I have an OpenVPN server on a VPS, and want to connect to the Internet from a workstation behind an OpenWRT (BB) router that is running an OpenVPN client. Any observations, advice, suggestions, and criticism would be greatly appreciated!! The topography is this:
http://postimg.org/image/c3y8ezh21/
The OpenWRT router runs the OpenVPN client; the OpenVZ VPS running Ubuntu 14.04 runs the OpenVPN server. I want to connect to the Internet from a workstation connected to the client's physical subnet - this will prove one half of my final goal which is to transparently connect two remote, filtered subnets (which is why I am using the VPS - to act as an Internet-visible server node on the VPN).
The VPN connects successfully, but the workstation cannot access the Internet if I try to route the client's IP traffic through the VPN with
push "redirect-gateway def1"
While redirecting IP traffic, the server can ping 8.8.8.8, but cannot ping 192.168.170.6, and the client can ping both 8.8.8.8 and 192.168.170.1.
While redirecting IP traffic, I get these outputs:
Server openvpn-status.log:
root@gnpramnode:~# cat /var/log/openvpn-status.log
OpenVPN CLIENT LIST
Updated,Wed Aug 20 18:56:20 2014
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
gnp-node1,206.xx.xx.xx:3427,21682,14808,Wed Aug 20 18:49:50 2014
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
192.168.170.6,gnp-node1,206.xx.xx.xx:3427,Wed Aug 20 18:55:44 2014
GLOBAL STATS
Max bcast/mcast queue length,0
END
Client openvpn-status.log:
root@OpenWrt:/tmp# cat openvpn-status.log
OpenVPN STATISTICS
Updated,Wed Aug 20 22:57:51 2014
TUN/TAP read bytes,10568
TUN/TAP write bytes,5278
TCP/UDP read bytes,15402
TCP/UDP write bytes,24583
Auth read bytes,5918
END
Server openvpn config file:
root@gnpramnode:~# cat /etc/openvpn/140804_server.conf
port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/gnpvpn140804-serv.crt
key /etc/openvpn/gnpvpn140804-serv.key
dh /etc/openvpn/dh2048.pem
server 192.168.170.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
client-to-client
#push "comp_lzo adaptive"
push "route 192.168.170.0 255.255.255.0"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
#comp-lzo adaptive
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 3
log /tmp/openvpn.log
Client openvpn config:
root@OpenWrt:/tmp# uci show openvpn
openvpn.myvpn=openvpn
openvpn.myvpn.dev=tun
openvpn.myvpn.log=/tmp/openvpn.log
openvpn.myvpn.verb=3
openvpn.myvpn.ca=/etc/openvpn/ca.crt
openvpn.myvpn.cert=/etc/openvpn/gnp-node1.crt
openvpn.myvpn.key=/etc/openvpn/gnp-node1.key
openvpn.myvpn.client=1
openvpn.myvpn.remote=107.xx.xx.xx 1194
openvpn.myvpn.status=/var/openvpn-status.log
openvpn.myvpn.persist_tun=1
openvpn.myvpn.persist_key=1
openvpn.myvpn.enabled=1
openvpn.myvpn.proto=udp
Server ifconfig output:
root@gnpramnode:~# ifconfig
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.170.1 P-t-P:192.168.170.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:198 errors:0 dropped:0 overruns:0 frame:0
TX packets:202 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:12748 (12.7 KB) TX bytes:17252 (17.2 KB)
venet0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:127.0.0.2 P-t-P:127.0.0.2 Bcast:0.0.0.0 Mask:255.255.255.255
inet6 addr: 2604:180:1::b739:bc30/128 Scope:Global
inet6 addr: 2604:180:1::fcea:675/128 Scope:Global
inet6 addr: 2604:180:1::b249:db67/128 Scope:Global
inet6 addr: 2604:180:1::19c5:a825/128 Scope:Global
inet6 addr: 2604:180:1::1a3e:6c4d/128 Scope:Global
inet6 addr: 2604:180:1::edfb:9f7/128 Scope:Global
inet6 addr: 2604:180:1::81ae:2392/128 Scope:Global
inet6 addr: 2604:180:1::6e48:8a76/128 Scope:Global
inet6 addr: 2604:180:1::e284:35d2/128 Scope:Global
inet6 addr: 2604:180:1::759:3ac7/128 Scope:Global
inet6 addr: 2604:180:1::5cbc:d47a/128 Scope:Global
inet6 addr: 2604:180:1::1632:40a2/128 Scope:Global
inet6 addr: 2604:180:1::d3f1:d125/128 Scope:Global
inet6 addr: 2604:180:1::7a60:b9ec/128 Scope:Global
inet6 addr: 2604:180:1::18ba:1b2d/128 Scope:Global
