MULTI: bad source address from client [ipv6...], packet drop

crinitic

Hi all,

I currently have a two issues with my openvpn connection. The server is on debian and the client is on Windows 7. Out of this two issues, my VPN is working properly (it forwards the traffic from my client through my server to go to internet).

My first issue, just after the client connects, I get a lot of:
MULTI: bad source address from client [ipv6...], packet dropped
for 3-4 minutes, then it stops. The VPN is working while I have those and also when they stop. The ipv6 address shown seems to be the address of my client openvpn connection (same connection as my 10.8.0.x).
- Why am I getting these messages ?
- How to solve the issue ?

My second issue is that, after 15-20 minutes, the vpn connection stops working without any message in the logs (neither server nor client side). The connection stays active (green on the icon), but it just doesn't work anymore. If I simply disconnect and reconnect, it works again for 15-20 minutes. Any idea how I can debug this ?

My server config:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
client-to-client
keepalive 10 120
cipher AES-256-CBC   # AES
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append  openvpn.log
verb 6

Client config:

client
dev tun
proto udp
remote a.b.c.d 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert crinitic.crt
key crinitic.key
ns-cert-type server
cipher AES-256-CBC
comp-lzo
verb 6

startup scripts

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t filter -A INPUT -p udp --dport 1194 -j ACCEPT
iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to 10.99.0.11 # i run in a VM, 10.99.0.11 is the interface which is bridged with the internet interface from the host
iptables -I INPUT -i tun+ -j ACCEPT
iptables -I FORWARD -i tun+ -j ACCEPT
iptables -I OUTPUT -o tun+ -j ACCEPT
iptables -I FORWARD -o tun+ -j ACCEPT
iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Any help is more than welcome 🙂

Thank you a lot

crinitic

Additional information:

when the connection stops working, I get the following logs on the server (nothing special but a few lines per minute instead of a lot every second):

Wed Dec 11 05:09:31 2013 us=701997 crinitic/CLIENT_PUB_IP:52884 UDPv4 WRITE [453] to [AF_INET]CLIENT_PUB_IP:52884: P_DATA_V1 kid=0 DATA len=452
Wed Dec 11 05:09:35 2013 us=361224 crinitic/CLIENT_PUB_IP:52884 TUN READ [1392]
Wed Dec 11 05:09:35 2013 us=361449 crinitic/CLIENT_PUB_IP:52884 UDPv4 WRITE [1445] to [AF_INET]CLIENT_PUB_IP:52884: P_DATA_V1 kid=0 DATA len=1444
Wed Dec 11 05:09:37 2013 us=140041 crinitic/CLIENT_PUB_IP:52884 TUN READ [1392]
Wed Dec 11 05:09:37 2013 us=140276 crinitic/CLIENT_PUB_IP:52884 UDPv4 WRITE [1445] to [AF_INET]CLIENT_PUB_IP:52884: P_DATA_V1 kid=0 DATA len=1444
Wed Dec 11 05:09:38 2013 us=391407 crinitic/CLIENT_PUB_IP:52884 TUN READ [105]
Wed Dec 11 05:09:38 2013 us=391613 crinitic/CLIENT_PUB_IP:52884 UDPv4 WRITE [149] to [AF_INET]CLIENT_PUB_IP:52884: P_DATA_V1 kid=0 DATA len=148
Wed Dec 11 05:09:38 2013 us=391792 crinitic/CLIENT_PUB_IP:52884 TUN READ [85]
Wed Dec 11 05:09:38 2013 us=391917 crinitic/CLIENT_PUB_IP:52884 UDPv4 WRITE [133] to [AF_INET]CLIENT_PUB_IP:52884: P_DATA_V1 kid=0 DATA len=132
Wed Dec 11 05:09:38 2013 us=392085 crinitic/CLIENT_PUB_IP:52884 TUN READ [40]

and on the client:

