Hello. When I try : root@ubuntu-serveur:/usr/share/doc/openvpn/examples/sample-config-files# ./openvpn-startup.sh I get Bad argument `10.8.0.1/24' Try `iptables -h' or 'iptables --help' for more information. I assume the issue come from the firewall.sh file where it is: # Change this subnet to correspond to your private # ethernet subnet. Home will use HOME_NET/24 and # Office will use OFFICE_NET/24. PRIVATE=10.8.0.1/24 But I don't know how to configure it. if I run ifconfig I get this: br0 Link encap:Ethernet HWaddr 00:13:d4:20:6b:e3 inet adr:192.168.1.142 Bcast:192.168.1.255 Masque:255.255.255.0 adr inet6: fe80::213:d4ff:fe20:6be3/64 Scope:Lien UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Packets reçus:434 erreurs:0 :0 overruns:0 frame:0 TX packets:206 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 lg file transmission:0 Octets reçus:39768 (39.7 KB) Octets transmis:28478 (28.4 KB) eth0 Link encap:Ethernet HWaddr 00:13:d4:20:6b:e3 adr inet6: fe80::213:d4ff:fe20:6be3/64 Scope:Lien UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 Packets reçus:34849550 erreurs:0 :0 overruns:0 frame:0 TX packets:17583175 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 lg file transmission:1000 Octets reçus:43533570358 (43.5 GB) Octets transmis:4919218119 (4.9 GB) Interruption:17 lo Link encap:Boucle locale inet adr:127.0.0.1 Masque:255.0.0.0 adr inet6: ::1/128 Scope:Hôte UP LOOPBACK RUNNING MTU:16436 Metric:1 Packets reçus:6866 erreurs:0 :0 overruns:0 frame:0 TX packets:6866 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 lg file transmission:0 Octets reçus:463324 (463.3 KB) Octets transmis:463324 (463.3 KB) tap0 Link encap:Ethernet HWaddr ce:97:ee:0b:24:da UP BROADCAST PROMISC MULTICAST MTU:1500 Metric:1 Packets reçus:0 erreurs:0 :0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 lg file transmission:100 Octets reçus:0 (0.0 B) Octets transmis:0 (0.0 B) virbr0 Link encap:Ethernet HWaddr 36:c8:f1:74:e5:68 inet adr:192.168.122.1 Bcast:192.168.122.255 Masque:255.255.255.0 UP BROADCAST MULTICAST MTU:1500 Metric:1 Packets reçus:0 erreurs:0 :0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 lg file transmission:0 Octets reçus:0 (0.0 B) Octets transmis:0 (0.0 B) should I see ip adress on eth0 and tap0 interface? Could someone help me with this please?

assuming you try to setup bridge mode then no , both tap & eth should not have ip address... posting your configs should helped a lot... Michael.

Hi! [b]I copy/paste openvpn-startup.sh, server.conf, firewall.sh et ifconfig. Their path are writen in bold. /usr/share/doc/openvpn/examples/sample-config-files/openvpn-startup.sh :[/b] #!/bin/sh # A sample OpenVPN startup script # for Linux. # openvpn config file directory dir=/etc/openvpn # load the firewall $dir/firewall.sh # load TUN/TAP kernel module modprobe tun # enable IP forwarding echo 1 > /proc/sys/net/ipv4/ip_forward # Invoke openvpn for each VPN tunnel # in daemon mode. Alternatively, # you could remove "--daemon" from # the command line and add "daemon" # to the config file. # # Each tunnel should run on a separate # UDP port. Use the "port" option # to control this. Like all of # OpenVPN's options, you can # specify "--port 8000" on the command # line or "port 8000" in the config # file. openvpn --cd $dir --daemon --config vpn1.conf openvpn --cd $dir --daemon --config vpn2.conf openvpn --cd $dir --daemon --config vpn2.conf [b] /etc/openvpn/server.conf :[/b] [code] port 1194 proto tcp dev tap0 ca /etc/openvpn/easy-rsa/keys/ca.crt cert /etc/openvpn/easy-rsa/keys/server.crt key /etc/openvpn/easy-rsa/keys/server.key # This file should be kept secret dh /etc/openvpn/easy-rsa/keys/dh1024.pem ifconfig-pool-persist ipp.txt server-bridge 10.8.0.0 255.255.255.0 10.8.0.50 10.8.0.100 keepalive 10 120 comp-lzo persist-key persist-tun status openvpn-status.log verb 3 [/code] [b]/etc/openvpn/firewall.sh :[/b] #!/bin/sh # A Sample OpenVPN-aware firewall. # eth0 is connected to the internet. # eth1 is connected to a private subnet. # Change this subnet to correspond to your private # ethernet subnet. Home will use HOME_NET/24 and # Office will use OFFICE_NET/24. PRIVATE=10.8.0.0/24 # Loopback address LOOP=127.0.0.1 # Delete old iptables rules # and temporarily block all traffic. iptables -P OUTPUT DROP iptables -P INPUT DROP iptables -P FORWARD DROP iptables -F # Set default policies iptables -P OUTPUT ACCEPT iptables -P INPUT DROP iptables -P FORWARD DROP # Prevent external packets from using loopback addr iptables -A INPUT -i eth0 -s $LOOP -j DROP iptables -A FORWARD -i eth0 -s $LOOP -j DROP iptables -A INPUT -i eth0 -d $LOOP -j DROP iptables -A FORWARD -i eth0 -d $LOOP -j DROP # Anything coming from the Internet should have a real Internet address iptables -A FORWARD -i eth0 -s 192.168.0.0/16 -j DROP iptables -A FORWARD -i eth0 -s 172.16.0.0/12 -j DROP iptables -A FORWARD -i eth0 -s 10.0.0.0/8 -j DROP iptables -A INPUT -i eth0 -s 192.168.0.0/16 -j DROP iptables -A INPUT -i eth0 -s 172.16.0.0/12 -j DROP iptables -A INPUT -i eth0 -s 10.0.0.0/8 -j DROP # Block outgoing NetBios (if you have windows machines running # on the private subnet). This will not affect any NetBios # traffic that flows over the VPN tunnel, but it will stop # local windows machines from broadcasting themselves to # the internet. iptables -A FORWARD -p tcp --sport 137:139 -o eth0 -j DROP iptables -A FORWARD -p udp --sport 137:139 -o eth0 -j DROP iptables -A OUTPUT -p tcp --sport 137:139 -o eth0 -j DROP iptables -A OUTPUT -p udp --sport 137:139 -o eth0 -j DROP # Check source address validity on packets going out to internet iptables -A FORWARD -s ! $PRIVATE -i eth1 -j DROP # Allow local loopback iptables -A INPUT -s $LOOP -j ACCEPT iptables -A INPUT -d $LOOP -j ACCEPT # Allow incoming pings (can be disabled) iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT # Allow services such as www and ssh (can be disabled) iptables -A INPUT -p tcp --dport http -j ACCEPT iptables -A INPUT -p tcp --dport ssh -j ACCEPT # Allow incoming OpenVPN packets # Duplicate the line below for each # OpenVPN tunnel, changing --dport n # to match the OpenVPN UDP port. # # In OpenVPN, the port number is # controlled by the --port n option. # If you put this option in the config # file, you can remove the leading '--' # # If you taking the stateful firewall # approach (see the OpenVPN HOWTO), # then comment out the line below. iptables -A INPUT -p udp --dport 1194 -j ACCEPT # Allow packets from TUN/TAP devices. # When OpenVPN is run in a secure mode, # it will authenticate packets prior # to their arriving on a tun or tap # interface. Therefore, it is not # necessary to add any filters here, # unless you want to restrict the # type of packets which can flow over # the tunnel. iptables -A INPUT -i tun+ -j ACCEPT iptables -A FORWARD -i tun+ -j ACCEPT iptables -A INPUT -i tap+ -j ACCEPT iptables -A FORWARD -i tap+ -j ACCEPT # Allow packets from private subnets iptables -A INPUT -i eth1 -j ACCEPT iptables -A FORWARD -i eth1 -j ACCEPT # Keep state of connections from local machine and private subnets iptables -A OUTPUT -m state --state NEW -o eth0 -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -m state --state NEW -o eth0 -j ACCEPT iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT # Masquerade local subnet iptables -t nat -A POSTROUTING -s $PRIVATE -o eth0 -j MASQUERADE #Mes propres ajouts iptables -A INPUT -i tap0 -j ACCEPT iptables -A INPUT -i br0 -j ACCEPT iptables -A FORWARD -i br0 -j ACCEPT [b] ifconfig:[/b] br0 Link encap:Ethernet HWaddr 00:13:d4:20:6b:e3 inet adr:192.168.1.142 Bcast:192.168.1.255 Masque:255.255.255.0 adr inet6: fe80::213:d4ff:fe20:6be3/64 Scope:Lien UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Packets reçus:768841 erreurs:0 :0 overruns:0 frame:0 TX packets:366238 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 lg file transmission:0 Octets reçus:795923010 (795.9 MB) Octets transmis:120863050 (120.8 MB) eth0 Link encap:Ethernet HWaddr 00:13:d4:20:6b:e3 adr inet6: fe80::213:d4ff:fe20:6be3/64 Scope:Lien UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 Packets reçus:35659590 erreurs:0 :0 overruns:0 frame:0 TX packets:17949207 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 lg file transmission:1000 Octets reçus:44354554502 (44.3 GB) Octets transmis:5040052691 (5.0 GB) Interruption:17 lo Link encap:Boucle locale inet adr:127.0.0.1 Masque:255.0.0.0 adr inet6: ::1/128 Scope:Hôte UP LOOPBACK RUNNING MTU:16436 Metric:1 Packets reçus:7640 erreurs:0 :0 overruns:0 frame:0 TX packets:7640 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 lg file transmission:0 Octets reçus:516586 (516.5 KB) Octets transmis:516586 (516.5 KB) tap0 Link encap:Ethernet HWaddr ce:97:ee:0b:24:da adr inet6: fe80::cc97:eeff:fe0b:24da/64 Scope:Lien UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 Packets reçus:0 erreurs:0 :0 overruns:0 frame:0 TX packets:57390 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 lg file transmission:100 Octets reçus:0 (0.0 B) Octets transmis:8857415 (8.8 MB) virbr0 Link encap:Ethernet HWaddr 36:c8:f1:74:e5:68 inet adr:192.168.122.1 Bcast:192.168.122.255 Masque:255.255.255.0 UP BROADCAST MULTICAST MTU:1500 Metric:1 Packets reçus:0 erreurs:0 :0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 lg file transmission:0 Octets reçus:0 (0.0 B) Octets transmis:0 (0.0 B)

hi there, there is a liiiitle mix up on your config.... using bridging mode means that you give "bridge" your lan interface with your vpn one, meaning that your vpn clients will recieve an ip address from your lan network.... meaning that this: [code]server-bridge 10.8.0.0 255.255.255.0 10.8.0.50 10.8.0.100[/code] is totally wrong... it should be like [code]server-bridge 192.168.1.142 255.255.255.0 192.168.1.50 192.168.1.100[/code] also for testing please try to use as little rules as possible on your firewall... Michael.

Hello I fixed server-bridge rule to my lan network: [code] server-bridge 192.168.1.142 255.255.255.0 192.168.1.175 192.168.1.250[/code] In the firewall.sh, I tried : [code]PRIVATE=192.168.1.142/24[/code] and [code]PRIVATE=10.8.0.0/24[/code] And both didn't work In the openvpn-startup. file, I commented the firewall.sh line : [code]# load the firewall #$dir/firewall.sh[/code] And it worked! So I think the problem comme from my firewall. But now, does opnenvpn work with no firewall or the firewall is not configuered correctly? More... I still seem to not work In a terminal I did : [code]#openvpn server.conf[/code] and I got: [code] Wed Aug 14 19:50:19 2013 OpenVPN 2.2.1 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Feb 27 2013 Wed Aug 14 19:50:19 2013 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to Wed Aug 14 19:50:19 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables Wed Aug 14 19:50:19 2013 Diffie-Hellman initialized with 1024 bit key Wed Aug 14 19:50:19 2013 TLS-Auth MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ] Wed Aug 14 19:50:19 2013 Socket Buffers: R=[87380->131072] S=[16384->131072] Wed Aug 14 19:50:19 2013 TCP/UDP: Socket bind failed on local address [undef]: Address already in use Wed Aug 14 19:50:19 2013 Exiting[/code] thank for the help

[quote="circacien"][code]Wed Aug 14 19:50:19 2013 TCP/UDP: Socket bind failed on local address [undef]: Address already in use[/code][/quote] OpenVPN is complaining about the port being in use and therefor cannot start. Is there allready another (openvpn)proces running and using that port? If so, kill the proces or choose another port for openvpn.

Now I think the server is correctly configure. Thank! But I got difficulties to connect the client. I do use tunnelblick mac osX software to connect openVPN. I get this error: 2013-08-18 22:32:29 *Tunnelblick: OS X 10.8.4; Tunnelblick 3.3.0 (build 3518) 2013-08-18 22:32:29 *Tunnelblick: Attempting connection with vpn_earadritz using shadow copy; Set nameserver = 1; monitoring connection 2013-08-18 22:32:29 *Tunnelblick: openvpnstart start vpn_earadritz.tblk 1337 1 0 1 0 370 -atADGNWradsgnw - 2013-08-18 22:32:30 *Tunnelblick: Could not start OpenVPN (openvpnstart returned with status #236) Contents of the openvpnstart log: *Tunnelblick: openvpnstart log: OpenVPN returned with status 1, errno = 13: Permission denied Command used to start OpenVPN (one argument per displayed line): /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3.2/openvpn --cd /Library/Application Support/Tunnelblick/Users/earadritz/vpn_earadritz.tblk/Contents/Resources --daemon --management 127.0.0.1 1337 --config /Library/Application Support/Tunnelblick/Users/earadritz/vpn_earadritz.tblk/Contents/Resources/config.ovpn --log /Library/Application Support/Tunnelblick/Logs/-SUsers-Searadritz-SLibrary-SApplication Support-STunnelblick-SConfigurations-Svpn_earadritz.tblk-SContents-SResources-Sconfig.ovpn.1_0_1_0_370.1337.openvpn.log --management-query-passwords --management-hold --script-security 2 --up /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -a -f -atADGNWradsgnw --down /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -a -f -atADGNWradsgnw --up-restart --route-pre-down /Applications/Tunnelblick.app/Contents/Resources/client.route-pre-down.tunnelblick.sh -m -w -d -a -f -atADGNWradsgnw Contents of the OpenVPN log: More details may be in the Console Log's "All Messages" Any Idea?

Any Idea how to configure tunnelblick?

I'm not familiair with Tunnelblick, but i noticed one thing: [quote]*Tunnelblick: openvpnstart log: OpenVPN returned with status 1, errno = 13: Permission denied[/quote] Does have Tunnelblick have sufficient permissions to run? OpenVPN needs root/administrator rights to startup. And i found a [url=https://code.google.com/p/tunnelblick/wiki/QuickStartGuide]Quick start Guide[/url] on Tunnelblick. Maybe it helps.

Hi! Good News! I can connect on local. I tried to connect another place but it didn't work. I don't understant how to tell my openvpn client where to connect to the host. Will I need to open port from my router? I realy need help for this part.

[quote]Will I need to open port from my router?[/quote] Yes, you do. As your server is inside your network, your router needs to know these incoming packets should be sent somewhere instead of being dropped. If that works, you can connect inbound from everywhere. Please consult the manual of your router how to do that.

need help to start openvpn

circacien

Hi!

I am behind my router. Here's netstat -nr before and after ./bridge-start

netstat -nr
Table de routage IP du noyau
Destination     Passerelle      Genmask         Indic   MSS Fenêtre irtt Iface
0.0.0.0         192.168.0.1     0.0.0.0         UG        0 0          0 eth0
192.168.0.0     0.0.0.0         255.255.255.0   U         0 0          0 eth0
192.168.122.0   0.0.0.0         255.255.255.0   U         0 0          0 virbr0

Table de routage IP du noyau
Destination     Passerelle      Genmask         Indic   MSS Fenêtre irtt Iface
192.168.0.0     0.0.0.0         255.255.255.0   U         0 0          0 br0
192.168.122.0   0.0.0.0         255.255.255.0   U         0 0          0 virbr0

And iptables -nL

iptables -nL
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:53
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:53
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:67
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:67
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  0.0.0.0/0            192.168.122.0/24     state RELATED,ESTABLISHED
ACCEPT     all  --  192.168.122.0/24     0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

brendan

you are losing your default or "Passerelle" route of 192.168.0.1. you need to add it back at the end of your bridge-start script. something like:

route add default gw 192.168.0.1

circacien

Thx a lot

It work now!

hana

am trying to create a testbed:
I have a cisco router :

* linux pc: 192.168.5.1 linked on the interface fasethernet 0/0 192.168.5.254 interface of the router
* linux pc : 192.168.1.1 linked on the interface fastethernet 0/1 192.168.1.254 interface of the router

on the router i added : ip route 192.168.1.0 255.255.255.0 192.168.5.0
Ip route 192.168.5.0 255.255.255.0 192.168.1.0

i would like to Create a bridge interface with this two pc can anyone help me ?!!!

i use the officel tutorial of openvpn bridge but i didn't have conection between client and server !!!!

brendan

on the router i added : ip route 192.168.1.0 255.255.255.0 192.168.5.0 Ip route 192.168.5.0 255.255.255.0 192.168.1.0

i think this is pointless. the networks are directly connected to the router, and therefore explicit routes are not needed. moreover, those statements dont look right. you cannot route a network via a network. i think if those routes were needed, they would look like:

ip route 192.168.1.0 255.255.255.0 192.168.5.254
Ip route 192.168.5.0 255.255.255.0 192.168.1.254

now, since they should not be needed, they should be removed from your configs. instead use 192.168.5.254 as the default gateway on the computer connected to fa0/0, and 192.168.1.254 as the default gateway for the pc connected to fa0/1

hana

thank you brendan for your interest but about the configuration of the pn bridge mode can you help me ?

i used this configuration for :

sample-scripts/bridge-start

#!/bin/bash

#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth0"
eth_ip="192.168.1.1"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.1.255"

for t in $tap; do
openvpn --mktun --dev $t
done

brctl addbr $br
brctl addif $br $eth

for t in $tap; do
brctl addif $br $t
done

for t in $tap; do
ifconfig $t 0.0.0.0 promisc up
done

ifconfig $eth 0.0.0.0 promisc up

ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast

and for bridge stop

sample-scripts/bridge-stop

#!/bin/bash

####################################
# Tear Down Ethernet bridge on Linux
####################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged together
tap="tap0"

ifconfig $br down
brctl delbr $br

for t in $tap; do
openvpn --rmtun --dev $t
done

Fichier /etc/openvpn/server.conf :

port 1194
proto udp
#mode bridgé
dev tap0
#serveur
mode server
tls-server
tun-mtu 1500
mssfix
persist-key
persist-tun
#les clés et certificats
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem
tls-auth ta.key 0 # This file is secret too, 0 = serveur

#adresse du bridging
#la première et la dernière IP devrait être les adresses de début
# et de fin d'un sous réseau (par ex: x.y.z.129 x.y.z.254)
# afin de simplifier le filtrage IPTABLES des clients
# (par ex: -s/-d x.y.z.128/25)
server-bridge 192.168.1.1 255.255.255.0 192.168.1.100 192.168.1.200
#les clients se voient entre eux
client-to-client
keepalive 10 120
cipher BF-CBC
comp-lzo
#nombre max de clients qui peuvent se connecter
max-clients 15
#utilisateur sous lequel tourne OpenVPN
user nobody
group nobody
#les logs
;status /var/log/openvpn/status.log
;log-append /var/log/openvpn/openvpn.log
verb 4
mute 10

and the file /etc/openvpn/client.conf

indique le mode client
client
#indique le mode bridged
dev tap0
#indique le protocole de connexion au serveur
proto udp #ou tcp
#le serveur auquel on se connecte
remote nom_DNS_ou_IP_serveur port_serveur
#essayer indéfiniment de résoudre le nom DNS du serveur (par ex IP dynamique)
resolv-retry infinite
#choisir dynamiquement le port côté client
nobind
tls-client
#préserve les états entre deux connexions
persist-key
persist-tun
#le fichier du certificat de la CA
ca ca.crt
#le certificat du client
cert client1.crt
#la clé privée du client (600)
key client1.key
ns-cert-type server
cipher BF-CBC
#oblige le client à demander sa configuration au serveur
#compression LZO
comp-lzo
verb 2
mute 5

