Hello, I need some expert assistance with OpenVPN. As a single VPN client I would like to be able to connect to devices on my home LAN, and have all of my dns/inet traffic sent over the tunnel.
A question I thought to ask before we begin troubleshooting:
Should I install something other than Debian that may be easier to work with? I'm more of a ubuntu user, but thought Debian may be more stable.
Home LAN GW: FiOS Actiontec MI424WR-GEN3,
VPN Server is on an old x86 machine running Debian with 2 gigabit NIC cards. I'm fine with only using one to keep it simple, or if two is easier for routing- lets do it! The
client machine is an Alienware running Linux Mint Qiana/Ubuntuish connecting from a public insecure wlan.
Problem: The VPN handshakes, estabs a tun connection, stays open. The client can not resolve hostnames, ping or trace external DNS IPs, or ping or trace the GW or other devices on the Home LAN. The VPN server's tunnel IP and private LAN IP on eth1 does reply.
Server (apiary): Has port-forward = 1 in sysctl, I've tried various routes using
route and
iptables, to include trying to set NAT routes on the server, forwarding using masquerade (which may not be working, the FiOS router is blocking "spoofing" and there is no way (that I know) to 100% disable that firewall. Only set input and output to accept. Yet it still says in the security log it's blocking spoofing on occasion which makes me hesitate. I've also tried to only use push "gateway-redirect def1" or push "gateway-redirect def1 bypass-dhcp" or push "route 0.0.0.0 0.0.0.0" (somewhere I read that's definitely incorrect). I've also added in push "dhcp-option DNS 8.8.8.8" and a variety of push DNS to the Home LAN gateway, and the vpn server LAN IP.
Client (walterm15x): I've applied various routes using
route, and without success fully restarted to reset and then confirmed they were not retained. When I connect to the VPN, routes are added automatically, however some stay that I believe should be removed- yet it doesn't allow me to
sudo route del them. It says no such process. I also use a neighbor's wifi AP when connecting to the VPN. I have a subdomain forward to a no-ip dyndns account that my Home LAN GW auto updates reliably.
That's what I can remember trying in the 60+ hours I have into this. Please save this box from getting hurled into the street :cry:
Thank you in advance for any time you put into this with me. The latest editions of configs, and logs follow. Also server/client time has been sync'd using rdate.
--
Walt
A+, Network+, CCNA
192.168.10.98 = VPN server private LAN IP
192.168.98.0 /24 = VPN server tunnel network.
108.*.*.* = Neighbor's WAN IP
192.168.0.0 /24 = Neighbor's LAN
173.*.*.* = VPN's (my Home) WAN IP : 1194 forwarded
Server Config
dev tun
proto udp
port 1194
ca /keys/ca.crt
cert /keys/server.crt
key /keys/server.key
dh /keys/dh2048.pem
user nobody
group nobody
server 192.168.98.0 255.255.255.0
client-config-dir /ccd # tried setting an iroute for client with no success.
persist-key
persist-tun
client-to-client
# route "192.168.10.0 255.255.255.0" # is Home LAN private Network
# push "route 0.0.0.0 0.0.0.0"
push "redirect-gateway def1"
# push "redirect-gateway def1 bypass-dhcp"
# push "remote-gateway 192.168.10.98" # is Home LAN private IP
# push "dhcp-option DNS 192.168.10.98"
keepalive 10 120
log /var/log/ovpnserver.log
verb 4
# daemon
Server Log, verb 4
Mon Jul 14 15:28:58 2014 us=775727 Current Parameter Settings:
Mon Jul 14 15:28:58 2014 us=775857 config = '/root/vpnbeta.opvn'
Mon Jul 14 15:28:58 2014 us=775882 mode = 1
Mon Jul 14 15:28:58 2014 us=775903 persist_config = DISABLED
Mon Jul 14 15:28:58 2014 us=775924 persist_mode = 1
Mon Jul 14 15:28:58 2014 us=775944 show_ciphers = DISABLED
Mon Jul 14 15:28:58 2014 us=775964 show_digests = DISABLED
Mon Jul 14 15:28:58 2014 us=775985 show_engines = DISABLED
Mon Jul 14 15:28:58 2014 us=776005 genkey = DISABLED
Mon Jul 14 15:28:58 2014 us=776026 key_pass_file = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=776047 show_tls_ciphers = DISABLED
Mon Jul 14 15:28:58 2014 us=776067 Connection profiles [default]:
Mon Jul 14 15:28:58 2014 us=776089 proto = udp
Mon Jul 14 15:28:58 2014 us=776109 local = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=776130 local_port = 1194
Mon Jul 14 15:28:58 2014 us=776151 remote = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=776171 remote_port = 1194
Mon Jul 14 15:28:58 2014 us=776192 remote_float = DISABLED
Mon Jul 14 15:28:58 2014 us=776212 bind_defined = DISABLED
Mon Jul 14 15:28:58 2014 us=776233 bind_local = ENABLED
Mon Jul 14 15:28:58 2014 us=776254 connect_retry_seconds = 5
Mon Jul 14 15:28:58 2014 us=776304 connect_timeout = 10
Mon Jul 14 15:28:58 2014 us=776325 connect_retry_max = 0
Mon Jul 14 15:28:58 2014 us=776347 socks_proxy_server = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=776368 socks_proxy_port = 0
Mon Jul 14 15:28:58 2014 us=776388 socks_proxy_retry = DISABLED
Mon Jul 14 15:28:58 2014 us=776409 Connection profiles END
Mon Jul 14 15:28:58 2014 us=776430 remote_random = DISABLED
Mon Jul 14 15:28:58 2014 us=776450 ipchange = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=776478 dev = 'tun'
Mon Jul 14 15:28:58 2014 us=776498 dev_type = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=776519 dev_node = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=776541 lladdr = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=776562 topology = 1
Mon Jul 14 15:28:58 2014 us=776582 tun_ipv6 = DISABLED
Mon Jul 14 15:28:58 2014 us=776603 ifconfig_local = '192.168.98.1'
Mon Jul 14 15:28:58 2014 us=776624 ifconfig_remote_netmask = '192.168.98.2'
Mon Jul 14 15:28:58 2014 us=776645 ifconfig_noexec = DISABLED
Mon Jul 14 15:28:58 2014 us=776665 ifconfig_nowarn = DISABLED
Mon Jul 14 15:28:58 2014 us=776686 ifconfig_ipv6_local = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=776707 ifconfig_ipv6_netbits = 0
Mon Jul 14 15:28:58 2014 us=776728 ifconfig_ipv6_remote = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=776749 shaper = 0
Mon Jul 14 15:28:58 2014 us=776773 tun_mtu = 1500
Mon Jul 14 15:28:58 2014 us=776794 tun_mtu_defined = ENABLED
Mon Jul 14 15:28:58 2014 us=776815 link_mtu = 1500
Mon Jul 14 15:28:58 2014 us=776835 link_mtu_defined = DISABLED
Mon Jul 14 15:28:58 2014 us=776856 tun_mtu_extra = 0
Mon Jul 14 15:28:58 2014 us=776877 tun_mtu_extra_defined = DISABLED
Mon Jul 14 15:28:58 2014 us=776897 fragment = 0
Mon Jul 14 15:28:58 2014 us=776918 mtu_discover_type = -1
Mon Jul 14 15:28:58 2014 us=776939 mtu_test = 0
Mon Jul 14 15:28:58 2014 us=776960 mlock = DISABLED
Mon Jul 14 15:28:58 2014 us=776980 keepalive_ping = 10
Mon Jul 14 15:28:58 2014 us=777001 keepalive_timeout = 120
Mon Jul 14 15:28:58 2014 us=777022 inactivity_timeout = 0
Mon Jul 14 15:28:58 2014 us=777043 ping_send_timeout = 10
Mon Jul 14 15:28:58 2014 us=777064 ping_rec_timeout = 240
Mon Jul 14 15:28:58 2014 us=777084 ping_rec_timeout_action = 2
Mon Jul 14 15:28:58 2014 us=777105 ping_timer_remote = DISABLED
Mon Jul 14 15:28:58 2014 us=777126 remap_sigusr1 = 0
Mon Jul 14 15:28:58 2014 us=777146 explicit_exit_notification = 0
Mon Jul 14 15:28:58 2014 us=777167 persist_tun = ENABLED
Mon Jul 14 15:28:58 2014 us=777187 persist_local_ip = DISABLED
Mon Jul 14 15:28:58 2014 us=777208 persist_remote_ip = DISABLED
Mon Jul 14 15:28:58 2014 us=777228 persist_key = ENABLED
Mon Jul 14 15:28:58 2014 us=777249 mssfix = 1450
Mon Jul 14 15:28:58 2014 us=777270 passtos = DISABLED
Mon Jul 14 15:28:58 2014 us=777291 resolve_retry_seconds = 1000000000
Mon Jul 14 15:28:58 2014 us=777323 username = 'nobody'
Mon Jul 14 15:28:58 2014 us=777344 groupname = 'nobody'
Mon Jul 14 15:28:58 2014 us=777365 chroot_dir = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=777385 cd_dir = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=777406 writepid = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=777427 up_script = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=777447 down_script = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=777467 down_pre = DISABLED
Mon Jul 14 15:28:58 2014 us=777488 up_restart = DISABLED
Mon Jul 14 15:28:58 2014 us=777508 up_delay = DISABLED
Mon Jul 14 15:28:58 2014 us=777529 daemon = DISABLED
Mon Jul 14 15:28:58 2014 us=777550 inetd = 0
Mon Jul 14 15:28:58 2014 us=777571 log = ENABLED
Mon Jul 14 15:28:58 2014 us=777591 suppress_timestamps = DISABLED
Mon Jul 14 15:28:58 2014 us=777612 nice = 0
Mon Jul 14 15:28:58 2014 us=777632 verbosity = 4
Mon Jul 14 15:28:58 2014 us=777653 mute = 0
Mon Jul 14 15:28:58 2014 us=777673 gremlin = 0
Mon Jul 14 15:28:58 2014 us=777694 status_file = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=777714 status_file_version = 1
Mon Jul 14 15:28:58 2014 us=777735 status_file_update_freq = 60
Mon Jul 14 15:28:58 2014 us=777756 occ = ENABLED
Mon Jul 14 15:28:58 2014 us=777776 rcvbuf = 65536
Mon Jul 14 15:28:58 2014 us=777797 sndbuf = 65536
Mon Jul 14 15:28:58 2014 us=777817 sockflags = 0
Mon Jul 14 15:28:58 2014 us=777838 fast_io = DISABLED
Mon Jul 14 15:28:58 2014 us=777859 lzo = 0
Mon Jul 14 15:28:58 2014 us=777879 route_script = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=777900 route_default_gateway = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=777921 route_default_metric = 0
Mon Jul 14 15:28:58 2014 us=777941 route_noexec = DISABLED
Mon Jul 14 15:28:58 2014 us=777963 route_delay = 0
Mon Jul 14 15:28:58 2014 us=777984 route_delay_window = 30
Mon Jul 14 15:28:58 2014 us=778005 route_delay_defined = DISABLED
Mon Jul 14 15:28:58 2014 us=778026 route_nopull = DISABLED
Mon Jul 14 15:28:58 2014 us=778047 route_gateway_via_dhcp = DISABLED
Mon Jul 14 15:28:58 2014 us=778068 max_routes = 100
Mon Jul 14 15:28:58 2014 us=778088 allow_pull_fqdn = DISABLED
Mon Jul 14 15:28:58 2014 us=778110 route 192.168.98.0/255.255.255.0/nil/nil
Mon Jul 14 15:28:58 2014 us=778132 management_addr = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=778153 management_port = 0
Mon Jul 14 15:28:58 2014 us=778173 management_user_pass = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=778194 management_log_history_cache = 250
Mon Jul 14 15:28:58 2014 us=778215 management_echo_buffer_size = 100
Mon Jul 14 15:28:58 2014 us=778236 management_write_peer_info_file = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=778257 management_client_user = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=778278 management_client_group = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=778299 management_flags = 0
Mon Jul 14 15:28:58 2014 us=778320 shared_secret_file = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=778340 key_direction = 0
Mon Jul 14 15:28:58 2014 us=778361 ciphername_defined = ENABLED
Mon Jul 14 15:28:58 2014 us=778382 ciphername = 'BF-CBC'
Mon Jul 14 15:28:58 2014 us=778403 authname_defined = ENABLED
Mon Jul 14 15:28:58 2014 us=778424 authname = 'SHA1'
Mon Jul 14 15:28:58 2014 us=778445 prng_hash = 'SHA1'
Mon Jul 14 15:28:58 2014 us=778466 prng_nonce_secret_len = 16
Mon Jul 14 15:28:58 2014 us=778487 keysize = 0
Mon Jul 14 15:28:58 2014 us=778507 engine = DISABLED
Mon Jul 14 15:28:58 2014 us=778528 replay = ENABLED
Mon Jul 14 15:28:58 2014 us=778549 mute_replay_warnings = DISABLED
Mon Jul 14 15:28:58 2014 us=778570 replay_window = 64
Mon Jul 14 15:28:58 2014 us=778591 replay_time = 15
Mon Jul 14 15:28:58 2014 us=778612 packet_id_file = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=778633 use_iv = ENABLED
Mon Jul 14 15:28:58 2014 us=778654 test_crypto = DISABLED
Mon Jul 14 15:28:58 2014 us=778674 tls_server = ENABLED
Mon Jul 14 15:28:58 2014 us=778695 tls_client = DISABLED
Mon Jul 14 15:28:58 2014 us=778716 key_method = 2
Mon Jul 14 15:28:58 2014 us=778737 ca_file = '/keys/ca.crt'
Mon Jul 14 15:28:58 2014 us=778768 ca_path = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=778789 dh_file = '/keys/dh2048.pem'
Mon Jul 14 15:28:58 2014 us=778811 cert_file = '/keys/server.crt'
Mon Jul 14 15:28:58 2014 us=778832 priv_key_file = '/keys/server.key'
Mon Jul 14 15:28:58 2014 us=778853 pkcs12_file = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=778874 cipher_list = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=778895 tls_verify = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=778916 tls_export_cert = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=778937 tls_remote = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=778958 crl_file = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=778979 ns_cert_type = 0
Mon Jul 14 15:28:58 2014 us=779000 remote_cert_ku[i] = 0
Mon Jul 14 15:28:58 2014 us=779021 remote_cert_ku[i] = 0
Mon Jul 14 15:28:58 2014 us=779042 remote_cert_ku[i] = 0
Mon Jul 14 15:28:58 2014 us=779063 remote_cert_ku[i] = 0
Mon Jul 14 15:28:58 2014 us=779083 remote_cert_ku[i] = 0
Mon Jul 14 15:28:58 2014 us=779104 remote_cert_ku[i] = 0
Mon Jul 14 15:28:58 2014 us=779125 remote_cert_ku[i] = 0
Mon Jul 14 15:28:58 2014 us=779145 remote_cert_ku[i] = 0
Mon Jul 14 15:28:58 2014 us=779165 remote_cert_ku[i] = 0
Mon Jul 14 15:28:58 2014 us=779187 remote_cert_ku[i] = 0
Mon Jul 14 15:28:58 2014 us=779208 remote_cert_ku[i] = 0
Mon Jul 14 15:28:58 2014 us=779228 remote_cert_ku[i] = 0
Mon Jul 14 15:28:58 2014 us=779249 remote_cert_ku[i] = 0
Mon Jul 14 15:28:58 2014 us=779270 remote_cert_ku[i] = 0
Mon Jul 14 15:28:58 2014 us=779291 remote_cert_ku[i] = 0
Mon Jul 14 15:28:58 2014 us=779311 remote_cert_ku[i] = 0
Mon Jul 14 15:28:58 2014 us=779332 remote_cert_eku = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=779353 tls_timeout = 2
Mon Jul 14 15:28:58 2014 us=779374 renegotiate_bytes = 0
Mon Jul 14 15:28:58 2014 us=779395 renegotiate_packets = 0
Mon Jul 14 15:28:58 2014 us=779416 renegotiate_seconds = 3600
Mon Jul 14 15:28:58 2014 us=779437 handshake_window = 60
Mon Jul 14 15:28:58 2014 us=779458 transition_window = 3600
Mon Jul 14 15:28:58 2014 us=779478 single_session = DISABLED
Mon Jul 14 15:28:58 2014 us=779499 push_peer_info = DISABLED
Mon Jul 14 15:28:58 2014 us=779519 tls_exit = DISABLED
Mon Jul 14 15:28:58 2014 us=779540 tls_auth_file = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=779561 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:28:58 2014 us=779582 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:28:58 2014 us=779603 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:28:58 2014 us=779623 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:28:58 2014 us=779644 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:28:58 2014 us=779664 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:28:58 2014 us=779685 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:28:58 2014 us=779706 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:28:58 2014 us=779727 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:28:58 2014 us=779747 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:28:58 2014 us=779768 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:28:58 2014 us=779789 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:28:58 2014 us=779809 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:28:58 2014 us=779830 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:28:58 2014 us=779851 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:28:58 2014 us=779872 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:28:58 2014 us=779894 pkcs11_private_mode = 00000000
Mon Jul 14 15:28:58 2014 us=779916 pkcs11_private_mode = 00000000
Mon Jul 14 15:28:58 2014 us=779937 pkcs11_private_mode = 00000000
Mon Jul 14 15:28:58 2014 us=779958 pkcs11_private_mode = 00000000
Mon Jul 14 15:28:58 2014 us=779979 pkcs11_private_mode = 00000000
Mon Jul 14 15:28:58 2014 us=780000 pkcs11_private_mode = 00000000
Mon Jul 14 15:28:58 2014 us=780021 pkcs11_private_mode = 00000000
Mon Jul 14 15:28:58 2014 us=780053 pkcs11_private_mode = 00000000
Mon Jul 14 15:28:58 2014 us=780074 pkcs11_private_mode = 00000000
Mon Jul 14 15:28:58 2014 us=780095 pkcs11_private_mode = 00000000
Mon Jul 14 15:28:58 2014 us=780117 pkcs11_private_mode = 00000000
Mon Jul 14 15:28:58 2014 us=780138 pkcs11_private_mode = 00000000
Mon Jul 14 15:28:58 2014 us=780159 pkcs11_private_mode = 00000000
Mon Jul 14 15:28:58 2014 us=780180 pkcs11_private_mode = 00000000
Mon Jul 14 15:28:58 2014 us=780201 pkcs11_private_mode = 00000000
Mon Jul 14 15:28:58 2014 us=780223 pkcs11_private_mode = 00000000
Mon Jul 14 15:28:58 2014 us=780244 pkcs11_cert_private = DISABLED
Mon Jul 14 15:28:58 2014 us=780283 pkcs11_cert_private = DISABLED
Mon Jul 14 15:28:58 2014 us=780309 pkcs11_cert_private = DISABLED
Mon Jul 14 15:28:58 2014 us=780330 pkcs11_cert_private = DISABLED
Mon Jul 14 15:28:58 2014 us=780351 pkcs11_cert_private = DISABLED
Mon Jul 14 15:28:58 2014 us=780372 pkcs11_cert_private = DISABLED
Mon Jul 14 15:28:58 2014 us=780393 pkcs11_cert_private = DISABLED
Mon Jul 14 15:28:58 2014 us=780413 pkcs11_cert_private = DISABLED
Mon Jul 14 15:28:58 2014 us=780434 pkcs11_cert_private = DISABLED
Mon Jul 14 15:28:58 2014 us=780455 pkcs11_cert_private = DISABLED
Mon Jul 14 15:28:58 2014 us=780476 pkcs11_cert_private = DISABLED
Mon Jul 14 15:28:58 2014 us=780497 pkcs11_cert_private = DISABLED
Mon Jul 14 15:28:58 2014 us=780518 pkcs11_cert_private = DISABLED
Mon Jul 14 15:28:58 2014 us=780539 pkcs11_cert_private = DISABLED
Mon Jul 14 15:28:58 2014 us=780559 pkcs11_cert_private = DISABLED
Mon Jul 14 15:28:58 2014 us=780581 pkcs11_cert_private = DISABLED
Mon Jul 14 15:28:58 2014 us=780602 pkcs11_pin_cache_period = -1
Mon Jul 14 15:28:58 2014 us=780622 pkcs11_id = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=780644 pkcs11_id_management = DISABLED
Mon Jul 14 15:28:58 2014 us=780673 server_network = 192.168.98.0
Mon Jul 14 15:28:58 2014 us=780697 server_netmask = 255.255.255.0
Mon Jul 14 15:28:58 2014 us=780724 server_network_ipv6 = ::
Mon Jul 14 15:28:58 2014 us=780746 server_netbits_ipv6 = 0
Mon Jul 14 15:28:58 2014 us=780770 server_bridge_ip = 0.0.0.0
Mon Jul 14 15:28:58 2014 us=780794 server_bridge_netmask = 0.0.0.0
Mon Jul 14 15:28:58 2014 us=780817 server_bridge_pool_start = 0.0.0.0
Mon Jul 14 15:28:58 2014 us=780840 server_bridge_pool_end = 0.0.0.0
Mon Jul 14 15:28:58 2014 us=780861 push_entry = 'redirect-gateway def1'
Mon Jul 14 15:28:58 2014 us=780882 push_entry = 'route 192.168.98.0 255.255.255.0'
Mon Jul 14 15:28:58 2014 us=780903 push_entry = 'topology net30'
Mon Jul 14 15:28:58 2014 us=780924 push_entry = 'ping 10'
Mon Jul 14 15:28:58 2014 us=780944 push_entry = 'ping-restart 120'
Mon Jul 14 15:28:58 2014 us=780965 ifconfig_pool_defined = ENABLED
Mon Jul 14 15:28:58 2014 us=780988 ifconfig_pool_start = 192.168.98.4
Mon Jul 14 15:28:58 2014 us=781011 ifconfig_pool_end = 192.168.98.251
Mon Jul 14 15:28:58 2014 us=781033 ifconfig_pool_netmask = 0.0.0.0
Mon Jul 14 15:28:58 2014 us=781054 ifconfig_pool_persist_filename = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=781075 ifconfig_pool_persist_refresh_freq = 600
Mon Jul 14 15:28:58 2014 us=781096 ifconfig_ipv6_pool_defined = DISABLED
Mon Jul 14 15:28:58 2014 us=781118 ifconfig_ipv6_pool_base = ::
Mon Jul 14 15:28:58 2014 us=781139 ifconfig_ipv6_pool_netbits = 0
Mon Jul 14 15:28:58 2014 us=781160 n_bcast_buf = 256
Mon Jul 14 15:28:58 2014 us=781182 tcp_queue_limit = 64
Mon Jul 14 15:28:58 2014 us=781203 real_hash_size = 256
Mon Jul 14 15:28:58 2014 us=781223 virtual_hash_size = 256
Mon Jul 14 15:28:58 2014 us=781244 client_connect_script = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=781265 learn_address_script = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=781287 client_disconnect_script = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=781308 client_config_dir = '/ccd'
Mon Jul 14 15:28:58 2014 us=781328 ccd_exclusive = DISABLED
Mon Jul 14 15:28:58 2014 us=781349 tmp_dir = '/tmp'
Mon Jul 14 15:28:58 2014 us=781370 push_ifconfig_defined = DISABLED
Mon Jul 14 15:28:58 2014 us=781403 push_ifconfig_local = 0.0.0.0
Mon Jul 14 15:28:58 2014 us=781426 push_ifconfig_remote_netmask = 0.0.0.0
Mon Jul 14 15:28:58 2014 us=781447 push_ifconfig_ipv6_defined = DISABLED
Mon Jul 14 15:28:58 2014 us=781470 push_ifconfig_ipv6_local = ::/0
Mon Jul 14 15:28:58 2014 us=781492 push_ifconfig_ipv6_remote = ::
Mon Jul 14 15:28:58 2014 us=781513 enable_c2c = ENABLED
Mon Jul 14 15:28:58 2014 us=781534 duplicate_cn = DISABLED
Mon Jul 14 15:28:58 2014 us=781555 cf_max = 0
Mon Jul 14 15:28:58 2014 us=781576 cf_per = 0
Mon Jul 14 15:28:58 2014 us=781597 max_clients = 1024
Mon Jul 14 15:28:58 2014 us=781618 max_routes_per_client = 256
Mon Jul 14 15:28:58 2014 us=781639 auth_user_pass_verify_script = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=781660 auth_user_pass_verify_script_via_file = DISABLED
Mon Jul 14 15:28:58 2014 us=781681 ssl_flags = 0
Mon Jul 14 15:28:58 2014 us=781702 port_share_host = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=781723 port_share_port = 0
Mon Jul 14 15:28:58 2014 us=781744 client = DISABLED
Mon Jul 14 15:28:58 2014 us=781764 pull = DISABLED
Mon Jul 14 15:28:58 2014 us=781785 auth_user_pass_file = '[UNDEF]'
Mon Jul 14 15:28:58 2014 us=781811 OpenVPN 2.2.1 i486-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jun 19 2013
Mon Jul 14 15:28:58 2014 us=782130 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Jul 14 15:28:58 2014 us=825428 Diffie-Hellman initialized with 2048 bit key
Mon Jul 14 15:28:58 2014 us=826028 WARNING: file '/keys/server.key' is group or others accessible
Mon Jul 14 15:28:58 2014 us=826943 TLS-Auth MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Jul 14 15:28:58 2014 us=827006 Socket Buffers: R=[163840->131072] S=[163840->131072]
Mon Jul 14 15:28:58 2014 us=827238 ROUTE default_gateway=192.168.10.1
Mon Jul 14 15:28:58 2014 us=829521 TUN/TAP device tun0 opened
Mon Jul 14 15:28:58 2014 us=829625 TUN/TAP TX queue length set to 100
Mon Jul 14 15:28:58 2014 us=829684 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Jul 14 15:28:58 2014 us=829749 /sbin/ifconfig tun0 192.168.98.1 pointopoint 192.168.98.2 mtu 1500
Mon Jul 14 15:28:58 2014 us=840989 /sbin/route add -net 192.168.98.0 netmask 255.255.255.0 gw 192.168.98.2
Mon Jul 14 15:28:58 2014 us=842881 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Mon Jul 14 15:28:58 2014 us=844043 GID set to nobody
Mon Jul 14 15:28:58 2014 us=844104 UID set to nobody
Mon Jul 14 15:28:58 2014 us=844144 UDPv4 link local (bound): [undef]
Mon Jul 14 15:28:58 2014 us=844176 UDPv4 link remote: [undef]
Mon Jul 14 15:28:58 2014 us=844228 MULTI: multi_init called, r=256 v=256
Mon Jul 14 15:28:58 2014 us=844342 IFCONFIG POOL: base=192.168.98.4 size=62, ipv6=0
Mon Jul 14 15:28:58 2014 us=844440 Initialization Sequence Completed
Mon Jul 14 15:29:14 2014 us=58008 MULTI: multi_create_instance called
Mon Jul 14 15:29:14 2014 us=58118 108.185.175.8:54323 Re-using SSL/TLS context
Mon Jul 14 15:29:14 2014 us=58341 108.185.175.8:54323 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Jul 14 15:29:14 2014 us=58371 108.185.175.8:54323 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Mon Jul 14 15:29:14 2014 us=58438 108.185.175.8:54323 Local Options String: 'V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Jul 14 15:29:14 2014 us=58460 108.185.175.8:54323 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Jul 14 15:29:14 2014 us=58506 108.185.175.8:54323 Local Options hash (VER=V4): '239669a8'
Mon Jul 14 15:29:14 2014 us=58535 108.185.175.8:54323 Expected Remote Options hash (VER=V4): '3514370b'
Mon Jul 14 15:29:14 2014 us=58604 108.185.175.8:54323 TLS: Initial packet from [AF_INET]108.185.175.8:54323, sid=2535073e 5a69b837
Mon Jul 14 15:29:14 2014 us=573833 108.185.175.8:54323 VERIFY OK: depth=1, /C=US/ST=CA/L=LosAngeles/O=YourCertifiedGeek/OU=support/CN=apiary/name=apiary/emailAddress=info@yourcertifiedgeek.com
Mon Jul 14 15:29:14 2014 us=574427 108.185.175.8:54323 VERIFY OK: depth=0, /C=US/ST=CA/L=LosAngeles/O=YourCertifiedGeek/OU=support/CN=walterm15x/name=walter-m15x/emailAddress=info@yourcertifiedgeek.com
Mon Jul 14 15:29:14 2014 us=762017 108.185.175.8:54323 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jul 14 15:29:14 2014 us=762072 108.185.175.8:54323 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jul 14 15:29:14 2014 us=762136 108.185.175.8:54323 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jul 14 15:29:14 2014 us=762160 108.185.175.8:54323 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jul 14 15:29:14 2014 us=793914 108.185.175.8:54323 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Jul 14 15:29:14 2014 us=793967 108.185.175.8:54323 [walterm15x] Peer Connection Initiated with [AF_INET]108.185.175.8:54323
Mon Jul 14 15:29:14 2014 us=794050 walterm15x/108.185.175.8:54323 MULTI_sva: pool returned IPv4=192.168.98.6, IPv6=a8c3:74b7:100:0:1cca:76b7:58e4:3fb8
Mon Jul 14 15:29:14 2014 us=794132 walterm15x/108.185.175.8:54323 MULTI: Learn: 192.168.98.6 -> walterm15x/108.185.175.8:54323
Mon Jul 14 15:29:14 2014 us=794160 walterm15x/108.185.175.8:54323 MULTI: primary virtual IP for walterm15x/108.185.175.8:54323: 192.168.98.6
Mon Jul 14 15:29:17 2014 us=46920 walterm15x/108.185.175.8:54323 PUSH: Received control message: 'PUSH_REQUEST'
Mon Jul 14 15:29:17 2014 us=46975 walterm15x/108.185.175.8:54323 send_push_reply(): safe_cap=960
Mon Jul 14 15:29:17 2014 us=47037 walterm15x/108.185.175.8:54323 SENT CONTROL [walterm15x]: 'PUSH_REPLY,redirect-gateway def1,route 192.168.98.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.98.6 192.168.98.5' (status=1)
Mon Jul 14 15:31:26 2014 us=472929 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Mon Jul 14 15:31:27 2014 us=560843 event_wait : Interrupted system call (code=4)
Mon Jul 14 15:31:27 2014 us=561279 TCP/UDP: Closing socket
Mon Jul 14 15:31:27 2014 us=561350 /sbin/route del -net 192.168.98.0 netmask 255.255.255.0
SIOCDELRT: Operation not permitted
Mon Jul 14 15:31:27 2014 us=562941 ERROR: Linux route delete command failed: external program exited with error status: 7
Mon Jul 14 15:31:27 2014 us=563010 Closing TUN/TAP interface
Mon Jul 14 15:31:27 2014 us=563044 /sbin/ifconfig tun0 0.0.0.0
SIOCSIFADDR: Permission denied
SIOCSIFFLAGS: Permission denied
Mon Jul 14 15:31:27 2014 us=564784 Linux ip addr del failed: external program exited with error status: 255
Mon Jul 14 15:31:28 2014 us=864367 SIGINT[hard,] received, process exiting
Server Routing
root@apiary:~# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default Wireless_Broadb 0.0.0.0 UG 0 0 0 eth1
link-local * 255.255.0.0 U 1000 0 0 eth1
192.168.10.0 * 255.255.255.0 U 0 0 0 eth1
192.168.98.0 192.168.98.2 255.255.255.0 UG 0 0 0 tun0
192.168.98.0 apiary.home 255.255.255.0 UG 0 0 0 eth1
192.168.98.2 * 255.255.255.255 UH 0 0 0 tun0
root@apiary:~# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- anywhere anywhere state NEW udp dpt:openvpn
ACCEPT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
root@apiary:~# iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 192.168.98.0/24 anywhere
MASQUERADE all -- 192.168.98.0/24 anywhere
Client Config
client
remote apiary.*****************.com
ca /home/walter/keys/ca.crt
cert /home/walter/keys/walterm15x.crt
key /home/walter/keys/walterm15x.key
dev tun
proto udp
remote-cert-tls server
nobind
auth-nocache
script-security 2
persist-key
persist-tun
user nobody
group nogroup
verb 4
log /home/walter/keys/client.log
Client Log
During this time I ssh'd to the VPN IP on Home LAN to get current routes and iptables.
It is unknown if it routed over VPN or neighbor's WLAN, but it took it a minute to get a
response to enter the ssh passwd, and then everything was snappy as usual. Maybe
the vpn setting up traffic encryption, or my client machine finding a route?? :roll:
Mon Jul 14 15:29:20 2014 us=952635 Current Parameter Settings:
Mon Jul 14 15:29:20 2014 us=952732 config = '/home/walter/keys/Apiary (openvpn).conf'
Mon Jul 14 15:29:20 2014 us=952749 mode = 0
Mon Jul 14 15:29:20 2014 us=952764 persist_config = DISABLED
Mon Jul 14 15:29:20 2014 us=952777 persist_mode = 1
Mon Jul 14 15:29:20 2014 us=952790 show_ciphers = DISABLED
Mon Jul 14 15:29:20 2014 us=952803 show_digests = DISABLED
Mon Jul 14 15:29:20 2014 us=952815 show_engines = DISABLED
Mon Jul 14 15:29:20 2014 us=952841 genkey = DISABLED
Mon Jul 14 15:29:20 2014 us=952854 key_pass_file = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=952867 show_tls_ciphers = DISABLED
Mon Jul 14 15:29:20 2014 us=952880 Connection profiles [default]:
Mon Jul 14 15:29:20 2014 us=952892 proto = udp
Mon Jul 14 15:29:20 2014 us=952904 local = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=952916 local_port = 0
Mon Jul 14 15:29:20 2014 us=952928 remote = 'apiary.yourcertifiedgeek.com'
Mon Jul 14 15:29:20 2014 us=952938 remote_port = 1194
Mon Jul 14 15:29:20 2014 us=952949 remote_float = DISABLED
Mon Jul 14 15:29:20 2014 us=952961 bind_defined = DISABLED
Mon Jul 14 15:29:20 2014 us=952994 bind_local = DISABLED
Mon Jul 14 15:29:20 2014 us=953005 connect_retry_seconds = 5
Mon Jul 14 15:29:20 2014 us=953017 connect_timeout = 10
Mon Jul 14 15:29:20 2014 us=953028 connect_retry_max = 0
Mon Jul 14 15:29:20 2014 us=953039 socks_proxy_server = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=953051 socks_proxy_port = 0
Mon Jul 14 15:29:20 2014 us=953062 socks_proxy_retry = DISABLED
Mon Jul 14 15:29:20 2014 us=953071 tun_mtu = 1500
Mon Jul 14 15:29:20 2014 us=953080 tun_mtu_defined = ENABLED
Mon Jul 14 15:29:20 2014 us=953090 link_mtu = 1500
Mon Jul 14 15:29:20 2014 us=953100 link_mtu_defined = DISABLED
Mon Jul 14 15:29:20 2014 us=953109 tun_mtu_extra = 0
Mon Jul 14 15:29:20 2014 us=953118 tun_mtu_extra_defined = DISABLED
Mon Jul 14 15:29:20 2014 us=953128 mtu_discover_type = -1
Mon Jul 14 15:29:20 2014 us=953138 fragment = 0
Mon Jul 14 15:29:20 2014 us=953148 mssfix = 1450
Mon Jul 14 15:29:20 2014 us=953158 explicit_exit_notification = 0
Mon Jul 14 15:29:20 2014 us=953171 Connection profiles END
Mon Jul 14 15:29:20 2014 us=953182 remote_random = DISABLED
Mon Jul 14 15:29:20 2014 us=953192 ipchange = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=953201 dev = 'tun'
Mon Jul 14 15:29:20 2014 us=953211 dev_type = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=953221 dev_node = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=953230 lladdr = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=953240 topology = 1
Mon Jul 14 15:29:20 2014 us=953250 tun_ipv6 = DISABLED
Mon Jul 14 15:29:20 2014 us=953259 ifconfig_local = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=953268 ifconfig_remote_netmask = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=953278 ifconfig_noexec = DISABLED
Mon Jul 14 15:29:20 2014 us=953287 ifconfig_nowarn = DISABLED
Mon Jul 14 15:29:20 2014 us=953297 ifconfig_ipv6_local = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=953307 ifconfig_ipv6_netbits = 0
Mon Jul 14 15:29:20 2014 us=953317 ifconfig_ipv6_remote = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=953327 shaper = 0
Mon Jul 14 15:29:20 2014 us=953337 mtu_test = 0
Mon Jul 14 15:29:20 2014 us=953346 mlock = DISABLED
Mon Jul 14 15:29:20 2014 us=953355 keepalive_ping = 0
Mon Jul 14 15:29:20 2014 us=953365 keepalive_timeout = 0
Mon Jul 14 15:29:20 2014 us=953374 inactivity_timeout = 0
Mon Jul 14 15:29:20 2014 us=953383 ping_send_timeout = 0
Mon Jul 14 15:29:20 2014 us=953392 ping_rec_timeout = 0
Mon Jul 14 15:29:20 2014 us=953402 ping_rec_timeout_action = 0
Mon Jul 14 15:29:20 2014 us=953411 ping_timer_remote = DISABLED
Mon Jul 14 15:29:20 2014 us=953421 remap_sigusr1 = 0
Mon Jul 14 15:29:20 2014 us=953431 persist_tun = ENABLED
Mon Jul 14 15:29:20 2014 us=953447 persist_local_ip = DISABLED
Mon Jul 14 15:29:20 2014 us=953457 persist_remote_ip = DISABLED
Mon Jul 14 15:29:20 2014 us=953468 persist_key = ENABLED
Mon Jul 14 15:29:20 2014 us=953479 passtos = DISABLED
Mon Jul 14 15:29:20 2014 us=953490 resolve_retry_seconds = 1000000000
Mon Jul 14 15:29:20 2014 us=953509 username = 'nobody'
Mon Jul 14 15:29:20 2014 us=953522 groupname = 'nogroup'
Mon Jul 14 15:29:20 2014 us=953533 chroot_dir = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=953545 cd_dir = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=953557 writepid = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=953570 up_script = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=953582 down_script = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=953594 down_pre = DISABLED
Mon Jul 14 15:29:20 2014 us=953606 up_restart = DISABLED
Mon Jul 14 15:29:20 2014 us=953617 up_delay = DISABLED
Mon Jul 14 15:29:20 2014 us=953629 daemon = DISABLED
Mon Jul 14 15:29:20 2014 us=953641 inetd = 0
Mon Jul 14 15:29:20 2014 us=953651 log = ENABLED
Mon Jul 14 15:29:20 2014 us=953661 suppress_timestamps = DISABLED
Mon Jul 14 15:29:20 2014 us=953671 nice = 0
Mon Jul 14 15:29:20 2014 us=953681 verbosity = 4
Mon Jul 14 15:29:20 2014 us=953691 mute = 0
Mon Jul 14 15:29:20 2014 us=953701 gremlin = 0
Mon Jul 14 15:29:20 2014 us=953712 status_file = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=953725 status_file_version = 1
Mon Jul 14 15:29:20 2014 us=953736 status_file_update_freq = 60
Mon Jul 14 15:29:20 2014 us=953747 occ = ENABLED
Mon Jul 14 15:29:20 2014 us=953758 rcvbuf = 65536
Mon Jul 14 15:29:20 2014 us=953770 sndbuf = 65536
Mon Jul 14 15:29:20 2014 us=953781 mark = 0
Mon Jul 14 15:29:20 2014 us=953793 sockflags = 0
Mon Jul 14 15:29:20 2014 us=953803 fast_io = DISABLED
Mon Jul 14 15:29:20 2014 us=953812 lzo = 0
Mon Jul 14 15:29:20 2014 us=953823 route_script = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=953833 route_default_gateway = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=953843 route_default_metric = 0
Mon Jul 14 15:29:20 2014 us=953854 route_noexec = DISABLED
Mon Jul 14 15:29:20 2014 us=953865 route_delay = 0
Mon Jul 14 15:29:20 2014 us=953876 route_delay_window = 30
Mon Jul 14 15:29:20 2014 us=953886 route_delay_defined = DISABLED
Mon Jul 14 15:29:20 2014 us=953895 route_nopull = DISABLED
Mon Jul 14 15:29:20 2014 us=953905 route_gateway_via_dhcp = DISABLED
Mon Jul 14 15:29:20 2014 us=953916 max_routes = 100
Mon Jul 14 15:29:20 2014 us=953928 allow_pull_fqdn = DISABLED
Mon Jul 14 15:29:20 2014 us=953939 management_addr = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=953951 management_port = 0
Mon Jul 14 15:29:20 2014 us=953961 management_user_pass = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=953972 management_log_history_cache = 250
Mon Jul 14 15:29:20 2014 us=953982 management_echo_buffer_size = 100
Mon Jul 14 15:29:20 2014 us=953993 management_write_peer_info_file = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=954004 management_client_user = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=954016 management_client_group = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=954028 management_flags = 0
Mon Jul 14 15:29:20 2014 us=954043 shared_secret_file = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=954056 key_direction = 0
Mon Jul 14 15:29:20 2014 us=954068 ciphername_defined = ENABLED
Mon Jul 14 15:29:20 2014 us=954080 ciphername = 'BF-CBC'
Mon Jul 14 15:29:20 2014 us=954092 authname_defined = ENABLED
Mon Jul 14 15:29:20 2014 us=954104 authname = 'SHA1'
Mon Jul 14 15:29:20 2014 us=954116 prng_hash = 'SHA1'
Mon Jul 14 15:29:20 2014 us=954129 prng_nonce_secret_len = 16
Mon Jul 14 15:29:20 2014 us=954141 keysize = 0
Mon Jul 14 15:29:20 2014 us=954153 engine = DISABLED
Mon Jul 14 15:29:20 2014 us=954164 replay = ENABLED
Mon Jul 14 15:29:20 2014 us=954177 mute_replay_warnings = DISABLED
Mon Jul 14 15:29:20 2014 us=954189 replay_window = 64
Mon Jul 14 15:29:20 2014 us=954202 replay_time = 15
Mon Jul 14 15:29:20 2014 us=954214 packet_id_file = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=954225 use_iv = ENABLED
Mon Jul 14 15:29:20 2014 us=954236 test_crypto = DISABLED
Mon Jul 14 15:29:20 2014 us=954247 tls_server = DISABLED
Mon Jul 14 15:29:20 2014 us=954258 tls_client = ENABLED
Mon Jul 14 15:29:20 2014 us=954270 key_method = 2
Mon Jul 14 15:29:20 2014 us=954282 ca_file = '/home/walter/keys/ca.crt'
Mon Jul 14 15:29:20 2014 us=954302 ca_path = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=954315 dh_file = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=954327 cert_file = '/home/walter/keys/walterm15x.crt'
Mon Jul 14 15:29:20 2014 us=954337 priv_key_file = '/home/walter/keys/walterm15x.key'
Mon Jul 14 15:29:20 2014 us=954347 pkcs12_file = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=954357 cipher_list = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=954368 tls_verify = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=954379 tls_export_cert = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=954387 verify_x509_type = 0
Mon Jul 14 15:29:20 2014 us=954395 verify_x509_name = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=954402 crl_file = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=954409 ns_cert_type = 0
Mon Jul 14 15:29:20 2014 us=954417 remote_cert_ku[i] = 160
Mon Jul 14 15:29:20 2014 us=954424 remote_cert_ku[i] = 136
Mon Jul 14 15:29:20 2014 us=954431 remote_cert_ku[i] = 0
Mon Jul 14 15:29:20 2014 us=954439 remote_cert_ku[i] = 0
Mon Jul 14 15:29:20 2014 us=954446 remote_cert_ku[i] = 0
Mon Jul 14 15:29:20 2014 us=954453 remote_cert_ku[i] = 0
Mon Jul 14 15:29:20 2014 us=954460 remote_cert_ku[i] = 0
Mon Jul 14 15:29:20 2014 us=954467 remote_cert_ku[i] = 0
Mon Jul 14 15:29:20 2014 us=954475 remote_cert_ku[i] = 0
Mon Jul 14 15:29:20 2014 us=954482 remote_cert_ku[i] = 0
Mon Jul 14 15:29:20 2014 us=954489 remote_cert_ku[i] = 0
Mon Jul 14 15:29:20 2014 us=954496 remote_cert_ku[i] = 0
Mon Jul 14 15:29:20 2014 us=954503 remote_cert_ku[i] = 0
Mon Jul 14 15:29:20 2014 us=954510 remote_cert_ku[i] = 0
Mon Jul 14 15:29:20 2014 us=954518 remote_cert_ku[i] = 0
Mon Jul 14 15:29:20 2014 us=954525 remote_cert_ku[i] = 0
Mon Jul 14 15:29:20 2014 us=954532 remote_cert_eku = 'TLS Web Server Authentication'
Mon Jul 14 15:29:20 2014 us=954539 ssl_flags = 0
Mon Jul 14 15:29:20 2014 us=954547 tls_timeout = 2
Mon Jul 14 15:29:20 2014 us=954554 renegotiate_bytes = 0
Mon Jul 14 15:29:20 2014 us=954561 renegotiate_packets = 0
Mon Jul 14 15:29:20 2014 us=954568 renegotiate_seconds = 3600
Mon Jul 14 15:29:20 2014 us=954576 handshake_window = 60
Mon Jul 14 15:29:20 2014 us=954583 transition_window = 3600
Mon Jul 14 15:29:20 2014 us=954590 single_session = DISABLED
Mon Jul 14 15:29:20 2014 us=954597 push_peer_info = DISABLED
Mon Jul 14 15:29:20 2014 us=954604 tls_exit = DISABLED
Mon Jul 14 15:29:20 2014 us=954611 tls_auth_file = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=954619 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:29:20 2014 us=954626 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:29:20 2014 us=954633 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:29:20 2014 us=954640 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:29:20 2014 us=954647 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:29:20 2014 us=954655 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:29:20 2014 us=954662 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:29:20 2014 us=954669 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:29:20 2014 us=954676 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:29:20 2014 us=954683 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:29:20 2014 us=954690 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:29:20 2014 us=954697 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:29:20 2014 us=954704 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:29:20 2014 us=954711 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:29:20 2014 us=954718 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:29:20 2014 us=954725 pkcs11_protected_authentication = DISABLED
Mon Jul 14 15:29:20 2014 us=954735 pkcs11_private_mode = 00000000
Mon Jul 14 15:29:20 2014 us=954743 pkcs11_private_mode = 00000000
Mon Jul 14 15:29:20 2014 us=954750 pkcs11_private_mode = 00000000
Mon Jul 14 15:29:20 2014 us=954758 pkcs11_private_mode = 00000000
Mon Jul 14 15:29:20 2014 us=954765 pkcs11_private_mode = 00000000
Mon Jul 14 15:29:20 2014 us=954778 pkcs11_private_mode = 00000000
Mon Jul 14 15:29:20 2014 us=954785 pkcs11_private_mode = 00000000
Mon Jul 14 15:29:20 2014 us=954793 pkcs11_private_mode = 00000000
Mon Jul 14 15:29:20 2014 us=954800 pkcs11_private_mode = 00000000
Mon Jul 14 15:29:20 2014 us=954807 pkcs11_private_mode = 00000000
Mon Jul 14 15:29:20 2014 us=954814 pkcs11_private_mode = 00000000
Mon Jul 14 15:29:20 2014 us=954821 pkcs11_private_mode = 00000000
Mon Jul 14 15:29:20 2014 us=954829 pkcs11_private_mode = 00000000
Mon Jul 14 15:29:20 2014 us=954836 pkcs11_private_mode = 00000000
Mon Jul 14 15:29:20 2014 us=954843 pkcs11_private_mode = 00000000
Mon Jul 14 15:29:20 2014 us=954850 pkcs11_private_mode = 00000000
Mon Jul 14 15:29:20 2014 us=954858 pkcs11_cert_private = DISABLED
Mon Jul 14 15:29:20 2014 us=954865 pkcs11_cert_private = DISABLED
Mon Jul 14 15:29:20 2014 us=954872 pkcs11_cert_private = DISABLED
Mon Jul 14 15:29:20 2014 us=954879 pkcs11_cert_private = DISABLED
Mon Jul 14 15:29:20 2014 us=954886 pkcs11_cert_private = DISABLED
Mon Jul 14 15:29:20 2014 us=954893 pkcs11_cert_private = DISABLED
Mon Jul 14 15:29:20 2014 us=954900 pkcs11_cert_private = DISABLED
Mon Jul 14 15:29:20 2014 us=954908 pkcs11_cert_private = DISABLED
Mon Jul 14 15:29:20 2014 us=954915 pkcs11_cert_private = DISABLED
Mon Jul 14 15:29:20 2014 us=954922 pkcs11_cert_private = DISABLED
Mon Jul 14 15:29:20 2014 us=954929 pkcs11_cert_private = DISABLED
Mon Jul 14 15:29:20 2014 us=954936 pkcs11_cert_private = DISABLED
Mon Jul 14 15:29:20 2014 us=954943 pkcs11_cert_private = DISABLED
Mon Jul 14 15:29:20 2014 us=954950 pkcs11_cert_private = DISABLED
Mon Jul 14 15:29:20 2014 us=954957 pkcs11_cert_private = DISABLED
Mon Jul 14 15:29:20 2014 us=954964 pkcs11_cert_private = DISABLED
Mon Jul 14 15:29:20 2014 us=954971 pkcs11_pin_cache_period = -1
Mon Jul 14 15:29:20 2014 us=954979 pkcs11_id = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=954986 pkcs11_id_management = DISABLED
Mon Jul 14 15:29:20 2014 us=955001 server_network = 0.0.0.0
Mon Jul 14 15:29:20 2014 us=955009 server_netmask = 0.0.0.0
Mon Jul 14 15:29:20 2014 us=955022 server_network_ipv6 = ::
Mon Jul 14 15:29:20 2014 us=955030 server_netbits_ipv6 = 0
Mon Jul 14 15:29:20 2014 us=955038 server_bridge_ip = 0.0.0.0
Mon Jul 14 15:29:20 2014 us=955046 server_bridge_netmask = 0.0.0.0
Mon Jul 14 15:29:20 2014 us=955054 server_bridge_pool_start = 0.0.0.0
Mon Jul 14 15:29:20 2014 us=955062 server_bridge_pool_end = 0.0.0.0
Mon Jul 14 15:29:20 2014 us=955069 ifconfig_pool_defined = DISABLED
Mon Jul 14 15:29:20 2014 us=955077 ifconfig_pool_start = 0.0.0.0
Mon Jul 14 15:29:20 2014 us=955085 ifconfig_pool_end = 0.0.0.0
Mon Jul 14 15:29:20 2014 us=955093 ifconfig_pool_netmask = 0.0.0.0
Mon Jul 14 15:29:20 2014 us=955100 ifconfig_pool_persist_filename = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=955107 ifconfig_pool_persist_refresh_freq = 600
Mon Jul 14 15:29:20 2014 us=955115 ifconfig_ipv6_pool_defined = DISABLED
Mon Jul 14 15:29:20 2014 us=955122 ifconfig_ipv6_pool_base = ::
Mon Jul 14 15:29:20 2014 us=955130 ifconfig_ipv6_pool_netbits = 0
Mon Jul 14 15:29:20 2014 us=955137 n_bcast_buf = 256
Mon Jul 14 15:29:20 2014 us=955144 tcp_queue_limit = 64
Mon Jul 14 15:29:20 2014 us=955152 real_hash_size = 256
Mon Jul 14 15:29:20 2014 us=955159 virtual_hash_size = 256
Mon Jul 14 15:29:20 2014 us=955166 client_connect_script = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=955173 learn_address_script = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=955181 client_disconnect_script = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=955188 client_config_dir = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=955195 ccd_exclusive = DISABLED
Mon Jul 14 15:29:20 2014 us=955202 tmp_dir = '/tmp'
Mon Jul 14 15:29:20 2014 us=955209 push_ifconfig_defined = DISABLED
Mon Jul 14 15:29:20 2014 us=955217 push_ifconfig_local = 0.0.0.0
Mon Jul 14 15:29:20 2014 us=955225 push_ifconfig_remote_netmask = 0.0.0.0
Mon Jul 14 15:29:20 2014 us=955233 push_ifconfig_ipv6_defined = DISABLED
Mon Jul 14 15:29:20 2014 us=955245 push_ifconfig_ipv6_local = ::/0
Mon Jul 14 15:29:20 2014 us=955253 push_ifconfig_ipv6_remote = ::
Mon Jul 14 15:29:20 2014 us=955260 enable_c2c = DISABLED
Mon Jul 14 15:29:20 2014 us=955267 duplicate_cn = DISABLED
Mon Jul 14 15:29:20 2014 us=955275 cf_max = 0
Mon Jul 14 15:29:20 2014 us=955282 cf_per = 0
Mon Jul 14 15:29:20 2014 us=955289 max_clients = 1024
Mon Jul 14 15:29:20 2014 us=955296 max_routes_per_client = 256
Mon Jul 14 15:29:20 2014 us=955303 auth_user_pass_verify_script = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=955311 auth_user_pass_verify_script_via_file = DISABLED
Mon Jul 14 15:29:20 2014 us=955318 port_share_host = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=955325 port_share_port = 0
Mon Jul 14 15:29:20 2014 us=955332 client = ENABLED
Mon Jul 14 15:29:20 2014 us=955339 pull = ENABLED
Mon Jul 14 15:29:20 2014 us=955346 auth_user_pass_file = '[UNDEF]'
Mon Jul 14 15:29:20 2014 us=955355 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Feb 4 2014
Mon Jul 14 15:29:20 2014 us=955852 WARNING: file '/home/walter/keys/walterm15x.key' is group or others accessible
Mon Jul 14 15:29:20 2014 us=956019 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Jul 14 15:29:20 2014 us=956062 Socket Buffers: R=[212992->131072] S=[212992->131072]
Mon Jul 14 15:29:21 2014 us=3011 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Mon Jul 14 15:29:21 2014 us=3097 Local Options String: 'V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Jul 14 15:29:21 2014 us=3119 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Jul 14 15:29:21 2014 us=3159 Local Options hash (VER=V4): '3514370b'
Mon Jul 14 15:29:21 2014 us=3183 Expected Remote Options hash (VER=V4): '239669a8'
Mon Jul 14 15:29:21 2014 us=3733 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Mon Jul 14 15:29:21 2014 us=3758 UDPv4 link local: [undef]
Mon Jul 14 15:29:21 2014 us=3774 UDPv4 link remote: [AF_INET]173.55.19.103:1194
Mon Jul 14 15:29:21 2014 us=30343 TLS: Initial packet from [AF_INET]173.55.19.103:1194, sid=5ddf7fb2 15c714bf
Mon Jul 14 15:29:21 2014 us=290117 VERIFY OK: depth=1, C=US, ST=CA, L=LosAngeles, O=YourCertifiedGeek, OU=support, CN=apiary, name=apiary, emailAddress=info@yourcertifiedgeek.com
Mon Jul 14 15:29:21 2014 us=290648 Validating certificate key usage
Mon Jul 14 15:29:21 2014 us=290679 ++ Certificate has key usage 00a0, expects 00a0
Mon Jul 14 15:29:21 2014 us=290698 VERIFY KU OK
Mon Jul 14 15:29:21 2014 us=290722 Validating certificate extended key usage
Mon Jul 14 15:29:21 2014 us=290742 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Jul 14 15:29:21 2014 us=290760 VERIFY EKU OK
Mon Jul 14 15:29:21 2014 us=290777 VERIFY OK: depth=0, C=US, ST=CA, L=LosAngeles, O=YourCertifiedGeek, OU=support, CN=server, name=apiary, emailAddress=info@yourcertifiedgeek.com
Mon Jul 14 15:29:21 2014 us=735877 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jul 14 15:29:21 2014 us=735936 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jul 14 15:29:21 2014 us=735997 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jul 14 15:29:21 2014 us=736013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jul 14 15:29:21 2014 us=736051 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Jul 14 15:29:21 2014 us=736079 [server] Peer Connection Initiated with [AF_INET]173.55.19.103:1194
Mon Jul 14 15:29:23 2014 us=996528 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Jul 14 15:29:24 2014 us=17762 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route 192.168.98.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.98.6 192.168.98.5'
Mon Jul 14 15:29:24 2014 us=17990 OPTIONS IMPORT: timers and/or timeouts modified
Mon Jul 14 15:29:24 2014 us=18025 OPTIONS IMPORT: --ifconfig/up options modified
Mon Jul 14 15:29:24 2014 us=18051 OPTIONS IMPORT: route options modified
Mon Jul 14 15:29:24 2014 us=18393 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=wlan0 HWADDR=00:21:6a:c6:76:dc
Mon Jul 14 15:29:24 2014 us=18858 TUN/TAP device tun0 opened
Mon Jul 14 15:29:24 2014 us=18892 TUN/TAP TX queue length set to 100
Mon Jul 14 15:29:24 2014 us=18924 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Jul 14 15:29:24 2014 us=18966 /sbin/ip link set dev tun0 up mtu 1500
Mon Jul 14 15:29:24 2014 us=21059 /sbin/ip addr add dev tun0 local 192.168.98.6 peer 192.168.98.5
Mon Jul 14 15:29:24 2014 us=22502 /sbin/ip route add 173.55.19.103/32 via 192.168.0.1
Mon Jul 14 15:29:24 2014 us=23554 /sbin/ip route add 0.0.0.0/1 via 192.168.98.5
Mon Jul 14 15:29:24 2014 us=26843 /sbin/ip route add 128.0.0.0/1 via 192.168.98.5
Mon Jul 14 15:29:24 2014 us=29880 /sbin/ip route add 192.168.98.0/24 via 192.168.98.5
Mon Jul 14 15:29:24 2014 us=32162 GID set to nogroup
Mon Jul 14 15:29:24 2014 us=32227 UID set to nobody
Mon Jul 14 15:29:24 2014 us=32243 Initialization Sequence Completed
Mon Jul 14 15:31:32 2014 us=620207 event_wait : Interrupted system call (code=4)
Mon Jul 14 15:31:32 2014 us=620663 TCP/UDP: Closing socket
Mon Jul 14 15:31:32 2014 us=620778 /sbin/ip route del 192.168.98.0/24
RTNETLINK answers: Operation not permitted
Mon Jul 14 15:31:32 2014 us=622932 ERROR: Linux route delete command failed: external program exited with error status: 2
Mon Jul 14 15:31:32 2014 us=623009 /sbin/ip route del 173.55.19.103/32
RTNETLINK answers: Operation not permitted
Mon Jul 14 15:31:32 2014 us=624440 ERROR: Linux route delete command failed: external program exited with error status: 2
Mon Jul 14 15:31:32 2014 us=624511 /sbin/ip route del 0.0.0.0/1
RTNETLINK answers: Operation not permitted
Mon Jul 14 15:31:32 2014 us=625615 ERROR: Linux route delete command failed: external program exited with error status: 2
Mon Jul 14 15:31:32 2014 us=625683 /sbin/ip route del 128.0.0.0/1
RTNETLINK answers: Operation not permitted
Mon Jul 14 15:31:32 2014 us=627039 ERROR: Linux route delete command failed: external program exited with error status: 2
Mon Jul 14 15:31:32 2014 us=627092 Closing TUN/TAP interface
Mon Jul 14 15:31:32 2014 us=627132 /sbin/ip addr del dev tun0 local 192.168.98.6 peer 192.168.98.5
RTNETLINK answers: Operation not permitted
Mon Jul 14 15:31:32 2014 us=628563 Linux ip addr del failed: external program exited with error status: 2
Mon Jul 14 15:31:32 2014 us=656972 SIGINT[hard,] received, process exiting
Client Routing
walter@walter-M15x ~ $ route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 192.168.98.5 128.0.0.0 UG 0 0 0 tun0
default 192.168.0.1 0.0.0.0 UG 0 0 0 wlan0 # I cannot delete this. I do not want any traffic to go out on the wlan, only route over the tunnel.
128.0.0.0 192.168.98.5 128.0.0.0 UG 0 0 0 tun0 # I have no idea why there's a route going to a 128 network? I'm assuming openvpn needs it, because it there only when it runs.
173.55.19.103 192.168.0.1 255.255.255.255 UGH 0 0 0 wlan0
192.168.0.0 * 255.255.255.0 U 9 0 0 wlan0
192.168.98.0 192.168.98.5 255.255.255.0 UG 0 0 0 tun0
192.168.98.5 * 255.255.255.255 UH 0 0 0 tun0
walter-M15x ~ # iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
walter-M15x ~ # iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
