I've been trying to troubleshoot an issue with a new VPN server for a few days now and its driving me bonkers since I cannot figure it out for the life of me. Basically no matter what I set the renec-sec to (60 seconds, an hour, two hours) it fails, virtually every time.
There is no NAT on the servers end, and its a CentOS 6.4 server with no iptables rules (all chains set to ACCEPT), the client has no firewall enabled either, or AV. The client is behind NAT, but I can connect to other UDP based openvpn servers fine, so I doubt its anything to do with the router on the clients end.
Pretty much without fail, whenever a TLS reneg happens the client connection will drop, and the server will log an error about keys being our of sync. This happens in both TCP and UDP mode, the logs below are UDP mode. The client will get disconnected a few minutes after the reneg fails, with an inactivity timeout error; it can reconnect right away but it will get disconnected each time the reneg fails.
Any help is greatly appreciated, I've been hitting my head against a wall for the past day now.
Server log:
Oct 8 02:06:10 VPN1 openvpn[2931]: MULTI: multi_create_instance called
Oct 8 02:06:10 VPN1 openvpn[2931]: 68.146.103.212:57276 Re-using SSL/TLS context
Oct 8 02:06:10 VPN1 openvpn[2931]: 68.146.103.212:57276 LZO compression initialized
Oct 8 02:06:10 VPN1 openvpn[2931]: 68.146.103.212:57276 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Oct 8 02:06:10 VPN1 openvpn[2931]: 68.146.103.212:57276 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Oct 8 02:06:10 VPN1 openvpn[2931]: 68.146.103.212:57276 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Oct 8 02:06:10 VPN1 openvpn[2931]: 68.146.103.212:57276 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Oct 8 02:06:10 VPN1 openvpn[2931]: 68.146.103.212:57276 Local Options hash (VER=V4): '14168603'
Oct 8 02:06:10 VPN1 openvpn[2931]: 68.146.103.212:57276 Expected Remote Options hash (VER=V4): '504e774e'
Oct 8 02:06:10 VPN1 openvpn[2931]: 68.146.103.212:57276 TLS: Initial packet from [AF_INET]68.146.103.212:57276, sid=497bcc34 472dde0d
Oct 8 02:06:13 VPN1 openvpn[2931]: 68.146.103.212:57276 VERIFY OK: depth=1, C=SE, ST=Stockholm, L=Stockholm, O=VPN1, OU=VPN1, CN=VPN1 CA, name=EasyRSA, emailAddress=null@localhost
Oct 8 02:06:13 VPN1 openvpn[2931]: 68.146.103.212:57276 VERIFY OK: depth=0, C=SE, ST=Stockholm, L=Stockholm, O=VPN1, OU=VPN1, CN=gen1, name=EasyRSA, emailAddress=null@localhost
Oct 8 02:06:14 VPN1 openvpn[2931]: 68.146.103.212:57276 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Oct 8 02:06:14 VPN1 openvpn[2931]: 68.146.103.212:57276 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Oct 8 02:06:14 VPN1 openvpn[2931]: 68.146.103.212:57276 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Oct 8 02:06:14 VPN1 openvpn[2931]: 68.146.103.212:57276 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Oct 8 02:06:14 VPN1 openvpn[2931]: 68.146.103.212:57276 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Oct 8 02:06:14 VPN1 openvpn[2931]: 68.146.103.212:57276 [gen1] Peer Connection Initiated with [AF_INET]68.146.103.212:57276
Oct 8 02:06:14 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI_sva: pool returned IPv4=10.10.10.6, IPv6=(Not enabled)
Oct 8 02:06:14 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: Learn: 10.10.10.6 -> gen1/68.146.103.212:57276
Oct 8 02:06:14 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: primary virtual IP for gen1/68.146.103.212:57276: 10.10.10.6
Oct 8 02:06:16 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 PUSH: Received control message: 'PUSH_REQUEST'
Oct 8 02:06:16 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 send_push_reply(): safe_cap=940
Oct 8 02:06:16 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 SENT CONTROL [gen1]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 4.2.2.2,route 10.10.10.1,topology net30,ping 10,ping-restart 120,ifconfig 10.10.10.6 10.10.10.5' (status=1)
Oct 8 02:06:17 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:17 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:17 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:17 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:17 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [::], packet dropped
Oct 8 02:06:17 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:17 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:17 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:17 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:17 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:17 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:18 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:18 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:19 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:19 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:20 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:21 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:22 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:22 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:23 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:23 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:23 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:23 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:24 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:25 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:32 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:06:48 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:07:14 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 TLS: soft reset sec=0 bytes=130582/0 pkts=286/0
