Hi, Simple site to site setup: client 192.168.0.17 NAT:82.163.99.82 Server: Hetzner VPS 88.198.198.57 Using example 2-2 cleint and server from openvpn cookbook. However server log stops at: [quote]SENT CONTROL [client1]: 'PUSH_REPLY,route 192.168.200.1,topology net30,ifconfig 192.168.200.6 192.168.200.5' (status=1) [/quote] Cannot ping etc. I`ve looked on the forum for an answer but no luck. Tried client on two machines (physical and virtual) same problem - i believe issue on server - permissions? ifconfig issue? Any suggestions. :( Regards Aidan [b]Client ip addr:[/b] root@debian7a:/home/zabbix# ip add [quote]1: lo: mtu 16436 qdisc noqueue state UNKNOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000 link/ether 00:0c:29:83:dd:93 brd ff:ff:ff:ff:ff:ff inet 192.168.148.128/24 brd 192.168.148.255 scope global eth0 inet6 fe80::20c:29ff:fe83:dd93/64 scope link valid_lft forever preferred_lft forever 20: tun0: mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100 link/none inet 192.168.200.6 peer 192.168.200.5/32 scope global tun0[/quote] [b]Client Version:[/b] [quote]OpenVPN 2.2.1 i486-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jun 19 2013 Originally developed by James Yonan Copyright (C) 2002-2010 OpenVPN Technologies, Inc. [/quote] [b]Client Config:[/b] [code] client proto udp remote 88.198.198.57 port 1194 dev tun nobind ca /etc/openvpn/easy-rsa/keys/ca.crt cert /etc/openvpn/easy-rsa/keys/client1.crt key /etc/openvpn/easy-rsa/keys/client1.key ns-cert-type server log-append client1.log[/code] [b]Client log:[/b] [quote]Mon Sep 23 12:50:30 2013 OpenVPN 2.2.1 i486-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jun 19 2013 Mon Sep 23 12:50:30 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables Mon Sep 23 12:50:30 2013 UDPv4 link local: [undef] Mon Sep 23 12:50:30 2013 UDPv4 link remote: [AF_INET]88.198.198.57:1194 Mon Sep 23 12:50:36 2013 [server] Peer Connection Initiated with [AF_INET]88.198.198.57:1194 Mon Sep 23 12:50:39 2013 TUN/TAP device tun0 opened Mon Sep 23 12:50:39 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Mon Sep 23 12:50:39 2013 /sbin/ifconfig tun0 192.168.200.6 pointopoint 192.168.200.5 mtu 1500 Mon Sep 23 12:50:39 2013 Initialization Sequence Completed[/quote] [b]Server ip addr[/b] [quote]zabbix@Deb764zab2:~$ ip addr 1: lo: mtu 16436 qdisc noqueue state UNKNOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:1c:14:01:64:99 brd ff:ff:ff:ff:ff:ff inet 88.198.198.57/28 brd 88.198.198.63 scope global eth0 inet6 2a01:4f8:d16:4aca::2/64 scope global valid_lft forever preferred_lft forever inet6 fe80::21c:14ff:fe01:6499/64 scope link valid_lft forever preferred_lft forever 10: tun0: mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100 link/none inet 192.168.200.1 peer 192.168.200.2/32 scope global tun0[/quote] [b]Server Version: [/b] [quote]OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jun 4 2013 Originally developed by James Yonan Copyright (C) 2002-2010 OpenVPN Technologies, Inc. [/quote] [b]Server Config:[/b] [code]proto udp port 1194 dev tun server 192.168.200.0 255.255.255.0 dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt cert /etc/openvpn/easy-rsa/2.0/keys/server.crt key /etc/openvpn/easy-rsa/2.0/keys/server.key # 3 -- medium output, good for normal operation. # 9 -- verbose, good for troubleshooting verb 3 log-append server.log[/code] [b]Server log:[/b] [quote]Mon Sep 23 13:50:02 2013 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jun 4 2013 Mon Sep 23 13:50:02 2013 WARNING: --keepalive option is missing from server config Mon Sep 23 13:50:02 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables Mon Sep 23 13:50:02 2013 Diffie-Hellman initialized with 1024 bit key Mon Sep 23 13:50:02 2013 TLS-Auth MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ] Mon Sep 23 13:50:02 2013 Socket Buffers: R=[229376->131072] S=[229376->131072] Mon Sep 23 13:50:02 2013 ROUTE default_gateway=88.198.198.49 Mon Sep 23 13:50:02 2013 TUN/TAP device tun0 opened Mon Sep 23 13:50:02 2013 TUN/TAP TX queue length set to 100 Mon Sep 23 13:50:02 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Mon Sep 23 13:50:02 2013 /sbin/ifconfig tun0 192.168.200.1 pointopoint 192.168.200.2 mtu 1500 Mon Sep 23 13:50:02 2013 /sbin/route add -net 192.168.200.0 netmask 255.255.255.0 gw 192.168.200.2 Mon Sep 23 13:50:02 2013 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ] Mon Sep 23 13:50:02 2013 UDPv4 link local (bound): [undef] Mon Sep 23 13:50:02 2013 UDPv4 link remote: [undef] Mon Sep 23 13:50:02 2013 MULTI: multi_init called, r=256 v=256 Mon Sep 23 13:50:02 2013 IFCONFIG POOL: base=192.168.200.4 size=62, ipv6=0 Mon Sep 23 13:50:02 2013 Initialization Sequence Completed Mon Sep 23 13:50:25 2013 MULTI: multi_create_instance called Mon Sep 23 13:50:25 2013 82.163.99.82:50803 Re-using SSL/TLS context Mon Sep 23 13:50:25 2013 82.163.99.82:50803 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ] Mon Sep 23 13:50:25 2013 82.163.99.82:50803 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ] Mon Sep 23 13:50:25 2013 82.163.99.82:50803 Local Options hash (VER=V4): '239669a8' Mon Sep 23 13:50:25 2013 82.163.99.82:50803 Expected Remote Options hash (VER=V4): '3514370b' Mon Sep 23 13:50:25 2013 82.163.99.82:50803 TLS: Initial packet from [AF_INET]82.163.99.82:50803, sid=be5c5be2 27503220 Mon Sep 23 13:50:31 2013 82.163.99.82:50803 VERIFY OK: depth=1, /C=DE/ST=Bavaria/L=Nuremberg/O=ObservIT_Ltd/OU=changeme/CN=Deb764zab2/name=changeme/emailAddress=mail@host.domain Mon Sep 23 13:50:31 2013 82.163.99.82:50803 VERIFY OK: depth=0, /C=DE/ST=Bavaria/L=Nuremberg/O=ObservIT_Ltd/OU=changeme/CN=client1/name=changeme/emailAddress=mail@host.domain Mon Sep 23 13:50:31 2013 82.163.99.82:50803 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key Mon Sep 23 13:50:31 2013 82.163.99.82:50803 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Mon Sep 23 13:50:31 2013 82.163.99.82:50803 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key Mon Sep 23 13:50:31 2013 82.163.99.82:50803 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Mon Sep 23 13:50:31 2013 82.163.99.82:50803 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA Mon Sep 23 13:50:31 2013 82.163.99.82:50803 [client1] Peer Connection Initiated with [AF_INET]82.163.99.82:50803 Mon Sep 23 13:50:31 2013 client1/82.163.99.82:50803 MULTI_sva: pool returned IPv4=192.168.200.6, IPv6=1::1a00:0:267f:0 Mon Sep 23 13:50:31 2013 client1/82.163.99.82:50803 MULTI: Learn: 192.168.200.6 -> client1/82.163.99.82:50803 Mon Sep 23 13:50:31 2013 client1/82.163.99.82:50803 MULTI: primary virtual IP for client1/82.163.99.82:50803: 192.168.200.6 Mon Sep 23 13:50:34 2013 client1/82.163.99.82:50803 PUSH: Received control message: 'PUSH_REQUEST' Mon Sep 23 13:50:34 2013 client1/82.163.99.82:50803 send_push_reply(): safe_cap=960 [color=#FF0000]Mon Sep 23 13:50:34 2013 client1/82.163.99.82:50803 SENT CONTROL [client1]: 'PUSH_REPLY,route 192.168.200.1,topology net30,ifconfig 192.168.200.6 192.168.200.5' (status=1)[/color][/quote]

