MULTI: bad source address from client

srthomas

Hi,

I have a tun VPN setup between two systems.

The client server is copying packets it received to the VPN so I can run a packet sniffer on the server end of the VPN. I see the packets copied to the client interface perfectly with tshark.

When viewing packets at Server end using tshark I see no packets.

When examining the logs I see a line like this for each packet:

MULTI: bad source address from client [A.B.C.D], packet dropped

I realise this is because OpenVPN doesn't know how to route the packet and thus drops it.

Is there any way to disable this as I need to be able to see the packet so my sniffer can detect it and process it?

My config:

port 1194
proto tcp
dev tun
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert <SNIP>
key <SNIP>
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 9
log openvpn.log

Hoping someone can help me out here...

dropje

Seems like your client has an unexpected source address.. Are you handing out a static address?

srthomas

Hi,

yes the source is unexpected as the packet has been copied to the tin interface by iptables and forwarded to the other end of the tunnel. The packet will have completely unknown source address, that's ok as all I need to do is sniff it. But openvpn drops it. I just need to disable that functionality.

Mimiko

Search on the remote site the faulty windows file server. Its common to see such messages when a not updated windows system is present.

srthomas

Hi,

I saw those in my research but both systems are Centos. No Windows involved.