Dear all,
I have a problem with the configuration of OpenVPN for which no one of many solutions I have seen from internet seems to work.
First of all few words about the infrastructure on which OpenVPN should be installed.
I have a public subnet behind a firewall (x.x.x.128/25). Within that LAN there is the OpenVPN server and other 2 servers I want to reach via OpenVPN validation. Moreover according to the client types I would like to have different types of accesses. For example:
client1 should be able to reach only server1
client2 should be able to reach only server2
client3 should be able to reach server1 and server2
...
So I have configured OpenVPN according to
http://openvpn.net/index.php/open-source/documentation/howto.html#scope under the section "Configuring client-specific rules and access policies")
OpenVPN IP (public): x.x.x.208
Server 1 IP (public): x.x.x.x.207
Server 2 IP (public): x.x.x.x.209
Gataway: x.x.x.x.129
Virtual range OpenVPN IP (client1): 10.8.0.0/24
Virtual range OpenVPN IP (client2): 10.8.1.0/24
Virtual range OpenVPN IP (client3): 10.8.2.0/24
The connection between OpenVpn server and client works fine but after that I cannot ping from the client the OpenVPN server (10.8.0.1) or Server 1/2. Only if I remove from configuration server file line push "route x.x.x.128 255.255.255.128" I can ping the 10.8.0.1 from the client but of course I cannot ping Server 1 and Server2 (which are pingable from the OpenVpn server).
Server config file
cd /etc/openvpn
port 1194
proto udp
dev tun0
cipher BF-CBC
ca certs/ca.crt
cert certs/server.crt
key keys/server.key
dh certs/dh2048.pem
crl-verify crl.pem
server 10.70.0.0 255.255.255.0
route 10.70.1.0 255.255.255.0
route 10.70.2.0 255.255.255.0
keepalive 10 120
tls-auth keys/ta.key 0
comp-lzo
user nobody
group nobody
persist-key
persist-tun
log-append /var/log/openvpn.log
verb 6
daemon
askpass /root/password.ovpn
auth-nocache
client-config-dir /etc/openvpn/ccd
ccd-exclusive
push "route x.x.x.128 255.255.255.128"
ccd/client2 file on the server
ifconfig-push 10.70.1.1 10.70.1.2
Client config file:
client
dev tun
proto udp
remote x.x.x.208 1194
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
ca ca.crt
cert client2.crt
key client2.key
remote-cert-tls server
tls-auth ta.key 1
comp-lzo
verb 3
On the server:
tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500
inet 10.70.0.1 netmask 255.255.255.255 destination 10.70.0.2
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
On the client:
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.70.1.1 P-t-P:10.70.1.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:12020065 errors:0 dropped:12015356 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:18026641525 (16.7 GiB)
Iptable on the server:
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
683 56565 ACCEPT all -- any any anywhere anywhere ctstate RELATED,ESTABLISHED
25 1750 ACCEPT udp -- any any anywhere anywhere udp dpt:openvpn
0 0 ACCEPT all -- any any 10.70.0.0/16 anywhere
1 40 LOG-AND-DROP-IT all -- any any anywhere anywhere
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- eth0 tun0 anywhere anywhere state RELATED,ESTABLISHED
0 0 ACCEPT all -- tun0 eth0 10.8.0.0/24 x.x.x.207
0 0 ACCEPT all -- tun0 eth0 10.8.1.0/24 x.x.x.209