Server Stops at SENT CONTROL (status=1)

avenn

Hi,

Simple site to site setup:

client
192.168.0.17 NAT:82.163.99.82

Server: Hetzner VPS
88.198.198.57

Using example 2-2 cleint and server from openvpn cookbook. However server log stops at:

SENT CONTROL [client1]: 'PUSH_REPLY,route 192.168.200.1,topology net30,ifconfig 192.168.200.6 192.168.200.5' (status=1)

Cannot ping etc.

I`ve looked on the forum for an answer but no luck.

Tried client on two machines (physical and virtual) same problem - i believe issue on server - permissions? ifconfig issue?

Any suggestions. 🙁

Regards

Aidan

Client ip addr:

root@debian7a:/home/zabbix# ip add

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000
link/ether 00:0c:29:83:dd:93 brd ff:ff:ff:ff:ff:ff
inet 192.168.148.128/24 brd 192.168.148.255 scope global eth0
inet6 fe80::20c:29ff:fe83:dd93/64 scope link
valid_lft forever preferred_lft forever
20: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
link/none
inet 192.168.200.6 peer 192.168.200.5/32 scope global tun0

Client Version:

OpenVPN 2.2.1 i486-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jun 19 2013
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>

Client Config:

client
proto udp
remote 88.198.198.57
port 1194

dev tun
nobind

ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/client1.crt
key /etc/openvpn/easy-rsa/keys/client1.key

ns-cert-type server

log-append client1.log

Client log:

Mon Sep 23 12:50:30 2013 OpenVPN 2.2.1 i486-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jun 19 2013
Mon Sep 23 12:50:30 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Sep 23 12:50:30 2013 UDPv4 link local: [undef]
Mon Sep 23 12:50:30 2013 UDPv4 link remote: [AF_INET]88.198.198.57:1194
Mon Sep 23 12:50:36 2013 [server] Peer Connection Initiated with [AF_INET]88.198.198.57:1194
Mon Sep 23 12:50:39 2013 TUN/TAP device tun0 opened
Mon Sep 23 12:50:39 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Sep 23 12:50:39 2013 /sbin/ifconfig tun0 192.168.200.6 pointopoint 192.168.200.5 mtu 1500
Mon Sep 23 12:50:39 2013 Initialization Sequence Completed

Server ip addr

zabbix@Deb764zab2:~$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:1c:14:01:64:99 brd ff:ff:ff:ff:ff:ff
inet 88.198.198.57/28 brd 88.198.198.63 scope global eth0
inet6 2a01:4f8:d16:4aca::2/64 scope global
valid_lft forever preferred_lft forever
inet6 fe80::21c:14ff:fe01:6499/64 scope link
valid_lft forever preferred_lft forever
10: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
link/none
inet 192.168.200.1 peer 192.168.200.2/32 scope global tun0

Server Version:

OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jun 4 2013
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>

Server Config:

proto udp
port 1194
dev tun
server 192.168.200.0 255.255.255.0

dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key

# 3 -- medium output, good for normal operation.
# 9 -- verbose, good for troubleshooting
verb 3
log-append server.log

Server log:

Mon Sep 23 13:50:02 2013 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jun 4 2013
Mon Sep 23 13:50:02 2013 WARNING: --keepalive option is missing from server config
Mon Sep 23 13:50:02 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Sep 23 13:50:02 2013 Diffie-Hellman initialized with 1024 bit key
Mon Sep 23 13:50:02 2013 TLS-Auth MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Sep 23 13:50:02 2013 Socket Buffers: R=[229376->131072] S=[229376->131072]
Mon Sep 23 13:50:02 2013 ROUTE default_gateway=88.198.198.49
Mon Sep 23 13:50:02 2013 TUN/TAP device tun0 opened
Mon Sep 23 13:50:02 2013 TUN/TAP TX queue length set to 100
Mon Sep 23 13:50:02 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Sep 23 13:50:02 2013 /sbin/ifconfig tun0 192.168.200.1 pointopoint 192.168.200.2 mtu 1500
Mon Sep 23 13:50:02 2013 /sbin/route add -net 192.168.200.0 netmask 255.255.255.0 gw 192.168.200.2
Mon Sep 23 13:50:02 2013 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Mon Sep 23 13:50:02 2013 UDPv4 link local (bound): [undef]
Mon Sep 23 13:50:02 2013 UDPv4 link remote: [undef]
Mon Sep 23 13:50:02 2013 MULTI: multi_init called, r=256 v=256
Mon Sep 23 13:50:02 2013 IFCONFIG POOL: base=192.168.200.4 size=62, ipv6=0
Mon Sep 23 13:50:02 2013 Initialization Sequence Completed
Mon Sep 23 13:50:25 2013 MULTI: multi_create_instance called
Mon Sep 23 13:50:25 2013 82.163.99.82:50803 Re-using SSL/TLS context
Mon Sep 23 13:50:25 2013 82.163.99.82:50803 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Sep 23 13:50:25 2013 82.163.99.82:50803 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Mon Sep 23 13:50:25 2013 82.163.99.82:50803 Local Options hash (VER=V4): '239669a8'
Mon Sep 23 13:50:25 2013 82.163.99.82:50803 Expected Remote Options hash (VER=V4): '3514370b'
Mon Sep 23 13:50:25 2013 82.163.99.82:50803 TLS: Initial packet from [AF_INET]82.163.99.82:50803, sid=be5c5be2 27503220
Mon Sep 23 13:50:31 2013 82.163.99.82:50803 VERIFY OK: depth=1, /C=DE/ST=Bavaria/L=Nuremberg/O=ObservIT_Ltd/OU=changeme/CN=Deb764zab2/name=changeme/emailAddress=mail@host.domain
Mon Sep 23 13:50:31 2013 82.163.99.82:50803 VERIFY OK: depth=0, /C=DE/ST=Bavaria/L=Nuremberg/O=ObservIT_Ltd/OU=changeme/CN=client1/name=changeme/emailAddress=mail@host.domain
Mon Sep 23 13:50:31 2013 82.163.99.82:50803 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Sep 23 13:50:31 2013 82.163.99.82:50803 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Sep 23 13:50:31 2013 82.163.99.82:50803 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Sep 23 13:50:31 2013 82.163.99.82:50803 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Sep 23 13:50:31 2013 82.163.99.82:50803 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon Sep 23 13:50:31 2013 82.163.99.82:50803 [client1] Peer Connection Initiated with [AF_INET]82.163.99.82:50803
Mon Sep 23 13:50:31 2013 client1/82.163.99.82:50803 MULTI_sva: pool returned IPv4=192.168.200.6, IPv6=1::1a00:0:267f:0
Mon Sep 23 13:50:31 2013 client1/82.163.99.82:50803 MULTI: Learn: 192.168.200.6 -> client1/82.163.99.82:50803
Mon Sep 23 13:50:31 2013 client1/82.163.99.82:50803 MULTI: primary virtual IP for client1/82.163.99.82:50803: 192.168.200.6
Mon Sep 23 13:50:34 2013 client1/82.163.99.82:50803 PUSH: Received control message: 'PUSH_REQUEST'
Mon Sep 23 13:50:34 2013 client1/82.163.99.82:50803 send_push_reply(): safe_cap=960
Mon Sep 23 13:50:34 2013 client1/82.163.99.82:50803 SENT CONTROL [client1]: 'PUSH_REPLY,route 192.168.200.1,topology net30,ifconfig 192.168.200.6 192.168.200.5' (status=1)