Hello. I have some trouble.
I want to build Windows OpenVPN server that broadcast-able and process all of client's traffic.
So, i was construct ethernet bridge VPN, enable packet forwarding by edit registry, and start windows 'Routing and Remote Access' service.
I use home router and that's IP is 192.168.2.1/24
VPN server IP is 192.168.2.2/24
IP range of client is 192.168.2.240~254
This is server's configuration.
local 192.168.2.2
port 1194
proto udp
dev tap
dev-node openvpn
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.2.2 255.255.255.0 192.168.2.240 192.168.2.254
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 168.126.63.1"
push "dhcp-option DNS 8.8.8.8"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 5
And this is client's configuration.
client
dev tap
dev-node openvpn
proto udp
remote MY.SERVERS.DOMAIN.NAME 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca_home.crt
cert company-notebook.crt
key company-notebook.key
ns-cert-type server
comp-lzo
verb 5
explicit-exit-notify 2
ping 10
ping-restart 60
route-method exe
route-delay 2
Everything looks good. VPN was work well. But after 2~3 minutes, traffic was flood and eventually building's hub(above of my home router) was stop working.(until re-powering)
This is log sample:
Server
------omit some initialization message------
Wed May 14 17:39:18 2014 us=230087 Initialization Sequence Completed
Wed May 14 17:39:18 2014 us=230087 MANAGEMENT: >STATE:1400056758,CONNECTED,SUCCESS,,
Wed May 14 17:39:20 2014 us=464215 MULTI: multi_create_instance called
Wed May 14 17:39:20 2014 us=464215 218.145.51.51:57098 Re-using SSL/TLS context
Wed May 14 17:39:20 2014 us=464215 218.145.51.51:57098 LZO compression initialized
Wed May 14 17:39:20 2014 us=464215 218.145.51.51:57098 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed May 14 17:39:20 2014 us=464215 218.145.51.51:57098 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Wed May 14 17:39:20 2014 us=464215 218.145.51.51:57098 Local Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed May 14 17:39:20 2014 us=464215 218.145.51.51:57098 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed May 14 17:39:20 2014 us=464215 218.145.51.51:57098 Local Options hash (VER=V4): 'f7df56b8'
Wed May 14 17:39:20 2014 us=464215 218.145.51.51:57098 Expected Remote Options hash (VER=V4): 'd79ca330'
Wed May 14 17:39:20 2014 us=464215 218.145.51.51:57098 TLS: Initial packet from [AF_INET]218.145.51.51:57098, sid=0cbc118a d49e2e0a
Wed May 14 17:39:21 2014 us=329265 read UDPv4: Net dropped connection or reset (WSAENETRESET) (code=10052)
Wed May 14 17:39:21 2014 us=342265 read UDPv4: Net dropped connection or reset (WSAENETRESET) (code=10052)
Wed May 14 17:39:21 2014 us=348266 read UDPv4: Net dropped connection or reset (WSAENETRESET) (code=10052)
[b]------repeat above message about 600 lines------[/b]
Wed May 14 17:39:38 2014 us=476245 read UDPv4: Net dropped connection or reset (WSAENETRESET) (code=10052)
Wed May 14 17:39:38 2014 us=478245 read UDPv4: Net dropped connection or reset (WSAENETRESET) (code=10052)
Wed May 14 17:39:40 2014 us=396355 TCP/UDP: Closing socket
Wed May 14 17:39:40 2014 us=396355 Closing TUN/TAP interface
Wed May 14 17:39:40 2014 us=405356 SIGTERM[hard,] received, process exiting
Wed May 14 17:39:40 2014 us=405356 MANAGEMENT: >STATE:1400056780,EXITING,SIGTERM,,
Client
------omit some initialization message------
Wed May 14 17:39:16 2014 us=768708 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Enter Management Password:
Wed May 14 17:39:16 2014 us=768708 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed May 14 17:39:16 2014 us=768708 Need hold release from management interface, waiting...
Wed May 14 17:39:17 2014 us=248735 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed May 14 17:39:17 2014 us=348741 MANAGEMENT: CMD 'state on'
Wed May 14 17:39:17 2014 us=348741 MANAGEMENT: CMD 'log all on'
Wed May 14 17:39:17 2014 us=439746 MANAGEMENT: CMD 'hold off'
Wed May 14 17:39:17 2014 us=440746 MANAGEMENT: CMD 'hold release'
Wed May 14 17:39:17 2014 us=574754 LZO compression initialized
Wed May 14 17:39:17 2014 us=574754 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed May 14 17:39:17 2014 us=574754 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed May 14 17:39:17 2014 us=574754 MANAGEMENT: >STATE:1400056757,RESOLVE,,,
Wed May 14 17:39:17 2014 us=580754 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Wed May 14 17:39:17 2014 us=580754 Local Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed May 14 17:39:17 2014 us=580754 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed May 14 17:39:17 2014 us=580754 Local Options hash (VER=V4): 'd79ca330'
Wed May 14 17:39:17 2014 us=580754 Expected Remote Options hash (VER=V4): 'f7df56b8'
Wed May 14 17:39:17 2014 us=580754 UDPv4 link local: [undef]
Wed May 14 17:39:17 2014 us=580754 UDPv4 link remote: [AF_INET]210.223.38.159:1194
Wed May 14 17:39:17 2014 us=580754 MANAGEMENT: >STATE:1400056757,WAIT,,,
Wed May 14 17:39:17 2014 us=626757 MANAGEMENT: >STATE:1400056757,AUTH,,,
Wed May 14 17:39:17 2014 us=626757 TLS: Initial packet from [AF_INET]210.223.38.159:1194, sid=c73882b8 02ae191a
Wed May 14 17:39:18 2014 us=24779 VERIFY OK: depth=1, C=KR, ST=SE, L=Seoul, O=Myservlab, OU=Desktop, CN=EarthCrash, name=EarthCrash, emailAddress=master@myservlab.com
Wed May 14 17:39:18 2014 us=25780 VERIFY OK: nsCertType=SERVER
Wed May 14 17:39:18 2014 us=25780 VERIFY OK: depth=0, C=KR, ST=SE, L=Seoul, O=Myservlab, OU=Desktop, CN=EarthCrash, name=EarthCrash, emailAddress=master@myservlab.com
Wed May 14 17:39:19 2014 us=81840 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed May 14 17:39:19 2014 us=81840 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 14 17:39:19 2014 us=81840 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed May 14 17:39:19 2014 us=81840 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 14 17:39:19 2014 us=82840 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed May 14 17:39:19 2014 us=82840 [EarthCrash] Peer Connection Initiated with [AF_INET]210.223.38.159:1194
Wed May 14 17:39:19 2014 us=541866 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed May 14 17:39:19 2014 us=541866 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed May 14 17:39:19 2014 us=542866 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #1 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
[b]------repeat above message about 39000 lines------[/b]
Wed May 14 17:39:30 2014 us=984521 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #2787 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed May 14 17:39:30 2014 us=984521 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #2804 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed May 14 17:39:31 2014 us=7522 TCP/UDP: Closing socket
Wed May 14 17:39:31 2014 us=7522 C:\Windows\system32\route.exe DELETE 210.223.38.159 MASK 255.255.255.255 10.12.244.1
Wed May 14 17:39:31 2014 us=7522 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Wed May 14 17:39:31 2014 us=21523 C:\Windows\system32\route.exe DELETE 0.0.0.0 MASK 128.0.0.0 192.168.2.2
Wed May 14 17:39:31 2014 us=21523 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Wed May 14 17:39:31 2014 us=34524 C:\Windows\system32\route.exe DELETE 128.0.0.0 MASK 128.0.0.0 192.168.2.2
Wed May 14 17:39:31 2014 us=34524 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Wed May 14 17:39:31 2014 us=47524 Closing TUN/TAP interface
Wed May 14 17:39:31 2014 us=48524 SIGTERM[soft,exit-with-notification] received, process exiting
Wed May 14 17:39:31 2014 us=48524 MANAGEMENT: >STATE:1400056771,EXITING,exit-with-notification,,
Something is definitely wrong.
During investgation, i found some interest thing.
When i starting the Windows 'Routing and Remote Access' service, upload traffic is start flooding.
So, this will be not OpenVPN's problem but maybe someone suffering from this problem like me.
Can anyone advise me about this problem?
Ah, by the way, VPN works really well if i use my home router instead of VPN server for routing like this:
server-bridge 192.168.2.1 255.255.255.0 192.168.2.240 192.168.2.254
But it's not my intention.
