Dear folks,
When I setup Openvpn client on OpenWRT, I got an issue which is driving me crazy.
The openvpn server is maintained by company; so I'm sure the server has no problem.
I got the client config file from the company. When I run the openvpn client with the client config file on windows 7, everything works like a charm.
Here is the config file:
###############################################################################
client
dev tun
proto udp
remote x.x.x.x 1649
cipher AES-128-CBC
auth SHA1
resolv-retry infinite
nobind
persist-key
persist-tun
verb 3
#################################################################
when I connected to the server, I got this log file:
---------------------------------------------------------------------------
Sun Jun 15 16:03:47 2014 OpenVPN 2.3.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on May 2 2014
Sun Jun 15 16:03:47 2014 library versions: OpenSSL 1.0.1g 7 Apr 2014, LZO 2.05
Enter Management Password:
Sun Jun 15 16:03:47 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25341
Sun Jun 15 16:03:47 2014 Need hold release from management interface, waiting...
Sun Jun 15 16:03:48 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25341
Sun Jun 15 16:03:48 2014 MANAGEMENT: CMD 'state on'
Sun Jun 15 16:03:48 2014 MANAGEMENT: CMD 'log all on'
Sun Jun 15 16:03:48 2014 MANAGEMENT: CMD 'hold off'
Sun Jun 15 16:03:48 2014 MANAGEMENT: CMD 'hold release'
Sun Jun 15 16:03:48 2014 WARNING: No server certificate verification method has been enabled. See
http://openvpn.net/howto.html#mitm for more info.
Sun Jun 15 16:03:48 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sun Jun 15 16:03:48 2014 UDPv4 link local: [undef]
Sun Jun 15 16:03:48 2014 UDPv4 link remote: [AF_INET]x.x.x.x:1649
Sun Jun 15 16:03:48 2014 MANAGEMENT: >STATE:1402819428,WAIT,,,
Sun Jun 15 16:03:48 2014 MANAGEMENT: >STATE:1402819428,AUTH,,,
Sun Jun 15 16:03:48 2014 TLS: Initial packet from [AF_INET]x.x.x.x:1649, sid=d84b9cc6 ae5c0e29
Sun Jun 15 16:03:49 2014 VERIFY OK: depth=0, CN=avan6tuadiepf59qbn.org, O=dg7ng12dn r2pr8dmb, C=US
Sun Jun 15 16:03:49 2014 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Jun 15 16:03:49 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jun 15 16:03:49 2014 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Jun 15 16:03:49 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jun 15 16:03:49 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Jun 15 16:03:49 2014 [avan6tuadiepf59qbn.org] Peer Connection Initiated with [AF_INET]126.54.39.126:1649
Sun Jun 15 16:03:50 2014 MANAGEMENT: >STATE:1402819430,GET_CONFIG,,,
Sun Jun 15 16:03:51 2014 SENT CONTROL [avan6tuadiepf59qbn.org]: 'PUSH_REQUEST' (status=1)
Sun Jun 15 16:03:51 2014 PUSH: Received control message: 'PUSH_REPLY,ping 3,ping-restart 10,ifconfig 10.211.1.13 10.211.1.14,dhcp-option DNS 10.211.254.254,dhcp-option DNS 8.8.8.8,route-gateway 10.211.1.14,redirect-gateway def1'
Sun Jun 15 16:03:51 2014 OPTIONS IMPORT: timers and/or timeouts modified
Sun Jun 15 16:03:51 2014 OPTIONS IMPORT: --ifconfig/up options modified
Sun Jun 15 16:03:51 2014 OPTIONS IMPORT: route options modified
Sun Jun 15 16:03:51 2014 OPTIONS IMPORT: route-related options modified
Sun Jun 15 16:03:51 2014 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Jun 15 16:03:51 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Jun 15 16:03:51 2014 MANAGEMENT: >STATE:1402819431,ASSIGN_IP,,10.211.1.13,
Sun Jun 15 16:03:51 2014 open_tun, tt->ipv6=0
Sun Jun 15 16:03:51 2014 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{576365CF-3C19-48D3-A9E6-7299B6E66325}.tap
Sun Jun 15 16:03:51 2014 TAP-Windows Driver Version 9.9
Sun Jun 15 16:03:51 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.211.1.13/255.255.255.252 on interface {576365CF-3C19-48D3-A9E6-7299B6E66325} [DHCP-serv: 10.211.1.14, lease-time: 31536000]
Sun Jun 15 16:03:51 2014 Successful ARP Flush on interface [35] {576365CF-3C19-48D3-A9E6-7299B6E66325}
Sun Jun 15 16:03:56 2014 TEST ROUTES: 1/1 succeeded len=0 ret=1 a=0 u/d=up
Sun Jun 15 16:03:56 2014 C:\Windows\system32\route.exe ADD 126.54.39.126 MASK 255.255.255.255 192.168.1.1
Sun Jun 15 16:03:56 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=2 and dwForwardType=4
Sun Jun 15 16:03:56 2014 Route addition via IPAPI succeeded [adaptive]
Sun Jun 15 16:03:56 2014 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.211.1.14
