OV on EasyTomato NAT router behind gateway. No ping of serv.

flowersrj

Hi,

Unable to get my config working. Here are what I think are the relevant details.

At home I have installed an OPENVPN(OV) server on a Asus rtn-16 nat(no Verizon snooping) router (WAN-192.168.1.2, LAN-192.168.2.1) with Easy Tomato. I am only running the server portion of OV on it. It is behind a FIOS ActionTec MI424WR gateway router(LAN-192.168.1.1).

Nothing else is connected to the Actiontec gateway besides the Asus router. On the ActionTec gateway I have defined:

Routes

DESTINATION GATEWAY NETMASK
192.168.2.0 192.168.1.2 255.255.255.255
10.100.100.0 192.168.1.2 255.255.255.0

Portfowards

DESTINATION PORT PACKET
192.168.1.2 1194 UDP

I believe I am getting to the OV server as it gives me an IP.

SAMPLE LOG from client
----------------------

Tue Dec 09 14:02:10 2014 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Tue Dec 09 14:02:10 2014 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Dec 09 14:02:10 2014 LZO compression initialized
Tue Dec 09 14:02:10 2014 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Dec 09 14:02:10 2014 Socket Buffers: R=[8192->8192] S=[64512->64512]
Tue Dec 09 14:02:10 2014 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Dec 09 14:02:10 2014 Local Options hash (VER=V4): '41690919'
Tue Dec 09 14:02:10 2014 Expected Remote Options hash (VER=V4): '530fdded'
Tue Dec 09 14:02:10 2014 UDPv4 link local: [undef]
Tue Dec 09 14:02:10 2014 UDPv4 link remote: 173.75.45.238:1194
Tue Dec 09 14:02:10 2014 TLS: Initial packet from 173.75.45.238:1194, sid=86395ba0 f59e5858
Tue Dec 09 14:02:10 2014 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=Fort-

Funston/OU=changeme/CN=changeme/name=changeme/emailAddress=mail@host.domain
Tue Dec 09 14:02:10 2014 VERIFY OK: nsCertType=SERVER
Tue Dec 09 14:02:10 2014 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=Fort-

Funston/OU=changeme/CN=server/name=changeme/emailAddress=mail@host.domain
Tue Dec 09 14:02:11 2014 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Dec 09 14:02:11 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Dec 09 14:02:11 2014 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Dec 09 14:02:11 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Dec 09 14:02:11 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Dec 09 14:02:11 2014 [server] Peer Connection Initiated with 173.75.45.238:1194
Tue Dec 09 14:02:13 2014 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue Dec 09 14:02:13 2014 PUSH: Received control message: 'PUSH_REPLY,route 192.168.2.0 255.255.255.0,dhcp-option DNS 192.168.2.1,route

10.100.100.1,topology net30,ping 15,ping-restart 60,ifconfig 10.100.100.6 10.100.100.5'
Tue Dec 09 14:02:13 2014 OPTIONS IMPORT: timers and/or timeouts modified
Tue Dec 09 14:02:13 2014 OPTIONS IMPORT: --ifconfig/up options modified
Tue Dec 09 14:02:13 2014 OPTIONS IMPORT: route options modified
Tue Dec 09 14:02:13 2014 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Dec 09 14:02:13 2014 ROUTE default_gateway=10.103.14.1
Tue Dec 09 14:02:13 2014 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{20842D55-E981-4590-987A-1682B3975FB6}.tap
Tue Dec 09 14:02:13 2014 TAP-Win32 Driver Version 9.9
Tue Dec 09 14:02:13 2014 TAP-Win32 MTU=1500
Tue Dec 09 14:02:13 2014 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.100.100.6/255.255.255.252 on interface {20842D55-E981-4590-

987A-1682B3975FB6} [DHCP-serv: 10.100.100.5, lease-time: 31536000]
Tue Dec 09 14:02:13 2014 Successful ARP Flush on interface [25] {20842D55-E981-4590-987A-1682B3975FB6}
Tue Dec 09 14:02:19 2014 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Tue Dec 09 14:02:19 2014 C:\WINDOWS\system32\route.exe ADD 192.168.2.0 MASK 255.255.255.0 10.100.100.5
Tue Dec 09 14:02:19 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Dec 09 14:02:19 2014 Route addition via IPAPI succeeded [adaptive]
Tue Dec 09 14:02:19 2014 C:\WINDOWS\system32\route.exe ADD 10.100.100.1 MASK 255.255.255.255 10.100.100.5
Tue Dec 09 14:02:19 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Dec 09 14:02:19 2014 Route addition via IPAPI succeeded [adaptive]
Tue Dec 09 14:02:19 2014 Initialization Sequence Completed
Tue Dec 09 14:02:28 2014 Authenticate/Decrypt packet error: cipher final failed
Tue Dec 09 14:02:30 2014 TCP/UDP: Closing socket
Tue Dec 09 14:02:30 2014 C:\WINDOWS\system32\route.exe DELETE 10.100.100.1 MASK 255.255.255.255 10.100.100.5
Tue Dec 09 14:02:30 2014 Route deletion via IPAPI succeeded [adaptive]
Tue Dec 09 14:02:30 2014 C:\WINDOWS\system32\route.exe DELETE 192.168.2.0 MASK 255.255.255.0 10.100.100.5
Tue Dec 09 14:02:30 2014 Route deletion via IPAPI succeeded [adaptive]
Tue Dec 09 14:02:30 2014 Closing TUN/TAP interface
Tue Dec 09 14:02:30 2014 SIGTERM[hard,] received, process exiting

