Yet another newbie in need of help setting up openVPN

MarcC

I actually posted my questions a while ago, but did not get a resolution, and got sidetracked on other things.

I am trying to set up a vpn server on my network at home so I can reach it from work. So far no joy getting it working. It seems to connect OK, from work, but I cannot do anything with it once connected. Not even ping any machine on my LAN at home. So with that said here is my config files along with log files with hopefully all sensitive data removed... Hope this is not overwhelming and much appreciate any help getting this up an running.... (and yes I did notice some anomalies in the log files, particularly the error messages in both log files, but googling is not giving me any info about what they mean or what to do about em....)

Running both my laptop and server under openSuSE x64 and here is my network topologies - Thanks in advance, Marc....

Office, where my client laptop is -
Note: At work my laptop is on the 192.168.100.0/24 net. I want to be able to reach my home LAN on the 192.168.10.0/24 net. Ultimately I will want to use my home DNS server to resolve host names on my home LAN, over a VPN link, and use tools such as autofs to mount filesystems. But for now I am simply trying to get openVNC to pass a "smoke test" and do some simple tasks...

route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.100.10  0.0.0.0         UG    0      0        0 wlan0
10.8.10.1       10.8.10.5       255.255.255.255 UGH   0      0        0 tun0
10.8.10.5       0.0.0.0         255.255.255.255 UH    0      0        0 tun0
192.168.10.0    10.8.10.5       255.255.255.0   UG    0      0        0 tun0
192.168.100.0   0.0.0.0         255.255.255.0   U     0      0        0 wlan0

ifconfig
eth0      Link encap:Ethernet  HWaddr 10:BF:48:26:6A:51  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:235202 errors:0 dropped:0 overruns:0 frame:0
          TX packets:235202 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:251423025 (239.7 Mb)  TX bytes:251423025 (239.7 Mb)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.10.6  P-t-P:10.8.10.5  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 b)  TX bytes:1092 (1.0 Kb)

wlan0     Link encap:Ethernet  HWaddr 00:08:CA:F7:89:5C  
          inet addr:192.168.100.100  Bcast:192.168.100.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1524766 errors:0 dropped:0 overruns:0 frame:0
          TX packets:219251 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:279517358 (266.5 Mb)  TX bytes:49877515 (47.5 Mb)

Home, where my server is -
Note: The external interface eth0 is also on a private network address space 10.10.10.0/24. This is because my home is reached via a Motorola Canopy wireless link which connects my home over a wireless link to a router, across some distance towers. This router in turn is my real gateway to the internet (10.10.10.1) and has my actual internet static IP address. This router simply forwards all packets on to my actual server where I run the openVPN server as well as a number of others.

route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.10.10.1      0.0.0.0         UG    0      0        0 eth0
10.8.10.0       192.168.10.100  255.255.255.0   UG    0      0        0 eth1
10.8.10.2       0.0.0.0         255.255.255.255 UH    0      0        0 tun0
10.10.10.0      0.0.0.0         255.255.255.0   U     0      0        0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0 eth0
192.168.10.0    0.0.0.0         255.255.255.0   U     0      0        0 eth1
192.168.20.0    10.10.10.200    255.255.255.0   UG    0      0        0 eth0

ifconfig
eth0      Link encap:Ethernet  HWaddr 00:13:20:7A:8A:FB  
          inet addr:10.10.10.100  Bcast:10.10.10.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:302731 errors:0 dropped:3 overruns:0 frame:0
          TX packets:262778 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:199806137 (190.5 Mb)  TX bytes:74065479 (70.6 Mb)
          Interrupt:17 Memory:93100000-93120000 

eth1      Link encap:Ethernet  HWaddr 00:E0:29:70:57:84  
          inet addr:192.168.10.100  Bcast:192.168.10.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3341262 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6105546 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:4645336925 (4430.1 Mb)  TX bytes:534420543 (509.6 Mb)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:2074025 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2074025 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:3520450655 (3357.3 Mb)  TX bytes:3520450655 (3357.3 Mb)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.10.1  P-t-P:10.8.10.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:13 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:1092 (1.0 Kb)  TX bytes:0 (0.0 b)

server.conf

port 1194
proto udp
dev tun0
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key  # This file should be kept secret
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
server 10.8.10.0 255.255.255.0
ifconfig-pool-persist /etc/openvpn/ipp.txt
push "route 192.168.10.0 255.255.255.0"
push "explicit-exit-notify 3"
keepalive 10 120
comp-lzo yes
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log         /var/log/openvpn.log
verb 4
mute 20
management localhost 7505

client.conf

client
dev tun
proto udp
remote XXX.XXX.XXX.XXX 1194
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
ca "/home/marc/openVPN/ca.crt"
cert "/home/marc/openVPN/marcslaptopsuse.crt"
key "/home/marc/openVPN/marcslaptopsuse.key"
comp-lzo yes
verb 4
log-append /var/log/openvpn.log

