site to site setup verification

markgav

I tried to configure site to site setup. I did received "Initialization sequence completed" on both servers. I really new for VPN and I really dont understand how to verify this set up. Please advise how to verify it. I'll put all confs and logs

Server conf*************************************************************************

;local a.b.c.d
port 1194
;proto tcp
proto udp
#dev tap
dev tun
;dev-node MyTap
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
;topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
;server-bridge
ifconfig 10.8.0.1 10.8.0.2
push route 192.168.190.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"
keepalive 10 120
;tls-auth ta.key 0 # This file is secret
;cipher BF-CBC # Blowfish (default)
;cipher AES-128-CBC # AES
;cipher DES-EDE3-CBC # Triple-DES
#cipher none.
comp-lzo
;max-clients 100
;user nobody
;group nobody
persist-key
persist-tun
status openvpn-status.log
;log openvpn.log
daemon
log-append openvpn.log
verb 3
;mute 20

ClientConf***************************************************************************
client
;dev tap
dev tun
;dev-node MyTap
;proto tcp
proto udp
remote 192.168.11.6 1194
;remote my-server-2 1194
ifconfig 10.8.0.2 10.8.0.1
route 192.168.58.0 255.255.255.0
;remote-random
resolv-retry infinite
nobind
;user nobody
;group nobody
persist-key
persist-tun
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
;mute-replay-warnings
ca ca.crt
cert client2.crt
key client2.key
ns-cert-type server
;tls-auth ta.key 1
;cipher x
comp-lzo
verb 3
daemon
log-append openvpn.log
;mute 20

server init log***********************************************************************

