Guys, I have been using OpenVPN for more than 5 years already, I guess, I'm not a complete noob ;-) But, I’m exhausted troubleshooting this one - need your help. This setup was working fine since Jan this year. I have not been using it for about 2 or 3 months. It doesn’t work now, below my config and logs. IMO, some info is irrelevant in bridge mode, but I’m posting anyway, just in case. I’ve striped tons of lines from logs using: [code]type openvpn.log | find /v "UDPv4 READ" | find /v "UDPv4 WRITE" | find /v "TUN READ" | find /v "TUN WRITE" > server.log[/code] Basically, the question is: what else do I need to check? Something (probably) wrong I see: / # iptables -v --list | grep 'Chain\|pkts\|eth3\|tap0\|br0' Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination [b]0 0[/b] ACCEPT all -- tap0 any anywhere anywhere [b]88 11587[/b] ACCEPT udp -- eth3 any anywhere anywhere udp dpt:1194 There are pockets flows on dpt:1194 – pkts/bytes counts keep growing. But there is no traffic on tap0 interface… Again, tons of successful "UDPv4 READ", "UDPv4 WRITE", "TUN READ", "TUN WRITE" in both server and client logs. In client.log: Fri Sep 07 16:41:36 2012 us=203000 [b]TEST ROUTES: 0/0 succeeded len=-1 ret=1 a=0 u/d=up[/b] No routes are succeeded? Does it supposed to be like this for bridge mode? [b]session.log[/b] / # ip link | grep 'eth2\|tap0\|br0' 1: eth2: mtu 1500 qdisc pfifo_fast qlen 1000 12: br0: mtu 1500 qdisc pfifo_fast qlen 1000 / # iptables -v --list | grep 'Chain\|pkts\|eth3\|tap0\|br0' Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 11954 3204K ACCEPT all -- br0 any anywhere anywhere Chain FORWARD (policy ACCEPT 5 packets, 280 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- br0 br0 anywhere anywhere 0 0 DROP all -- !br0 eth3 anywhere anywhere 0 0 DROP all -- any br0 anywhere anywhere Chain OUTPUT (policy ACCEPT 26 packets, 3742 bytes) pkts bytes target prot opt in out source destination Chain UPNP (1 references) pkts bytes target prot opt in out source destination Chain doslimit (0 references) pkts bytes target prot opt in out source destination Chain logaccept (0 references) pkts bytes target prot opt in out source destination Chain logdrop (0 references) pkts bytes target prot opt in out source destination Chain maclist (0 references) pkts bytes target prot opt in out source destination / # grep -vE '^#|^;|^$' /opt/etc/openvpn/openvpn.conf dh /opt/etc/openvpn/dh.pem ca /opt/etc/openvpn/ca.crt cert /opt/etc/openvpn/cert.pem key /opt/etc/openvpn/key.pem tls-auth /opt/etc/openvpn/ta.key 0 keepalive 10 120 log /opt/var/log/openvpn.log status /opt/var/log/openvpn.stat ifconfig-pool-persist /opt/var/log/ifconfig-pool-persist.txt tls-server port 1194 proto udp cipher bf-cbc auth sha1 mtu-disc yes topology subnet client-to-client server-bridge 10.0.0.1 255.255.255.0 10.0.0.201 10.0.0.210 dev tap0 / # netstat -nr Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 0.0.0.0 A.B.C.1 0.0.0.0 UG 0 0 0 eth3 10.0.0.0 0.0.0.0 255.255.255.0 U 0 0 0 br0 A.B.C.0 0.0.0.0 255.255.252.0 U 0 0 0 eth3 A.B.C.1 0.0.0.0 255.255.255.255 UH 0 0 0 eth3 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo / # cat /proc/sys/net/ipv4/ip_forward 1 / # ip route show A.B.C.1 dev eth3 10.0.0.0/24 dev br0 src 10.0.0.1 A.B.C.0/22 dev eth3 src 74.90.229.5 127.0.0.0/8 dev lo default via A.B.C.1 dev eth3 / # cat /opt/etc/init.d/S20openvpn #!