Tue Dec 10 23:09:22 2013 us=817839 UDPv4 WRITE [85] to [AF_INET]SERVER_PUB_IP:1194: P_DATA_V1 kid=0 DATA len=84
Tue Dec 10 23:09:23 2013 us=417873 UDPv4 WRITE [101] to [AF_INET]SERVER_PUB_IP:1194: P_DATA_V1 kid=0 DATA len=100
Tue Dec 10 23:09:23 2013 us=591883 UDPv4 WRITE [85] to [AF_INET]SERVER_PUB_IP:1194: P_DATA_V1 kid=0 DATA len=84
Tue Dec 10 23:09:23 2013 us=630885 UDPv4 WRITE [85] to [AF_INET]SERVER_PUB_IP:1194: P_DATA_V1 kid=0 DATA len=84
Tue Dec 10 23:09:23 2013 us=917902 UDPv4 WRITE [1445] to [AF_INET]SERVER_PUB_IP:1194: P_DATA_V1 kid=0 DATA len=1444

If I try to ping DNS servers or the VPN server with the Openvpn network ip, it fails:

C:\Users\crinitic>ping 8.8.8.8

Pinging 8.8.8.8 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 8.8.8.8:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
	
	
C:\Users\crinitic>ping 10.8.0.1

Pinging 10.8.0.1 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 10.8.0.1:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

And after I few minutes, I get the following log on the server:

Wed Dec 11 05:12:09 2013 us=736904 crinitic/CLIENT_PUB_IP:52884 [crinitic] Inactivity timeout (--ping-restart), restarting
Wed Dec 11 05:12:09 2013 us=737019 crinitic/CLIENT_PUB_IP:52884 SIGUSR1[soft,ping-restart] received, client-instance restarting

and on the client:

Tue Dec 10 23:14:33 2013 us=99586 UDPv4 WRITE [101] to [AF_INET]SERVER_PUB_IP:1194: P_DATA_V1 kid=0 DATA len=100
Tue Dec 10 23:14:33 2013 us=205592 UDPv4 WRITE [101] to [AF_INET]SERVER_PUB_IP:1194: P_DATA_V1 kid=0 DATA len=100
Tue Dec 10 23:14:35 2013 us=125702 [vpn.carlocriniti.com] Inactivity timeout (--ping-restart), restarting
Tue Dec 10 23:14:35 2013 us=126702 TCP/UDP: Closing socket
Tue Dec 10 23:14:35 2013 us=126702 SIGUSR1[soft,ping-restart] received, process restarting
Tue Dec 10 23:14:35 2013 us=126702 MANAGEMENT: >STATE:1386735275,RECONNECTING,ping-restart,,
Tue Dec 10 23:14:35 2013 us=127702 Restart pause, 2 second(s)
Tue Dec 10 23:14:37 2013 us=127816 Re-using SSL/TLS context

And it works again for 15-20 minutes...

crinitic

Hi,

thank you a lot for helping me

I did the change to the verb and keepalive, and here is what I got:

Server side:

Thu Dec 12 00:27:29 2013 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jun 18 2013
Thu Dec 12 00:27:29 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Dec 12 00:27:29 2013 Diffie-Hellman initialized with 2048 bit key
Thu Dec 12 00:27:29 2013 TLS-Auth MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Dec 12 00:27:29 2013 Socket Buffers: R=[229376->131072] S=[229376->131072]
Thu Dec 12 00:27:29 2013 ROUTE default_gateway=10.99.0.254
Thu Dec 12 00:27:29 2013 TUN/TAP device tun0 opened
Thu Dec 12 00:27:29 2013 TUN/TAP TX queue length set to 100
Thu Dec 12 00:27:29 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Dec 12 00:27:29 2013 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Thu Dec 12 00:27:29 2013 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Thu Dec 12 00:27:29 2013 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Dec 12 00:27:29 2013 GID set to nogroup
Thu Dec 12 00:27:29 2013 UID set to nobody
Thu Dec 12 00:27:29 2013 UDPv4 link local (bound): [undef]
Thu Dec 12 00:27:29 2013 UDPv4 link remote: [undef]
Thu Dec 12 00:27:29 2013 MULTI: multi_init called, r=256 v=256
Thu Dec 12 00:27:29 2013 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Thu Dec 12 00:27:29 2013 ifconfig_pool_read(), in='crinitic,10.8.0.4', TODO: IPv6
Thu Dec 12 00:27:29 2013 succeeded -> ifconfig_pool_set()
Thu Dec 12 00:27:29 2013 IFCONFIG POOL LIST
Thu Dec 12 00:27:29 2013 crinitic,10.8.0.4
Thu Dec 12 00:27:29 2013 Initialization Sequence Completed
Thu Dec 12 00:27:50 2013 MULTI: multi_create_instance called
Thu Dec 12 00:27:50 2013 CLIENT_PUB_IP:50521 Re-using SSL/TLS context
Thu Dec 12 00:27:50 2013 CLIENT_PUB_IP:50521 LZO compression initialized
Thu Dec 12 00:27:50 2013 CLIENT_PUB_IP:50521 Control Channel MTU parms [ L:1558
Thu Dec 12 00:27:50 2013 CLIENT_PUB_IP:50521 Data Channel MTU parms [ L:1558 D:
Thu Dec 12 00:27:50 2013 CLIENT_PUB_IP:50521 Local Options hash (VER=V4): 'a8f5
Thu Dec 12 00:27:50 2013 CLIENT_PUB_IP:50521 Expected Remote Options hash (VER=
Thu Dec 12 00:27:50 2013 CLIENT_PUB_IP:50521 TLS: Initial packet from [AF_INET]
Thu Dec 12 00:27:52 2013 CLIENT_PUB_IP:50521 VERIFY OK: depth=1, /C=CH/ST=ZH/L=
Thu Dec 12 00:27:52 2013 CLIENT_PUB_IP:50521 VERIFY OK: depth=0, /C=CH/ST=ZH/L=
Thu Dec 12 00:27:52 2013 CLIENT_PUB_IP:50521 Data Channel Encrypt: Cipher 'AES-
Thu Dec 12 00:27:52 2013 CLIENT_PUB_IP:50521 Data Channel Encrypt: Using 160 bi
Thu Dec 12 00:27:52 2013 CLIENT_PUB_IP:50521 Data Channel Decrypt: Cipher 'AES-
Thu Dec 12 00:27:52 2013 CLIENT_PUB_IP:50521 Data Channel Decrypt: Using 160 bi
Thu Dec 12 00:27:52 2013 CLIENT_PUB_IP:50521 Control Channel: TLSv1, cipher TLS
Thu Dec 12 00:27:52 2013 CLIENT_PUB_IP:50521 [crinitic] Peer Connection Initiat
Thu Dec 12 00:27:52 2013 crinitic/CLIENT_PUB_IP:50521 MULTI_sva: pool returned
Thu Dec 12 00:27:52 2013 crinitic/CLIENT_PUB_IP:50521 MULTI: Learn: 10.8.0.6 ->
Thu Dec 12 00:27:52 2013 crinitic/CLIENT_PUB_IP:50521 MULTI: primary virtual IP
