OpenVPN is always lossing the connection

Patschi

Hi,

since I setted up OpenVPN the connection between the server and the clients is always timing out. I connect my homePC and three other servers in three different datacenters, but also they always loose the connection. I already tried so many things, like changing the fragment, link-mtu, tun, tap, inactive, keepalive and some other things I just can't remember. I would be happy for every suggestion, which help me to come the problem closer.

Client configuration:

client

dev tap
proto udp
remote IP PORT

resolv-retry infinite
nobind

link-mtu 1590
fragment 1300
mssfix

persist-key
persist-tun

auth-user-pass pass.txt
auth-retry interact
auth-nocache

ca [inline]
cert [inline]
key [inline]

tls-client
tls-auth [inline] 1
tls-remote server
remote-cert-tls server
ns-cert-type server
pull

verb 3

auth SHA1
cipher AES-256-CBC

reneg-sec 0
inactive 0
keepalive 5 120
comp-lzo

<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
...
-----END OpenVPN Static key V1-----
</tls-auth>
<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</ca>
<cert>
Certificate:
...
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
</key>

Server configuration:

port PORT
proto udp

dev tap

local IP
mode server

link-mtu 1590
fragment 1400
mssfix

ca keys/ca.crt
cert keys/server.crt
key keys/server.key
dh keys/dh1024.pem

server 172.16.0.0 255.255.255.0
push "route 192.168.0.0 255.255.255.0"

ifconfig-pool-persist ip-pool.txt
client-config-dir clientconfig
ccd-exclusive

push "persist-key"
push "persist-tun"

push "dhcp-option DNS 172.16.0.1"
push "dhcp-option DNS 8.8.8.8"

push "comp-lzo"

auth SHA1
cipher AES-256-CBC

keepalive 10 120
comp-lzo

user openvpn
group openvpn

username-as-common-name
auth-user-pass-verify scripts/login.sh via-env
client-connect scripts/connect.sh
client-disconnect scripts/disconnect.sh

script-security 3 system

tls-auth keys/ta.key 0

tls-server

# clients to be able to "see" each other.
# By default, clients will only see the server.
client-to-client

persist-key
persist-tun
persist-local-ip
persist-remote-ip

status status.log 10
status-version 2

log-append openvpn.log
verb 3

The file connect.sh is just a simple bash script to check the entered username and password in the MySQL database and I modified it a little bit, that everyone gets a static ip address, which is entered in the database (everything about the authentication works without any problems). The disconnect.sh file is putting logs on every disconnect in the database with the IP of the user, port, start and end time and how many bytes got transfered. For this scripts I basically used the tutorial on http://chagridsada.blogspot.co.at/2012/06/openvpn-system-based-on-user-pass-lib.html

Thanks for any help!

Kind regards,
Patschi

Patschi

Thanks for your answer, but this can't sadly be the solution. I have "fragment 1300" on my local client, but on a server I have already "fragment 1400" for testing purposes - both are always loosing the connection after some time.

Sadly the logs also aren't very helpful:

Client:

Oct 17 07:35:52 localhost ovpn[20629]: TUN/TAP device tap0 opened
Oct 17 07:35:52 localhost ovpn[20629]: TUN/TAP TX queue length set to 100
Oct 17 07:35:52 localhost ovpn[20629]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Oct 17 07:35:52 localhost ovpn[20629]: /sbin/ifconfig tap0 172.16.0.101 netmask 255.255.255.0 mtu 1500 broadcast 172.16.0.255
Oct 17 07:35:52 localhost ovpn[20629]: /sbin/route add -net 192.168.0.0 netmask 255.255.255.0 gw 172.16.0.1
Oct 17 07:35:52 localhost ovpn[20629]: Initialization Sequence Completed
--- CONNECTION LOST ---
Oct 17 08:35:49 localhost ovpn[20629]: ERROR: could not read Auth username from stdin
Oct 17 08:35:49 localhost ovpn[20629]: Exiting
Oct 17 08:35:49 localhost ovpn[20629]: /sbin/route del -net 192.168.0.0 netmask 255.255.255.0
Oct 17 08:35:49 localhost ovpn[20629]: Closing TUN/TAP interface
Oct 17 08:35:49 localhost ovpn[20629]: /sbin/ifconfig tap0 0.0.0.0

Meanwhile on the server log:

Thu Oct 17 08:35:49 2013 CLIENT/IP:PORT TLS: soft reset sec=0 bytes=166447/0 pkts=1195/0
Thu Oct 17 08:35:51 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Thu Oct 17 08:36:01 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Thu Oct 17 08:36:04 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Thu Oct 17 08:36:14 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Thu Oct 17 08:36:23 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Thu Oct 17 08:36:28 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Thu Oct 17 08:36:31 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Thu Oct 17 08:36:34 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Thu Oct 17 08:36:44 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Thu Oct 17 08:36:50 2013 CLIENT/IP:PORT TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu Oct 17 08:36:50 2013 CLIENT/IP:PORT TLS Error: TLS handshake failed
Thu Oct 17 08:36:50 2013 CLIENT/IP:PORT TLS: move_session: dest=TM_LAME_DUCK src=TM_ACTIVE reinit_src=1
Thu Oct 17 08:36:54 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Thu Oct 17 08:36:55 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Thu Oct 17 08:36:56 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Thu Oct 17 08:36:56 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)

Any more ideas? I don't know what I still could try...

Patschi

I already tried it without before - didn't made any difference.

Thu Oct 17 18:05:09 2013 Initialization Sequence Completed
Enter Auth Username:Thu Oct 17 19:05:06 2013 ERROR: could not read Auth username from stdin
Thu Oct 17 19:05:06 2013 Exiting

With these parameters the connection is some more moments longer stable.

Patschi

Thanks for your help, I reduced the config files on client and server a bit - Still waiting, if the connection now get's lost.

debbie10t wroteIt is far more likely that either a peice of your network is malfunctioning or simply that a NAT firewall is breaking the link.

I don't think that it's my network. I have completely five clients connected: Three servers in three different datacenter and two at my home (NAS with Debian and my PC with Windows) and all clients gets lost in about some time after connecting.

I did set the parameters with mtu, fragment and mssfix because other people said, that with the parameters it's working fine and at some times OpenVPN said a WARNING in the log, that the value for these parameters does not fit (because that I added it in the config file)

Patschi

Server-Config

port PORT
proto udp
dev tap
local IP
mode server
ca keys/ca.crt
cert keys/server.crt
key keys/server.key
dh keys/dh1024.pem
server 172.16.0.0 255.255.255.0
push "route 192.168.0.0 255.255.255.0"
ifconfig-pool-persist ip-pool.txt
client-config-dir clientconfig
push "persist-key"
push "persist-tun"
push "dhcp-option DNS 172.16.0.1"
push "dhcp-option DNS 8.8.8.8"
push "comp-lzo"
keepalive 10 120
comp-lzo
user openvpn
group openvpn
username-as-common-name
auth-user-pass-verify scripts/login.sh via-env
client-connect scripts/connect.sh
client-disconnect scripts/disconnect.sh
script-security 3 system
tls-auth keys/ta.key 0
client-to-client
persist-key
persist-tun
status status.log 10
status-version 2
log-append openvpn.log
verb 4

Client-Config

client
dev tap
proto udp
remote IP PORT
resolv-retry infinite
nobind
persist-key
persist-tun
auth-user-pass pass.txt
auth-retry interact
auth-nocache
ca [inline]
cert [inline]
key [inline]
tls-auth [inline] 1
pull
verb 4
keepalive 5 120
comp-lzo
<tls-auth></tls-auth>
<ca></ca>
<cert></cert>
<key></key>

Server-Log:

Fri Oct 18 21:21:38 2013 us=97120 Current Parameter Settings:
Fri Oct 18 21:21:38 2013 us=97157   config = '/etc/openvpn/server.conf'
Fri Oct 18 21:21:38 2013 us=97162   mode = 1
Fri Oct 18 21:21:38 2013 us=97165   persist_config = DISABLED
Fri Oct 18 21:21:38 2013 us=97168   persist_mode = 1
Fri Oct 18 21:21:38 2013 us=97171   show_ciphers = DISABLED
Fri Oct 18 21:21:38 2013 us=97174   show_digests = DISABLED
Fri Oct 18 21:21:38 2013 us=97177   show_engines = DISABLED
Fri Oct 18 21:21:38 2013 us=97180   genkey = DISABLED
Fri Oct 18 21:21:38 2013 us=97183   key_pass_file = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97186   show_tls_ciphers = DISABLED
Fri Oct 18 21:21:38 2013 us=97189 Connection profiles [default]:
Fri Oct 18 21:21:38 2013 us=97192   proto = udp
Fri Oct 18 21:21:38 2013 us=97195   local = 'SERVERIP'
Fri Oct 18 21:21:38 2013 us=97198   local_port = SERVERPORT
Fri Oct 18 21:21:38 2013 us=97201   remote = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97204   remote_port = SERVERPORT
Fri Oct 18 21:21:38 2013 us=97207   remote_float = DISABLED
Fri Oct 18 21:21:38 2013 us=97210   bind_defined = DISABLED
Fri Oct 18 21:21:38 2013 us=97213   bind_local = ENABLED
Fri Oct 18 21:21:38 2013 us=97215   connect_retry_seconds = 5
Fri Oct 18 21:21:38 2013 us=97218   connect_timeout = 10
Fri Oct 18 21:21:38 2013 us=97221   connect_retry_max = 0
Fri Oct 18 21:21:38 2013 us=97224   socks_proxy_server = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97227   socks_proxy_port = 0
Fri Oct 18 21:21:38 2013 us=97230   socks_proxy_retry = DISABLED
Fri Oct 18 21:21:38 2013 us=97233 Connection profiles END
Fri Oct 18 21:21:38 2013 us=97236   remote_random = DISABLED
Fri Oct 18 21:21:38 2013 us=97239   ipchange = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97245   dev = 'tap'
Fri Oct 18 21:21:38 2013 us=97250   dev_type = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97255   dev_node = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97260   lladdr = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97265   topology = 1
Fri Oct 18 21:21:38 2013 us=97269   tun_ipv6 = DISABLED
Fri Oct 18 21:21:38 2013 us=97272   ifconfig_local = '172.16.0.1'
Fri Oct 18 21:21:38 2013 us=97275   ifconfig_remote_netmask = '255.255.255.0'
Fri Oct 18 21:21:38 2013 us=97278   ifconfig_noexec = DISABLED
Fri Oct 18 21:21:38 2013 us=97281   ifconfig_nowarn = DISABLED
Fri Oct 18 21:21:38 2013 us=97284   ifconfig_ipv6_local = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97287   ifconfig_ipv6_netbits = 0
Fri Oct 18 21:21:38 2013 us=97290   ifconfig_ipv6_remote = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97292   shaper = 0
Fri Oct 18 21:21:38 2013 us=97295   tun_mtu = 1500
Fri Oct 18 21:21:38 2013 us=97298   tun_mtu_defined = ENABLED
Fri Oct 18 21:21:38 2013 us=97301   link_mtu = 1500
Fri Oct 18 21:21:38 2013 us=97304   link_mtu_defined = DISABLED
Fri Oct 18 21:21:38 2013 us=97307   tun_mtu_extra = 32
Fri Oct 18 21:21:38 2013 us=97310   tun_mtu_extra_defined = ENABLED
Fri Oct 18 21:21:38 2013 us=97313   fragment = 0
Fri Oct 18 21:21:38 2013 us=97315   mtu_discover_type = -1
Fri Oct 18 21:21:38 2013 us=97318   mtu_test = 0
Fri Oct 18 21:21:38 2013 us=97321   mlock = DISABLED
Fri Oct 18 21:21:38 2013 us=97324   keepalive_ping = 10
Fri Oct 18 21:21:38 2013 us=97327   keepalive_timeout = 120
Fri Oct 18 21:21:38 2013 us=97330   inactivity_timeout = 0
Fri Oct 18 21:21:38 2013 us=97333   ping_send_timeout = 10
Fri Oct 18 21:21:38 2013 us=97335   ping_rec_timeout = 240
Fri Oct 18 21:21:38 2013 us=97338   ping_rec_timeout_action = 2
Fri Oct 18 21:21:38 2013 us=97341   ping_timer_remote = DISABLED
Fri Oct 18 21:21:38 2013 us=97344   remap_sigusr1 = 0
Fri Oct 18 21:21:38 2013 us=97347   explicit_exit_notification = 0
Fri Oct 18 21:21:38 2013 us=97355   persist_tun = ENABLED
Fri Oct 18 21:21:38 2013 us=97358   persist_local_ip = DISABLED
Fri Oct 18 21:21:38 2013 us=97361   persist_remote_ip = DISABLED
Fri Oct 18 21:21:38 2013 us=97363   persist_key = ENABLED
Fri Oct 18 21:21:38 2013 us=97366   mssfix = 1450
Fri Oct 18 21:21:38 2013 us=97369   passtos = DISABLED
Fri Oct 18 21:21:38 2013 us=97371   resolve_retry_seconds = 1000000000
Fri Oct 18 21:21:38 2013 us=97374   username = 'openvpn'
Fri Oct 18 21:21:38 2013 us=97377   groupname = 'openvpn'
Fri Oct 18 21:21:38 2013 us=97379   chroot_dir = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97383   cd_dir = '/etc/openvpn'
Fri Oct 18 21:21:38 2013 us=97386   writepid = '/var/run/openvpn.server.pid'
Fri Oct 18 21:21:38 2013 us=97389   up_script = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97391   down_script = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97394   down_pre = DISABLED
Fri Oct 18 21:21:38 2013 us=97397   up_restart = DISABLED
Fri Oct 18 21:21:38 2013 us=97399   up_delay = DISABLED
Fri Oct 18 21:21:38 2013 us=97402   daemon = ENABLED
Fri Oct 18 21:21:38 2013 us=97405   inetd = 0
Fri Oct 18 21:21:38 2013 us=97407   log = ENABLED
Fri Oct 18 21:21:38 2013 us=97410   suppress_timestamps = DISABLED
Fri Oct 18 21:21:38 2013 us=97413   nice = 0
Fri Oct 18 21:21:38 2013 us=97415   verbosity = 4
Fri Oct 18 21:21:38 2013 us=97418   mute = 0
Fri Oct 18 21:21:38 2013 us=97420   gremlin = 0
Fri Oct 18 21:21:38 2013 us=97423   status_file = 'status.log'
Fri Oct 18 21:21:38 2013 us=97426   status_file_version = 2
Fri Oct 18 21:21:38 2013 us=97428   status_file_update_freq = 10
Fri Oct 18 21:21:38 2013 us=97431   occ = ENABLED
Fri Oct 18 21:21:38 2013 us=97434   rcvbuf = 65536
Fri Oct 18 21:21:38 2013 us=97436   sndbuf = 65536
Fri Oct 18 21:21:38 2013 us=97439   sockflags = 0
Fri Oct 18 21:21:38 2013 us=97441   fast_io = DISABLED
Fri Oct 18 21:21:38 2013 us=97444   lzo = 7
Fri Oct 18 21:21:38 2013 us=97447   route_script = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97450   route_default_gateway = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97453   route_default_metric = 0
Fri Oct 18 21:21:38 2013 us=97455   route_noexec = DISABLED
Fri Oct 18 21:21:38 2013 us=97459   route_delay = 0
Fri Oct 18 21:21:38 2013 us=97462   route_delay_window = 30
Fri Oct 18 21:21:38 2013 us=97465   route_delay_defined = DISABLED
Fri Oct 18 21:21:38 2013 us=97467   route_nopull = DISABLED
Fri Oct 18 21:21:38 2013 us=97470   route_gateway_via_dhcp = DISABLED
Fri Oct 18 21:21:38 2013 us=97473   max_routes = 100
Fri Oct 18 21:21:38 2013 us=97476   allow_pull_fqdn = DISABLED
Fri Oct 18 21:21:38 2013 us=97478   management_addr = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97481   management_port = 0
Fri Oct 18 21:21:38 2013 us=97484   management_user_pass = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97486   management_log_history_cache = 250
Fri Oct 18 21:21:38 2013 us=97489   management_echo_buffer_size = 100
Fri Oct 18 21:21:38 2013 us=97492   management_write_peer_info_file = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97495   management_client_user = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97498   management_client_group = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97500   management_flags = 0
Fri Oct 18 21:21:38 2013 us=97503   shared_secret_file = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97506   key_direction = 1
Fri Oct 18 21:21:38 2013 us=97509   ciphername_defined = ENABLED
Fri Oct 18 21:21:38 2013 us=97511   ciphername = 'BF-CBC'
Fri Oct 18 21:21:38 2013 us=97514   authname_defined = ENABLED
Fri Oct 18 21:21:38 2013 us=97517   authname = 'SHA1'
Fri Oct 18 21:21:38 2013 us=97527   prng_hash = 'SHA1'
Fri Oct 18 21:21:38 2013 us=97530   prng_nonce_secret_len = 16
Fri Oct 18 21:21:38 2013 us=97533   keysize = 0
Fri Oct 18 21:21:38 2013 us=97536   engine = DISABLED
Fri Oct 18 21:21:38 2013 us=97538   replay = ENABLED
Fri Oct 18 21:21:38 2013 us=97541   mute_replay_warnings = DISABLED
Fri Oct 18 21:21:38 2013 us=97544   replay_window = 64
Fri Oct 18 21:21:38 2013 us=97546   replay_time = 15
Fri Oct 18 21:21:38 2013 us=97549   packet_id_file = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97554   use_iv = ENABLED
Fri Oct 18 21:21:38 2013 us=97557   test_crypto = DISABLED
Fri Oct 18 21:21:38 2013 us=97560   tls_server = ENABLED
Fri Oct 18 21:21:38 2013 us=97562   tls_client = DISABLED
Fri Oct 18 21:21:38 2013 us=97565   key_method = 2
Fri Oct 18 21:21:38 2013 us=97568   ca_file = 'keys/ca.crt'
Fri Oct 18 21:21:38 2013 us=97570   ca_path = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97573   dh_file = 'keys/dh1024.pem'
Fri Oct 18 21:21:38 2013 us=97576   cert_file = 'keys/server.crt'
Fri Oct 18 21:21:38 2013 us=97579   priv_key_file = 'keys/server.key'
Fri Oct 18 21:21:38 2013 us=97581   pkcs12_file = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97584   cipher_list = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97587   tls_verify = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97590   tls_export_cert = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97592   tls_remote = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97595   crl_file = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97598   ns_cert_type = 0
Fri Oct 18 21:21:38 2013 us=97600   remote_cert_ku[i] = 0
Fri Oct 18 21:21:38 2013 us=97603   remote_cert_ku[i] = 0
Fri Oct 18 21:21:38 2013 us=97606   remote_cert_ku[i] = 0
Fri Oct 18 21:21:38 2013 us=97608   remote_cert_ku[i] = 0
Fri Oct 18 21:21:38 2013 us=97611   remote_cert_ku[i] = 0
Fri Oct 18 21:21:38 2013 us=97613   remote_cert_ku[i] = 0
Fri Oct 18 21:21:38 2013 us=97616   remote_cert_ku[i] = 0
Fri Oct 18 21:21:38 2013 us=97619   remote_cert_ku[i] = 0
Fri Oct 18 21:21:38 2013 us=97621   remote_cert_ku[i] = 0
Fri Oct 18 21:21:38 2013 us=97624   remote_cert_ku[i] = 0
Fri Oct 18 21:21:38 2013 us=97626   remote_cert_ku[i] = 0
Fri Oct 18 21:21:38 2013 us=97629   remote_cert_ku[i] = 0
Fri Oct 18 21:21:38 2013 us=97632   remote_cert_ku[i] = 0
Fri Oct 18 21:21:38 2013 us=97634   remote_cert_ku[i] = 0
Fri Oct 18 21:21:38 2013 us=97637   remote_cert_ku[i] = 0
Fri Oct 18 21:21:38 2013 us=97639   remote_cert_ku[i] = 0
Fri Oct 18 21:21:38 2013 us=97642   remote_cert_eku = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97645   tls_timeout = 2
Fri Oct 18 21:21:38 2013 us=97647   renegotiate_bytes = 0
Fri Oct 18 21:21:38 2013 us=97650   renegotiate_packets = 0
Fri Oct 18 21:21:38 2013 us=97653   renegotiate_seconds = 3600
Fri Oct 18 21:21:38 2013 us=97656   handshake_window = 60
Fri Oct 18 21:21:38 2013 us=97659   transition_window = 3600
Fri Oct 18 21:21:38 2013 us=97664   single_session = DISABLED
Fri Oct 18 21:21:38 2013 us=97668   push_peer_info = DISABLED
Fri Oct 18 21:21:38 2013 us=97673   tls_exit = DISABLED
Fri Oct 18 21:21:38 2013 us=97678   tls_auth_file = 'keys/ta.key'
Fri Oct 18 21:21:38 2013 us=97683   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:38 2013 us=97698   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:38 2013 us=97702   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:38 2013 us=97707   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:38 2013 us=97712   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:38 2013 us=97717   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:38 2013 us=97722   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:38 2013 us=97725   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:38 2013 us=97737   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:38 2013 us=97740   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:38 2013 us=97743   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:38 2013 us=97745   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:38 2013 us=97748   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:38 2013 us=97751   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:38 2013 us=97753   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:38 2013 us=97756   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:38 2013 us=97759   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:38 2013 us=97762   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:38 2013 us=97765   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:38 2013 us=97770   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:38 2013 us=97772   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:38 2013 us=97775   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:38 2013 us=97778   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:38 2013 us=97780   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:38 2013 us=97783   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:38 2013 us=97785   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:38 2013 us=97788   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:38 2013 us=97790   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:38 2013 us=97793   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:38 2013 us=97796   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:38 2013 us=97798   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:38 2013 us=97801   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:38 2013 us=97803   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:38 2013 us=97806   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:38 2013 us=97809   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:38 2013 us=97811   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:38 2013 us=97814   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:38 2013 us=97816   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:38 2013 us=97819   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:38 2013 us=97822   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:38 2013 us=97824   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:38 2013 us=97827   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:38 2013 us=97830   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:38 2013 us=97832   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:38 2013 us=97835   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:38 2013 us=97837   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:38 2013 us=97840   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:38 2013 us=97843   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:38 2013 us=97845   pkcs11_pin_cache_period = -1
Fri Oct 18 21:21:38 2013 us=97848   pkcs11_id = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97851   pkcs11_id_management = DISABLED
Fri Oct 18 21:21:38 2013 us=97854   server_network = 172.16.0.0
Fri Oct 18 21:21:38 2013 us=97857   server_netmask = 255.255.255.0
Fri Oct 18 21:21:38 2013 us=97864   server_network_ipv6 = ::
Fri Oct 18 21:21:38 2013 us=97867   server_netbits_ipv6 = 0
Fri Oct 18 21:21:38 2013 us=97870   server_bridge_ip = 0.0.0.0
Fri Oct 18 21:21:38 2013 us=97873   server_bridge_netmask = 0.0.0.0
Fri Oct 18 21:21:38 2013 us=97876   server_bridge_pool_start = 0.0.0.0
Fri Oct 18 21:21:38 2013 us=97879   server_bridge_pool_end = 0.0.0.0
Fri Oct 18 21:21:38 2013 us=97882   push_entry = 'route 192.168.0.0 255.255.255.0'
Fri Oct 18 21:21:38 2013 us=97885   push_entry = 'persist-key'
Fri Oct 18 21:21:38 2013 us=97887   push_entry = 'persist-tun'
Fri Oct 18 21:21:38 2013 us=97890   push_entry = 'dhcp-option DNS 172.16.0.1'
Fri Oct 18 21:21:38 2013 us=97893   push_entry = 'dhcp-option DNS 8.8.8.8'
Fri Oct 18 21:21:38 2013 us=97896   push_entry = 'comp-lzo'
Fri Oct 18 21:21:38 2013 us=97899   push_entry = 'route-gateway 172.16.0.1'
Fri Oct 18 21:21:38 2013 us=97901   push_entry = 'ping 10'
Fri Oct 18 21:21:38 2013 us=97904   push_entry = 'ping-restart 120'
Fri Oct 18 21:21:38 2013 us=97907   ifconfig_pool_defined = ENABLED
Fri Oct 18 21:21:38 2013 us=97910   ifconfig_pool_start = 172.16.0.2
Fri Oct 18 21:21:38 2013 us=97913   ifconfig_pool_end = 172.16.0.254
Fri Oct 18 21:21:38 2013 us=97916   ifconfig_pool_netmask = 255.255.255.0
Fri Oct 18 21:21:38 2013 us=97919   ifconfig_pool_persist_filename = 'ip-pool.txt'
Fri Oct 18 21:21:38 2013 us=97922   ifconfig_pool_persist_refresh_freq = 600
Fri Oct 18 21:21:38 2013 us=97925   ifconfig_ipv6_pool_defined = DISABLED
Fri Oct 18 21:21:38 2013 us=97928   ifconfig_ipv6_pool_base = ::
Fri Oct 18 21:21:38 2013 us=97930   ifconfig_ipv6_pool_netbits = 0
Fri Oct 18 21:21:38 2013 us=97933   n_bcast_buf = 256
Fri Oct 18 21:21:38 2013 us=97936   tcp_queue_limit = 64
Fri Oct 18 21:21:38 2013 us=97938   real_hash_size = 256
Fri Oct 18 21:21:38 2013 us=97943   virtual_hash_size = 256
Fri Oct 18 21:21:38 2013 us=97946   client_connect_script = 'scripts/connect.sh'
Fri Oct 18 21:21:38 2013 us=97948   learn_address_script = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=97951   client_disconnect_script = 'scripts/disconnect.sh'
Fri Oct 18 21:21:38 2013 us=97954   client_config_dir = 'clientconfig'
Fri Oct 18 21:21:38 2013 us=97957   ccd_exclusive = DISABLED
Fri Oct 18 21:21:38 2013 us=97959   tmp_dir = '/tmp'
Fri Oct 18 21:21:38 2013 us=97962   push_ifconfig_defined = DISABLED
Fri Oct 18 21:21:38 2013 us=97965   push_ifconfig_local = 0.0.0.0
Fri Oct 18 21:21:38 2013 us=97968   push_ifconfig_remote_netmask = 0.0.0.0
Fri Oct 18 21:21:38 2013 us=97971   push_ifconfig_ipv6_defined = DISABLED
Fri Oct 18 21:21:38 2013 us=97974   push_ifconfig_ipv6_local = ::/0
Fri Oct 18 21:21:38 2013 us=97977   push_ifconfig_ipv6_remote = ::
Fri Oct 18 21:21:38 2013 us=97980   enable_c2c = ENABLED
Fri Oct 18 21:21:38 2013 us=97982   duplicate_cn = DISABLED
Fri Oct 18 21:21:38 2013 us=97985   cf_max = 0
Fri Oct 18 21:21:38 2013 us=97988   cf_per = 0
Fri Oct 18 21:21:38 2013 us=97990   max_clients = 1024
Fri Oct 18 21:21:38 2013 us=97993   max_routes_per_client = 256
Fri Oct 18 21:21:38 2013 us=97996   auth_user_pass_verify_script = 'scripts/login.sh'
Fri Oct 18 21:21:38 2013 us=97999   auth_user_pass_verify_script_via_file = DISABLED
Fri Oct 18 21:21:38 2013 us=98001   ssl_flags = 2
Fri Oct 18 21:21:38 2013 us=98004   port_share_host = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=98007   port_share_port = 0
Fri Oct 18 21:21:38 2013 us=98010   client = DISABLED
Fri Oct 18 21:21:38 2013 us=98012   pull = DISABLED
Fri Oct 18 21:21:38 2013 us=98015   auth_user_pass_file = '[UNDEF]'
Fri Oct 18 21:21:38 2013 us=98020 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jun 18 2013
Fri Oct 18 21:21:38 2013 us=98114 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Fri Oct 18 21:21:38 2013 us=98121 NOTE: --script-security method='system' is deprecated due to the fact that passed parameters will be subject to shell expansion
Fri Oct 18 21:21:38 2013 us=110382 Diffie-Hellman initialized with 1024 bit key
Fri Oct 18 21:21:38 2013 us=151892 Control Channel Authentication: using 'keys/ta.key' as a OpenVPN static key file
Fri Oct 18 21:21:38 2013 us=151908 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Oct 18 21:21:38 2013 us=151913 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Oct 18 21:21:38 2013 us=151920 TLS-Auth MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ]
Fri Oct 18 21:21:38 2013 us=151932 Socket Buffers: R=[245760->131072] S=[245760->131072]
Fri Oct 18 21:21:38 2013 us=152109 TUN/TAP device tap0 opened
Fri Oct 18 21:21:38 2013 us=152122 TUN/TAP TX queue length set to 100
Fri Oct 18 21:21:38 2013 us=152131 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Oct 18 21:21:38 2013 us=152142 /sbin/ifconfig tap0 172.16.0.1 netmask 255.255.255.0 mtu 1500 broadcast 172.16.0.255
Fri Oct 18 21:21:38 2013 us=154303 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Fri Oct 18 21:21:38 2013 us=154736 GID set to openvpn
Fri Oct 18 21:21:38 2013 us=154765 UID set to openvpn
Fri Oct 18 21:21:38 2013 us=154782 UDPv4 link local (bound): [AF_INET]SERVERIP:SERVERPORT
Fri Oct 18 21:21:38 2013 us=154786 UDPv4 link remote: [undef]
Fri Oct 18 21:21:38 2013 us=154792 MULTI: multi_init called, r=256 v=256
Fri Oct 18 21:21:38 2013 us=154838 IFCONFIG POOL: base=172.16.0.2 size=253, ipv6=0
Fri Oct 18 21:21:38 2013 us=154848 IFCONFIG POOL LIST
Fri Oct 18 21:21:38 2013 us=154868 Initialization Sequence Completed
Fri Oct 18 21:21:43 2013 us=63903 MULTI: multi_create_instance called
Fri Oct 18 21:21:43 2013 us=64054 CLIENTIP:CLIENTPORT Re-using SSL/TLS context
Fri Oct 18 21:21:43 2013 us=64135 CLIENTIP:CLIENTPORT LZO compression initialized
Fri Oct 18 21:21:43 2013 us=64492 CLIENTIP:CLIENTPORT Control Channel MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ]
Fri Oct 18 21:21:43 2013 us=64542 CLIENTIP:CLIENTPORT Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Fri Oct 18 21:21:43 2013 us=64665 CLIENTIP:CLIENTPORT Local Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Fri Oct 18 21:21:43 2013 us=64683 CLIENTIP:CLIENTPORT Expected Remote Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Fri Oct 18 21:21:43 2013 us=64792 CLIENTIP:CLIENTPORT Local Options hash (VER=V4): '360696c5'
Fri Oct 18 21:21:43 2013 us=64837 CLIENTIP:CLIENTPORT Expected Remote Options hash (VER=V4): '13a273ba'
Fri Oct 18 21:21:43 2013 us=64934 CLIENTIP:CLIENTPORT TLS: Initial packet from [AF_INET]CLIENTIP:CLIENTPORT, sid=2bb9420a d7b958f6
Fri Oct 18 21:21:47 2013 us=326776 CLIENTIP:CLIENTPORT VERIFY OK: depth=1, /C=AT/ST=vpn/L=vpn/O=vpn/OU=vpn/CN=vpn/name=vpn/emailAddress=info@vpn
Fri Oct 18 21:21:47 2013 us=327090 CLIENTIP:CLIENTPORT VERIFY OK: depth=0, /C=AT/ST=vpn/L=vpn/O=vpn/OU=vpn/CN=CLIENT/name=vpn/emailAddress=info@vpn
[!] Authentication 'CLIENT' okay.
Fri Oct 18 21:21:49 2013 us=93643 CLIENTIP:CLIENTPORT TLS: Username/Password authentication succeeded for username 'CLIENT' [CN SET]
Fri Oct 18 21:21:49 2013 us=93945 CLIENTIP:CLIENTPORT Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Oct 18 21:21:49 2013 us=93982 CLIENTIP:CLIENTPORT Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Oct 18 21:21:49 2013 us=94084 CLIENTIP:CLIENTPORT Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Oct 18 21:21:49 2013 us=94100 CLIENTIP:CLIENTPORT Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Oct 18 21:21:49 2013 us=438390 CLIENTIP:CLIENTPORT Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Fri Oct 18 21:21:49 2013 us=438477 CLIENTIP:CLIENTPORT [CLIENT] Peer Connection Initiated with [AF_INET]CLIENTIP:CLIENTPORT
Fri Oct 18 21:21:49 2013 us=438585 CLIENT/CLIENTIP:CLIENTPORT OPTIONS IMPORT: reading client specific options from: clientconfig/CLIENT
Fri Oct 18 21:21:49 2013 us=472190 CLIENT/CLIENTIP:CLIENTPORT OPTIONS IMPORT: reading client specific options from: /tmp/openvpn_cc_813dce74582e3cad2abac53a4376ba77.tmp
Fri Oct 18 21:21:51 2013 us=610492 CLIENT/CLIENTIP:CLIENTPORT PUSH: Received control message: 'PUSH_REQUEST'
Fri Oct 18 21:21:51 2013 us=610518 CLIENT/CLIENTIP:CLIENTPORT send_push_reply(): safe_cap=960
Fri Oct 18 21:21:51 2013 us=610534 CLIENT/CLIENTIP:CLIENTPORT SENT CONTROL [CLIENT]: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,persist-key,persist-tun,dhcp-option DNS 172.16.0.1,dhcp-option DNS 8.8.8.8,comp-lzo,route-gateway 172.16.0.1,ping 10,ping-restart 120,ifconfig 172.16.0.2 255.255.255.0' (status=1)
Fri Oct 18 21:21:51 2013 us=977629 CLIENT/CLIENTIP:CLIENTPORT MULTI: Learn: 00:ff:7f:4d:12:19 -> CLIENT/CLIENTIP:CLIENTPORT
Fri Oct 18 22:21:49 2013 us=394595 CLIENT/CLIENTIP:CLIENTPORT TLS: soft reset sec=0 bytes=501476/0 pkts=3197/0
Fri Oct 18 22:22:00 2013 us=268362 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Fri Oct 18 22:22:02 2013 us=174396 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Fri Oct 18 22:22:11 2013 us=728449 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Fri Oct 18 22:22:22 2013 us=49166 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)