Mon Jan 5 14:30:31 2015 OpenVPN 2.3.5 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Dec 27 2014
Mon Jan 5 14:30:31 2015 library versions: OpenSSL 1.0.0-fips 29 Mar 2010, LZO 2.06
Mon Jan 5 14:30:31 2015 Diffie-Hellman initialized with 2048 bit key
Mon Jan 5 14:30:31 2015 WARNING: file 'server.key' is group or others accessible
Mon Jan 5 14:30:31 2015 Socket Buffers: R=[229376->131072] S=[229376->131072]
Mon Jan 5 14:30:31 2015 ROUTE_GATEWAY 192.168.11.2/255.255.255.0 IFACE=eth0 HWADDR=00:0c:29:2f:84:19
Mon Jan 5 14:30:31 2015 TUN/TAP device tun0 opened
Mon Jan 5 14:30:31 2015 TUN/TAP TX queue length set to 100
Mon Jan 5 14:30:31 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Jan 5 14:30:31 2015 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Mon Jan 5 14:30:31 2015 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Mon Jan 5 14:30:31 2015 UDPv4 link local (bound): [undef]
Mon Jan 5 14:30:31 2015 UDPv4 link remote: [undef]
Mon Jan 5 14:30:31 2015 MULTI: multi_init called, r=256 v=256
Mon Jan 5 14:30:31 2015 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Mon Jan 5 14:30:31 2015 ifconfig_pool_read(), in='client1,10.8.0.4', TODO: IPv6
Mon Jan 5 14:30:31 2015 succeeded -> ifconfig_pool_set()
Mon Jan 5 14:30:31 2015 ifconfig_pool_read(), in='client2,10.8.0.8', TODO: IPv6
Mon Jan 5 14:30:31 2015 succeeded -> ifconfig_pool_set()
Mon Jan 5 14:30:31 2015 IFCONFIG POOL LIST
Mon Jan 5 14:30:31 2015 client1,10.8.0.4
Mon Jan 5 14:30:31 2015 client2,10.8.0.8
Mon Jan 5 14:30:31 2015 Initialization Sequence Completed
Mon Jan 5 14:32:17 2015 192.168.190.128:45621 TLS: Initial packet from [AF_INET]192.168.190.128:45621, sid=c16ad268 41970185
Mon Jan 5 14:32:18 2015 192.168.190.128:45621 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=me@myhost.mydomain
Mon Jan 5 14:32:18 2015 192.168.190.128:45621 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=client2, name=EasyRSA, emailAddress=me@myhost.mydomain
Mon Jan 5 14:32:18 2015 192.168.190.128:45621 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jan 5 14:32:18 2015 192.168.190.128:45621 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jan 5 14:32:18 2015 192.168.190.128:45621 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jan 5 14:32:18 2015 192.168.190.128:45621 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jan 5 14:32:18 2015 192.168.190.128:45621 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Jan 5 14:32:18 2015 192.168.190.128:45621 [client2] Peer Connection Initiated with [AF_INET]192.168.190.128:45621
Mon Jan 5 14:32:18 2015 client2/192.168.190.128:45621 MULTI_sva: pool returned IPv4=10.8.0.10, IPv6=(Not enabled)
Mon Jan 5 14:32:18 2015 client2/192.168.190.128:45621 MULTI: Learn: 10.8.0.10 -> client2/192.168.190.128:45621
Mon Jan 5 14:32:18 2015 client2/192.168.190.128:45621 MULTI: primary virtual IP for client2/192.168.190.128:45621: 10.8.0.10
Mon Jan 5 14:32:20 2015 client2/192.168.190.128:45621 PUSH: Received control message: 'PUSH_REQUEST'
Mon Jan 5 14:32:20 2015 client2/192.168.190.128:45621 send_push_reply(): safe_cap=940
Mon Jan 5 14:32:20 2015 client2/192.168.190.128:45621 SENT CONTROL [client2]: 'PUSH_REPLY,route 192.168.190.0 255.255.255.0",route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9' (status=1)
Mon Jan 5 14:33:53 2015 192.168.190.128:42063 TLS: Initial packet from [AF_INET]192.168.190.128:42063, sid=d8b7cecb b2e0823c
Mon Jan 5 14:33:53 2015 192.168.190.128:42063 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=me@myhost.mydomain
Mon Jan 5 14:33:53 2015 192.168.190.128:42063 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=client2, name=EasyRSA, emailAddress=me@myhost.mydomain
Mon Jan 5 14:33:53 2015 192.168.190.128:42063 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jan 5 14:33:53 2015 192.168.190.128:42063 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jan 5 14:33:53 2015 192.168.190.128:42063 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jan 5 14:33:53 2015 192.168.190.128:42063 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jan 5 14:33:53 2015 192.168.190.128:42063 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Jan 5 14:33:53 2015 192.168.190.128:42063 [client2] Peer Connection Initiated with [AF_INET]192.168.190.128:42063
Mon Jan 5 14:33:53 2015 MULTI: new connection by client 'client2' will cause previous active sessions by this client to be dropped. Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Mon Jan 5 14:33:53 2015 MULTI_sva: pool returned IPv4=10.8.0.10, IPv6=(Not enabled)
Mon Jan 5 14:33:53 2015 MULTI: Learn: 10.8.0.10 -> client2/192.168.190.128:42063
Mon Jan 5 14:33:53 2015 MULTI: primary virtual IP for client2/192.168.190.128:42063: 10.8.0.10
Mon Jan 5 14:33:55 2015 client2/192.168.190.128:42063 PUSH: Received control message: 'PUSH_REQUEST'
Mon Jan 5 14:33:55 2015 client2/192.168.190.128:42063 send_push_reply(): safe_cap=940
Mon Jan 5 14:33:55 2015 client2/192.168.190.128:42063 SENT CONTROL [client2]: 'PUSH_REPLY,route 192.168.190.0 255.255.255.0",route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9' (status=1)
Mon Jan 5 14:36:41 2015 192.168.190.128:51312 TLS: Initial packet from [AF_INET]192.168.190.128:51312, sid=f1e74997 2b854e5c
Mon Jan 5 14:36:41 2015 192.168.190.128:51312 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=me@myhost.mydomain
Mon Jan 5 14:36:41 2015 192.168.190.128:51312 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=client2, name=EasyRSA, emailAddress=me@myhost.mydomain
Mon Jan 5 14:36:41 2015 192.168.190.128:51312 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jan 5 14:36:41 2015 192.168.190.128:51312 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jan 5 14:36:41 2015 192.168.190.128:51312 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jan 5 14:36:41 2015 192.168.190.128:51312 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jan 5 14:36:41 2015 192.168.190.128:51312 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Jan 5 14:36:41 2015 192.168.190.128:51312 [client2] Peer Connection Initiated with [AF_INET]192.168.190.128:51312
Mon Jan 5 14:36:41 2015 MULTI: new connection by client 'client2' will cause previous active sessions by this client to be dropped. Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Mon Jan 5 14:36:41 2015 MULTI_sva: pool returned IPv4=10.8.0.10, IPv6=(Not enabled)
Mon Jan 5 14:36:41 2015 MULTI: Learn: 10.8.0.10 -> client2/192.168.190.128:51312
Mon Jan 5 14:36:41 2015 MULTI: primary virtual IP for client2/192.168.190.128:51312: 10.8.0.10
Mon Jan 5 14:36:43 2015 client2/192.168.190.128:51312 PUSH: Received control message: 'PUSH_REQUEST'
Mon Jan 5 14:36:43 2015 client2/192.168.190.128:51312 send_push_reply(): safe_cap=940
Mon Jan 5 14:36:43 2015 client2/192.168.190.128:51312 SENT CONTROL [client2]: 'PUSH_REPLY,route 192.168.190.0 255.255.255.0",route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9' (status=1)