Thu Dec 12 00:27:55 2013 crinitic/CLIENT_PUB_IP:50521 PUSH: Received control me
Thu Dec 12 00:27:55 2013 crinitic/CLIENT_PUB_IP:50521 send_push_reply(): safe_c
Thu Dec 12 00:27:55 2013 crinitic/CLIENT_PUB_IP:50521 SENT CONTROL [crinitic]:                                                                                                  te 10.8.0.0 255.255.255.0,topology net30,ping 5,ping-restart 15,ifconfig 10.8.0.
Thu Dec 12 00:44:29 2013 crinitic/CLIENT_PUB_IP:50521 [crinitic] Inactivity timeout (--ping-restart), restarting
Thu Dec 12 00:44:29 2013 crinitic/CLIENT_PUB_IP:50521 SIGUSR1[soft,ping-restart] received, client-instance restarting
Thu Dec 12 00:44:42 2013 MULTI: multi_create_instance called
Thu Dec 12 00:44:42 2013 CLIENT_PUB_IP:50545 Re-using SSL/TLS context
Thu Dec 12 00:44:42 2013 CLIENT_PUB_IP:50545 LZO compression initialized
Thu Dec 12 00:44:42 2013 CLIENT_PUB_IP:50545 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Dec 12 00:44:42 2013 CLIENT_PUB_IP:50545 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Dec 12 00:44:42 2013 CLIENT_PUB_IP:50545 Local Options hash (VER=V4): 'a8f55717'
Thu Dec 12 00:44:42 2013 CLIENT_PUB_IP:50545 Expected Remote Options hash (VER=V4): '22188c5b'
Thu Dec 12 00:44:42 2013 CLIENT_PUB_IP:50545 TLS: Initial packet from [AF_INET]CLIENT_PUB_IP:50545, sid=4cc17ac5 03a319d3
Thu Dec 12 00:44:44 2013 CLIENT_PUB_IP:50545 VERIFY OK: depth=1, /C=CH/ST=ZH/L=Zurich/O=None/OU=none/CN=server/name=vpn/emailAddress=mail@mail.com
Thu Dec 12 00:44:44 2013 CLIENT_PUB_IP:50545 VERIFY OK: depth=0, /C=CH/ST=ZH/L=Zurich/O=None/OU=none/CN=crinitic/name=vpn/emailAddress=mail@mail.com
Thu Dec 12 00:44:44 2013 CLIENT_PUB_IP:50545 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Dec 12 00:44:44 2013 CLIENT_PUB_IP:50545 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec 12 00:44:44 2013 CLIENT_PUB_IP:50545 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Dec 12 00:44:44 2013 CLIENT_PUB_IP:50545 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec 12 00:44:45 2013 CLIENT_PUB_IP:50545 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu Dec 12 00:44:45 2013 CLIENT_PUB_IP:50545 [crinitic] Peer Connection Initiated with [AF_INET]CLIENT_PUB_IP:50545
Thu Dec 12 00:44:45 2013 crinitic/CLIENT_PUB_IP:50545 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=1::1d00:0:947f:0
Thu Dec 12 00:44:45 2013 crinitic/CLIENT_PUB_IP:50545 MULTI: Learn: 10.8.0.6 -> crinitic/CLIENT_PUB_IP:50545
Thu Dec 12 00:44:45 2013 crinitic/CLIENT_PUB_IP:50545 MULTI: primary virtual IP for crinitic/CLIENT_PUB_IP:50545: 10.8.0.6
Thu Dec 12 00:44:46 2013 crinitic/CLIENT_PUB_IP:50545 PUSH: Received control message: 'PUSH_REQUEST'
Thu Dec 12 00:44:46 2013 crinitic/CLIENT_PUB_IP:50545 send_push_reply(): safe_cap=960
Thu Dec 12 00:44:46 2013 crinitic/CLIENT_PUB_IP:50545 SENT CONTROL [crinitic]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.0 255.255.255.0,topology net30,ping 5,ping-restart 15,ifconfig 10.8.0.6 10.8.0.5' (status=1)

Client side:

Wed Dec 11 18:28:24 2013 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Enter Management Password:
Wed Dec 11 18:28:24 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Dec 11 18:28:24 2013 Need hold release from management interface, waiting...
Wed Dec 11 18:28:25 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Dec 11 18:28:25 2013 MANAGEMENT: CMD 'state on'
Wed Dec 11 18:28:25 2013 MANAGEMENT: CMD 'log all on'
Wed Dec 11 18:28:25 2013 MANAGEMENT: CMD 'hold off'
Wed Dec 11 18:28:25 2013 MANAGEMENT: CMD 'hold release'
Wed Dec 11 18:28:27 2013 MANAGEMENT: CMD 'password [...]'
Wed Dec 11 18:28:27 2013 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Dec 11 18:28:27 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Dec 11 18:28:27 2013 UDPv4 link local: [undef]
Wed Dec 11 18:28:27 2013 UDPv4 link remote: [AF_INET]SERVER_PUB_IP:1194
Wed Dec 11 18:28:27 2013 MANAGEMENT: >STATE:1386804507,WAIT,,,
Wed Dec 11 18:28:27 2013 MANAGEMENT: >STATE:1386804507,AUTH,,,
Wed Dec 11 18:28:27 2013 TLS: Initial packet from [AF_INET]SERVER_PUB_IP:1194, sid=b6c7c08c be1b23b1
Wed Dec 11 18:28:27 2013 VERIFY OK: depth=1, C=CH, ST=ZH, L=Zurich, O=None, OU=none, CN=server, name=vpn, emailAddress=mail@mail.com
Wed Dec 11 18:28:27 2013 VERIFY OK: nsCertType=SERVER
Wed Dec 11 18:28:27 2013 VERIFY OK: depth=0, C=CH, ST=ZH, L=Zurich, O=None, OU=none, CN=server, name=vpn, emailAddress=mail@mail.com
Wed Dec 11 18:28:29 2013 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Dec 11 18:28:29 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Dec 11 18:28:29 2013 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Dec 11 18:28:29 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Dec 11 18:28:29 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Dec 11 18:28:29 2013 [server] Peer Connection Initiated with [AF_INET]SERVER_PUB_IP:1194
Wed Dec 11 18:28:30 2013 MANAGEMENT: >STATE:1386804510,GET_CONFIG,,,
Wed Dec 11 18:28:31 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Dec 11 18:28:31 2013 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.0 255.255.255.0,topology net30,ping 5,ping-restart 15,ifconfig 10.8.0.6 10.8.0.5'
Wed Dec 11 18:28:31 2013 OPTIONS IMPORT: timers and/or timeouts modified
Wed Dec 11 18:28:31 2013 OPTIONS IMPORT: --ifconfig/up options modified
Wed Dec 11 18:28:31 2013 OPTIONS IMPORT: route options modified
Wed Dec 11 18:28:31 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Dec 11 18:28:31 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Dec 11 18:28:31 2013 MANAGEMENT: >STATE:1386804511,ASSIGN_IP,,10.8.0.6,
Wed Dec 11 18:28:31 2013 open_tun, tt->ipv6=0
Wed Dec 11 18:28:31 2013 TAP-WIN32 device [OpenVPN] opened: \\.\Global\{4F12CFBA-FEEA-480F-AA6E-1C46D4294E67}.tap
Wed Dec 11 18:28:31 2013 TAP-Windows Driver Version 9.9 
Wed Dec 11 18:28:31 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {4F12CFBA-FEEA-480F-AA6E-1C46D4294E67} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Wed Dec 11 18:28:31 2013 Successful ARP Flush on interface [18] {4F12CFBA-FEEA-480F-AA6E-1C46D4294E67}
Wed Dec 11 18:28:36 2013 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Wed Dec 11 18:28:36 2013 C:\Windows\system32\route.exe ADD SERVER_PUB_IP MASK 255.255.255.255 10.0.0.1
Wed Dec 11 18:28:36 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Wed Dec 11 18:28:36 2013 Route addition via IPAPI succeeded [adaptive]
Wed Dec 11 18:28:36 2013 C:\Windows\system32\route.exe ADD 10.0.0.1 MASK 255.255.255.255 10.0.0.1 IF 11
Wed Dec 11 18:28:36 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Wed Dec 11 18:28:36 2013 Route addition via IPAPI succeeded [adaptive]
Wed Dec 11 18:28:36 2013 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Wed Dec 11 18:28:36 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Wed Dec 11 18:28:36 2013 Route addition via IPAPI succeeded [adaptive]
Wed Dec 11 18:28:36 2013 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Wed Dec 11 18:28:36 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Wed Dec 11 18:28:36 2013 Route addition via IPAPI succeeded [adaptive]
Wed Dec 11 18:28:36 2013 MANAGEMENT: >STATE:1386804516,ADD_ROUTES,,,
Wed Dec 11 18:28:36 2013 C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.5
Wed Dec 11 18:28:36 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Wed Dec 11 18:28:36 2013 Route addition via IPAPI succeeded [adaptive]
Wed Dec 11 18:28:36 2013 Initialization Sequence Completed
Wed Dec 11 18:28:36 2013 MANAGEMENT: >STATE:1386804516,CONNECTED,SUCCESS,10.8.0.6,SERVER_PUB_IP
Wed Dec 11 18:45:17 2013 [server] Inactivity timeout (--ping-restart), restarting
Wed Dec 11 18:45:17 2013 SIGUSR1[soft,ping-restart] received, process restarting
Wed Dec 11 18:45:17 2013 MANAGEMENT: >STATE:1386805517,RECONNECTING,ping-restart,,
Wed Dec 11 18:45:17 2013 Restart pause, 2 second(s)
Wed Dec 11 18:45:19 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Dec 11 18:45:19 2013 UDPv4 link local: [undef]
Wed Dec 11 18:45:19 2013 UDPv4 link remote: [AF_INET]SERVER_PUB_IP:1194
Wed Dec 11 18:45:19 2013 MANAGEMENT: >STATE:1386805519,WAIT,,,
Wed Dec 11 18:45:19 2013 MANAGEMENT: >STATE:1386805519,AUTH,,,
Wed Dec 11 18:45:19 2013 TLS: Initial packet from [AF_INET]SERVER_PUB_IP:1194, sid=85ba5720 eaff44f7
Wed Dec 11 18:45:20 2013 VERIFY OK: depth=1, C=CH, ST=ZH, L=Zurich, O=None, OU=none, CN=server, name=vpn, emailAddress=mail@mail.com
Wed Dec 11 18:45:20 2013 VERIFY OK: nsCertType=SERVER
Wed Dec 11 18:45:20 2013 VERIFY OK: depth=0, C=CH, ST=ZH, L=Zurich, O=None, OU=none, CN=server, name=vpn, emailAddress=mail@mail.com
Wed Dec 11 18:45:21 2013 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Dec 11 18:45:21 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Dec 11 18:45:21 2013 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Dec 11 18:45:21 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Dec 11 18:45:21 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Dec 11 18:45:21 2013 [server] Peer Connection Initiated with [AF_INET]SERVER_PUB_IP:1194
Wed Dec 11 18:45:22 2013 MANAGEMENT: >STATE:1386805522,GET_CONFIG,,,
Wed Dec 11 18:45:23 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Dec 11 18:45:23 2013 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.0 255.255.255.0,topology net30,ping 5,ping-restart 15,ifconfig 10.8.0.6 10.8.0.5'
Wed Dec 11 18:45:23 2013 OPTIONS IMPORT: timers and/or timeouts modified
Wed Dec 11 18:45:23 2013 OPTIONS IMPORT: --ifconfig/up options modified
Wed Dec 11 18:45:23 2013 OPTIONS IMPORT: route options modified
Wed Dec 11 18:45:23 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Dec 11 18:45:23 2013 Preserving previous TUN/TAP instance: OpenVPN
Wed Dec 11 18:45:23 2013 Initialization Sequence Completed
Wed Dec 11 18:45:23 2013 MANAGEMENT: >STATE:1386805523,CONNECTED,SUCCESS,10.8.0.6,SERVER_PUB_IP