0 0 ACCEPT all -- tun0 eth0 10.8.2.0/24 x.x.x.207
0 0 ACCEPT all -- tun0 eth0 10.8.2.0/24 x.x.x.209
0 0 LOG-AND-DROP-IT all -- any any anywhere anywhere
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any lo anywhere anywhere
501 64011 ACCEPT all -- any eth0 anywhere anywhere
0 0 ACCEPT all -- any tun0 anywhere anywhere
Chain LOG-AND-DROP-IT (2 references)
pkts bytes target prot opt in out source destination
1 40 LOG all -- any any anywhere anywhere limit: avg 2/min burst 5 LOG level debug prefix "IPTables- Dropped: "
1 40 DROP all -- any any anywhere anywhere
Routing table on the server:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default x.x.x.129 0.0.0.0 UG 1 0 0 eth0
10.70.0.0 10.70.0.254 255.255.255.0 UG 0 0 0 eth0
10.70.0.0 * 255.255.255.0 U 0 0 0 eth0
10.70.0.2 * 255.255.255.255 UH 0 0 0 tun0
10.70.1.0 10.70.0.2 255.255.255.0 UG 0 0 0 tun0
10.70.2.0 10.70.0.2 255.255.255.0 UG 0 0 0 tun0
loopback * 255.0.0.0 U 0 0 0 lo
x.x.x.128 * 255.255.255.128 U 0 0 0 eth0
Routing table on the client:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.70.0.1 10.70.1.2 255.255.255.255 UGH 0 0 0 tun0
10.70.1.2 * 255.255.255.255 UH 0 0 0 tun0
x.x.x.128 10.70.1.2 255.255.255.128 UG 0 0 0 tun0
localnet * 255.255.255.0 U 0 0 0 eth0
loopback * 255.0.0.0 U 0 0 0 lo
default x.x.x.x 0.0.0.0 UG 1 0 0 eth0
Finally the log file generated on the server:
Thu Feb 6 12:23:18 2014 us=550832 Current Parameter Settings:
Thu Feb 6 12:23:18 2014 us=550934 config = '/etc/openvpn/openvpn.conf'
Thu Feb 6 12:23:18 2014 us=550950 mode = 1
Thu Feb 6 12:23:18 2014 us=550964 persist_config = DISABLED
Thu Feb 6 12:23:18 2014 us=550979 persist_mode = 1
Thu Feb 6 12:23:18 2014 us=550993 show_ciphers = DISABLED
Thu Feb 6 12:23:18 2014 us=551006 show_digests = DISABLED
Thu Feb 6 12:23:18 2014 us=551020 show_engines = DISABLED
Thu Feb 6 12:23:18 2014 us=551033 genkey = DISABLED
Thu Feb 6 12:23:18 2014 us=551046 key_pass_file = '/root/password.ovpn'
Thu Feb 6 12:23:18 2014 us=551060 show_tls_ciphers = DISABLED
Thu Feb 6 12:23:18 2014 us=551074 Connection profiles [default]:
Thu Feb 6 12:23:18 2014 us=551088 proto = udp
Thu Feb 6 12:23:18 2014 us=551101 local = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=551115 local_port = 1194
Thu Feb 6 12:23:18 2014 us=551128 remote = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=551141 remote_port = 1194
Thu Feb 6 12:23:18 2014 us=551155 remote_float = DISABLED
Thu Feb 6 12:23:18 2014 us=551168 bind_defined = DISABLED
Thu Feb 6 12:23:18 2014 us=551181 bind_local = ENABLED
Thu Feb 6 12:23:18 2014 us=551194 connect_retry_seconds = 5
Thu Feb 6 12:23:18 2014 us=551207 connect_timeout = 10
Thu Feb 6 12:23:18 2014 us=551221 connect_retry_max = 0
Thu Feb 6 12:23:18 2014 us=551234 socks_proxy_server = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=551248 socks_proxy_port = 0
Thu Feb 6 12:23:18 2014 us=551261 socks_proxy_retry = DISABLED
Thu Feb 6 12:23:18 2014 us=551274 tun_mtu = 1500
Thu Feb 6 12:23:18 2014 us=551287 tun_mtu_defined = ENABLED
Thu Feb 6 12:23:18 2014 us=551301 link_mtu = 1500
Thu Feb 6 12:23:18 2014 us=551313 link_mtu_defined = DISABLED
Thu Feb 6 12:23:18 2014 us=551327 tun_mtu_extra = 0
Thu Feb 6 12:23:18 2014 us=551340 tun_mtu_extra_defined = DISABLED