Sun Jun 15 16:03:56 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Jun 15 16:03:56 2014 Route addition via IPAPI succeeded [adaptive]
Sun Jun 15 16:03:56 2014 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.211.1.14
Sun Jun 15 16:03:56 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Jun 15 16:03:56 2014 Route addition via IPAPI succeeded [adaptive]
Sun Jun 15 16:03:56 2014 Initialization Sequence Completed
Sun Jun 15 16:03:56 2014 MANAGEMENT: >STATE:1402819436,CONNECTED,SUCCESS,10.211.1.13,126.54.39.126
Sun Jun 15 16:06:17 2014 C:\Windows\system32\route.exe DELETE 126.54.39.126 MASK 255.255.255.255 192.168.1.1
Sun Jun 15 16:06:17 2014 Route deletion via IPAPI succeeded [adaptive]
Sun Jun 15 16:06:17 2014 C:\Windows\system32\route.exe DELETE 0.0.0.0 MASK 128.0.0.0 10.211.1.14
Sun Jun 15 16:06:17 2014 Route deletion via IPAPI succeeded [adaptive]
Sun Jun 15 16:06:17 2014 C:\Windows\system32\route.exe DELETE 128.0.0.0 MASK 128.0.0.0 10.211.1.14
Sun Jun 15 16:06:17 2014 Route deletion via IPAPI succeeded [adaptive]
Sun Jun 15 16:06:17 2014 Closing TUN/TAP interface
Sun Jun 15 16:06:17 2014 SIGTERM[hard,] received, process exiting
Sun Jun 15 16:06:17 2014 MANAGEMENT: >STATE:1402819577,EXITING,SIGTERM,,
----------------------------------------------------------------------------------
when I setup an openvpn client on my router of OpenWRT with openvpn 2.3.2, I use this config file:
############################################
config openvpn 'VPN_client'
option enabled '1'
option enable '1'
option client '1'
option remote 'x.x.x.x 1649'
option dev 'tun'
option proto 'udp'
option comp_lzo 'yes'
option resolv_retry 'infinite'
option nobind '1'
option persist_tun '1'
option persist_key '1'
option ca /etc/openvpn/ca.crt
option cert /etc/openvpn/client.crt
option key /etc/openvpn/client.key
option verb '3'
option cipher 'AES-128-CBC'
option auth 'SHA1'
option script_security '2'
option log '/tmp/openvpn.log'
option keepalive '3 10'
################################################
In fact all the options are exactly resemble the previous client config file.
when I start the openvpn on OpenWRT, I got the log file:
---------------------------------------------------------------------------------------
Sun Jun 15 21:36:44 2014 OpenVPN 2.3.2 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jun 15 2014
Sun Jun 15 21:36:44 2014 WARNING: No server certificate verification method has been enabled. See
http://openvpn.net/howto.html#mitm for more info.
Sun Jun 15 21:36:44 2014 WARNING: file '/etc/openvpn/client.key' is group or others accessible
Sun Jun 15 21:36:44 2014 Socket Buffers: R=[163840->131072] S=[163840->131072]
Sun Jun 15 21:36:44 2014 UDPv4 link local: [undef]
Sun Jun 15 21:36:44 2014 UDPv4 link remote: [AF_INET]x.x.x.x:1649
Sun Jun 15 21:36:44 2014 write UDPv4: Network is unreachable (code=128)
Sun Jun 15 21:36:46 2014 write UDPv4: Network is unreachable (code=128)
Sun Jun 15 21:36:50 2014 TLS: Initial packet from [AF_INET]x.x.x.x:1649, sid=c8ca9330 b6b1b3f0
Sun Jun 15 21:36:50 2014 VERIFY OK: depth=0, CN=avan6tuadiepf59qbn.org, O=dg7ng12dn r2pr8dmb, C=US
Sun Jun 15 21:36:51 2014 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Jun 15 21:36:51 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jun 15 21:36:51 2014 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Jun 15 21:36:51 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jun 15 21:36:51 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Jun 15 21:36:51 2014 [avan6tuadiepf59qbn.org] Peer Connection Initiated with [AF_INETx.x.x.x:1649
Sun Jun 15 21:36:53 2014 SENT CONTROL [avan6tuadiepf59qbn.org]: 'PUSH_REQUEST' (status=1)
Sun Jun 15 21:36:54 2014 PUSH: Received control message: 'PUSH_REPLY,ping 3,ping-restart 10'
Sun Jun 15 21:36:54 2014 OPTIONS IMPORT: timers and/or timeouts modified
Sun Jun 15 21:36:54 2014 TUN/TAP device tun0 opened
Sun Jun 15 21:36:54 2014 TUN/TAP TX queue length set to 100
Sun Jun 15 21:36:54 2014 Initialization Sequence Completed
Sun Jun 15 21:37:47 2014 [avan6tuadiepf59qbn.org] Inactivity timeout (--ping-restart), restarting
Sun Jun 15 21:37:47 2014 SIGUSR1[soft,ping-restart] received, process restarting
Sun Jun 15 21:37:47 2014 Restart pause, 2 second(s)
Sun Jun 15 21:37:49 2014 WARNING: No server certificate verification method has been enabled. See
http://openvpn.net/howto.html#mitm for more info.
