Folks
I am trying to configure a site to site openvpn setup where the client side is ruing on a dd-wrt box and the server side on a smoothwall. I believe I ma pretty close to have it working but there is obviously still something missing...
So the client is using
OpenVPN 2.2.1 mips-linux [SSL] [LZO2] built on Mar 19 2012
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
$ ./configure --host=mips-linux CPPFLAGS=-I../lzo/include -I../openssl/include -L../lzo -L../openssl -L../lzo/src/.libs --enable-pthread --disable-plugins --disable-debug --enable-password-save --enable-management --enable-lzo --enable-server --enable-multihome CFLAGS=-Os -pipe -mips32r2 -mtune=mips32r2 -msoft-float -fno-caller-saves LDFLAGS=-L../openssl -L../lzo -L../lzo/src/.libs -ldl ac_cv_func_epoll_create=no host_alias=mips-linux CC=mips-linux-uclibc-gcc --no-create --no-recursion
Compile time defines: ENABLE_CLIENT_SERVER ENABLE_FRAGMENT ENABLE_HTTP_PROXY ENABLE_MANAGEMENT ENABLE_MULTIHOME ENABLE_PASSWORD_SAVE ENABLE_PORT_SHARE ENABLE_SOCKS USE_CRYPTO USE_LZO USE_SSL
whereas server is using
smoothwall2 (root) ~ $ openvpn --version
OpenVPN 2.2.2 i686-pc-linux-gnu [SSL] [LZO2] [EPOLL] [eurephia] built on Jan 30 2012
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
$ ./configure --prefix=/usr --with-lzo-headers=/usr/local/include --with-lzo-lib=/usr/local/lib --with-ssl-headers=/usr/ssl/include --with-ssl-lib=/usr/ssl/lib --enable-pthread
Compile time defines: ENABLE_CLIENT_SERVER ENABLE_DEBUG ENABLE_EUREPHIA ENABLE_FRAGMENT ENABLE_HTTP_PROXY ENABLE_MANAGEMENT ENABLE_MULTIHOME ENABLE_PORT_SHARE ENABLE_SOCKS USE_CRYPTO USE_LIBDL USE_LZO USE_SSL
smoothwall2 (root) ~ $
here is the client config
ca /tmp/openvpncl/ca.crt
cert /tmp/openvpncl/client.crt
key /tmp/openvpncl/client.key
management 127.0.0.1 5001
management-log-cache 50
verb 4
mute 5
log-append /var/log/openvpncl
writepid /var/log/openvpncl.pid
client
resolv-retry infinite
nobind
persist-key
persist-tun
script-security 2
mtu-disc yes
dev tun1
proto udp
cipher bf-cbc
auth sha1
remote xxxxx.domain.com 1197
tls-client
tun-mtu 1500
fast-io
ifconfig 10.178.23.2 10.178.23.1
keepalive 10 60
persist-tun
persist-key
verb 5
mute 10
and the server config
dev tun3
tun-mtu 1500
proto udp
lport 1197
ifconfig 10.178.23.1 10.178.23.2
# remote myhost.xx.xx 1197
tls-server
ca /var/smoothwall/ovpn/ca/cacert.pem
cert /var/smoothwall/ovpn/certs/servercert.pem
key /var/smoothwall/ovpn/certs/serverkey.pem
dh /var/smoothwall/ovpn/ca/dh1024.pem
route 172.16.101.0 255.255.255.0
keepalive 10 60
persist-tun
persist-key
cipher BF-CBC
verb 3
mute 10
user nobody
group nobody
#remote-subnet 172.16.101.0/255.255.255.0
daemon OVPN_Office
#status /var/smoothwall/ovpn/n2nconf/Office/Office.log 2
writepid /var/run/openvpn.Office.pid
config /var/smoothwall/ovpn/n2nconf/Office/Office.custom.conf
(nothing in custom config for the time being)
with client side log
Sun Sep 9 00:07:32 2012 us=811496 UDPv4 link local: [undef]
Sun Sep 9 00:07:32 2012 us=811707 UDPv4 link remote: ***.***.***.***:1197
WRSun Sep 9 00:07:32 2012 us=825090 TLS: Initial packet from ***.***.***.***:1197, sid=354c9a20 d09b2768
WWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRSun Sep 9 00:07:32 2012 us=954437 VERIFY OK: depth=1, /C=CH/O=MyCo/CN=MyCo_CA/emailAddress=MyCoadmin@MyCo.ch
Sun Sep 9 00:07:32 2012 us=972863 VERIFY OK: depth=0, /C=CH/O=MyCo/CN=openvpn.MyCo.ch
WRWRWRWRWRWRWWWWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRRRRWRWRWRWRWRWRWRWRWRWRWRWWWWRRRRWRWRSun Sep 9 00:07:33 2012 us=805415 WARNING: 'ifconfig' is present in remote config but missing in local config, remote='ifconfig 10.178.23.2 10.178.23.1'
Sun Sep 9 00:07:33 2012 us=819383 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Sep 9 00:07:33 2012 us=819613 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Sep 9 00:07:33 2012 us=820369 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Sep 9 00:07:33 2012 us=820538 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
WSun Sep 9 00:07:33 2012 us=821057 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Sep 9 00:07:33 2012 us=821712 [openvpn.MyCo.ch] Peer Connection Initiated with ***.***.***.***:1197
RSun Sep 9 00:07:35 2012 us=51095 SENT CONTROL [openvpn.MyCo.ch]: 'PUSH_REQUEST' (status=1)
WRRSun Sep 9 00:07:35 2012 us=65300 PUSH: Received control message: 'PUSH_REPLY'
Sun Sep 9 00:07:35 2012 us=68076 TUN/TAP device tun1 opened
Sun Sep 9 00:07:35 2012 us=68300 TUN/TAP TX queue length set to 100
Sun Sep 9 00:07:35 2012 us=68668 /sbin/ifconfig tun1 10.178.23.2 pointopoint 10.178.23.1 mtu 1500
Sun Sep 9 00:07:35 2012 us=155717 Initialization Sequence Completed
WSun Sep 9 00:07:39 2012 us=508586 event_wait : Interrupted system call (code=4)
Sun Sep 9 00:07:39 2012 us=510982 TCP/UDP: Closing socket
Sun Sep 9 00:07:39 2012 us=511641 Closing TUN/TAP interface
Sun Sep 9 00:07:39 2012 us=511839 /sbin/ifconfig tun1 0.0.0.0
Sun Sep 9 00:07:39 2012 us=522471 SIGTERM[hard,] received, process exiting
Sun Sep 9 00:07:41 2012 us=526321 OpenVPN 2.2.1 mips-linux [SSL] [LZO2] built on Mar 19 2012
Sun Sep 9 00:07:41 2012 us=527087 MANAGEMENT: TCP Socket listening on 127.0.0.1:5001
Sun Sep 9 00:07:41 2012 us=527694 WARNING: using --pull/--client and --ifconfig together is probably not what you want
Sun Sep 9 00:07:41 2012 us=527817 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Sun Sep 9 00:07:41 2012 us=527925 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sun Sep 9 00:07:41 2012 us=533005 WARNING: file '/tmp/openvpncl/client.key' is group or others accessible
Sun Sep 9 00:07:41 2012 us=538099 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Sep 9 00:07:41 2012 us=538476 Socket Buffers: R=[163840->131072] S=[163840->131072]
Sun Sep 9 00:07:41 2012 us=539613 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Sun Sep 9 00:07:41 2012 us=540132 Local Options String: 'V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Sun Sep 9 00:07:41 2012 us=540627 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Sun Sep 9 00:07:41 2012 us=540953 Local Options hash (VER=V4): '3514370b'
Sun Sep 9 00:07:41 2012 us=541210 Expected Remote Options hash (VER=V4): '239669a8'
Sun Sep 9 00:07:41 2012 us=547190 UDPv4 link local: [undef]
Sun Sep 9 00:07:41 2012 us=547407 UDPv4 link remote: ***.***.***.***:1197