Thu Feb 6 12:23:18 2014 us=551353 mtu_discover_type = -1
Thu Feb 6 12:23:18 2014 us=551366 fragment = 0
Thu Feb 6 12:23:18 2014 us=551379 mssfix = 1450
Thu Feb 6 12:23:18 2014 us=551393 explicit_exit_notification = 0
Thu Feb 6 12:23:18 2014 us=551406 Connection profiles END
Thu Feb 6 12:23:18 2014 us=551419 remote_random = DISABLED
Thu Feb 6 12:23:18 2014 us=551432 ipchange = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=551445 dev = 'tun0'
Thu Feb 6 12:23:18 2014 us=551458 dev_type = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=551471 dev_node = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=551484 lladdr = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=551497 topology = 1
Thu Feb 6 12:23:18 2014 us=551510 tun_ipv6 = DISABLED
Thu Feb 6 12:23:18 2014 us=551523 ifconfig_local = '10.70.0.1'
Thu Feb 6 12:23:18 2014 us=551537 ifconfig_remote_netmask = '10.70.0.2'
Thu Feb 6 12:23:18 2014 us=551550 ifconfig_noexec = DISABLED
Thu Feb 6 12:23:18 2014 us=551563 ifconfig_nowarn = DISABLED
Thu Feb 6 12:23:18 2014 us=551576 ifconfig_ipv6_local = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=551589 ifconfig_ipv6_netbits = 0
Thu Feb 6 12:23:18 2014 us=551602 ifconfig_ipv6_remote = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=551636 shaper = 0
Thu Feb 6 12:23:18 2014 us=551652 mtu_test = 0
Thu Feb 6 12:23:18 2014 us=551666 mlock = DISABLED
Thu Feb 6 12:23:18 2014 us=551679 keepalive_ping = 10
Thu Feb 6 12:23:18 2014 us=551693 keepalive_timeout = 120
Thu Feb 6 12:23:18 2014 us=551706 inactivity_timeout = 0
Thu Feb 6 12:23:18 2014 us=551719 ping_send_timeout = 10
Thu Feb 6 12:23:18 2014 us=551732 ping_rec_timeout = 240
Thu Feb 6 12:23:18 2014 us=551746 ping_rec_timeout_action = 2
Thu Feb 6 12:23:18 2014 us=551759 ping_timer_remote = DISABLED
Thu Feb 6 12:23:18 2014 us=551772 remap_sigusr1 = 0
Thu Feb 6 12:23:18 2014 us=551789 persist_tun = ENABLED
Thu Feb 6 12:23:18 2014 us=551803 persist_local_ip = DISABLED
Thu Feb 6 12:23:18 2014 us=551816 persist_remote_ip = DISABLED
Thu Feb 6 12:23:18 2014 us=551829 persist_key = ENABLED
Thu Feb 6 12:23:18 2014 us=551842 passtos = DISABLED
Thu Feb 6 12:23:18 2014 us=551855 resolve_retry_seconds = 1000000000
Thu Feb 6 12:23:18 2014 us=551876 username = 'nobody'
Thu Feb 6 12:23:18 2014 us=551889 groupname = 'nobody'
Thu Feb 6 12:23:18 2014 us=551903 chroot_dir = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=551916 cd_dir = '/etc/openvpn'
Thu Feb 6 12:23:18 2014 us=551929 writepid = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=551942 up_script = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=551955 down_script = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=551968 down_pre = DISABLED
Thu Feb 6 12:23:18 2014 us=551982 up_restart = DISABLED
Thu Feb 6 12:23:18 2014 us=551999 up_delay = DISABLED
Thu Feb 6 12:23:18 2014 us=552014 daemon = ENABLED
Thu Feb 6 12:23:18 2014 us=552028 inetd = 0
Thu Feb 6 12:23:18 2014 us=552041 log = ENABLED
Thu Feb 6 12:23:18 2014 us=552054 suppress_timestamps = DISABLED
Thu Feb 6 12:23:18 2014 us=552068 nice = 0
Thu Feb 6 12:23:18 2014 us=552081 verbosity = 6
Thu Feb 6 12:23:18 2014 us=552094 mute = 0
Thu Feb 6 12:23:18 2014 us=552107 gremlin = 0