client.ovpn used at work
------------------------
client
remote my-DNS-name 1194

ns-cert-type server

dev tun
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
float
ca ca.crt
cert client1.crt
key client1.key
dh dh1024.pem
comp-lzo adaptive
verb 3

server conf found on Asus router
--------------------------------

# Automatically generated configuration
daemon
server 10.100.100.0 255.255.255.0
proto udp
port 1194
dev tun21
cipher AES-128-CBC
comp-lzo adaptive
keepalive 15 60
verb 3
push "route 192.168.2.0 255.255.255.0"
push "dhcp-option DNS 192.168.2.1"
ca ca.crt
dh dh.pem
cert server.crt
key server.key
status-version 2
status status

1. I believe I'm getting to OV server as it gives me an IP. Can I assume my routing is good ?
2. Another question I have is whether my Routes on 192.168.1.1 are correct?
3. Any suggestions on what I 've done wrong?

Thanks, Rich

flowersrj

Just saw the request for "VERB 4".

Tue Dec 09 15:11:14 2014 us=506000 Current Parameter Settings:
Tue Dec 09 15:11:14 2014 us=506000 config = 'MyConnection.ovpn'
Tue Dec 09 15:11:14 2014 us=506000 mode = 0
Tue Dec 09 15:11:14 2014 us=506000 show_ciphers = DISABLED
Tue Dec 09 15:11:14 2014 us=506000 show_digests = DISABLED
Tue Dec 09 15:11:14 2014 us=506000 show_engines = DISABLED
Tue Dec 09 15:11:14 2014 us=506000 genkey = DISABLED
Tue Dec 09 15:11:14 2014 us=506000 key_pass_file = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=506000 show_tls_ciphers = DISABLED
Tue Dec 09 15:11:14 2014 us=506000 Connection profiles [default]:
Tue Dec 09 15:11:14 2014 us=506000 proto = udp
Tue Dec 09 15:11:14 2014 us=506000 local = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=506000 local_port = 0
Tue Dec 09 15:11:14 2014 us=506000 remote = 'myDNS.no-ip.info'
Tue Dec 09 15:11:14 2014 us=506000 remote_port = 1194
Tue Dec 09 15:11:14 2014 us=506000 remote_float = ENABLED
Tue Dec 09 15:11:14 2014 us=506000 bind_defined = DISABLED
Tue Dec 09 15:11:14 2014 us=506000 bind_local = DISABLED
Tue Dec 09 15:11:14 2014 us=506000 connect_retry_seconds = 5
Tue Dec 09 15:11:14 2014 us=506000 connect_timeout = 10
Tue Dec 09 15:11:14 2014 us=506000 connect_retry_max = 0
Tue Dec 09 15:11:14 2014 us=506000 socks_proxy_server = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=506000 socks_proxy_port = 0
Tue Dec 09 15:11:14 2014 us=506000 socks_proxy_retry = DISABLED
Tue Dec 09 15:11:14 2014 us=506000 Connection profiles END
Tue Dec 09 15:11:14 2014 us=506000 remote_random = DISABLED
Tue Dec 09 15:11:14 2014 us=506000 ipchange = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=506000 dev = 'tun'
Tue Dec 09 15:11:14 2014 us=506000 dev_type = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=506000 dev_node = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=506000 lladdr = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=506000 topology = 1
Tue Dec 09 15:11:14 2014 us=506000 tun_ipv6 = DISABLED
Tue Dec 09 15:11:14 2014 us=506000 ifconfig_local = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=506000 ifconfig_remote_netmask = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=506000 ifconfig_noexec = DISABLED
Tue Dec 09 15:11:14 2014 us=506000 ifconfig_nowarn = DISABLED
Tue Dec 09 15:11:14 2014 us=506000 shaper = 0
Tue Dec 09 15:11:14 2014 us=506000 tun_mtu = 1500
Tue Dec 09 15:11:14 2014 us=506000 tun_mtu_defined = ENABLED
Tue Dec 09 15:11:14 2014 us=506000 link_mtu = 1500
Tue Dec 09 15:11:14 2014 us=506000 link_mtu_defined = DISABLED
Tue Dec 09 15:11:14 2014 us=506000 tun_mtu_extra = 0
Tue Dec 09 15:11:14 2014 us=506000 tun_mtu_extra_defined = DISABLED
Tue Dec 09 15:11:14 2014 us=506000 fragment = 0
Tue Dec 09 15:11:14 2014 us=506000 mtu_discover_type = -1
Tue Dec 09 15:11:14 2014 us=506000 mtu_test = 0
Tue Dec 09 15:11:14 2014 us=506000 mlock = DISABLED
Tue Dec 09 15:11:14 2014 us=506000 keepalive_ping = 0
Tue Dec 09 15:11:14 2014 us=506000 keepalive_timeout = 0
Tue Dec 09 15:11:14 2014 us=506000 inactivity_timeout = 0
Tue Dec 09 15:11:14 2014 us=506000 ping_send_timeout = 0
Tue Dec 09 15:11:14 2014 us=506000 ping_rec_timeout = 0
Tue Dec 09 15:11:14 2014 us=506000 ping_rec_timeout_action = 0
Tue Dec 09 15:11:14 2014 us=506000 ping_timer_remote = DISABLED
Tue Dec 09 15:11:14 2014 us=506000 remap_sigusr1 = 0
Tue Dec 09 15:11:14 2014 us=506000 explicit_exit_notification = 0
Tue Dec 09 15:11:14 2014 us=506000 persist_tun = ENABLED
Tue Dec 09 15:11:14 2014 us=506000 persist_local_ip = DISABLED
Tue Dec 09 15:11:14 2014 us=506000 persist_remote_ip = DISABLED
Tue Dec 09 15:11:14 2014 us=506000 persist_key = ENABLED
Tue Dec 09 15:11:14 2014 us=506000 mssfix = 1450
Tue Dec 09 15:11:14 2014 us=506000 resolve_retry_seconds = 1000000000
Tue Dec 09 15:11:14 2014 us=506000 username = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=506000 groupname = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=506000 chroot_dir = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=506000 cd_dir = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=506000 writepid = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=756000 up_script = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=756000 down_script = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=756000 down_pre = DISABLED
Tue Dec 09 15:11:14 2014 us=756000 up_restart = DISABLED
Tue Dec 09 15:11:14 2014 us=756000 up_delay = DISABLED
Tue Dec 09 15:11:14 2014 us=756000 daemon = DISABLED
Tue Dec 09 15:11:14 2014 us=756000 inetd = 0
Tue Dec 09 15:11:14 2014 us=756000 log = DISABLED
Tue Dec 09 15:11:14 2014 us=756000 suppress_timestamps = DISABLED
Tue Dec 09 15:11:14 2014 us=756000 nice = 0
Tue Dec 09 15:11:14 2014 us=756000 verbosity = 4
Tue Dec 09 15:11:14 2014 us=756000 mute = 0
Tue Dec 09 15:11:14 2014 us=756000 gremlin = 0
Tue Dec 09 15:11:14 2014 us=756000 status_file = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=756000 status_file_version = 1
Tue Dec 09 15:11:14 2014 us=756000 status_file_update_freq = 60
Tue Dec 09 15:11:14 2014 us=756000 occ = ENABLED
Tue Dec 09 15:11:14 2014 us=756000 rcvbuf = 0
Tue Dec 09 15:11:14 2014 us=756000 sndbuf = 0
Tue Dec 09 15:11:14 2014 us=756000 sockflags = 0
Tue Dec 09 15:11:14 2014 us=756000 fast_io = DISABLED
Tue Dec 09 15:11:14 2014 us=756000 lzo = 7
Tue Dec 09 15:11:14 2014 us=756000 route_script = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=756000 route_default_gateway = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=756000 route_default_metric = 0
Tue Dec 09 15:11:14 2014 us=756000 route_noexec = DISABLED
Tue Dec 09 15:11:14 2014 us=756000 route_delay = 5
Tue Dec 09 15:11:14 2014 us=756000 route_delay_window = 30
Tue Dec 09 15:11:14 2014 us=756000 route_delay_defined = ENABLED
Tue Dec 09 15:11:14 2014 us=756000 route_nopull = DISABLED
Tue Dec 09 15:11:14 2014 us=756000 route_gateway_via_dhcp = DISABLED
Tue Dec 09 15:11:14 2014 us=756000 max_routes = 100
Tue Dec 09 15:11:14 2014 us=756000 allow_pull_fqdn = DISABLED
Tue Dec 09 15:11:14 2014 us=756000 management_addr = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=802000 management_port = 0
Tue Dec 09 15:11:14 2014 us=802000 management_user_pass = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=802000 management_log_history_cache = 250
Tue Dec 09 15:11:14 2014 us=802000 management_echo_buffer_size = 100
Tue Dec 09 15:11:14 2014 us=802000 management_write_peer_info_file = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=802000 management_client_user = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=802000 management_client_group = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=802000 management_flags = 0
Tue Dec 09 15:11:14 2014 us=802000 shared_secret_file = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=802000 key_direction = 0
Tue Dec 09 15:11:14 2014 us=802000 ciphername_defined = ENABLED
Tue Dec 09 15:11:14 2014 us=802000 ciphername = 'BF-CBC'
Tue Dec 09 15:11:14 2014 us=802000 authname_defined = ENABLED
Tue Dec 09 15:11:14 2014 us=802000 authname = 'SHA1'
Tue Dec 09 15:11:14 2014 us=802000 prng_hash = 'SHA1'
Tue Dec 09 15:11:14 2014 us=802000 prng_nonce_secret_len = 16
Tue Dec 09 15:11:14 2014 us=834000 keysize = 0
Tue Dec 09 15:11:14 2014 us=834000 engine = DISABLED
Tue Dec 09 15:11:14 2014 us=834000 replay = ENABLED
Tue Dec 09 15:11:14 2014 us=834000 mute_replay_warnings = DISABLED
Tue Dec 09 15:11:14 2014 us=834000 replay_window = 64
Tue Dec 09 15:11:14 2014 us=834000 replay_time = 15
Tue Dec 09 15:11:14 2014 us=834000 packet_id_file = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=834000 use_iv = ENABLED
Tue Dec 09 15:11:14 2014 us=834000 test_crypto = DISABLED
Tue Dec 09 15:11:14 2014 us=834000 tls_server = DISABLED
Tue Dec 09 15:11:14 2014 us=834000 tls_client = ENABLED
Tue Dec 09 15:11:14 2014 us=834000 key_method = 2
Tue Dec 09 15:11:14 2014 us=834000 ca_file = 'ca.crt'
Tue Dec 09 15:11:14 2014 us=834000 ca_path = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=834000 dh_file = 'dh1024.pem'
Tue Dec 09 15:11:14 2014 us=834000 cert_file = 'client1.crt'
Tue Dec 09 15:11:14 2014 us=834000 priv_key_file = 'client1.key'
