Hi,
here is my server config:
port 443
proto tcp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh4096.pem
tls-auth /etc/openvpn/keys/ta.key 0
crl-verify /etc/openvpn/keys/crl.pem
server 10.10.5.0 255.255.255.0
persist-key
persist-tun
topology subnet
push "topology subnet"
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
persist-key
persist-tun
mtu-disc maybe
user nobody
group nogroup
client-config-dir /etc/openvpn/ccd
comp-lzo yes
push "comp-lzo yes"
keepalive 10 120
verb 1
status /var/log/openvpn/status.log
log /var/log/openvpn/openvpn.log
log-append /var/log/openvpn/openvpn.log
Here is a ccd file for a specific user I am trying to connect:
cat /etc/openvpn/ccd/user1
ifconfig-push 10.10.5.53 255.255.255.0
When I try to connect to VPN server (with Linux, commandline), I get this error:
* xx:xx:30 2013 VERIFY OK: depth=0, /C=xx/ST=xx/L=Ljubljana/O=server.xx/OU=VPN/CN=server/emailAddress=xx@xx
* xx:xx:33 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
* xx:xx:33 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
* xx:xx:33 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
* xx:xx:33 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
* xx:xx:33 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 3072 bit RSA
* xx:xx:33 2013 [server] Peer Connection Initiated with [AF_INET]xx.xxx.xxx.xx:443
* xx:xx:35 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
* xx:xx:35 2013 PUSH: Received control message: 'PUSH_REPLY,topology subnet,redirect-gateway def1,dhcp-option DNS 8.8.8.8,comp-lzo yes,route-gateway 10.10.5.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.10.5.53 255.255.255.0'
* xx:xx:35 2013 OPTIONS IMPORT: timers and/or timeouts modified
* xx:xx:35 2013 OPTIONS IMPORT: LZO parms modified
* xx:xx:35 2013 OPTIONS IMPORT: --ifconfig/up options modified
* xx:xx:35 2013 OPTIONS IMPORT: route options modified
* xx:xx:35 2013 OPTIONS IMPORT: route-related options modified
* xx:xx:35 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
* xx:xx:35 2013 Preserving previous TUN/TAP instance: tun0
* xx:xx:35 2013 NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device.
* xx:xx:35 2013 /sbin/route del -net xx.xxx.xxx.xx netmask 255.255.255.255
SIOCDELRT: Operation not permitted
* xx:xx:35 2013 ERROR: Linux route delete command failed: external program exited with error status: 7
* xx:xx:35 2013 /sbin/route del -net 0.0.0.0 netmask 128.0.0.0
SIOCDELRT: Operation not permitted
* xx:xx:36 2013 ERROR: Linux route delete command failed: external program exited with error status: 7
* xx:xx:36 2013 /sbin/route del -net 128.0.0.0 netmask 128.0.0.0
SIOCDELRT: Operation not permitted
* xx:xx:36 2013 ERROR: Linux route delete command failed: external program exited with error status: 7
* xx:xx:36 2013 Closing TUN/TAP interface
* xx:xx:36 2013 /sbin/ifconfig tun0 0.0.0.0
SIOCSIFADDR: Permission denied
SIOCSIFFLAGS: Permission denied
* xx:xx:36 2013 Linux ip addr del failed: external program exited with error status: 255
* xx:xx:38 2013 ROUTE default_gateway=10.0.2.2
* xx:xx:38 2013 Note: Cannot ioctl TUNSETIFF tun: Operation not permitted (errno=1)
* xx:xx:38 2013 Note: Attempting fallback to kernel 2.2 TUN/TAP interface
* xx:xx:38 2013 Cannot allocate TUN/TAP dev dynamically
* xx:xx:38 2013 Exiting
However, if I remove client-config-dir /etc/openvpn/ccd from the server.conf, connection is successful, everything works just fine, and my local IP is:
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.10.5.2 P-t-P:10.10.5.2 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:1 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:63 (63.0 B)
What I am doing wrong?