Thu Feb 6 12:23:18 2014 us=552120 status_file = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=552134 status_file_version = 1
Thu Feb 6 12:23:18 2014 us=552147 status_file_update_freq = 60
Thu Feb 6 12:23:18 2014 us=552160 occ = ENABLED
Thu Feb 6 12:23:18 2014 us=552173 rcvbuf = 65536
Thu Feb 6 12:23:18 2014 us=552186 sndbuf = 65536
Thu Feb 6 12:23:18 2014 us=552199 mark = 0
Thu Feb 6 12:23:18 2014 us=552212 sockflags = 0
Thu Feb 6 12:23:18 2014 us=552225 fast_io = DISABLED
Thu Feb 6 12:23:18 2014 us=552238 lzo = 7
Thu Feb 6 12:23:18 2014 us=552251 route_script = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=552264 route_default_gateway = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=552277 route_default_metric = 0
Thu Feb 6 12:23:18 2014 us=552291 route_noexec = DISABLED
Thu Feb 6 12:23:18 2014 us=552304 route_delay = 0
Thu Feb 6 12:23:18 2014 us=552318 route_delay_window = 30
Thu Feb 6 12:23:18 2014 us=552331 route_delay_defined = DISABLED
Thu Feb 6 12:23:18 2014 us=552344 route_nopull = DISABLED
Thu Feb 6 12:23:18 2014 us=552358 route_gateway_via_dhcp = DISABLED
Thu Feb 6 12:23:18 2014 us=552371 max_routes = 100
Thu Feb 6 12:23:18 2014 us=552385 allow_pull_fqdn = DISABLED
Thu Feb 6 12:23:18 2014 us=552402 route 10.70.1.0/255.255.255.0/nil/nil
Thu Feb 6 12:23:18 2014 us=552417 route 10.70.2.0/255.255.255.0/nil/nil
Thu Feb 6 12:23:18 2014 us=552430 route 10.70.0.0/255.255.255.0/nil/nil
Thu Feb 6 12:23:18 2014 us=552444 management_addr = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=552458 management_port = 0
Thu Feb 6 12:23:18 2014 us=552471 management_user_pass = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=552484 management_log_history_cache = 250
Thu Feb 6 12:23:18 2014 us=552497 management_echo_buffer_size = 100
Thu Feb 6 12:23:18 2014 us=552511 management_write_peer_info_file = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=552524 management_client_user = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=552537 management_client_group = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=552551 management_flags = 0
Thu Feb 6 12:23:18 2014 us=552564 shared_secret_file = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=552578 key_direction = 1
Thu Feb 6 12:23:18 2014 us=552591 ciphername_defined = ENABLED
Thu Feb 6 12:23:18 2014 us=552604 ciphername = 'BF-CBC'
Thu Feb 6 12:23:18 2014 us=552631 authname_defined = ENABLED
Thu Feb 6 12:23:18 2014 us=552645 authname = 'SHA1'
Thu Feb 6 12:23:18 2014 us=552659 prng_hash = 'SHA1'
Thu Feb 6 12:23:18 2014 us=552673 prng_nonce_secret_len = 16
Thu Feb 6 12:23:18 2014 us=552686 keysize = 0
Thu Feb 6 12:23:18 2014 us=552699 engine = DISABLED
Thu Feb 6 12:23:18 2014 us=552713 replay = ENABLED
Thu Feb 6 12:23:18 2014 us=552726 mute_replay_warnings = DISABLED
Thu Feb 6 12:23:18 2014 us=552739 replay_window = 64
Thu Feb 6 12:23:18 2014 us=552752 replay_time = 15
Thu Feb 6 12:23:18 2014 us=552766 packet_id_file = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=552779 use_iv = ENABLED
Thu Feb 6 12:23:18 2014 us=552792 test_crypto = DISABLED
Thu Feb 6 12:23:18 2014 us=552813 tls_server = ENABLED
Thu Feb 6 12:23:18 2014 us=552826 tls_client = DISABLED
Thu Feb 6 12:23:18 2014 us=552839 key_method = 2
Thu Feb 6 12:23:18 2014 us=552852 ca_file = 'certs/ca.crt'