server log

cat openvpn.log.captured
Mon Aug 18 15:30:20 2014 us=728129 Current Parameter Settings:
Mon Aug 18 15:30:20 2014 us=728342   config = '/etc/openvpn/server.conf'
Mon Aug 18 15:30:20 2014 us=728370   mode = 1
Mon Aug 18 15:30:20 2014 us=728456   persist_config = DISABLED
Mon Aug 18 15:30:20 2014 us=728477   persist_mode = 1
Mon Aug 18 15:30:20 2014 us=728496   show_ciphers = DISABLED
Mon Aug 18 15:30:20 2014 us=728515   show_digests = DISABLED
Mon Aug 18 15:30:20 2014 us=728534   show_engines = DISABLED
Mon Aug 18 15:30:20 2014 us=728553   genkey = DISABLED
Mon Aug 18 15:30:20 2014 us=728573   key_pass_file = '[UNDEF]'
Mon Aug 18 15:30:20 2014 us=728593   show_tls_ciphers = DISABLED
Mon Aug 18 15:30:20 2014 us=728613 Connection profiles [default]:
Mon Aug 18 15:30:20 2014 us=728633   proto = udp
Mon Aug 18 15:30:20 2014 us=728652   local = '[UNDEF]'
Mon Aug 18 15:30:20 2014 us=728672   local_port = 1194
Mon Aug 18 15:30:20 2014 us=728690   remote = '[UNDEF]'
Mon Aug 18 15:30:20 2014 us=728741   remote_port = 1194
Mon Aug 18 15:30:20 2014 us=728762   remote_float = DISABLED
Mon Aug 18 15:30:20 2014 us=728781   bind_defined = DISABLED
Mon Aug 18 15:30:20 2014 us=728801   bind_local = ENABLED
Mon Aug 18 15:30:20 2014 us=728819 NOTE: --mute triggered...
Mon Aug 18 15:30:20 2014 us=728856 250 variation(s) on previous 20 message(s) suppressed by --mute
Mon Aug 18 15:30:20 2014 us=728880 OpenVPN 2.2.2 x86_64-suse-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Dec 14 2011
Mon Aug 18 15:30:20 2014 us=729478 MANAGEMENT: TCP Socket listening on 127.0.0.1:7505
Mon Aug 18 15:30:20 2014 us=729793 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Aug 18 15:30:20 2014 us=749503 Diffie-Hellman initialized with 1024 bit key
Mon Aug 18 15:30:20 2014 us=768340 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Aug 18 15:30:20 2014 us=768417 Socket Buffers: R=[212992->131072] S=[212992->131072]
Mon Aug 18 15:30:20 2014 us=768678 ROUTE default_gateway=10.10.10.1
Mon Aug 18 15:30:20 2014 us=769237 TUN/TAP device tun0 opened
Mon Aug 18 15:30:20 2014 us=769309 TUN/TAP TX queue length set to 100
Mon Aug 18 15:30:20 2014 us=769380 /bin/ip link set dev tun0 up mtu 1500
Mon Aug 18 15:30:20 2014 us=791299 /bin/ip addr add dev tun0 local 10.8.10.1 peer 10.8.10.2
Mon Aug 18 15:30:20 2014 us=794209 /bin/ip route add 10.8.10.0/24 via 10.8.10.2
RTNETLINK answers: File exists
Mon Aug 18 15:30:20 2014 us=796312 ERROR: Linux route add command failed: external program exited with error status: 2
Mon Aug 18 15:30:20 2014 us=796383 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Aug 18 15:30:20 2014 us=797956 GID set to nobody
Mon Aug 18 15:30:20 2014 us=798057 UID set to nobody
Mon Aug 18 15:30:20 2014 us=798117 UDPv4 link local (bound): [undef]:1194
Mon Aug 18 15:30:20 2014 us=798141 UDPv4 link remote: [undef]
Mon Aug 18 15:30:20 2014 us=798175 MULTI: multi_init called, r=256 v=256
Mon Aug 18 15:30:20 2014 us=798357 IFCONFIG POOL: base=10.8.10.4 size=62
Mon Aug 18 15:30:20 2014 us=798443 IFCONFIG POOL LIST
Mon Aug 18 15:30:20 2014 us=798471 marcslaptopsuse,10.8.10.4
Mon Aug 18 15:30:20 2014 us=798539 Initialization Sequence Completed
Mon Aug 18 15:30:29 2014 us=809663 event_wait : Interrupted system call (code=4)
Mon Aug 18 15:30:29 2014 us=809741 OpenVPN CLIENT LIST
Mon Aug 18 15:30:29 2014 us=809775 Updated,Mon Aug 18 15:30:29 2014
Mon Aug 18 15:30:29 2014 us=809796 Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
Mon Aug 18 15:30:29 2014 us=809821 ROUTING TABLE
Mon Aug 18 15:30:29 2014 us=809842 Virtual Address,Common Name,Real Address,Last Ref
Mon Aug 18 15:30:29 2014 us=809864 GLOBAL STATS
Mon Aug 18 15:30:29 2014 us=809885 Max bcast/mcast queue length,0
Mon Aug 18 15:30:29 2014 us=809908 END
Mon Aug 18 15:31:00 2014 us=792667 MULTI: multi_create_instance called
Mon Aug 18 15:31:00 2014 us=792809 xxx.xx.xxx.xxx:53457 Re-using SSL/TLS context
Mon Aug 18 15:31:00 2014 us=792901 xxx.xx.xxx.xxx:53457 LZO compression initialized
Mon Aug 18 15:31:00 2014 us=793210 xxx.xx.xxx.xxx:53457 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Aug 18 15:31:00 2014 us=793281 xxx.xx.xxx.xxx:53457 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Aug 18 15:31:00 2014 us=793375 xxx.xx.xxx.xxx:53457 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Aug 18 15:31:00 2014 us=793404 xxx.xx.xxx.xxx:53457 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Aug 18 15:31:00 2014 us=793453 xxx.xx.xxx.xxx:53457 Local Options hash (VER=V4): '530fdded'
Mon Aug 18 15:31:00 2014 us=793488 xxx.xx.xxx.xxx:53457 Expected Remote Options hash (VER=V4): '41690919'
Mon Aug 18 15:31:00 2014 us=793564 xxx.xx.xxx.xxx:53457 TLS: Initial packet from xxx.xx.xxx.xxx:53457, sid=f9608cd0 8596ceab
Mon Aug 18 15:31:24 2014 us=965933 xxx.xx.xxx.xxx:53457 VERIFY OK: depth=1, /C=US/ST=MYSTATE/L=MyCity/O=Mylastname/CN=Mylastname_CA/name=Marc/emailAddress=marc@mydomain.com
Mon Aug 18 15:31:24 2014 us=966222 xxx.xx.xxx.xxx:53457 VERIFY OK: depth=0, /C=US/ST=MYSTATE/L=MyCity/O=Mylastname/CN=marcslaptopsuse/name=Marc/emailAddress=marc@mydomain.com
Mon Aug 18 15:31:25 2014 us=808120 xxx.xx.xxx.xxx:53457 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Aug 18 15:31:25 2014 us=808200 xxx.xx.xxx.xxx:53457 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Aug 18 15:31:25 2014 us=808308 xxx.xx.xxx.xxx:53457 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Aug 18 15:31:25 2014 us=808344 xxx.xx.xxx.xxx:53457 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Aug 18 15:31:26 2014 us=22830 xxx.xx.xxx.xxx:53457 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon Aug 18 15:31:26 2014 us=22925 xxx.xx.xxx.xxx:53457 [marcslaptopsuse] Peer Connection Initiated with xxx.xx.xxx.xxx:53457
Mon Aug 18 15:31:26 2014 us=23029 marcslaptopsuse/xxx.xx.xxx.xxx:53457 MULTI: Learn: 10.8.10.6 -> marcslaptopsuse/xxx.xx.xxx.xxx:53457
Mon Aug 18 15:31:26 2014 us=23065 marcslaptopsuse/xxx.xx.xxx.xxx:53457 MULTI: primary virtual IP for marcslaptopsuse/xxx.xx.xxx.xxx:53457: 10.8.10.6
Mon Aug 18 15:31:28 2014 us=457290 marcslaptopsuse/xxx.xx.xxx.xxx:53457 PUSH: Received control message: 'PUSH_REQUEST'
Mon Aug 18 15:31:28 2014 us=457410 marcslaptopsuse/xxx.xx.xxx.xxx:53457 SENT CONTROL [marcslaptopsuse]: 'PUSH_REPLY,route 192.168.10.0 255.255.255.0,explicit-exit-notify 3,route 10.8.10.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.10.6 10.8.10.5' (status=1)

