Unable to get outside access once connected

Uniden

I have a Banana PI that I’m trying to set up a OpenVPN server on. I’m able to connect to the server but I can’t get outside access once connected to the VPN server.

Operating sys – Raspbian
Pi ip – 192.168.1.126

After generating the keys and modifying the server and client config files I did the following steps
Modified sysctl.conf and enabled net.ipv4.ip_forward = 1
sysctl –p
echo 1 > /proc/sys/net/ipv4/ip_forward
Then entered the iptable commands listed below.

iptable commands entered

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to 192.168.1.126

server.conf

dev tun0
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/SVPN.crt
key /etc/openvpn/easy-rsa/keys/SVPN.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
user nobody
group nogroup
server 10.8.0.0 255.255.255.0
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 4
client-to-client
push "redirect-gateway def1"
#set the dns servers
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
log-append /var/log/openvpn
comp-lzo

client.conf

dev tun
client
proto udp
remote *.*.*.* 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert P-Tablet.crt
key P-Tablet.key
comp-lzo
verb 4

server log file

 Current Parameter Settings:
   config = '/etc/openvpn/openvpn.conf'
   mode = 1
   persist_config = DISABLED
   persist_mode = 1
   show_ciphers = DISABLED
   show_digests = DISABLED
   show_engines = DISABLED
   genkey = DISABLED
   key_pass_file = '[UNDEF]'
   show_tls_ciphers = DISABLED
 Connection profiles [default]:
   proto = udp
   local = '[UNDEF]'
   local_port = 1194
   remote = '[UNDEF]'
   remote_port = 1194
   remote_float = DISABLED
   bind_defined = DISABLED
   bind_local = ENABLED
   connect_retry_seconds = 5
   connect_timeout = 10
   connect_retry_max = 0
   socks_proxy_server = '[UNDEF]'
   socks_proxy_port = 0
   socks_proxy_retry = DISABLED
 Connection profiles END
   remote_random = DISABLED
   ipchange = '[UNDEF]'
   dev = 'tun0'
   dev_type = '[UNDEF]'
   dev_node = '[UNDEF]'
   lladdr = '[UNDEF]'
   topology = 1
   tun_ipv6 = DISABLED
   ifconfig_local = '10.8.0.1'
   ifconfig_remote_netmask = '10.8.0.2'
   ifconfig_noexec = DISABLED
   ifconfig_nowarn = DISABLED
   ifconfig_ipv6_local = '[UNDEF]'
   ifconfig_ipv6_netbits = 0
   ifconfig_ipv6_remote = '[UNDEF]'
   shaper = 0
   tun_mtu = 1500
   tun_mtu_defined = ENABLED
   link_mtu = 1500
   link_mtu_defined = DISABLED
   tun_mtu_extra = 0
   tun_mtu_extra_defined = DISABLED
   fragment = 0
   mtu_discover_type = -1
   mtu_test = 0
   mlock = DISABLED
   keepalive_ping = 0
   keepalive_timeout = 0
   inactivity_timeout = 0
   ping_send_timeout = 0
   ping_rec_timeout = 0
   ping_rec_timeout_action = 0
   ping_timer_remote = DISABLED
   remap_sigusr1 = 0
   explicit_exit_notification = 0
   persist_tun = ENABLED
   persist_local_ip = DISABLED
   persist_remote_ip = DISABLED
   persist_key = ENABLED
   mssfix = 1450
   passtos = DISABLED
   resolve_retry_seconds = 1000000000
   username = 'nobody'
   groupname = 'nogroup'
   chroot_dir = '[UNDEF]'
   cd_dir = '/etc/openvpn'
   writepid = '/var/run/openvpn.openvpn.pid'
   up_script = '[UNDEF]'
   down_script = '[UNDEF]'
   down_pre = DISABLED
   up_restart = DISABLED
   up_delay = DISABLED
   daemon = ENABLED
   inetd = 0
   log = ENABLED
   suppress_timestamps = DISABLED
   nice = 0
   verbosity = 4
   mute = 0
   gremlin = 0
   status_file = '/var/log/openvpn-status.log'
   status_file_version = 1
   status_file_update_freq = 60
   occ = ENABLED
   rcvbuf = 65536
   sndbuf = 65536
   sockflags = 0
   fast_io = DISABLED
   lzo = 7
   route_script = '[UNDEF]'
   route_default_gateway = '[UNDEF]'
   route_default_metric = 0
   route_noexec = DISABLED
   route_delay = 0
   route_delay_window = 30
   route_delay_defined = DISABLED
   route_nopull = DISABLED
   route_gateway_via_dhcp = DISABLED
   max_routes = 100
   allow_pull_fqdn = DISABLED
   route 10.8.0.0/255.255.255.0/nil/nil
   management_addr = '[UNDEF]'
   management_port = 0
   management_user_pass = '[UNDEF]'
   management_log_history_cache = 250
   management_echo_buffer_size = 100
   management_write_peer_info_file = '[UNDEF]'
   management_client_user = '[UNDEF]'
   management_client_group = '[UNDEF]'
   management_flags = 0
   shared_secret_file = '[UNDEF]'
   key_direction = 0
   ciphername_defined = ENABLED
   ciphername = 'BF-CBC'
   authname_defined = ENABLED
   authname = 'SHA1'
   prng_hash = 'SHA1'
   prng_nonce_secret_len = 16
   keysize = 0
   engine = DISABLED
   replay = ENABLED
   mute_replay_warnings = DISABLED
   replay_window = 64
   replay_time = 15
   packet_id_file = '[UNDEF]'
   use_iv = ENABLED
   test_crypto = DISABLED
   tls_server = ENABLED
   tls_client = DISABLED
   key_method = 2
   ca_file = '/etc/openvpn/easy-rsa/keys/ca.crt'
   ca_path = '[UNDEF]'
   dh_file = '/etc/openvpn/easy-rsa/keys/dh2048.pem'
   cert_file = '/etc/openvpn/easy-rsa/keys/SVPN.crt'
   priv_key_file = '/etc/openvpn/easy-rsa/keys/SVPN.key'
   pkcs12_file = '[UNDEF]'
   cipher_list = '[UNDEF]'
   tls_verify = '[UNDEF]'
   tls_export_cert = '[UNDEF]'
   tls_remote = '[UNDEF]'
   crl_file = '[UNDEF]'
   ns_cert_type = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_eku = '[UNDEF]'
   tls_timeout = 2
   renegotiate_bytes = 0