client init log************************************************************************
Mon Jan 5 14:36:41 2015 OpenVPN 2.3.5 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Dec 27 2014
Mon Jan 5 14:36:41 2015 library versions: OpenSSL 1.0.0-fips 29 Mar 2010, LZO 2.06
Mon Jan 5 14:36:41 2015 WARNING: using --pull/--client and --ifconfig together is probably not what you want
Mon Jan 5 14:36:41 2015 WARNING: file 'client2.key' is group or others accessible
Mon Jan 5 14:36:41 2015 Socket Buffers: R=[229376->131072] S=[229376->131072]
Mon Jan 5 14:36:41 2015 UDPv4 link local: [undef]
Mon Jan 5 14:36:41 2015 UDPv4 link remote: [AF_INET]192.168.11.6:1194
Mon Jan 5 14:36:41 2015 TLS: Initial packet from [AF_INET]192.168.11.6:1194, sid=9cc21452 edc87a3a
Mon Jan 5 14:36:41 2015 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=me@myhost.mydomain
Mon Jan 5 14:36:41 2015 VERIFY OK: nsCertType=SERVER
Mon Jan 5 14:36:41 2015 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=server, name=EasyRSA, emailAddress=me@myhost.mydomain
Mon Jan 5 14:36:41 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jan 5 14:36:41 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jan 5 14:36:41 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Jan 5 14:36:41 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jan 5 14:36:41 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Jan 5 14:36:41 2015 [server] Peer Connection Initiated with [AF_INET]192.168.11.6:1194
Mon Jan 5 14:36:43 2015 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Jan 5 14:36:43 2015 PUSH: Received control message: 'PUSH_REPLY,route 192.168.190.0 255.255.255.0",route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9'
Mon Jan 5 14:36:43 2015 Options error: route parameter netmask '255.255.255.0"' must be an IP address
Mon Jan 5 14:36:43 2015 OPTIONS IMPORT: timers and/or timeouts modified
Mon Jan 5 14:36:43 2015 OPTIONS IMPORT: --ifconfig/up options modified
Mon Jan 5 14:36:43 2015 OPTIONS IMPORT: route options modified
Mon Jan 5 14:36:43 2015 ROUTE: default_gateway=UNDEF
Mon Jan 5 14:36:43 2015 TUN/TAP device tun0 opened
Mon Jan 5 14:36:43 2015 TUN/TAP TX queue length set to 100
Mon Jan 5 14:36:43 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Jan 5 14:36:43 2015 /sbin/ifconfig tun0 10.8.0.10 pointopoint 10.8.0.9 mtu 1500
Mon Jan 5 14:36:43 2015 /sbin/route add -net 192.168.58.0 netmask 255.255.255.0 gw 10.8.0.9
Mon Jan 5 14:36:43 2015 /sbin/route add -net 10.8.0.1 netmask 255.255.255.255 gw 10.8.0.9
Mon Jan 5 14:36:43 2015 Initialization Sequence Completed

openvpn status.log*******************************************************************
OpenVPN CLIENT LIST
Updated,Mon Jan 5 15:08:01 2015
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
client2,192.168.190.128:51312,15222,15601,Mon Jan 5 14:36:41 2015
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
10.8.0.10,client2,192.168.190.128:51312,Mon Jan 5 14:36:41 2015
GLOBAL STATS
Max bcast/mcast queue length,0
END

Traffic

markgav wroteMon Jan 5 14:33:53 2015 MULTI: new connection by client 'client2' will cause previous active sessions by this client to be dropped. Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.

otherwise ?

markgav

thanks for reply. My main point which application can i run to verify that i really have site to site vpn tunnel. What should i able to do....

Traffic

Ping the server from the client and vice~versa ..

You do have a working connection but maybe you have some problems as well.

Set --verb 4 in your configs for some extra info.

Use --push "explicit-exit-notify 3" in your server config.

It looks like you are trying to link two networks over the VPN .. have a look at this:
HOWTO: Expanding the scope of the VPN to include additional machines

markgav

yes. exactly. Please kindly confirm, that i understand correctly. I set up a Real Site-to-Site setup of vpn. I understand, that possibly a have some issue inside of it. I will check your recommendations. For now please confirm that it is an exact Site-to-Site and nothing else. I'm sorry that i'm so new for vpn. Thanks for your time:-)