I'm having problems on 2 different machines with the same config. I connect to the VPN Server via external IP, from inside the LAN of course. This is just for testing purposes.
The setup:
* Linksys WRT54GL Router with OpenVPN Server, LAN 31.33.7.0/32, Router IP 31.33.7.1 (I know it's not a private notwork ...)
* Virtual Machine Fedora 10, IP 31.33.7.113 (DHCP)
* Embedded System with STLinux 2.4, self compiled tun.ko and openvpn client, IP 31.33.7.109 (DHCP)
I use the same config on both machines. On Fedora it's working without problems. I can still connect to this machine even when OpenVPN is running.
On the embedded system I loose the connection and can't connect to it on neither IP. The redirected the output of openvpn and "route -n" to a file.
The router tells me that both clients are connected but I can't connect the STLinux when openvpn is active. It's unreachable.
Client config
client
dev tun
proto tcp
remote 1.2.3.4 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
verb 4
Server Config on WRT54GL:
push "route 31.33.7.0 255.255.255.0"
push "dhcp-option DNS 192.168.66.1"
push "dhcp-option DNS 212.123.35.78"
#push "redirect-gateway def1"
server 192.168.66.0 255.255.255.0
dev tun0
proto tcp
keepalive 10 120
management localhost 5001
port 1194
verb 5
cipher BF-CBC
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
Log + route -n from non-working machine:
Geht nicht:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.66.9 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.66.1 192.168.66.9 255.255.255.255 UGH 0 0 0 tun0
31.33.7.0 192.168.66.9 255.255.255.0 UG 0 0 0 tun0
31.33.7.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
0.0.0.0 31.33.7.1 0.0.0.0 UG 1 0 0 eth0
OpenVPN Log
Sat Feb 22 13:23:09 2014 us=56427 Re-using SSL/TLS context
Sat Feb 22 13:23:09 2014 us=57988 Control Channel MTU parms [ L:1543 D:140 EF:40 EB:0 ET:0 EL:0 ]
Sat Feb 22 13:23:09 2014 us=58443 Socket Buffers: R=[87380->131072] S=[16384->131072]
Sat Feb 22 13:23:09 2014 us=61163 Data Channel MTU parms [ L:1543 D:1450 EF:43 EB:4 ET:0 EL:0 ]
Sat Feb 22 13:23:09 2014 us=61535 Attempting to establish TCP connection with [AF_INET]1.2.3.4:1194 [nonblock]
Sat Feb 22 13:23:10 2014 us=62472 TCP connection established with [AF_INET]1.2.3.4:1194
Sat Feb 22 13:23:10 2014 us=62754 TCPv4_CLIENT link local: [undef]
Sat Feb 22 13:23:10 2014 us=62969 TCPv4_CLIENT link remote: [AF_INET]1.2.3.4:1194
Sat Feb 22 13:23:10 2014 us=66582 TLS: Initial packet from [AF_INET]1.2.3.4:1194, sid=d57b6ac1 1bf4d10b
Sat Feb 22 13:23:10 2014 us=545905 VERIFY OK: depth=1, C=DE, bla
Sat Feb 22 13:23:10 2014 us=549854 VERIFY OK: nsCertType=SERVER
Sat Feb 22 13:23:10 2014 us=550231 VERIFY OK: depth=0, C=DE, bla
Sat Feb 22 13:23:11 2014 us=265948 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Feb 22 13:23:11 2014 us=266318 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 22 13:23:11 2014 us=267465 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Feb 22 13:23:11 2014 us=267754 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 22 13:23:11 2014 us=268567 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sat Feb 22 13:23:11 2014 us=268948 [bla.blo.x] Peer Connection Initiated with [AF_INET]1.2.3.4:1194
Sat Feb 22 13:23:13 2014 us=460938 SENT CONTROL [bla.blo.x]: 'PUSH_REQUEST' (status=1)
Sat Feb 22 13:23:13 2014 us=508932 PUSH: Received control message: 'PUSH_REPLY,route 31.33.7.0 255.255.255.0,dhcp-option DNS 192.168.66.1,dhcp-option DNS 212.123.35.78,route 192.168.66.1,topology net30,ping 10,ping-restart 120,ifconfig 192.168.66.10 192.168.66.9'
