VPN Connection working, but black hole afterwards

ionasOHG

Hi everybody,

please help me to find my fault. I am totaly depressed because I have no glue why this is not working.

I want
OPENVPN-Client (Ubuntu Notebook with UMTS) --> Internet --> PFSense Firewall --> OpenVPN-Server (Ubuntu Server)

What is working:
- I can establish a connection from the Client to the OpenVPN-Server. All devices can ping each other. Even I can open local webpages or samba shares on 192.168.5.205 or 192.168.5.4 (other server on the lan).
IP-Client: 10.8.0.6
IP-Server (tun0): 10.8.0.1
IP-Server (eth0): 192.168.5.205
IP-PFSense Gateway: 192.168.5.1

My Configurations:
/etc/openvpn/server.conf (reduced to the most important things)
dev tun
server 10.8.0.0 255.255.255.0
push "route 192.168.5.0 255.255.255.0"
push "redirect-gateway"

/etc/network/iptables
*nat
: POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/24 -d 192.168.5.0/24 -j SNAT --to-source 192.168.5.205
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MAQUERADE
COMMIT

I can confirm that all traffic is routed through the VPN.

ip route show (on the server)
default via 192.168.5.1 dev eth0
10.8.0.0/24 via 10.8.0.2 dev tun0
10.8.0.2 dev tun0 proto kernel scope link src 10.8.0.1
192.168.5.0/24 dev eth0 proto kernel sceope link src 192.168.5.205

Problem 1:
- I can ping from the client http://www.google.de and it shows me the IP 173.194.39.23
- I can do traceroute http://www.google.de and it takes quite a long time:
1 10.8.0.1 80 ms
2 37.148.137.57 500ms
3 217.0.67.250 600ms
...
- But if i try to open http://www.google.de on the page it shows me a "timeout"
- I can see no blocked packages in my pfsense firewall from the source 10.8.*

Assumption 1:
can you confirm that I have internet access via openvpn. Otherwise it should not be possible to ping anything.
but where is the problem that I can not open url pages? Is the channel back blocked? How can I debug where the problem is?

Problem 2:
- I can open via openvpn all different clients in the lan (I can open 192.168.5.* via openvpn).
- But some pages are not shown correctly. For example If I open seafile via 192.168.5.205 from the LAN everything is perfect.
- If I open same page via openvpn it show me only half of the page and it seems like the computer has huge problems to resolve the url.

Do you have any idea what the problem is? It is pfsense? Is it iptables?
Thanks for your help.

Traffic

Your server & client configs & logs would help a lot.

I am not sure you require both of these:

ionasOHG wrote/etc/network/iptables
*nat
: POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/24 -d 192.168.5.0/24 -j SNAT --to-source 192.168.5.205 ### Delete this
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MAQUERADE
COMMIT

I would remove the first one as the second will NAT your connections to the server eth0

Finally, check your pfsense firewall logs for problems.

ionasOHG

client.conf


client
dev tun
proto udp
remote 192.168.5.205 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ns-cert-type server
comp-lzo
verb 3

<key>
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDPV89QM2GPXy0u
... shortened ....
-----END PRIVATE KEY-----
</key>

<cert>
-----BEGIN CERTIFICATE-----
MIIFXjCCBEagAwIBAgIBAjANBgkqhkiG9w0BAQsFADCBrzELMAkGA1UEBhMCREUx
... shortened ....
-----END CERTIFICATE-----
</cert>

<ca>
-----BEGIN CERTIFICATE-----
MIIE/TCCA+WgAwIBAgIJALOAqeTqNfpLMA0GCSqGSIb3DQEBCwUAMIGvMQswCQYD
... shortened ....
-----END CERTIFICATE-----
</ca>

server.conf

port 1194
proto udp
dev tun
ca ./easy-rsa2/keys/ca.crt
cert ./easy-rsa2/keys/server.crt
key ./easy-rsa2/keys/server.key
dh ./easy-rsa2/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.5.0 255.255.255.0"
push "dhcp-option DNS 192.168.5.1"
push "redirect-gateway"
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

Traffic

ionasOHG wroteclient.conf
Code:

client
dev tun
proto udp
remote 192.168.5.205 1194

And the real IP address of your client ethernet ?

ionasOHG

Hi,
sorry for the error.
Of cause I have a static IP (business DSL) that I used in the client.conf.

Just for clarification:

the client is using UMTS and has an IP from Deutsche Telekom.
the server has a static ip due to a business DSL Account
the local lan network is 192.168.5.* (eth0)
the openerp subnet is 10.8.0.* (tun0)

Best regards
Christoph

Traffic

Does the client have a LAN IP or is it directly connected to the internet ?
And are you testing it on the same LAN or is it over the internet ?

Also, please post your preferentially censored logs at verb 4

ionasOHG

Hi Traffic,

here is the complete picture:

[Client]
ubuntu-client with umts connection (deutsche Telekom, temporary IP: 17.xxx, no connection to any lan)

## the client.conf is:
client
dev tun
proto udp
remote 37.148.137.58
port 1194
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 4
status openvpn-status.log
log openvpn.log

<key>
-----BEGIN PRIVATE KEY-----
MIIEvgI...
-----END PRIVATE KEY-----
</key>

<cert>
-----BEGIN CERTIFICATE-----
MIIFXjCC...
-----END CERTIFICATE-----
</cert>

<ca>
-----BEGIN CERTIFICATE-----
MIIE/TCCA+Wg...
-----END CERTIFICATE-----
</ca>

[Server]
Ubuntu Server 14.04 with openvpn. IP 192.168.5.205

### server.conf
port 1194
proto udp
dev tun
ca ./easy-rsa2/keys/ca.crt
cert ./easy-rsa2/keys/server.crt
key ./easy-rsa2/keys/server.key  # This file should be kept secret
dh ./easy-rsa2/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.5.0 255.255.255.0"
push "dhcp-option DNS 10.8.0.1"
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
comp-lzo
max-clients 10
user nobody
group nogroup
persist-key
persist-tun
verb 4
status openvpn-status.log
log openvpn.log

I have a pfsense with port forwarding of port 1194 to 192.168.5.205.
I can establish the openvpn connection.
If I don't change add any iptables rule on the server I can only ping 10.8.0.1 from the client. (The client has 10.8.0.6)
There is no pinging and tracerouting to the WAN or LAN (192.168.5.*). The client is captured to the server.

Then I add the following iptables rules

*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1161:105847]
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -p udp --dport 1194 -j ACCEPT
-A INPUT -p tcp --dport 80 -j ACCEPT

COMMIT

*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/24 -d 192.168.5.0/24 -j SNAT --to-source 192.168.5.205
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT

As soon as I do a

sudo iptables-restore < /etc/network/iptables

I can ping 192.168.5.205 and other clients on the 192.168.5.* lan.
I can do traceroute http://www.google.de and even in the firefox it shows me "connected to http://www.google.de" in the status bar.
BUT http://www.google.de does not open.

Concrete example: if I open 192.168.5.205 from an other pc in the lan it shows me that:
https://dl.dropboxusercontent.com/u/473785/seafile-from-lan.png

If I open 192.168.5.205 via openvpn it shows me that:
https://dl.dropboxusercontent.com/u/473785/seafile-via-openvpn.png

Conclusion:
in my opinion the openvpn connection is established but there are some obsticles to get data from WAN and LAN.

Here are the log files:

## openvpn-status.log from client
OpenVPN STATISTICS
Updated,Thu Dec  4 05:56:07 2014
TUN/TAP read bytes,0
TUN/TAP write bytes,0
TCP/UDP read bytes,0
TCP/UDP write bytes,0
Auth read bytes,0
pre-compress bytes,0
post-compress bytes,0
pre-decompress bytes,0
post-decompress bytes,0
END