   renegotiate_packets = 0
   renegotiate_seconds = 3600
   handshake_window = 60
   transition_window = 3600
   single_session = DISABLED
   push_peer_info = DISABLED
   tls_exit = DISABLED
   tls_auth_file = '[UNDEF]'
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_pin_cache_period = -1
   pkcs11_id = '[UNDEF]'
   pkcs11_id_management = DISABLED
   server_network = 10.8.0.0
   server_netmask = 255.255.255.0
   server_network_ipv6 = ::
   server_netbits_ipv6 = 0
   server_bridge_ip = 0.0.0.0
   server_bridge_netmask = 0.0.0.0
   server_bridge_pool_start = 0.0.0.0
   server_bridge_pool_end = 0.0.0.0
   push_entry = 'redirect-gateway def1'
   push_entry = 'dhcp-option DNS 8.8.8.8'
   push_entry = 'dhcp-option DNS 8.8.4.4'
   push_entry = 'route 10.8.0.0 255.255.255.0'
   push_entry = 'topology net30'
   ifconfig_pool_defined = ENABLED
   ifconfig_pool_start = 10.8.0.4
   ifconfig_pool_end = 10.8.0.251
   ifconfig_pool_netmask = 0.0.0.0
   ifconfig_pool_persist_filename = '[UNDEF]'
   ifconfig_pool_persist_refresh_freq = 600
   ifconfig_ipv6_pool_defined = DISABLED
   ifconfig_ipv6_pool_base = ::
   ifconfig_ipv6_pool_netbits = 0
   n_bcast_buf = 256
   tcp_queue_limit = 64
   real_hash_size = 256
   virtual_hash_size = 256
   client_connect_script = '[UNDEF]'
   learn_address_script = '[UNDEF]'
   client_disconnect_script = '[UNDEF]'
   client_config_dir = '[UNDEF]'
   ccd_exclusive = DISABLED
   tmp_dir = '/tmp'
   push_ifconfig_defined = DISABLED
   push_ifconfig_local = 0.0.0.0
   push_ifconfig_remote_netmask = 0.0.0.0
   push_ifconfig_ipv6_defined = DISABLED
   push_ifconfig_ipv6_local = ::/0
   push_ifconfig_ipv6_remote = ::
   enable_c2c = ENABLED
   duplicate_cn = DISABLED
   cf_max = 0
   cf_per = 0
   max_clients = 1024
   max_routes_per_client = 256
   auth_user_pass_verify_script = '[UNDEF]'
   auth_user_pass_verify_script_via_file = DISABLED
   ssl_flags = 0
   port_share_host = '[UNDEF]'
   port_share_port = 0
   client = DISABLED
   pull = DISABLED
   auth_user_pass_file = '[UNDEF]'
 OpenVPN 2.2.1 arm-linux-gnueabihf [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec  1 2014
 WARNING: --keepalive option is missing from server config
 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
 Diffie-Hellman initialized with 2048 bit key
 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
 Socket Buffers: R=[163840->131072] S=[163840->131072]
 ROUTE default_gateway=192.168.1.1
 TUN/TAP device tun0 opened
 TUN/TAP TX queue length set to 100
 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
 GID set to nogroup
 UID set to nobody
 UDPv4 link local (bound): [undef]
 UDPv4 link remote: [undef]
 MULTI: multi_init called, r=256 v=256
 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
 Initialization Sequence Completed
 MULTI: multi_create_instance called
 *.*.*.*:58115 Re-using SSL/TLS context
 *.*.*.*:58115 LZO compression initialized
 *.*.*.*:58115 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
 *.*.*.*:58115 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
 *.*.*.*:58115 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
 *.*.*.*:58115 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
 *.*.*.*:58115 Local Options hash (VER=V4): '530fdded'
 *.*.*.*:58115 Expected Remote Options hash (VER=V4): '41690919'
 *.*.*.*:58115 TLS: Initial packet from [AF_INET]*.*.*.*:58115, sid=32255744 66a5636f
 *.*.*.*:58115 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=SVPN/OU=SVPN/CN=Administrator/name=changeme/emailAddress=mail@host.domain
 *.*.*.*:58115 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=P-Tablet/OU=P-Tablet/CN=P-Tablet/name=changeme/emailAddress=mail@host.domain
 *.*.*.*:58115 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
 *.*.*.*:58115 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
 *.*.*.*:58115 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
 *.*.*.*:58115 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
 *.*.*.*:58115 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
 *.*.*.*:58115 [P-Tablet] Peer Connection Initiated with [AF_INET]*.*.*.*:58115
 P-Tablet/*.*.*.*:58115 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=4817:b8be:80de:edb6:340b:f3b6:7cd2:ffb7
 P-Tablet/*.*.*.*:58115 MULTI: Learn: 10.8.0.6 -> P-Tablet/*.*.*.*:58115
 P-Tablet/*.*.*.*:58115 MULTI: primary virtual IP for P-Tablet/*.*.*.*:58115: 10.8.0.6
 P-Tablet/*.*.*.*:58115 PUSH: Received control message: 'PUSH_REQUEST'
 P-Tablet/*.*.*.*:58115 send_push_reply(): safe_cap=960
 P-Tablet/*.*.*.*:58115 SENT CONTROL [P-Tablet]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.0 255.255.255.0,topology net30,ifconfig 10.8.0.6 10.8.0.5' (status=1)
 P-Tablet/*.*.*.*:58115 MULTI: bad source address from client [192.168.43.233], packet dropped
 P-Tablet/*.*.*.*:58115 MULTI: bad source address from client [192.168.43.233], packet dropped
 P-Tablet/*.*.*.*:58115 MULTI: bad source address from client [192.168.43.233], packet dropped
 P-Tablet/*.*.*.*:58115 MULTI: bad source address from client [192.168.43.233], packet dropped
 P-Tablet/*.*.*.*:58115 MULTI: bad source address from client [192.168.43.233], packet dropped
 P-Tablet/*.*.*.*:58115 MULTI: bad source address from client [192.168.43.233], packet dropped
 P-Tablet/*.*.*.*:58115 MULTI: bad source address from client [192.168.43.233], packet dropped