Client-Log:

Fri Oct 18 21:21:46 2013 us=98818 Current Parameter Settings:
Fri Oct 18 21:21:46 2013 us=98818   config = 'vpn.ovpn'
Fri Oct 18 21:21:46 2013 us=98818   mode = 0
Fri Oct 18 21:21:46 2013 us=98818   show_ciphers = DISABLED
Fri Oct 18 21:21:46 2013 us=98818   show_digests = DISABLED
Fri Oct 18 21:21:46 2013 us=98818   show_engines = DISABLED
Fri Oct 18 21:21:46 2013 us=98818   genkey = DISABLED
Fri Oct 18 21:21:46 2013 us=98818   key_pass_file = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=98818   show_tls_ciphers = DISABLED
Fri Oct 18 21:21:46 2013 us=98818 Connection profiles [default]:
Fri Oct 18 21:21:46 2013 us=98818   proto = udp
Fri Oct 18 21:21:46 2013 us=98818   local = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=98818   local_port = 0
Fri Oct 18 21:21:46 2013 us=98818   remote = 'SERVERIP'
Fri Oct 18 21:21:46 2013 us=98818   remote_port = SERVERPORT
Fri Oct 18 21:21:46 2013 us=98818   remote_float = DISABLED
Fri Oct 18 21:21:46 2013 us=98818   bind_defined = DISABLED
Fri Oct 18 21:21:46 2013 us=98818   bind_local = DISABLED
Fri Oct 18 21:21:46 2013 us=98818   connect_retry_seconds = 5
Fri Oct 18 21:21:46 2013 us=98818   connect_timeout = 10
Fri Oct 18 21:21:46 2013 us=98818   connect_retry_max = 0
Fri Oct 18 21:21:46 2013 us=98818   socks_proxy_server = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=98818   socks_proxy_port = 0
Fri Oct 18 21:21:46 2013 us=98818   socks_proxy_retry = DISABLED
Fri Oct 18 21:21:46 2013 us=98818   tun_mtu = 1500
Fri Oct 18 21:21:46 2013 us=98818   tun_mtu_defined = ENABLED
Fri Oct 18 21:21:46 2013 us=98818   link_mtu = 1500
Fri Oct 18 21:21:46 2013 us=98818   link_mtu_defined = DISABLED
Fri Oct 18 21:21:46 2013 us=98818   tun_mtu_extra = 32
Fri Oct 18 21:21:46 2013 us=98818   tun_mtu_extra_defined = ENABLED
Fri Oct 18 21:21:46 2013 us=98818   mtu_discover_type = -1
Fri Oct 18 21:21:46 2013 us=98818   fragment = 0
Fri Oct 18 21:21:46 2013 us=98818   mssfix = 1450
Fri Oct 18 21:21:46 2013 us=98818   explicit_exit_notification = 0
Fri Oct 18 21:21:46 2013 us=98818 Connection profiles END
Fri Oct 18 21:21:46 2013 us=99818   remote_random = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   ipchange = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   dev = 'tap'
Fri Oct 18 21:21:46 2013 us=99818   dev_type = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   dev_node = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   lladdr = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   topology = 1
Fri Oct 18 21:21:46 2013 us=99818   tun_ipv6 = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   ifconfig_local = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   ifconfig_remote_netmask = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   ifconfig_noexec = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   ifconfig_nowarn = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   ifconfig_ipv6_local = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   ifconfig_ipv6_netbits = 0
Fri Oct 18 21:21:46 2013 us=99818   ifconfig_ipv6_remote = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   shaper = 0
Fri Oct 18 21:21:46 2013 us=99818   mtu_test = 0
Fri Oct 18 21:21:46 2013 us=99818   mlock = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   keepalive_ping = 5
Fri Oct 18 21:21:46 2013 us=99818   keepalive_timeout = 120
Fri Oct 18 21:21:46 2013 us=99818   inactivity_timeout = 0
Fri Oct 18 21:21:46 2013 us=99818   ping_send_timeout = 5
Fri Oct 18 21:21:46 2013 us=99818   ping_rec_timeout = 120
Fri Oct 18 21:21:46 2013 us=99818   ping_rec_timeout_action = 2
Fri Oct 18 21:21:46 2013 us=99818   ping_timer_remote = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   remap_sigusr1 = 0
Fri Oct 18 21:21:46 2013 us=99818   persist_tun = ENABLED
Fri Oct 18 21:21:46 2013 us=99818   persist_local_ip = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   persist_remote_ip = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   persist_key = ENABLED
Fri Oct 18 21:21:46 2013 us=99818   passtos = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   resolve_retry_seconds = 1000000000
Fri Oct 18 21:21:46 2013 us=99818   username = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   groupname = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   chroot_dir = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   cd_dir = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   writepid = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   up_script = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   down_script = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   down_pre = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   up_restart = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   up_delay = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   daemon = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   inetd = 0
Fri Oct 18 21:21:46 2013 us=99818   log = ENABLED
Fri Oct 18 21:21:46 2013 us=99818   suppress_timestamps = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   nice = 0
Fri Oct 18 21:21:46 2013 us=99818   verbosity = 4
Fri Oct 18 21:21:46 2013 us=99818   mute = 0
Fri Oct 18 21:21:46 2013 us=99818   status_file = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   status_file_version = 1
Fri Oct 18 21:21:46 2013 us=99818   status_file_update_freq = 60
Fri Oct 18 21:21:46 2013 us=99818   occ = ENABLED
Fri Oct 18 21:21:46 2013 us=99818   rcvbuf = 0
Fri Oct 18 21:21:46 2013 us=99818   sndbuf = 0
Fri Oct 18 21:21:46 2013 us=99818   sockflags = 0
Fri Oct 18 21:21:46 2013 us=99818   fast_io = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   lzo = 7
Fri Oct 18 21:21:46 2013 us=99818   route_script = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   route_default_gateway = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   route_default_metric = 0
Fri Oct 18 21:21:46 2013 us=99818   route_noexec = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   route_delay = 5
Fri Oct 18 21:21:46 2013 us=99818   route_delay_window = 30
Fri Oct 18 21:21:46 2013 us=99818   route_delay_defined = ENABLED
Fri Oct 18 21:21:46 2013 us=99818   route_nopull = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   route_gateway_via_dhcp = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   max_routes = 100
Fri Oct 18 21:21:46 2013 us=99818   allow_pull_fqdn = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   management_addr = '127.0.0.1'
Fri Oct 18 21:21:46 2013 us=99818   management_port = 25340
Fri Oct 18 21:21:46 2013 us=99818   management_user_pass = 'stdin'
Fri Oct 18 21:21:46 2013 us=99818   management_log_history_cache = 250
Fri Oct 18 21:21:46 2013 us=99818   management_echo_buffer_size = 100
Fri Oct 18 21:21:46 2013 us=99818   management_write_peer_info_file = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   management_client_user = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   management_client_group = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   management_flags = 6
Fri Oct 18 21:21:46 2013 us=99818   shared_secret_file = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   key_direction = 2
Fri Oct 18 21:21:46 2013 us=99818   ciphername_defined = ENABLED
Fri Oct 18 21:21:46 2013 us=99818   ciphername = 'BF-CBC'
Fri Oct 18 21:21:46 2013 us=99818   authname_defined = ENABLED
Fri Oct 18 21:21:46 2013 us=99818   authname = 'SHA1'
Fri Oct 18 21:21:46 2013 us=99818   prng_hash = 'SHA1'
Fri Oct 18 21:21:46 2013 us=99818   prng_nonce_secret_len = 16
Fri Oct 18 21:21:46 2013 us=99818   keysize = 0
Fri Oct 18 21:21:46 2013 us=99818   engine = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   replay = ENABLED
Fri Oct 18 21:21:46 2013 us=99818   mute_replay_warnings = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   replay_window = 64
Fri Oct 18 21:21:46 2013 us=99818   replay_time = 15
Fri Oct 18 21:21:46 2013 us=99818   packet_id_file = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   use_iv = ENABLED
Fri Oct 18 21:21:46 2013 us=99818   test_crypto = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   tls_server = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   tls_client = ENABLED
Fri Oct 18 21:21:46 2013 us=99818   key_method = 2
Fri Oct 18 21:21:46 2013 us=99818   ca_file = '[[INLINE]]'
Fri Oct 18 21:21:46 2013 us=99818   ca_path = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   dh_file = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   cert_file = '[[INLINE]]'
Fri Oct 18 21:21:46 2013 us=99818   priv_key_file = '[[INLINE]]'
Fri Oct 18 21:21:46 2013 us=99818   pkcs12_file = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   cryptoapi_cert = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   cipher_list = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   tls_verify = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   tls_export_cert = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   verify_x509_type = 0
Fri Oct 18 21:21:46 2013 us=99818   verify_x509_name = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   crl_file = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   ns_cert_type = 0
Fri Oct 18 21:21:46 2013 us=99818   remote_cert_ku[i] = 0
Fri Oct 18 21:21:46 2013 us=99818   remote_cert_ku[i] = 0
Fri Oct 18 21:21:46 2013 us=99818   remote_cert_ku[i] = 0
Fri Oct 18 21:21:46 2013 us=99818   remote_cert_ku[i] = 0
Fri Oct 18 21:21:46 2013 us=99818   remote_cert_ku[i] = 0
Fri Oct 18 21:21:46 2013 us=99818   remote_cert_ku[i] = 0
Fri Oct 18 21:21:46 2013 us=99818   remote_cert_ku[i] = 0
Fri Oct 18 21:21:46 2013 us=99818   remote_cert_ku[i] = 0
Fri Oct 18 21:21:46 2013 us=99818   remote_cert_ku[i] = 0
Fri Oct 18 21:21:46 2013 us=99818   remote_cert_ku[i] = 0
Fri Oct 18 21:21:46 2013 us=99818   remote_cert_ku[i] = 0
Fri Oct 18 21:21:46 2013 us=99818   remote_cert_ku[i] = 0
Fri Oct 18 21:21:46 2013 us=99818   remote_cert_ku[i] = 0
Fri Oct 18 21:21:46 2013 us=99818   remote_cert_ku[i] = 0
Fri Oct 18 21:21:46 2013 us=99818   remote_cert_ku[i] = 0
Fri Oct 18 21:21:46 2013 us=99818   remote_cert_ku[i] = 0
Fri Oct 18 21:21:46 2013 us=99818   remote_cert_eku = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=99818   ssl_flags = 0
Fri Oct 18 21:21:46 2013 us=99818   tls_timeout = 2
Fri Oct 18 21:21:46 2013 us=99818   renegotiate_bytes = 0
Fri Oct 18 21:21:46 2013 us=99818   renegotiate_packets = 0
Fri Oct 18 21:21:46 2013 us=99818   renegotiate_seconds = 3600
Fri Oct 18 21:21:46 2013 us=99818   handshake_window = 60
Fri Oct 18 21:21:46 2013 us=99818   transition_window = 3600
Fri Oct 18 21:21:46 2013 us=99818   single_session = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   push_peer_info = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   tls_exit = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   tls_auth_file = '[[INLINE]]'
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_protected_authentication = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_private_mode = 00000000
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:46 2013 us=99818   pkcs11_cert_private = DISABLED
Fri Oct 18 21:21:46 2013 us=100818   pkcs11_pin_cache_period = -1
Fri Oct 18 21:21:46 2013 us=100818   pkcs11_id = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=100818   pkcs11_id_management = DISABLED
Fri Oct 18 21:21:46 2013 us=100818   server_network = 0.0.0.0
Fri Oct 18 21:21:46 2013 us=100818   server_netmask = 0.0.0.0
Fri Oct 18 21:21:46 2013 us=102819   server_network_ipv6 = ::
Fri Oct 18 21:21:46 2013 us=102819   server_netbits_ipv6 = 0
Fri Oct 18 21:21:46 2013 us=102819   server_bridge_ip = 0.0.0.0
Fri Oct 18 21:21:46 2013 us=102819   server_bridge_netmask = 0.0.0.0
Fri Oct 18 21:21:46 2013 us=102819   server_bridge_pool_start = 0.0.0.0
Fri Oct 18 21:21:46 2013 us=102819   server_bridge_pool_end = 0.0.0.0
Fri Oct 18 21:21:46 2013 us=102819   ifconfig_pool_defined = DISABLED
Fri Oct 18 21:21:46 2013 us=102819   ifconfig_pool_start = 0.0.0.0
Fri Oct 18 21:21:46 2013 us=102819   ifconfig_pool_end = 0.0.0.0
Fri Oct 18 21:21:46 2013 us=102819   ifconfig_pool_netmask = 0.0.0.0
Fri Oct 18 21:21:46 2013 us=102819   ifconfig_pool_persist_filename = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=102819   ifconfig_pool_persist_refresh_freq = 600
Fri Oct 18 21:21:46 2013 us=102819   ifconfig_ipv6_pool_defined = DISABLED
Fri Oct 18 21:21:46 2013 us=102819   ifconfig_ipv6_pool_base = ::
Fri Oct 18 21:21:46 2013 us=102819   ifconfig_ipv6_pool_netbits = 0
Fri Oct 18 21:21:46 2013 us=102819   n_bcast_buf = 256
Fri Oct 18 21:21:46 2013 us=102819   tcp_queue_limit = 64
Fri Oct 18 21:21:46 2013 us=102819   real_hash_size = 256
Fri Oct 18 21:21:46 2013 us=102819   virtual_hash_size = 256
Fri Oct 18 21:21:46 2013 us=102819   client_connect_script = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=102819   learn_address_script = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=102819   client_disconnect_script = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=102819   client_config_dir = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=102819   ccd_exclusive = DISABLED
Fri Oct 18 21:21:46 2013 us=102819   tmp_dir = 'L:\TEMP\User\'
Fri Oct 18 21:21:46 2013 us=102819   push_ifconfig_defined = DISABLED
Fri Oct 18 21:21:46 2013 us=102819   push_ifconfig_local = 0.0.0.0
Fri Oct 18 21:21:46 2013 us=102819   push_ifconfig_remote_netmask = 0.0.0.0
Fri Oct 18 21:21:46 2013 us=102819   push_ifconfig_ipv6_defined = DISABLED
Fri Oct 18 21:21:46 2013 us=102819   push_ifconfig_ipv6_local = ::/0
Fri Oct 18 21:21:46 2013 us=102819   push_ifconfig_ipv6_remote = ::
Fri Oct 18 21:21:46 2013 us=102819   enable_c2c = DISABLED
Fri Oct 18 21:21:46 2013 us=102819   duplicate_cn = DISABLED
Fri Oct 18 21:21:46 2013 us=102819   cf_max = 0
Fri Oct 18 21:21:46 2013 us=102819   cf_per = 0
Fri Oct 18 21:21:46 2013 us=102819   max_clients = 1024
Fri Oct 18 21:21:46 2013 us=102819   max_routes_per_client = 256
Fri Oct 18 21:21:46 2013 us=102819   auth_user_pass_verify_script = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=102819   auth_user_pass_verify_script_via_file = DISABLED
