45 2012 RESOLVE: NOTE: thisis.remotevpn.net resolves to 7 addresses
route before ovenvpn:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.1.0 * 255.255.255.0 U 0 0 0 eth0
default 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
route during ovenvpn:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.8.0.1 10.8.0.17 255.255.255.255 UGH 0 0 0 tun0
10.8.0.17 * 255.255.255.255 UH 0 0 0 tun0
108.61.74.99.ch 192.168.101.1 255.255.255.255 UGH 0 0 0 eth0
192.168.101.0 * 255.255.255.0 U 0 0 0 eth0
default 10.8.0.17 128.0.0.0 UG 0 0 0 tun0
128.0.0.0 10.8.0.17 128.0.0.0 UG 0 0 0 tun0
default 10.8.0.17 0.0.0.0 UG 0 0 0 tun0
default 192.168.101.1 0.0.0.0 UG 0 0 0 eth0
