Need help debugging a p2p connection Debian <-> OpenWRT

simonszu

Hi,

i have some trouble with creating a p2p connection between a debian server and an OpenWRT router. Here are the config files:

The debian server:

dev tun
proto tcp-server
comp-lzo
port 40960
ifconfig 172.21.211.129 172.21.211.1
secret keys/dn42_home.key
log log/dn42_home.log
log-append log/dn42_home.log
verb 7

The relevant part of the openvpn config on the openwrt router:

config openvpn 'dn42_meldir'
        option enabled '1'
        option mode 'p2p'
        option dev 'tun'
        option proto 'tcp-client'
        option port '40960'
        option remote '37.221.193.14'
        option ifconfig '172.23.211.1 172.23.211.129'
        option secret '/etc/openvpn/meldir.psk'
        option verb 9
        option comp_lzo '1'
        option log '/tmp/dn42_meldir.log'

And the results in the log file:

Debian Server

Mon Aug  4 10:36:26 2014 us=106523 TUN/TAP device tun0 opened
Mon Aug  4 10:36:26 2014 us=106571 TUN/TAP TX queue length set to 100
Mon Aug  4 10:36:26 2014 us=106609 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Aug  4 10:36:26 2014 us=106654 /sbin/ifconfig tun0 172.21.211.129 pointopoint 172.21.211.1 mtu 1500
Mon Aug  4 10:36:26 2014 us=109826 Data Channel MTU parms [ L:1547 D:1450 EF:47 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Aug  4 10:36:26 2014 us=132534 Local Options String: 'V4,dev-type tun,link-mtu 1547,tun-mtu 1500,proto TCPv4_SERVER,ifconfig 172.21.211.1 172.21.211.129,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,secret'
Mon Aug  4 10:36:26 2014 us=132602 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1547,tun-mtu 1500,proto TCPv4_CLIENT,ifconfig 172.21.211.129 172.21.211.1,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,secret'
Mon Aug  4 10:36:26 2014 us=132645 Local Options hash (VER=V4): '3ccfa33b'
Mon Aug  4 10:36:26 2014 us=132662 Expected Remote Options hash (VER=V4): '8ca2e772'
Mon Aug  4 10:36:26 2014 us=132724 Listening for incoming TCP connection on [undef]

OpenWRT Router

Mon Aug  4 10:25:56 2014 us=171830 OpenVPN 2.2.2 mips-openwrt-linux [SSL] [LZO2] [EPOLL] built on Mar 14 2013
Mon Aug  4 10:25:56 2014 us=172649 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Aug  4 10:25:56 2014 us=188448 WARNING: file '/etc/openvpn/meldir.psk' is group or others accessible
Mon Aug  4 10:25:56 2014 us=189174 Static Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Aug  4 10:25:56 2014 us=189424 Static Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Aug  4 10:25:56 2014 us=190890 Static Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Aug  4 10:25:56 2014 us=191112 Static Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Aug  4 10:25:56 2014 us=191316 LZO compression initialized
Mon Aug  4 10:25:56 2014 us=191640 Socket Buffers: R=[87380->131072] S=[16384->131072]
Mon Aug  4 10:25:56 2014 us=203605 TUN/TAP device tun2 opened
Mon Aug  4 10:25:56 2014 us=203844 TUN/TAP TX queue length set to 100
Mon Aug  4 10:25:56 2014 us=204188 /sbin/ifconfig tun2 172.23.211.1 pointopoint 172.23.211.129 mtu 1500
Mon Aug  4 10:25:56 2014 us=214888 Data Channel MTU parms [ L:1547 D:1450 EF:47 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Aug  4 10:25:56 2014 us=215243 Attempting to establish TCP connection with 37.221.193.14:40960 [nonblock]
Mon Aug  4 10:25:57 2014 us=215890 TCP connection established with 37.221.193.14:40960
Mon Aug  4 10:25:57 2014 us=216103 TCPv4_CLIENT link local: [undef]
Mon Aug  4 10:25:57 2014 us=216243 TCPv4_CLIENT link remote: 37.221.193.14:40960
Mon Aug  4 10:25:58 2014 us=415879  event_wait returned 0
Mon Aug  4 10:25:59 2014 us=613695  event_wait returned 0
Mon Aug  4 10:26:00 2014 us=812185  event_wait returned 0
Mon Aug  4 10:26:02 2014 us=10647  event_wait returned 0
Mon Aug  4 10:26:03 2014 us=209128  event_wait returned 0

Both sides have the tun device created and assigned the IPs and created a direct route via the tun devices, but i can't ping across the tunnel. I have two other p2p connections spreading from the router with exact the same config, which was copypasted with the proper values, and they are working fine (well, they are UDP, i switched to TCP on this particular connection for debugging purposes).

So i hope someone around here is able to help me. 😉

maikcat

use this:

ifconfig 172.21.211.2 172.21.211.1

and reverse it to other end.

Michael.

simonszu

Well, i wanted to span a /24 subnet, splitted into two /25 subnets across the tunnel, so that the router has the first /24 from 172.21.211.1 to .128, and the server the second subnet from .129 to .255.

However, i assigned the .1 to the router and the .2 to the server, as you suggested. The result is the same.

Server

Mon Aug  4 11:48:13 2014 us=82074 TUN/TAP device tun0 opened
Mon Aug  4 11:48:13 2014 us=82106 TUN/TAP TX queue length set to 100
Mon Aug  4 11:48:13 2014 us=82128 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Aug  4 11:48:13 2014 us=82153 /sbin/ifconfig tun0 172.21.211.2 pointopoint 172.21.211.1 mtu 1500
Mon Aug  4 11:48:13 2014 us=85873 Data Channel MTU parms [ L:1547 D:1450 EF:47 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Aug  4 11:48:13 2014 us=85932 Local Options String: 'V4,dev-type tun,link-mtu 1547,tun-mtu 1500,proto TCPv4_SERVER,ifconfig 172.21.211.1 172.21.211.2,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,secret'
Mon Aug  4 11:48:13 2014 us=85946 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1547,tun-mtu 1500,proto TCPv4_CLIENT,ifconfig 172.21.211.2 172.21.211.1,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,secret'
Mon Aug  4 11:48:13 2014 us=85971 Local Options hash (VER=V4): 'f04e2d6a'
Mon Aug  4 11:48:13 2014 us=85986 Expected Remote Options hash (VER=V4): '6b2daadb'
Mon Aug  4 11:48:13 2014 us=86043 Listening for incoming TCP connection on [undef]

Router

Mon Aug  4 11:48:01 2014 us=173841 OpenVPN 2.2.2 mips-openwrt-linux [SSL] [LZO2] [EPOLL] built on Mar 14 2013
Mon Aug  4 11:48:01 2014 us=174434 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Aug  4 11:48:01 2014 us=175645 WARNING: file '/etc/openvpn/meldir.psk' is group or others accessible
Mon Aug  4 11:48:01 2014 us=176685 Static Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Aug  4 11:48:01 2014 us=176949 Static Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Aug  4 11:48:01 2014 us=177999 Static Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Aug  4 11:48:01 2014 us=178176 Static Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Aug  4 11:48:01 2014 us=178466 LZO compression initialized
Mon Aug  4 11:48:01 2014 us=178806 Socket Buffers: R=[87380->131072] S=[16384->131072]
Mon Aug  4 11:48:01 2014 us=185283 TUN/TAP device tun2 opened
Mon Aug  4 11:48:01 2014 us=185562 TUN/TAP TX queue length set to 100
Mon Aug  4 11:48:01 2014 us=186328 /sbin/ifconfig tun2 172.23.211.1 pointopoint 172.23.211.2 mtu 1500
Mon Aug  4 11:48:01 2014 us=194470 Data Channel MTU parms [ L:1547 D:1450 EF:47 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Aug  4 11:48:01 2014 us=194828 Attempting to establish TCP connection with 37.221.193.14:40960 [nonblock]
Mon Aug  4 11:48:02 2014 us=195765 TCP connection established with 37.221.193.14:40960
Mon Aug  4 11:48:02 2014 us=195970 TCPv4_CLIENT link local: [undef]
Mon Aug  4 11:48:02 2014 us=196107 TCPv4_CLIENT link remote: 37.221.193.14:40960
Mon Aug  4 11:48:03 2014 us=408843  event_wait returned 0
Mon Aug  4 11:48:04 2014 us=620325  event_wait returned 0
Mon Aug  4 11:48:05 2014 us=831817  event_wait returned 0
Mon Aug  4 11:48:07 2014 us=43283  event_wait returned 0
Mon Aug  4 11:48:08 2014 us=264420  event_wait returned 0
Mon Aug  4 11:48:09 2014 us=475917  event_wait returned 0

maikcat

it seems that your server doesnt recieve any packets at all...

can you disable any firewall rules on your server side?

Michael.

simonszu

There is no firewall running, except some iptables rules which i have disabled. The router log says:

Mon Aug  4 11:48:01 2014 us=194828 Attempting to establish TCP connection with 37.221.193.14:40960 [nonblock]
Mon Aug  4 11:48:02 2014 us=195765 TCP connection established with 37.221.193.14:40960

and i can telnet to the server. However, a telnet client on my desktop pc shows a normal prompt, but the OpenWRT telnet client has the following result:

root@OpenWrt:/tmp# telnet 37.221.193.14 40960
<�ڵ�^DX�XM����x9
                �\��a4����Jýý-ýG│ýVPûZAýý┌ý*ý%ý/^

It's quite strange...

maikcat

with the iptables rules disabled,can you post the complete server/client log?

Michael.

simonszu

Yes, of course.

This is the complete server log with verbosity 9.

http://sprunge.us/RLRf

There are some interesting lines:

Mon Aug  4 13:10:45 2014 us=250559 STREAM: WRITE 60 offset=156
Mon Aug  4 13:10:45 2014 us=250671 TCPv4_SERVER write returned 62
Mon Aug  4 13:10:45 2014 us=250691 STREAM: SET NEXT, buf=[184,0] next=[184,1547] len=-1 maxlen=1547
Mon Aug  4 13:10:45 2014 us=250703 PO_CTL rwflags=0x0001 ev=6 arg=0x7f69075b8130
Mon Aug  4 13:10:45 2014 us=250714 PO_CTL rwflags=0x0001 ev=5 arg=0x7f69075b8064
Mon Aug  4 13:10:45 2014 us=250726 I/O WAIT TR|Tw|SR|Sw [1/180316]
Mon Aug  4 13:10:45 2014 us=269536 PO_WAIT[0,0] fd=6 rev=0x00000019 rwflags=0x0001 arg=0x7f69075b8130 
Mon Aug  4 13:10:45 2014 us=269639  event_wait returned 1
Mon Aug  4 13:10:45 2014 us=269663 I/O WAIT status=0x0001
Mon Aug  4 13:10:45 2014 us=269686 STREAM: GET NEXT len=1547
Mon Aug  4 13:10:45 2014 us=269710 Connection reset, restarting [-1]
Mon Aug  4 13:10:45 2014 us=269814 TCP/UDP: Closing socket
Mon Aug  4 13:10:45 2014 us=269886 Closing TUN/TAP interface

And this is the complete router log with verbosity 9 (however, i think that the verbosity levels on the openWRT client do not match the 'real' verbosity levels)

http://sprunge.us/HULZ