If I enter the following iptable commands listed below I’m able to get outside access however I still get the status=1 listing in the server log and it takes approximately 45 seconds to 1 min for Google’s home page to load

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -t filter -F
iptables -t filter -X

iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

Any help would be greatly appreciated

Traffic

Uniden wroteIf I enter the following iptable commands listed below

Those last rules clear your iptables .. even the NAT one .. which is the only one you do need:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

So enter that one only and keep it .. double check your network interface is called eth0.

P-Tablet/*.*.*.*:58115 MULTI: bad source address from client [192.168.43.233], packet dropped

You can resolve this by using --iroute in a client-connect file but you will also need a client-connect-dir etc ..
see HOWTO: Expanding the scope of the VPN to include additional machines

Uniden wroteOperating sys – Raspbian
Pi ip – 192.168.1.126

Bad idea .. see your log:

Uniden wroteNOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

Change it to any other RFC1918 network.

Uniden wroteit takes approximately 45 seconds to 1 min for Google’s home page to load

Try http://www.speedtest.net/ on your server and client .. what's the result ?

I could not resist this:

Uniden wroteI have a Banana PI that I’m trying to set up a OpenVPN server on

try using a computer .. not a Pie :lol:

Uniden

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
So enter that one only and keep it .. double check your network interface is called eth0.

I went ahead and removed the other iptable entries other than the one listed above

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
So enter that one only and keep it .. double check your network interface is called eth0.

ifconfig

eth0      Link encap:Ethernet  HWaddr 02:92:09:c1:63:5a
          inet addr:192.168.2.127  Bcast:192.168.2.255  Mask:255.255.255.0
          inet6 addr: fe80::92:9ff:fec1:635a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2641 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2716 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:246603 (240.8 KiB)  TX bytes:378622 (369.7 KiB)
          Interrupt:117 Base address:0xc000

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:25 errors:0 dropped:0 overruns:0 frame:0
          TX packets:25 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:2680 (2.6 KiB)  TX bytes:2680 (2.6 KiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tunl0     Link encap:IPIP Tunnel  HWaddr
          UP RUNNING NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0

Uniden wrote:
Operating sys – Raspbian
Pi ip – 192.168.1.126

Traffic
Bad idea .. see your log:

I went ahead and changed the router ip address, now i don't get the notice about the subnet in the server log anymore
router gateway: 192.168.2.2
Pi's new address: 192.168.2.127

Traffic
You can resolve this by using --iroute in a client-connect file but you will also need a client-connect-dir etc ..see HOWTO: Expanding the scope of the VPN to include additional machines

I made an attempt at this but im not sure i have the information in the server.conf and /ccd/P-Tablet set correctly because i still get the packet drop notices in the server log.

server.conf

dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/SVPN.crt
key /etc/openvpn/easy-rsa/keys/SVPN.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
user nobody
group nogroup
server 10.8.0.0 255.255.255.0
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 4
keepalive 10 120
push "redirect-gateway local def1"
#set the dns servers
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
log-append /var/log/openvpn
comp-lzo
client-config-dir ccd
client-to-client
push "route 192.168.2.0 255.255.255.0"