On Windows, I don't have any firewall.

Moreover, how should I check the dropped packets for iptables on the server ?

Thank you for your help, it is very much appreciated

crinitic

Hi debbie10t,

Thank you for the time you spend helping me.

Problem is still here with Windows firewall completely disabled. I will check your link for the server (host and vm) firewall.

And yes the openvpn server is in a proxmox virtual machine.

Here is the network config on the host:
vmbr0 is the interface connected to internet
vmbr2 is the interface used as a bridge from the VM

auto vmbr2
iface vmbr2 inet static
    address 10.99.0.254
    netmask 255.255.255.0
    bridge_ports none
    bridge_stp off
    bridge_fd 0
    post-up echo 1 > /proc/sys/net/ipv4/ip_forward
    post-up iptables -t nat -A POSTROUTING -s '10.99.0.0/24' -o vmbr0 -j MASQUERADE # define out rule
    post-down iptables -t nat -D POSTROUTING -s '10.99.0.0/24' -o vmbr0 -j MASQUERADE # kill out rule
    post-up iptables -t nat -A PREROUTING -i vmbr0 -p udp --dport 1194 -j DNAT --to 10.99.0.11:1194
    post-down iptables -t nat -D PREROUTING -i vmbr0 -p udp --dport 1194 -j DNAT --to 10.99.0.11:1194

then the rules in the vpn having the openvpn server, where eth0 (10.99.0.11) is bridge to the host vmbr2:

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t filter -A INPUT -p udp --dport 1194 -j ACCEPT
iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to 10.99.0.11
iptables -I INPUT -i tun+ -j ACCEPT
iptables -I FORWARD -i tun+ -j ACCEPT
iptables -I OUTPUT -o tun+ -j ACCEPT
iptables -I FORWARD -o tun+ -j ACCEPT
iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

crinitic

Hi,

I have activated the logging on the host and on the VM hosting the VPN server.