inet6 addr: 2604:180:1::40d4:954a/128 Scope:Global
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
RX packets:8282 errors:0 dropped:0 overruns:0 frame:0
TX packets:7877 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:831377 (831.3 KB) TX bytes:1465011 (1.4 MB)
venet0:0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:107.xx.xx.xx P-t-P:107.xx.xx.xx Bcast:107.xx.xx.xx Mask:255.255.255.255
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
root@gnpramnode:~#
Client ifconfig output:
root@OpenWrt:/tmp# ifconfig
br-lan Link encap:Ethernet HWaddr C0:4A:00:EB:36:82
inet addr:192.168.171.5 Bcast:192.168.171.255 Mask:255.255.255.0
inet6 addr: fd15:829c:73c9::1/60 Scope:Global
inet6 addr: fe80::c24a:ff:feeb:3682/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:10190 errors:0 dropped:0 overruns:0 frame:0
TX packets:9692 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:764139 (746.2 KiB) TX bytes:3352275 (3.1 MiB)
eth0 Link encap:Ethernet HWaddr C0:4A:00:EB:36:83
inet addr:192.168.175.103 Bcast:192.168.175.255 Mask:255.255.255.0
inet6 addr: fe80::c24a:ff:feeb:3683/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:8150 errors:0 dropped:0 overruns:0 frame:0
TX packets:5979 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:4860206 (4.6 MiB) TX bytes:633752 (618.8 KiB)
Interrupt:4
eth1 Link encap:Ethernet HWaddr C0:4A:00:EB:36:82
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:17632 errors:0 dropped:10 overruns:0 frame:0
TX packets:17019 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1612105 (1.5 MiB) TX bytes:6992443 (6.6 MiB)
Interrupt:5
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:192 errors:0 dropped:0 overruns:0 frame:0
TX packets:192 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:17081 (16.6 KiB) TX bytes:17081 (16.6 KiB)
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.170.6 P-t-P:192.168.170.5 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:61 errors:0 dropped:0 overruns:0 frame:0
TX packets:437 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:5506 (5.3 KiB) TX bytes:22412 (21.8 KiB)
root@OpenWrt:/tmp#
Server openvpn.log:
root@gnpramnode:~# cat /tmp/openvpn.log
Wed Aug 20 17:25:01 2014 OpenVPN 2.3.2 i686-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Feb 4 2014
Wed Aug 20 17:25:01 2014 Diffie-Hellman initialized with 2048 bit key
Wed Aug 20 17:25:01 2014 Socket Buffers: R=[30000000->131072] S=[30000000->131072]
Wed Aug 20 17:25:01 2014 ROUTE_GATEWAY ON_LINK IFACE=venet0 HWADDR=00:00:00:00:00:00
Wed Aug 20 17:25:01 2014 TUN/TAP device tun0 opened
Wed Aug 20 17:25:01 2014 TUN/TAP TX queue length set to 100
Wed Aug 20 17:25:01 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Aug 20 17:25:01 2014 /sbin/ip link set dev tun0 up mtu 1500
Wed Aug 20 17:25:01 2014 /sbin/ip addr add dev tun0 local 192.168.170.1 peer 192.168.170.2
Wed Aug 20 17:25:01 2014 /sbin/ip route add 192.168.170.0/24 via 192.168.170.2
Wed Aug 20 17:25:01 2014 UDPv4 link local (bound): [undef]
Wed Aug 20 17:25:01 2014 UDPv4 link remote: [undef]
Wed Aug 20 17:25:01 2014 MULTI: multi_init called, r=256 v=256
Wed Aug 20 17:25:01 2014 IFCONFIG POOL: base=192.168.170.4 size=62, ipv6=0
Wed Aug 20 17:25:01 2014 ifconfig_pool_read(), in='gnp-node1,192.168.170.4', TODO: IPv6
Wed Aug 20 17:25:01 2014 succeeded -> ifconfig_pool_set()
Wed Aug 20 17:25:01 2014 IFCONFIG POOL LIST
Wed Aug 20 17:25:01 2014 gnp-node1,192.168.170.4
Wed Aug 20 17:25:01 2014 Initialization Sequence Completed
Wed Aug 20 17:25:28 2014 206.xx.xx.xx:12212 TLS: Initial packet from [AF_INET]206.xx.xx.xx:12212, sid=3589ef8e eb4e705f
Wed Aug 20 17:25:29 2014 206.xx.xx.xx:12212 VERIFY OK: depth=1, C=CA, ST=AB, L=Calgary, O=GNP, OU=140804-2, CN=gnpvpn140804, name=140804-2, emailAddress=cd@greatnorthernpower.com
Wed Aug 20 17:25:29 2014 206.xx.xx.xx:12212 VERIFY OK: depth=0, C=CA, ST=AB, L=Calgary, O=GNP, OU=140804-2, CN=gnp-node1, name=140804-2, emailAddress=cd@greatnorthernpower.com