/ccd/P-Tablet

iroute 192.168.2.0 225.225.225.0

server log

Current Parameter Settings:
   config = '/etc/openvpn/openvpn.conf'
   mode = 1
   persist_config = DISABLED
   persist_mode = 1
   show_ciphers = DISABLED
   show_digests = DISABLED
   show_engines = DISABLED
   genkey = DISABLED
   key_pass_file = '[UNDEF]'
   show_tls_ciphers = DISABLED
 Connection profiles [default]:
   proto = udp
   local = '[UNDEF]'
   local_port = 1194
   remote = '[UNDEF]'
   remote_port = 1194
   remote_float = DISABLED
   bind_defined = DISABLED
   bind_local = ENABLED
   connect_retry_seconds = 5
   connect_timeout = 10
   connect_retry_max = 0
   socks_proxy_server = '[UNDEF]'
   socks_proxy_port = 0
   socks_proxy_retry = DISABLED
 Connection profiles END
   remote_random = DISABLED
   ipchange = '[UNDEF]'
   dev = 'tun'
   dev_type = '[UNDEF]'
   dev_node = '[UNDEF]'
   lladdr = '[UNDEF]'
   topology = 1
   tun_ipv6 = DISABLED
   ifconfig_local = '10.8.0.1'
   ifconfig_remote_netmask = '10.8.0.2'
   ifconfig_noexec = DISABLED
   ifconfig_nowarn = DISABLED
   ifconfig_ipv6_local = '[UNDEF]'
   ifconfig_ipv6_netbits = 0
   ifconfig_ipv6_remote = '[UNDEF]'
   shaper = 0
   tun_mtu = 1500
   tun_mtu_defined = ENABLED
   link_mtu = 1500
   link_mtu_defined = DISABLED
   tun_mtu_extra = 0
   tun_mtu_extra_defined = DISABLED
   fragment = 0
   mtu_discover_type = -1
   mtu_test = 0
   mlock = DISABLED
   keepalive_ping = 10
   keepalive_timeout = 120
   inactivity_timeout = 0
   ping_send_timeout = 10
   ping_rec_timeout = 240
   ping_rec_timeout_action = 2
   ping_timer_remote = DISABLED
   remap_sigusr1 = 0
   explicit_exit_notification = 0
   persist_tun = ENABLED
   persist_local_ip = DISABLED
   persist_remote_ip = DISABLED
   persist_key = ENABLED
   mssfix = 1450
   passtos = DISABLED
   resolve_retry_seconds = 1000000000
   username = 'nobody'
   groupname = 'nogroup'
   chroot_dir = '[UNDEF]'
   cd_dir = '/etc/openvpn'
   writepid = '/var/run/openvpn.openvpn.pid'
   up_script = '[UNDEF]'
   down_script = '[UNDEF]'
   down_pre = DISABLED
   up_restart = DISABLED
   up_delay = DISABLED
   daemon = ENABLED
   inetd = 0
   log = ENABLED
   suppress_timestamps = DISABLED
   nice = 0
   verbosity = 4
   mute = 0
   gremlin = 0
   status_file = '/var/log/openvpn-status.log'
   status_file_version = 1
   status_file_update_freq = 60
   occ = ENABLED
   rcvbuf = 65536
   sndbuf = 65536
   sockflags = 0
   fast_io = DISABLED
   lzo = 7
   route_script = '[UNDEF]'
   route_default_gateway = '[UNDEF]'
   route_default_metric = 0
   route_noexec = DISABLED
   route_delay = 0
   route_delay_window = 30
   route_delay_defined = DISABLED
   route_nopull = DISABLED
   route_gateway_via_dhcp = DISABLED
   max_routes = 100
   allow_pull_fqdn = DISABLED
   route 10.8.0.0/255.255.255.0/nil/nil
   management_addr = '[UNDEF]'
   management_port = 0
   management_user_pass = '[UNDEF]'
   management_log_history_cache = 250
   management_echo_buffer_size = 100
   management_write_peer_info_file = '[UNDEF]'
   management_client_user = '[UNDEF]'
   management_client_group = '[UNDEF]'
   management_flags = 0
   shared_secret_file = '[UNDEF]'
   key_direction = 0
   ciphername_defined = ENABLED
   ciphername = 'BF-CBC'
   authname_defined = ENABLED
   authname = 'SHA1'
   prng_hash = 'SHA1'
   prng_nonce_secret_len = 16
   keysize = 0
   engine = DISABLED
   replay = ENABLED
   mute_replay_warnings = DISABLED
   replay_window = 64
   replay_time = 15
   packet_id_file = '[UNDEF]'
   use_iv = ENABLED
   test_crypto = DISABLED
   tls_server = ENABLED
   tls_client = DISABLED
   key_method = 2
   ca_file = '/etc/openvpn/easy-rsa/keys/ca.crt'
   ca_path = '[UNDEF]'
   dh_file = '/etc/openvpn/easy-rsa/keys/dh2048.pem'
   cert_file = '/etc/openvpn/easy-rsa/keys/SVPN.crt'
   priv_key_file = '/etc/openvpn/easy-rsa/keys/SVPN.key'
   pkcs12_file = '[UNDEF]'
   cipher_list = '[UNDEF]'
   tls_verify = '[UNDEF]'
   tls_export_cert = '[UNDEF]'
   tls_remote = '[UNDEF]'
   crl_file = '[UNDEF]'
   ns_cert_type = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_eku = '[UNDEF]'
   tls_timeout = 2
   renegotiate_bytes = 0
   renegotiate_packets = 0
   renegotiate_seconds = 3600
   handshake_window = 60
   transition_window = 3600
   single_session = DISABLED
   push_peer_info = DISABLED
   tls_exit = DISABLED
   tls_auth_file = '[UNDEF]'
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_pin_cache_period = -1
   pkcs11_id = '[UNDEF]'
   pkcs11_id_management = DISABLED
   server_network = 10.8.0.0
   server_netmask = 255.255.255.0
   server_network_ipv6 = ::
   server_netbits_ipv6 = 0
   server_bridge_ip = 0.0.0.0
   server_bridge_netmask = 0.0.0.0
   server_bridge_pool_start = 0.0.0.0
   server_bridge_pool_end = 0.0.0.0
   push_entry = 'redirect-gateway local def1'