On the host I get a lot of :

Dec 18 02:17:33 sd-56179 kernel: iptables denied: IN=vmbr0 OUT= MAC=ff:ff:ff:ff:ff:ff:d4:ae:52:cb:c3:67:08:00 SRC=UNKNOWN_IP_SAME_NETWORK DST=NETWORK_BROADCAST LEN=49 TOS=0x00 PREC=0x00 TT  L=128 ID=20787 PROTO=UDP SPT=51502 DPT=32412 LEN=29

and 1 minute before the disconnect, I get only once:

Dec 18 02:17:44 sd-56179 kernel: iptables denied: IN=vmbr0 OUT= MAC=01:00:5e:00:00:01:d4:ae:52:cb:c6:ca:08:00 SRC=0.0.0.0 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0xC0 TTL=1 ID=0 DF   PROTO=2
Dec 18 02:17:44 sd-56179 kernel: iptables denied: IN=vmbr0 OUT= MAC=01:00:5e:00:00:01:d4:ae:52:cb:c6:ca:08:00 SRC=0.0.0.0 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0xC0 TTL=1 ID=0 DF   PROTO=2

-------------------------

On the VM hosting the VPN server, I get a lot of:

Dec 18 02:17:55 vpn kernel: [852189.017793] iptables denied: IN=eth0 OUT= MAC=7e:44:56:0a:26:b2:7e:3b:16:c5:1c:7b:08:00 SRC=CLIENT_PUB_IP DST=10.99.0.11 LEN=113 TOS=0x00 PREC  =0x00 TTL=116 ID=30248 PROTO=UDP SPT=50686 DPT=1194 LEN=93

and 1 minute before the disconnect, I get only once:

Dec 18 02:17:43 vpn kernel: [852177.239789] iptables denied: IN=eth0 OUT= MAC=01:00:5e:00:00:01:7e:3b:16:c5:1c:7b:08:00 SRC=0.0.0.0 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0xC0 TTL  =1 ID=0 DF PROTO=2
Dec 18 02:17:43 vpn kernel: [852177.239794] iptables denied: IN=eth0 OUT= MAC=01:00:5e:00:00:01:7e:3b:16:c5:1c:7b:08:00 SRC=0.0.0.0 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0xC0 TTL  =1 ID=0 DF PROTO=2
Dec 18 02:17:43 vpn kernel: [852177.239798] iptables denied: IN=eth0 OUT= MAC=01:00:5e:00:00:01:7e:3b:16:c5:1c:7b:08:00 SRC=0.0.0.0 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0xC0 TTL  =1 ID=0 DF PROTO=2
Dec 18 02:17:43 vpn kernel: [852177.239802] iptables denied: IN=eth0 OUT= MAC=01:00:5e:00:00:01:7e:3b:16:c5:1c:7b:08:00 SRC=0.0.0.0 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0xC0 TTL  =1 ID=0 DF PROTO=2
Dec 18 02:17:43 vpn kernel: [852177.239806] iptables denied: IN=eth0 OUT= MAC=01:00:5e:00:00:01:7e:3b:16:c5:1c:7b:08:00 SRC=0.0.0.0 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0xC0 TTL  =1 ID=0 DF PROTO=2
Dec 18 02:17:43 vpn kernel: [852177.239810] iptables denied: IN=eth0 OUT= MAC=01:00:5e:00:00:01:7e:3b:16:c5:1c:7b:08:00 SRC=0.0.0.0 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0xC0 TTL  =1 ID=0 DF PROTO=2

Does it help ?

Thank you again for your help !!!

crinitic

Thank you for your help, thanks to you now I know I have to look deeper on the firewall in the VM. I will ask on proxmox community as you mentioned.

Thank you again for the time you spent !!!