Wed Aug 20 17:25:29 2014 206.xx.xx.xx:12212 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Aug 20 17:25:29 2014 206.xx.xx.xx:12212 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 20 17:25:29 2014 206.xx.xx.xx:12212 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Aug 20 17:25:29 2014 206.xx.xx.xx:12212 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 20 17:25:29 2014 206.xx.xx.xx:12212 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Aug 20 17:25:29 2014 206.xx.xx.xx:12212 [gnp-node1] Peer Connection Initiated with [AF_INET]206.xx.xx.xx:12212
Wed Aug 20 17:25:29 2014 gnp-node1/206.xx.xx.xx:12212 MULTI_sva: pool returned IPv4=192.168.170.6, IPv6=(Not enabled)
Wed Aug 20 17:25:29 2014 gnp-node1/206.xx.xx.xx:12212 MULTI: Learn: 192.168.170.6 -> gnp-node1/206.xx.xx.xx:12212
Wed Aug 20 17:25:29 2014 gnp-node1/206.xx.xx.xx:12212 MULTI: primary virtual IP for gnp-node1/206.xx.xx.xx:12212: 192.168.170.6
Wed Aug 20 17:25:31 2014 gnp-node1/206.xx.xx.xx:12212 PUSH: Received control message: 'PUSH_REQUEST'
Wed Aug 20 17:25:31 2014 gnp-node1/206.xx.xx.xx:12212 send_push_reply(): safe_cap=940
Wed Aug 20 17:25:31 2014 gnp-node1/206.xx.xx.xx:12212 SENT CONTROL [gnp-node1]: 'PUSH_REPLY,redirect-gateway def1,route 192.168.170.0 255.255.255.0,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 192.168.170.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.170.6 192.168.170.5' (status=1)
Wed Aug 20 17:37:37 2014 gnp-node1/206.xx.xx.xx:12212 TLS: new session incoming connection from [AF_INET]206.xx.xx.xx:12212
Wed Aug 20 17:37:39 2014 gnp-node1/206.xx.xx.xx:12212 VERIFY OK: depth=1, C=CA, ST=AB, L=Calgary, O=GNP, OU=140804-2, CN=gnpvpn140804, name=140804-2, emailAddress=cd@greatnorthernpower.com
Wed Aug 20 17:37:39 2014 gnp-node1/206.xx.xx.xx:12212 VERIFY OK: depth=0, C=CA, ST=AB, L=Calgary, O=GNP, OU=140804-2, CN=gnp-node1, name=140804-2, emailAddress=cd@greatnorthernpower.com
Wed Aug 20 17:37:39 2014 gnp-node1/206.xx.xx.xx:12212 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Aug 20 17:37:39 2014 gnp-node1/206.xx.xx.xx:12212 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 20 17:37:39 2014 gnp-node1/206.xx.xx.xx:12212 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Aug 20 17:37:39 2014 gnp-node1/206.xx.xx.xx:12212 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 20 17:37:39 2014 gnp-node1/206.xx.xx.xx:12212 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Wed Aug 20 17:37:39 2014 gnp-node1/206.xx.xx.xx:12212 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Wed Aug 20 17:37:39 2014 gnp-node1/206.xx.xx.xx:12212 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Aug 20 17:37:41 2014 gnp-node1/206.xx.xx.xx:12212 PUSH: Received control message: 'PUSH_REQUEST'
Wed Aug 20 17:37:41 2014 gnp-node1/206.xx.xx.xx:12212 send_push_reply(): safe_cap=940
Wed Aug 20 17:37:41 2014 gnp-node1/206.xx.xx.xx:12212 SENT CONTROL [gnp-node1]: 'PUSH_REPLY,redirect-gateway def1,route 192.168.170.0 255.255.255.0,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 192.168.170.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.170.6 192.168.170.5' (status=1)
Wed Aug 20 17:54:22 2014 gnp-node1/206.xx.xx.xx:12212 [gnp-node1] Inactivity timeout (--ping-restart), restarting
Wed Aug 20 17:54:22 2014 gnp-node1/206.xx.xx.xx:12212 SIGUSR1[soft,ping-restart] received, client-instance restarting
Wed Aug 20 18:02:34 2014 206.xx.xx.xx:12212 TLS: Initial packet from [AF_INET]206.xx.xx.xx:12212, sid=a8e61299 7b8ab006
Wed Aug 20 18:02:36 2014 206.xx.xx.xx:12212 VERIFY OK: depth=1, C=CA, ST=AB, L=Calgary, O=GNP, OU=140804-2, CN=gnpvpn140804, name=140804-2, emailAddress=cd@greatnorthernpower.com
Wed Aug 20 18:02:36 2014 206.xx.xx.xx:12212 VERIFY OK: depth=0, C=CA, ST=AB, L=Calgary, O=GNP, OU=140804-2, CN=gnp-node1, name=140804-2, emailAddress=cd@greatnorthernpower.com