   push_entry = 'dhcp-option DNS 8.8.8.8'
   push_entry = 'dhcp-option DNS 8.8.4.4'
   push_entry = 'route 192.168.2.0 255.255.255.0'
   push_entry = 'route 10.8.0.0 255.255.255.0'
   push_entry = 'topology net30'
   push_entry = 'ping 10'
   push_entry = 'ping-restart 120'
   ifconfig_pool_defined = ENABLED
   ifconfig_pool_start = 10.8.0.4
   ifconfig_pool_end = 10.8.0.251
   ifconfig_pool_netmask = 0.0.0.0
   ifconfig_pool_persist_filename = '[UNDEF]'
   ifconfig_pool_persist_refresh_freq = 600
   ifconfig_ipv6_pool_defined = DISABLED
   ifconfig_ipv6_pool_base = ::
   ifconfig_ipv6_pool_netbits = 0
   n_bcast_buf = 256
   tcp_queue_limit = 64
   real_hash_size = 256
   virtual_hash_size = 256
   client_connect_script = '[UNDEF]'
   learn_address_script = '[UNDEF]'
   client_disconnect_script = '[UNDEF]'
   client_config_dir = 'ccd'
   ccd_exclusive = DISABLED
   tmp_dir = '/tmp'
   push_ifconfig_defined = DISABLED
   push_ifconfig_local = 0.0.0.0
   push_ifconfig_remote_netmask = 0.0.0.0
   push_ifconfig_ipv6_defined = DISABLED
   push_ifconfig_ipv6_local = ::/0
   push_ifconfig_ipv6_remote = ::
   enable_c2c = ENABLED
   duplicate_cn = DISABLED
   cf_max = 0
   cf_per = 0
   max_clients = 1024
   max_routes_per_client = 256
   auth_user_pass_verify_script = '[UNDEF]'
   auth_user_pass_verify_script_via_file = DISABLED
   ssl_flags = 0
   port_share_host = '[UNDEF]'
   port_share_port = 0
   client = DISABLED
   pull = DISABLED
   auth_user_pass_file = '[UNDEF]'
 OpenVPN 2.2.1 arm-linux-gnueabihf [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec  1 2014
 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
 Diffie-Hellman initialized with 2048 bit key
 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
 Socket Buffers: R=[163840->131072] S=[163840->131072]
 ROUTE default_gateway=192.168.2.2
 TUN/TAP device tun0 opened
 TUN/TAP TX queue length set to 100
 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
 GID set to nogroup
 UID set to nobody
 UDPv4 link local (bound): [undef]
 UDPv4 link remote: [undef]
 MULTI: multi_init called, r=256 v=256
 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
 Initialization Sequence Completed
MULTI: multi_create_instance called
*.*.*.*:25789 Re-using SSL/TLS context
*.*.*.*:25789 LZO compression initialized
*.*.*.*:25789 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
*.*.*.*:25789 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
*.*.*.*:25789 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
*.*.*.*:25789 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
*.*.*.*:25789 Local Options hash (VER=V4): '530fdded'
*.*.*.*:25789 Expected Remote Options hash (VER=V4): '41690919'
*.*.*.*:25789 TLS: Initial packet from [AF_INET]*.*.*.*:25789, sid=f979e156 b9bbcf27
 *.*.*.*:25789 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=SVPN/OU=SVPN/CN=Administrator/name=changeme/emailAddress=mail@host.domain
 *.*.*.*:25789 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=P-Tablet/OU=P-Tablet/CN=P-Tablet/name=changeme/emailAddress=mail@host.domain
 *.*.*.*:25789 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
 *.*.*.*:25789 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
 *.*.*.*:25789 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
 *.*.*.*:25789 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
 *.*.*.*:25789 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
 *.*.*.*:25789 [P-Tablet] Peer Connection Initiated with [AF_INET]*.*.*.*:25789
 P-Tablet/*.*.*.*:25789 OPTIONS IMPORT: reading client specific options from: ccd/P-Tablet
 P-Tablet/*.*.*.*:25789 Options error: in --iroute 192.168.2.0 225.225.225.0 : Bad network/subnet specification
 P-Tablet/*.*.*.*:25789 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=c8c8:b2b8:7067:b0b8:90dc:eeb6::
 P-Tablet/*.*.*.*:25789 MULTI: Learn: 10.8.0.6 -> P-Tablet/*.*.*.*:25789
 P-Tablet/*.*.*.*:25789 MULTI: primary virtual IP for P-Tablet/*.*.*.*:25789: 10.8.0.6
 P-Tablet/*.*.*.*:25789 PUSH: Received control message: 'PUSH_REQUEST'
 P-Tablet/*.*.*.*:25789 send_push_reply(): safe_cap=960
 P-Tablet/*.*.*.*:25789 SENT CONTROL [P-Tablet]: 'PUSH_REPLY,redirect-gateway local def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 192.168.2.0 255.255.255.0,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
 P-Tablet/*.*.*.*:25789 MULTI: bad source address from client [192.168.43.233], packet dropped
 P-Tablet/*.*.*.*:25789 MULTI: bad source address from client [192.168.43.233], packet dropped
 P-Tablet/*.*.*.*:25789 MULTI: bad source address from client [192.168.43.233], packet dropped
 P-Tablet/*.*.*.*:25789 MULTI: bad source address from client [192.168.43.233], packet dropped
 P-Tablet/*.*.*.*:25789 MULTI: bad source address from client [192.168.43.233], packet dropped