Tue Dec 09 15:11:14 2014 us=849000 pkcs12_file = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=849000 cryptoapi_cert = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=849000 cipher_list = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=849000 tls_verify = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=849000 tls_export_cert = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=849000 tls_remote = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=849000 crl_file = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=849000 ns_cert_type = 64
Tue Dec 09 15:11:14 2014 us=849000 remote_cert_ku = 0
Tue Dec 09 15:11:14 2014 us=849000 remote_cert_ku = 0
Tue Dec 09 15:11:14 2014 us=849000 remote_cert_ku = 0
Tue Dec 09 15:11:14 2014 us=849000 remote_cert_ku = 0
Tue Dec 09 15:11:14 2014 us=849000 remote_cert_ku = 0
Tue Dec 09 15:11:14 2014 us=849000 remote_cert_ku = 0
Tue Dec 09 15:11:14 2014 us=849000 remote_cert_ku = 0
Tue Dec 09 15:11:14 2014 us=849000 remote_cert_ku = 0
Tue Dec 09 15:11:14 2014 us=865000 remote_cert_ku = 0
Tue Dec 09 15:11:14 2014 us=865000 remote_cert_ku = 0
Tue Dec 09 15:11:14 2014 us=865000 remote_cert_ku[i] = 0
Tue Dec 09 15:11:14 2014 us=865000 remote_cert_ku[i] = 0
Tue Dec 09 15:11:14 2014 us=865000 remote_cert_ku[i] = 0
Tue Dec 09 15:11:14 2014 us=865000 remote_cert_ku[i] = 0
Tue Dec 09 15:11:14 2014 us=865000 remote_cert_ku[i] = 0
Tue Dec 09 15:11:14 2014 us=865000 remote_cert_ku[i] = 0
Tue Dec 09 15:11:14 2014 us=865000 remote_cert_eku = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=865000 tls_timeout = 2
Tue Dec 09 15:11:14 2014 us=865000 renegotiate_bytes = 0
Tue Dec 09 15:11:14 2014 us=865000 renegotiate_packets = 0
Tue Dec 09 15:11:14 2014 us=865000 renegotiate_seconds = 3600
Tue Dec 09 15:11:14 2014 us=865000 handshake_window = 60
Tue Dec 09 15:11:14 2014 us=865000 transition_window = 3600
Tue Dec 09 15:11:14 2014 us=865000 single_session = DISABLED
Tue Dec 09 15:11:14 2014 us=880000 push_peer_info = DISABLED
Tue Dec 09 15:11:14 2014 us=880000 tls_exit = DISABLED
Tue Dec 09 15:11:14 2014 us=880000 tls_auth_file = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=880000 pkcs11_protected_authentication = DISABLED
Tue Dec 09 15:11:14 2014 us=880000 pkcs11_protected_authentication = DISABLED
Tue Dec 09 15:11:14 2014 us=880000 pkcs11_protected_authentication = DISABLED
Tue Dec 09 15:11:14 2014 us=880000 pkcs11_protected_authentication = DISABLED
Tue Dec 09 15:11:14 2014 us=880000 pkcs11_protected_authentication = DISABLED
Tue Dec 09 15:11:14 2014 us=880000 pkcs11_protected_authentication = DISABLED
Tue Dec 09 15:11:14 2014 us=880000 pkcs11_protected_authentication = DISABLED
Tue Dec 09 15:11:14 2014 us=880000 pkcs11_protected_authentication = DISABLED
Tue Dec 09 15:11:14 2014 us=880000 pkcs11_protected_authentication = DISABLED
Tue Dec 09 15:11:14 2014 us=880000 pkcs11_protected_authentication = DISABLED
Tue Dec 09 15:11:14 2014 us=896000 pkcs11_protected_authentication = DISABLED
Tue Dec 09 15:11:14 2014 us=896000 pkcs11_protected_authentication = DISABLED
Tue Dec 09 15:11:14 2014 us=896000 pkcs11_protected_authentication = DISABLED
Tue Dec 09 15:11:14 2014 us=896000 pkcs11_protected_authentication = DISABLED
Tue Dec 09 15:11:14 2014 us=896000 pkcs11_protected_authentication = DISABLED
Tue Dec 09 15:11:14 2014 us=896000 pkcs11_protected_authentication = DISABLED
Tue Dec 09 15:11:14 2014 us=896000 pkcs11_private_mode = 00000000
Tue Dec 09 15:11:14 2014 us=896000 pkcs11_private_mode = 00000000
Tue Dec 09 15:11:14 2014 us=896000 pkcs11_private_mode = 00000000
Tue Dec 09 15:11:14 2014 us=896000 pkcs11_private_mode = 00000000
Tue Dec 09 15:11:14 2014 us=896000 pkcs11_private_mode = 00000000
Tue Dec 09 15:11:14 2014 us=896000 pkcs11_private_mode = 00000000
Tue Dec 09 15:11:14 2014 us=896000 pkcs11_private_mode = 00000000
Tue Dec 09 15:11:14 2014 us=896000 pkcs11_private_mode = 00000000
Tue Dec 09 15:11:14 2014 us=912000 pkcs11_private_mode = 00000000
Tue Dec 09 15:11:14 2014 us=912000 pkcs11_private_mode = 00000000
Tue Dec 09 15:11:14 2014 us=912000 pkcs11_private_mode = 00000000
Tue Dec 09 15:11:14 2014 us=912000 pkcs11_private_mode = 00000000
Tue Dec 09 15:11:14 2014 us=912000 pkcs11_private_mode = 00000000
Tue Dec 09 15:11:14 2014 us=912000 pkcs11_private_mode = 00000000
Tue Dec 09 15:11:14 2014 us=912000 pkcs11_private_mode = 00000000
Tue Dec 09 15:11:14 2014 us=912000 pkcs11_private_mode = 00000000
Tue Dec 09 15:11:14 2014 us=912000 pkcs11_cert_private = DISABLED
Tue Dec 09 15:11:14 2014 us=912000 pkcs11_cert_private = DISABLED
Tue Dec 09 15:11:14 2014 us=912000 pkcs11_cert_private = DISABLED
Tue Dec 09 15:11:14 2014 us=912000 pkcs11_cert_private = DISABLED
Tue Dec 09 15:11:14 2014 us=912000 pkcs11_cert_private = DISABLED
Tue Dec 09 15:11:14 2014 us=912000 pkcs11_cert_private = DISABLED
Tue Dec 09 15:11:14 2014 us=927000 pkcs11_cert_private = DISABLED
Tue Dec 09 15:11:14 2014 us=927000 pkcs11_cert_private = DISABLED
Tue Dec 09 15:11:14 2014 us=927000 pkcs11_cert_private = DISABLED
Tue Dec 09 15:11:14 2014 us=927000 pkcs11_cert_private = DISABLED
Tue Dec 09 15:11:14 2014 us=927000 pkcs11_cert_private = DISABLED
Tue Dec 09 15:11:14 2014 us=927000 pkcs11_cert_private = DISABLED
Tue Dec 09 15:11:14 2014 us=927000 pkcs11_cert_private = DISABLED
Tue Dec 09 15:11:14 2014 us=927000 pkcs11_cert_private = DISABLED
Tue Dec 09 15:11:14 2014 us=927000 pkcs11_cert_private = DISABLED
Tue Dec 09 15:11:14 2014 us=927000 pkcs11_cert_private = DISABLED
Tue Dec 09 15:11:14 2014 us=927000 pkcs11_pin_cache_period = -1
Tue Dec 09 15:11:14 2014 us=927000 pkcs11_id = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=927000 pkcs11_id_management = DISABLED
Tue Dec 09 15:11:14 2014 us=927000 server_network = 0.0.0.0
Tue Dec 09 15:11:14 2014 us=927000 server_netmask = 0.0.0.0
Tue Dec 09 15:11:14 2014 us=943000 server_bridge_ip = 0.0.0.0
Tue Dec 09 15:11:14 2014 us=943000 server_bridge_netmask = 0.0.0.0
Tue Dec 09 15:11:14 2014 us=943000 server_bridge_pool_start = 0.0.0.0
Tue Dec 09 15:11:14 2014 us=943000 server_bridge_pool_end = 0.0.0.0
Tue Dec 09 15:11:14 2014 us=943000 ifconfig_pool_defined = DISABLED
Tue Dec 09 15:11:14 2014 us=943000 ifconfig_pool_start = 0.0.0.0
Tue Dec 09 15:11:14 2014 us=943000 ifconfig_pool_end = 0.0.0.0
Tue Dec 09 15:11:14 2014 us=943000 ifconfig_pool_netmask = 0.0.0.0
Tue Dec 09 15:11:14 2014 us=943000 ifconfig_pool_persist_filename = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=943000 ifconfig_pool_persist_refresh_freq = 600
Tue Dec 09 15:11:14 2014 us=943000 n_bcast_buf = 256
Tue Dec 09 15:11:14 2014 us=943000 tcp_queue_limit = 64
Tue Dec 09 15:11:14 2014 us=943000 real_hash_size = 256
Tue Dec 09 15:11:14 2014 us=943000 virtual_hash_size = 256
Tue Dec 09 15:11:14 2014 us=958000 client_connect_script = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=958000 learn_address_script = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=958000 client_disconnect_script = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=958000 client_config_dir = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=958000 ccd_exclusive = DISABLED
Tue Dec 09 15:11:14 2014 us=958000 tmp_dir = 'C:\Users\FLOWER~1\AppData\Local\Temp\'
Tue Dec 09 15:11:14 2014 us=958000 push_ifconfig_defined = DISABLED
Tue Dec 09 15:11:14 2014 us=958000 push_ifconfig_local = 0.0.0.0
Tue Dec 09 15:11:14 2014 us=958000 push_ifconfig_remote_netmask = 0.0.0.0
Tue Dec 09 15:11:14 2014 us=958000 enable_c2c = DISABLED
Tue Dec 09 15:11:14 2014 us=958000 duplicate_cn = DISABLED
Tue Dec 09 15:11:14 2014 us=958000 cf_max = 0
Tue Dec 09 15:11:14 2014 us=958000 cf_per = 0
Tue Dec 09 15:11:14 2014 us=958000 max_clients = 1024
Tue Dec 09 15:11:14 2014 us=958000 max_routes_per_client = 256
Tue Dec 09 15:11:14 2014 us=958000 auth_user_pass_verify_script = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=958000 auth_user_pass_verify_script_via_file = DISABLED
Tue Dec 09 15:11:14 2014 us=958000 ssl_flags = 0
Tue Dec 09 15:11:14 2014 us=958000 client = ENABLED
Tue Dec 09 15:11:14 2014 us=958000 pull = ENABLED
Tue Dec 09 15:11:14 2014 us=958000 auth_user_pass_file = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=958000 show_net_up = DISABLED
Tue Dec 09 15:11:14 2014 us=958000 route_method = 0
Tue Dec 09 15:11:14 2014 us=958000 ip_win32_defined = DISABLED
Tue Dec 09 15:11:14 2014 us=958000 ip_win32_type = 3
Tue Dec 09 15:11:14 2014 us=958000 dhcp_masq_offset = 0
Tue Dec 09 15:11:14 2014 us=958000 dhcp_lease_time = 31536000
Tue Dec 09 15:11:14 2014 us=958000 tap_sleep = 0
Tue Dec 09 15:11:14 2014 us=958000 dhcp_options = DISABLED
Tue Dec 09 15:11:14 2014 us=958000 dhcp_renew = DISABLED
Tue Dec 09 15:11:14 2014 us=958000 dhcp_pre_release = DISABLED
Tue Dec 09 15:11:14 2014 us=974000 dhcp_release = DISABLED
Tue Dec 09 15:11:14 2014 us=974000 domain = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=974000 netbios_scope = '[UNDEF]'
Tue Dec 09 15:11:14 2014 us=974000 netbios_node_type = 0
Tue Dec 09 15:11:14 2014 us=974000 disable_nbt = DISABLED
Tue Dec 09 15:11:14 2014 us=974000 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Tue Dec 09 15:11:14 2014 us=974000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Dec 09 15:11:15 2014 us=146000 LZO compression initialized
Tue Dec 09 15:11:15 2014 us=146000 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Dec 09 15:11:15 2014 us=146000 Socket Buffers: R=[8192->8192] S=[64512->64512]
Tue Dec 09 15:11:15 2014 us=161000 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Dec 09 15:11:15 2014 us=161000 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth

SHA1,keysize 128,key-method 2,tls-client'
Tue Dec 09 15:11:15 2014 us=161000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-

CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Tue Dec 09 15:11:15 2014 us=161000 Local Options hash (VER=V4): '41690919'
Tue Dec 09 15:11:15 2014 us=161000 Expected Remote Options hash (VER=V4): '530fdded'
Tue Dec 09 15:11:15 2014 us=161000 UDPv4 link local: [undef]
Tue Dec 09 15:11:15 2014 us=161000 UDPv4 link remote: 173.75.45.238:1194
Tue Dec 09 15:11:15 2014 us=192000 TLS: Initial packet from 173.75.45.238:1194, sid=22a187b3 26429d3e
Tue Dec 09 15:11:15 2014 us=458000 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=Fort-

Funston/OU=changeme/CN=changeme/name=changeme/emailAddress=mail@host.domain
Tue Dec 09 15:11:15 2014 us=458000 VERIFY OK: nsCertType=SERVER
Tue Dec 09 15:11:15 2014 us=458000 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=Fort-

Funston/OU=changeme/CN=server/name=changeme/emailAddress=mail@host.domain
Tue Dec 09 15:11:15 2014 us=863000 NOTE: Options consistency check may be skewed by version differences
Tue Dec 09 15:11:15 2014 us=863000 WARNING: 'version' is used inconsistently, local='version V4', remote='version V0 UNDEF'
Tue Dec 09 15:11:15 2014 us=863000 WARNING: 'dev-type' is present in local config but missing in remote config, local='dev-type tun'
Tue Dec 09 15:11:15 2014 us=863000 WARNING: 'link-mtu' is present in local config but missing in remote config, local='link-mtu 1542'
Tue Dec 09 15:11:15 2014 us=863000 WARNING: 'tun-mtu' is present in local config but missing in remote config, local='tun-mtu 1500'
Tue Dec 09 15:11:15 2014 us=863000 WARNING: 'proto' is present in local config but missing in remote config, local='proto UDPv4'
Tue Dec 09 15:11:15 2014 us=863000 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Tue Dec 09 15:11:15 2014 us=863000 WARNING: 'cipher' is present in local config but missing in remote config, local='cipher BF-CBC'
Tue Dec 09 15:11:15 2014 us=863000 WARNING: 'auth' is present in local config but missing in remote config, local='auth SHA1'
Tue Dec 09 15:11:15 2014 us=863000 WARNING: 'keysize' is present in local config but missing in remote config, local='keysize 128'
Tue Dec 09 15:11:15 2014 us=863000 WARNING: 'key-method' is present in local config but missing in remote config, local='key-method 2'
Tue Dec 09 15:11:15 2014 us=863000 WARNING: 'tls-server' is present in local config but missing in remote config, local='tls-server'
Tue Dec 09 15:11:15 2014 us=863000 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Dec 09 15:11:15 2014 us=863000 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Dec 09 15:11:15 2014 us=863000 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Dec 09 15:11:15 2014 us=863000 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Dec 09 15:11:15 2014 us=863000 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Dec 09 15:11:15 2014 us=863000 [server] Peer Connection Initiated with 173.75.45.238:1194
Tue Dec 09 15:11:18 2014 us=328000 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue Dec 09 15:11:18 2014 us=359000 PUSH: Received control message: 'PUSH_REPLY,route 192.168.2.0 255.255.255.0,dhcp-option DNS

192.168.2.1,route 10.100.100.1,topology net30,ping 15,ping-restart 60,ifconfig 10.100.100.6 10.100.100.5'
Tue Dec 09 15:11:18 2014 us=359000 OPTIONS IMPORT: timers and/or timeouts modified
Tue Dec 09 15:11:18 2014 us=359000 OPTIONS IMPORT: --ifconfig/up options modified
Tue Dec 09 15:11:18 2014 us=359000 OPTIONS IMPORT: route options modified
Tue Dec 09 15:11:18 2014 us=359000 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Dec 09 15:11:18 2014 us=359000 ROUTE default_gateway=10.103.14.1
Tue Dec 09 15:11:18 2014 us=359000 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{BF1B359C-FA7D-4496-8520-6B135DAC433E}.tap
Tue Dec 09 15:11:18 2014 us=359000 TAP-Win32 Driver Version 9.9
Tue Dec 09 15:11:18 2014 us=359000 TAP-Win32 MTU=1500
Tue Dec 09 15:11:18 2014 us=359000 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.100.100.6/255.255.255.252 on interface {BF1B359C-

FA7D-4496-8520-6B135DAC433E} [DHCP-serv: 10.100.100.5, lease-time: 31536000]
Tue Dec 09 15:11:18 2014 us=359000 DHCP option string: 0604c0a8 0201
Tue Dec 09 15:11:18 2014 us=359000 Successful ARP Flush on interface [25] {BF1B359C-FA7D-4496-8520-6B135DAC433E}
Tue Dec 09 15:11:23 2014 us=710000 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Tue Dec 09 15:11:23 2014 us=710000 C:\WINDOWS\system32\route.exe ADD 192.168.2.0 MASK 255.255.255.0 10.100.100.5
Tue Dec 09 15:11:23 2014 us=710000 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Dec 09 15:11:23 2014 us=710000 Route addition via IPAPI succeeded [adaptive]
Tue Dec 09 15:11:23 2014 us=710000 C:\WINDOWS\system32\route.exe ADD 10.100.100.1 MASK 255.255.255.255 10.100.100.5
Tue Dec 09 15:11:23 2014 us=710000 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Dec 09 15:11:23 2014 us=710000 Route addition via IPAPI succeeded [adaptive]
Tue Dec 09 15:11:23 2014 us=710000 Initialization Sequence Completed
Tue Dec 09 15:11:33 2014 us=476000 Authenticate/Decrypt packet error: cipher final failed
Tue Dec 09 15:11:48 2014 us=623000 Authenticate/Decrypt packet error: cipher final failed
Tue Dec 09 15:12:03 2014 us=818000 Authenticate/Decrypt packet error: cipher final failed
Tue Dec 09 15:12:18 2014 us=638000 Authenticate/Decrypt packet error: cipher final failed
Tue Dec 09 15:12:18 2014 us=638000 [server] Inactivity timeout (--ping-restart), restarting
Tue Dec 09 15:12:18 2014 us=638000 TCP/UDP: Closing socket
Tue Dec 09 15:12:18 2014 us=638000 SIGUSR1[soft,ping-restart] received, process restarting
Tue Dec 09 15:12:18 2014 us=638000 Restart pause, 2 second(s)
Tue Dec 09 15:12:20 2014 us=650000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Dec 09 15:12:20 2014 us=650000 Re-using SSL/TLS context
Tue Dec 09 15:12:20 2014 us=650000 LZO compression initialized
Tue Dec 09 15:12:20 2014 us=650000 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Dec 09 15:12:20 2014 us=650000 Socket Buffers: R=[8192->8192] S=[64512->64512]
Tue Dec 09 15:12:21 2014 us=680000 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Dec 09 15:12:21 2014 us=680000 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth

SHA1,keysize 128,key-method 2,tls-client'
Tue Dec 09 15:12:21 2014 us=680000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-

CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Tue Dec 09 15:12:21 2014 us=680000 Local Options hash (VER=V4): '41690919'
Tue Dec 09 15:12:21 2014 us=680000 Expected Remote Options hash (VER=V4): '530fdded'
Tue Dec 09 15:12:21 2014 us=680000 UDPv4 link local: [undef]
Tue Dec 09 15:12:21 2014 us=680000 UDPv4 link remote: 173.75.45.238:1194
Tue Dec 09 15:12:21 2014 us=680000 TCP/UDP: Closing socket
Tue Dec 09 15:12:21 2014 us=680000 C:\WINDOWS\system32\route.exe DELETE 10.100.100.1 MASK 255.255.255.255 10.100.100.5
Tue Dec 09 15:12:21 2014 us=680000 Route deletion via IPAPI succeeded [adaptive]
Tue Dec 09 15:12:21 2014 us=680000 C:\WINDOWS\system32\route.exe DELETE 192.168.2.0 MASK 255.255.255.0 10.100.100.5
Tue Dec 09 15:12:21 2014 us=696000 Route deletion via IPAPI succeeded [adaptive]
Tue Dec 09 15:12:21 2014 us=696000 Closing TUN/TAP interface
Tue Dec 09 15:12:21 2014 us=696000 SIGTERM[hard,] received, process exiting

Traffic

flowersrj wrote1. I believe I'm getting to OV server as it gives me an IP. Can I assume my routing is good ?