Wed Aug 20 18:02:36 2014 206.xx.xx.xx:12212 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Aug 20 18:02:36 2014 206.xx.xx.xx:12212 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 20 18:02:36 2014 206.xx.xx.xx:12212 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Aug 20 18:02:36 2014 206.xx.xx.xx:12212 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 20 18:02:36 2014 206.xx.xx.xx:12212 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Aug 20 18:02:36 2014 206.xx.xx.xx:12212 [gnp-node1] Peer Connection Initiated with [AF_INET]206.xx.xx.xx:12212
Wed Aug 20 18:02:36 2014 gnp-node1/206.xx.xx.xx:12212 MULTI_sva: pool returned IPv4=192.168.170.6, IPv6=(Not enabled)
Wed Aug 20 18:02:36 2014 gnp-node1/206.xx.xx.xx:12212 MULTI: Learn: 192.168.170.6 -> gnp-node1/206.xx.xx.xx:12212
Wed Aug 20 18:02:36 2014 gnp-node1/206.xx.xx.xx:12212 MULTI: primary virtual IP for gnp-node1/206.xx.xx.xx:12212: 192.168.170.6
Wed Aug 20 18:02:38 2014 gnp-node1/206.xx.xx.xx:12212 PUSH: Received control message: 'PUSH_REQUEST'
Wed Aug 20 18:02:38 2014 gnp-node1/206.xx.xx.xx:12212 send_push_reply(): safe_cap=940
Wed Aug 20 18:02:38 2014 gnp-node1/206.xx.xx.xx:12212 SENT CONTROL [gnp-node1]: 'PUSH_REPLY,redirect-gateway def1,route 192.168.170.0 255.255.255.0,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 192.168.170.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.170.6 192.168.170.5' (status=1)
Wed Aug 20 18:07:53 2014 gnp-node1/206.xx.xx.xx:12212 [gnp-node1] Inactivity timeout (--ping-restart), restarting
Wed Aug 20 18:07:53 2014 gnp-node1/206.xx.xx.xx:12212 SIGUSR1[soft,ping-restart] received, client-instance restarting
Wed Aug 20 18:09:03 2014 206.xx.xx.xx:12212 TLS: Initial packet from [AF_INET]206.xx.xx.xx:12212, sid=9c42c1a0 b5abfff9
Wed Aug 20 18:09:05 2014 206.xx.xx.xx:12212 VERIFY OK: depth=1, C=CA, ST=AB, L=Calgary, O=GNP, OU=140804-2, CN=gnpvpn140804, name=140804-2, emailAddress=cd@greatnorthernpower.com
Wed Aug 20 18:09:05 2014 206.xx.xx.xx:12212 VERIFY OK: depth=0, C=CA, ST=AB, L=Calgary, O=GNP, OU=140804-2, CN=gnp-node1, name=140804-2, emailAddress=cd@greatnorthernpower.com
Wed Aug 20 18:09:05 2014 206.xx.xx.xx:12212 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Aug 20 18:09:05 2014 206.xx.xx.xx:12212 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 20 18:09:05 2014 206.xx.xx.xx:12212 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Aug 20 18:09:05 2014 206.xx.xx.xx:12212 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 20 18:09:05 2014 206.xx.xx.xx:12212 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Aug 20 18:09:05 2014 206.xx.xx.xx:12212 [gnp-node1] Peer Connection Initiated with [AF_INET]206.xx.xx.xx:12212
Wed Aug 20 18:09:05 2014 gnp-node1/206.xx.xx.xx:12212 MULTI_sva: pool returned IPv4=192.168.170.6, IPv6=(Not enabled)
Wed Aug 20 18:09:05 2014 gnp-node1/206.xx.xx.xx:12212 MULTI: Learn: 192.168.170.6 -> gnp-node1/206.xx.xx.xx:12212
Wed Aug 20 18:09:05 2014 gnp-node1/206.xx.xx.xx:12212 MULTI: primary virtual IP for gnp-node1/206.xx.xx.xx:12212: 192.168.170.6
Wed Aug 20 18:09:07 2014 gnp-node1/206.xx.xx.xx:12212 PUSH: Received control message: 'PUSH_REQUEST'
Wed Aug 20 18:09:07 2014 gnp-node1/206.xx.xx.xx:12212 send_push_reply(): safe_cap=940
Wed Aug 20 18:09:07 2014 gnp-node1/206.xx.xx.xx:12212 SENT CONTROL [gnp-node1]: 'PUSH_REPLY,redirect-gateway def1,route 192.168.170.0 255.255.255.0,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 192.168.170.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.170.6 192.168.170.5' (status=1)
Wed Aug 20 18:17:30 2014 gnp-node1/206.xx.xx.xx:12212 [gnp-node1] Inactivity timeout (--ping-restart), restarting
Wed Aug 20 18:17:30 2014 gnp-node1/206.xx.xx.xx:12212 SIGUSR1[soft,ping-restart] received, client-instance restarting
Wed Aug 20 18:38:03 2014 206.xx.xx.xx:3427 TLS: Initial packet from [AF_INET]206.xx.xx.xx:3427, sid=9e0e5c37 0182b15a
Wed Aug 20 18:38:04 2014 206.xx.xx.xx:3427 VERIFY OK: depth=1, C=CA, ST=AB, L=Calgary, O=GNP, OU=140804-2, CN=gnpvpn140804, name=140804-2, emailAddress=cd@greatnorthernpower.com