Thu Feb 6 12:23:18 2014 us=552865 ca_path = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=552878 dh_file = 'certs/dh2048.pem'
Thu Feb 6 12:23:18 2014 us=552891 cert_file = 'certs/server.crt'
Thu Feb 6 12:23:18 2014 us=552905 priv_key_file = 'keys/server.key'
Thu Feb 6 12:23:18 2014 us=552919 pkcs12_file = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=552932 cipher_list = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=552946 tls_verify = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=552959 tls_export_cert = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=552973 verify_x509_type = 0
Thu Feb 6 12:23:18 2014 us=552986 verify_x509_name = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=552999 crl_file = 'crl.pem'
Thu Feb 6 12:23:18 2014 us=553012 ns_cert_type = 0
Thu Feb 6 12:23:18 2014 us=553025 remote_cert_ku[i] = 0
Thu Feb 6 12:23:18 2014 us=553039 remote_cert_ku[i] = 0
Thu Feb 6 12:23:18 2014 us=553052 remote_cert_ku[i] = 0
Thu Feb 6 12:23:18 2014 us=553065 remote_cert_ku[i] = 0
Thu Feb 6 12:23:18 2014 us=553078 remote_cert_ku[i] = 0
Thu Feb 6 12:23:18 2014 us=553091 remote_cert_ku[i] = 0
Thu Feb 6 12:23:18 2014 us=553104 remote_cert_ku[i] = 0
Thu Feb 6 12:23:18 2014 us=553117 remote_cert_ku[i] = 0
Thu Feb 6 12:23:18 2014 us=553130 remote_cert_ku[i] = 0
Thu Feb 6 12:23:18 2014 us=553143 remote_cert_ku[i] = 0
Thu Feb 6 12:23:18 2014 us=553156 remote_cert_ku[i] = 0
Thu Feb 6 12:23:18 2014 us=553169 remote_cert_ku[i] = 0
Thu Feb 6 12:23:18 2014 us=553182 remote_cert_ku[i] = 0
Thu Feb 6 12:23:18 2014 us=553195 remote_cert_ku[i] = 0
Thu Feb 6 12:23:18 2014 us=553208 remote_cert_ku[i] = 0
Thu Feb 6 12:23:18 2014 us=553221 remote_cert_ku[i] = 0
Thu Feb 6 12:23:18 2014 us=553234 remote_cert_eku = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=553248 ssl_flags = 0
Thu Feb 6 12:23:18 2014 us=553261 tls_timeout = 2
Thu Feb 6 12:23:18 2014 us=553274 renegotiate_bytes = 0
Thu Feb 6 12:23:18 2014 us=553287 renegotiate_packets = 0
Thu Feb 6 12:23:18 2014 us=553300 renegotiate_seconds = 3600
Thu Feb 6 12:23:18 2014 us=553313 handshake_window = 60
Thu Feb 6 12:23:18 2014 us=553327 transition_window = 3600
Thu Feb 6 12:23:18 2014 us=553340 single_session = DISABLED
Thu Feb 6 12:23:18 2014 us=553353 push_peer_info = DISABLED
Thu Feb 6 12:23:18 2014 us=553366 tls_exit = DISABLED
Thu Feb 6 12:23:18 2014 us=553379 tls_auth_file = 'keys/ta.key'
Thu Feb 6 12:23:18 2014 us=553394 server_network = 10.70.0.0
Thu Feb 6 12:23:18 2014 us=553410 server_netmask = 255.255.255.0
Thu Feb 6 12:23:18 2014 us=553428 server_network_ipv6 = ::
Thu Feb 6 12:23:18 2014 us=553442 server_netbits_ipv6 = 0
Thu Feb 6 12:23:18 2014 us=553457 server_bridge_ip = 0.0.0.0
Thu Feb 6 12:23:18 2014 us=553471 server_bridge_netmask = 0.0.0.0
Thu Feb 6 12:23:18 2014 us=553486 server_bridge_pool_start = 0.0.0.0
Thu Feb 6 12:23:18 2014 us=553501 server_bridge_pool_end = 0.0.0.0
Thu Feb 6 12:23:18 2014 us=553514 push_entry = 'route x.x.x.128 255.255.255.128'
Thu Feb 6 12:23:18 2014 us=553528 push_entry = 'route 10.70.0.1'
Thu Feb 6 12:23:18 2014 us=553541 push_entry = 'topology net30'
Thu Feb 6 12:23:18 2014 us=553554 push_entry = 'ping 10'
Thu Feb 6 12:23:18 2014 us=553568 push_entry = 'ping-restart 120'
Thu Feb 6 12:23:18 2014 us=553581 ifconfig_pool_defined = ENABLED
Thu Feb 6 12:23:18 2014 us=553596 ifconfig_pool_start = 10.70.0.4
Thu Feb 6 12:23:18 2014 us=553611 ifconfig_pool_end = 10.70.0.251
Thu Feb 6 12:23:18 2014 us=553638 ifconfig_pool_netmask = 0.0.0.0
Thu Feb 6 12:23:18 2014 us=553652 ifconfig_pool_persist_filename = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=553666 ifconfig_pool_persist_refresh_freq = 600
Thu Feb 6 12:23:18 2014 us=553680 ifconfig_ipv6_pool_defined = DISABLED
Thu Feb 6 12:23:18 2014 us=553694 ifconfig_ipv6_pool_base = ::
Thu Feb 6 12:23:18 2014 us=553714 ifconfig_ipv6_pool_netbits = 0
Thu Feb 6 12:23:18 2014 us=553728 n_bcast_buf = 256
Thu Feb 6 12:23:18 2014 us=553741 tcp_queue_limit = 64
Thu Feb 6 12:23:18 2014 us=553755 real_hash_size = 256
Thu Feb 6 12:23:18 2014 us=553768 virtual_hash_size = 256
Thu Feb 6 12:23:18 2014 us=553782 client_connect_script = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=553795 learn_address_script = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=553808 client_disconnect_script = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=553822 client_config_dir = '/etc/openvpn/ccd'
Thu Feb 6 12:23:18 2014 us=553835 ccd_exclusive = ENABLED
Thu Feb 6 12:23:18 2014 us=553848 tmp_dir = '/tmp'
Thu Feb 6 12:23:18 2014 us=553862 push_ifconfig_defined = DISABLED
Thu Feb 6 12:23:18 2014 us=553876 push_ifconfig_local = 0.0.0.0
Thu Feb 6 12:23:18 2014 us=553891 push_ifconfig_remote_netmask = 0.0.0.0
Thu Feb 6 12:23:18 2014 us=553904 push_ifconfig_ipv6_defined = DISABLED
Thu Feb 6 12:23:18 2014 us=553919 push_ifconfig_ipv6_local = ::/0
Thu Feb 6 12:23:18 2014 us=553933 push_ifconfig_ipv6_remote = ::
Thu Feb 6 12:23:18 2014 us=553946 enable_c2c = DISABLED
Thu Feb 6 12:23:18 2014 us=553959 duplicate_cn = DISABLED
Thu Feb 6 12:23:18 2014 us=553973 cf_max = 0
Thu Feb 6 12:23:18 2014 us=553986 cf_per = 0
Thu Feb 6 12:23:18 2014 us=553999 max_clients = 1024
Thu Feb 6 12:23:18 2014 us=554017 max_routes_per_client = 256
Thu Feb 6 12:23:18 2014 us=554037 auth_user_pass_verify_script = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=554055 auth_user_pass_verify_script_via_file = DISABLED
Thu Feb 6 12:23:18 2014 us=554069 port_share_host = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=554083 port_share_port = 0
Thu Feb 6 12:23:18 2014 us=554097 client = DISABLED
Thu Feb 6 12:23:18 2014 us=554110 pull = DISABLED
Thu Feb 6 12:23:18 2014 us=554124 auth_user_pass_file = '[UNDEF]'
Thu Feb 6 12:23:18 2014 us=554138 OpenVPN 2.3.2 i486-slackware-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [eurephia] [MH] [IPv6] built on Oct 12 2013
Thu Feb 6 12:23:18 2014 us=592427 Diffie-Hellman initialized with 2048 bit key
Thu Feb 6 12:23:18 2014 us=599109 Control Channel Authentication: using 'keys/ta.key' as a OpenVPN static key file
Thu Feb 6 12:23:18 2014 us=599134 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 6 12:23:18 2014 us=599150 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 6 12:23:18 2014 us=599177 TLS-Auth MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Thu Feb 6 12:23:18 2014 us=599211 Socket Buffers: R=[180224->131072] S=[180224->131072]