OpenVPN is working fine according to your logs: Your client connects and gets an ip address ...

flowersrj wrote2. Another question I have is whether my Routes on 192.168.1.1 are correct?

flowersrj wroteOn the ActionTec gateway I have defined:

Routes

DESTINATION GATEWAY NETMASK
192.168.2.0 192.168.1.2 255.255.255.255 <<-- Check this netmask out ...
10.100.100.0 192.168.1.2 255.255.255.0

route 192.168.2.0 netmask 255.255.255.0 gateway 192.168.1.2

flowersrj

Traffic,

You suggestion has resulted in good progress after a frustrating week. Changed routes on gateway to the following...

DESTINATION GATEWAY NETMASK
192.168.2.0 192.168.1.2 255.255.255.0
10.100.100.0 192.168.1.1 255.255.255.0

As a result I now can ping OV server 192.168.2.1--yippee!!. However, I can NOT ping anything else on 192.168.2.*.

Do I need to do something special to access the rest of the devices on 192.168.2.*. In OpenTomato, I have checked a box labeled "Push LAN to clients" which I think resulted in the following being in the server config file...

push "route 192.168.2.0 255.255.255.0"
push "dhcp-option DNS 192.168.2.1"

Thanks, Rich

flowersrj

More specific update ...

Now I can ping OV server from client.
I can NOT ping connected client from the OV server/router.
I can NOT ping any other devices like webcams and RaspberryPI on 192.168.2* lan from connected client.

Current routes on gateway

DESTINATION GATEWAY NETMASK
192.168.2.0 192.168.1.2 255.255.255.0
10.100.100.0 192.168.1.1 255.255.255.0

...Rich

Traffic

flowersrj wroteNow I can ping OV server from client.
I can NOT ping connected client from the OV server/router.

Check your firewalls ..

flowersrj wroteI can NOT ping any other devices like webcams and RaspberryPI on 192.168.2* lan from connected client

Did you enable IP forwarding on your router and check the firewalls of router and devices on subnet and client.

flowersrj

Traffic,

If you mean port forwarding when you say "IP Forwarding" I am sure of my settings as I have much experience in that area.

So I am guessing a route may be incorrect and I will look at those..

Rich

flowersrj

Hi.

I don't need to access the client from OV server. So, is it a symptom of a bad config that I can't ping the client or should I automatically be able to or is it something that I have to set it up specifically to do.

-Rich

Traffic

flowersrj wroteIf you mean port forwarding when you say "IP Forwarding" I am sure of my settings as I have much experience in that area

IP_Forwarding

flowersrj wroteis it a symptom of a bad config that I can't ping the client or should I automatically be able to

Barring a firewall issue (most likely on your client) you should be able to ping 10.100.100.6(client) from 10.100.100.1(server) and server from client ..

flowersrj

Traffic,

I checked and IP_Forwarding was already set to 1.

A LAN person at work asked me if my OV server app is on the LAN or WAN side so he could better consider the routes it automatically configured. Think I stated that correctly.

Thanks, Rich

Traffic

flowersrj wroteA LAN person at work asked me if my OV server app is on the LAN or WAN side

You can specify where OpenVPN resides by defining --local x.x.x.x in your server config. That way you know where it is.

flowersrj

Traffic,

I tried using "local 192.168.2.1" in the Custom Configuration" box which is LAN address of router where OV is installed. Server restarted successfully. However, the client would no longer connect.

So I removed it. Would that mean it starts on the WAN side?

Thanks, Rich

Traffic

Forward your OpenVPN Server port: UDP:1194 WAN -> LAN

flowersrj

Traffic,

No go.

With "local 192.168.2.1" defined in OV, which is LAN side IP on OV box, I added a UDP 1194 portforward on the OV box for 192.168.1.2(WAN IP) to 192.168.2.1(LAN IP).

The log spits out the following line 5 times then it fails.

Thu Dec 11 12:04:34 2014 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)

So I removed "local 192.168.2.1" out of OV server config but left in the portforward from above.

Now it connects and I can 2 devices on the LAN, a webcam(192.168.2.210) and Raspberry PI(192.168.2.118). That 2nd portforward must of done it. [/color]

Traffic--thanks for your patience and diligence. 😛

Rich

Traffic

I don't understand .. have you solved the problem or not ?

flowersrj

Traffic,

Yes.

Removing the "local 192.168.2.1" entry( you had suggested earlier I try ) in the OV server config and creating a port forward rule on the internal NAT router/OV server allowed me to see the other devices on the LAN from the client.

I contribute it to brain freeze on my part.

I did not realize I needed to also port forward UDP packets on the OV server box itself. But I do because it is a NAT router.

Once again I appreciate your input and perserverence in helping me to resolve the issues I experienced. 😛

Rich