## openvpn.log from client
Thu Dec  4 05:56:07 2014 us=755704 Current Parameter Settings:
Thu Dec  4 05:56:07 2014 us=755854   config = '/etc/openvpn/is-client.conf'
Thu Dec  4 05:56:07 2014 us=755866   mode = 0
Thu Dec  4 05:56:07 2014 us=755876   persist_config = DISABLED
Thu Dec  4 05:56:07 2014 us=755885   persist_mode = 1
Thu Dec  4 05:56:07 2014 us=755894   show_ciphers = DISABLED
Thu Dec  4 05:56:07 2014 us=755903   show_digests = DISABLED
Thu Dec  4 05:56:07 2014 us=755912   show_engines = DISABLED
Thu Dec  4 05:56:07 2014 us=755921   genkey = DISABLED
Thu Dec  4 05:56:07 2014 us=755930   key_pass_file = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=755939   show_tls_ciphers = DISABLED
Thu Dec  4 05:56:07 2014 us=755947 Connection profiles [default]:
Thu Dec  4 05:56:07 2014 us=755957   proto = udp
Thu Dec  4 05:56:07 2014 us=755966   local = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=755975   local_port = 0
Thu Dec  4 05:56:07 2014 us=755984   remote = '37.148.137.58'
Thu Dec  4 05:56:07 2014 us=755992   remote_port = 1194
Thu Dec  4 05:56:07 2014 us=756001   remote_float = DISABLED
Thu Dec  4 05:56:07 2014 us=756010   bind_defined = DISABLED
Thu Dec  4 05:56:07 2014 us=756019   bind_local = DISABLED
Thu Dec  4 05:56:07 2014 us=756028   connect_retry_seconds = 5
Thu Dec  4 05:56:07 2014 us=756037   connect_timeout = 10
Thu Dec  4 05:56:07 2014 us=756046   connect_retry_max = 0
Thu Dec  4 05:56:07 2014 us=756055   socks_proxy_server = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756064   socks_proxy_port = 0
Thu Dec  4 05:56:07 2014 us=756073   socks_proxy_retry = DISABLED
Thu Dec  4 05:56:07 2014 us=756082   tun_mtu = 1500
Thu Dec  4 05:56:07 2014 us=756091   tun_mtu_defined = ENABLED
Thu Dec  4 05:56:07 2014 us=756100   link_mtu = 1500
Thu Dec  4 05:56:07 2014 us=756109   link_mtu_defined = DISABLED
Thu Dec  4 05:56:07 2014 us=756118   tun_mtu_extra = 0
Thu Dec  4 05:56:07 2014 us=756127   tun_mtu_extra_defined = DISABLED
Thu Dec  4 05:56:07 2014 us=756136   mtu_discover_type = -1
Thu Dec  4 05:56:07 2014 us=756144   fragment = 0
Thu Dec  4 05:56:07 2014 us=756153   mssfix = 1450
Thu Dec  4 05:56:07 2014 us=756162   explicit_exit_notification = 0
Thu Dec  4 05:56:07 2014 us=756173 Connection profiles END
Thu Dec  4 05:56:07 2014 us=756183   remote_random = DISABLED
Thu Dec  4 05:56:07 2014 us=756192   ipchange = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756201   dev = 'tun'
Thu Dec  4 05:56:07 2014 us=756210   dev_type = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756218   dev_node = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756227   lladdr = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756236   topology = 1
Thu Dec  4 05:56:07 2014 us=756245   tun_ipv6 = DISABLED
Thu Dec  4 05:56:07 2014 us=756253   ifconfig_local = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756263   ifconfig_remote_netmask = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756271   ifconfig_noexec = DISABLED
Thu Dec  4 05:56:07 2014 us=756280   ifconfig_nowarn = DISABLED
Thu Dec  4 05:56:07 2014 us=756289   ifconfig_ipv6_local = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756298   ifconfig_ipv6_netbits = 0
Thu Dec  4 05:56:07 2014 us=756307   ifconfig_ipv6_remote = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756316   shaper = 0
Thu Dec  4 05:56:07 2014 us=756325   mtu_test = 0
Thu Dec  4 05:56:07 2014 us=756333   mlock = DISABLED
Thu Dec  4 05:56:07 2014 us=756342   keepalive_ping = 0
Thu Dec  4 05:56:07 2014 us=756351   keepalive_timeout = 0
Thu Dec  4 05:56:07 2014 us=756360   inactivity_timeout = 0
Thu Dec  4 05:56:07 2014 us=756369   ping_send_timeout = 0
Thu Dec  4 05:56:07 2014 us=756377   ping_rec_timeout = 0
Thu Dec  4 05:56:07 2014 us=756386   ping_rec_timeout_action = 0
Thu Dec  4 05:56:07 2014 us=756395   ping_timer_remote = DISABLED
Thu Dec  4 05:56:07 2014 us=756404   remap_sigusr1 = 0
Thu Dec  4 05:56:07 2014 us=756412   persist_tun = ENABLED
Thu Dec  4 05:56:07 2014 us=756421   persist_local_ip = DISABLED
Thu Dec  4 05:56:07 2014 us=756430   persist_remote_ip = DISABLED
Thu Dec  4 05:56:07 2014 us=756439   persist_key = ENABLED
Thu Dec  4 05:56:07 2014 us=756448   passtos = DISABLED
Thu Dec  4 05:56:07 2014 us=756457   resolve_retry_seconds = 1000000000
Thu Dec  4 05:56:07 2014 us=756474   username = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756483   groupname = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756492   chroot_dir = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756501   cd_dir = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756510   writepid = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756519   up_script = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756528   down_script = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756537   down_pre = DISABLED
Thu Dec  4 05:56:07 2014 us=756546   up_restart = DISABLED
Thu Dec  4 05:56:07 2014 us=756555   up_delay = DISABLED
Thu Dec  4 05:56:07 2014 us=756563   daemon = DISABLED
Thu Dec  4 05:56:07 2014 us=756572   inetd = 0
Thu Dec  4 05:56:07 2014 us=756581   log = ENABLED
Thu Dec  4 05:56:07 2014 us=756590   suppress_timestamps = DISABLED
Thu Dec  4 05:56:07 2014 us=756599   nice = 0
Thu Dec  4 05:56:07 2014 us=756608   verbosity = 4
Thu Dec  4 05:56:07 2014 us=756616   mute = 0
Thu Dec  4 05:56:07 2014 us=756625   gremlin = 0
Thu Dec  4 05:56:07 2014 us=756634   status_file = 'openvpn-status.log'
Thu Dec  4 05:56:07 2014 us=756643   status_file_version = 1
Thu Dec  4 05:56:07 2014 us=756652   status_file_update_freq = 60
Thu Dec  4 05:56:07 2014 us=756660   occ = ENABLED
Thu Dec  4 05:56:07 2014 us=756669   rcvbuf = 65536
Thu Dec  4 05:56:07 2014 us=756678   sndbuf = 65536
Thu Dec  4 05:56:07 2014 us=756687   mark = 0
Thu Dec  4 05:56:07 2014 us=756696   sockflags = 0
Thu Dec  4 05:56:07 2014 us=756704   fast_io = DISABLED
Thu Dec  4 05:56:07 2014 us=756713   lzo = 7
Thu Dec  4 05:56:07 2014 us=756722   route_script = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756731   route_default_gateway = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756740   route_default_metric = 0
Thu Dec  4 05:56:07 2014 us=756749   route_noexec = DISABLED
Thu Dec  4 05:56:07 2014 us=756758   route_delay = 0
Thu Dec  4 05:56:07 2014 us=756767   route_delay_window = 30
Thu Dec  4 05:56:07 2014 us=756776   route_delay_defined = DISABLED
Thu Dec  4 05:56:07 2014 us=756785   route_nopull = DISABLED
Thu Dec  4 05:56:07 2014 us=756794   route_gateway_via_dhcp = DISABLED
Thu Dec  4 05:56:07 2014 us=756803   max_routes = 100
Thu Dec  4 05:56:07 2014 us=756812   allow_pull_fqdn = DISABLED
Thu Dec  4 05:56:07 2014 us=756821   management_addr = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756830   management_port = 0
Thu Dec  4 05:56:07 2014 us=756839   management_user_pass = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756848   management_log_history_cache = 250
Thu Dec  4 05:56:07 2014 us=756857   management_echo_buffer_size = 100
Thu Dec  4 05:56:07 2014 us=756866   management_write_peer_info_file = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756875   management_client_user = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756884   management_client_group = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756893   management_flags = 0
Thu Dec  4 05:56:07 2014 us=756904   shared_secret_file = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=756913   key_direction = 0
Thu Dec  4 05:56:07 2014 us=756922   ciphername_defined = ENABLED
Thu Dec  4 05:56:07 2014 us=756931   ciphername = 'BF-CBC'
Thu Dec  4 05:56:07 2014 us=756940   authname_defined = ENABLED
Thu Dec  4 05:56:07 2014 us=756949   authname = 'SHA1'
Thu Dec  4 05:56:07 2014 us=756957   prng_hash = 'SHA1'
Thu Dec  4 05:56:07 2014 us=756966   prng_nonce_secret_len = 16
Thu Dec  4 05:56:07 2014 us=756975   keysize = 0
Thu Dec  4 05:56:07 2014 us=756984   engine = DISABLED
Thu Dec  4 05:56:07 2014 us=756993   replay = ENABLED
Thu Dec  4 05:56:07 2014 us=757002   mute_replay_warnings = DISABLED
Thu Dec  4 05:56:07 2014 us=757011   replay_window = 64
Thu Dec  4 05:56:07 2014 us=757020   replay_time = 15
Thu Dec  4 05:56:07 2014 us=757028   packet_id_file = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=757037   use_iv = ENABLED
Thu Dec  4 05:56:07 2014 us=757046   test_crypto = DISABLED
Thu Dec  4 05:56:07 2014 us=757055   tls_server = DISABLED
Thu Dec  4 05:56:07 2014 us=757064   tls_client = ENABLED
Thu Dec  4 05:56:07 2014 us=757073   key_method = 2
Thu Dec  4 05:56:07 2014 us=757082   ca_file = '[[INLINE]]'
Thu Dec  4 05:56:07 2014 us=757096   ca_path = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=757106   dh_file = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=757115   cert_file = '[[INLINE]]'
Thu Dec  4 05:56:07 2014 us=757124   priv_key_file = '[[INLINE]]'
Thu Dec  4 05:56:07 2014 us=757133   pkcs12_file = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=757142   cipher_list = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=757151   tls_verify = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=757160   tls_export_cert = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=757169   verify_x509_type = 0
Thu Dec  4 05:56:07 2014 us=757177   verify_x509_name = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=757186   crl_file = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=757195   ns_cert_type = 0
Thu Dec  4 05:56:07 2014 us=757204   remote_cert_ku[i] = 0
Thu Dec  4 05:56:07 2014 us=757213   remote_cert_ku[i] = 0
Thu Dec  4 05:56:07 2014 us=757222   remote_cert_ku[i] = 0
Thu Dec  4 05:56:07 2014 us=757231   remote_cert_ku[i] = 0
Thu Dec  4 05:56:07 2014 us=757239   remote_cert_ku[i] = 0
Thu Dec  4 05:56:07 2014 us=757248   remote_cert_ku[i] = 0
Thu Dec  4 05:56:07 2014 us=757257   remote_cert_ku[i] = 0
Thu Dec  4 05:56:07 2014 us=757266   remote_cert_ku[i] = 0
Thu Dec  4 05:56:07 2014 us=757274   remote_cert_ku[i] = 0
Thu Dec  4 05:56:07 2014 us=757283   remote_cert_ku[i] = 0
Thu Dec  4 05:56:07 2014 us=757291   remote_cert_ku[i] = 0
Thu Dec  4 05:56:07 2014 us=757300   remote_cert_ku[i] = 0
Thu Dec  4 05:56:07 2014 us=757309   remote_cert_ku[i] = 0
Thu Dec  4 05:56:07 2014 us=757318   remote_cert_ku[i] = 0
Thu Dec  4 05:56:07 2014 us=757326   remote_cert_ku[i] = 0
Thu Dec  4 05:56:07 2014 us=757335   remote_cert_ku[i] = 0
Thu Dec  4 05:56:07 2014 us=757344   remote_cert_eku = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=757353   ssl_flags = 0
Thu Dec  4 05:56:07 2014 us=757362   tls_timeout = 2
Thu Dec  4 05:56:07 2014 us=757371   renegotiate_bytes = 0
Thu Dec  4 05:56:07 2014 us=757380   renegotiate_packets = 0
Thu Dec  4 05:56:07 2014 us=757388   renegotiate_seconds = 3600
Thu Dec  4 05:56:07 2014 us=757397   handshake_window = 60
Thu Dec  4 05:56:07 2014 us=757406   transition_window = 3600
Thu Dec  4 05:56:07 2014 us=757415   single_session = DISABLED
Thu Dec  4 05:56:07 2014 us=757424   push_peer_info = DISABLED
Thu Dec  4 05:56:07 2014 us=757433   tls_exit = DISABLED