WRSun Sep 9 00:07:41 2012 us=561064 TLS: Initial packet from ***.***.***.***:1197, sid=22990e6e 41632a10
WWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRSun Sep 9 00:07:41 2012 us=689568 VERIFY OK: depth=1, /C=CH/O=MyCo/CN=MyCo_CA/emailAddress=MyCoadmin@MyCo.ch
Sun Sep 9 00:07:41 2012 us=711227 VERIFY OK: depth=0, /C=CH/O=MyCo/CN=openvpn.MyCo.ch
WRWRWRWRWRWRWWWWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRRRRWRWRWRWRWRWRWRWSun Sep 9 00:08:42 2012 us=76741 [openvpn.MyCo.ch] Inactivity timeout (--ping-restart), restarting
Sun Sep 9 00:08:42 2012 us=78118 TCP/UDP: Closing socket
Sun Sep 9 00:08:42 2012 us=78363 SIGUSR1[soft,ping-restart] received, process restarting
Sun Sep 9 00:08:42 2012 us=78530 Restart pause, 2 second(s)
Sun Sep 9 00:08:44 2012 us=96695 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Sun Sep 9 00:08:44 2012 us=96872 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sun Sep 9 00:08:44 2012 us=97055 Re-using SSL/TLS context
Sun Sep 9 00:08:44 2012 us=97727 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Sep 9 00:08:44 2012 us=97963 Socket Buffers: R=[163840->131072] S=[163840->131072]
Sun Sep 9 00:08:44 2012 us=99084 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Sun Sep 9 00:08:44 2012 us=99604 Local Options String: 'V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Sun Sep 9 00:08:44 2012 us=99730 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Sun Sep 9 00:08:44 2012 us=99995 Local Options hash (VER=V4): '3514370b'
Sun Sep 9 00:08:44 2012 us=100251 Expected Remote Options hash (VER=V4): '239669a8'
Sun Sep 9 00:08:44 2012 us=100416 UDPv4 link local: [undef]
Sun Sep 9 00:08:44 2012 us=100570 UDPv4 link remote: ***.***.***.***:1197
WSun Sep 9 00:08:44 2012 us=112931 read UDPv4 [ECONNREFUSED]: Connection refused (code=146)
WRSun Sep 9 00:08:46 2012 us=549248 TLS: Initial packet from ***.***.***.***:1197, sid=2aa53985 dd40b3ba
WWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRSun Sep 9 00:08:46 2012 us=644021 VERIFY OK: depth=1, /C=CH/O=MyCo/CN=MyCo_CA/emailAddress=MyCoadmin@MyCo.ch
Sun Sep 9 00:08:46 2012 us=652087 VERIFY OK: depth=0, /C=CH/O=MyCo/CN=openvpn.MyCo.ch
WRWRWRWRWRWRWWWWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRRRRWRWRWRWRWRWRWRWRWRWRWRWWWWRRRRWRWRSun Sep 9 00:08:47 2012 us=99295 WARNING: 'ifconfig' is present in remote config but missing in local config, remote='ifconfig 10.178.23.2 10.178.23.1'
Sun Sep 9 00:08:47 2012 us=102698 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Sep 9 00:08:47 2012 us=102898 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Sep 9 00:08:47 2012 us=103649 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Sep 9 00:08:47 2012 us=103819 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
WSun Sep 9 00:08:47 2012 us=104313 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Sep 9 00:08:47 2012 us=104621 [openvpn.MyCo.ch] Peer Connection Initiated with ***.***.***.***:1197
RSun Sep 9 00:08:49 2012 us=947008 SENT CONTROL [openvpn.MyCo.ch]: 'PUSH_REQUEST' (status=1)
WRRSun Sep 9 00:08:49 2012 us=961310 PUSH: Received control message: 'PUSH_REPLY'
Sun Sep 9 00:08:49 2012 us=963023 TUN/TAP device tun1 opened