Wed Aug 20 18:38:04 2014 206.xx.xx.xx:3427 VERIFY OK: depth=0, C=CA, ST=AB, L=Calgary, O=GNP, OU=140804-2, CN=gnp-node1, name=140804-2, emailAddress=cd@greatnorthernpower.com
Wed Aug 20 18:38:04 2014 206.xx.xx.xx:3427 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Aug 20 18:38:04 2014 206.xx.xx.xx:3427 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 20 18:38:04 2014 206.xx.xx.xx:3427 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Aug 20 18:38:04 2014 206.xx.xx.xx:3427 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 20 18:38:04 2014 206.xx.xx.xx:3427 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Aug 20 18:38:04 2014 206.xx.xx.xx:3427 [gnp-node1] Peer Connection Initiated with [AF_INET]206.xx.xx.xx:3427
Wed Aug 20 18:38:04 2014 gnp-node1/206.xx.xx.xx:3427 MULTI_sva: pool returned IPv4=192.168.170.6, IPv6=(Not enabled)
Wed Aug 20 18:38:04 2014 gnp-node1/206.xx.xx.xx:3427 MULTI: Learn: 192.168.170.6 -> gnp-node1/206.xx.xx.xx:3427
Wed Aug 20 18:38:04 2014 gnp-node1/206.xx.xx.xx:3427 MULTI: primary virtual IP for gnp-node1/206.xx.xx.xx:3427: 192.168.170.6
Wed Aug 20 18:38:07 2014 gnp-node1/206.xx.xx.xx:3427 PUSH: Received control message: 'PUSH_REQUEST'
Wed Aug 20 18:38:07 2014 gnp-node1/206.xx.xx.xx:3427 send_push_reply(): safe_cap=940
Wed Aug 20 18:38:07 2014 gnp-node1/206.xx.xx.xx:3427 SENT CONTROL [gnp-node1]: 'PUSH_REPLY,redirect-gateway def1,route 192.168.170.0 255.255.255.0,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 192.168.170.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.170.6 192.168.170.5' (status=1)
Wed Aug 20 18:47:05 2014 gnp-node1/206.xx.xx.xx:3427 [gnp-node1] Inactivity timeout (--ping-restart), restarting
Wed Aug 20 18:47:05 2014 gnp-node1/206.xx.xx.xx:3427 SIGUSR1[soft,ping-restart] received, client-instance restarting
Wed Aug 20 18:49:50 2014 206.xx.xx.xx:3427 TLS: Initial packet from [AF_INET]206.xx.xx.xx:3427, sid=aebfc64f f89bb84c
Wed Aug 20 18:49:52 2014 206.xx.xx.xx:3427 VERIFY OK: depth=1, C=CA, ST=AB, L=Calgary, O=GNP, OU=140804-2, CN=gnpvpn140804, name=140804-2, emailAddress=cd@greatnorthernpower.com
Wed Aug 20 18:49:52 2014 206.xx.xx.xx:3427 VERIFY OK: depth=0, C=CA, ST=AB, L=Calgary, O=GNP, OU=140804-2, CN=gnp-node1, name=140804-2, emailAddress=cd@greatnorthernpower.com
Wed Aug 20 18:49:52 2014 206.xx.xx.xx:3427 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Aug 20 18:49:52 2014 206.xx.xx.xx:3427 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 20 18:49:52 2014 206.xx.xx.xx:3427 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Aug 20 18:49:52 2014 206.xx.xx.xx:3427 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 20 18:49:52 2014 206.xx.xx.xx:3427 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Aug 20 18:49:52 2014 206.xx.xx.xx:3427 [gnp-node1] Peer Connection Initiated with [AF_INET]206.xx.xx.xx:3427
Wed Aug 20 18:49:52 2014 gnp-node1/206.xx.xx.xx:3427 MULTI_sva: pool returned IPv4=192.168.170.6, IPv6=(Not enabled)
Wed Aug 20 18:49:52 2014 gnp-node1/206.xx.xx.xx:3427 MULTI: Learn: 192.168.170.6 -> gnp-node1/206.xx.xx.xx:3427
Wed Aug 20 18:49:52 2014 gnp-node1/206.xx.xx.xx:3427 MULTI: primary virtual IP for gnp-node1/206.xx.xx.xx:3427: 192.168.170.6
Wed Aug 20 18:49:54 2014 gnp-node1/206.xx.xx.xx:3427 PUSH: Received control message: 'PUSH_REQUEST'
Wed Aug 20 18:49:54 2014 gnp-node1/206.xx.xx.xx:3427 send_push_reply(): safe_cap=940
Wed Aug 20 18:49:54 2014 gnp-node1/206.xx.xx.xx:3427 SENT CONTROL [gnp-node1]: 'PUSH_REPLY,redirect-gateway def1,route 192.168.170.0 255.255.255.0,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 192.168.170.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.170.6 192.168.170.5' (status=1)
root@gnpramnode:~#
Client openvpn.log:
root@OpenWrt:/tmp# cat openvpn.log
Wed Aug 20 22:49:50 2014 OpenVPN 2.3.4 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jul 11 2014
Wed Aug 20 22:49:50 2014 library versions: OpenSSL 1.0.1h 5 Jun 2014, LZO 2.06
Wed Aug 20 22:49:50 2014 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Wed Aug 20 22:49:50 2014 WARNING: file '/etc/openvpn/gnp-node1.key' is group or others accessible
Wed Aug 20 22:49:50 2014 Socket Buffers: R=[163840->131072] S=[163840->131072]
Wed Aug 20 22:49:50 2014 UDPv4 link local (bound): [undef]
Wed Aug 20 22:49:50 2014 UDPv4 link remote: [AF_INET]107.xx.xx.xx:1194
Wed Aug 20 22:49:50 2014 TLS: Initial packet from [AF_INET]107.xx.xx.xx:1194, sid=70661304 4ed13dd0
Wed Aug 20 22:49:50 2014 VERIFY OK: depth=1, C=CA, ST=AB, L=Calgary, O=GNP, OU=140804-2, CN=gnpvpn140804, name=140804-2, emailAddress=cd@greatnorthernpower.com
Wed Aug 20 22:49:50 2014 VERIFY OK: depth=0, C=CA, ST=AB, L=Calgary, O=GNP, OU=140804-2, CN=gnpvpn140804-serv, name=140804-2, emailAddress=cd@greatnorthernpower.com
Wed Aug 20 22:49:52 2014 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Aug 20 22:49:52 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 20 22:49:52 2014 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Aug 20 22:49:52 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 20 22:49:52 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Aug 20 22:49:52 2014 [gnpvpn140804-serv] Peer Connection Initiated with [AF_INET]107.xx.xx.xx:1194
Wed Aug 20 22:49:54 2014 SENT CONTROL [gnpvpn140804-serv]: 'PUSH_REQUEST' (status=1)
Wed Aug 20 22:49:54 2014 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route 192.168.170.0 255.255.255.0,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 192.168.170.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.170.6 192.168.170.5'
Wed Aug 20 22:49:54 2014 OPTIONS IMPORT: timers and/or timeouts modified
Wed Aug 20 22:49:54 2014 OPTIONS IMPORT: --ifconfig/up options modified
Wed Aug 20 22:49:54 2014 OPTIONS IMPORT: route options modified
Wed Aug 20 22:49:54 2014 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Aug 20 22:49:54 2014 TUN/TAP device tun0 opened
Wed Aug 20 22:49:54 2014 TUN/TAP TX queue length set to 100
Wed Aug 20 22:49:54 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Aug 20 22:49:54 2014 /sbin/ifconfig tun0 192.168.170.6 pointopoint 192.168.170.5 mtu 1500
Wed Aug 20 22:49:54 2014 /sbin/route add -net 107.xx.xx.xx netmask 255.255.255.255 gw 192.168.175.5
Wed Aug 20 22:49:54 2014 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 192.168.170.5
Wed Aug 20 22:49:54 2014 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 192.168.170.5
Wed Aug 20 22:49:54 2014 /sbin/route add -net 192.168.170.0 netmask 255.255.255.0 gw 192.168.170.5
Wed Aug 20 22:49:54 2014 /sbin/route add -net 192.168.170.0 netmask 255.255.255.0 gw 192.168.170.5
route: SIOCADDRT: File exists
Wed Aug 20 22:49:54 2014 ERROR: Linux route add command failed: external program exited with error status: 1
Wed Aug 20 22:49:54 2014 Initialization Sequence Completed
root@OpenWrt:/tmp#
Server iptables -L output:
root@gnpramnode:~# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT udp -- anywhere anywhere udp dpt:openvpn
ACCEPT tcp -- anywhere anywhere tcp flags:ACK/ACK
ACCEPT udp -- anywhere anywhere udp spt:domain dpts:1024:65535
ACCEPT icmp -- anywhere anywhere icmp echo-reply
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
ACCEPT icmp -- anywhere anywhere icmp source-quench
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
ACCEPT icmp -- anywhere anywhere icmp parameter-problem
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT udp -- anywhere anywhere udp dpts:33434:33523
ACCEPT icmp -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- 192.168.170.0/24 anywhere
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Client iptables -L output:
root@OpenWrt:/tmp# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
delegate_input all -- anywhere anywhere
Chain FORWARD (policy DROP)
target prot opt source destination
delegate_forward all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
delegate_output all -- anywhere anywhere
Chain delegate_forward (1 references)
target prot opt source destination
forwarding_rule all -- anywhere anywhere /* user chain for forwarding */
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
zone_wan_forward all -- anywhere anywhere
zone_gnp_vpn_lan_forward all -- anywhere anywhere
zone_gnp_vpn_lan_forward all -- anywhere anywhere
reject all -- anywhere anywhere
Chain delegate_input (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
input_rule all -- anywhere anywhere /* user chain for input */
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
syn_flood tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN
ACCEPT udp -- anywhere anywhere udp dpt:openvpn /* Allow-OpenVPN-Inbound */
zone_wan_input all -- anywhere anywhere
zone_gnp_vpn_lan_input all -- anywhere anywhere
zone_gnp_vpn_lan_input all -- anywhere anywhere
Chain delegate_output (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
output_rule all -- anywhere anywhere /* user chain for output */
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
zone_wan_output all -- anywhere anywhere
zone_gnp_vpn_lan_output all -- anywhere anywhere
zone_gnp_vpn_lan_output all -- anywhere anywhere
Chain forwarding_lan_rule (1 references)
target prot opt source destination
Chain forwarding_rule (1 references)
target prot opt source destination
Chain forwarding_vpn_rule (1 references)
target prot opt source destination
Chain forwarding_wan_rule (1 references)
target prot opt source destination
Chain input_lan_rule (1 references)
target prot opt source destination
Chain input_rule (1 references)
target prot opt source destination
Chain input_vpn_rule (1 references)
target prot opt source destination
Chain input_wan_rule (1 references)
target prot opt source destination
Chain output_lan_rule (1 references)
target prot opt source destination
Chain output_rule (1 references)
target prot opt source destination
Chain output_vpn_rule (1 references)
target prot opt source destination
Chain output_wan_rule (1 references)
target prot opt source destination
Chain reject (2 references)
target prot opt source destination
REJECT tcp -- anywhere anywhere reject-with tcp-reset
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain syn_flood (1 references)
target prot opt source destination
RETURN tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN limit: avg 25/sec burst 50
DROP all -- anywhere anywhere
Chain zone_gnp_vpn_lan_dest_ACCEPT (3 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain zone_gnp_vpn_lan_forward (2 references)
target prot opt source destination
zone_lan_dest_ACCEPT all -- anywhere anywhere /* forwarding gnp_vpn_lan -> lan */
zone_vpn_dest_ACCEPT all -- anywhere anywhere /* forwarding gnp_vpn_lan -> vpn */
ACCEPT all -- anywhere anywhere ctstate DNAT /* Accept port forwards */
zone_gnp_vpn_lan_src_ACCEPT all -- anywhere anywhere
Chain zone_gnp_vpn_lan_input (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere ctstate DNAT /* Accept port redirections */
zone_gnp_vpn_lan_src_ACCEPT all -- anywhere anywhere
Chain zone_gnp_vpn_lan_output (2 references)
target prot opt source destination
zone_gnp_vpn_lan_dest_ACCEPT all -- anywhere anywhere
Chain zone_gnp_vpn_lan_src_ACCEPT (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain zone_gnpvpn1_forward (0 references)
target prot opt source destination
Chain zone_gnpvpn1_input (0 references)
target prot opt source destination
Chain zone_gnpvpn1_output (0 references)
target prot opt source destination
Chain zone_lan_dest_ACCEPT (2 references)
target prot opt source destination
Chain zone_lan_forward (0 references)
target prot opt source destination
forwarding_lan_rule all -- anywhere anywhere /* user chain for forwarding */
zone_wan_dest_ACCEPT all -- anywhere anywhere /* forwarding lan -> wan */
zone_gnp_vpn_lan_dest_ACCEPT all -- anywhere anywhere /* forwarding lan -> gnp_vpn_lan */
ACCEPT all -- anywhere anywhere ctstate DNAT /* Accept port forwards */