Sat Feb 22 13:23:13 2014 us=510747 OPTIONS IMPORT: timers and/or timeouts modified
Sat Feb 22 13:23:13 2014 us=511012 OPTIONS IMPORT: --ifconfig/up options modified
Sat Feb 22 13:23:13 2014 us=511323 OPTIONS IMPORT: route options modified
Sat Feb 22 13:23:13 2014 us=511719 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sat Feb 22 13:23:13 2014 us=520237 TUN/TAP device tun0 opened
Sat Feb 22 13:23:13 2014 us=520900 TUN/TAP TX queue length set to 100
Sat Feb 22 13:23:13 2014 us=521325 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Feb 22 13:23:13 2014 us=522355 /sbin/ifconfig tun0 192.168.66.10 pointopoint 192.168.66.9 mtu 1500
Sat Feb 22 13:23:13 2014 us=548935 /sbin/route add -net 31.33.7.0 netmask 255.255.255.0 gw 192.168.66.9
Sat Feb 22 13:23:13 2014 us=563003 /sbin/route add -net 192.168.66.1 netmask 255.255.255.255 gw 192.168.66.9
Sat Feb 22 13:23:13 2014 us=576634 Initialization Sequence Completed
Sat Feb 22 13:23:26 2014 us=629308 TCP/UDP: Closing socket
Sat Feb 22 13:23:26 2014 us=630252 /sbin/route del -net 192.168.66.1 netmask 255.255.255.255
Sat Feb 22 13:23:26 2014 us=650435 /sbin/route del -net 31.33.7.0 netmask 255.255.255.0
Sat Feb 22 13:23:26 2014 us=664787 Closing TUN/TAP interface
Sat Feb 22 13:23:26 2014 us=665826 /sbin/ifconfig tun0 0.0.0.0
Sat Feb 22 13:23:26 2014 us=685797 SIGTERM[hard,] received, process exiting
Log + route -n from working machine:
Kernel IP Routentabelle
Ziel Router Genmask Flags Metric Ref Use Iface
192.168.66.9 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.66.1 192.168.66.9 255.255.255.255 UGH 0 0 0 tun0
31.33.7.0 192.168.66.9 255.255.255.0 UG 0 0 0 tun0
31.33.7.0 0.0.0.0 255.255.255.0 U 1 0 0 eth0
0.0.0.0 31.33.7.1 0.0.0.0 UG 0 0 0 eth0
LOG:
Sat Feb 22 03:55:34 2014 us=527613 OpenVPN 2.1_rc15 i386-redhat-linux-gnu [SSL] [LZO2] [EPOLL] built on Nov 30 2008
Sat Feb 22 03:55:34 2014 us=527759 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sat Feb 22 03:55:34 2014 us=529792 WARNING: file 'client-goennes.extrn-cs.key' is group or others accessible
Sat Feb 22 03:55:34 2014 us=530954 Control Channel MTU parms [ L:1543 D:140 EF:40 EB:0 ET:0 EL:0 ]
Sat Feb 22 03:55:34 2014 us=645010 Data Channel MTU parms [ L:1543 D:1450 EF:43 EB:4 ET:0 EL:0 ]
Sat Feb 22 03:55:34 2014 us=645428 Local Options String: 'V4,dev-type tun,link-mtu 1543,tun-mtu 1500,proto TCPv4_CLIENT,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Sat Feb 22 03:55:34 2014 us=645645 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1543,tun-mtu 1500,proto TCPv4_SERVER,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Sat Feb 22 03:55:34 2014 us=645944 Local Options hash (VER=V4): 'db02a8f8'
Sat Feb 22 03:55:34 2014 us=646183 Expected Remote Options hash (VER=V4): '7e068940'
Sat Feb 22 03:55:34 2014 us=646511 Attempting to establish TCP connection with 1.2.3.4:1194 [nonblock]
Sat Feb 22 03:55:35 2014 us=679292 TCP connection established with 1.2.3.4:1194
Sat Feb 22 03:55:35 2014 us=679659 Socket Buffers: R=[87380->131072] S=[16384->131072]
Sat Feb 22 03:55:35 2014 us=679929 TCPv4_CLIENT link local: [undef]
Sat Feb 22 03:55:35 2014 us=680150 TCPv4_CLIENT link remote: 1.2.3.4:1194
Sat Feb 22 03:55:35 2014 us=683878 TLS: Initial packet from 1.2.3.4:1194, sid=beff43b7 54e6ca0c
Sat Feb 22 03:55:36 2014 us=150983 VERIFY OK: depth=1, bla
Sat Feb 22 03:55:36 2014 us=151547 VERIFY OK: nsCertType=SERVER