Oct 8 02:07:18 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 VERIFY OK: depth=1, C=SE, ST=Stockholm, L=Stockholm, O=VPN1, OU=VPN1, CN=VPN1 CA, name=EasyRSA, emailAddress=null@localhost
Oct 8 02:07:18 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 VERIFY OK: depth=0, C=SE, ST=Stockholm, L=Stockholm, O=VPN1, OU=VPN1, CN=gen1, name=EasyRSA, emailAddress=null@localhost
Oct 8 02:07:19 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Oct 8 02:07:19 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Oct 8 02:07:19 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Oct 8 02:07:19 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Oct 8 02:07:19 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Oct 8 02:07:20 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 MULTI: bad source address from client [fe80::54f9:b0b5:47d7:21bf], packet dropped
Oct 8 02:08:19 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 TLS: soft reset sec=0 bytes=264/0 pkts=5/0
Oct 8 02:08:23 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 VERIFY OK: depth=1, C=SE, ST=Stockholm, L=Stockholm, O=VPN1, OU=VPN1, CN=VPN1 CA, name=EasyRSA, emailAddress=null@localhost
Oct 8 02:08:23 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 VERIFY OK: depth=0, C=SE, ST=Stockholm, L=Stockholm, O=VPN1, OU=VPN1, CN=gen1, name=EasyRSA, emailAddress=null@localhost
Oct 8 02:08:24 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Oct 8 02:08:24 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Oct 8 02:08:24 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Oct 8 02:08:24 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Oct 8 02:08:24 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Oct 8 02:09:24 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 TLS: soft reset sec=0 bytes=159/0 pkts=3/0
Oct 8 02:09:27 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 VERIFY OK: depth=1, C=SE, ST=Stockholm, L=Stockholm, O=VPN1, OU=VPN1, CN=VPN1 CA, name=EasyRSA, emailAddress=null@localhost
Oct 8 02:09:27 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 VERIFY OK: depth=0, C=SE, ST=Stockholm, L=Stockholm, O=VPN1, OU=VPN1, CN=gen1, name=EasyRSA, emailAddress=null@localhost
Oct 8 02:09:28 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 TLS Auth Error: TLS object CN=gen1 client-provided SSL certs unexpectedly changed during mid-session reauth
Oct 8 02:09:29 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Oct 8 02:09:38 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 TLS Error: local/remote TLS keys are out of sync: [AF_INET]68.146.103.212:57276 [2]
Oct 8 02:09:44 VPN1 openvpn[2931]: gen1/68.146.103.212:57276 SIGTERM[soft,auth-control-exit] received, client-instance exiting
Server config:
port 443
proto udp
dev tun
ca /etc/openvpn/ca/keys/ca.crt
cert /etc/openvpn/ca/keys/server.crt
key /etc/openvpn/ca/keys/server.key
dh /etc/openvpn/ca/keys/dh2048.pem
server 10.10.10.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 4.2.2.2"
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/ca/keys/ta.key 0
reneg-sec 60
comp-lzo
max-clients 20
user nobody
group nobody
persist-key
persist-tun
;log /dev/null
;log-append /dev/null
verb 5
Client log:
Mon Oct 07 15:35:50 2013 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Jun 3 2013
Mon Oct 07 15:35:51 2013 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Mon Oct 07 15:35:51 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Oct 07 15:35:51 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Oct 07 15:35:51 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Oct 07 15:35:51 2013 UDPv4 link local: [undef]
Mon Oct 07 15:35:51 2013 UDPv4 link remote: [AF_INET]:443
Mon Oct 07 15:35:51 2013 TLS: Initial packet from [AF_INET]:443, sid=934c83fc 07889eff
Mon Oct 07 15:35:52 2013 VERIFY OK: depth=1, C=SE, ST=Stockholm, L=Stockholm, O=VPN1, OU=VPN1, CN=VPN1 CA, name=EasyRSA, emailAddress=null@localhost
Mon Oct 07 15:35:52 2013 VERIFY OK: nsCertType=SERVER
Mon Oct 07 15:35:52 2013 VERIFY OK: depth=0, C=SE, ST=Stockholm, L=Stockholm, O=VPN1, OU=VPN1, CN=server, name=EasyRSA, emailAddress=null@localhost
Mon Oct 07 15:35:55 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Oct 07 15:35:55 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Oct 07 15:35:55 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Oct 07 15:35:55 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Oct 07 15:35:55 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Oct 07 15:35:55 2013 [server] Peer Connection Initiated with [AF_INET]:443
Mon Oct 07 15:35:57 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Oct 07 15:35:58 2013 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 4.2.2.2,route 10.10.10.1,topology net30,ping 10,ping-restart 120,ifconfig 10.10.10.6 10.10.10.5'
Mon Oct 07 15:35:58 2013 OPTIONS IMPORT: timers and/or timeouts modified
Mon Oct 07 15:35:58 2013 OPTIONS IMPORT: --ifconfig/up options modified