/bin/sh ################################################################################ ## ## Invoking process name daemon=/opt/sbin/openvpn ## OpenVPN configuration config_file=/opt/etc/openvpn/openvpn.conf ## Temp directory for temp files temp_dir=/opt/tmp/openvpn ## Process priority (0-normal, 19-lowest) priority=5 ## ################################################################################ do_start() { ## Make sure an instance of daemon is not running if [ -n "`pidof ${daemon}`" ] ; then echo -e "\v\t\033[1;37;41m ${daemon##*/} is already running! \033[0m\v" exit 1 fi echo -en "\v\t\033[1;37;44m Starting ${daemon##*/} \033[0m" ## Create tmp direcrory if doesn't exist [ -d ${temp_dir} ] || mkdir ${temp_dir} [ -d /dev/net ] || mkdir /dev/net [ -L /dev/net/tun ] || ln -s /dev/tun /dev/net ## Make sure IP forwarding is enabled [ `cat /proc/sys/net/ipv4/ip_forward` -ne 1 ] && \ /bin/sh 'echo 1 > /proc/sys/net/ipv4/ip_forward' ${daemon} --daemon \ --nice ${priority} \ --cd ${config_file%/*} \ --config ${config_file##*/} \ --tmp-dir ${temp_dir} \ --verb 6 --management 10.0.0.1 5002 # --log-append /opt/var/log/openvpn.log \ # --status /opt/var/log/openvpn.stat \ wait ## Check if port is opened. Update iptables if not port=$(sed -n 's/^port[ \t]*//p' "${config_file}") iptables -vL | grep -q dpt:${port} || ${config_file%/*}/firewall.sh up >/dev/null 2>&1 wait if [ $? -eq 0 -a -n "`pidof ${daemon##*/}`" ] ; then echo -e "\033[1;37;44m [ OK ] \033[0m\v" else echo -e "\033[1;37;41m [ FAILED ] \033[0m\v" fi } do_stop() { ## Make sure an instance of daemon is running if [ -z "`pidof ${daemon##*/}`" ] ; then echo -e "\v\t\033[1;37;41m ${daemon##*/} is not running! \033[0m\v" exit 1 fi echo -en "\v\t\033[1;37;44m Stopping ${daemon##*/} \033[0m" ${config_file%/*}/firewall.sh down >/dev/null 2>&1 killall -15 ${daemon##*/} 2>/dev/null ; sleep 1 ## Wait max 20 seconds if [ -n "`pidof ${daemon##*/}`" ] ; then echo -en "\t Waiting" ; i=20 ; echo -ne "\r" while [ -n "`pidof ${daemon##*/}`" ] && [ $i -ge 0 ] ; do echo -ne "\r[ $i ] " ; i=$(( $i - 1 )) ; sleep 1 done echo -e "\n" fi if [ -n "`pidof ${daemon##*/}`" ] ; then ## Kill the process unconditinally kill -9 `pidof ${daemon##*/}` >/dev/null 2>&1 echo -e "\r\t\t\t\t\033[1;37;41m [ KILLED ] by timeout! \033[0m\r\n" logger -t "${daemon##*/}" "Was killed by timeout!" else echo -e "\033[1;37;44m [ OK ] \033[0m\r\n" fi } do_restart() { # Let's check daemon is running if [ -z "`pidof ${daemon##*/}`" ] ; then echo -e "\033[1;37;41m $daemon is not running! \033[0m\v" do_start else echo -e "\v\t\033[1;37;44m Trying to restart ${daemon##*/} \033[0m" do_stop sleep 1 do_start fi } case "$1" in start) do_start ;; stop) do_stop ;; restart) do_restart ;; *) echo -e "\v\t\033[1;37;44m Usage: $0 { start | stop | restart } \033[0m\v" exit 1 ;; esac exit $? / # cat /opt/etc/openvpn/firewall.sh #!/bin/sh ## Custom firewall script for openvpn server. openvpn_cfg=/opt/etc/openvpn/openvpn.conf ; [ -f ${openvpn_cfg} ] || exit 1 ## read config from file wan_iface=$(nvram get wan_ifname) lan_iface=$(nvram get lan_ifname) proto=$(sed -n 's/^proto[ \t]*//p' "${openvpn_cfg}") port=$(sed -n 's/^port[ \t]*//p' "${openvpn_cfg}") cidr=$(/opt/bin/snh `sed -n 's/^server[ \t]*//p' "${openvpn_cfg}" | sed 's/.*[ \t]//g'`) network_ip=$(sed -n 's/^server[ \t]*//p' "${openvpn_cfg}" | sed 's/[ \t].*//g') dev=$(sed -n 's/^dev[ \t]*//p' "${openvpn_cfg}") do_up() { # BR=$1 # DEV=$2 # MTU=$3 ip link set "tap0" up promisc on mtu "1500" brctl addif br0 tap0 # brctl addif br0 tap0 # ifconfig tap0 0.0.0.0 promisc up iptables -I INPUT -i ${wan_iface} -p ${proto} --dport ${port} -j ACCEPT iptables -I INPUT -i ${dev} -j ACCEPT iptables -I FORWARD -i ${dev} -j ACCEPT # iptables -t nat -I POSTROUTING -s ${network_ip}/${cidr} -o ${lan_iface} -j MASQUERADE } do_down() { # BR=$1 # DEV=$2 brctl delif br0 tap0 ip link set "tap0" down iptables -D INPUT -i ${wan_iface} -p ${proto} --dport ${port} -j ACCEPT iptables -D INPUT -i ${dev} -j ACCEPT iptables -D FORWARD -i ${dev} -j ACCEPT # iptables -t nat -D POSTROUTING -s ${network_ip}/${cidr} -o ${lan_iface} -j MASQUERADE } case "$1" in up) do_up ;; down) do_down ;; *) echo -e "\v\tOpenVPN firewall script." echo -e "\tUsage: $0 { up | down }\v" exit 1 ;; esac exit $? / # /opt/etc/init.d/S20openvpn start Starting openvpn [ OK ] / # ip link | grep 'eth2\|tap0\|br0' 1: eth2: mtu 1500 qdisc pfifo_fast qlen 1000 12: br0: mtu 1500 qdisc pfifo_fast qlen 1000 36: tap0: mtu 1500 qdisc noop qlen 100 / # iptables -v --list | grep 'Chain\|pkts\|eth3\|tap0\|br0' Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- tap0 any anywhere anywhere 0 0 ACCEPT udp -- eth3 any anywhere anywhere udp dpt:1194 12577 3370K ACCEPT all -- br0 any anywhere anywhere Chain FORWARD (policy ACCEPT 2 packets, 121 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- tap0 any anywhere anywhere 0 0 ACCEPT all -- br0 br0 anywhere anywhere 0 0 DROP all -- !br0 eth3 anywhere anywhere 0 0 DROP all -- any br0 anywhere anywhere Chain OUTPUT (policy ACCEPT 31 packets, 8809 bytes) pkts bytes target prot opt in out source destination Chain UPNP (1 references) pkts bytes target prot opt in out source destination Chain doslimit (0 references) pkts bytes target prot opt in out source destination Chain logaccept (0 references) pkts bytes target prot opt in out source destination Chain logdrop (0 references) pkts bytes target prot opt in out source destination Chain maclist (0 references) pkts bytes target prot opt in out source destination / # netstat -nr Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 0.0.0.0 A.B.C.1 0.0.0.0 UG 0 0 0 eth3 10.0.0.0 0.0.0.0 255.255.255.0 U 0 0 0 br0 A.B.C.0 0.0.0.0 255.255.252.0 U 0 0 0 eth3 A.B.C.1 0.0.0.0 255.255.255.255 UH 0 0 0 eth3 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo / # ip route show A.B.C.1 dev eth3 10.0.0.0/24 dev br0 src 10.0.0.1 A.B.C.0/22 dev eth3 src 74.90.229.5 127.0.0.0/8 dev lo default via A.B.C.1 dev eth3 / # brctl show bridge name bridge id STP enabled interfaces br0 8000.20cf30b8134d yes eth2 rai0 tap0 / # ping 10.0.0.201 PING 10.0.0.201 (10.0.0.201): 56 data bytes ^C --- 10.0.0.201 ping statistics --- 4 packets transmitted, 0 packets received, 100% packet loss / # arp a (10.0.0.2) at 00:1E:C9:36:AA:BB [ether] on br0 ? (10.0.0.201) at on br0 a.b.c.net (A.B.C.1) at 44:D3:CA:XX:YY:ZZ [ether] on eth3 [b]server.log[/b] Current Parameter Settings: config = 'openvpn.conf' mode = 1 persist_config = DISABLED persist_mode = 1 show_ciphers = DISABLED show_digests = DISABLED show_engines = DISABLED genkey = DISABLED key_pass_file = '[UNDEF]' show_tls_ciphers = DISABLED Connection profiles [default]: proto = udp local = '[UNDEF]' local_port = 1194 remote = '[UNDEF]' remote_port = 1194 remote_float = DISABLED bind_defined = DISABLED bind_local = ENABLED connect_retry_seconds = 5 connect_timeout = 10 connect_retry_max = 0 socks_proxy_server = '[UNDEF]' socks_proxy_port = 0 socks_proxy_retry = DISABLED Connection profiles END remote_random = DISABLED ipchange = '[UNDEF]' dev = 'tap0' dev_type = '[UNDEF]' dev_node = '[UNDEF]' lladdr = '[UNDEF]' topology = 3 tun_ipv6 = DISABLED ifconfig_local = '[UNDEF]' ifconfig_remote_netmask = '[UNDEF]' ifconfig_noexec = DISABLED ifconfig_nowarn = DISABLED shaper = 0 tun_mtu = 1500 tun_mtu_defined = ENABLED link_mtu = 1500 link_mtu_defined = DISABLED tun_mtu_extra = 32 tun_mtu_extra_defined = ENABLED fragment = 0 mtu_discover_type = 2 mtu_test = 0 mlock = DISABLED keepalive_ping = 10 keepalive_timeout = 120 inactivity_timeout = 0 ping_send_timeout = 10 ping_rec_timeout = 240 ping_rec_timeout_action = 2 ping_timer_remote = DISABLED remap_sigusr1 = 0 explicit_exit_notification = 0 persist_tun = DISABLED persist_local_ip = DISABLED persist_remote_ip = DISABLED persist_key = DISABLED mssfix = 1450 passtos = DISABLED resolve_retry_seconds = 1000000000 username = '[UNDEF]' groupname = '[UNDEF]' chroot_dir = '[UNDEF]' cd_dir = '/opt/etc/openvpn' writepid = '[UNDEF]' up_script = '[UNDEF]' down_script = '[UNDEF]' down_pre = DISABLED up_restart = DISABLED up_delay = DISABLED daemon = ENABLED inetd = 0 log = ENABLED suppress_timestamps = DISABLED nice = 5 verbosity = 6 mute = 0 gremlin = 0 status_file = '/opt/var/log/openvpn.stat' status_file_version = 1 status_file_update_freq = 60 occ = ENABLED rcvbuf = 65536 sndbuf = 65536 sockflags = 0 fast_io = DISABLED lzo = 0 route_script = '[UNDEF]' route_default_gateway = '[UNDEF]' route_default_metric = 0 route_noexec = DISABLED route_delay = 0 route_delay_window = 30 route_delay_defined = DISABLED route_nopull = DISABLED route_gateway_via_dhcp = DISABLED max_routes = 100 allow_pull_fqdn = DISABLED management_addr = '10.0.0.1' management_port = 5002 management_user_pass = '[UNDEF]' management_log_history_cache = 250 management_echo_buffer_size = 100 management_write_peer_info_file = '[UNDEF]' management_client_user = '[UNDEF]' management_client_group = '[UNDEF]' management_flags = 0 shared_secret_file = '[UNDEF]' key_direction = 1 ciphername_defined = ENABLED ciphername = 'bf-cbc' authname_defined = ENABLED authname = 'sha1' prng_hash = 'SHA1' prng_nonce_secret_len = 16 keysize = 0 engine = DISABLED replay = ENABLED mute_replay_warnings = DISABLED replay_window = 64 replay_time = 15 packet_id_file = '[UNDEF]' use_iv = ENABLED test_crypto = DISABLED tls_server = ENABLED tls_client = DISABLED key_method = 2 ca_file = '/opt/etc/openvpn/ca.crt' ca_path = '[UNDEF]' dh_file = '/opt/etc/openvpn/dh.pem' cert_file = '/opt/etc/openvpn/cert.pem' priv_key_file = '/opt/etc/openvpn/key.pem' pkcs12_file = '[UNDEF]' cipher_list = '[UNDEF]' tls_verify = '[UNDEF]' tls_export_cert = '[UNDEF]' tls_remote = '[UNDEF]' crl_file = '[UNDEF]' ns_cert_type = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_eku = '[UNDEF]' tls_timeout = 2 renegotiate_bytes = 0 renegotiate_packets = 0 renegotiate_seconds = 3600 handshake_window = 60 transition_window = 3600 single_session = DISABLED push_peer_info = DISABLED tls_exit = DISABLED tls_auth_file = '/opt/etc/openvpn/ta.key' server_network = 0.0.0.0 server_netmask = 0.0.0.0 server_bridge_ip = 10.0.0.1 server_bridge_netmask = 255.255.255.0 server_bridge_pool_start = 10.0.0.201 server_bridge_pool_end = 10.0.0.210 push_entry = 'route-gateway 10.0.0.1' push_entry = 'ping 10' push_entry = 'ping-restart 120' ifconfig_pool_defined = ENABLED ifconfig_pool_start = 10.0.0.201 ifconfig_pool_end = 10.0.0.210 ifconfig_pool_netmask = 255.255.255.0 ifconfig_pool_persist_filename = '/opt/var/log/ifconfig-pool-persist.txt' ifconfig_pool_persist_refresh_freq = 600 n_bcast_buf = 256 tcp_queue_limit = 64 real_hash_size = 256 virtual_hash_size = 256 client_connect_script = '[UNDEF]' learn_address_script = '[UNDEF]' client_disconnect_script = '[UNDEF]' client_config_dir = '[UNDEF]' ccd_exclusive = DISABLED tmp_dir = '/opt/tmp/openvpn' push_ifconfig_defined = DISABLED push_ifconfig_local = 0.0.0.0 push_ifconfig_remote_netmask = 0.0.0.0 enable_c2c = ENABLED duplicate_cn = DISABLED cf_max = 0 cf_per = 0 max_clients = 1024 max_routes_per_client = 256 auth_user_pass_verify_script = '[UNDEF]' auth_user_pass_verify_script_via_file = DISABLED ssl_flags = 0 port_share_host = '[UNDEF]' port_share_port = 0 client = DISABLED pull = DISABLED auth_user_pass_file = '[UNDEF]' OpenVPN 2.2.2 mipsel-linux [SSL] [LZO2] [EPOLL] [eurephia] built on Feb 29 2012 MANAGEMENT: TCP Socket listening on 10.0.0.1:5002 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables Diffie-Hellman initialized with 2048 bit key Control Channel Authentication: using '/opt/etc/openvpn/ta.key' as a OpenVPN static key file Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication TLS-Auth MTU parms [ L:1573 D:166 EF:66 EB:0 ET:0 EL:0 ] Socket Buffers: R=[110592->131072] S=[110592->131072] TUN/TAP device tap0 opened TUN/TAP TX queue length set to 100 Data Channel MTU parms [ L:1573 D:1450 EF:41 EB:4 ET:32 EL:0 ] nice 5 succeeded UDPv4 link local (bound): [undef]:1194 UDPv4 link remote: [undef] MULTI: multi_init called, r=256 v=256 IFCONFIG POOL: base=10.0.0.201 size=10 IFCONFIG POOL LIST work,10.0.0.201 Initialization Sequence Completed MULTI: multi_create_instance called [client-external-ip-nated]:62866 Re-using SSL/TLS context [client-external-ip-nated]:62866 Control Channel MTU parms [ L:1573 D:166 EF:66 EB:0 ET:0 EL:0 ] [client-external-ip-nated]:62866 Data Channel MTU parms [ L:1573 D:1450 EF:41 EB:4 ET:32 EL:0 ] [client-external-ip-nated]:62866 Local Options String: 'V4,dev-type tap,link-mtu 1573,tun-mtu 1532,proto UDPv4,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server' [client-external-ip-nated]:62866 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1573,tun-mtu 1532,proto UDPv4,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client' [client-external-ip-nated]:62866 Local Options hash (VER=V4): '47de3ccc' [client-external-ip-nated]:62866 Expected Remote Options hash (VER=V4): '1a647362' [client-external-ip-nated]:62866 TLS: Initial packet from [client-external-ip-nated]:62866, sid=cf34057b 72de882b [client-external-ip-nated]:62866 VERIFY OK: depth=1, /CN=CA [client-external-ip-nated]:62866 VERIFY OK: depth=0, /CN=work [client-external-ip-nated]:62866 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key [client-external-ip-nated]:62866 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication [client-external-ip-nated]:62866 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key [client-external-ip-nated]:62866 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication [client-external-ip-nated]:62866 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA [client-external-ip-nated]:62866 [work] Peer Connection Initiated with [client-external-ip-nated]:62866 work/[client-external-ip-nated]:62866 PUSH: Received control message: 'PUSH_REQUEST' work/[client-external-ip-nated]:62866 SENT CONTROL [work]: 'PUSH_REPLY,route-gateway 10.0.0.1,ping 10,ping-restart 120,ifconfig 10.0.0.201 255.255.255.0' (status=1) work/[client-external-ip-nated]:62866 MULTI: Learn: 00:ff:b0:a4:0c:34 -> work/[client-external-ip-nated]:62866 event_wait : Interrupted system call (code=4) TCP/UDP: Closing socket Closing TUN/TAP interface SIGTERM[hard,] received, process exiting [b]client.log[/b] Current Parameter Settings: config = 'bridge.config' mode = 0 show_ciphers = DISABLED show_digests = DISABLED show_engines = DISABLED genkey = DISABLED key_pass_file = '[UNDEF]' show_tls_ciphers = DISABLED Connection profiles [default]: proto = udp local = '[UNDEF]' local_port = 0 remote = '[server-external-ip]' remote_port = 1194 remote_float = ENABLED bind_defined = DISABLED bind_local = DISABLED connect_retry_seconds = 5 connect_timeout = 10 connect_retry_max = 0 socks_proxy_server = '[UNDEF]' socks_proxy_port = 0 socks_proxy_retry = DISABLED Connection profiles END remote_random = DISABLED ipchange = '[UNDEF]' dev = 'tap0' dev_type = '[UNDEF]' dev_node = '[UNDEF]' lladdr = '[UNDEF]' topology = 1 tun_ipv6 = DISABLED ifconfig_local = '[UNDEF]' ifconfig_remote_netmask = '[UNDEF]' ifconfig_noexec = DISABLED ifconfig_nowarn = DISABLED shaper = 0 tun_mtu = 1500 tun_mtu_defined = ENABLED link_mtu = 1500 link_mtu_defined = DISABLED tun_mtu_extra = 32 tun_mtu_extra_defined = ENABLED fragment = 0 mtu_discover_type = -1 mtu_test = 0 mlock = DISABLED keepalive_ping = 0 keepalive_timeout = 0 inactivity_timeout = 0 ping_send_timeout = 0 ping_rec_timeout = 0 ping_rec_timeout_action = 0 ping_timer_remote = DISABLED remap_sigusr1 = 0 explicit_exit_notification = 0 persist_tun = ENABLED persist_local_ip = DISABLED persist_remote_ip = DISABLED persist_key = ENABLED mssfix = 1450 resolve_retry_seconds = 1000000000 username = '[UNDEF]' groupname = '[UNDEF]' chroot_dir = '[UNDEF]' cd_dir = '[UNDEF]' writepid = '[UNDEF]' up_script = '[UNDEF]' down_script = '[UNDEF]' down_pre = DISABLED up_restart = DISABLED up_delay = DISABLED daemon = DISABLED inetd = 0 log = ENABLED suppress_timestamps = DISABLED nice = 0 verbosity = 6 mute = 0 gremlin = 0 status_file = '[UNDEF]' status_file_version = 1 status_file_update_freq = 60 occ = ENABLED rcvbuf = 0 sndbuf = 0 sockflags = 0 fast_io = DISABLED lzo = 0 route_script = '[UNDEF]' route_default_gateway = '[UNDEF]' route_default_metric = 0 route_noexec = DISABLED route_delay = 5 route_delay_window = 30 route_delay_defined = ENABLED route_nopull = DISABLED route_gateway_via_dhcp = DISABLED max_routes = 100 allow_pull_fqdn = DISABLED management_addr = '[UNDEF]' management_port = 0 management_user_pass = '[UNDEF]' management_log_history_cache = 250 management_echo_buffer_size = 100 management_write_peer_info_file = '[UNDEF]' management_client_user = '[UNDEF]' management_client_group = '[UNDEF]' management_flags = 0 shared_secret_file = '[UNDEF]' key_direction = 2 ciphername_defined = ENABLED ciphername = 'BF-CBC' authname_defined = ENABLED authname = 'SHA1' prng_hash = 'SHA1' prng_nonce_secret_len = 16 keysize = 0 engine = DISABLED replay = ENABLED mute_replay_warnings = DISABLED replay_window = 64 replay_time = 15 packet_id_file = '[UNDEF]' use_iv = ENABLED test_crypto = DISABLED tls_server = DISABLED tls_client = ENABLED key_method = 2 ca_file = 'ca_new.crt' ca_path = '[UNDEF]' dh_file = '[UNDEF]' cert_file = 'work.crt' priv_key_file = 'work.key' pkcs12_file = '[UNDEF]' cryptoapi_cert = '[UNDEF]' cipher_list = '[UNDEF]' tls_verify = '[UNDEF]' tls_export_cert = '[UNDEF]' tls_remote = '[UNDEF]' crl_file = '[UNDEF]' ns_cert_type = 0 remote_cert_ku[i] = 160 remote_cert_ku[i] = 136 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_eku = 'TLS Web Server Authentication' tls_timeout = 2 renegotiate_bytes = 0 renegotiate_packets = 0 renegotiate_seconds = 3600 handshake_window = 60 transition_window = 3600 single_session = DISABLED push_peer_info = DISABLED tls_exit = DISABLED tls_auth_file = 'ta.key' pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_pin_cache_period = -1 pkcs11_id = '[UNDEF]' pkcs11_id_management = DISABLED server_network = 0.0.0.0 server_netmask = 0.0.0.0 server_bridge_ip = 0.0.0.0 server_bridge_netmask = 0.0.0.0 server_bridge_pool_start = 0.0.0.0 server_bridge_pool_end = 0.0.0.0 ifconfig_pool_defined = DISABLED ifconfig_pool_start = 0.0.0.0 ifconfig_pool_end = 0.0.0.0 ifconfig_pool_netmask = 0.0.0.0 ifconfig_pool_persist_filename = '[UNDEF]' ifconfig_pool_persist_refresh_freq = 600 n_bcast_buf = 256 tcp_queue_limit = 64 real_hash_size = 256 virtual_hash_size = 256 client_connect_script = '[UNDEF]' learn_address_script = '[UNDEF]' client_disconnect_script = '[UNDEF]' client_config_dir = '[UNDEF]' ccd_exclusive = DISABLED tmp_dir = 'C:\Users\OKUKAR~1\AppData\Local\Temp\' push_ifconfig_defined = DISABLED push_ifconfig_local = 0.0.0.0 push_ifconfig_remote_netmask = 0.0.0.0 enable_c2c = DISABLED duplicate_cn = DISABLED cf_max = 0 cf_per = 0 max_clients = 1024 max_routes_per_client = 256 auth_user_pass_verify_script = '[UNDEF]' auth_user_pass_verify_script_via_file = DISABLED ssl_flags = 0 client = ENABLED pull = ENABLED auth_user_pass_file = '[UNDEF]' show_net_up = DISABLED route_method = 0 ip_win32_defined = DISABLED ip_win32_type = 3 dhcp_masq_offset = 0 dhcp_lease_time = 31536000 tap_sleep = 0 dhcp_options = DISABLED dhcp_renew = DISABLED dhcp_pre_release = DISABLED dhcp_release = DISABLED domain = '[UNDEF]' netbios_scope = '[UNDEF]' netbios_node_type = 0 disable_nbt = DISABLED OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables Control Channel Authentication: using 'ta.key' as a OpenVPN static key file Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Control Channel MTU parms [ L:1573 D:166 EF:66 EB:0 ET:0 EL:0 ] Socket Buffers: R=[8192->8192] S=[8192->8192] Data Channel MTU parms [ L:1573 D:1450 EF:41 EB:4 ET:32 EL:0 ] Local Options String: 'V4,dev-type tap,link-mtu 1573,tun-mtu 1532,proto UDPv4,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client' Expected Remote Options String: 'V4,dev-type tap,link-mtu 1573,tun-mtu 1532,proto UDPv4,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server' Local Options hash (VER=V4): '1a647362' Expected Remote Options hash (VER=V4): '47de3ccc' UDPv4 link local: [undef] UDPv4 link remote: [server-external-ip]:1194 TLS: Initial packet from [server-external-ip]:1194, sid=102308b0 6b3a930d VERIFY OK: depth=1, /CN=CA Validating certificate key usage ++ Certificate has key usage 00a0, expects 00a0 VERIFY KU OK Validating certificate extended key usage ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication VERIFY EKU OK VERIFY OK: depth=0, /CN=asus Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA [asus] Peer Connection Initiated with [server-external-ip]:1194 SENT CONTROL [asus]: 'PUSH_REQUEST' (status=1) PUSH: Received control message: 'PUSH_REPLY,route-gateway 10.0.0.1,ping 10,ping-restart 120,ifconfig 10.0.0.201 255.255.255.0' OPTIONS IMPORT: timers and/or timeouts modified OPTIONS IMPORT: --ifconfig/up options modified OPTIONS IMPORT: route-related options modified TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{B0A40C34-B1AD-435B-9FB1-06652A48C27D}.tap TAP-Win32 Driver Version 9.9 TAP-Win32 MTU=1500 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.0.0.201/255.255.255.0 on interface {B0A40C34-B1AD-435B-9FB1-06652A48C27D} [DHCP-serv: 10.0.0.0, lease-time: 31536000] Successful ARP Flush on interface [16] {B0A40C34-B1AD-435B-9FB1-06652A48C27D} TEST ROUTES: 0/0 succeeded len=-1 ret=1 a=0 u/d=up Initialization Sequence Completed [b]client.config[/b] >ipconfig /all Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : TAP-Win32 Adapter V9 Physical Address. . . . . . . . . : 00-FF-B0-A4-0C-34 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : 10.0.0.201(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Friday, September 07, 2012 4:41:31 PM Lease Expires . . . . . . . . . . : Saturday, September 07, 2013 4:41:31 PM Default Gateway . . . . . . . . . : DHCP Server . . . . . . . . . . . : 10.0.0.0 NetBIOS over Tcpip. . . . . . . . : Disabled >route -4 print =========================================================================== Interface List 16...00 ff b0 a4 0c 34 ......TAP-Win32 Adapter V9 15...00 15 5d 5f 43 00 ......Microsoft Virtual Machine Bus Network Adapter #2 1...........................Software Loopback Interface 1 11...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter 10...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface 12...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2 =========================================================================== IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.XX.6 192.168.XX.YY 5 10.0.0.0 255.255.255.0 On-link 10.0.0.201 286 10.0.0.201 255.255.255.255 On-link 10.0.0.201 286 10.0.0.255 255.255.255.255 On-link 10.0.0.201 286 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 192.168.XX.0 255.255.240.0 On-link 192.168.XX.YY 261 192.168.XX.YY 255.255.255.255 On-link 192.168.XX.YY 261 192.168.79.255 255.255.255.255 On-link 192.168.XX.YY 261 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 192.168.XX.YY 261 224.0.0.0 240.0.0.0 On-link 10.0.0.201 286 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 192.168.XX.YY 261 255.255.255.255 255.255.255.255 On-link 10.0.0.201 286 =========================================================================== Persistent Routes: None =========================================================================== >tracert -d 10.0.0.2 Tracing route to 10.0.0.2 over a maximum of 30 hops [b] 1 10.0.0.201 reports: Destination host unreachable.[/b] Trace complete. >arp -a Interface: 10.0.0.201 --- 0x10 Internet Address Physical Address Type [b] 10.0.0.255 ff-ff-ff-ff-ff-ff static [/b] 224.0.0.22 01-00-5e-00-00-16 static 224.0.0.251 01-00-5e-00-00-fb static 224.0.0.252 01-00-5e-00-00-fc static 239.255.255.250 01-00-5e-7f-ff-fa static 255.255.255.255 ff-ff-ff-ff-ff-ff static

Ouch. I, guess, I’m complete idiot. :oops: I set up another client and both clients can communicate easily, but not with the server. It turned out, server tap0 was not up, and it was clearly visible from "ip link" output: ip link | grep 'eth2\|tap0\|br0' 1: eth2: mtu 1500 qdisc pfifo_fast qlen 1000 12: br0: mtu 1500 qdisc pfifo_fast qlen 1000 36: tap0: mtu 1500 qdisc noop qlen 100 It was due to "unsupported" parameter "promisc" in: ip link set "tap0" up [b]promisc on[/b] mtu "1500" Well, my bad, obviously. I didn’t even remember when I’ve changed it and why didn’t test after.

OpenVPN bridge mode – connects but no traffic flows...

Apokrif

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

Apokrif

I was wondering, if I need to post the question in another forum...
Did I put too much info, nobody is able to swallow that much at once?
What kind of troubleshooting steps I can try?

Apokrif

Ouch.
I, guess, I’m complete idiot. :oops:
I set up another client and both clients can communicate easily, but not with the server.
It turned out, server tap0 was not up, and it was clearly visible from "ip link" output:
ip link | grep 'eth2\|tap0\|br0'
1: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
12: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
36: tap0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop qlen 100

It was due to "unsupported" parameter "promisc" in:
ip link set "tap0" up promisc on mtu "1500"
Well, my bad, obviously.
I didn’t even remember when I’ve changed it and why didn’t test after.

Apokrif

Interesting!
I’ve found what was wrong and posted detailed explanation couple days ago, but it didn’t show up still.
I guess, my post is waiting to mod approval still.
I made another post about the same time about "mtu-test" results and it didn’t show up either.
Let’s see, if this one will get through…

Mimiko

You are giving a tracert to 10.0.0.2. I suppose it is in server's LAN. But 10.0.0.2 is online? Does it accept igmp?

Also, re-verify your scripts which tampers with firewall on server.