Sat Feb 22 03:55:36 2014 us=151810 VERIFY OK: depth=0, bla
Sat Feb 22 03:55:36 2014 us=753363 NOTE: Options consistency check may be skewed by version differences
Sat Feb 22 03:55:36 2014 us=753688 WARNING: 'version' is used inconsistently, local='version V4', remote='version V0 UNDEF'
Sat Feb 22 03:55:36 2014 us=753957 WARNING: 'dev-type' is present in local config but missing in remote config, local='dev-type tun'
Sat Feb 22 03:55:36 2014 us=754181 WARNING: 'link-mtu' is present in local config but missing in remote config, local='link-mtu 1543'
Sat Feb 22 03:55:36 2014 us=754443 WARNING: 'tun-mtu' is present in local config but missing in remote config, local='tun-mtu 1500'
Sat Feb 22 03:55:36 2014 us=754665 WARNING: 'proto' is present in local config but missing in remote config, local='proto TCPv4_SERVER'
Sat Feb 22 03:55:36 2014 us=754909 WARNING: 'cipher' is present in local config but missing in remote config, local='cipher BF-CBC'
Sat Feb 22 03:55:36 2014 us=755129 WARNING: 'auth' is present in local config but missing in remote config, local='auth SHA1'
Sat Feb 22 03:55:36 2014 us=755399 WARNING: 'keysize' is present in local config but missing in remote config, local='keysize 128'
Sat Feb 22 03:55:36 2014 us=755626 WARNING: 'key-method' is present in local config but missing in remote config, local='key-method 2'
Sat Feb 22 03:55:36 2014 us=755869 WARNING: 'tls-server' is present in local config but missing in remote config, local='tls-server'
Sat Feb 22 03:55:36 2014 us=756472 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Feb 22 03:55:36 2014 us=756715 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 22 03:55:36 2014 us=756989 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Feb 22 03:55:36 2014 us=757243 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Feb 22 03:55:36 2014 us=757651 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sat Feb 22 03:55:36 2014 us=757907 [bla.blo.x] Peer Connection Initiated with 1.2.3.4:1194
Sat Feb 22 03:55:37 2014 us=808696 SENT CONTROL [bla.blo.x]: 'PUSH_REQUEST' (status=1)
Sat Feb 22 03:55:37 2014 us=855885 PUSH: Received control message: 'PUSH_REPLY,route 31.33.7.0 255.255.255.0,dhcp-option DNS 192.168.66.1,dhcp-option DNS 212.123.35.78,route 192.168.66.1,topology net30,ping 10,ping-restart 120,ifconfig 192.168.66.10 192.168.66.9'
Sat Feb 22 03:55:37 2014 us=856483 OPTIONS IMPORT: timers and/or timeouts modified
Sat Feb 22 03:55:37 2014 us=856732 OPTIONS IMPORT: --ifconfig/up options modified
Sat Feb 22 03:55:37 2014 us=856972 OPTIONS IMPORT: route options modified
Sat Feb 22 03:55:37 2014 us=857187 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sat Feb 22 03:55:37 2014 us=857815 ROUTE default_gateway=31.33.7.1
Sat Feb 22 03:55:37 2014 us=873976 TUN/TAP device tun0 opened
Sat Feb 22 03:55:37 2014 us=874377 TUN/TAP TX queue length set to 100
Sat Feb 22 03:55:37 2014 us=874627 /sbin/ip link set dev tun0 up mtu 1500
Sat Feb 22 03:55:37 2014 us=887720 /sbin/ip addr add dev tun0 local 192.168.66.10 peer 192.168.66.9
Sat Feb 22 03:55:37 2014 us=896997 WARNING: potential route subnet conflict between local LAN [31.33.7.0/255.255.255.0] and remote VPN [31.33.7.0/255.255.255.0]
Sat Feb 22 03:55:37 2014 us=897394 /sbin/ip route add 31.33.7.0/24 via 192.168.66.9
Sat Feb 22 03:55:37 2014 us=928483 /sbin/ip route add 192.168.66.1/32 via 192.168.66.9
Sat Feb 22 03:55:37 2014 us=931578 Initialization Sequence Completed