Fri Oct 18 21:21:46 2013 us=102819   client = ENABLED
Fri Oct 18 21:21:46 2013 us=102819   pull = ENABLED
Fri Oct 18 21:21:46 2013 us=102819   auth_user_pass_file = 'vpn.txt'
Fri Oct 18 21:21:46 2013 us=102819   show_net_up = DISABLED
Fri Oct 18 21:21:46 2013 us=102819   route_method = 0
Fri Oct 18 21:21:46 2013 us=102819   ip_win32_defined = DISABLED
Fri Oct 18 21:21:46 2013 us=102819   ip_win32_type = 3
Fri Oct 18 21:21:46 2013 us=102819   dhcp_masq_offset = 0
Fri Oct 18 21:21:46 2013 us=102819   dhcp_lease_time = 31536000
Fri Oct 18 21:21:46 2013 us=102819   tap_sleep = 0
Fri Oct 18 21:21:46 2013 us=102819   dhcp_options = DISABLED
Fri Oct 18 21:21:46 2013 us=102819   dhcp_renew = DISABLED
Fri Oct 18 21:21:46 2013 us=102819   dhcp_pre_release = DISABLED
Fri Oct 18 21:21:46 2013 us=102819   dhcp_release = DISABLED
Fri Oct 18 21:21:46 2013 us=102819   domain = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=102819   netbios_scope = '[UNDEF]'
Fri Oct 18 21:21:46 2013 us=102819   netbios_node_type = 0
Fri Oct 18 21:21:46 2013 us=102819   disable_nbt = DISABLED
Fri Oct 18 21:21:46 2013 us=102819 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Enter Management Password:
Fri Oct 18 21:21:46 2013 us=104819 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Fri Oct 18 21:21:46 2013 us=104819 Need hold release from management interface, waiting...
Fri Oct 18 21:21:46 2013 us=559845 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Fri Oct 18 21:21:46 2013 us=659850 MANAGEMENT: CMD 'state on'
Fri Oct 18 21:21:46 2013 us=659850 MANAGEMENT: CMD 'log all on'
Fri Oct 18 21:21:46 2013 us=737855 MANAGEMENT: CMD 'hold off'
Fri Oct 18 21:21:46 2013 us=739855 MANAGEMENT: CMD 'hold release'
Fri Oct 18 21:21:46 2013 us=739855 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Fri Oct 18 21:21:46 2013 us=870862 Control Channel Authentication: tls-auth using INLINE static key file
Fri Oct 18 21:21:46 2013 us=870862 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Oct 18 21:21:46 2013 us=870862 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Oct 18 21:21:46 2013 us=870862 LZO compression initialized
Fri Oct 18 21:21:46 2013 us=870862 Control Channel MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ]
Fri Oct 18 21:21:46 2013 us=870862 Socket Buffers: R=[8192->8192] S=[8192->8192]
Fri Oct 18 21:21:46 2013 us=870862 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Fri Oct 18 21:21:46 2013 us=870862 Local Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Fri Oct 18 21:21:46 2013 us=870862 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Fri Oct 18 21:21:46 2013 us=870862 Local Options hash (VER=V4): '13a273ba'
Fri Oct 18 21:21:46 2013 us=870862 Expected Remote Options hash (VER=V4): '360696c5'
Fri Oct 18 21:21:46 2013 us=870862 UDPv4 link local: [undef]
Fri Oct 18 21:21:46 2013 us=870862 UDPv4 link remote: [AF_INET]SERVERIP:SERVERPORT
Fri Oct 18 21:21:46 2013 us=870862 MANAGEMENT: >STATE:1382124106,WAIT,,,
Fri Oct 18 21:21:47 2013 us=160879 MANAGEMENT: >STATE:1382124107,AUTH,,,
Fri Oct 18 21:21:47 2013 us=160879 TLS: Initial packet from [AF_INET]SERVERIP:SERVERPORT, sid=df538f5e 03245299
Fri Oct 18 21:21:48 2013 us=922980 VERIFY OK: depth=1, C=AT, ST=vpn, L=vpn, O=vpn, OU=vpn, CN=vpn, name=vpn, emailAddress=info@vpn
Fri Oct 18 21:21:48 2013 us=922980 VERIFY OK: depth=0, C=AT, ST=vpn, L=vpn, O=vpn, OU=vpn, CN=server, name=vpn, emailAddress=info@vpn
Fri Oct 18 21:21:53 2013 us=226226 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Oct 18 21:21:53 2013 us=226226 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Oct 18 21:21:53 2013 us=226226 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Oct 18 21:21:53 2013 us=226226 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Oct 18 21:21:53 2013 us=227226 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Fri Oct 18 21:21:53 2013 us=227226 [server] Peer Connection Initiated with [AF_INET]SERVERIP:SERVERPORT
Fri Oct 18 21:21:54 2013 us=321289 MANAGEMENT: >STATE:1382124114,GET_CONFIG,,,
Fri Oct 18 21:21:55 2013 us=415351 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Fri Oct 18 21:21:55 2013 us=728369 PUSH: Received control message: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,persist-key,persist-tun,dhcp-option DNS 172.16.0.1,dhcp-option DNS 8.8.8.8,comp-lzo,route-gateway 172.16.0.1,ping 10,ping-restart 120,ifconfig 172.16.0.2 255.255.255.0'
Fri Oct 18 21:21:55 2013 us=728369 OPTIONS IMPORT: timers and/or timeouts modified
Fri Oct 18 21:21:55 2013 us=728369 OPTIONS IMPORT: LZO parms modified
Fri Oct 18 21:21:55 2013 us=728369 OPTIONS IMPORT: --persist options modified
Fri Oct 18 21:21:55 2013 us=728369 OPTIONS IMPORT: --ifconfig/up options modified
Fri Oct 18 21:21:55 2013 us=728369 OPTIONS IMPORT: route options modified
Fri Oct 18 21:21:55 2013 us=728369 OPTIONS IMPORT: route-related options modified
Fri Oct 18 21:21:55 2013 us=728369 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Fri Oct 18 21:21:55 2013 us=733369 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Oct 18 21:21:55 2013 us=733369 MANAGEMENT: >STATE:1382124115,ASSIGN_IP,,172.16.0.2,
Fri Oct 18 21:21:55 2013 us=733369 open_tun, tt->ipv6=0
Fri Oct 18 21:21:55 2013 us=734369 TAP-WIN32 device [VPN] opened: \\.\Global\{7F4D1219-500A-4A3A-807C-042B969F450C}.tap
Fri Oct 18 21:21:55 2013 us=734369 TAP-Windows Driver Version 9.9 
Fri Oct 18 21:21:55 2013 us=734369 TAP-Windows MTU=1500
Fri Oct 18 21:21:55 2013 us=736370 Notified TAP-Windows driver to set a DHCP IP/netmask of 172.16.0.2/255.255.255.0 on interface {7F4D1219-500A-4A3A-807C-042B969F450C} [DHCP-serv: 172.16.0.0, lease-time: 31536000]
Fri Oct 18 21:21:55 2013 us=736370 DHCP option string: 0608ac10 00010808 0808
Fri Oct 18 21:21:55 2013 us=736370 Successful ARP Flush on interface [54] {7F4D1219-500A-4A3A-807C-042B969F450C}
Fri Oct 18 21:22:00 2013 us=75618 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Fri Oct 18 21:22:00 2013 us=75618 MANAGEMENT: >STATE:1382124120,ADD_ROUTES,,,
Fri Oct 18 21:22:00 2013 us=76618 C:\Windows\system32\route.exe ADD 192.168.0.0 MASK 255.255.255.0 172.16.0.1
Fri Oct 18 21:22:00 2013 us=78618 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Fri Oct 18 21:22:00 2013 us=78618 Route addition via IPAPI succeeded [adaptive]
Fri Oct 18 21:22:00 2013 us=78618 Initialization Sequence Completed
Fri Oct 18 21:22:00 2013 us=78618 MANAGEMENT: >STATE:1382124120,CONNECTED,SUCCESS,172.16.0.2,SERVERIP
Fri Oct 18 22:21:57 2013 us=819397 MANAGEMENT: Client disconnected
Fri Oct 18 22:21:57 2013 us=819397 ERROR: could not read Auth username/password/ok/string from management interface
Fri Oct 18 22:21:57 2013 us=819397 Exiting due to fatal error
Fri Oct 18 22:21:57 2013 us=819397 C:\Windows\system32\route.exe DELETE 192.168.0.0 MASK 255.255.255.0 172.16.0.1
Fri Oct 18 22:21:57 2013 us=821397 Route deletion via IPAPI succeeded [adaptive]
Fri Oct 18 22:21:57 2013 us=821397 Closing TUN/TAP interface