Sun Sep 9 00:08:49 2012 us=963239 TUN/TAP TX queue length set to 100
Sun Sep 9 00:08:49 2012 us=963604 /sbin/ifconfig tun1 10.178.23.2 pointopoint 10.178.23.1 mtu 1500
Sun Sep 9 00:08:50 2012 us=52773 Initialization Sequence Completed
WRwWRWRWRWRwWRwWRwWRWRWRWRwWRwWRwWRWRWRWRwWRRwWRRwWRWRWRWRwWRRwWRwWRWRWRWRwWRwWRw
and server side log
00:00:11 OVPN_Office TLS: new session incoming connection from yyy.yyy.yyy.yyy:57758
00:00:12 OVPN_Office VERIFY OK: depth=1, /C=CH/O=MyCo/CN=MyCo_CA/emailAddress=MyCoadmin@MyCo.ch
00:00:12 OVPN_Office VERIFY OK: depth=0, /C=CH/O=MyCo/CN=MyCo.dyndns.org
00:00:17 OVPN_Office WARNING: 'ifconfig' is present in local config but missing in remote config, local='ifconfig 10.178.23.1 10.178.23.2'
00:00:17 OVPN_Office Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
00:00:17 OVPN_Office Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
00:00:17 OVPN_Office Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
00:00:17 OVPN_Office Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
00:00:17 OVPN_Office TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
00:00:17 OVPN_Office TLS: tls_multi_process: untrusted session promoted to semi-trusted
00:00:17 OVPN_Office Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
00:00:17 OVPN_Office [MyCo.dyndns.org] Peer Connection Initiated with yyy.yyy.yyy.yyy:57758
00:00:19 OVPN_Office PUSH: Received control message: 'PUSH_REQUEST'
00:00:19 OVPN_Office[5394]: SENT CONTROL 'PUSH_REPLY' (status=1)
01:00:17 OVPN_Office VERIFY OK: depth=1, /C=CH/O=MyCo/CN=MyCo_CA/emailAddress=MyCoadmin@MyCo.ch
01:00:17 OVPN_Office VERIFY OK: depth=0, /C=CH/O=MyCo/CN=MyCo.dyndns.org
01:00:17 OVPN_Office WARNING: 'ifconfig' is present in local config but missing in remote config, local='ifconfig 10.178.23.1 10.178.23.2'
01:00:17 OVPN_Office Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
01:00:17 OVPN_Office Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
01:00:17 OVPN_Office Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
01:00:17 OVPN_Office Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
01:00:17 OVPN_Office Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
02:00:16 OVPN_Office TLS: tls_process: killed expiring key
02:00:17 OVPN_Office TLS: soft reset sec=0 bytes=474154/0 pkts=3372/0
02:00:18 OVPN_Office VERIFY OK: depth=1, /C=CH/O=MyCo/CN=MyCo_CA/emailAddress=MyCoadmin@MyCo.ch
02:00:18 OVPN_Office VERIFY OK: depth=0, /C=CH/O=MyCo/CN=MyCo.dyndns.org
02:00:18 OVPN_Office WARNING: 'ifconfig' is present in local config but missing in remote config, local='ifconfig 10.178.23.1 10.178.23.2'
02:00:18 OVPN_Office Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
02:00:18 OVPN_Office Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
02:00:18 OVPN_Office Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
02:00:18 OVPN_Office Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
02:00:18 OVPN_Office Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
seems to be that we are pretty close to have something working here and would appreciate any suggestion / remark towards having this config fully operational.