Thu Dec  4 05:56:07 2014 us=757442   tls_auth_file = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=757451   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:56:07 2014 us=757460   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:56:07 2014 us=757469   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:56:07 2014 us=757478   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:56:07 2014 us=757487   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:56:07 2014 us=757497   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:56:07 2014 us=757506   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:56:07 2014 us=757515   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:56:07 2014 us=757524   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:56:07 2014 us=757533   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:56:07 2014 us=757543   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:56:07 2014 us=757552   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:56:07 2014 us=757562   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:56:07 2014 us=757571   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:56:07 2014 us=757580   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:56:07 2014 us=757589   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:56:07 2014 us=757598   pkcs11_private_mode = 00000000
Thu Dec  4 05:56:07 2014 us=757607   pkcs11_private_mode = 00000000
Thu Dec  4 05:56:07 2014 us=757616   pkcs11_private_mode = 00000000
Thu Dec  4 05:56:07 2014 us=757625   pkcs11_private_mode = 00000000
Thu Dec  4 05:56:07 2014 us=757634   pkcs11_private_mode = 00000000
Thu Dec  4 05:56:07 2014 us=757643   pkcs11_private_mode = 00000000
Thu Dec  4 05:56:07 2014 us=757659   pkcs11_private_mode = 00000000
Thu Dec  4 05:56:07 2014 us=757668   pkcs11_private_mode = 00000000
Thu Dec  4 05:56:07 2014 us=757677   pkcs11_private_mode = 00000000
Thu Dec  4 05:56:07 2014 us=757686   pkcs11_private_mode = 00000000
Thu Dec  4 05:56:07 2014 us=757695   pkcs11_private_mode = 00000000
Thu Dec  4 05:56:07 2014 us=757704   pkcs11_private_mode = 00000000
Thu Dec  4 05:56:07 2014 us=757713   pkcs11_private_mode = 00000000
Thu Dec  4 05:56:07 2014 us=757722   pkcs11_private_mode = 00000000
Thu Dec  4 05:56:07 2014 us=757731   pkcs11_private_mode = 00000000
Thu Dec  4 05:56:07 2014 us=757740   pkcs11_private_mode = 00000000
Thu Dec  4 05:56:07 2014 us=757749   pkcs11_cert_private = DISABLED
Thu Dec  4 05:56:07 2014 us=757758   pkcs11_cert_private = DISABLED
Thu Dec  4 05:56:07 2014 us=757767   pkcs11_cert_private = DISABLED
Thu Dec  4 05:56:07 2014 us=757775   pkcs11_cert_private = DISABLED
Thu Dec  4 05:56:07 2014 us=757785   pkcs11_cert_private = DISABLED
Thu Dec  4 05:56:07 2014 us=757794   pkcs11_cert_private = DISABLED
Thu Dec  4 05:56:07 2014 us=757803   pkcs11_cert_private = DISABLED
Thu Dec  4 05:56:07 2014 us=757812   pkcs11_cert_private = DISABLED
Thu Dec  4 05:56:07 2014 us=757821   pkcs11_cert_private = DISABLED
Thu Dec  4 05:56:07 2014 us=757830   pkcs11_cert_private = DISABLED
Thu Dec  4 05:56:07 2014 us=757838   pkcs11_cert_private = DISABLED
Thu Dec  4 05:56:07 2014 us=757847   pkcs11_cert_private = DISABLED
Thu Dec  4 05:56:07 2014 us=757856   pkcs11_cert_private = DISABLED
Thu Dec  4 05:56:07 2014 us=757865   pkcs11_cert_private = DISABLED
Thu Dec  4 05:56:07 2014 us=757874   pkcs11_cert_private = DISABLED
Thu Dec  4 05:56:07 2014 us=757883   pkcs11_cert_private = DISABLED
Thu Dec  4 05:56:07 2014 us=757892   pkcs11_pin_cache_period = -1
Thu Dec  4 05:56:07 2014 us=757901   pkcs11_id = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=757910   pkcs11_id_management = DISABLED
Thu Dec  4 05:56:07 2014 us=757930   server_network = 0.0.0.0
Thu Dec  4 05:56:07 2014 us=757941   server_netmask = 0.0.0.0
Thu Dec  4 05:56:07 2014 us=757957   server_network_ipv6 = ::
Thu Dec  4 05:56:07 2014 us=757966   server_netbits_ipv6 = 0
Thu Dec  4 05:56:07 2014 us=757976   server_bridge_ip = 0.0.0.0
Thu Dec  4 05:56:07 2014 us=757985   server_bridge_netmask = 0.0.0.0
Thu Dec  4 05:56:07 2014 us=757995   server_bridge_pool_start = 0.0.0.0
Thu Dec  4 05:56:07 2014 us=758004   server_bridge_pool_end = 0.0.0.0
Thu Dec  4 05:56:07 2014 us=758013   ifconfig_pool_defined = DISABLED
Thu Dec  4 05:56:07 2014 us=758023   ifconfig_pool_start = 0.0.0.0
Thu Dec  4 05:56:07 2014 us=758033   ifconfig_pool_end = 0.0.0.0
Thu Dec  4 05:56:07 2014 us=758042   ifconfig_pool_netmask = 0.0.0.0
Thu Dec  4 05:56:07 2014 us=758051   ifconfig_pool_persist_filename = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=758060   ifconfig_pool_persist_refresh_freq = 600
Thu Dec  4 05:56:07 2014 us=758069   ifconfig_ipv6_pool_defined = DISABLED
Thu Dec  4 05:56:07 2014 us=758079   ifconfig_ipv6_pool_base = ::
Thu Dec  4 05:56:07 2014 us=758088   ifconfig_ipv6_pool_netbits = 0
Thu Dec  4 05:56:07 2014 us=758097   n_bcast_buf = 256
Thu Dec  4 05:56:07 2014 us=758106   tcp_queue_limit = 64
Thu Dec  4 05:56:07 2014 us=758114   real_hash_size = 256
Thu Dec  4 05:56:07 2014 us=758123   virtual_hash_size = 256
Thu Dec  4 05:56:07 2014 us=758132   client_connect_script = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=758141   learn_address_script = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=758150   client_disconnect_script = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=758159   client_config_dir = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=758168   ccd_exclusive = DISABLED
Thu Dec  4 05:56:07 2014 us=758177   tmp_dir = '/tmp'
Thu Dec  4 05:56:07 2014 us=758186   push_ifconfig_defined = DISABLED
Thu Dec  4 05:56:07 2014 us=758196   push_ifconfig_local = 0.0.0.0
Thu Dec  4 05:56:07 2014 us=758205   push_ifconfig_remote_netmask = 0.0.0.0
Thu Dec  4 05:56:07 2014 us=758214   push_ifconfig_ipv6_defined = DISABLED
Thu Dec  4 05:56:07 2014 us=758224   push_ifconfig_ipv6_local = ::/0
Thu Dec  4 05:56:07 2014 us=758242   push_ifconfig_ipv6_remote = ::
Thu Dec  4 05:56:07 2014 us=758252   enable_c2c = DISABLED
Thu Dec  4 05:56:07 2014 us=758261   duplicate_cn = DISABLED
Thu Dec  4 05:56:07 2014 us=758270   cf_max = 0
Thu Dec  4 05:56:07 2014 us=758279   cf_per = 0
Thu Dec  4 05:56:07 2014 us=758288   max_clients = 1024
Thu Dec  4 05:56:07 2014 us=758297   max_routes_per_client = 256
Thu Dec  4 05:56:07 2014 us=758306   auth_user_pass_verify_script = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=758315   auth_user_pass_verify_script_via_file = DISABLED
Thu Dec  4 05:56:07 2014 us=758324   port_share_host = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=758333   port_share_port = 0
Thu Dec  4 05:56:07 2014 us=758342   client = ENABLED
Thu Dec  4 05:56:07 2014 us=758351   pull = ENABLED
Thu Dec  4 05:56:07 2014 us=758360   auth_user_pass_file = '[UNDEF]'
Thu Dec  4 05:56:07 2014 us=758370 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Feb  4 2014
Thu Dec  4 05:56:07 2014 us=758494 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu Dec  4 05:56:07 2014 us=759080 LZO compression initialized
Thu Dec  4 05:56:07 2014 us=759156 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Dec  4 05:56:07 2014 us=759200 Socket Buffers: R=[212992->131072] S=[212992->131072]
Thu Dec  4 05:56:07 2014 us=759223 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Dec  4 05:56:07 2014 us=759246 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Thu Dec  4 05:56:07 2014 us=759256 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Dec  4 05:56:07 2014 us=759276 Local Options hash (VER=V4): '41690919'
Thu Dec  4 05:56:07 2014 us=759291 Expected Remote Options hash (VER=V4): '530fdded'
Thu Dec  4 05:56:07 2014 us=759304 UDPv4 link local: [undef]
Thu Dec  4 05:56:07 2014 us=759315 UDPv4 link remote: [AF_INET]37.148.137.58:1194
Thu Dec  4 05:56:07 2014 us=912910 TLS: Initial packet from [AF_INET]37.148.137.58:1194, sid=b7d2a9e4 2e497a8f
Thu Dec  4 05:56:08 2014 us=484212 VERIFY OK: depth=1, C=DE, ST=Rheinland-Pfalz, L=Mainz, O=ionas OHG, OU=MyOrganizationalUnit, CN=CommonName, name=EasyRSA, emailAddress=cdb@ionas.com
Thu Dec  4 05:56:08 2014 us=484484 VERIFY OK: depth=0, C=DE, ST=Rheinland-Pfalz, L=Mainz, O=ionas OHG, OU=MyOrganizationalUnit, CN=server, name=EasyRSA, emailAddress=cdb@ionas.com
Thu Dec  4 05:56:09 2014 us=703122 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Dec  4 05:56:09 2014 us=703168 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec  4 05:56:09 2014 us=703224 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Dec  4 05:56:09 2014 us=703236 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec  4 05:56:09 2014 us=703266 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu Dec  4 05:56:09 2014 us=703291 [server] Peer Connection Initiated with [AF_INET]37.148.137.58:1194
Thu Dec  4 05:56:12 2014 us=155886 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Dec  4 05:56:12 2014 us=322172 PUSH: Received control message: 'PUSH_REPLY,route 192.168.5.0 255.255.255.0,dhcp-option DNS 10.8.0.1,redirect-gateway def1 bypass-dhcp,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Thu Dec  4 05:56:12 2014 us=322272 OPTIONS IMPORT: timers and/or timeouts modified
Thu Dec  4 05:56:12 2014 us=322284 OPTIONS IMPORT: --ifconfig/up options modified
Thu Dec  4 05:56:12 2014 us=322293 OPTIONS IMPORT: route options modified
Thu Dec  4 05:56:12 2014 us=322309 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Dec  4 05:56:12 2014 us=322467 ROUTE_GATEWAY 172.20.10.1/255.255.255.240 IFACE=eth1 HWADDR=5e:95:ae:69:02:a7
Thu Dec  4 05:56:12 2014 us=322711 TUN/TAP device tun0 opened
Thu Dec  4 05:56:12 2014 us=322729 TUN/TAP TX queue length set to 100
Thu Dec  4 05:56:12 2014 us=322747 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Dec  4 05:56:12 2014 us=322773 /sbin/ip link set dev tun0 up mtu 1500
Thu Dec  4 05:56:12 2014 us=327122 /sbin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
Thu Dec  4 05:56:12 2014 us=330463 /sbin/ip route add 37.148.137.58/32 via 172.20.10.1
Thu Dec  4 05:56:12 2014 us=332689 /sbin/ip route add 0.0.0.0/1 via 10.8.0.5
Thu Dec  4 05:56:12 2014 us=334925 /sbin/ip route add 128.0.0.0/1 via 10.8.0.5
Thu Dec  4 05:56:12 2014 us=339593 /sbin/ip route add 192.168.5.0/24 via 10.8.0.5
Thu Dec  4 05:56:12 2014 us=347459 /sbin/ip route add 10.8.0.1/32 via 10.8.0.5
Thu Dec  4 05:56:12 2014 us=349488 Initialization Sequence Completed
Thu Dec  4 05:56:32 2014 us=370122 event_wait : Interrupted system call (code=4)
Thu Dec  4 05:56:32 2014 us=370422 TCP/UDP: Closing socket
Thu Dec  4 05:56:32 2014 us=370485 /sbin/ip route del 10.8.0.1/32
Thu Dec  4 05:56:32 2014 us=371497 /sbin/ip route del 192.168.5.0/24
Thu Dec  4 05:56:32 2014 us=372761 /sbin/ip route del 37.148.137.58/32
Thu Dec  4 05:56:32 2014 us=373520 /sbin/ip route del 0.0.0.0/1
Thu Dec  4 05:56:32 2014 us=374422 /sbin/ip route del 128.0.0.0/1
Thu Dec  4 05:56:32 2014 us=375516 Closing TUN/TAP interface
Thu Dec  4 05:56:32 2014 us=375552 /sbin/ip addr del dev tun0 local 10.8.0.6 peer 10.8.0.5
Thu Dec  4 05:56:32 2014 us=404014 SIGINT[hard,] received, process exiting