client logfile

cat openvpn.log.captured

Mon Aug 18 14:56:41 2014 us=291175 TLS: soft reset sec=0 bytes=38847/0 pkts=715/0
Mon Aug 18 14:56:48 2014 us=122280 VERIFY OK: depth=1, /C=US/ST=MYSTATE/L=Mycity/O=Mylastname/CN=Mylastname_CA/name=Marc/emailAddress=marc@myemailaddress.com
Mon Aug 18 14:56:48 2014 us=122448 VERIFY OK: depth=0, /C=US/ST=MYSTATE/L=Mycity/O=Mylastname/CN=server/name=bigbang/emailAddress=marc@myemailaddress.com
Mon Aug 18 14:57:00 2014 us=925177 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Aug 18 14:57:00 2014 us=925235 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Aug 18 14:57:00 2014 us=925287 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Aug 18 14:57:00 2014 us=925305 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Aug 18 14:57:00 2014 us=925373 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon Aug 18 15:30:15 2014 us=222271 event_wait : Interrupted system call (code=4)
Mon Aug 18 15:30:15 2014 us=222713 TCP/UDP: Closing socket
Mon Aug 18 15:30:15 2014 us=222796 /bin/ip route del 10.8.10.1/32
RTNETLINK answers: Operation not permitted
Mon Aug 18 15:30:15 2014 us=224548 ERROR: Linux route delete command failed: external program exited with error status: 2
Mon Aug 18 15:30:15 2014 us=224636 /bin/ip route del 192.168.10.0/24
RTNETLINK answers: Operation not permitted
Mon Aug 18 15:30:15 2014 us=226160 ERROR: Linux route delete command failed: external program exited with error status: 2
Mon Aug 18 15:30:15 2014 us=226230 Closing TUN/TAP interface
Mon Aug 18 15:30:15 2014 us=226274 /bin/ip addr del dev tun0 local 10.8.10.6 peer 10.8.10.5
RTNETLINK answers: Operation not permitted
Mon Aug 18 15:30:15 2014 us=228391 Linux ip addr del failed: external program exited with error status: 2
Mon Aug 18 15:30:15 2014 us=233709 SIGINT[hard,] received, process exiting
Mon Aug 18 15:31:00 2014 us=725774 Current Parameter Settings:
Mon Aug 18 15:31:00 2014 us=725837   config = './client.conf'
Mon Aug 18 15:31:00 2014 us=725847   mode = 0
Mon Aug 18 15:31:00 2014 us=725854   persist_config = DISABLED
Mon Aug 18 15:31:00 2014 us=725860   persist_mode = 1
Mon Aug 18 15:31:00 2014 us=725867   show_ciphers = DISABLED
Mon Aug 18 15:31:00 2014 us=725874   show_digests = DISABLED
Mon Aug 18 15:31:00 2014 us=725880   show_engines = DISABLED
Mon Aug 18 15:31:00 2014 us=725894   genkey = DISABLED
Mon Aug 18 15:31:00 2014 us=725910   key_pass_file = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=725916   show_tls_ciphers = DISABLED
Mon Aug 18 15:31:00 2014 us=725922 Connection profiles [default]:
Mon Aug 18 15:31:00 2014 us=725929   proto = udp
Mon Aug 18 15:31:00 2014 us=725934   local = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=725940   local_port = 0
Mon Aug 18 15:31:00 2014 us=725946   remote = 'XX.XX.XX.XX1'
Mon Aug 18 15:31:00 2014 us=725953   remote_port = 1194
Mon Aug 18 15:31:00 2014 us=725959   remote_float = DISABLED
Mon Aug 18 15:31:00 2014 us=725966   bind_defined = DISABLED
Mon Aug 18 15:31:00 2014 us=725972   bind_local = DISABLED
Mon Aug 18 15:31:00 2014 us=725978   connect_retry_seconds = 5
Mon Aug 18 15:31:00 2014 us=725984   connect_timeout = 10
Mon Aug 18 15:31:00 2014 us=725990   connect_retry_max = 0
Mon Aug 18 15:31:00 2014 us=725995   socks_proxy_server = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726001   socks_proxy_port = 0
Mon Aug 18 15:31:00 2014 us=726007   socks_proxy_retry = DISABLED
Mon Aug 18 15:31:00 2014 us=726014 Connection profiles END
Mon Aug 18 15:31:00 2014 us=726020   remote_random = DISABLED
Mon Aug 18 15:31:00 2014 us=726026   ipchange = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726033   dev = 'tun'
Mon Aug 18 15:31:00 2014 us=726040   dev_type = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726046   dev_node = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726051   lladdr = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726057   topology = 1
Mon Aug 18 15:31:00 2014 us=726063   tun_ipv6 = DISABLED
Mon Aug 18 15:31:00 2014 us=726068   ifconfig_local = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726075   ifconfig_remote_netmask = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726080   ifconfig_noexec = DISABLED
Mon Aug 18 15:31:00 2014 us=726086   ifconfig_nowarn = DISABLED
Mon Aug 18 15:31:00 2014 us=726093   shaper = 0
Mon Aug 18 15:31:00 2014 us=726101   tun_mtu = 1500
Mon Aug 18 15:31:00 2014 us=726107   tun_mtu_defined = ENABLED
Mon Aug 18 15:31:00 2014 us=726113   link_mtu = 1500
Mon Aug 18 15:31:00 2014 us=726120   link_mtu_defined = DISABLED
Mon Aug 18 15:31:00 2014 us=726127   tun_mtu_extra = 0
Mon Aug 18 15:31:00 2014 us=726133   tun_mtu_extra_defined = DISABLED
Mon Aug 18 15:31:00 2014 us=726138   fragment = 0
Mon Aug 18 15:31:00 2014 us=726144   mtu_discover_type = -1
Mon Aug 18 15:31:00 2014 us=726150   mtu_test = 0
Mon Aug 18 15:31:00 2014 us=726155   mlock = DISABLED
Mon Aug 18 15:31:00 2014 us=726161   keepalive_ping = 0
Mon Aug 18 15:31:00 2014 us=726167   keepalive_timeout = 0
Mon Aug 18 15:31:00 2014 us=726174   inactivity_timeout = 0
Mon Aug 18 15:31:00 2014 us=726180   ping_send_timeout = 0
Mon Aug 18 15:31:00 2014 us=726186   ping_rec_timeout = 0
Mon Aug 18 15:31:00 2014 us=726193   ping_rec_timeout_action = 0
Mon Aug 18 15:31:00 2014 us=726200   ping_timer_remote = DISABLED
Mon Aug 18 15:31:00 2014 us=726209   remap_sigusr1 = 0
Mon Aug 18 15:31:00 2014 us=726216   explicit_exit_notification = 0
Mon Aug 18 15:31:00 2014 us=726222   persist_tun = ENABLED
Mon Aug 18 15:31:00 2014 us=726229   persist_local_ip = DISABLED
Mon Aug 18 15:31:00 2014 us=726235   persist_remote_ip = DISABLED
Mon Aug 18 15:31:00 2014 us=726242   persist_key = ENABLED
Mon Aug 18 15:31:00 2014 us=726248   mssfix = 1450
Mon Aug 18 15:31:00 2014 us=726255   passtos = DISABLED
Mon Aug 18 15:31:00 2014 us=726261   resolve_retry_seconds = 1000000000
Mon Aug 18 15:31:00 2014 us=726268   username = 'nobody'
Mon Aug 18 15:31:00 2014 us=726274   groupname = 'nobody'
Mon Aug 18 15:31:00 2014 us=726281   chroot_dir = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726287   cd_dir = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726294   selinux_context = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726300   writepid = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726307   up_script = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726313   down_script = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726320   down_pre = DISABLED
Mon Aug 18 15:31:00 2014 us=726326   up_restart = DISABLED
Mon Aug 18 15:31:00 2014 us=726332   up_delay = DISABLED
Mon Aug 18 15:31:00 2014 us=726341   daemon = DISABLED
Mon Aug 18 15:31:00 2014 us=726348   inetd = 0
Mon Aug 18 15:31:00 2014 us=726355   log = ENABLED
Mon Aug 18 15:31:00 2014 us=726361   suppress_timestamps = DISABLED
Mon Aug 18 15:31:00 2014 us=726368   nice = 0
Mon Aug 18 15:31:00 2014 us=726374   verbosity = 4
Mon Aug 18 15:31:00 2014 us=726381   mute = 0
Mon Aug 18 15:31:00 2014 us=726387   gremlin = 0
Mon Aug 18 15:31:00 2014 us=726395   status_file = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726402   status_file_version = 1
Mon Aug 18 15:31:00 2014 us=726411   status_file_update_freq = 60
Mon Aug 18 15:31:00 2014 us=726421   occ = ENABLED
Mon Aug 18 15:31:00 2014 us=726428   rcvbuf = 65536
Mon Aug 18 15:31:00 2014 us=726434   sndbuf = 65536
Mon Aug 18 15:31:00 2014 us=726441   sockflags = 0
Mon Aug 18 15:31:00 2014 us=726447   fast_io = DISABLED
Mon Aug 18 15:31:00 2014 us=726454   lzo = 3
Mon Aug 18 15:31:00 2014 us=726460   route_script = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726467   route_default_gateway = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726473   route_default_metric = 0
Mon Aug 18 15:31:00 2014 us=726480   route_noexec = DISABLED
Mon Aug 18 15:31:00 2014 us=726486   route_delay = 0
Mon Aug 18 15:31:00 2014 us=726497   route_delay_window = 30
Mon Aug 18 15:31:00 2014 us=726506   route_delay_defined = DISABLED
Mon Aug 18 15:31:00 2014 us=726512   route_nopull = DISABLED
Mon Aug 18 15:31:00 2014 us=726519   route_gateway_via_dhcp = DISABLED
Mon Aug 18 15:31:00 2014 us=726525   max_routes = 100
Mon Aug 18 15:31:00 2014 us=726531   allow_pull_fqdn = DISABLED
Mon Aug 18 15:31:00 2014 us=726538   management_addr = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726545   management_port = 0
Mon Aug 18 15:31:00 2014 us=726551   management_user_pass = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726558   management_log_history_cache = 250
Mon Aug 18 15:31:00 2014 us=726565   management_echo_buffer_size = 100
Mon Aug 18 15:31:00 2014 us=726571   management_write_peer_info_file = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726578   management_client_user = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726585   management_client_group = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726591   management_flags = 0
Mon Aug 18 15:31:00 2014 us=726598   shared_secret_file = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726604   key_direction = 0
Mon Aug 18 15:31:00 2014 us=726611   ciphername_defined = ENABLED
Mon Aug 18 15:31:00 2014 us=726618   ciphername = 'BF-CBC'
Mon Aug 18 15:31:00 2014 us=726625   authname_defined = ENABLED
Mon Aug 18 15:31:00 2014 us=726632   authname = 'SHA1'
Mon Aug 18 15:31:00 2014 us=726638   prng_hash = 'SHA1'
Mon Aug 18 15:31:00 2014 us=726645   prng_nonce_secret_len = 16
Mon Aug 18 15:31:00 2014 us=726651   keysize = 0
Mon Aug 18 15:31:00 2014 us=726658   engine = DISABLED
Mon Aug 18 15:31:00 2014 us=726665   replay = ENABLED
Mon Aug 18 15:31:00 2014 us=726671   mute_replay_warnings = DISABLED
Mon Aug 18 15:31:00 2014 us=726678   replay_window = 64
Mon Aug 18 15:31:00 2014 us=726684   replay_time = 15
Mon Aug 18 15:31:00 2014 us=726691   packet_id_file = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726697   use_iv = ENABLED
Mon Aug 18 15:31:00 2014 us=726704   test_crypto = DISABLED
Mon Aug 18 15:31:00 2014 us=726711   tls_server = DISABLED
Mon Aug 18 15:31:00 2014 us=726717   tls_client = ENABLED
Mon Aug 18 15:31:00 2014 us=726724   key_method = 2
Mon Aug 18 15:31:00 2014 us=726731   ca_file = '/home/marc/openVPN/ca.crt'
Mon Aug 18 15:31:00 2014 us=726738   ca_path = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726745   dh_file = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726752   cert_file = '/home/marc/openVPN/marcslaptopsuse.crt'
Mon Aug 18 15:31:00 2014 us=726758   priv_key_file = '/home/marc/openVPN/marcslaptopsuse.key'
Mon Aug 18 15:31:00 2014 us=726765   pkcs12_file = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726772   cipher_list = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726778   tls_verify = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726785   tls_export_cert = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726791   tls_remote = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726799   crl_file = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726805   ns_cert_type = 0
Mon Aug 18 15:31:00 2014 us=726811   remote_cert_ku[i] = 0
Mon Aug 18 15:31:00 2014 us=726817   remote_cert_ku[i] = 0
Mon Aug 18 15:31:00 2014 us=726822   remote_cert_ku[i] = 0
Mon Aug 18 15:31:00 2014 us=726829   remote_cert_ku[i] = 0
Mon Aug 18 15:31:00 2014 us=726835   remote_cert_ku[i] = 0
Mon Aug 18 15:31:00 2014 us=726841   remote_cert_ku[i] = 0
Mon Aug 18 15:31:00 2014 us=726847   remote_cert_ku[i] = 0
Mon Aug 18 15:31:00 2014 us=726853   remote_cert_ku[i] = 0
Mon Aug 18 15:31:00 2014 us=726859   remote_cert_ku[i] = 0
Mon Aug 18 15:31:00 2014 us=726864   remote_cert_ku[i] = 0
Mon Aug 18 15:31:00 2014 us=726870   remote_cert_ku[i] = 0
Mon Aug 18 15:31:00 2014 us=726875   remote_cert_ku[i] = 0
Mon Aug 18 15:31:00 2014 us=726881   remote_cert_ku[i] = 0
Mon Aug 18 15:31:00 2014 us=726887   remote_cert_ku[i] = 0
Mon Aug 18 15:31:00 2014 us=726894   remote_cert_ku[i] = 0
Mon Aug 18 15:31:00 2014 us=726900   remote_cert_ku[i] = 0
Mon Aug 18 15:31:00 2014 us=726907   remote_cert_eku = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726912   tls_timeout = 2
Mon Aug 18 15:31:00 2014 us=726919   renegotiate_bytes = 0
Mon Aug 18 15:31:00 2014 us=726925   renegotiate_packets = 0
Mon Aug 18 15:31:00 2014 us=726931   renegotiate_seconds = 3600
Mon Aug 18 15:31:00 2014 us=726937   handshake_window = 60
Mon Aug 18 15:31:00 2014 us=726944   transition_window = 3600
Mon Aug 18 15:31:00 2014 us=726950   single_session = DISABLED
Mon Aug 18 15:31:00 2014 us=726956   push_peer_info = DISABLED
Mon Aug 18 15:31:00 2014 us=726962   tls_exit = DISABLED
Mon Aug 18 15:31:00 2014 us=726968   tls_auth_file = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=726974   pkcs11_protected_authentication = DISABLED
Mon Aug 18 15:31:00 2014 us=726981   pkcs11_protected_authentication = DISABLED
Mon Aug 18 15:31:00 2014 us=726987   pkcs11_protected_authentication = DISABLED
Mon Aug 18 15:31:00 2014 us=726993   pkcs11_protected_authentication = DISABLED
Mon Aug 18 15:31:00 2014 us=726998   pkcs11_protected_authentication = DISABLED
Mon Aug 18 15:31:00 2014 us=727004   pkcs11_protected_authentication = DISABLED
Mon Aug 18 15:31:00 2014 us=727010   pkcs11_protected_authentication = DISABLED
Mon Aug 18 15:31:00 2014 us=727015   pkcs11_protected_authentication = DISABLED
Mon Aug 18 15:31:00 2014 us=727022   pkcs11_protected_authentication = DISABLED
Mon Aug 18 15:31:00 2014 us=727028   pkcs11_protected_authentication = DISABLED
Mon Aug 18 15:31:00 2014 us=727034   pkcs11_protected_authentication = DISABLED
Mon Aug 18 15:31:00 2014 us=727040   pkcs11_protected_authentication = DISABLED
Mon Aug 18 15:31:00 2014 us=727045   pkcs11_protected_authentication = DISABLED
Mon Aug 18 15:31:00 2014 us=727051   pkcs11_protected_authentication = DISABLED
Mon Aug 18 15:31:00 2014 us=727056   pkcs11_protected_authentication = DISABLED
Mon Aug 18 15:31:00 2014 us=727062   pkcs11_protected_authentication = DISABLED
Mon Aug 18 15:31:00 2014 us=727068   pkcs11_private_mode = 00000000
Mon Aug 18 15:31:00 2014 us=727075   pkcs11_private_mode = 00000000
Mon Aug 18 15:31:00 2014 us=727081   pkcs11_private_mode = 00000000
Mon Aug 18 15:31:00 2014 us=727087   pkcs11_private_mode = 00000000
Mon Aug 18 15:31:00 2014 us=727092   pkcs11_private_mode = 00000000
Mon Aug 18 15:31:00 2014 us=727098   pkcs11_private_mode = 00000000
Mon Aug 18 15:31:00 2014 us=727104   pkcs11_private_mode = 00000000
Mon Aug 18 15:31:00 2014 us=727109   pkcs11_private_mode = 00000000
Mon Aug 18 15:31:00 2014 us=727116   pkcs11_private_mode = 00000000
Mon Aug 18 15:31:00 2014 us=727122   pkcs11_private_mode = 00000000
Mon Aug 18 15:31:00 2014 us=727129   pkcs11_private_mode = 00000000
Mon Aug 18 15:31:00 2014 us=727135   pkcs11_private_mode = 00000000
Mon Aug 18 15:31:00 2014 us=727142   pkcs11_private_mode = 00000000
Mon Aug 18 15:31:00 2014 us=727148   pkcs11_private_mode = 00000000
Mon Aug 18 15:31:00 2014 us=727154   pkcs11_private_mode = 00000000
Mon Aug 18 15:31:00 2014 us=727161   pkcs11_private_mode = 00000000
Mon Aug 18 15:31:00 2014 us=727169   pkcs11_cert_private = DISABLED
Mon Aug 18 15:31:00 2014 us=727175   pkcs11_cert_private = DISABLED
Mon Aug 18 15:31:00 2014 us=727181   pkcs11_cert_private = DISABLED
Mon Aug 18 15:31:00 2014 us=727187   pkcs11_cert_private = DISABLED
Mon Aug 18 15:31:00 2014 us=727192   pkcs11_cert_private = DISABLED
Mon Aug 18 15:31:00 2014 us=727198   pkcs11_cert_private = DISABLED
Mon Aug 18 15:31:00 2014 us=727205   pkcs11_cert_private = DISABLED
Mon Aug 18 15:31:00 2014 us=727211   pkcs11_cert_private = DISABLED
Mon Aug 18 15:31:00 2014 us=727218   pkcs11_cert_private = DISABLED
Mon Aug 18 15:31:00 2014 us=727225   pkcs11_cert_private = DISABLED
Mon Aug 18 15:31:00 2014 us=727232   pkcs11_cert_private = DISABLED
Mon Aug 18 15:31:00 2014 us=727238   pkcs11_cert_private = DISABLED
Mon Aug 18 15:31:00 2014 us=727244   pkcs11_cert_private = DISABLED
Mon Aug 18 15:31:00 2014 us=727251   pkcs11_cert_private = DISABLED
Mon Aug 18 15:31:00 2014 us=727257   pkcs11_cert_private = DISABLED
Mon Aug 18 15:31:00 2014 us=727264   pkcs11_cert_private = DISABLED
Mon Aug 18 15:31:00 2014 us=727270   pkcs11_pin_cache_period = -1
Mon Aug 18 15:31:00 2014 us=727277   pkcs11_id = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=727283   pkcs11_id_management = DISABLED
Mon Aug 18 15:31:00 2014 us=727294   server_network = 0.0.0.0
Mon Aug 18 15:31:00 2014 us=727301   server_netmask = 0.0.0.0
Mon Aug 18 15:31:00 2014 us=727309   server_bridge_ip = 0.0.0.0
Mon Aug 18 15:31:00 2014 us=727316   server_bridge_netmask = 0.0.0.0
Mon Aug 18 15:31:00 2014 us=727323   server_bridge_pool_start = 0.0.0.0
Mon Aug 18 15:31:00 2014 us=727330   server_bridge_pool_end = 0.0.0.0
Mon Aug 18 15:31:00 2014 us=727337   ifconfig_pool_defined = DISABLED
Mon Aug 18 15:31:00 2014 us=727344   ifconfig_pool_start = 0.0.0.0
Mon Aug 18 15:31:00 2014 us=727351   ifconfig_pool_end = 0.0.0.0
Mon Aug 18 15:31:00 2014 us=727358   ifconfig_pool_netmask = 0.0.0.0
Mon Aug 18 15:31:00 2014 us=727366   ifconfig_pool_persist_filename = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=727373   ifconfig_pool_persist_refresh_freq = 600
Mon Aug 18 15:31:00 2014 us=727379   n_bcast_buf = 256
Mon Aug 18 15:31:00 2014 us=727386   tcp_queue_limit = 64
Mon Aug 18 15:31:00 2014 us=727393   real_hash_size = 256
Mon Aug 18 15:31:00 2014 us=727399   virtual_hash_size = 256
Mon Aug 18 15:31:00 2014 us=727406   client_connect_script = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=727412   learn_address_script = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=727419   client_disconnect_script = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=727426   client_config_dir = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=727432   ccd_exclusive = DISABLED
Mon Aug 18 15:31:00 2014 us=727439   tmp_dir = '/tmp'
Mon Aug 18 15:31:00 2014 us=727445   push_ifconfig_defined = DISABLED
Mon Aug 18 15:31:00 2014 us=727453   push_ifconfig_local = 0.0.0.0
Mon Aug 18 15:31:00 2014 us=727461   push_ifconfig_remote_netmask = 0.0.0.0
Mon Aug 18 15:31:00 2014 us=727468   enable_c2c = DISABLED
Mon Aug 18 15:31:00 2014 us=727475   duplicate_cn = DISABLED
Mon Aug 18 15:31:00 2014 us=727481   cf_max = 0
Mon Aug 18 15:31:00 2014 us=727488   cf_per = 0
Mon Aug 18 15:31:00 2014 us=727499   max_clients = 1024
Mon Aug 18 15:31:00 2014 us=727505   max_routes_per_client = 256
Mon Aug 18 15:31:00 2014 us=727512   auth_user_pass_verify_script = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=727519   auth_user_pass_verify_script_via_file = DISABLED
Mon Aug 18 15:31:00 2014 us=727526   ssl_flags = 0
Mon Aug 18 15:31:00 2014 us=727532   port_share_host = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=727539   port_share_port = 0
Mon Aug 18 15:31:00 2014 us=727545   client = ENABLED
Mon Aug 18 15:31:00 2014 us=727552   pull = ENABLED
Mon Aug 18 15:31:00 2014 us=727558   auth_user_pass_file = '[UNDEF]'
Mon Aug 18 15:31:00 2014 us=727567 OpenVPN 2.2.2 x86_64-suse-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Dec 14 2011
Mon Aug 18 15:31:00 2014 us=727629 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Aug 18 15:31:00 2014 us=727641 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Aug 18 15:31:00 2014 us=728216 LZO compression initialized
Mon Aug 18 15:31:00 2014 us=728266 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Aug 18 15:31:00 2014 us=728295 Socket Buffers: R=[212992->131072] S=[212992->131072]
Mon Aug 18 15:31:00 2014 us=728314 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Aug 18 15:31:00 2014 us=728331 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Aug 18 15:31:00 2014 us=728337 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Aug 18 15:31:00 2014 us=728351 Local Options hash (VER=V4): '41690919'
Mon Aug 18 15:31:00 2014 us=728361 Expected Remote Options hash (VER=V4): '530fdded'
Mon Aug 18 15:31:00 2014 us=729116 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Mon Aug 18 15:31:00 2014 us=729159 UDPv4 link local: [undef]
Mon Aug 18 15:31:00 2014 us=729177 UDPv4 link remote:xx.xx.xx.xx:1194
Mon Aug 18 15:31:01 2014 us=54959 TLS: Initial packet fromxx.xx.xx.xx:1194, sid=b9dc2d00 6fca536e
Mon Aug 18 15:31:19 2014 us=901134 VERIFY OK: depth=1, /C=US/ST=MYSTATE/L=Mycity/O=Mylastname/CN=Mylastname_CA/name=Marc/emailAddress=marc@myemailaddress.com
Mon Aug 18 15:31:19 2014 us=901420 VERIFY OK: depth=0, /C=US/ST=MYSTATE/L=Mycity/O=Mylastname/CN=server/name=bigbang/emailAddress=marc@myemailaddress.com
Mon Aug 18 15:31:25 2014 us=938582 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Aug 18 15:31:25 2014 us=938681 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Aug 18 15:31:25 2014 us=938811 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Aug 18 15:31:25 2014 us=938846 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Aug 18 15:31:25 2014 us=938977 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon Aug 18 15:31:25 2014 us=939049 [server] Peer Connection Initiated withxx.xx.xx.xx:1194
Mon Aug 18 15:31:28 2014 us=405770 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Aug 18 15:31:32 2014 us=698065 PUSH: Received control message: 'PUSH_REPLY,route 192.168.10.0 255.255.255.0,explicit-exit-notify 3,route 10.8.10.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.10.6 10.8.10.5'
Mon Aug 18 15:31:32 2014 us=698258 OPTIONS IMPORT: timers and/or timeouts modified
Mon Aug 18 15:31:32 2014 us=698296 OPTIONS IMPORT: explicit notify parm(s) modified
Mon Aug 18 15:31:32 2014 us=698320 OPTIONS IMPORT: --ifconfig/up options modified
Mon Aug 18 15:31:32 2014 us=698345 OPTIONS IMPORT: route options modified
Mon Aug 18 15:31:32 2014 us=698768 ROUTE default_gateway=192.168.100.10
Mon Aug 18 15:31:32 2014 us=699281 TUN/TAP device tun0 opened
Mon Aug 18 15:31:32 2014 us=699355 TUN/TAP TX queue length set to 100
Mon Aug 18 15:31:32 2014 us=699450 /bin/ip link set dev tun0 up mtu 1500
Mon Aug 18 15:31:32 2014 us=701873 /bin/ip addr add dev tun0 local 10.8.10.6 peer 10.8.10.5
Mon Aug 18 15:31:32 2014 us=703980 /bin/ip route add 192.168.10.0/24 via 10.8.10.5
Mon Aug 18 15:31:32 2014 us=705014 /bin/ip route add 10.8.10.1/32 via 10.8.10.5
Mon Aug 18 15:31:32 2014 us=705966 GID set to nobody
Mon Aug 18 15:31:32 2014 us=706043 UID set to nobody
Mon Aug 18 15:31:32 2014 us=706081 Initialization Sequence Completed
Mon Aug 18 16:31:25 2014 us=900818 TLS: soft reset sec=0 bytes=37910/0 pkts=704/0
Mon Aug 18 16:31:27 2014 us=688862 VERIFY OK: depth=1, /C=US/ST=MYSTATE/L=Mycity/O=Mylastname/CN=Mylastname_CA/name=Marc/emailAddress=marc@myemailaddress.com
Mon Aug 18 16:31:27 2014 us=689031 VERIFY OK: depth=0, /C=US/ST=MYSTATE/L=Mycity/O=Mylastname/CN=server/name=bigbang/emailAddress=marc@myemailaddress.com
Mon Aug 18 16:31:30 2014 us=458149 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Aug 18 16:31:30 2014 us=458227 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Aug 18 16:31:30 2014 us=458287 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Aug 18 16:31:30 2014 us=458295 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Aug 18 16:31:30 2014 us=458354 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA

maikcat

step by step approach..

can you ping from your client:

1)10.8.10.1
2)192.168.10.100

if none of the above then post the output of:

iptables -L -v
iptables -t nat -L -v

on your openvpn server.

Michael.

MarcC

Thanks maikcat for taking the time to reply! Sure thing but I have removed a bit of what I consider potentially sensitive info, my domain name and part of the dnat data as that exposes some things about my network that I think is risky... I don't know if you wanted me to generate this info while I have actually established a VPN connection from work to my home server or not. At the moment I am home, but if you want to see the results while I am actually connected let me know and I will repost from work.

First off, I cannot ping either URL from work after I establish the VPN connection.

This output is generated straight off my server and not while a connection has been established....

iptables -L -v
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 707K  126M ACCEPT     all  --  lo     any     anywhere             anywhere            
76827   22M ACCEPT     all  --  any    any     anywhere             anywhere             ctstate ESTABLISHED
  132 14214 ACCEPT     icmp --  any    any     anywhere             anywhere             ctstate RELATED
 7127  743K input_int  all  --  eth1   any     anywhere             anywhere            
    0     0 input_int  all  --  tun0   any     anywhere             anywhere            
 6766  735K input_ext  all  --  any    any     anywhere             anywhere            
    0     0 LOG        all  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix "SFW2-IN-ILL-TARGET "
    0     0 DROP       all  --  any    any     anywhere             anywhere            

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 5868  347K TCPMSS     tcp  --  any    any     anywhere             anywhere             tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
69943 7138K forward_int  all  --  eth1   any     anywhere             anywhere            
    0     0 forward_int  all  --  tun0   any     anywhere             anywhere            
78264   85M forward_ext  all  --  eth0   any     anywhere             anywhere            
    0     0 LOG        all  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix "SFW2-FWD-ILL-ROUTING "
    0     0 DROP       all  --  any    any     anywhere             anywhere            

Chain OUTPUT (policy ACCEPT 724K packets, 111M bytes)
 pkts bytes target     prot opt in     out     source               destination         
 707K  126M ACCEPT     all  --  any    lo      anywhere             anywhere            

Chain forward_ext (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    6   504 ACCEPT     icmp --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED icmp echo-reply
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED icmp destination-unreachable
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED icmp time-exceeded
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED icmp parameter-problem
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED icmp timestamp-reply
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED icmp address-mask-reply
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED icmp protocol-unreachable
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED icmp redirect
    0     0 LOG        all  --  any    any     192.168.10.0/24      10.8.10.0/24         limit: avg 3/min burst 5 ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-FORW "
    0     0 ACCEPT     all  --  any    any     192.168.10.0/24      10.8.10.0/24         ctstate NEW,RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  any    any     10.8.10.0/24         192.168.10.0/24      ctstate RELATED,ESTABLISHED
    0     0 LOG        all  --  any    any     10.8.10.0/24         192.168.10.0/24      limit: avg 3/min burst 5 ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-FORW "
    0     0 ACCEPT     all  --  any    any     10.8.10.0/24         192.168.10.0/24      ctstate NEW,RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  any    any     192.168.10.0/24      10.8.10.0/24         ctstate RELATED,ESTABLISHED
78252   85M ACCEPT     all  --  eth0   eth1    anywhere             anywhere             ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  eth0   tun0    anywhere             anywhere             ctstate RELATED,ESTABLISHED
    6   264 ACCEPT     all  --  eth0   eth1    anywhere             anywhere             ctstate NEW,RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  eth0   tun0    anywhere             anywhere             ctstate NEW,RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             bigbang              limit: avg 3/min burst 5 tcp dpt:http-alt ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             bigbang              tcp dpt:http-alt
    0     0 ACCEPT     tcp  --  any    any     bigbang              anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             bigbang              limit: avg 3/min burst 5 tcp dpt:http-alt ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             bigbang              tcp dpt:http-alt
    0     0 ACCEPT     tcp  --  any    any     bigbang              anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             192.168.10.254       limit: avg 3/min burst 5 tcp dpt:http ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             192.168.10.254       tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     192.168.10.254       anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             192.168.10.254       limit: avg 3/min burst 5 tcp dpt:http ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             192.168.10.254       tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     192.168.10.254       anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             192.168.10.250       limit: avg 3/min burst 5 tcp dpt:http ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             192.168.10.250       tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     192.168.10.250       anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             192.168.10.250       limit: avg 3/min burst 5 tcp dpt:http ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             192.168.10.250       tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     192.168.10.250       anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             10.10.10.200         limit: avg 3/min burst 5 tcp dpt:http-alt ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             10.10.10.200         tcp dpt:http-alt
    0     0 ACCEPT     tcp  --  any    any     10.10.10.200         anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             10.10.10.200         limit: avg 3/min burst 5 tcp dpt:http-alt ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             10.10.10.200         tcp dpt:http-alt
    0     0 ACCEPT     tcp  --  any    any     10.10.10.200         anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             10.10.10.1           limit: avg 3/min burst 5 tcp dpt:http ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             10.10.10.1           tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     10.10.10.1           anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             10.10.10.1           limit: avg 3/min burst 5 tcp dpt:http ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             10.10.10.1           tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     10.10.10.1           anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             10.10.10.2           limit: avg 3/min burst 5 tcp dpt:http ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             10.10.10.2           tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     10.10.10.2           anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             10.10.10.2           limit: avg 3/min burst 5 tcp dpt:http ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             10.10.10.2           tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     10.10.10.2           anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             10.10.10.3           limit: avg 3/min burst 5 tcp dpt:http ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             10.10.10.3           tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     10.10.10.3           anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             10.10.10.3           limit: avg 3/min burst 5 tcp dpt:http ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             10.10.10.3           tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     10.10.10.3           anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             novasuse.mydomain.com  limit: avg 3/min burst 5 tcp dpt:http ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             novasuse.mydomain.com  tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     novasuse.mydomain.com  anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             novasuse.mydomain.com  limit: avg 3/min burst 5 tcp dpt:http-alt ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             novasuse.mydomain.com  tcp dpt:http-alt
    0     0 ACCEPT     tcp  --  any    any     novasuse.mydomain.com  anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             marcslaptopsuse.mydomain.com  limit: avg 3/min burst 5 tcp dpt:fcp-addr-srvr1 ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             marcslaptopsuse.mydomain.com  tcp dpt:fcp-addr-srvr1
    0     0 ACCEPT     tcp  --  any    any     marcslaptopsuse.mydomain.com  anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             marcslaptopsuse.mydomain.com  limit: avg 3/min burst 5 tcp dpt:vnc-server ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             marcslaptopsuse.mydomain.com  tcp dpt:vnc-server
    0     0 ACCEPT     tcp  --  any    any     marcslaptopsuse.mydomain.com  anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             marcslaptopWin7.mydomain.com  limit: avg 3/min burst 5 tcp dpt:vnc-server ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             marcslaptopWin7.mydomain.com  tcp dpt:vnc-server
    0     0 ACCEPT     tcp  --  any    any     marcslaptopWin7.mydomain.com  anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             novasuse.mydomain.com  limit: avg 3/min burst 5 tcp dpt:vnc-server ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             novasuse.mydomain.com  tcp dpt:vnc-server
    0     0 ACCEPT     tcp  --  any    any     novasuse.mydomain.com  anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             novaXP.mydomain.com  limit: avg 3/min burst 5 tcp dpt:vnc-server ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             novaXP.mydomain.com  tcp dpt:vnc-server
    0     0 ACCEPT     tcp  --  any    any     novaXP.mydomain.com  anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             brotherPrinter.mydomain.com  limit: avg 3/min burst 5 tcp dpt:vnc-server ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             brotherPrinter.mydomain.com  tcp dpt:vnc-server
    0     0 ACCEPT     tcp  --  any    any     brotherPrinter.mydomain.com  anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             192.168.10.35        limit: avg 3/min burst 5 tcp dpt:vnc-server ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             192.168.10.35        tcp dpt:vnc-server
    0     0 ACCEPT     tcp  --  any    any     192.168.10.35        anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             stephslaptopWin7.mydomain.com  limit: avg 3/min burst 5 tcp dpt:vnc-server ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             stephslaptopWin7.mydomain.com  tcp dpt:vnc-server
    0     0 ACCEPT     tcp  --  any    any     stephslaptopWin7.mydomain.com  anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             darkstarsuse.mydomain.com  limit: avg 3/min burst 5 tcp dpt:vnc-server ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             darkstarsuse.mydomain.com  tcp dpt:vnc-server
    0     0 ACCEPT     tcp  --  any    any     darkstarsuse.mydomain.com  anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             192.168.10.80        limit: avg 3/min burst 5 tcp dpt:vnc-server ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             192.168.10.80        tcp dpt:vnc-server
    0     0 ACCEPT     tcp  --  any    any     192.168.10.80        anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             192.168.10.85        limit: avg 3/min burst 5 tcp dpt:vnc-server ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             192.168.10.85        tcp dpt:vnc-server
    0     0 ACCEPT     tcp  --  any    any     192.168.10.85        anywhere             ctstate RELATED,ESTABLISHED
    0     0 DROP       all  --  any    any     anywhere             anywhere             PKTTYPE = multicast
    0     0 DROP       all  --  any    any     anywhere             anywhere             PKTTYPE = broadcast
    0     0 LOG        tcp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 tcp flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix "SFW2-FWDext-DROP-DEFLT "
    0     0 LOG        icmp --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix "SFW2-FWDext-DROP-DEFLT "
    0     0 LOG        udp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDext-DROP-DEFLT "
    0     0 DROP       all  --  any    any     anywhere             anywhere            

Chain forward_int (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED icmp echo-reply
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED icmp destination-unreachable
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED icmp time-exceeded
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED icmp parameter-problem
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED icmp timestamp-reply
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED icmp address-mask-reply
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED icmp protocol-unreachable
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED icmp redirect
    0     0 ACCEPT     all  --  any    eth1    anywhere             anywhere            
    0     0 ACCEPT     all  --  any    tun0    anywhere             anywhere            
    0     0 LOG        all  --  any    any     192.168.10.0/24      10.8.10.0/24         limit: avg 3/min burst 5 ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-FORW "
    0     0 ACCEPT     all  --  any    any     192.168.10.0/24      10.8.10.0/24         ctstate NEW,RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  any    any     10.8.10.0/24         192.168.10.0/24      ctstate RELATED,ESTABLISHED
    0     0 LOG        all  --  any    any     10.8.10.0/24         192.168.10.0/24      limit: avg 3/min burst 5 ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-FORW "
    0     0 ACCEPT     all  --  any    any     10.8.10.0/24         192.168.10.0/24      ctstate NEW,RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  any    any     192.168.10.0/24      10.8.10.0/24         ctstate RELATED,ESTABLISHED
69781 7131K ACCEPT     all  --  eth1   eth0    anywhere             anywhere             ctstate NEW,RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  tun0   eth0    anywhere             anywhere             ctstate NEW,RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  eth1   eth0    anywhere             anywhere             ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  tun0   eth0    anywhere             anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             bigbang              limit: avg 3/min burst 5 tcp dpt:http-alt ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             bigbang              tcp dpt:http-alt
    0     0 ACCEPT     tcp  --  any    any     bigbang              anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             bigbang              limit: avg 3/min burst 5 tcp dpt:http-alt ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             bigbang              tcp dpt:http-alt
    0     0 ACCEPT     tcp  --  any    any     bigbang              anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             192.168.10.254       limit: avg 3/min burst 5 tcp dpt:http ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             192.168.10.254       tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     192.168.10.254       anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             192.168.10.254       limit: avg 3/min burst 5 tcp dpt:http ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             192.168.10.254       tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     192.168.10.254       anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             192.168.10.250       limit: avg 3/min burst 5 tcp dpt:http ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             192.168.10.250       tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     192.168.10.250       anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             192.168.10.250       limit: avg 3/min burst 5 tcp dpt:http ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             192.168.10.250       tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     192.168.10.250       anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             10.10.10.200         limit: avg 3/min burst 5 tcp dpt:http-alt ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             10.10.10.200         tcp dpt:http-alt
    0     0 ACCEPT     tcp  --  any    any     10.10.10.200         anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             10.10.10.200         limit: avg 3/min burst 5 tcp dpt:http-alt ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             10.10.10.200         tcp dpt:http-alt
    0     0 ACCEPT     tcp  --  any    any     10.10.10.200         anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             10.10.10.1           limit: avg 3/min burst 5 tcp dpt:http ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             10.10.10.1           tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     10.10.10.1           anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             10.10.10.1           limit: avg 3/min burst 5 tcp dpt:http ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             10.10.10.1           tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     10.10.10.1           anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             10.10.10.2           limit: avg 3/min burst 5 tcp dpt:http ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             10.10.10.2           tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     10.10.10.2           anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             10.10.10.2           limit: avg 3/min burst 5 tcp dpt:http ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             10.10.10.2           tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     10.10.10.2           anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             10.10.10.3           limit: avg 3/min burst 5 tcp dpt:http ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             10.10.10.3           tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     10.10.10.3           anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             10.10.10.3           limit: avg 3/min burst 5 tcp dpt:http ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             10.10.10.3           tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     10.10.10.3           anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             novasuse.mydomain.com  limit: avg 3/min burst 5 tcp dpt:http ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             novasuse.mydomain.com  tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     novasuse.mydomain.com  anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             novasuse.mydomain.com  limit: avg 3/min burst 5 tcp dpt:http-alt ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             novasuse.mydomain.com  tcp dpt:http-alt
    0     0 ACCEPT     tcp  --  any    any     novasuse.mydomain.com  anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             marcslaptopsuse.mydomain.com  limit: avg 3/min burst 5 tcp dpt:fcp-addr-srvr1 ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             marcslaptopsuse.mydomain.com  tcp dpt:fcp-addr-srvr1
    0     0 ACCEPT     tcp  --  any    any     marcslaptopsuse.mydomain.com  anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             marcslaptopsuse.mydomain.com  limit: avg 3/min burst 5 tcp dpt:vnc-server ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             marcslaptopsuse.mydomain.com  tcp dpt:vnc-server
    0     0 ACCEPT     tcp  --  any    any     marcslaptopsuse.mydomain.com  anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             marcslaptopWin7.mydomain.com  limit: avg 3/min burst 5 tcp dpt:vnc-server ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             marcslaptopWin7.mydomain.com  tcp dpt:vnc-server
    0     0 ACCEPT     tcp  --  any    any     marcslaptopWin7.mydomain.com  anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             novasuse.mydomain.com  limit: avg 3/min burst 5 tcp dpt:vnc-server ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             novasuse.mydomain.com  tcp dpt:vnc-server
    0     0 ACCEPT     tcp  --  any    any     novasuse.mydomain.com  anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             novaXP.mydomain.com  limit: avg 3/min burst 5 tcp dpt:vnc-server ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             novaXP.mydomain.com  tcp dpt:vnc-server
    0     0 ACCEPT     tcp  --  any    any     novaXP.mydomain.com  anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             brotherPrinter.mydomain.com  limit: avg 3/min burst 5 tcp dpt:vnc-server ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             brotherPrinter.mydomain.com  tcp dpt:vnc-server
    0     0 ACCEPT     tcp  --  any    any     brotherPrinter.mydomain.com  anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             192.168.10.35        limit: avg 3/min burst 5 tcp dpt:vnc-server ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             192.168.10.35        tcp dpt:vnc-server
    0     0 ACCEPT     tcp  --  any    any     192.168.10.35        anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             stephslaptopWin7.mydomain.com  limit: avg 3/min burst 5 tcp dpt:vnc-server ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             stephslaptopWin7.mydomain.com  tcp dpt:vnc-server
    0     0 ACCEPT     tcp  --  any    any     stephslaptopWin7.mydomain.com  anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             darkstarsuse.mydomain.com  limit: avg 3/min burst 5 tcp dpt:vnc-server ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             darkstarsuse.mydomain.com  tcp dpt:vnc-server
    0     0 ACCEPT     tcp  --  any    any     darkstarsuse.mydomain.com  anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             192.168.10.80        limit: avg 3/min burst 5 tcp dpt:vnc-server ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             192.168.10.80        tcp dpt:vnc-server
    0     0 ACCEPT     tcp  --  any    any     192.168.10.80        anywhere             ctstate RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             192.168.10.85        limit: avg 3/min burst 5 tcp dpt:vnc-server ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-ACC-REVMASQ "
    0     0 ACCEPT     tcp  --  any    any     anywhere             192.168.10.85        tcp dpt:vnc-server
    0     0 ACCEPT     tcp  --  any    any     192.168.10.85        anywhere             ctstate RELATED,ESTABLISHED
    0     0 DROP       all  --  any    any     anywhere             anywhere             PKTTYPE = multicast
    0     0 DROP       all  --  any    any     anywhere             anywhere             PKTTYPE = broadcast
    0     0 LOG        tcp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 tcp flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix "SFW2-FWDint-DROP-DEFLT "
    0     0 LOG        icmp --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix "SFW2-FWDint-DROP-DEFLT "
    0     0 LOG        udp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-FWDint-DROP-DEFLT "
  162  7092 reject_func  all  --  any    any     anywhere             anywhere            

Chain input_ext (1 references)
 pkts bytes target     prot opt in     out     source               destination         
 1624  346K DROP       all  --  any    any     anywhere             anywhere             PKTTYPE = broadcast
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp source-quench
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp echo-request
    0     0 reject_func  tcp  --  any    any     anywhere             anywhere             tcp dpt:ident ctstate NEW
    0     0 LOG        tcp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 tcp dpt:dyna-access flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix "SFW2-INext-ACC-TCP "
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:dyna-access
    7   316 LOG        tcp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 tcp dpt:ms-wbt-server flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix "SFW2-INext-ACC-TCP "
    7   316 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:ms-wbt-server
    5   300 LOG        tcp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 tcp dpt:collaborator flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix "SFW2-INext-ACC-TCP "
    7   500 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:collaborator
    1    48 LOG        tcp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 tcp dpts:afs3-fileserver:font-service flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix "SFW2-INext-ACC-TCP "
    1    48 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpts:afs3-fileserver:font-service
    0     0 LOG        tcp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 tcp dpt:7505 flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix "SFW2-INext-ACC-TCP "
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:7505
  298 17300 LOG        tcp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 tcp dpts:http-alt:8086 flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix "SFW2-INext-ACC-TCP "
  347 20476 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpts:http-alt:8086
    0     0 LOG        tcp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 tcp dpt:cvspserver flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix "SFW2-INext-ACC-TCP "
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:cvspserver
    0     0 LOG        tcp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 tcp dpt:domain flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix "SFW2-INext-ACC-TCP "
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:domain
    1    60 LOG        tcp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 tcp dpt:ftp flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix "SFW2-INext-ACC-TCP "
    1    60 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:ftp
    0     0 LOG        tcp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 tcp dpt:ftp-data flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix "SFW2-INext-ACC-TCP "
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:ftp-data
    0     0 LOG        tcp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 tcp dpt:http flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix "SFW2-INext-ACC-TCP "
   11   452 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:http
   20  1136 LOG        tcp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 tcp dpt:pop3 flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix "SFW2-INext-ACC-TCP "
   20  1136 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:pop3
  223 12668 LOG        tcp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 tcp dpt:smtp flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix "SFW2-INext-ACC-TCP "
  340 17410 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:smtp
    4   232 LOG        tcp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 tcp dpt:urd flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix "SFW2-INext-ACC-TCP "
    4   232 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:urd
  226 12624 LOG        tcp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 tcp dpt:pop3s flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix "SFW2-INext-ACC-TCP "
  230 12832 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:pop3s
    0     0 LOG        tcp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 tcp dpt:privoxy flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix "SFW2-INext-ACC-TCP "
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:privoxy
    7   294 ACCEPT     udp  --  any    any     anywhere             anywhere             udp dpt:openvpn
    0     0 ACCEPT     udp  --  any    any     anywhere             anywhere             udp dpt:rsf-1
  495 36357 ACCEPT     udp  --  any    any     anywhere             anywhere             udp dpt:domain
 3352  231K DROP       all  --  any    any     anywhere             anywhere             PKTTYPE = multicast
    0     0 DROP       all  --  any    any     anywhere             anywhere             PKTTYPE = broadcast
   87  4608 LOG        tcp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 tcp flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix "SFW2-INext-DROP-DEFLT "
    0     0 LOG        icmp --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix "SFW2-INext-DROP-DEFLT "
   40  3296 LOG        udp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-INext-DROP-DEFLT "
  320 68357 DROP       all  --  any    any     anywhere             anywhere            

Chain input_int (2 references)
 pkts bytes target     prot opt in     out     source               destination         
 7127  743K ACCEPT     all  --  any    any     anywhere             anywhere            

Chain reject_func (2 references)
 pkts bytes target     prot opt in     out     source               destination         
  162  7092 REJECT     tcp  --  any    any     anywhere             anywhere             reject-with tcp-reset
    0     0 REJECT     udp  --  any    any     anywhere             anywhere             reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-proto-unreachable

iptables -t nat -L -v
Chain PREROUTING (policy ACCEPT 15437 packets, 1117K bytes)
 pkts bytes target     prot opt in     out     source               destination         
  345 20376 DNAT       tcp  --  eth0   any     anywhere             bigbang              tcp dpt:http to:192.168.10.100:8080
    0     0 DNAT       tcp  --  eth1   any     anywhere             bigbang              tcp dpt:http to:192.168.10.100:8080
    0     0 DNAT       tcp  --  tun0   any     anywhere             bigbang              tcp dpt:http to:192.168.10.100:8080
    0     0 DNAT       tcp  --  eth0   any     anywhere             bigbang              tcp dpt:http to:192.168.10.100:8080
    1    60 DNAT       tcp  --  eth1   any     anywhere             bigbang              tcp dpt:http to:192.168.10.100:8080
   12   720 DNAT       tcp  --  tun0   any     anywhere             bigbang              tcp dpt:http to:192.168.10.100:8080
    6   240 DNAT       tcp  --  eth0   any     anywhere             anywhere             tcp dpt:radan-http to:192.168.10.20:8080
    0     0 DNAT       tcp  --  eth1   any     anywhere             anywhere             tcp dpt:radan-http to:192.168.10.20:8080
    0     0 DNAT       tcp  --  tun0   any     anywhere             anywhere             tcp dpt:radan-http to:192.168.10.20:8080

Chain INPUT (policy ACCEPT 5877 packets, 420K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 15824 packets, 1607K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
16974 1443K MASQUERADE  all  --  any    eth0    anywhere             anywhere            
 1559  330K MASQUERADE  all  --  any    eth1    anywhere             anywhere            
    0     0 MASQUERADE  all  --  any    tun0    anywhere             anywhere

maikcat

the most easy way to exclude your firewall rules is to temporary disable iptables

-or-

switch the default action from drop to allow temporarely...

you MUST verify that your iptables rules not blocking something before proceeding to troubleshoot
your routing config...