zone_lan_src_ACCEPT all -- anywhere anywhere
Chain zone_lan_input (0 references)
target prot opt source destination
input_lan_rule all -- anywhere anywhere /* user chain for input */
ACCEPT all -- anywhere anywhere ctstate DNAT /* Accept port redirections */
zone_lan_src_ACCEPT all -- anywhere anywhere
Chain zone_lan_output (0 references)
target prot opt source destination
output_lan_rule all -- anywhere anywhere /* user chain for output */
zone_lan_dest_ACCEPT all -- anywhere anywhere
Chain zone_lan_src_ACCEPT (2 references)
target prot opt source destination
Chain zone_newzone_forward (0 references)
target prot opt source destination
Chain zone_newzone_input (0 references)
target prot opt source destination
Chain zone_newzone_output (0 references)
target prot opt source destination
Chain zone_vpn_dest_ACCEPT (2 references)
target prot opt source destination
Chain zone_vpn_forward (0 references)
target prot opt source destination
forwarding_vpn_rule all -- anywhere anywhere /* user chain for forwarding */
zone_gnp_vpn_lan_dest_ACCEPT all -- anywhere anywhere /* forwarding vpn -> gnp_vpn_lan */
ACCEPT all -- anywhere anywhere ctstate DNAT /* Accept port forwards */
zone_vpn_src_ACCEPT all -- anywhere anywhere
Chain zone_vpn_input (0 references)
target prot opt source destination
input_vpn_rule all -- anywhere anywhere /* user chain for input */
ACCEPT all -- anywhere anywhere ctstate DNAT /* Accept port redirections */
zone_vpn_src_ACCEPT all -- anywhere anywhere
Chain zone_vpn_output (0 references)
target prot opt source destination
output_vpn_rule all -- anywhere anywhere /* user chain for output */
zone_vpn_dest_ACCEPT all -- anywhere anywhere
Chain zone_vpn_src_ACCEPT (2 references)
target prot opt source destination
Chain zone_vpnforward_forward (0 references)
target prot opt source destination
Chain zone_vpnforward_input (0 references)
target prot opt source destination
Chain zone_vpnforward_output (0 references)
target prot opt source destination
Chain zone_wan_dest_ACCEPT (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
Chain zone_wan_forward (1 references)
target prot opt source destination
forwarding_wan_rule all -- anywhere anywhere /* user chain for forwarding */
ACCEPT all -- anywhere anywhere ctstate DNAT /* Accept port forwards */
zone_wan_src_REJECT all -- anywhere anywhere
Chain zone_wan_input (1 references)
target prot opt source destination
input_wan_rule all -- anywhere anywhere /* user chain for input */
ACCEPT udp -- anywhere anywhere udp dpt:bootpc /* Allow-DHCP-Renew */
ACCEPT icmp -- anywhere anywhere icmp echo-request /* Allow-Ping */
ACCEPT all -- anywhere anywhere ctstate DNAT /* Accept port redirections */
zone_wan_src_REJECT all -- anywhere anywhere
Chain zone_wan_output (1 references)
target prot opt source destination
output_wan_rule all -- anywhere anywhere /* user chain for output */
zone_wan_dest_ACCEPT all -- anywhere anywhere
Chain zone_wan_src_REJECT (2 references)
target prot opt source destination
reject all -- anywhere anywhere
root@OpenWrt:/tmp#
Server iptables -t nat -L output:
root@gnpramnode:~# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- anywhere anywhere to:107.xx.xx.xx
SNAT all -- 192.168.170.0/24 anywhere to:107.xx.xx.xx
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
root@gnpramnode:~#
Client iptables -t nat -L output:
Chain delegate_postrouting (1 references)
target prot opt source destination
postrouting_rule all -- anywhere anywhere /* user chain for postrouting */
zone_wan_postrouting all -- anywhere anywhere
zone_gnp_vpn_lan_postrouting all -- anywhere anywhere
zone_gnp_vpn_lan_postrouting all -- anywhere anywhere
Chain delegate_prerouting (1 references)
target prot opt source destination
prerouting_rule all -- anywhere anywhere /* user chain for prerouting */
zone_wan_prerouting all -- anywhere anywhere
zone_gnp_vpn_lan_prerouting all -- anywhere anywhere
zone_gnp_vpn_lan_prerouting all -- anywhere anywhere