## openvpn-status.log from server
OpenVPN CLIENT LIST
Updated,Thu Dec  4 06:03:14 2014
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
GLOBAL STATS
Max bcast/mcast queue length,0
END

to be continued in next post...

ionasOHG

## openvpn.log from server
Thu Dec  4 05:14:31 2014 us=628246 Current Parameter Settings:
Thu Dec  4 05:14:31 2014 us=628352   config = '/etc/openvpn/server.conf'
Thu Dec  4 05:14:31 2014 us=628373   mode = 1
Thu Dec  4 05:14:31 2014 us=628389   persist_config = DISABLED
Thu Dec  4 05:14:31 2014 us=628404   persist_mode = 1
Thu Dec  4 05:14:31 2014 us=628418   show_ciphers = DISABLED
Thu Dec  4 05:14:31 2014 us=628433   show_digests = DISABLED
Thu Dec  4 05:14:31 2014 us=628448   show_engines = DISABLED
Thu Dec  4 05:14:31 2014 us=628463   genkey = DISABLED
Thu Dec  4 05:14:31 2014 us=628478   key_pass_file = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=628492   show_tls_ciphers = DISABLED
Thu Dec  4 05:14:31 2014 us=628508 Connection profiles [default]:
Thu Dec  4 05:14:31 2014 us=628524   proto = udp
Thu Dec  4 05:14:31 2014 us=628539   local = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=628554   local_port = 1194
Thu Dec  4 05:14:31 2014 us=628569   remote = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=628584   remote_port = 1194
Thu Dec  4 05:14:31 2014 us=628598   remote_float = DISABLED
Thu Dec  4 05:14:31 2014 us=628613   bind_defined = DISABLED
Thu Dec  4 05:14:31 2014 us=628628   bind_local = ENABLED
Thu Dec  4 05:14:31 2014 us=628643   connect_retry_seconds = 5
Thu Dec  4 05:14:31 2014 us=628658   connect_timeout = 10
Thu Dec  4 05:14:31 2014 us=628673   connect_retry_max = 0
Thu Dec  4 05:14:31 2014 us=628688   socks_proxy_server = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=628703   socks_proxy_port = 0
Thu Dec  4 05:14:31 2014 us=628717   socks_proxy_retry = DISABLED
Thu Dec  4 05:14:31 2014 us=628732   tun_mtu = 1500
Thu Dec  4 05:14:31 2014 us=628747   tun_mtu_defined = ENABLED
Thu Dec  4 05:14:31 2014 us=628762   link_mtu = 1500
Thu Dec  4 05:14:31 2014 us=628777   link_mtu_defined = DISABLED
Thu Dec  4 05:14:31 2014 us=628791   tun_mtu_extra = 0
Thu Dec  4 05:14:31 2014 us=628806   tun_mtu_extra_defined = DISABLED
Thu Dec  4 05:14:31 2014 us=628821   mtu_discover_type = -1
Thu Dec  4 05:14:31 2014 us=628836   fragment = 0
Thu Dec  4 05:14:31 2014 us=628851   mssfix = 1450
Thu Dec  4 05:14:31 2014 us=628866   explicit_exit_notification = 0
Thu Dec  4 05:14:31 2014 us=628884 Connection profiles END
Thu Dec  4 05:14:31 2014 us=628899   remote_random = DISABLED
Thu Dec  4 05:14:31 2014 us=628914   ipchange = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=628929   dev = 'tun'
Thu Dec  4 05:14:31 2014 us=628944   dev_type = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=628958   dev_node = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=628973   lladdr = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=628988   topology = 1
Thu Dec  4 05:14:31 2014 us=629002   tun_ipv6 = DISABLED
Thu Dec  4 05:14:31 2014 us=629017   ifconfig_local = '10.8.0.1'
Thu Dec  4 05:14:31 2014 us=629032   ifconfig_remote_netmask = '10.8.0.2'
Thu Dec  4 05:14:31 2014 us=629047   ifconfig_noexec = DISABLED
Thu Dec  4 05:14:31 2014 us=629062   ifconfig_nowarn = DISABLED
Thu Dec  4 05:14:31 2014 us=629076   ifconfig_ipv6_local = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=629091   ifconfig_ipv6_netbits = 0
Thu Dec  4 05:14:31 2014 us=629106   ifconfig_ipv6_remote = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=629121   shaper = 0
Thu Dec  4 05:14:31 2014 us=629135   mtu_test = 0
Thu Dec  4 05:14:31 2014 us=629150   mlock = DISABLED
Thu Dec  4 05:14:31 2014 us=629165   keepalive_ping = 10
Thu Dec  4 05:14:31 2014 us=629183   keepalive_timeout = 120
Thu Dec  4 05:14:31 2014 us=629200   inactivity_timeout = 0
Thu Dec  4 05:14:31 2014 us=629216   ping_send_timeout = 10
Thu Dec  4 05:14:31 2014 us=629231   ping_rec_timeout = 240
Thu Dec  4 05:14:31 2014 us=629245   ping_rec_timeout_action = 2
Thu Dec  4 05:14:31 2014 us=629260   ping_timer_remote = DISABLED
Thu Dec  4 05:14:31 2014 us=629275   remap_sigusr1 = 0
Thu Dec  4 05:14:31 2014 us=629290   persist_tun = ENABLED
Thu Dec  4 05:14:31 2014 us=629304   persist_local_ip = DISABLED
Thu Dec  4 05:14:31 2014 us=629319   persist_remote_ip = DISABLED
Thu Dec  4 05:14:31 2014 us=629334   persist_key = ENABLED
Thu Dec  4 05:14:31 2014 us=629349   passtos = DISABLED
Thu Dec  4 05:14:31 2014 us=629364   resolve_retry_seconds = 1000000000
Thu Dec  4 05:14:31 2014 us=629388   username = 'nobody'
Thu Dec  4 05:14:31 2014 us=629416   groupname = 'nogroup'
Thu Dec  4 05:14:31 2014 us=629432   chroot_dir = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=629447   cd_dir = '/etc/openvpn'
Thu Dec  4 05:14:31 2014 us=629462   writepid = '/run/openvpn/server.pid'
Thu Dec  4 05:14:31 2014 us=629477   up_script = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=629492   down_script = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=629507   down_pre = DISABLED
Thu Dec  4 05:14:31 2014 us=629521   up_restart = DISABLED
Thu Dec  4 05:14:31 2014 us=629536   up_delay = DISABLED
Thu Dec  4 05:14:31 2014 us=629551   daemon = ENABLED
Thu Dec  4 05:14:31 2014 us=629566   inetd = 0
Thu Dec  4 05:14:31 2014 us=629581   log = ENABLED
Thu Dec  4 05:14:31 2014 us=629596   suppress_timestamps = DISABLED
Thu Dec  4 05:14:31 2014 us=629611   nice = 0
Thu Dec  4 05:14:31 2014 us=629626   verbosity = 4
Thu Dec  4 05:14:31 2014 us=629640   mute = 0
Thu Dec  4 05:14:31 2014 us=629655   gremlin = 0
Thu Dec  4 05:14:31 2014 us=629670   status_file = 'openvpn-status.log'
Thu Dec  4 05:14:31 2014 us=629685   status_file_version = 1
Thu Dec  4 05:14:31 2014 us=629700   status_file_update_freq = 60
Thu Dec  4 05:14:31 2014 us=629715   occ = ENABLED
Thu Dec  4 05:14:31 2014 us=629730   rcvbuf = 65536
Thu Dec  4 05:14:31 2014 us=629745   sndbuf = 65536
Thu Dec  4 05:14:31 2014 us=629760   mark = 0
Thu Dec  4 05:14:31 2014 us=629774   sockflags = 0
Thu Dec  4 05:14:31 2014 us=629789   fast_io = DISABLED
Thu Dec  4 05:14:31 2014 us=629804   lzo = 7
Thu Dec  4 05:14:31 2014 us=629819   route_script = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=629834   route_default_gateway = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=629849   route_default_metric = 0
Thu Dec  4 05:14:31 2014 us=629864   route_noexec = DISABLED
Thu Dec  4 05:14:31 2014 us=629879   route_delay = 0
Thu Dec  4 05:14:31 2014 us=629894   route_delay_window = 30
Thu Dec  4 05:14:31 2014 us=629909   route_delay_defined = DISABLED
Thu Dec  4 05:14:31 2014 us=629924   route_nopull = DISABLED
Thu Dec  4 05:14:31 2014 us=629939   route_gateway_via_dhcp = DISABLED
Thu Dec  4 05:14:31 2014 us=629954   max_routes = 100
Thu Dec  4 05:14:31 2014 us=629969   allow_pull_fqdn = DISABLED
Thu Dec  4 05:14:31 2014 us=629985   route 10.8.0.0/255.255.255.0/nil/nil
Thu Dec  4 05:14:31 2014 us=630000   management_addr = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=630015   management_port = 0
Thu Dec  4 05:14:31 2014 us=630030   management_user_pass = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=630045   management_log_history_cache = 250
Thu Dec  4 05:14:31 2014 us=630060   management_echo_buffer_size = 100
Thu Dec  4 05:14:31 2014 us=630075   management_write_peer_info_file = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=630090   management_client_user = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=630105   management_client_group = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=630120   management_flags = 0
Thu Dec  4 05:14:31 2014 us=630139   shared_secret_file = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=630155   key_direction = 0
Thu Dec  4 05:14:31 2014 us=630170   ciphername_defined = ENABLED
Thu Dec  4 05:14:31 2014 us=630185   ciphername = 'BF-CBC'
Thu Dec  4 05:14:31 2014 us=630200   authname_defined = ENABLED
Thu Dec  4 05:14:31 2014 us=630215   authname = 'SHA1'
Thu Dec  4 05:14:31 2014 us=630230   prng_hash = 'SHA1'
Thu Dec  4 05:14:31 2014 us=630245   prng_nonce_secret_len = 16
Thu Dec  4 05:14:31 2014 us=630260   keysize = 0
Thu Dec  4 05:14:31 2014 us=630274   engine = DISABLED
Thu Dec  4 05:14:31 2014 us=630289   replay = ENABLED
Thu Dec  4 05:14:31 2014 us=630304   mute_replay_warnings = DISABLED
Thu Dec  4 05:14:31 2014 us=630319   replay_window = 64
Thu Dec  4 05:14:31 2014 us=630334   replay_time = 15
Thu Dec  4 05:14:31 2014 us=630348   packet_id_file = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=630363   use_iv = ENABLED
Thu Dec  4 05:14:31 2014 us=630378   test_crypto = DISABLED
Thu Dec  4 05:14:31 2014 us=630393   tls_server = ENABLED
Thu Dec  4 05:14:31 2014 us=630408   tls_client = DISABLED
Thu Dec  4 05:14:31 2014 us=630441   key_method = 2
Thu Dec  4 05:14:31 2014 us=630457   ca_file = './easy-rsa2/keys/ca.crt'
Thu Dec  4 05:14:31 2014 us=630473   ca_path = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=630488   dh_file = './easy-rsa2/keys/dh2048.pem'
Thu Dec  4 05:14:31 2014 us=630503   cert_file = './easy-rsa2/keys/server.crt'
Thu Dec  4 05:14:31 2014 us=630518   priv_key_file = './easy-rsa2/keys/server.key'
Thu Dec  4 05:14:31 2014 us=630533   pkcs12_file = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=630548   cipher_list = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=630562   tls_verify = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=630577   tls_export_cert = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=630592   verify_x509_type = 0
Thu Dec  4 05:14:31 2014 us=630607   verify_x509_name = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=630622   crl_file = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=630637   ns_cert_type = 0
Thu Dec  4 05:14:31 2014 us=630652   remote_cert_ku[i] = 0
Thu Dec  4 05:14:31 2014 us=630667   remote_cert_ku[i] = 0
Thu Dec  4 05:14:31 2014 us=630682   remote_cert_ku[i] = 0
Thu Dec  4 05:14:31 2014 us=630697   remote_cert_ku[i] = 0
Thu Dec  4 05:14:31 2014 us=630711   remote_cert_ku[i] = 0