/etc/network/interfaces

auto lo br0
iface lo inet loopback
iface br0 inet static
address 192.168.1.1
netmask 255.255.255.0
broadcast 192.168.1.255
bridge-ports eth0

brendan

are there errors in your logs? does the service start? what happens when you try to connect a client PC?

brctl show - make sure both eth0 and tap0 are listed
netstat -nr - make sure your routing is pointing at the correct default gateway
netstat -naut | grep 1194 - make sure your process is up and running

find your logs (/var/log/messages, maybe) what do the logs indicate?

hana

bridge name bridge id STP enabled interfaces
br0 8000.9201bba48c07 no eth0
tap0

hana

Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 192.168.1.254 0.0.0.0 UG 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

brendan

hana wrote192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

only one should be there. the eth0 route should be deleted. that seems to be causing some confusion

hana

br0 Link encap:Ethernet HWaddr 3e:65:06:46:b3:b9
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::3c65:6ff:fe46:b3b9/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:318 errors:0 dropped:0 overruns:0 frame:0
TX packets:405 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:24247 (24.2 KB) TX bytes:47536 (47.5 KB)

eth0 Link encap:Ethernet HWaddr f0:bf:97:e9:9a:ea
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:2405 errors:0 dropped:108 overruns:0 frame:0
TX packets:2950 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:187353 (187.3 KB) TX bytes:368632 (368.6 KB)
Interrupt:43 Base address:0xc000

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:3778 errors:0 dropped:0 overruns:0 frame:0
TX packets:3778 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:279271 (279.2 KB) TX bytes:279271 (279.2 KB)

tap0 Link encap:Ethernet HWaddr 3e:65:06:46:b3:b9
inet6 addr: fe80::3c65:6ff:fe46:b3b9/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:62 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:8958 (8.9 KB)

wlan0 Link encap:Ethernet HWaddr 68:5d:43:13:ea:0c
inet6 addr: fe80::6a5d:43ff:fe13:ea0c/64 Scope:Link
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:42002 errors:0 dropped:0 overruns:0 frame:0
TX packets:9540 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:10767568 (10.7 MB) TX bytes:1679457 (1.6 MB)

netstat -nr
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 192.168.1.254 0.0.0.0 UG 0 0 0 br0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 br0

udp 0 0 0.0.0.0:1194 0.0.0.0:*

bridge name bridge id STP enabled interfaces
br0 8000.3e650646b3b9 no eth0
tap0
Fri Sep 20 17:00:55 2013 OpenVPN 2.2.1 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Feb 27 2013
Fri Sep 20 17:00:55 2013 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Fri Sep 20 17:00:55 2013 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Fri Sep 20 17:00:55 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Fri Sep 20 17:00:55 2013 Diffie-Hellman initialized with 1024 bit key
Fri Sep 20 17:00:55 2013 TLS-Auth MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Sep 20 17:00:55 2013 Socket Buffers: R=[163840->131072] S=[163840->131072]
Fri Sep 20 17:00:55 2013 TUN/TAP device tap0 opened
Fri Sep 20 17:00:55 2013 TUN/TAP TX queue length set to 100
Fri Sep 20 17:00:55 2013 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Fri Sep 20 17:00:55 2013 UDPv4 link local (bound): [undef]
Fri Sep 20 17:00:55 2013 UDPv4 link remote: [undef]
Fri Sep 20 17:00:55 2013 MULTI: multi_init called, r=256 v=256
Fri Sep 20 17:00:55 2013 IFCONFIG POOL: base=192.168.1.100 size=101, ipv6=0
Fri Sep 20 17:00:55 2013 ifconfig_pool_read(), in='client1,192.168.1.100', TODO: IPv6
Fri Sep 20 17:00:55 2013 succeeded -> ifconfig_pool_set()
Fri Sep 20 17:00:55 2013 IFCONFIG POOL LIST
Fri Sep 20 17:00:55 2013 client1,192.168.1.100
Fri Sep 20 17:00:55 2013 Initialization Sequence Completed
Fri Sep 20 17:00:57 2013 MULTI: multi_create_instance called
Fri Sep 20 17:00:57 2013 192.168.5.1:45712 Re-using SSL/TLS context
Fri Sep 20 17:00:57 2013 192.168.5.1:45712 LZO compression initialized
Fri Sep 20 17:00:57 2013 192.168.5.1:45712 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Sep 20 17:00:57 2013 192.168.5.1:45712 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Fri Sep 20 17:00:57 2013 192.168.5.1:45712 Local Options hash (VER=V4): 'f7df56b8'
Fri Sep 20 17:00:57 2013 192.168.5.1:45712 Expected Remote Options hash (VER=V4): 'd79ca330'
Fri Sep 20 17:00:57 2013 192.168.5.1:45712 TLS: Initial packet from [AF_INET]192.168.5.1:45712, sid=755b449d 7585210a
Fri Sep 20 17:00:57 2013 192.168.5.1:45712 VERIFY OK: depth=1, /C=tn/ST=tn/L=tn/O=tn/OU=n/CN=k/name=changeme/emailAddress=me@myhost.mydomain
Fri Sep 20 17:00:57 2013 192.168.5.1:45712 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/OU=changeme/CN=client1/name=changeme/emailAddress=me@myhost.mydomain
Fri Sep 20 17:00:57 2013 192.168.5.1:45712 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Sep 20 17:00:57 2013 192.168.5.1:45712 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Sep 20 17:00:57 2013 192.168.5.1:45712 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Sep 20 17:00:57 2013 192.168.5.1:45712 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Sep 20 17:00:57 2013 192.168.5.1:45712 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Fri Sep 20 17:00:57 2013 192.168.5.1:45712 [client1] Peer Connection Initiated with [AF_INET]192.168.5.1:45712
Fri Sep 20 17:00:57 2013 client1/192.168.5.1:45712 MULTI_sva: pool returned IPv4=192.168.1.100, IPv6=145a:7fb7:c0e8:f2b7::c0e8:f2b7
Fri Sep 20 17:01:00 2013 client1/192.168.5.1:45712 PUSH: Received control message: 'PUSH_REQUEST'
Fri Sep 20 17:01:00 2013 client1/192.168.5.1:45712 send_push_reply(): safe_cap=960
Fri Sep 20 17:01:00 2013 client1/192.168.5.1:45712 SENT CONTROL [client1]: 'PUSH_REPLY,route-gateway 192.168.1.1,ping 10,ping-restart 120,ifconfig 192.168.1.100 255.255.255.0' (status=1)
Fri Sep 20 17:02:52 2013 read UDPv4 [EHOSTUNREACH|EHOSTUNREACH|EHOSTUNREACH]: No route to host (code=113)
Fri Sep 20 17:03:02 2013 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
Fri Sep 20 17:03:10 2013 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
Fri Sep 20 17:03:17 2013 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
Fri Sep 20 17:03:27 2013 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
Fri Sep 20 17:03:32 2013 read UDPv4 [EHOSTUNREACH|EHOSTUNREACH]: No route to host (code=113)
Fri Sep 20 17:03:37 2013 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
Fri Sep 20 17:03:47 2013 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
Fri Sep 20 17:03:59 2013 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
Fri Sep 20 17:04:04 2013 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
Fri Sep 20 17:04:14 2013 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
Fri Sep 20 17:04:18 2013 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
Fri Sep 20 17:04:28 2013 read UDPv4 [EHOSTUNREACH|EHOSTUNREACH]: No route to host (code=113)
Fri Sep 20 17:04:39 2013 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
Fri Sep 20 17:04:49 2013 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
Fri Sep 20 17:04:54 2013 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
Fri Sep 20 17:05:00 2013 client1/192.168.5.1:45712 [client1] Inactivity timeout (--ping-restart), restarting
Fri Sep 20 17:05:00 2013 client1/192.168.5.1:45712 SIGUSR1[soft,ping-restart] received, client-instance restarting

« Previous Page