Patschi

Thanks for your response. I'd like to use TAP instead of tun.
What settings are wrong for tap? What should I try, when I want to use tap?
I don't know what I should try exactly.

Patschi

Thanks for your help, but sadly now change with the stability. I replaced "server" with exact the following line to the already existing config:

server-bridge 172.16.0.1 255.255.255.0 172.16.0.2 172.16.0.254

Server-Log:

Sat Oct 26 00:14:30 2013 us=773924 PC/IP:PORT MULTI: Learn: 00:ff:7f:4d:12:19 -> PC/IP:PORT
Sat Oct 26 01:14:28 2013 us=49189 PC/IP:PORT TLS: soft reset sec=0 bytes=289222/0 pkts=1991/0
Sat Oct 26 01:15:17 2013 us=564293 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Sat Oct 26 01:15:27 2013 us=135693 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Sat Oct 26 01:15:28 2013 us=331927 PC/IP:PORT TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sat Oct 26 01:15:28 2013 us=331945 PC/IP:PORT TLS Error: TLS handshake failed
Sat Oct 26 01:15:28 2013 us=331952 PC/IP:PORT TLS: move_session: dest=TM_LAME_DUCK src=TM_ACTIVE reinit_src=1
Sat Oct 26 01:15:37 2013 us=555867 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Sat Oct 26 01:15:43 2013 us=626967 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Sat Oct 26 01:15:45 2013 us=690224 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Sat Oct 26 01:15:49 2013 us=952568 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Sat Oct 26 01:15:57 2013 us=218663 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Sat Oct 26 01:16:43 2013 us=635890 PC/IP:PORT TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sat Oct 26 01:16:43 2013 us=635953 PC/IP:PORT TLS Error: TLS handshake failed

Client-Log:

Sat Oct 26 00:14:18 2013 us=470374 Successful ARP Flush on interface [37] {7F4D1219-500A-4A3A-807C-042B969F450C}
Sat Oct 26 00:14:23 2013 us=58636 TEST ROUTES: 0/0 succeeded len=0 ret=1 a=0 u/d=up
Sat Oct 26 00:14:23 2013 us=58636 Initialization Sequence Completed
Sat Oct 26 00:14:23 2013 us=58636 MANAGEMENT: >STATE:1382739263,CONNECTED,SUCCESS,172.16.0.2,SERVERIP
Sat Oct 26 01:14:55 2013 us=932425 MANAGEMENT: Client disconnected
Sat Oct 26 01:14:55 2013 us=932425 ERROR: could not read Auth username/password/ok/string from management interface
Sat Oct 26 01:14:55 2013 us=932425 Exiting due to fatal error
Sat Oct 26 01:14:55 2013 us=932425 Closing TUN/TAP interface

The curious thing is, that the connection seems to get lost about every hour... I have created no bridge between tap0 and eth0 on my linux debian server, because the VPN only should have access to the internal network and not to the internet.

Patschi

Good to know, but just asking, because it would interest me: Why OpenVPN needs a bridge between tap0 and eth0 interface?
The logs are always the same like on the post before: https://forums.openvpn.net/topic14083.html#p34240

Server-Config:

cert keys/server.crt
key keys/server.key
dh keys/dh1024.pem
server-bridge 172.16.0.1 255.255.255.0 172.16.0.2 172.16.0.254
push "route 192.168.100.0 255.255.255.0"
ifconfig-pool-persist ip-pool.txt
client-config-dir clientconfig
push "persist-key"
push "persist-tun"
push "dhcp-option DNS 172.16.0.1"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
comp-lzo
user openvpn
group openvpn
username-as-common-name
auth-user-pass-verify scripts/login.sh via-env
client-connect scripts/connect.sh
client-disconnect scripts/disconnect.sh
script-security 3 system
tls-auth keys/ta.key 0
tls-server
client-to-client
persist-key
persist-tun
status status.log 10
status-version 2
log-append openvpn.log
verb 4

Client-Config:

client
dev tap
proto udp
remote IP PORT
resolv-retry infinite
nobind
persist-key
persist-tun
auth-user-pass pass.txt
auth-retry interact
auth-nocache
ca [inline]
cert [inline]
key [inline]
tls-client
tls-auth [inline] 1
tls-remote server
remote-cert-tls server
ns-cert-type server
pull
verb 4
keepalive 5 120
comp-lzo
<tls-auth>...</tls-auth>
<ca>...</ca>
<cert>...</cert>
<key>...</key>

Short off-topic:
I really thank you for your great help and I wish you all the best as a new global moderator! 🙂

Patschi

debbie10t wrotedev tap: Bridge is OSI Layer 2 .. all packets are forwarded across the vpn just like a LAN cable.

That is exactly what I want. I want to have access to the internal network on my server like the service would be in my local LAN. I have some virtual machines (Linux and Windows) running on the server and I want to access them directly. I also want to link all my other servers in the VPN to estabilish secure connections between them (SSH, ...). Like I read on some sites, tap is the best choice for this behaviour.

I already removed the three lines with mtu and tried it two times after removing it - still connection problems after about one hour. I also stripped the config a bit (except tls-auth) and also no change, so I also guess that there are some problems with the "dev". But I don't know what I should try...

Patschi

Okay, thanks. I'll try it today later. I better go to sleep now, instead testing it now and failing because I'm already sleeping for 50% 😃

Is there anything I should know about "server-bridge"? Can I start beginning at .0.2 or is there any IP reserved for broadcast or something like that?

server-bridge 172.16.0.1 255.255.255.0 172.16.0.2 172.16.0.254

Just to be sure: OpenVPN is only giving internet access to the clients, if I enable

push "redirect-gateway def1 bypass-dhcp"

...in the configuration?

To be more exactly:
My goal is to make these two subnets available through the VPN - Only the both, nothing more.

172.16.0.0: VPN clients (Interface: tap0 (and br0?))
192.168.0.0: virtual machines (Interfaces: vmbr0 and venet0)

Is it enough to create the bridge "br0" with eth0 and tap0 or have I to include the other two interfaces for the VMs too? Within the one hour the connection was working on the OpenVPN I was able to ping all these IPs - after the connection lost, ofcourse, not anymore. Sometimes I read "dev tap" and sometimes "dev tap0" in some example configurations of OpenVPN - is there any difference between them?

Patschi

Exactly this page I found too and used this for getting some informations. I tried to add eth0 to br0, but sadly this ended not very well... The whole connection of the server got lost (after I sent "brctl addif br0 eth0"). I still wondering, why I exactly loose the connection after one hour (+-5min)... The connection (ping, http, ...) is working fine and without any problems, but the connection losts after one hour not. (I also can ping the host and all VMs)

I know that 172.16.0.0 are very common, but on no computer I used this subnet is in use, so I choose this one.