I have a Virtual Machine with x86_64 architecture, CentOS 6.3. My openvpn's version is 2.1. Is short the problem is that after a random but longer period the clients can't connect to the server. The problems disappears after I reset the openvpn server but I should find a permanent solution.
On the client side I see this when the connection can not be established:
Wed May 28 08:14:24 2014 us=517021 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25341
Wed May 28 08:14:24 2014 us=618026 MANAGEMENT: CMD 'state on'
Wed May 28 08:14:24 2014 us=618026 MANAGEMENT: CMD 'log all on'
Wed May 28 08:14:24 2014 us=857040 MANAGEMENT: CMD 'hold off'
Wed May 28 08:14:24 2014 us=859040 MANAGEMENT: CMD 'hold release'
Wed May 28 08:14:24 2014 us=874041 WARNING: No server certificate verification method has been enabled. See
http://openvpn.net/howto.html#mitm for more info.
I doubt that there is a certificate problem as it works well after a server reset with the same certificate.
On the server side the last line is this:
Need IPv6 code in mroute_extract_addr_from_packet
98% percent of the log consists of this message. I have learned that only openvpn 2.3 supports ipv6 and I should unbind the TCP/IP v6 on the client but I couldn't find any practical advise on how to do this. Does this mean a client configuration setting or just the TAP adapter properties should be changed so that the ipv6 to be disabled.
After resetting the OpenVPN server everything works fine, only a line of warning appears:
NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
By the way this is my first post, I'm a newbie in openvpn, so are my config files... I list them bellow bellow:
server.conf:
port 1193
proto tcp
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
server 1.2.4.0 255.255.255.0
ifconfig-pool-persist /etc/openvpn/ipp.txt
#push "redirect-gateway def1"
#push "dhcp-option DNS 208.67.222.222"
#push "dhcp-option DNS 4.2.2.1"
keepalive 5 30
comp-lzo
persist-key
persist-tun
verb 5
status /etc/openvpn/server-tcp.log
log /etc/openvpn/server.log
client.ovpn:
client
dev tun
proto tcp
remote 176.223.202.56 1195
resolv-retry infinite
nobind
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
ca distrib/ca.crt
cert distrib/test01.crt
key distrib/test01.key
comp-lzo
verb 5
route-method exe
route-delay 2
iptables:
-A INPUT -i tun0 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 139 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 138 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 137 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 1194 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 17673 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 5900 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 6543 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 5666 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 161 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -i tun0 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