Thu Dec  4 05:14:31 2014 us=630726   remote_cert_ku[i] = 0
Thu Dec  4 05:14:31 2014 us=630741   remote_cert_ku[i] = 0
Thu Dec  4 05:14:31 2014 us=630756   remote_cert_ku[i] = 0
Thu Dec  4 05:14:31 2014 us=630771   remote_cert_ku[i] = 0
Thu Dec  4 05:14:31 2014 us=630785   remote_cert_ku[i] = 0
Thu Dec  4 05:14:31 2014 us=630800   remote_cert_ku[i] = 0
Thu Dec  4 05:14:31 2014 us=630814   remote_cert_ku[i] = 0
Thu Dec  4 05:14:31 2014 us=630829   remote_cert_ku[i] = 0
Thu Dec  4 05:14:31 2014 us=630844   remote_cert_ku[i] = 0
Thu Dec  4 05:14:31 2014 us=630858   remote_cert_ku[i] = 0
Thu Dec  4 05:14:31 2014 us=630873   remote_cert_ku[i] = 0
Thu Dec  4 05:14:31 2014 us=630888   remote_cert_eku = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=630903   ssl_flags = 0
Thu Dec  4 05:14:31 2014 us=630918   tls_timeout = 2
Thu Dec  4 05:14:31 2014 us=630933   renegotiate_bytes = 0
Thu Dec  4 05:14:31 2014 us=630947   renegotiate_packets = 0
Thu Dec  4 05:14:31 2014 us=630962   renegotiate_seconds = 3600
Thu Dec  4 05:14:31 2014 us=630977   handshake_window = 60
Thu Dec  4 05:14:31 2014 us=630992   transition_window = 3600
Thu Dec  4 05:14:31 2014 us=631007   single_session = DISABLED
Thu Dec  4 05:14:31 2014 us=631022   push_peer_info = DISABLED
Thu Dec  4 05:14:31 2014 us=631036   tls_exit = DISABLED
Thu Dec  4 05:14:31 2014 us=631051   tls_auth_file = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=631067   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:14:31 2014 us=631082   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:14:31 2014 us=631097   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:14:31 2014 us=631111   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:14:31 2014 us=631126   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:14:31 2014 us=631141   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:14:31 2014 us=631156   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:14:31 2014 us=631171   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:14:31 2014 us=631185   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:14:31 2014 us=631200   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:14:31 2014 us=631215   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:14:31 2014 us=631230   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:14:31 2014 us=631266   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:14:31 2014 us=631371   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:14:31 2014 us=631392   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:14:31 2014 us=631408   pkcs11_protected_authentication = DISABLED
Thu Dec  4 05:14:31 2014 us=631424   pkcs11_private_mode = 00000000
Thu Dec  4 05:14:31 2014 us=631440   pkcs11_private_mode = 00000000
Thu Dec  4 05:14:31 2014 us=631455   pkcs11_private_mode = 00000000
Thu Dec  4 05:14:31 2014 us=631470   pkcs11_private_mode = 00000000
Thu Dec  4 05:14:31 2014 us=631495   pkcs11_private_mode = 00000000
Thu Dec  4 05:14:31 2014 us=631511   pkcs11_private_mode = 00000000
Thu Dec  4 05:14:31 2014 us=631526   pkcs11_private_mode = 00000000
Thu Dec  4 05:14:31 2014 us=631541   pkcs11_private_mode = 00000000
Thu Dec  4 05:14:31 2014 us=631556   pkcs11_private_mode = 00000000
Thu Dec  4 05:14:31 2014 us=631571   pkcs11_private_mode = 00000000
Thu Dec  4 05:14:31 2014 us=631586   pkcs11_private_mode = 00000000
Thu Dec  4 05:14:31 2014 us=631601   pkcs11_private_mode = 00000000
Thu Dec  4 05:14:31 2014 us=631616   pkcs11_private_mode = 00000000
Thu Dec  4 05:14:31 2014 us=631631   pkcs11_private_mode = 00000000
Thu Dec  4 05:14:31 2014 us=631646   pkcs11_private_mode = 00000000
Thu Dec  4 05:14:31 2014 us=631661   pkcs11_private_mode = 00000000
Thu Dec  4 05:14:31 2014 us=631676   pkcs11_cert_private = DISABLED
Thu Dec  4 05:14:31 2014 us=631691   pkcs11_cert_private = DISABLED
Thu Dec  4 05:14:31 2014 us=631706   pkcs11_cert_private = DISABLED
Thu Dec  4 05:14:31 2014 us=631720   pkcs11_cert_private = DISABLED
Thu Dec  4 05:14:31 2014 us=631735   pkcs11_cert_private = DISABLED
Thu Dec  4 05:14:31 2014 us=631750   pkcs11_cert_private = DISABLED
Thu Dec  4 05:14:31 2014 us=631765   pkcs11_cert_private = DISABLED
Thu Dec  4 05:14:31 2014 us=631780   pkcs11_cert_private = DISABLED
Thu Dec  4 05:14:31 2014 us=631795   pkcs11_cert_private = DISABLED
Thu Dec  4 05:14:31 2014 us=631810   pkcs11_cert_private = DISABLED
Thu Dec  4 05:14:31 2014 us=631824   pkcs11_cert_private = DISABLED
Thu Dec  4 05:14:31 2014 us=631839   pkcs11_cert_private = DISABLED
Thu Dec  4 05:14:31 2014 us=631854   pkcs11_cert_private = DISABLED
Thu Dec  4 05:14:31 2014 us=631869   pkcs11_cert_private = DISABLED
Thu Dec  4 05:14:31 2014 us=631884   pkcs11_cert_private = DISABLED
Thu Dec  4 05:14:31 2014 us=631898   pkcs11_cert_private = DISABLED
Thu Dec  4 05:14:31 2014 us=631914   pkcs11_pin_cache_period = -1
Thu Dec  4 05:14:31 2014 us=631929   pkcs11_id = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=631943   pkcs11_id_management = DISABLED
Thu Dec  4 05:14:31 2014 us=631960   server_network = 10.8.0.0
Thu Dec  4 05:14:31 2014 us=631976   server_netmask = 255.255.255.0
Thu Dec  4 05:14:31 2014 us=631999   server_network_ipv6 = ::
Thu Dec  4 05:14:31 2014 us=632015   server_netbits_ipv6 = 0
Thu Dec  4 05:14:31 2014 us=632031   server_bridge_ip = 0.0.0.0
Thu Dec  4 05:14:31 2014 us=632047   server_bridge_netmask = 0.0.0.0
Thu Dec  4 05:14:31 2014 us=632063   server_bridge_pool_start = 0.0.0.0
Thu Dec  4 05:14:31 2014 us=632079   server_bridge_pool_end = 0.0.0.0
Thu Dec  4 05:14:31 2014 us=632094   push_entry = 'route 192.168.5.0 255.255.255.0'
Thu Dec  4 05:14:31 2014 us=632109   push_entry = 'dhcp-option DNS 10.8.0.1'
Thu Dec  4 05:14:31 2014 us=632124   push_entry = 'redirect-gateway def1 bypass-dhcp'
Thu Dec  4 05:14:31 2014 us=632139   push_entry = 'route 10.8.0.1'
Thu Dec  4 05:14:31 2014 us=632154   push_entry = 'topology net30'
Thu Dec  4 05:14:31 2014 us=632169   push_entry = 'ping 10'
Thu Dec  4 05:14:31 2014 us=632184   push_entry = 'ping-restart 120'
Thu Dec  4 05:14:31 2014 us=632205   ifconfig_pool_defined = ENABLED
Thu Dec  4 05:14:31 2014 us=632233   ifconfig_pool_start = 10.8.0.4
Thu Dec  4 05:14:31 2014 us=632259   ifconfig_pool_end = 10.8.0.251
Thu Dec  4 05:14:31 2014 us=632276   ifconfig_pool_netmask = 0.0.0.0
Thu Dec  4 05:14:31 2014 us=632291   ifconfig_pool_persist_filename = 'ipp.txt'
Thu Dec  4 05:14:31 2014 us=632307   ifconfig_pool_persist_refresh_freq = 600
Thu Dec  4 05:14:31 2014 us=632322   ifconfig_ipv6_pool_defined = DISABLED
Thu Dec  4 05:14:31 2014 us=632344   ifconfig_ipv6_pool_base = ::
Thu Dec  4 05:14:31 2014 us=632361   ifconfig_ipv6_pool_netbits = 0
Thu Dec  4 05:14:31 2014 us=632376   n_bcast_buf = 256
Thu Dec  4 05:14:31 2014 us=632391   tcp_queue_limit = 64
Thu Dec  4 05:14:31 2014 us=632406   real_hash_size = 256
Thu Dec  4 05:14:31 2014 us=632421   virtual_hash_size = 256
Thu Dec  4 05:14:31 2014 us=632436   client_connect_script = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=632459   learn_address_script = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=632476   client_disconnect_script = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=632491   client_config_dir = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=632506   ccd_exclusive = DISABLED
Thu Dec  4 05:14:31 2014 us=632521   tmp_dir = '/tmp'
Thu Dec  4 05:14:31 2014 us=632536   push_ifconfig_defined = DISABLED
Thu Dec  4 05:14:31 2014 us=632551   push_ifconfig_local = 0.0.0.0
Thu Dec  4 05:14:31 2014 us=632567   push_ifconfig_remote_netmask = 0.0.0.0
Thu Dec  4 05:14:31 2014 us=632582   push_ifconfig_ipv6_defined = DISABLED
Thu Dec  4 05:14:31 2014 us=632598   push_ifconfig_ipv6_local = ::/0
Thu Dec  4 05:14:31 2014 us=632614   push_ifconfig_ipv6_remote = ::
Thu Dec  4 05:14:31 2014 us=632629   enable_c2c = DISABLED
Thu Dec  4 05:14:31 2014 us=632644   duplicate_cn = DISABLED
Thu Dec  4 05:14:31 2014 us=632659   cf_max = 0
Thu Dec  4 05:14:31 2014 us=632674   cf_per = 0
Thu Dec  4 05:14:31 2014 us=632689   max_clients = 10
Thu Dec  4 05:14:31 2014 us=632704   max_routes_per_client = 256
Thu Dec  4 05:14:31 2014 us=632719   auth_user_pass_verify_script = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=632734   auth_user_pass_verify_script_via_file = DISABLED
Thu Dec  4 05:14:31 2014 us=632749   port_share_host = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=632764   port_share_port = 0
Thu Dec  4 05:14:31 2014 us=632779   client = DISABLED
Thu Dec  4 05:14:31 2014 us=632793   pull = DISABLED
Thu Dec  4 05:14:31 2014 us=632808   auth_user_pass_file = '[UNDEF]'
Thu Dec  4 05:14:31 2014 us=632825 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Feb  4 2014
Thu Dec  4 05:14:31 2014 us=642692 Diffie-Hellman initialized with 2048 bit key
Thu Dec  4 05:14:31 2014 us=643087 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Dec  4 05:14:31 2014 us=643125 Socket Buffers: R=[212992->131072] S=[212992->131072]
Thu Dec  4 05:14:31 2014 us=643237 ROUTE_GATEWAY 192.168.5.1/255.255.255.0 IFACE=eth0 HWADDR=08:00:27:27:26:56
Thu Dec  4 05:14:31 2014 us=644440 TUN/TAP device tun0 opened
Thu Dec  4 05:14:31 2014 us=644471 TUN/TAP TX queue length set to 100
Thu Dec  4 05:14:31 2014 us=644494 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Dec  4 05:14:31 2014 us=644522 /sbin/ip link set dev tun0 up mtu 1500
Thu Dec  4 05:14:31 2014 us=645998 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Thu Dec  4 05:14:31 2014 us=647824 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Thu Dec  4 05:14:31 2014 us=648818 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Dec  4 05:14:31 2014 us=650638 GID set to nogroup
Thu Dec  4 05:14:31 2014 us=650697 UID set to nobody
Thu Dec  4 05:14:31 2014 us=650721 UDPv4 link local (bound): [undef]
Thu Dec  4 05:14:31 2014 us=650733 UDPv4 link remote: [undef]
Thu Dec  4 05:14:31 2014 us=650749 MULTI: multi_init called, r=256 v=256