Sun Jun 15 21:37:49 2014 Socket Buffers: R=[163840->131072] S=[163840->131072]
Sun Jun 15 21:37:49 2014 UDPv4 link local: [undef]
Sun Jun 15 21:37:49 2014 UDPv4 link remote: [AF_INETx.x.x.x:1649
Sun Jun 15 21:37:49 2014 TLS: Initial packet from [AF_INET]x.x.x.x:1649, sid=8c206cb9 d5963d3b
Sun Jun 15 21:37:49 2014 VERIFY OK: depth=0, CN=avan6tuadiepf59qbn.org, O=dg7ng12dn r2pr8dmb, C=US
Sun Jun 15 21:37:49 2014 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Jun 15 21:37:49 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jun 15 21:37:49 2014 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Jun 15 21:37:49 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jun 15 21:37:49 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Jun 15 21:37:49 2014 [avan6tuadiepf59qbn.org] Peer Connection Initiated with [AF_INET]x.x.x.x:1649
Sun Jun 15 21:37:52 2014 SENT CONTROL [avan6tuadiepf59qbn.org]: 'PUSH_REQUEST' (status=1)
Sun Jun 15 21:37:52 2014 PUSH: Received control message: 'PUSH_REPLY,ping 3,ping-restart 10'
Sun Jun 15 21:37:52 2014 OPTIONS IMPORT: timers and/or timeouts modified
Sun Jun 15 21:37:52 2014 Preserving previous TUN/TAP instance: tun0
Sun Jun 15 21:37:52 2014 Initialization Sequence Completed
Sun Jun 15 21:38:02 2014 [avan6tuadiepf59qbn.org] Inactivity timeout (--ping-restart), restarting
Sun Jun 15 21:38:02 2014 SIGUSR1[soft,ping-restart] received, process restarting
Sun Jun 15 21:38:02 2014 Restart pause, 2 second(s)
Sun Jun 15 21:38:04 2014 WARNING: No server certificate verification method has been enabled. See
http://openvpn.net/howto.html#mitm for more info.
Sun Jun 15 21:38:04 2014 Socket Buffers: R=[163840->131072] S=[163840->131072]
Sun Jun 15 21:38:04 2014 UDPv4 link local: [undef]
Sun Jun 15 21:38:04 2014 UDPv4 link remote: [AF_INET]x.x.x.x:1649
Sun Jun 15 21:38:04 2014 TLS: Initial packet from [AF_INET]x.x.x.x:1649, sid=b000d461 a714d7a3
Sun Jun 15 21:38:04 2014 VERIFY OK: depth=0, CN=avan6tuadiepf59qbn.org, O=dg7ng12dn r2pr8dmb, C=US
Sun Jun 15 21:38:05 2014 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Jun 15 21:38:05 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jun 15 21:38:05 2014 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Jun 15 21:38:05 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jun 15 21:38:05 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Jun 15 21:38:05 2014 [avan6tuadiepf59qbn.org] Peer Connection Initiated with [AF_INET]x.x.x.x:1649
Sun Jun 15 21:38:08 2014 SENT CONTROL [avan6tuadiepf59qbn.org]: 'PUSH_REQUEST' (status=1)
Sun Jun 15 21:38:08 2014 PUSH: Received control message: 'PUSH_REPLY,ping 3,ping-restart 10'
Sun Jun 15 21:38:08 2014 OPTIONS IMPORT: timers and/or timeouts modified
Sun Jun 15 21:38:08 2014 Preserving previous TUN/TAP instance: tun0
Sun Jun 15 21:38:08 2014 Initialization Sequence Completed
---------------------------------------------------------------------------------------
By comparing the two log files, we can see the one difference is the highlighted part in red color.
When I run openvpn clinet on windows 7, I got the push message from server is:
Sun Jun 15 16:03:51 2014 PUSH: Received control message: 'PUSH_REPLY,ping 3,ping-restart 10,ifconfig 10.211.1.13 10.211.1.14,dhcp-option DNS 10.211.254.254,dhcp-option DNS 8.8.8.8,route-gateway 10.211.1.14,redirect-gateway def1'
When I run openvpn client on OpenWRT, I got the push message from the server is:
Sun Jun 15 21:38:08 2014 PUSH: Received control message: 'PUSH_REPLY,ping 3,ping-restart 10'
Obviously this message does not include ipconfig info, that is why the client cannot get IP address from the server.
Anybody know what wrong with the config? Please help me out and thanks very much.