Michael.

MarcC

maikcat wrotethe most easy way to exclude your firewall rules is to temporary disable iptables

-or-

switch the default action from drop to allow temporarely...

you MUST verify that your iptables rules not blocking something before proceeding to troubleshoot
your routing config...

Michael.

Hi Michael and thanks again for replying... To the best of my understanding, the way to disable iptables/firewall on openSuSE13.1 is to stop the SuSEFirewall daemon. This I did on the server and I think that then causes iptables to use it's default packet filtering rules which is to allow everything through. I am still able to connect to the openVPN server but unable to ping either address you asked me to. (Mind you I am NOT a guru on all this stuff regarding iptables or the SuSEFirewall daemon so I am making a guess....) Just to be absolutely certain I turned off SuSEFirewall on both my laptop and my home server when making the test. Dunno if that helps...

Marc...

MarcC

Michael - In fact I just verified what I said in my previous posting, see the following which shows the state of the iptables after I stopped the SuSEFirewall2 daemon -

rcSuSEfirewall2 stop
bigbang:/home/marc # iptables -L -v
Chain INPUT (policy ACCEPT 490 packets, 101K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 747 packets, 113K bytes)
 pkts bytes target     prot opt in     out     source               destination         
bigbang:/home/marc # iptables -t nat -L -v
Chain PREROUTING (policy ACCEPT 15 packets, 978 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 11 packets, 734 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 112 packets, 8886 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 112 packets, 8886 bytes)
 pkts bytes target     prot opt in     out     source               destination

maikcat

with the firewall out of the way the next thing to check is:

is ip forwading is enabled on server?

Michael.

MarcC

maikcat wrotewith the firewall out of the way the next thing to check is:

is ip forwading is enabled on server?

Michael.

Michael, I think this answers the question, and I am presuming that you want me to test with the normal firewall configuration, not with the firewall turned off?... If that is correct, then yes it appears that ip forwarding is enabled when the firewall is up and running...

bigbang:/home/marc # rcSuSEfirewall2 stop
bigbang:/home/marc # cat /proc/sys/net/ipv4/ip_forward
0
bigbang:/home/marc # rcSuSEfirewall2 start
bigbang:/home/marc # cat /proc/sys/net/ipv4/ip_forward
1

maikcat

i didnt make my self clear...

keep for testing your Firewall DOWN and enable ip forwarding and re-test...
😃

Michael.

MarcC

maikcat wrotei didnt make my self clear...

keep for testing your Firewall DOWN and enable ip forwarding and re-test...
😃

Michael.

Still no joy Michael, The following shows what I did, basically I stopped the firewall, enabled ip forwarding, (I hope I did it correctly, this is what I discovered from Googling...) stopped the openvpn service, started the openvpn service, connected to it from my laptop at work, and tried to ping the two IP addresses you asked me to.. The pings do not return anything, just hangs...

bigbang:/home/marc # rcSuSEfirewall2 stop
bigbang:/home/marc # cat /proc/sys/net/ipv4/ip_forward
0
bigbang:/home/marc # echo 1 > /proc/sys/net/ipv4/ip_forward
bigbang:/home/marc # cat /proc/sys/net/ipv4/ip_forward
1
bigbang:/home/marc # rcopenvpn restart
redirecting to systemctl  restart openvpn
bigbang:/home/marc # rcopenvpn status
Checking for OpenVPN [server]                                                                               running
OpenVPN status written to /var/log/messages
openvpn.service - LSB: OpenVPN tunnel
          Loaded: loaded (/etc/init.d/openvpn)
          Active: active (running) since Wed, 2014-08-20 14:49:50 PDT; 17s ago
         Process: 19514 ExecStop=/etc/init.d/openvpn stop (code=exited, status=0/SUCCESS)
         Process: 19529 ExecStart=/etc/init.d/openvpn start (code=exited, status=0/SUCCESS)
          CGroup: name=systemd:/system/openvpn.service
                  └ 19551 /usr/sbin/openvpn --daemon --writepid /var/run/openvpn/server.pid --config /etc/openvpn/s...

Aug 20 14:49:50 bigbang.mydomain.com systemd[1]: Starting LSB: OpenVPN tunnel...
Aug 20 14:49:50 bigbang.mydomain.com openvpn[19529]: Starting OpenVPN [server]
Aug 20 14:49:50 bigbang.mydomain.com openvpn[19529]: ..done
Aug 20 14:49:50 bigbang.mydomain.com systemd[1]: Started LSB: OpenVPN tunnel.

maikcat

instead of ping can you use the traceroute command from your client?

also post the output of netstat -nr on your client after vpn is up...

Michael.

MarcC

Thanks again Michael, Ok here is what I did in sequence -

From my laptop, while at work, I ssh in to my home server and issued the following commands -

marc@marcslaptop:~/openVPN> ssh -p 222 marc@mydomain.com
Password: 
Last login: Thu Aug 21 12:04:49 2014 from console
Have a lot of fun...
marc@bigbang:~> su root
Password: 

bigbang:/home/marc # rcSuSEfirewall2 stop
bigbang:/home/marc # echo 1 > /proc/sys/net/ipv4/ip_forward

That should have stopped the fireall, told iptables to accept everything, and turned on ip forwarding. Then in another shell I connected to my server via openvpn -

marcslaptop:/home/marc/openVPN # openvpn ./client.conf

Finally, in an 3rd shell window I executed and got the following responses -

marcslaptop:/home/marc # traceroute 10.8.10.1
traceroute to 10.8.10.1 (10.8.10.1), 30 hops max, 40 byte packets using UDP
 1  * * *
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *
marcslaptop:/home/marc # traceroute 192.168.10.100
traceroute to 192.168.10.100 (192.168.10.100), 30 hops max, 40 byte packets using UDP
 1  * * *
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *
marcslaptop:/home/marc # netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.100.10  0.0.0.0         UG        0 0          0 wlan0
10.8.10.1       10.8.10.5       255.255.255.255 UGH       0 0          0 tun0
10.8.10.5       0.0.0.0         255.255.255.255 UH        0 0          0 tun0
192.168.10.0    10.8.10.5       255.255.255.0   UG        0 0          0 tun0
192.168.100.0   0.0.0.0         255.255.255.0   U         0 0          0 wlan0

Just for grins, I then went back to my ssh connection and ran the netstat command on the server as well -

bigbang:/home/marc # netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         10.10.10.1      0.0.0.0         UG        0 0          0 eth0
10.8.10.0       192.168.10.100  255.255.255.0   UG        0 0          0 eth1
10.8.10.2       0.0.0.0         255.255.255.255 UH        0 0          0 tun0
10.10.10.0      0.0.0.0         255.255.255.0   U         0 0          0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth0
192.168.10.0    0.0.0.0         255.255.255.0   U         0 0          0 eth1
192.168.20.0    10.10.10.200    255.255.255.0   UG        0 0          0 eth0

HTHs Marc...

maikcat

this is wrong...

bigbang:/home/marc # netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         10.10.10.1      0.0.0.0         UG        0 0          0 eth0
10.8.10.0       192.168.10.100  255.255.255.0   UG        0 0          0 eth1  <--***
10.8.10.2       0.0.0.0         255.255.255.255 UH        0 0          0 tun0
10.10.10.0      0.0.0.0         255.255.255.0   U         0 0          0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U         0 0          0 lo
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth0
192.168.10.0    0.0.0.0         255.255.255.0   U         0 0          0 eth1
192.168.20.0    10.10.10.200    255.255.255.0   UG        0 0          0 eth0

this should be

10.8.10.0 10.8.10.2 255.255.255.0 UG 0 0 0 tun0

dont know why the above routes are wrong in your setup...

Michael.

MarcC

Thanks Michael, you pointed me in the right direction and I found out where the routes on my server were misconfigured. So removed that particular route and now am able to ping my home server over the VPN from work! That's the good news.

Now I have to figure out how to actually use the VPN from a Linux client. I think that my next step will be to figure out how to get my client (laptop) to use my DNS server on my home server. My hope is that will allow my laptop to resolve host names, for systems on my home network, and from there things like autofs will then start working?

Thanks again and if you or anyone else have any pointers on how to actually use a VPN, going from a Linux system to a mixture of Linux and Windows on a private network, please send me a link! :-)

Marc....

maikcat

time for commercials 😃

you can always buy janjust's book from packt publishing openvpn cookbook and learn ALOT!

Michael.