Thu Feb 6 12:23:18 2014 us=599337 ROUTE_GATEWAY x.x.x.129/255.255.255.128 IFACE=eth0 HWADDR=00:50:56:9f:1f:f8
Thu Feb 6 12:23:18 2014 us=600335 TUN/TAP device tun0 opened
Thu Feb 6 12:23:18 2014 us=600360 TUN/TAP TX queue length set to 100
Thu Feb 6 12:23:18 2014 us=600387 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Feb 6 12:23:18 2014 us=600417 /usr/sbin/ip link set dev tun0 up mtu 1500
Thu Feb 6 12:23:18 2014 us=601499 /usr/sbin/ip addr add dev tun0 local 10.70.0.1 peer 10.70.0.2
Thu Feb 6 12:23:18 2014 us=602530 /usr/sbin/ip route add 10.70.1.0/24 via 10.70.0.2
Thu Feb 6 12:23:18 2014 us=603453 /usr/sbin/ip route add 10.70.2.0/24 via 10.70.0.2
Thu Feb 6 12:23:18 2014 us=604405 /usr/sbin/ip route add 10.70.0.0/24 via 10.70.0.2
RTNETLINK answers: File exists
Thu Feb 6 12:23:18 2014 us=605398 ERROR: Linux route add command failed: external program exited with error status: 2
Thu Feb 6 12:23:18 2014 us=605439 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Feb 6 12:23:18 2014 us=606889 GID set to nobody
Thu Feb 6 12:23:18 2014 us=607039 UID set to nobody
Thu Feb 6 12:23:18 2014 us=607076 UDPv4 link local (bound): [undef]
Thu Feb 6 12:23:18 2014 us=607091 UDPv4 link remote: [undef]
Thu Feb 6 12:23:18 2014 us=607115 MULTI: multi_init called, r=256 v=256
Thu Feb 6 12:23:18 2014 us=607216 IFCONFIG POOL: base=10.70.0.4 size=62, ipv6=0
Thu Feb 6 12:23:18 2014 us=607282 Initialization Sequence Completed
Thu Feb 6 12:23:30 2014 us=321308 MULTI: multi_create_instance called
Thu Feb 6 12:23:30 2014 us=321402 192.168.69.44:59350 Re-using SSL/TLS context
Thu Feb 6 12:23:30 2014 us=321448 192.168.69.44:59350 LZO compression initialized
Thu Feb 6 12:23:30 2014 us=321810 192.168.69.44:59350 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Thu Feb 6 12:23:30 2014 us=321830 192.168.69.44:59350 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Feb 6 12:23:30 2014 us=321935 192.168.69.44:59350 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Thu Feb 6 12:23:30 2014 us=321950 192.168.69.44:59350 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Thu Feb 6 12:23:30 2014 us=321989 192.168.69.44:59350 Local Options hash (VER=V4): '14168603'
Thu Feb 6 12:23:30 2014 us=322009 192.168.69.44:59350 Expected Remote Options hash (VER=V4): '504e774e'
Thu Feb 6 12:23:30 2014 us=322100 192.168.69.44:59350 UDPv4 READ [42] from [AF_INET]192.168.69.44:59350: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #1 ] [ ] pid=0 DATA len=0
Thu Feb 6 12:23:30 2014 us=322123 192.168.69.44:59350 TLS: Initial packet from [AF_INET]192.168.69.44:59350, sid=3bac3f77 45874979
Thu Feb 6 12:23:30 2014 us=322171 192.168.69.44:59350 UDPv4 WRITE [54] to [AF_INET]192.168.69.44:59350: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 pid=[ #1 ] [ 0 ] pid=0 DATA len=0
Thu Feb 6 12:23:30 2014 us=324214 192.168.69.44:59350 UDPv4 READ [50] from [AF_INET]192.168.69.44:59350: P_ACK_V1 kid=0 pid=[ #2 ] [ 0 ]
...
As you can see I have an ERROR in the log but I'm not sure it is important as the route for the subnet 10.70.0.0/24 seems correct in the routing table of server.
Last peace of infomation I have also added on the gateway the static route
10.8.0.0 255.255.0.0 x.x.x.208
to redirect the traffic from the subnet 10.8.x.0 to the OpenVPN server.
Thanks in advance for your help!