Thu Dec  4 05:14:31 2014 us=650813 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Thu Dec  4 05:14:31 2014 us=650834 ifconfig_pool_read(), in='ersterclient,10.8.0.4', TODO: IPv6
Thu Dec  4 05:14:31 2014 us=650859 succeeded -> ifconfig_pool_set()
Thu Dec  4 05:14:31 2014 us=650873 IFCONFIG POOL LIST
Thu Dec  4 05:14:31 2014 us=650886 ersterclient,10.8.0.4
Thu Dec  4 05:14:31 2014 us=650924 Initialization Sequence Completed
Thu Dec  4 05:17:02 2014 us=992143 MULTI: multi_create_instance called
Thu Dec  4 05:17:02 2014 us=992298 192.168.100.2:48792 Re-using SSL/TLS context
Thu Dec  4 05:17:02 2014 us=992367 192.168.100.2:48792 LZO compression initialized
Thu Dec  4 05:17:02 2014 us=992643 192.168.100.2:48792 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Dec  4 05:17:02 2014 us=992677 192.168.100.2:48792 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Dec  4 05:17:02 2014 us=992741 192.168.100.2:48792 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Dec  4 05:17:02 2014 us=992765 192.168.100.2:48792 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Thu Dec  4 05:17:02 2014 us=992833 192.168.100.2:48792 Local Options hash (VER=V4): '530fdded'
Thu Dec  4 05:17:02 2014 us=992864 192.168.100.2:48792 Expected Remote Options hash (VER=V4): '41690919'
Thu Dec  4 05:17:02 2014 us=992943 192.168.100.2:48792 TLS: Initial packet from [AF_INET]192.168.100.2:48792, sid=828a3651 d24d7134
Thu Dec  4 05:17:03 2014 us=60372 192.168.100.2:48792 VERIFY OK: depth=1, C=DE, ST=Rheinland-Pfalz, L=Mainz, O=ionas OHG, OU=MyOrganizationalUnit, CN=CommonName, name=EasyRSA, emailAddress=cdb@ionas.com
Thu Dec  4 05:17:03 2014 us=60945 192.168.100.2:48792 VERIFY OK: depth=0, C=DE, ST=Rheinland-Pfalz, L=Mainz, O=ionas OHG, OU=MyOrganizationalUnit, CN=ersterclient, name=EasyRSA, emailAddress=cdb@ionas.com
Thu Dec  4 05:17:03 2014 us=77361 192.168.100.2:48792 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Dec  4 05:17:03 2014 us=77397 192.168.100.2:48792 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec  4 05:17:03 2014 us=77617 192.168.100.2:48792 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Dec  4 05:17:03 2014 us=77641 192.168.100.2:48792 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec  4 05:17:03 2014 us=78948 192.168.100.2:48792 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu Dec  4 05:17:03 2014 us=78988 192.168.100.2:48792 [ersterclient] Peer Connection Initiated with [AF_INET]192.168.100.2:48792
Thu Dec  4 05:17:03 2014 us=79022 ersterclient/192.168.100.2:48792 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Thu Dec  4 05:17:03 2014 us=79059 ersterclient/192.168.100.2:48792 MULTI: Learn: 10.8.0.6 -> ersterclient/192.168.100.2:48792
Thu Dec  4 05:17:03 2014 us=79074 ersterclient/192.168.100.2:48792 MULTI: primary virtual IP for ersterclient/192.168.100.2:48792: 10.8.0.6
Thu Dec  4 05:17:05 2014 us=218965 ersterclient/192.168.100.2:48792 PUSH: Received control message: 'PUSH_REQUEST'
Thu Dec  4 05:17:05 2014 us=219052 ersterclient/192.168.100.2:48792 send_push_reply(): safe_cap=940
Thu Dec  4 05:17:05 2014 us=219121 ersterclient/192.168.100.2:48792 SENT CONTROL [ersterclient]: 'PUSH_REPLY,route 192.168.5.0 255.255.255.0,dhcp-option DNS 10.8.0.1,redirect-gateway def1 bypass-dhcp,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Thu Dec  4 05:17:35 2014 us=520037 MULTI: multi_create_instance called
Thu Dec  4 05:17:35 2014 us=520105 192.168.100.2:44294 Re-using SSL/TLS context
Thu Dec  4 05:17:35 2014 us=520166 192.168.100.2:44294 LZO compression initialized
Thu Dec  4 05:17:35 2014 us=520308 192.168.100.2:44294 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Dec  4 05:17:35 2014 us=520339 192.168.100.2:44294 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Dec  4 05:17:35 2014 us=520390 192.168.100.2:44294 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Dec  4 05:17:35 2014 us=520412 192.168.100.2:44294 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Thu Dec  4 05:17:35 2014 us=520447 192.168.100.2:44294 Local Options hash (VER=V4): '530fdded'
Thu Dec  4 05:17:35 2014 us=520475 192.168.100.2:44294 Expected Remote Options hash (VER=V4): '41690919'
Thu Dec  4 05:17:35 2014 us=520530 192.168.100.2:44294 TLS: Initial packet from [AF_INET]192.168.100.2:44294, sid=e43a03ae df4343da
Thu Dec  4 05:17:35 2014 us=582340 192.168.100.2:44294 VERIFY OK: depth=1, C=DE, ST=Rheinland-Pfalz, L=Mainz, O=ionas OHG, OU=MyOrganizationalUnit, CN=CommonName, name=EasyRSA, emailAddress=cdb@ionas.com
Thu Dec  4 05:17:35 2014 us=582777 192.168.100.2:44294 VERIFY OK: depth=0, C=DE, ST=Rheinland-Pfalz, L=Mainz, O=ionas OHG, OU=MyOrganizationalUnit, CN=ersterclient, name=EasyRSA, emailAddress=cdb@ionas.com
Thu Dec  4 05:17:35 2014 us=597962 192.168.100.2:44294 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Dec  4 05:17:35 2014 us=598030 192.168.100.2:44294 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec  4 05:17:35 2014 us=598148 192.168.100.2:44294 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Dec  4 05:17:35 2014 us=598178 192.168.100.2:44294 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec  4 05:17:35 2014 us=599795 192.168.100.2:44294 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu Dec  4 05:17:35 2014 us=599859 192.168.100.2:44294 [ersterclient] Peer Connection Initiated with [AF_INET]192.168.100.2:44294
Thu Dec  4 05:17:35 2014 us=600160 MULTI: new connection by client 'ersterclient' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Thu Dec  4 05:17:35 2014 us=600207 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Thu Dec  4 05:17:35 2014 us=600284 MULTI: Learn: 10.8.0.6 -> ersterclient/192.168.100.2:44294
Thu Dec  4 05:17:35 2014 us=600315 MULTI: primary virtual IP for ersterclient/192.168.100.2:44294: 10.8.0.6
Thu Dec  4 05:17:37 2014 us=826531 ersterclient/192.168.100.2:44294 PUSH: Received control message: 'PUSH_REQUEST'
Thu Dec  4 05:17:37 2014 us=826634 ersterclient/192.168.100.2:44294 send_push_reply(): safe_cap=940
Thu Dec  4 05:17:37 2014 us=826693 ersterclient/192.168.100.2:44294 SENT CONTROL [ersterclient]: 'PUSH_REPLY,route 192.168.5.0 255.255.255.0,dhcp-option DNS 10.8.0.1,redirect-gateway def1 bypass-dhcp,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Thu Dec  4 05:17:41 2014 us=394712 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:17:41 2014 us=719542 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:17:42 2014 us=47715 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:17:42 2014 us=703591 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:17:44 2014 us=18838 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:17:46 2014 us=647188 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:17:47 2014 us=768964 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:17:47 2014 us=975857 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:17:48 2014 us=183720 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:17:48 2014 us=599867 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:17:49 2014 us=396643 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:17:49 2014 us=431668 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:17:51 2014 us=99948 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:17:51 2014 us=903139 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:17:54 2014 us=431864 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:17:58 2014 us=398198 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:17:58 2014 us=610645 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:17:58 2014 us=826726 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:17:59 2014 us=259101 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:00 2014 us=123430 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:00 2014 us=398405 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:00 2014 us=602972 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:00 2014 us=810895 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:01 2014 us=103584 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:01 2014 us=227209 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:01 2014 us=398444 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:01 2014 us=607170 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:01 2014 us=819183 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:01 2014 us=854992 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:02 2014 us=58804 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:02 2014 us=243267 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:02 2014 us=431267 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:03 2014 us=91245 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:03 2014 us=524855 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:03 2014 us=727269 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:04 2014 us=400860 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:04 2014 us=790906 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:05 2014 us=319267 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:05 2014 us=524425 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:05 2014 us=525301 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:07 2014 us=62902 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:18:08 2014 us=190808 ersterclient/192.168.100.2:44294 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:36 2014 us=555532 MULTI: multi_create_instance called
Thu Dec  4 05:21:36 2014 us=555691 192.168.100.2:51869 Re-using SSL/TLS context
Thu Dec  4 05:21:36 2014 us=555758 192.168.100.2:51869 LZO compression initialized
Thu Dec  4 05:21:36 2014 us=555892 192.168.100.2:51869 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Dec  4 05:21:36 2014 us=555932 192.168.100.2:51869 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Dec  4 05:21:36 2014 us=556017 192.168.100.2:51869 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Dec  4 05:21:36 2014 us=556046 192.168.100.2:51869 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Thu Dec  4 05:21:36 2014 us=556087 192.168.100.2:51869 Local Options hash (VER=V4): '530fdded'
Thu Dec  4 05:21:36 2014 us=556122 192.168.100.2:51869 Expected Remote Options hash (VER=V4): '41690919'
Thu Dec  4 05:21:36 2014 us=556188 192.168.100.2:51869 TLS: Initial packet from [AF_INET]192.168.100.2:51869, sid=b076b300 a86b715f
Thu Dec  4 05:21:36 2014 us=614498 192.168.100.2:51869 VERIFY OK: depth=1, C=DE, ST=Rheinland-Pfalz, L=Mainz, O=ionas OHG, OU=MyOrganizationalUnit, CN=CommonName, name=EasyRSA, emailAddress=cdb@ionas.com
Thu Dec  4 05:21:36 2014 us=614936 192.168.100.2:51869 VERIFY OK: depth=0, C=DE, ST=Rheinland-Pfalz, L=Mainz, O=ionas OHG, OU=MyOrganizationalUnit, CN=ersterclient, name=EasyRSA, emailAddress=cdb@ionas.com
Thu Dec  4 05:21:36 2014 us=629306 192.168.100.2:51869 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Dec  4 05:21:36 2014 us=629339 192.168.100.2:51869 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec  4 05:21:36 2014 us=629388 192.168.100.2:51869 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Dec  4 05:21:36 2014 us=629400 192.168.100.2:51869 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec  4 05:21:36 2014 us=630557 192.168.100.2:51869 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu Dec  4 05:21:36 2014 us=630587 192.168.100.2:51869 [ersterclient] Peer Connection Initiated with [AF_INET]192.168.100.2:51869
Thu Dec  4 05:21:36 2014 us=630740 MULTI: new connection by client 'ersterclient' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Thu Dec  4 05:21:36 2014 us=630763 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Thu Dec  4 05:21:36 2014 us=630797 MULTI: Learn: 10.8.0.6 -> ersterclient/192.168.100.2:51869
Thu Dec  4 05:21:36 2014 us=630810 MULTI: primary virtual IP for ersterclient/192.168.100.2:51869: 10.8.0.6
Thu Dec  4 05:21:38 2014 us=877336 ersterclient/192.168.100.2:51869 PUSH: Received control message: 'PUSH_REQUEST'
Thu Dec  4 05:21:38 2014 us=877422 ersterclient/192.168.100.2:51869 send_push_reply(): safe_cap=940
Thu Dec  4 05:21:38 2014 us=877479 ersterclient/192.168.100.2:51869 SENT CONTROL [ersterclient]: 'PUSH_REPLY,route 192.168.5.0 255.255.255.0,dhcp-option DNS 10.8.0.1,redirect-gateway def1 bypass-dhcp,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Thu Dec  4 05:21:39 2014 us=996423 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:40 2014 us=92575 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:40 2014 us=92725 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:40 2014 us=668292 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:40 2014 us=668478 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:40 2014 us=859521 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:40 2014 us=859641 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:40 2014 us=859695 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:40 2014 us=996285 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:41 2014 us=92840 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:41 2014 us=92972 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:41 2014 us=93026 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:41 2014 us=516304 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:41 2014 us=668256 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:41 2014 us=668583 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:41 2014 us=996596 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:42 2014 us=92811 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:42 2014 us=93002 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:42 2014 us=300683 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:42 2014 us=364379 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:42 2014 us=668207 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:42 2014 us=668389 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:42 2014 us=996346 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:43 2014 us=92582 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:43 2014 us=92741 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:43 2014 us=300455 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:43 2014 us=668401 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:43 2014 us=668581 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:43 2014 us=995843 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:44 2014 us=63745 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:44 2014 us=91916 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:44 2014 us=92183 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:44 2014 us=300131 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:44 2014 us=668168 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:44 2014 us=671988 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:45 2014 us=304395 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:46 2014 us=300071 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:47 2014 us=468045 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:54 2014 us=268427 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:58 2014 us=108619 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:58 2014 us=336475 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:58 2014 us=564101 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:59 2014 us=20539 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:59 2014 us=109513 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:59 2014 us=320470 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:59 2014 us=532195 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:59 2014 us=932035 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:21:59 2014 us=955821 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:22:00 2014 us=803783 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:22:01 2014 us=760004 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:22:02 2014 us=503671 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:22:05 2014 us=420250 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:22:05 2014 us=899860 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:22:06 2014 us=111442 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:22:07 2014 us=111252 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:22:07 2014 us=867826 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:22:12 2014 us=699507 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:22:12 2014 us=731706 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:22:26 2014 us=299669 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:22:27 2014 us=356094 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:22:35 2014 us=67658 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:22:53 2014 us=499495 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:22:56 2014 us=635927 ersterclient/192.168.100.2:51869 MULTI: bad source address from client [192.168.100.2], packet dropped
Thu Dec  4 05:29:59 2014 us=984745 ersterclient/192.168.100.2:51869 [ersterclient] Inactivity timeout (--ping-restart), restarting
Thu Dec  4 05:29:59 2014 us=984865 ersterclient/192.168.100.2:51869 SIGUSR1[soft,ping-restart] received, client-instance restarting
Thu Dec  4 05:30:40 2014 us=288911 MULTI: multi_create_instance called
Thu Dec  4 05:30:40 2014 us=289050 80.187.101.91:2855 Re-using SSL/TLS context
Thu Dec  4 05:30:40 2014 us=289099 80.187.101.91:2855 LZO compression initialized
Thu Dec  4 05:30:40 2014 us=289217 80.187.101.91:2855 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Dec  4 05:30:40 2014 us=289274 80.187.101.91:2855 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Dec  4 05:30:40 2014 us=289327 80.187.101.91:2855 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Dec  4 05:30:40 2014 us=289349 80.187.101.91:2855 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Thu Dec  4 05:30:40 2014 us=289383 80.187.101.91:2855 Local Options hash (VER=V4): '530fdded'
Thu Dec  4 05:30:40 2014 us=289411 80.187.101.91:2855 Expected Remote Options hash (VER=V4): '41690919'
Thu Dec  4 05:30:40 2014 us=289465 80.187.101.91:2855 TLS: Initial packet from [AF_INET]80.187.101.91:2855, sid=569fb169 b9197a84
Thu Dec  4 05:30:41 2014 us=240090 80.187.101.91:2855 VERIFY OK: depth=1, C=DE, ST=Rheinland-Pfalz, L=Mainz, O=ionas OHG, OU=MyOrganizationalUnit, CN=CommonName, name=EasyRSA, emailAddress=cdb@ionas.com
Thu Dec  4 05:30:41 2014 us=240459 80.187.101.91:2855 VERIFY OK: depth=0, C=DE, ST=Rheinland-Pfalz, L=Mainz, O=ionas OHG, OU=MyOrganizationalUnit, CN=ersterclient, name=EasyRSA, emailAddress=cdb@ionas.com
Thu Dec  4 05:30:41 2014 us=605285 80.187.101.91:2855 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Dec  4 05:30:41 2014 us=605374 80.187.101.91:2855 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec  4 05:30:41 2014 us=605471 80.187.101.91:2855 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Dec  4 05:30:41 2014 us=605495 80.187.101.91:2855 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec  4 05:30:41 2014 us=675099 80.187.101.91:2855 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu Dec  4 05:30:41 2014 us=675172 80.187.101.91:2855 [ersterclient] Peer Connection Initiated with [AF_INET]80.187.101.91:2855
Thu Dec  4 05:30:41 2014 us=675220 ersterclient/80.187.101.91:2855 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Thu Dec  4 05:30:41 2014 us=675267 ersterclient/80.187.101.91:2855 MULTI: Learn: 10.8.0.6 -> ersterclient/80.187.101.91:2855
Thu Dec  4 05:30:41 2014 us=675398 ersterclient/80.187.101.91:2855 MULTI: primary virtual IP for ersterclient/80.187.101.91:2855: 10.8.0.6
Thu Dec  4 05:30:44 2014 us=107642 ersterclient/80.187.101.91:2855 PUSH: Received control message: 'PUSH_REQUEST'
Thu Dec  4 05:30:44 2014 us=107740 ersterclient/80.187.101.91:2855 send_push_reply(): safe_cap=940
Thu Dec  4 05:30:44 2014 us=107809 ersterclient/80.187.101.91:2855 SENT CONTROL [ersterclient]: 'PUSH_REPLY,route 192.168.5.0 255.255.255.0,dhcp-option DNS 10.8.0.1,redirect-gateway def1 bypass-dhcp,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Thu Dec  4 05:30:58 2014 us=686403 ersterclient/80.187.101.91:2855 MULTI: bad source address from client [172.20.10.2], packet dropped
Thu Dec  4 05:30:58 2014 us=964951 ersterclient/80.187.101.91:2855 MULTI: bad source address from client [172.20.10.2], packet dropped
Thu Dec  4 05:30:59 2014 us=204560 ersterclient/80.187.101.91:2855 MULTI: bad source address from client [172.20.10.2], packet dropped
Thu Dec  4 05:30:59 2014 us=864255 ersterclient/80.187.101.91:2855 MULTI: bad source address from client [172.20.10.2], packet dropped
Thu Dec  4 05:31:01 2014 us=64587 ersterclient/80.187.101.91:2855 MULTI: bad source address from client [172.20.10.2], packet dropped
Thu Dec  4 05:31:02 2014 us=596909 ersterclient/80.187.101.91:2855 MULTI: bad source address from client [172.20.10.2], packet dropped
Thu Dec  4 05:31:03 2014 us=451001 ersterclient/80.187.101.91:2855 MULTI: bad source address from client [172.20.10.2], packet dropped
Thu Dec  4 05:31:03 2014 us=706570 ersterclient/80.187.101.91:2855 MULTI: bad source address from client [172.20.10.2], packet dropped
Thu Dec  4 05:31:03 2014 us=994810 ersterclient/80.187.101.91:2855 MULTI: bad source address from client [172.20.10.2], packet dropped
Thu Dec  4 05:31:04 2014 us=288439 ersterclient/80.187.101.91:2855 MULTI: bad source address from client [172.20.10.2], packet dropped
Thu Dec  4 05:31:04 2014 us=873003 ersterclient/80.187.101.91:2855 MULTI: bad source address from client [172.20.10.2], packet dropped
Thu Dec  4 05:31:06 2014 us=74628 ersterclient/80.187.101.91:2855 MULTI: bad source address from client [172.20.10.2], packet dropped
Thu Dec  4 05:31:07 2014 us=601066 ersterclient/80.187.101.91:2855 MULTI: bad source address from client [172.20.10.2], packet dropped
Thu Dec  4 05:31:08 2014 us=285602 ersterclient/80.187.101.91:2855 MULTI: bad source address from client [172.20.10.2], packet dropped
Thu Dec  4 05:31:08 2014 us=421349 ersterclient/80.187.101.91:2855 MULTI: bad source address from client [172.20.10.2], packet dropped
Thu Dec  4 05:31:13 2014 us=294911 ersterclient/80.187.101.91:2855 MULTI: bad source address from client [172.20.10.2], packet dropped
Thu Dec  4 05:31:17 2014 us=836834 ersterclient/80.187.101.91:2855 MULTI: bad source address from client [172.20.10.2], packet dropped
Thu Dec  4 05:31:22 2014 us=918979 ersterclient/80.187.101.91:2855 MULTI: bad source address from client [172.20.10.2], packet dropped
Thu Dec  4 05:31:37 2014 us=127063 ersterclient/80.187.101.91:2855 MULTI: bad source address from client [172.20.10.2], packet dropped
Thu Dec  4 05:31:42 2014 us=154889 ersterclient/80.187.101.91:2855 MULTI: bad source address from client [172.20.10.2], packet dropped
Thu Dec  4 05:32:15 2014 us=642554 ersterclient/80.187.101.91:2855 MULTI: bad source address from client [172.20.10.2], packet dropped
Thu Dec  4 05:32:20 2014 us=746799 ersterclient/80.187.101.91:2855 MULTI: bad source address from client [172.20.10.2], packet dropped
Thu Dec  4 05:32:41 2014 us=147824 MULTI: multi_create_instance called
Thu Dec  4 05:32:41 2014 us=147958 80.187.101.91:15106 Re-using SSL/TLS context
Thu Dec  4 05:32:41 2014 us=148017 80.187.101.91:15106 LZO compression initialized
Thu Dec  4 05:32:41 2014 us=148134 80.187.101.91:15106 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Dec  4 05:32:41 2014 us=148167 80.187.101.91:15106 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Dec  4 05:32:41 2014 us=148220 80.187.101.91:15106 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Dec  4 05:32:41 2014 us=148242 80.187.101.91:15106 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Thu Dec  4 05:32:41 2014 us=148276 80.187.101.91:15106 Local Options hash (VER=V4): '530fdded'
Thu Dec  4 05:32:41 2014 us=148306 80.187.101.91:15106 Expected Remote Options hash (VER=V4): '41690919'
Thu Dec  4 05:32:41 2014 us=148360 80.187.101.91:15106 TLS: Initial packet from [AF_INET]80.187.101.91:15106, sid=c640e6d5 932cf8ff
Thu Dec  4 05:32:42 2014 us=248501 80.187.101.91:15106 VERIFY OK: depth=1, C=DE, ST=Rheinland-Pfalz, L=Mainz, O=ionas OHG, OU=MyOrganizationalUnit, CN=CommonName, name=EasyRSA, emailAddress=cdb@ionas.com
Thu Dec  4 05:32:42 2014 us=248868 80.187.101.91:15106 VERIFY OK: depth=0, C=DE, ST=Rheinland-Pfalz, L=Mainz, O=ionas OHG, OU=MyOrganizationalUnit, CN=ersterclient, name=EasyRSA, emailAddress=cdb@ionas.com
Thu Dec  4 05:32:42 2014 us=628588 80.187.101.91:15106 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Dec  4 05:32:42 2014 us=628677 80.187.101.91:15106 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec  4 05:32:42 2014 us=628775 80.187.101.91:15106 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Dec  4 05:32:42 2014 us=628801 80.187.101.91:15106 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec  4 05:32:42 2014 us=692058 80.187.101.91:15106 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu Dec  4 05:32:42 2014 us=692206 80.187.101.91:15106 [ersterclient] Peer Connection Initiated with [AF_INET]80.187.101.91:15106
Thu Dec  4 05:32:42 2014 us=692486 MULTI: new connection by client 'ersterclient' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Thu Dec  4 05:32:42 2014 us=692532 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Thu Dec  4 05:32:42 2014 us=692607 MULTI: Learn: 10.8.0.6 -> ersterclient/80.187.101.91:15106
Thu Dec  4 05:32:42 2014 us=692638 MULTI: primary virtual IP for ersterclient/80.187.101.91:15106: 10.8.0.6
Thu Dec  4 05:32:45 2014 us=290313 ersterclient/80.187.101.91:15106 PUSH: Received control message: 'PUSH_REQUEST'
Thu Dec  4 05:32:45 2014 us=290401 ersterclient/80.187.101.91:15106 send_push_reply(): safe_cap=940
Thu Dec  4 05:32:45 2014 us=290458 ersterclient/80.187.101.91:15106 SENT CONTROL [ersterclient]: 'PUSH_REPLY,route 192.168.5.0 255.255.255.0,dhcp-option DNS 10.8.0.1,redirect-gateway def1 bypass-dhcp,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Thu Dec  4 05:45:03 2014 us=727682 ersterclient/80.187.101.91:15106 [ersterclient] Inactivity timeout (--ping-restart), restarting
Thu Dec  4 05:45:03 2014 us=727785 ersterclient/80.187.101.91:15106 SIGUSR1[soft,ping-restart] received, client-instance restarting
Thu Dec  4 05:56:07 2014 us=835564 MULTI: multi_create_instance called
Thu Dec  4 05:56:07 2014 us=835711 80.187.101.91:6156 Re-using SSL/TLS context
Thu Dec  4 05:56:07 2014 us=835749 80.187.101.91:6156 LZO compression initialized
Thu Dec  4 05:56:07 2014 us=835881 80.187.101.91:6156 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Dec  4 05:56:07 2014 us=835921 80.187.101.91:6156 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Dec  4 05:56:07 2014 us=835981 80.187.101.91:6156 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Dec  4 05:56:07 2014 us=836008 80.187.101.91:6156 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Thu Dec  4 05:56:07 2014 us=836049 80.187.101.91:6156 Local Options hash (VER=V4): '530fdded'
Thu Dec  4 05:56:07 2014 us=836085 80.187.101.91:6156 Expected Remote Options hash (VER=V4): '41690919'
Thu Dec  4 05:56:07 2014 us=836149 80.187.101.91:6156 TLS: Initial packet from [AF_INET]80.187.101.91:6156, sid=7d0dbe2d 2a1821a2
Thu Dec  4 05:56:09 2014 us=186024 80.187.101.91:6156 VERIFY OK: depth=1, C=DE, ST=Rheinland-Pfalz, L=Mainz, O=ionas OHG, OU=MyOrganizationalUnit, CN=CommonName, name=EasyRSA, emailAddress=cdb@ionas.com
Thu Dec  4 05:56:09 2014 us=186461 80.187.101.91:6156 VERIFY OK: depth=0, C=DE, ST=Rheinland-Pfalz, L=Mainz, O=ionas OHG, OU=MyOrganizationalUnit, CN=ersterclient, name=EasyRSA, emailAddress=cdb@ionas.com
Thu Dec  4 05:56:09 2014 us=625852 80.187.101.91:6156 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Dec  4 05:56:09 2014 us=626057 80.187.101.91:6156 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec  4 05:56:09 2014 us=626185 80.187.101.91:6156 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Dec  4 05:56:09 2014 us=626241 80.187.101.91:6156 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec  4 05:56:09 2014 us=714150 80.187.101.91:6156 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu Dec  4 05:56:09 2014 us=714306 80.187.101.91:6156 [ersterclient] Peer Connection Initiated with [AF_INET]80.187.101.91:6156
Thu Dec  4 05:56:09 2014 us=714369 ersterclient/80.187.101.91:6156 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Thu Dec  4 05:56:09 2014 us=714435 ersterclient/80.187.101.91:6156 MULTI: Learn: 10.8.0.6 -> ersterclient/80.187.101.91:6156
Thu Dec  4 05:56:09 2014 us=714462 ersterclient/80.187.101.91:6156 MULTI: primary virtual IP for ersterclient/80.187.101.91:6156: 10.8.0.6
Thu Dec  4 05:56:12 2014 us=254251 ersterclient/80.187.101.91:6156 PUSH: Received control message: 'PUSH_REQUEST'
Thu Dec  4 05:56:12 2014 us=254336 ersterclient/80.187.101.91:6156 send_push_reply(): safe_cap=940
Thu Dec  4 05:56:12 2014 us=254394 ersterclient/80.187.101.91:6156 SENT CONTROL [ersterclient]: 'PUSH_REPLY,route 192.168.5.0 255.255.255.0,dhcp-option DNS 10.8.0.1,redirect-gateway def1 bypass-dhcp,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Thu Dec  4 06:00:24 2014 us=556766 ersterclient/80.187.101.91:6156 [ersterclient] Inactivity timeout (--ping-restart), restarting
Thu Dec  4 06:00:24 2014 us=556886 ersterclient/80.187.101.91:6156 SIGUSR1[soft,ping-restart] received, client-instance restarting

As you can see there are a lot of dropped packages but I have no idea what to do against it.
Do you have any idea?

Best regards
Christoph

Traffic

ionasOHG wroteAs you can see there are a lot of dropped packages but I have no idea what to do against it.
Do you have any idea?

It is easily fixed ...

Read this HOWTO:
HOWTO: Expanding the scope of the VPN to include additional machines

It explains how to expand the scope of the VPN to include machines on the client subnet, all you need to do is include the client host IP.
So where you add the --iroute statement (in a client-connect-file) you use:
iroute client.private.ip (No mask required as /32 is the default and is what you require)
Also, remember to add the route to the server config.
route client.private.ip

As for your firewall, use only the documented required line and remove all others (For testing):

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE