error: not adding 2000::/3, no IPv6 on if tap0

dfn

Hi everybody,

I'm having problems pushing IPv6 options to clients
in a bridged (tap) configuration.

Our IPv4-only setup is working nicely:

- bridged setup
- pushing of default IPv4 route to clients
- Server: Openvpn 2.3.2 on Debian-Linux 7
- Client: Openvpn 2.3.3 on Debian-Linux 7

Clients get a local IPv6 address through stateless address
autoconfiguration and can use IPv6 to hosts in the server network.

But when pushing the default IPv6 route to the clients I get

add_route_ipv6(): not adding 2000::/3, no IPv6 on if tap0

I played around with the various --ifconfig-ipv6-* options but they do
apparently not work when using a bridged setup.
I checked the wiki (https://community.openvpn.net/openvpn/wiki/IPv6)
and Google without success. They all just talk about a routed setup.

Sorry if I'm missing something obvious here but I'm running out of ideas.

Server config:

local                   HOSTNAME
port                    1194
proto                   udp
dev                     tap0
management              127.0.0.1 7505  /etc/openvpn/passwd-mgt
ca                      ca.pem
cert                    /etc/ssl/localcerts/HOSTNAME.crt.pem
key                     /etc/ssl/private/HOSTNAME.key.pem
dh                      dh1024.pem
ifconfig-pool-persist   /var/lib/openvpn/ipp.txt
status                  /var/lib/openvpn/status.log
server-bridge           XX.XX.XX.1 255.255.255.0 XX.XX.XX.241 XX.XX.XX.242
client-config-dir       ccd
push                    "redirect-gateway def1"
push                    "route-ipv6 2000::/3 2001:XX:XX::1"
push                    "dhcp-option DNS XX.XX.XX.217"
push                    "dhcp-option DNS XX.XX.XX.252"
client-to-client
keepalive               10 120
comp-lzo
user                    nobody
group                   nogroup
persist-key
persist-tun
verb                    4
script-security         2
tls-verify              "/usr/share/openvpn/verify-cn /etc/openvpn/allowedclients"

Client config:

client
dev                     tap0
proto                   udp
remote                  HOSTNAME 1194
resolv-retry            infinite
nobind
persist-key
persist-tun
pkcs12                  /home/USER/.openvpn/NAME.p12
comp-lzo
ifconfig-nowarn
verify-x509-name        "C=XX, ST=XX, L=XX, O=XX, OU=XX, CN=HOSTNAME"
verb                    4
script-security         2
route-delay             3

Server log:

Jul 28 10:57:30 ovpn0 ovpn-dev[24288]: Current Parameter Settings:
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   config = '/etc/openvpn/ovpn-dev.conf'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   mode = 1
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   persist_config = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   persist_mode = 1
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   show_ciphers = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   show_digests = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   show_engines = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   genkey = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   key_pass_file = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   show_tls_ciphers = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]: Connection profiles [default]:
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   proto = udp
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   local = 'HOSTNAME'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   local_port = 1194
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   remote = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   remote_port = 1194
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   remote_float = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   bind_defined = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   bind_local = ENABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   connect_retry_seconds = 5
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   connect_timeout = 10
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   connect_retry_max = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   socks_proxy_server = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   socks_proxy_port = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   socks_proxy_retry = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   tun_mtu = 1500
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   tun_mtu_defined = ENABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   link_mtu = 1500
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   link_mtu_defined = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   tun_mtu_extra = 32
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   tun_mtu_extra_defined = ENABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   mtu_discover_type = -1
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   fragment = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   mssfix = 1450
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   explicit_exit_notification = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]: Connection profiles END
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   remote_random = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   ipchange = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   dev = 'tap0'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   dev_type = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   dev_node = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   lladdr = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   topology = 1
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   tun_ipv6 = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   ifconfig_local = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   ifconfig_remote_netmask = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   ifconfig_noexec = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   ifconfig_nowarn = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   ifconfig_ipv6_local = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   ifconfig_ipv6_netbits = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   ifconfig_ipv6_remote = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   shaper = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   mtu_test = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   mlock = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   keepalive_ping = 10
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   keepalive_timeout = 120
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   inactivity_timeout = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   ping_send_timeout = 10
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   ping_rec_timeout = 240
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   ping_rec_timeout_action = 2
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   ping_timer_remote = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   remap_sigusr1 = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   persist_tun = ENABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   persist_local_ip = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   persist_remote_ip = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   persist_key = ENABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   passtos = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   resolve_retry_seconds = 1000000000
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   username = 'nobody'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   groupname = 'nogroup'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   chroot_dir = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   cd_dir = '/etc/openvpn'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   writepid = '/run/openvpn/ovpn-dev.pid'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   up_script = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   down_script = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   down_pre = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   up_restart = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   up_delay = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   daemon = ENABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   inetd = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   log = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   suppress_timestamps = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   nice = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   verbosity = 4
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   mute = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   gremlin = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   status_file = '/var/lib/openvpn/status.log'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   status_file_version = 1
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   status_file_update_freq = 60
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   occ = ENABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   rcvbuf = 65536
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   sndbuf = 65536
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   mark = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   sockflags = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   fast_io = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   lzo = 7
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   route_script = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   route_default_gateway = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   route_default_metric = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   route_noexec = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   route_delay = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   route_delay_window = 30
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   route_delay_defined = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   route_nopull = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   route_gateway_via_dhcp = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   max_routes = 100
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   allow_pull_fqdn = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   management_addr = '127.0.0.1'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   management_port = 7505
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   management_user_pass = '/etc/openvpn/passwd-mgt'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   management_log_history_cache = 250
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   management_echo_buffer_size = 100
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   management_write_peer_info_file = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   management_client_user = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   management_client_group = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   management_flags = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   shared_secret_file = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   key_direction = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   ciphername_defined = ENABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   ciphername = 'BF-CBC'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   authname_defined = ENABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   authname = 'SHA1'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   prng_hash = 'SHA1'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   prng_nonce_secret_len = 16
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   keysize = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   engine = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   replay = ENABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   mute_replay_warnings = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   replay_window = 64
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   replay_time = 15
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   packet_id_file = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   use_iv = ENABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   test_crypto = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   tls_server = ENABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   tls_client = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   key_method = 2
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   ca_file = 'ca.pem'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   ca_path = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   dh_file = 'dh1024.pem'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   cert_file = '/etc/ssl/localcerts/HOSTNAME.crt.pem'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   priv_key_file = '/etc/ssl/private/HOSTNAME.key.pem'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs12_file = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   cipher_list = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   tls_verify = '/usr/share/openvpn/verify-cn /etc/openvpn/allowedclients'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   tls_export_cert = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   verify_x509_type = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   verify_x509_name = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   crl_file = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   ns_cert_type = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   remote_cert_ku[i] = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   remote_cert_ku[i] = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   remote_cert_ku[i] = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   remote_cert_ku[i] = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   remote_cert_ku[i] = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   remote_cert_ku[i] = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   remote_cert_ku[i] = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   remote_cert_ku[i] = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   remote_cert_ku[i] = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   remote_cert_ku[i] = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   remote_cert_ku[i] = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   remote_cert_ku[i] = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   remote_cert_ku[i] = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   remote_cert_ku[i] = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   remote_cert_ku[i] = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   remote_cert_ku[i] = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   remote_cert_eku = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   ssl_flags = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   tls_timeout = 2
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   renegotiate_bytes = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   renegotiate_packets = 0
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   renegotiate_seconds = 3600
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   handshake_window = 60
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   transition_window = 3600
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   single_session = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   push_peer_info = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   tls_exit = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   tls_auth_file = '[UNDEF]'
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs11_protected_authentication = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs11_protected_authentication = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs11_protected_authentication = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs11_protected_authentication = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs11_protected_authentication = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs11_protected_authentication = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs11_protected_authentication = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs11_protected_authentication = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs11_protected_authentication = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs11_protected_authentication = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs11_protected_authentication = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs11_protected_authentication = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs11_protected_authentication = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs11_protected_authentication = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs11_protected_authentication = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs11_protected_authentication = DISABLED
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs11_private_mode = 00000000
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs11_private_mode = 00000000
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs11_private_mode = 00000000
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs11_private_mode = 00000000
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs11_private_mode = 00000000
Jul 28 10:57:30 ovpn0 ovpn-dev[24288]:   pkcs11_private_mode = 00000000
Jul 28 10:57:30 ovpn0 ovpn-dev[24289]: GID set to nogroup
Jul 28 10:57:30 ovpn0 ovpn-dev[24289]: UID set to nobody
Jul 28 10:57:30 ovpn0 ovpn-dev[24289]: UDPv4 link local (bound): [AF_INET]XX.XX.XX.249:1194
Jul 28 10:57:30 ovpn0 ovpn-dev[24289]: UDPv4 link remote: [undef]
Jul 28 10:57:30 ovpn0 ovpn-dev[24289]: MULTI: multi_init called, r=256 v=256
Jul 28 10:57:30 ovpn0 ovpn-dev[24289]: IFCONFIG POOL: base=XX.XX.XX.241 size=2, ipv6=0
Jul 28 10:57:30 ovpn0 ovpn-dev[24289]: ifconfig_pool_read(), in='NAME,XX.XX.XX.241', TODO: IPv6
Jul 28 10:57:30 ovpn0 ovpn-dev[24289]: succeeded -> ifconfig_pool_set()
Jul 28 10:57:30 ovpn0 ovpn-dev[24289]: ifconfig_pool_read(), in='NAME,XX.XX.XX.242', TODO: IPv6
Jul 28 10:57:30 ovpn0 ovpn-dev[24289]: succeeded -> ifconfig_pool_set()
Jul 28 10:57:30 ovpn0 ovpn-dev[24289]: IFCONFIG POOL LIST
Jul 28 10:57:30 ovpn0 ovpn-dev[24289]: NAME,XX.XX.XX.241
Jul 28 10:57:30 ovpn0 ovpn-dev[24289]: NAME,XX.XX.XX.242
Jul 28 10:57:30 ovpn0 ovpn-dev[24289]: Initialization Sequence Completed
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: MULTI: multi_create_instance called
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 Re-using SSL/TLS context
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 LZO compression initialized
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 Local Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 Local Options hash (VER=V4): 'f7df56b8'
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 Expected Remote Options hash (VER=V4): 'd79ca330'
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 TLS: Initial packet from [AF_INET]XX.XX.XX.252:32912, sid=1c185fd0 0607ab52
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 VERIFY SCRIPT OK: depth=3, C=XX
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 VERIFY OK: depth=3, C=XX
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 VERIFY SCRIPT OK: depth=2, C=XX
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 VERIFY OK: depth=2, C=XX
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 VERIFY SCRIPT OK: depth=1, C=XX
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 VERIFY OK: depth=1, C=XX
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 VERIFY SCRIPT OK: depth=0, C=XX
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 VERIFY OK: depth=0, C=XX
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: XX.XX.XX.252:32912 [NAME] Peer Connection Initiated with [AF_INET]XX.XX.XX.252:32912
Jul 28 10:57:54 ovpn0 ovpn-dev[24289]: NAME/XX.XX.XX.252:32912 OPTIONS IMPORT: reading client specific options from: ccd/NAME
Jul 28 10:57:56 ovpn0 ovpn-dev[24289]: NAME/XX.XX.XX.252:32912 PUSH: Received control message: 'PUSH_REQUEST'
Jul 28 10:57:56 ovpn0 ovpn-dev[24289]: NAME/XX.XX.XX.252:32912 send_push_reply(): safe_cap=940
Jul 28 10:57:56 ovpn0 ovpn-dev[24289]: NAME/XX.XX.XX.252:32912 SENT CONTROL [NAME]: 'PUSH_REPLY,redirect-gateway def1,route-ipv6 2000::/3 2001:XX:.XX:1::1,dhcp-option DNS XX.XX.XX.217,dhcp-option DNS XX.XX.XX.252,route-gateway XX.XX.XX.1,ping 10,ping-restart 120,ifconfig XX.XX.XX.112 255.255.255.0' (status=1)
Jul 28 10:57:59 ovpn0 ovpn-dev[24289]: NAME/XX.XX.XX.252:32912 MULTI: Learn: d6:51:ab:f6:f6:f8 -> NAME/XX.XX.XX.252:32912

Client log:

Mon Jul 28 10:57:51 2014 us=578687 Current Parameter Settings:
Mon Jul 28 10:57:51 2014 us=578749   config = '/home/USER/.openvpn/ovpn-dev.ovpn'
Mon Jul 28 10:57:51 2014 us=578761   mode = 0
Mon Jul 28 10:57:51 2014 us=578770   persist_config = DISABLED
Mon Jul 28 10:57:51 2014 us=578779   persist_mode = 1
Mon Jul 28 10:57:51 2014 us=578788   show_ciphers = DISABLED
Mon Jul 28 10:57:51 2014 us=578797   show_digests = DISABLED
Mon Jul 28 10:57:51 2014 us=578805   show_engines = DISABLED
Mon Jul 28 10:57:51 2014 us=578813   genkey = DISABLED
Mon Jul 28 10:57:51 2014 us=578822   key_pass_file = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=578833   show_tls_ciphers = DISABLED
Mon Jul 28 10:57:51 2014 us=578844 Connection profiles [default]:
Mon Jul 28 10:57:51 2014 us=578854   proto = udp
Mon Jul 28 10:57:51 2014 us=578862   local = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=578870   local_port = 0
Mon Jul 28 10:57:51 2014 us=578878   remote = 'HOSTNAME'
Mon Jul 28 10:57:51 2014 us=578886   remote_port = 1194
Mon Jul 28 10:57:51 2014 us=578894   remote_float = DISABLED
Mon Jul 28 10:57:51 2014 us=578902   bind_defined = DISABLED
Mon Jul 28 10:57:51 2014 us=578910   bind_local = DISABLED
Mon Jul 28 10:57:51 2014 us=578919   connect_retry_seconds = 5
Mon Jul 28 10:57:51 2014 us=578927   connect_timeout = 10
Mon Jul 28 10:57:51 2014 us=578935   connect_retry_max = 0
Mon Jul 28 10:57:51 2014 us=578943   socks_proxy_server = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=578951   socks_proxy_port = 0
Mon Jul 28 10:57:51 2014 us=578959   socks_proxy_retry = DISABLED
Mon Jul 28 10:57:51 2014 us=578967   tun_mtu = 1500
Mon Jul 28 10:57:51 2014 us=578976   tun_mtu_defined = ENABLED
Mon Jul 28 10:57:51 2014 us=578984   link_mtu = 1500
Mon Jul 28 10:57:51 2014 us=578992   link_mtu_defined = DISABLED
Mon Jul 28 10:57:51 2014 us=579000   tun_mtu_extra = 32
Mon Jul 28 10:57:51 2014 us=579011   tun_mtu_extra_defined = ENABLED
Mon Jul 28 10:57:51 2014 us=579021   mtu_discover_type = -1
Mon Jul 28 10:57:51 2014 us=579030   fragment = 0
Mon Jul 28 10:57:51 2014 us=579038   mssfix = 1450
Mon Jul 28 10:57:51 2014 us=579047   explicit_exit_notification = 0
Mon Jul 28 10:57:51 2014 us=579057 Connection profiles END
Mon Jul 28 10:57:51 2014 us=579066   remote_random = DISABLED
Mon Jul 28 10:57:51 2014 us=579077   ipchange = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579094   dev = 'tap0'
Mon Jul 28 10:57:51 2014 us=579110   dev_type = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579130   dev_node = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579146   lladdr = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579162   topology = 1
Mon Jul 28 10:57:51 2014 us=579193   tun_ipv6 = DISABLED
Mon Jul 28 10:57:51 2014 us=579210   ifconfig_local = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579226   ifconfig_remote_netmask = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579242   ifconfig_noexec = DISABLED
Mon Jul 28 10:57:51 2014 us=579260   ifconfig_nowarn = ENABLED
Mon Jul 28 10:57:51 2014 us=579278   ifconfig_ipv6_local = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579296   ifconfig_ipv6_netbits = 0
Mon Jul 28 10:57:51 2014 us=579305   ifconfig_ipv6_remote = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579313   shaper = 0
Mon Jul 28 10:57:51 2014 us=579322   mtu_test = 0
Mon Jul 28 10:57:51 2014 us=579330   mlock = DISABLED
Mon Jul 28 10:57:51 2014 us=579339   keepalive_ping = 0
Mon Jul 28 10:57:51 2014 us=579347   keepalive_timeout = 0
Mon Jul 28 10:57:51 2014 us=579355   inactivity_timeout = 0
Mon Jul 28 10:57:51 2014 us=579364   ping_send_timeout = 0
Mon Jul 28 10:57:51 2014 us=579372   ping_rec_timeout = 0
Mon Jul 28 10:57:51 2014 us=579381   ping_rec_timeout_action = 0
Mon Jul 28 10:57:51 2014 us=579389   ping_timer_remote = DISABLED
Mon Jul 28 10:57:51 2014 us=579397   remap_sigusr1 = 0
Mon Jul 28 10:57:51 2014 us=579406   persist_tun = ENABLED
Mon Jul 28 10:57:51 2014 us=579414   persist_local_ip = DISABLED
Mon Jul 28 10:57:51 2014 us=579423   persist_remote_ip = DISABLED
Mon Jul 28 10:57:51 2014 us=579431   persist_key = ENABLED
Mon Jul 28 10:57:51 2014 us=579439   passtos = DISABLED
Mon Jul 28 10:57:51 2014 us=579448   resolve_retry_seconds = 1000000000
Mon Jul 28 10:57:51 2014 us=579465   username = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579474   groupname = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579482   chroot_dir = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579491   cd_dir = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579499   writepid = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579507   up_script = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579519   down_script = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579527   down_pre = DISABLED
Mon Jul 28 10:57:51 2014 us=579535   up_restart = DISABLED
Mon Jul 28 10:57:51 2014 us=579543   up_delay = DISABLED
Mon Jul 28 10:57:51 2014 us=579551   daemon = DISABLED
Mon Jul 28 10:57:51 2014 us=579559   inetd = 0
Mon Jul 28 10:57:51 2014 us=579567   log = DISABLED
Mon Jul 28 10:57:51 2014 us=579575   suppress_timestamps = DISABLED
Mon Jul 28 10:57:51 2014 us=579583   nice = 0
Mon Jul 28 10:57:51 2014 us=579591   verbosity = 4
Mon Jul 28 10:57:51 2014 us=579599   mute = 0
Mon Jul 28 10:57:51 2014 us=579606   gremlin = 0
Mon Jul 28 10:57:51 2014 us=579618   status_file = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579626   status_file_version = 1
Mon Jul 28 10:57:51 2014 us=579635   status_file_update_freq = 60
Mon Jul 28 10:57:51 2014 us=579643   occ = ENABLED
Mon Jul 28 10:57:51 2014 us=579651   rcvbuf = 65536
Mon Jul 28 10:57:51 2014 us=579660   sndbuf = 65536
Mon Jul 28 10:57:51 2014 us=579668   mark = 0
Mon Jul 28 10:57:51 2014 us=579676   sockflags = 0
Mon Jul 28 10:57:51 2014 us=579684   fast_io = DISABLED
Mon Jul 28 10:57:51 2014 us=579693   lzo = 7
Mon Jul 28 10:57:51 2014 us=579701   route_script = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579709   route_default_gateway = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579717   route_default_metric = 0
Mon Jul 28 10:57:51 2014 us=579726   route_noexec = DISABLED
Mon Jul 28 10:57:51 2014 us=579734   route_delay = 3
Mon Jul 28 10:57:51 2014 us=579743   route_delay_window = 30
Mon Jul 28 10:57:51 2014 us=579751   route_delay_defined = ENABLED
Mon Jul 28 10:57:51 2014 us=579764   route_nopull = DISABLED
Mon Jul 28 10:57:51 2014 us=579773   route_gateway_via_dhcp = DISABLED
Mon Jul 28 10:57:51 2014 us=579782   max_routes = 100
Mon Jul 28 10:57:51 2014 us=579791   allow_pull_fqdn = DISABLED
Mon Jul 28 10:57:51 2014 us=579799   management_addr = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579808   management_port = 0
Mon Jul 28 10:57:51 2014 us=579819   management_user_pass = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579836   management_log_history_cache = 250
Mon Jul 28 10:57:51 2014 us=579854   management_echo_buffer_size = 100
Mon Jul 28 10:57:51 2014 us=579870   management_write_peer_info_file = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579888   management_client_user = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579904   management_client_group = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579923   management_flags = 0
Mon Jul 28 10:57:51 2014 us=579946   shared_secret_file = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=579965   key_direction = 0
Mon Jul 28 10:57:51 2014 us=579984   ciphername_defined = ENABLED
Mon Jul 28 10:57:51 2014 us=580000   ciphername = 'BF-CBC'
Mon Jul 28 10:57:51 2014 us=580016   authname_defined = ENABLED
Mon Jul 28 10:57:51 2014 us=580032   authname = 'SHA1'
Mon Jul 28 10:57:51 2014 us=580047   prng_hash = 'SHA1'
Mon Jul 28 10:57:51 2014 us=580063   prng_nonce_secret_len = 16
Mon Jul 28 10:57:51 2014 us=580083   keysize = 0
Mon Jul 28 10:57:51 2014 us=580099   engine = DISABLED
Mon Jul 28 10:57:51 2014 us=580115   replay = ENABLED
Mon Jul 28 10:57:51 2014 us=580132   mute_replay_warnings = DISABLED
Mon Jul 28 10:57:51 2014 us=580148   replay_window = 64
Mon Jul 28 10:57:51 2014 us=580163   replay_time = 15
Mon Jul 28 10:57:51 2014 us=580183   packet_id_file = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=580198   use_iv = ENABLED
Mon Jul 28 10:57:51 2014 us=580213   test_crypto = DISABLED
Mon Jul 28 10:57:51 2014 us=580239   tls_server = DISABLED
Mon Jul 28 10:57:51 2014 us=580267   tls_client = ENABLED
Mon Jul 28 10:57:51 2014 us=580284   key_method = 2
Mon Jul 28 10:57:51 2014 us=580302   ca_file = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=580334   ca_path = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=580346   dh_file = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=580354   cert_file = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=580362   priv_key_file = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=580370   pkcs12_file = '/home/USER/.openvpn/NAME.p12'
Mon Jul 28 10:57:51 2014 us=580379   cipher_list = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=580387   tls_verify = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=580395   tls_export_cert = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=580403   verify_x509_type = 1
Mon Jul 28 10:57:51 2014 us=580412   verify_x509_name = 'C=XX...'
Mon Jul 28 10:57:51 2014 us=580424   crl_file = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=580460   ns_cert_type = 0
Mon Jul 28 10:57:51 2014 us=580469   remote_cert_ku[i] = 0
Mon Jul 28 10:57:51 2014 us=580478   remote_cert_ku[i] = 0
Mon Jul 28 10:57:51 2014 us=580486   remote_cert_ku[i] = 0
Mon Jul 28 10:57:51 2014 us=580494   remote_cert_ku[i] = 0
Mon Jul 28 10:57:51 2014 us=580503   remote_cert_ku[i] = 0
Mon Jul 28 10:57:51 2014 us=580511   remote_cert_ku[i] = 0
Mon Jul 28 10:57:51 2014 us=580520   remote_cert_ku[i] = 0
Mon Jul 28 10:57:51 2014 us=580528   remote_cert_ku[i] = 0
Mon Jul 28 10:57:51 2014 us=580536   remote_cert_ku[i] = 0
Mon Jul 28 10:57:51 2014 us=580545   remote_cert_ku[i] = 0
Mon Jul 28 10:57:51 2014 us=580553   remote_cert_ku[i] = 0
Mon Jul 28 10:57:51 2014 us=580562   remote_cert_ku[i] = 0
Mon Jul 28 10:57:51 2014 us=580570   remote_cert_ku[i] = 0
Mon Jul 28 10:57:51 2014 us=580578   remote_cert_ku[i] = 0
Mon Jul 28 10:57:51 2014 us=580587   remote_cert_ku[i] = 0
Mon Jul 28 10:57:51 2014 us=580595   remote_cert_ku[i] = 0
Mon Jul 28 10:57:51 2014 us=580604   remote_cert_eku = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=580612   ssl_flags = 0
Mon Jul 28 10:57:51 2014 us=580620   tls_timeout = 2
Mon Jul 28 10:57:51 2014 us=580629   renegotiate_bytes = 0
Mon Jul 28 10:57:51 2014 us=580637   renegotiate_packets = 0
Mon Jul 28 10:57:51 2014 us=580646   renegotiate_seconds = 3600
Mon Jul 28 10:57:51 2014 us=580654   handshake_window = 60
Mon Jul 28 10:57:51 2014 us=580666   transition_window = 3600
Mon Jul 28 10:57:51 2014 us=580674   single_session = DISABLED
Mon Jul 28 10:57:51 2014 us=580682   push_peer_info = DISABLED
Mon Jul 28 10:57:51 2014 us=580690   tls_exit = DISABLED
Mon Jul 28 10:57:51 2014 us=580698   tls_auth_file = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=580707   pkcs11_protected_authentication = DISABLED
Mon Jul 28 10:57:51 2014 us=580715   pkcs11_protected_authentication = DISABLED
Mon Jul 28 10:57:51 2014 us=580723   pkcs11_protected_authentication = DISABLED
Mon Jul 28 10:57:51 2014 us=580731   pkcs11_protected_authentication = DISABLED
Mon Jul 28 10:57:51 2014 us=580739   pkcs11_protected_authentication = DISABLED
Mon Jul 28 10:57:51 2014 us=580751   pkcs11_protected_authentication = DISABLED
Mon Jul 28 10:57:51 2014 us=580760   pkcs11_protected_authentication = DISABLED
Mon Jul 28 10:57:51 2014 us=580769   pkcs11_protected_authentication = DISABLED
Mon Jul 28 10:57:51 2014 us=580777   pkcs11_protected_authentication = DISABLED
Mon Jul 28 10:57:51 2014 us=580786   pkcs11_protected_authentication = DISABLED
Mon Jul 28 10:57:51 2014 us=580794   pkcs11_protected_authentication = DISABLED
Mon Jul 28 10:57:51 2014 us=580803   pkcs11_protected_authentication = DISABLED
Mon Jul 28 10:57:51 2014 us=580811   pkcs11_protected_authentication = DISABLED
Mon Jul 28 10:57:51 2014 us=580820   pkcs11_protected_authentication = DISABLED
Mon Jul 28 10:57:51 2014 us=580828   pkcs11_protected_authentication = DISABLED
Mon Jul 28 10:57:51 2014 us=580837   pkcs11_protected_authentication = DISABLED
Mon Jul 28 10:57:51 2014 us=580846   pkcs11_private_mode = 00000000
Mon Jul 28 10:57:51 2014 us=580854   pkcs11_private_mode = 00000000
Mon Jul 28 10:57:51 2014 us=580870   pkcs11_private_mode = 00000000
Mon Jul 28 10:57:51 2014 us=580887   pkcs11_private_mode = 00000000
Mon Jul 28 10:57:51 2014 us=580913   pkcs11_private_mode = 00000000
Mon Jul 28 10:57:51 2014 us=580932   pkcs11_private_mode = 00000000
Mon Jul 28 10:57:51 2014 us=580953   pkcs11_private_mode = 00000000
Mon Jul 28 10:57:51 2014 us=580973   pkcs11_private_mode = 00000000
Mon Jul 28 10:57:51 2014 us=580986   pkcs11_private_mode = 00000000
Mon Jul 28 10:57:51 2014 us=580994   pkcs11_private_mode = 00000000
Mon Jul 28 10:57:51 2014 us=581002   pkcs11_private_mode = 00000000
Mon Jul 28 10:57:51 2014 us=581011   pkcs11_private_mode = 00000000
Mon Jul 28 10:57:51 2014 us=581019   pkcs11_private_mode = 00000000
Mon Jul 28 10:57:51 2014 us=581027   pkcs11_private_mode = 00000000
Mon Jul 28 10:57:51 2014 us=581035   pkcs11_private_mode = 00000000
Mon Jul 28 10:57:51 2014 us=581043   pkcs11_private_mode = 00000000
Mon Jul 28 10:57:51 2014 us=581051   pkcs11_cert_private = DISABLED
Mon Jul 28 10:57:51 2014 us=581059   pkcs11_cert_private = DISABLED
Mon Jul 28 10:57:51 2014 us=581067   pkcs11_cert_private = DISABLED
Mon Jul 28 10:57:51 2014 us=581075   pkcs11_cert_private = DISABLED
Mon Jul 28 10:57:51 2014 us=581084   pkcs11_cert_private = DISABLED
Mon Jul 28 10:57:51 2014 us=581092   pkcs11_cert_private = DISABLED
Mon Jul 28 10:57:51 2014 us=581100   pkcs11_cert_private = DISABLED
Mon Jul 28 10:57:51 2014 us=581108   pkcs11_cert_private = DISABLED
Mon Jul 28 10:57:51 2014 us=581116   pkcs11_cert_private = DISABLED
Mon Jul 28 10:57:51 2014 us=581124   pkcs11_cert_private = DISABLED
Mon Jul 28 10:57:51 2014 us=581132   pkcs11_cert_private = DISABLED
Mon Jul 28 10:57:51 2014 us=581140   pkcs11_cert_private = DISABLED
Mon Jul 28 10:57:51 2014 us=581148   pkcs11_cert_private = DISABLED
Mon Jul 28 10:57:51 2014 us=581156   pkcs11_cert_private = DISABLED
Mon Jul 28 10:57:51 2014 us=581164   pkcs11_cert_private = DISABLED
Mon Jul 28 10:57:51 2014 us=581172   pkcs11_cert_private = DISABLED
Mon Jul 28 10:57:51 2014 us=581180   pkcs11_pin_cache_period = -1
Mon Jul 28 10:57:51 2014 us=581189   pkcs11_id = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=581200   pkcs11_id_management = DISABLED
Mon Jul 28 10:57:51 2014 us=581227   server_network = 0.0.0.0
Mon Jul 28 10:57:51 2014 us=581251   server_netmask = 0.0.0.0
Mon Jul 28 10:57:51 2014 us=581266   server_network_ipv6 = ::
Mon Jul 28 10:57:51 2014 us=581275   server_netbits_ipv6 = 0
Mon Jul 28 10:57:51 2014 us=581285   server_bridge_ip = 0.0.0.0
Mon Jul 28 10:57:51 2014 us=581294   server_bridge_netmask = 0.0.0.0
Mon Jul 28 10:57:51 2014 us=581303   server_bridge_pool_start = 0.0.0.0
Mon Jul 28 10:57:51 2014 us=581313   server_bridge_pool_end = 0.0.0.0
Mon Jul 28 10:57:51 2014 us=581321   ifconfig_pool_defined = DISABLED
Mon Jul 28 10:57:51 2014 us=581331   ifconfig_pool_start = 0.0.0.0
Mon Jul 28 10:57:51 2014 us=581340   ifconfig_pool_end = 0.0.0.0
Mon Jul 28 10:57:51 2014 us=581353   ifconfig_pool_netmask = 0.0.0.0
Mon Jul 28 10:57:51 2014 us=581362   ifconfig_pool_persist_filename = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=581370   ifconfig_pool_persist_refresh_freq = 600
Mon Jul 28 10:57:51 2014 us=581378   ifconfig_ipv6_pool_defined = DISABLED
Mon Jul 28 10:57:51 2014 us=581387   ifconfig_ipv6_pool_base = ::
Mon Jul 28 10:57:51 2014 us=581395   ifconfig_ipv6_pool_netbits = 0
Mon Jul 28 10:57:51 2014 us=581403   n_bcast_buf = 256
Mon Jul 28 10:57:51 2014 us=581411   tcp_queue_limit = 64
Mon Jul 28 10:57:51 2014 us=581419   real_hash_size = 256
Mon Jul 28 10:57:51 2014 us=581427   virtual_hash_size = 256
Mon Jul 28 10:57:51 2014 us=581435   client_connect_script = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=581444   learn_address_script = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=581457   client_disconnect_script = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=581485   client_config_dir = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=581509   ccd_exclusive = DISABLED
Mon Jul 28 10:57:51 2014 us=581527   tmp_dir = '/tmp'
Mon Jul 28 10:57:51 2014 us=581544   push_ifconfig_defined = DISABLED
Mon Jul 28 10:57:51 2014 us=581563   push_ifconfig_local = 0.0.0.0
Mon Jul 28 10:57:51 2014 us=581581   push_ifconfig_remote_netmask = 0.0.0.0
Mon Jul 28 10:57:51 2014 us=581609   push_ifconfig_ipv6_defined = DISABLED
Mon Jul 28 10:57:51 2014 us=581623   push_ifconfig_ipv6_local = ::/0
Mon Jul 28 10:57:51 2014 us=581632   push_ifconfig_ipv6_remote = ::
Mon Jul 28 10:57:51 2014 us=581641   enable_c2c = DISABLED
Mon Jul 28 10:57:51 2014 us=581649   duplicate_cn = DISABLED
Mon Jul 28 10:57:51 2014 us=581658   cf_max = 0
Mon Jul 28 10:57:51 2014 us=581667   cf_per = 0
Mon Jul 28 10:57:51 2014 us=581675   max_clients = 1024
Mon Jul 28 10:57:51 2014 us=581684   max_routes_per_client = 256
Mon Jul 28 10:57:51 2014 us=581692   auth_user_pass_verify_script = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=581701   auth_user_pass_verify_script_via_file = DISABLED
Mon Jul 28 10:57:51 2014 us=581713   port_share_host = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=581721   port_share_port = 0
Mon Jul 28 10:57:51 2014 us=581729   client = ENABLED
Mon Jul 28 10:57:51 2014 us=581737   pull = ENABLED
Mon Jul 28 10:57:51 2014 us=581745   auth_user_pass_file = '[UNDEF]'
Mon Jul 28 10:57:51 2014 us=581754 OpenVPN 2.3.3 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jun 26 2014
Mon Jul 28 10:57:54 2014 us=794622 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mon Jul 28 10:57:54 2014 us=799301 WARNING: file '/home/USER/.openvpn/NAME.p12' is group or others accessible
Mon Jul 28 10:57:54 2014 us=799423 LZO compression initialized
Mon Jul 28 10:57:54 2014 us=799521 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Jul 28 10:57:54 2014 us=799564 Socket Buffers: R=[229376->131072] S=[229376->131072]
Mon Jul 28 10:57:54 2014 us=801541 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Mon Jul 28 10:57:54 2014 us=801576 Local Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Jul 28 10:57:54 2014 us=801588 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Jul 28 10:57:54 2014 us=801614 Local Options hash (VER=V4): 'd79ca330'
Mon Jul 28 10:57:54 2014 us=801631 Expected Remote Options hash (VER=V4): 'f7df56b8'
Mon Jul 28 10:57:54 2014 us=801648 UDPv4 link local: [undef]
Mon Jul 28 10:57:54 2014 us=801661 UDPv4 link remote: [AF_INET]XX.XX.XX.249:1194
Mon Jul 28 10:57:54 2014 us=806524 TLS: Initial packet from [AF_INET]XX.XX.XX.249:1194, sid=28627896 0d28b831
Mon Jul 28 10:57:54 2014 us=826950 VERIFY OK: depth=3, C=XX
Mon Jul 28 10:57:54 2014 us=827217 VERIFY OK: depth=2, C=XX
Mon Jul 28 10:57:54 2014 us=827460 VERIFY OK: depth=1, C=XX
Mon Jul 28 10:57:54 2014 us=827671 VERIFY X509NAME OK: C=XX
Mon Jul 28 10:57:54 2014 us=827687 VERIFY OK: depth=0, C=XX
Mon Jul 28 10:57:54 2014 us=871132 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jul 28 10:57:54 2014 us=871164 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jul 28 10:57:54 2014 us=871230 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jul 28 10:57:54 2014 us=871254 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jul 28 10:57:54 2014 us=871318 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Jul 28 10:57:54 2014 us=871348 [HOSTNAME] Peer Connection Initiated with [AF_INET]XX.XX.XX.249:1194
Mon Jul 28 10:57:56 2014 us=58429 SENT CONTROL [HOSTNAME]: 'PUSH_REQUEST' (status=1)
Mon Jul 28 10:57:56 2014 us=61209 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route-ipv6 2000::/3 2001:XX:XX:1::1,dhcp-option DNS XX.XX.XX.217,dhcp-option DNS XX.XX.XX.252,route-gateway XX.XX.XX.1,ping 10,ping-restart 120,ifconfig XX.XX.XX.112 255.255.255.0'
Mon Jul 28 10:57:56 2014 us=61340 OPTIONS IMPORT: timers and/or timeouts modified
Mon Jul 28 10:57:56 2014 us=61356 OPTIONS IMPORT: --ifconfig/up options modified
Mon Jul 28 10:57:56 2014 us=61365 OPTIONS IMPORT: route options modified
Mon Jul 28 10:57:56 2014 us=61373 OPTIONS IMPORT: route-related options modified
Mon Jul 28 10:57:56 2014 us=61392 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon Jul 28 10:57:56 2014 us=61553 ROUTE_GATEWAY XX.XX.XX.1/255.255.255.0 IFACE=eth0 HWADDR=52:54:00:cf:11:37
Mon Jul 28 10:57:56 2014 us=61576 ROUTE6: default_gateway=UNDEF
Mon Jul 28 10:57:56 2014 us=62542 TUN/TAP device tap0 opened
Mon Jul 28 10:57:56 2014 us=62568 TUN/TAP TX queue length set to 100
Mon Jul 28 10:57:56 2014 us=62589 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Jul 28 10:57:56 2014 us=62612 /sbin/ip link set dev tap0 up mtu 1500
Mon Jul 28 10:57:56 2014 us=65065 /sbin/ip addr add dev tap0 XX.XX.XX.112/24 broadcast XX.XX.XX.255
Mon Jul 28 10:57:59 2014 us=83469 /sbin/ip route add XX.XX.XX.249/32 via XX.XX.XX.1
Mon Jul 28 10:57:59 2014 us=85411 /sbin/ip route add 0.0.0.0/1 via XX.XX.XX.1
Mon Jul 28 10:57:59 2014 us=86680 /sbin/ip route add 128.0.0.0/1 via XX.XX.XX.1
Mon Jul 28 10:57:59 2014 us=87652 add_route_ipv6(): not adding 2000::/3, no IPv6 on if tap0
Mon Jul 28 10:57:59 2014 us=87704 Initialization Sequence Completed

dfn

Sorry missing that! Here's the version on the server:

openvpn --version
OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec 27 2013
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
Compile time defines: enable_crypto=yes enable_debug=yes enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_eurephia=yes enable_fast_install=yes enable_fragment=yes enable_http_proxy=yes enable_iproute2=yes enable_libtool_lock=yes enable_lzo=yes enable_lzo_stub=no enable_maintainer_mode=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=yes enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_socks=yes enable_ssl=yes enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=no enable_win32_dll=yes enable_x509_alt_username=yes with_crypto_library=openssl with_gnu_ld=yes with_ifconfig_path=/sbin/ifconfig with_iproute_path=/sbin/ip with_mem_check=no with_plugindir='${prefix}/lib/openvpn' with_route_path=/sbin/route with_sysroot=no

It's this one https://packages.debian.org/wheezy-backports/openvpn

dfn

Thanks for your quick reply! And I'm aware of the recommendation to better use the routed setup.
Special circumstances require a bridged setup for the moment though and as it works really well
in the IPv4 case I'm only trying to add the last missing bit of IPv6 to have a full working dual stack
solution.

It's no problem adding the '2001::/3' route after the vpn has come up. Manually issuing the command

ip -6 route add 2001::/3 dev tap0 via 2001:XX:XX::1

sets up the route and everything works as expected. Just getting that bit
automatically pushed by the server seems to not work. Well actually the
server pushes it but the client has problems enabling that on the
interface. But IPv6 is active on the client, it even gets an automatically
assigned IPv6 address from the gateway router in the server network.

Here's the ip setup on the client before starting openvpn:

ip address show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN group default 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 52:54:00:cf:11:37 brd ff:ff:ff:ff:ff:ff
    inet XX.XX.XX.252/24 brd XX.XX.XX.255 scope global eth0
    inet6 2001:XX:XX:XX::::1002/64 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::5054:ff:fecf:1137/64 scope link 
       valid_lft forever preferred_lft forever
ip route show
default via XX.XX.XX.1 dev eth0 
XX.XX.XX.0/24 dev eth0  proto kernel  scope link  src XX.XX.XX.252
ip -6 route show
2001:XX:XX:XX::/64 dev eth0  proto kernel  metric 256 
fe80::/64 dev eth0  proto kernel  metric 256 
default via fe80::216:9cff:fe6e:1300 dev eth0  proto kernel  metric 1024  expires 1745sec
default via 2001:XX:XX:XX::1 dev eth0  metric 1024

and after:

ip address show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN group default 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 52:54:00:cf:11:37 brd ff:ff:ff:ff:ff:ff
    inet XX.XX.XX.252/24 brd Xx.XX.XX.255 scope global eth0
    inet6 2001:XX:XX:XX::1002/64 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::5054:ff:fecf:1137/64 scope link 
       valid_lft forever preferred_lft forever
32: tap0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
    link/ether e6:9e:fc:e1:3c:84 brd ff:ff:ff:ff:ff:ff
    inet XX.XX.XX.112/24 brd XX.XX.XX.255 scope global tap0
    inet6 2001:XX:XX:XX:e49e:fcff:fee1:3c84/64 scope global dynamic 
       valid_lft 2591999sec preferred_lft 604799sec
    inet6 fe80::e49e:fcff:fee1:3c84/64 scope link 
       valid_lft forever preferred_lft forever
ip route show
0.0.0.0/1 via XX.XX.XX.1 dev tap0 
default via XX.XX.XX.1 dev eth0 
128.0.0.0/1 via XX.XX.XX.1 dev tap0 
XX.XX.XX.0/24 dev tap0  proto kernel  scope link  src XX.XX.XX.112 
XX.XX.XX.249 via XX.XX.XX.1 dev eth0 
XX.XX.XX.0/24 dev eth0  proto kernel  scope link  src XX.XX.XX.252
ip -6 route show
2001:XX:XX:XX::/64 dev eth0  proto kernel  metric 256 
2001:XX:XX:XX::/64 dev tap0  proto kernel  metric 256  expires 2592289sec
fe80::/64 dev eth0  proto kernel  metric 256 
fe80::/64 dev tap0  proto kernel  metric 256 
default via fe80::216:9cff:fe6e:1300 dev eth0  proto kernel  metric 1024  expires 1632sec
default via 2001:XX:XX:XX::1 dev eth0  metric 1024 
default via fe80::218:74ff:fe14:4d00 dev tap0  proto kernel  metric 1024  expires 1765sec

The automatically assigned IPv6 address is there, the only thing missing is the '2000::/3' route.

dfn

Thanks for the information, I'll give it a try in the next days.

And thanks also for the heads-up regarding heartbleed. Should not be an issue though because the openvpn binary is linked dynamically to openssl which was fixed shortly after the hearbleed bug became public.

dfn

Server and client both with Debian 7.x