Mon Oct 07 15:35:58 2013 OPTIONS IMPORT: route options modified
Mon Oct 07 15:35:58 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon Oct 07 15:35:58 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Oct 07 15:35:58 2013 open_tun, tt->ipv6=0
Mon Oct 07 15:35:58 2013 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{AE59A222-B743-4E76-881B-4FC78A4E907A}.tap
Mon Oct 07 15:35:58 2013 TAP-Windows Driver Version 9.9
Mon Oct 07 15:35:58 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.10.10.6/255.255.255.252 on interface {AE59A222-B743-4E76-881B-4FC78A4E907A} [DHCP-serv: 10.10.10.5, lease-time: 31536000]
Mon Oct 07 15:35:58 2013 Successful ARP Flush on interface [20] {AE59A222-B743-4E76-881B-4FC78A4E907A}
Mon Oct 07 15:36:03 2013 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Mon Oct 07 15:36:03 2013 C:\Windows\system32\route.exe ADD MASK 255.255.255.255 192.168.6.1
Mon Oct 07 15:36:03 2013 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists. [status=5010 if_index=11]
Mon Oct 07 15:36:03 2013 Route addition via IPAPI failed [adaptive]
Mon Oct 07 15:36:03 2013 Route addition fallback to route.exe
Mon Oct 07 15:36:03 2013 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Oct 07 15:36:03 2013 C:\Windows\system32\route.exe ADD 192.168.6.100 MASK 255.255.255.255 192.168.6.1 IF 11
Mon Oct 07 15:36:03 2013 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists. [status=5010 if_index=11]
Mon Oct 07 15:36:03 2013 Route addition via IPAPI failed [adaptive]
Mon Oct 07 15:36:03 2013 Route addition fallback to route.exe
Mon Oct 07 15:36:03 2013 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Oct 07 15:36:03 2013 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.10.10.5
Mon Oct 07 15:36:03 2013 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists. [status=5010 if_index=20]
Mon Oct 07 15:36:03 2013 Route addition via IPAPI failed [adaptive]
Mon Oct 07 15:36:03 2013 Route addition fallback to route.exe
Mon Oct 07 15:36:03 2013 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Oct 07 15:36:03 2013 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.10.10.5
Mon Oct 07 15:36:03 2013 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists. [status=5010 if_index=20]
Mon Oct 07 15:36:03 2013 Route addition via IPAPI failed [adaptive]
Mon Oct 07 15:36:03 2013 Route addition fallback to route.exe
Mon Oct 07 15:36:03 2013 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Oct 07 15:36:03 2013 C:\Windows\system32\route.exe ADD 10.10.10.1 MASK 255.255.255.255 10.10.10.5
Mon Oct 07 15:36:03 2013 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists. [status=5010 if_index=20]
Mon Oct 07 15:36:03 2013 Route addition via IPAPI failed [adaptive]
Mon Oct 07 15:36:03 2013 Route addition fallback to route.exe
Mon Oct 07 15:36:03 2013 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Oct 07 15:36:03 2013 Initialization Sequence Completed
Mon Oct 07 15:36:57 2013 VERIFY OK: depth=1, C=SE, ST=Stockholm, L=Stockholm, O=VPN1, OU=VPN1, CN=VPN1 CA, name=EasyRSA, emailAddress=null@localhost
Mon Oct 07 15:36:57 2013 VERIFY OK: nsCertType=SERVER
Mon Oct 07 15:36:57 2013 VERIFY OK: depth=0, C=SE, ST=Stockholm, L=Stockholm, O=VPN1, OU=VPN1, CN=server, name=EasyRSA, emailAddress=null@localhost
Mon Oct 07 15:37:00 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Oct 07 15:37:00 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Oct 07 15:37:00 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Oct 07 15:37:00 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Oct 07 15:37:00 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Oct 07 15:38:02 2013 VERIFY OK: depth=1, C=SE, ST=Stockholm, L=Stockholm, O=VPN1, OU=VPN1, CN=VPN1 CA, name=EasyRSA, emailAddress=null@localhost
Mon Oct 07 15:38:02 2013 VERIFY OK: nsCertType=SERVER
Mon Oct 07 15:38:02 2013 VERIFY OK: depth=0, C=SE, ST=Stockholm, L=Stockholm, O=VPN1, OU=VPN1, CN=server, name=EasyRSA, emailAddress=null@localhost
Mon Oct 07 15:38:05 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Oct 07 15:38:05 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Oct 07 15:38:05 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Oct 07 15:38:05 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Oct 07 15:38:05 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Oct 07 15:39:07 2013 VERIFY OK: depth=1, C=SE, ST=Stockholm, L=Stockholm, O=VPN1, OU=VPN1, CN=VPN1 CA, name=EasyRSA, emailAddress=null@localhost
Mon Oct 07 15:39:07 2013 VERIFY OK: nsCertType=SERVER
Mon Oct 07 15:39:07 2013 VERIFY OK: depth=0, C=SE, ST=Stockholm, L=Stockholm, O=VPN1, OU=VPN1, CN=server, name=EasyRSA, emailAddress=null@localhost
Mon Oct 07 15:39:09 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Oct 07 15:39:09 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Oct 07 15:39:09 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Oct 07 15:39:09 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Oct 07 15:39:09 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Client config:
client
dev tun
;dev-node MyTap
proto udp
remote <ip> 443
resolv-retry infinite
nobind
persist-key
persist-tun
ns-cert-type server
tls-auth ta.key 1
comp-lzo
verb 3
<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN RSA PRIVATE KEY-----
-----END RSA PRIVATE KEY-----
</key>