Uniden wrote:
I have a Banana PI that I’m trying to set up a OpenVPN server on

Traffic
try using a computer .. not a Pie :lol:

I figured that since bananas are good for people that it would carry over to computers. More potassium = more bandwidth 😃

Traffic

Uniden wrote made an attempt at this but im not sure i have the information in the server.conf and /ccd/P-Tablet set correctly because i still get the packet drop notices in the server log.

Yes, you have done it wrong.

Uniden wrote/ccd/P-Tablet
Code:
iroute 192.168.2.0 225.225.225.0

This is your server LAN, it needs to be your client LAN ip address: eg. 192.168.48.12 255.255.255.255

Your server log did mention this:

Uniden wroteP-Tablet/*.*.*.*:25789 Options error: in --iroute 192.168.2.0 225.225.225.0 : Bad network/subnet specification

Uniden

I made the corrections to the server.conf and the P-Tablet. I no longer get the "Bad network/subnet specification " error message in the log file (I hope i did it correctly this time). I was wondering if i was missing anything else. When i load Google search i get a blank white page where the browser is loading but it just hangs there. Also I really appreciate the help 😃

server.conf

dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/SVPN.crt
key /etc/openvpn/easy-rsa/keys/SVPN.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
user nobody
group nogroup
server 10.8.0.0 255.255.255.0
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 4
keepalive 10 120
push "redirect-gateway local def1"
#set the dns servers
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
log-append /var/log/openvpn
comp-lzo
client-config-dir ccd
client-to-client
push "route 192.168.43.0 255.255.255.0"

/ccd/P-Tablet

iroute 192.168.43.0 255.255.255.0

iptables -L -t nat -v

Chain PREROUTING (policy ACCEPT 43 packets, 2806 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain INPUT (policy ACCEPT 5 packets, 425 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 42 packets, 3131 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 43 packets, 3212 bytes)
 pkts bytes target     prot opt in     out     source               destination
   37  2300 MASQUERADE  all  --  any    eth0    10.8.0.0/24          anywhere

server log

 Current Parameter Settings:
   config = '/etc/openvpn/openvpn.conf'
   mode = 1
   persist_config = DISABLED
   persist_mode = 1
   show_ciphers = DISABLED
   show_digests = DISABLED
   show_engines = DISABLED
   genkey = DISABLED
   key_pass_file = '[UNDEF]'
   show_tls_ciphers = DISABLED
 Connection profiles [default]:
   proto = udp
   local = '[UNDEF]'
   local_port = 1194
   remote = '[UNDEF]'
   remote_port = 1194
   remote_float = DISABLED
   bind_defined = DISABLED
   bind_local = ENABLED
   connect_retry_seconds = 5
   connect_timeout = 10
   connect_retry_max = 0
   socks_proxy_server = '[UNDEF]'
   socks_proxy_port = 0
   socks_proxy_retry = DISABLED
 Connection profiles END
   remote_random = DISABLED
   ipchange = '[UNDEF]'
   dev = 'tun'
   dev_type = '[UNDEF]'
   dev_node = '[UNDEF]'
   lladdr = '[UNDEF]'
   topology = 1
   tun_ipv6 = DISABLED
   ifconfig_local = '10.8.0.1'
   ifconfig_remote_netmask = '10.8.0.2'
   ifconfig_noexec = DISABLED
   ifconfig_nowarn = DISABLED
   ifconfig_ipv6_local = '[UNDEF]'
   ifconfig_ipv6_netbits = 0
   ifconfig_ipv6_remote = '[UNDEF]'
   shaper = 0
   tun_mtu = 1500
   tun_mtu_defined = ENABLED
   link_mtu = 1500
   link_mtu_defined = DISABLED
   tun_mtu_extra = 0
   tun_mtu_extra_defined = DISABLED
   fragment = 0
   mtu_discover_type = -1
   mtu_test = 0
   mlock = DISABLED
   keepalive_ping = 10
   keepalive_timeout = 120
   inactivity_timeout = 0
   ping_send_timeout = 10
   ping_rec_timeout = 240
   ping_rec_timeout_action = 2
   ping_timer_remote = DISABLED
   remap_sigusr1 = 0
   explicit_exit_notification = 0
   persist_tun = ENABLED
   persist_local_ip = DISABLED
   persist_remote_ip = DISABLED
   persist_key = ENABLED
   mssfix = 1450
   passtos = DISABLED
   resolve_retry_seconds = 1000000000
   username = 'nobody'
   groupname = 'nogroup'
   chroot_dir = '[UNDEF]'
   cd_dir = '/etc/openvpn'
   writepid = '/var/run/openvpn.openvpn.pid'
   up_script = '[UNDEF]'
   down_script = '[UNDEF]'
   down_pre = DISABLED
   up_restart = DISABLED
   up_delay = DISABLED
   daemon = ENABLED
   inetd = 0
   log = ENABLED
   suppress_timestamps = DISABLED
   nice = 0
   verbosity = 4
   mute = 0
   gremlin = 0
   status_file = '/var/log/openvpn-status.log'
   status_file_version = 1
   status_file_update_freq = 60
   occ = ENABLED
   rcvbuf = 65536
   sndbuf = 65536
   sockflags = 0
   fast_io = DISABLED
   lzo = 7
   route_script = '[UNDEF]'
   route_default_gateway = '[UNDEF]'
   route_default_metric = 0
   route_noexec = DISABLED
   route_delay = 0
   route_delay_window = 30
   route_delay_defined = DISABLED
   route_nopull = DISABLED
   route_gateway_via_dhcp = DISABLED
   max_routes = 100
   allow_pull_fqdn = DISABLED
   route 10.8.0.0/255.255.255.0/nil/nil
   management_addr = '[UNDEF]'
   management_port = 0
   management_user_pass = '[UNDEF]'
   management_log_history_cache = 250
   management_echo_buffer_size = 100
   management_write_peer_info_file = '[UNDEF]'
   management_client_user = '[UNDEF]'
   management_client_group = '[UNDEF]'
   management_flags = 0
   shared_secret_file = '[UNDEF]'
   key_direction = 0
   ciphername_defined = ENABLED
   ciphername = 'BF-CBC'
   authname_defined = ENABLED
   authname = 'SHA1'
   prng_hash = 'SHA1'
   prng_nonce_secret_len = 16
   keysize = 0
   engine = DISABLED
   replay = ENABLED
   mute_replay_warnings = DISABLED
   replay_window = 64
   replay_time = 15
   packet_id_file = '[UNDEF]'
   use_iv = ENABLED
   test_crypto = DISABLED
   tls_server = ENABLED
   tls_client = DISABLED
   key_method = 2
   ca_file = '/etc/openvpn/easy-rsa/keys/ca.crt'
   ca_path = '[UNDEF]'
   dh_file = '/etc/openvpn/easy-rsa/keys/dh2048.pem'
   cert_file = '/etc/openvpn/easy-rsa/keys/SVPN.crt'
   priv_key_file = '/etc/openvpn/easy-rsa/keys/SVPN.key'
   pkcs12_file = '[UNDEF]'
   cipher_list = '[UNDEF]'
   tls_verify = '[UNDEF]'
   tls_export_cert = '[UNDEF]'
   tls_remote = '[UNDEF]'
   crl_file = '[UNDEF]'
   ns_cert_type = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_ku[i] = 0
   remote_cert_eku = '[UNDEF]'
   tls_timeout = 2
   renegotiate_bytes = 0
   renegotiate_packets = 0
   renegotiate_seconds = 3600
   handshake_window = 60
   transition_window = 3600
   single_session = DISABLED
   push_peer_info = DISABLED
   tls_exit = DISABLED
   tls_auth_file = '[UNDEF]'
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_protected_authentication = DISABLED
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_private_mode = 00000000
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_cert_private = DISABLED
   pkcs11_pin_cache_period = -1
   pkcs11_id = '[UNDEF]'
   pkcs11_id_management = DISABLED
   server_network = 10.8.0.0
   server_netmask = 255.255.255.0
   server_network_ipv6 = ::
   server_netbits_ipv6 = 0
   server_bridge_ip = 0.0.0.0
   server_bridge_netmask = 0.0.0.0
   server_bridge_pool_start = 0.0.0.0
   server_bridge_pool_end = 0.0.0.0
   push_entry = 'redirect-gateway local def1'
   push_entry = 'dhcp-option DNS 8.8.8.8'
   push_entry = 'dhcp-option DNS 8.8.4.4'
   push_entry = 'route 192.168.43.0 255.255.255.0'
   push_entry = 'route 10.8.0.0 255.255.255.0'
   push_entry = 'topology net30'
   push_entry = 'ping 10'
   push_entry = 'ping-restart 120'
   ifconfig_pool_defined = ENABLED
   ifconfig_pool_start = 10.8.0.4
   ifconfig_pool_end = 10.8.0.251
   ifconfig_pool_netmask = 0.0.0.0
   ifconfig_pool_persist_filename = '[UNDEF]'
   ifconfig_pool_persist_refresh_freq = 600
   ifconfig_ipv6_pool_defined = DISABLED
   ifconfig_ipv6_pool_base = ::
   ifconfig_ipv6_pool_netbits = 0
   n_bcast_buf = 256
   tcp_queue_limit = 64
   real_hash_size = 256
   virtual_hash_size = 256
   client_connect_script = '[UNDEF]'
   learn_address_script = '[UNDEF]'
   client_disconnect_script = '[UNDEF]'
   client_config_dir = 'ccd'
   ccd_exclusive = DISABLED
   tmp_dir = '/tmp'
   push_ifconfig_defined = DISABLED
   push_ifconfig_local = 0.0.0.0
   push_ifconfig_remote_netmask = 0.0.0.0
   push_ifconfig_ipv6_defined = DISABLED
   push_ifconfig_ipv6_local = ::/0
   push_ifconfig_ipv6_remote = ::
   enable_c2c = ENABLED
   duplicate_cn = DISABLED
   cf_max = 0
   cf_per = 0
   max_clients = 1024
   max_routes_per_client = 256
   auth_user_pass_verify_script = '[UNDEF]'
   auth_user_pass_verify_script_via_file = DISABLED
   ssl_flags = 0
   port_share_host = '[UNDEF]'
   port_share_port = 0
   client = DISABLED
   pull = DISABLED
   auth_user_pass_file = '[UNDEF]'
 OpenVPN 2.2.1 arm-linux-gnueabihf [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec  1 2014
 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
iffie-Hellman initialized with 2048 bit key
LS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
ocket Buffers: R=[163840->131072] S=[163840->131072]
ROUTE default_gateway=192.168.2.2
TUN/TAP device tun0 opened
TUN/TAP TX queue length set to 100
do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
/sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
/sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
GID set to nogroup
UID set to nobody
UDPv4 link local (bound): [undef]
UDPv4 link remote: [undef]
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Initialization Sequence Completed
 MULTI: multi_create_instance called
 *.*.*.*:45651 Re-using SSL/TLS context
 *.*.*.*:45651 LZO compression initialized
 *.*.*.*:45651 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
 *.*.*.*:45651 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
 *.*.*.*:45651 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
 *.*.*.*:45651 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
 *.*.*.*:45651 Local Options hash (VER=V4): '530fdded'
 *.*.*.*:45651 Expected Remote Options hash (VER=V4): '41690919'
 *.*.*.*:45651 TLS: Initial packet from [AF_INET]*.*.*.*:45651, sid=240917a9 8dee12a8
 *.*.*.*:45651 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=SVPN/OU=SVPN/CN=Administrator/name=changeme/emailAddress=mail@host.domain
 *.*.*.*:45651 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=P-Tablet/OU=P-Tablet/CN=P-Tablet/name=changeme/emailAddress=mail@host.domain
*.*.*.*:45651 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
*.*.*.*:45651 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
*.*.*.*:45651 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
*.*.*.*:45651 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
 *.*.*.*:45651 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
 *.*.*.*:45651 [P-Tablet] Peer Connection Initiated with [AF_INET]*.*.*.*:45651
 P-Tablet/*.*.*.*:45651 OPTIONS IMPORT: reading client specific options from: ccd/P-Tablet
 P-Tablet/*.*.*.*:45651 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=e8e8:d4b8:8087:d2b8:903c:f3b6::
 P-Tablet/*.*.*.*:45651 MULTI: Learn: 10.8.0.6 -> P-Tablet/*.*.*.*:45651
 P-Tablet/*.*.*.*:45651 MULTI: primary virtual IP for P-Tablet/*.*.*.*:45651: 10.8.0.6
 P-Tablet/*.*.*.*:45651 MULTI: internal route 192.168.43.0/24 -> P-Tablet/*.*.*.*:45651
 P-Tablet/*.*.*.*:45651 MULTI: Learn: 192.168.43.0/24 -> P-Tablet/*.*.*.*:45651
 P-Tablet/*.*.*.*:45651 REMOVE PUSH ROUTE: 'route 192.168.43.0 255.255.255.0'
 P-Tablet/*.*.*.*:45651 PUSH: Received control message: 'PUSH_REQUEST'
 P-Tablet/*.*.*.*:45651 send_push_reply(): safe_cap=960
 P-Tablet/*.*.*.*:45651 SENT CONTROL [P-Tablet]: 'PUSH_REPLY,redirect-gateway local def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
 P-Tablet/*.*.*.*:45651 MULTI: Learn: 192.168.43.233 -> P-Tablet/*.*.*.*:45651

Traffic

Uniden wroteI was wondering if i was missing anything else

I think this is wrong:

Uniden wroteserver.conf
Code:
..
user nobody ## Comment out
group nogroup ## Comment out
..
push "route 192.168.43.0 255.255.255.0" ## Change to: route 192.168.43.0 255.255.255.0

/ccd/P-Tablet
Code:
iroute 192.168.43.0 255.255.255.0 ## This is good

First: comment out the user/group until you get your VPN working as this complicates things.

If your client network is 192.168.43.0/24 then you do not --push that route from the server, you route it at the server.
The client will already have normal routing for this network.

Uniden wroteWhen i load Google search i get a blank white page

Can you ping 8.8.8.8 from your server and client when the VPN is connected ?

Uniden

I went ahead and made the changes to the server.conf, after checking the log files of the client I noticed “error rendering cert” after looking into it a bit more I read a few people talking about a potential issue connecting to a vpn while running custom firmware on android devices. I went ahead and flashed my tablet back to the stock kernel and now I have outside access over the vpn. I haven’t seen the error message appear in the client after flashing back as of yet and everything seems to be working. I went ahead and uncommented “user nobody” & “group nogroup”.

I only have one last question, during the speedtest.net testing i started getting the messages below appearing in the server log file. I was wondering if those messages were anything to worry about

P-Tablet/*.*.*.*:33572 Replay-window backtrack occurred [1]
P-Tablet/*.*.*.*:33572 Replay-window backtrack occurred [2]
P-Tablet/*.*.*.*:33572 Replay-window backtrack occurred [3]
P-Tablet/*.*.*.*:33572 Replay-window backtrack occurred [10]
P-Tablet/*.*.*.*:33572 Replay-window backtrack occurred [23]
P-Tablet/*.*.*.*:33572 Replay-window backtrack occurred [36]

Speedtest.net Playstore app (I don’t have great cell reception in my room)

Tablet tethered to cellphone
Ping:107 Download:2.73Mbps Upload:1.67Mbps

Tablet tethered to cellphone & Connected to VPN
Ping:144 Download:3.36Mbps Upload: 1.76Mbps

Traffic

Uniden wroteduring the speedtest.net testing i started getting the messages below

Uniden wroteCode:
P-Tablet/*.*.*.*:33572 Replay-window backtrack occurred [1]
etc ..

Probably just due to speedtest saturating your VPN ..

See --replay-window n [t] in The Manual v23x

Uniden

Then i think I'm all set. Thank you for helping me get this thing up and running 😃

Traffic

No problem ..

Uniden wroteI have a Banana PI that I’m trying to set up a OpenVPN server on

That is still funny :mrgreen: