2 OpenVPN clients, same config but 1 device cannot connect

superinterstellar

Hello,

I have 2 OpenVPN clients(laptop and ipad) trying to connect to the same server. Both are configured in the same way however the laptop can connect and the ipad cannot connect. I have been trying to read the client log to understand why the ipad cannot connect and the laptop does connect.

I have taken the openvpn config from the ipad and tried and tested it on the macbook and it works fine.
I imagine this could be a firewall issue?
Could someone confirm this?

Below is the output from the ipad client

2015-02-23 17:18:37 SSL Handshake: TLSv1.0/TLS-DHE-RSA-WITH-AES-256-CBC-SHA
2015-02-23 17:18:37 Session is ACTIVE
2015-02-23 17:18:37 EVENT: GET_CONFIG
2015-02-23 17:18:37 Sending PUSH_REQUEST to server...
2015-02-23 17:18:37 OPTIONS:
0 [redirect-gateway] [def1] [bypass-dhcp]
1 [dhcp-option] [DNS] [8.8.8.8]
2 [dhcp-option] [DNS] [8.8.4.4]
3 [route] [10.8.0.1]
4 [topology] [net30]
5 [ping] [10]
6 [ping-restart] [120]
7 [ifconfig] [10.8.0.10] [10.8.0.9]
2015-02-23 17:18:37 LZO-ASYM init swap=0 asym=0
2015-02-23 17:18:37 EVENT: ASSIGN_IP
2015-02-23 17:18:37 Connected via tun
2015-02-23 17:18:37 EVENT: CONNECTED @gamaya.net:1194 (46.226.108.41) via /UDPv4 on tun/10.8.0.10/
2015-02-23 17:18:37 NET Internet:ReachableViaWiFi/-R t----l-
2015-02-23 17:18:37 SetStatus Connected

Below is the log output from the laptop



2015-02-23 17:44:21 *Tunnelblick: Established communication with OpenVPN
2015-02-23 17:44:21 OpenVPN 2.3.6 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Jan  8 2015
2015-02-23 17:44:21 library versions: OpenSSL 1.0.1k 8 Jan 2015, LZO 2.08
2015-02-23 17:44:21 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1337
2015-02-23 17:44:21 Need hold release from management interface, waiting...
2015-02-23 17:44:21 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1337
2015-02-23 17:44:21 MANAGEMENT: CMD 'pid'
2015-02-23 17:44:21 MANAGEMENT: CMD 'state on'
2015-02-23 17:44:21 MANAGEMENT: CMD 'state'
2015-02-23 17:44:21 MANAGEMENT: CMD 'bytecount 1'
2015-02-23 17:44:21 MANAGEMENT: CMD 'hold release'
2015-02-23 17:44:21 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
2015-02-23 17:44:21 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2015-02-23 17:44:21 Socket Buffers: R=[196724->65536] S=[9216->65536]
2015-02-23 17:44:21 MANAGEMENT: >STATE:1424684661,RESOLVE,,,
2015-02-23 17:44:21 UDPv4 link local: [undef]
2015-02-23 17:44:21 UDPv4 link remote: [AF_INET]46.xxx.xxx.41:1194
2015-02-23 17:44:21 MANAGEMENT: >STATE:1424684661,WAIT,,,
2015-02-23 17:44:21 MANAGEMENT: >STATE:1424684661,AUTH,,,
2015-02-23 17:44:21 TLS: Initial packet from [AF_INET]46.xxx.xxx.41:1194, sid=f3d41462 8babda1b
2015-02-23 17:44:24 VERIFY OK: depth=1, C=FR, ST=LX, L=, O=, OU=IT, CN=, name=BASE, emailAddress=info@.net
2015-02-23 17:44:24 VERIFY OK: depth=0, C=FR, ST=LX, L=, O=, OU=IT, CN=, name=, emailAddress=info@
2015-02-23 17:44:27 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
2015-02-23 17:44:27 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2015-02-23 17:44:27 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
2015-02-23 17:44:27 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2015-02-23 17:44:27 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
2015-02-23 17:44:27 [GAMAYA] Peer Connection Initiated with [AF_INET]46.xxx.xxx.41:1194
2015-02-23 17:44:28 MANAGEMENT: >STATE:1424684668,GET_CONFIG,,,
2015-02-23 17:44:30 SENT CONTROL [GAMAYA]: 'PUSH_REQUEST' (status=1)
2015-02-23 17:44:30 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9'
2015-02-23 17:44:30 OPTIONS IMPORT: timers and/or timeouts modified
2015-02-23 17:44:30 OPTIONS IMPORT: --ifconfig/up options modified
2015-02-23 17:44:30 OPTIONS IMPORT: route options modified
2015-02-23 17:44:30 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2015-02-23 17:44:30 Opened utun device utun0
2015-02-23 17:44:30 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
2015-02-23 17:44:30 MANAGEMENT: >STATE:1424684670,ASSIGN_IP,,10.8.0.10,
2015-02-23 17:44:30 /sbin/ifconfig utun0 delete
                                        ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2015-02-23 17:44:30 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2015-02-23 17:44:30 /sbin/ifconfig utun0 10.8.0.10 10.8.0.9 mtu 1500 netmask 255.255.255.255 up
2015-02-23 17:44:30 /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw utun0 1500 1542 10.8.0.10 10.8.0.9 init
                                        **********************************************
                                        Start of output from client.up.tunnelblick.sh
                                        Retrieved from OpenVPN: name server(s) [ 8.8.8.8 8.8.4.4 ], search domain(s) [  ] and SMB server(s) [  ] and using default domain name [ openvpn ]
                                        Not aggregating ServerAddresses because running on OS X 10.6 or higher
                                        Setting search domains to 'openvpn' because running under OS X 10.6 or higher and the search domains were not set manually and 'Prepend domain name to search domains' was not selected
                                        Saved the DNS and SMB configurations so they can be restored
                                        Set ServerAddresses to 8.8.8.8 8.8.4.4
                                        Set SearchDomains   to openvpn
                                        Set DomainName       to openvpn
                                        Flushed the DNS cache via dscacheutil
                                        No matching processes were found
                                        mDNSResponder not running. Not notifying it that the DNS cache was flushed
                                        Setting up to monitor system configuration with process-network-changes
                                        End of output from client.up.tunnelblick.sh
                                        **********************************************
2015-02-23 17:44:33 *Tunnelblick: No 'connected.sh' script to execute
2015-02-23 17:44:33 /sbin/route add -net 46.226.108.41 192.168.50.1 255.255.255.255
                                        add net 46.226.108.41: gateway 192.168.50.1
2015-02-23 17:44:33 /sbin/route add -net 0.0.0.0 10.8.0.9 128.0.0.0
                                        add net 0.0.0.0: gateway 10.8.0.9
2015-02-23 17:44:33 /sbin/route add -net 128.0.0.0 10.8.0.9 128.0.0.0
                                        add net 128.0.0.0: gateway 10.8.0.9
2015-02-23 17:44:33 MANAGEMENT: >STATE:1424684673,ADD_ROUTES,,,
2015-02-23 17:44:33 /sbin/route add -net 10.8.0.1 10.8.0.9 255.255.255.255
                                        add net 10.8.0.1: gateway 10.8.0.9
2015-02-23 17:44:33 Initialization Sequence Completed
2015-02-23 17:44:33 MANAGEMENT: >STATE:1424684673,CONNECTED,SUCCESS,10.8.0.10,46.226.108.41
2015-02-23 17:44:38 *Tunnelblick process-network-changes: A system configuration change was ignored
2015-02-23 17:44:50 *Tunnelblick: Disconnecting; 'Disconnect' (toggle) menu command invoked
2015-02-23 17:44:50 *Tunnelblick: Disconnecting using 'kill'
2015-02-23 17:44:50 *Tunnelblick: No 'post-disconnect.sh' script to execute
2015-02-23 17:44:50 *Tunnelblick: Expected disconnection occurred.
2015-02-23 17:44:50 event_wait : Interrupted system call (code=4)
2015-02-23 17:44:50 /sbin/route delete -net 10.8.0.1 10.8.0.9 255.255.255.255
                                        delete net 10.8.0.1: gateway 10.8.0.9
2015-02-23 17:44:50 /sbin/route delete -net 46.226.108.41 192.168.50.1 255.255.255.255
                                        delete net 46.226.108.41: gateway 192.168.50.1
2015-02-23 17:44:50 /sbin/route delete -net 0.0.0.0 10.8.0.9 128.0.0.0
                                        delete net 0.0.0.0: gateway 10.8.0.9
2015-02-23 17:44:50 /sbin/route delete -net 128.0.0.0 10.8.0.9 128.0.0.0
                                        delete net 128.0.0.0: gateway 10.8.0.9
2015-02-23 17:44:50 Closing TUN/TAP interface
2015-02-23 17:44:50 /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw utun0 1500 1542 10.8.0.10 10.8.0.9 init
                                        **********************************************
                                        Start of output from client.down.tunnelblick.sh
                                        Cancelled monitoring of system configuration changes
                                        Restored the DNS and SMB configurations
                                        Flushed the DNS cache via dscacheutil
                                        No matching processes were found
                                        mDNSResponder not running. Not notifying it that the DNS cache was flushed
                                        End of output from client.down.tunnelblick.sh
                                        **********************************************
2015-02-23 17:44:50 SIGTERM[hard,] received, process exiting
2015-02-23 17:44:50 MANAGEMENT: >STATE:1424684690,EXITING,SIGTERM,,

Traffic

superinterstellar wroteI have been trying to read the client log to understand why the ipad cannot connect

superinterstellar wroteBelow is the output from the ipad client

Code:
...
2015-02-23 17:18:37 Connected via tun
2015-02-23 17:18:37 EVENT: CONNECTED @gamaya.net:1194 (46.226.108.41) via /UDPv4 on tun/10.8.0.10/
2015-02-23 17:18:37 NET Internet:ReachableViaWiFi/-R t----l-
2015-02-23 17:18:37 SetStatus Connected

It looks like it is connected ..

superinterstellar wroteI imagine this could be a firewall issue?

Very probably ..

superinterstellar

Right. Both are connected. One is able to gain internet access (using the Google DNS) while the other cannot.
What could be in the firewall that can cause such restriction(that can be very client specific)? Shouldnt it be if 1 client can access, all the others should be able to by the same mean?
Any thoughts?

Below is a print out of my iptables

Chain INPUT (policy ACCEPT 1290 packets, 81390 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 320K   30M ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:1194
    0     0 ACCEPT     all  --  tun+   *       0.0.0.0/0            0.0.0.0/0           
54996 8742K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 120K   10M ACCEPT     all  --  tun+   *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      eth0    0.0.0.0/0            0.0.0.0/0            state NEW
 169K  250M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT 560K packets, 315M bytes)
 pkts bytes target     prot opt in     out     source               destination         
  878 65497 ACCEPT     all  --  *      eth0    0.0.0.0/0            0.0.0.0/0            state NEW

Traffic

Title:

2 OpenVPN clients, same config but 1 device cannot connect

Means:

2 OpenVPN clients, same config but 1 device cannot connect to the internet

As your client connects to the internet via your server we need server config and logs ..

Also:

server: iptables -t nat -L
ipad client: ping 10.8.0.1 and ping 8.8.8.8

superinterstellar

Hey traffic,
thanks for your feedback.
The ipad client now seems to work, it can access the internet but another client(the router does not work). It pings fine to the server and google. I am guessing this is a NAT issue. Not sure. Below is the config output. Appreciate if you could advise on this.

Server config is below:

local 46.xxx.xxx.41
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
persist-key
persist-tun
status openvpn-status.log
verb 3
comp-lzo
#client-to-client
#client-config-dir ccd
#route 192.168.30.0 255.255.255.0
#route 192.168.20.0 255.255.255.0
#push "route 192.168.20.0 255.255.255.0"
#push "route 192.168.30.0 255.255.255.0"
#push "route 192.168.50.0 255.255.255.0"
#tun-mtu 1500
#tun-mtu-extra 32
#mssfix 1450

Output for 8.8.8.8 ping

Seq	Address	RX Bytes	TTL	RTT (ms)	+/- (ms)
0	8.8.8.8 (8.8.8.8)	64	58	330.46	
1	8.8.8.8 (8.8.8.8)	64	58	330.15	-0.31
2	8.8.8.8 (8.8.8.8)	64	58	330.08	-0.07
3	8.8.8.8 (8.8.8.8)	64	58	330.13	0.05
4	8.8.8.8 (8.8.8.8)	64	58	330.02	-0.11

Output for 18.8.0.1 ping

Seq	Address	RX Bytes	TTL	RTT (ms)	+/- (ms)
0	10.8.0.1 (10.8.0.1)	64	64	321.24	
1	10.8.0.1 (10.8.0.1)	64	64	321.04	-0.20
2	10.8.0.1 (10.8.0.1)	64	64	321.20	0.16
3	10.8.0.1 (10.8.0.1)	64	64	321.11	-0.09
4	10.8.0.1 (10.8.0.1)	64	64	321.27	0.16

Round-Trip: 321.037 min, 321.170 avg, 321.274 max (ms)
Packets: 5 transmitted, 5 received, 0% lost

Output of iptables

  iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  10.8.0.0/24          anywhere            
MASQUERADE  all  --  10.8.0.0/24          anywhere            
MASQUERADE  all  --  10.8.0.0/24          anywhere            
MASQUERADE  all  --  10.8.0.0/24          anywhere            
MASQUERADE  all  --  10.8.0.0/24          anywhere

Output log from client : It seems that the client is working well and I imagine its a NAT issue

Feb 24 11:43:46 RT-AC9E17E989D4 daemon.err openvpn[6493]: event_wait : Interrupted system call (code=4)
Feb 24 11:43:46 RT-AC9E17E989D4 daemon.notice openvpn[6493]: OpenVPN STATISTICS
Feb 24 11:43:46 RT-AC9E17E989D4 daemon.notice openvpn[6493]: Updated,Tue Feb 24 11:43:46 2015
Feb 24 11:43:46 RT-AC9E17E989D4 daemon.notice openvpn[6493]: TUN/TAP read bytes,0
Feb 24 11:43:46 RT-AC9E17E989D4 daemon.notice openvpn[6493]: TUN/TAP write bytes,0
Feb 24 11:43:46 RT-AC9E17E989D4 daemon.notice openvpn[6493]: TCP/UDP read bytes,3346
Feb 24 11:43:46 RT-AC9E17E989D4 daemon.notice openvpn[6493]: TCP/UDP write bytes,3099
Feb 24 11:43:46 RT-AC9E17E989D4 daemon.notice openvpn[6493]: Auth read bytes,0
Feb 24 11:43:46 RT-AC9E17E989D4 daemon.notice openvpn[6493]: pre-compress bytes,0
Feb 24 11:43:46 RT-AC9E17E989D4 daemon.notice openvpn[6493]: post-compress bytes,0
Feb 24 11:43:46 RT-AC9E17E989D4 daemon.notice openvpn[6493]: pre-decompress bytes,0
Feb 24 11:43:47 RT-AC9E17E989D4 daemon.notice openvpn[6493]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Feb 24 11:43:47 RT-AC9E17E989D4 daemon.notice openvpn[6493]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Feb 24 11:43:47 RT-AC9E17E989D4 daemon.notice openvpn[6493]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Feb 24 11:43:47 RT-AC9E17E989D4 daemon.notice openvpn[6493]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Feb 24 11:43:47 RT-AC9E17E989D4 daemon.notice openvpn[6493]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Feb 24 11:43:47 RT-AC9E17E989D4 daemon.notice openvpn[6493]: [GAMAYA] Peer Connection Initiated with [AF_INET]46.226.108.41:1194
Feb 24 11:43:49 RT-AC9E17E989D4 daemon.notice openvpn[6493]: SENT CONTROL [GAMAYA]: 'PUSH_REQUEST' (status=1)
Feb 24 11:43:49 RT-AC9E17E989D4 daemon.notice openvpn[6493]: PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.14 10.8.0.13'
Feb 24 11:43:49 RT-AC9E17E989D4 daemon.notice openvpn[6493]: OPTIONS IMPORT: timers and/or timeouts modified
Feb 24 11:43:49 RT-AC9E17E989D4 daemon.notice openvpn[6493]: OPTIONS IMPORT: --ifconfig/up options modified
Feb 24 11:43:49 RT-AC9E17E989D4 daemon.notice openvpn[6493]: OPTIONS IMPORT: route options modified
Feb 24 11:43:49 RT-AC9E17E989D4 daemon.notice openvpn[6493]: OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Feb 24 11:43:49 RT-AC9E17E989D4 daemon.notice openvpn[6493]: TUN/TAP device tun11 opened
Feb 24 11:43:49 RT-AC9E17E989D4 daemon.notice openvpn[6493]: TUN/TAP TX queue length set to 100
Feb 24 11:43:49 RT-AC9E17E989D4 daemon.notice openvpn[6493]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Feb 24 11:43:49 RT-AC9E17E989D4 daemon.notice openvpn[6493]: /sbin//ifconfig tun11 10.8.0.14 pointopoint 10.8.0.13 mtu 1500
Feb 24 11:43:50 RT-AC9E17E989D4 daemon.notice openvpn[6493]: updown.sh tun11 1500 1542 10.8.0.14 10.8.0.13 init
Feb 24 11:43:50 RT-AC9E17E989D4 daemon.info dnsmasq[4404]: exiting on receipt of SIGTERM
Feb 24 11:43:50 RT-AC9E17E989D4 user.debug preinit[1]: 182: pptp peerdns disabled
Feb 24 11:43:50 RT-AC9E17E989D4 daemon.info dnsmasq[6538]: started, version 2.71 cachesize 1500
Feb 24 11:43:50 RT-AC9E17E989D4 daemon.info dnsmasq[6538]: compile time options: IPv6 GNU-getopt no-RTC no-DBus no-i18n no-IDN DHCP DHCPv6 no-Lua TFTP no-conntrack ipset Tomato-helper auth DNSSEC
Feb 24 11:43:50 RT-AC9E17E989D4 daemon.info dnsmasq[6538]: asynchronous logging enabled, queue limit is 5 messages
Feb 24 11:43:50 RT-AC9E17E989D4 daemon.info dnsmasq-dhcp[6538]: DHCP, IP range 192.168.50.100 -- 192.168.50.149, lease time 1d
Feb 24 11:43:50 RT-AC9E17E989D4 daemon.info dnsmasq[6538]: reading /etc/resolv.dnsmasq
Feb 24 11:43:50 RT-AC9E17E989D4 daemon.info dnsmasq[6538]: using nameserver 8.8.8.8#53
Feb 24 11:43:50 RT-AC9E17E989D4 daemon.info dnsmasq[6538]: using nameserver 8.8.4.4#53
Feb 24 11:43:50 RT-AC9E17E989D4 daemon.info dnsmasq[6538]: using nameserver 209.244.0.4#53
Feb 24 11:43:50 RT-AC9E17E989D4 daemon.info dnsmasq[6538]: read /etc/hosts - 2 addresses
Feb 24 11:43:50 RT-AC9E17E989D4 daemon.info dnsmasq[6538]: read /etc/dnsmasq/hosts/hosts - 3 addresses
Feb 24 11:43:50 RT-AC9E17E989D4 daemon.info dnsmasq-dhcp[6538]: read /etc/dnsmasq/dhcp/dhcp-hosts
Feb 24 11:43:50 RT-AC9E17E989D4 daemon.notice openvpn[6493]: /sbin//route add -net 46.226.108.41 netmask 255.255.255.255 gw 203.186.64.129
Feb 24 11:43:50 RT-AC9E17E989D4 daemon.notice openvpn[6493]: /sbin//route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.8.0.13
Feb 24 11:43:50 RT-AC9E17E989D4 daemon.notice openvpn[6493]: /sbin//route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.8.0.13
Feb 24 11:43:50 RT-AC9E17E989D4 daemon.notice openvpn[6493]: /sbin//route add -net 10.8.0.1 netmask 255.255.255.255 gw 10.8.0.13
Feb 24 11:43:50 RT-AC9E17E989D4 daemon.notice openvpn[6493]: Initialization Sequence Completed
Feb 24 11:45:13 RT-AC9E17E989D4 daemon.err openvpn[6493]: event_wait : Interrupted system call (code=4)
Feb 24 11:45:13 RT-AC9E17E989D4 daemon.notice openvpn[6493]: OpenVPN STATISTICS
Feb 24 11:45:13 RT-AC9E17E989D4 daemon.notice openvpn[6493]: Updated,Tue Feb 24 11:45:13 2015
Feb 24 11:45:13 RT-AC9E17E989D4 daemon.notice openvpn[6493]: TUN/TAP read bytes,212005
Feb 24 11:45:13 RT-AC9E17E989D4 daemon.notice openvpn[6493]: TUN/TAP write bytes,283
Feb 24 11:45:13 RT-AC9E17E989D4 daemon.notice openvpn[6493]: TCP/UDP read bytes,4974
Feb 24 11:45:13 RT-AC9E17E989D4 daemon.notice openvpn[6493]: TCP/UDP write bytes,229391
Feb 24 11:45:13 RT-AC9E17E989D4 daemon.notice openvpn[6493]: Auth read bytes,395
Feb 24 11:45:13 RT-AC9E17E989D4 daemon.notice openvpn[6493]: pre-compress bytes,10321
Feb 24 11:45:13 RT-AC9E17E989D4 daemon.notice openvpn[6493]: post-compress bytes,10393
Feb 24 11:45:13 RT-AC9E17E989D4 daemon.notice openvpn[6493]: pre-decompress bytes,0
Feb 24 11:46:33 RT-AC9E17E989D4 daemon.err openvpn[6493]: event_wait : Interrupted system call (code=4)
Feb 24 11:46:33 RT-AC9E17E989D4 daemon.notice openvpn[6493]: OpenVPN STATISTICS
Feb 24 11:46:33 RT-AC9E17E989D4 daemon.notice openvpn[6493]: Updated,Tue Feb 24 11:46:33 2015
Feb 24 11:46:33 RT-AC9E17E989D4 daemon.notice openvpn[6493]: TUN/TAP read bytes,260369
Feb 24 11:46:33 RT-AC9E17E989D4 daemon.notice openvpn[6493]: TUN/TAP write bytes,1809
Feb 24 11:46:33 RT-AC9E17E989D4 daemon.notice openvpn[6493]: TCP/UDP read bytes,7054
Feb 24 11:46:33 RT-AC9E17E989D4 daemon.notice openvpn[6493]: TCP/UDP write bytes,295693
Feb 24 11:46:33 RT-AC9E17E989D4 daemon.notice openvpn[6493]: Auth read bytes,2001
Feb 24 11:46:33 RT-AC9E17E989D4 daemon.notice openvpn[6493]: pre-compress bytes,17718
Feb 24 11:46:33 RT-AC9E17E989D4 daemon.notice openvpn[6493]: post-compress bytes,17298
Feb 24 11:46:33 RT-AC9E17E989D4 daemon.notice openvpn[6493]: pre-decompress bytes,474

The server log
http://pastebin.com/piDWX2jq

Traffic

Pastebin is a pain so here is a snippet of the relevant parts of your server log:

### I have obfuscated the first two numbers of your client ip
### Your client ip address is: xx3.186.64.152 - May be this is your Laptop

client-instance restarting
Tue Feb 24 04:43:13 2015 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Feb 24 04:43:13 2015 xx3.186.64.152:35942 VERIFY OK: depth=1, /C=FR/ST=/L=/O=/OU=IT/CN=/name=/emailAddress=
Tue Feb 24 04:43:13 2015 xx3.186.64.152:35942 VERIFY OK: depth=0, /C=/ST=/L=/O=/OU=/CN=N18UHK/name=changeme/emailAddress=
Tue Feb 24 04:43:14 2015 xx3.186.64.152:35942 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Feb 24 04:43:14 2015 xx3.186.64.152:35942 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb 24 04:43:14 2015 xx3.186.64.152:35942 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Feb 24 04:43:14 2015 xx3.186.64.152:35942 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb 24 04:43:14 2015 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Feb 24 04:43:14 2015 xx3.186.64.152:35942 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Feb 24 04:43:14 2015 xx3.186.64.152:35942 [N18UHK] Peer Connection Initiated with [AF_INET]xx3.186.64.152:35942
Tue Feb 24 04:43:14 2015 N18UHK/xx3.186.64.152:35942 MULTI_sva: pool returned IPv4=10.8.0.14, IPv6=1::1b00:0:267f:0
Tue Feb 24 04:43:14 2015 N18UHK/xx3.186.64.152:35942 MULTI: Learn: 10.8.0.14 -> N18UHK/xx3.186.64.152:35942
Tue Feb 24 04:43:14 2015 N18UHK/xx3.186.64.152:35942 MULTI: primary virtual IP for N18UHK/xx3.186.64.152:35942: 10.8.0.14

### Now your client changes ip address to: xx1.108.150.0 - May be this is your ipad
### Possibly this is a second client connecting with the same cert/key but from a new location

Tue Feb 24 04:43:14 2015 MULTI: multi_create_instance called
Tue Feb 24 04:43:14 2015 xx1.108.150.0:3330 Re-using SSL/TLS context
Tue Feb 24 04:43:14 2015 xx1.108.150.0:3330 LZO compression initialized
Tue Feb 24 04:43:14 2015 xx1.108.150.0:3330 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Feb 24 04:43:14 2015 xx1.108.150.0:3330 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Feb 24 04:43:14 2015 xx1.108.150.0:3330 Local Options hash (VER=V4): '530fdded'
Tue Feb 24 04:43:14 2015 xx1.108.150.0:3330 Expected Remote Options hash (VER=V4): '41690919'
Tue Feb 24 04:43:14 2015 xx1.108.150.0:3330 TLS: Initial packet from [AF_INET]xx1.108.150.0:3330, sid=0a0a200e 54763fe8
Tue Feb 24 04:43:15 2015 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Feb 24 04:43:16 2015 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Feb 24 04:43:16 2015 xx1.108.150.0:62478 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue Feb 24 04:43:16 2015 xx1.108.150.0:62478 TLS Error: TLS handshake failed
Tue Feb 24 04:43:16 2015 xx1.108.150.0:62478 SIGUSR1[soft,tls-error] received, client-instance restarting
Tue Feb 24 04:43:16 2015 N18UHK/xx3.186.64.152:35942 PUSH: Received control message: 'PUSH_REQUEST'
Tue Feb 24 04:43:16 2015 N18UHK/xx3.186.64.152:35942 send_push_reply(): safe_cap=960
Tue Feb 24 04:43:16 2015 N18UHK/xx3.186.64.152:35942 SENT CONTROL [N18UHK]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.14 10.8.0.13' (status=1)

### Above Looks like the connection is successful
### And then this:

Tue Feb 24 04:43:17 2015 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Feb 24 04:43:19 2015 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Feb 24 04:43:19 2015 MULTI: multi_create_instance called
Tue Feb 24 04:43:19 2015 xx1.108.150.0:5147 Re-using SSL/TLS context
Tue Feb 24 04:43:19 2015 xx1.108.150.0:5147 LZO compression initialized
Tue Feb 24 04:43:19 2015 xx1.108.150.0:5147 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Feb 24 04:43:19 2015 xx1.108.150.0:5147 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Feb 24 04:43:19 2015 xx1.108.150.0:5147 Local Options hash (VER=V4): '530fdded'
Tue Feb 24 04:43:19 2015 xx1.108.150.0:5147 Expected Remote Options hash (VER=V4): '41690919'
Tue Feb 24 04:43:19 2015 xx1.108.150.0:5147 TLS: Initial packet from [AF_INET]xx1.108.150.0:5147, sid=9db6bb7a 03f76a55
Tue Feb 24 04:43:19 2015 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Feb 24 04:43:20 2015 N18UHK/xx3.186.64.152:35942 Replay-window backtrack occurred [2]
Tue Feb 24 04:43:20 2015 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Feb 24 04:43:21 2015 xx1.108.150.0:45074 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue Feb 24 04:43:21 2015 xx1.108.150.0:45074 TLS Error: TLS handshake failed
Tue Feb 24 04:43:21 2015 xx1.108.150.0:45074 SIGUSR1[soft,tls-error] received, client-instance restarting
Tue Feb 24 04:43:21 2015 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Feb 24 04:43:22 2015 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Feb 24 04:43:23 2015 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)

I think this may be an MTU issue on your ipad client. What Machine/OS do you use for your server ?

Please post details of (server & ipad client): ifconfig

Also, set --verb 4 in your server & client configs and restart then paste (or pastebin) your log files.

For more details See --mssfix in The Manual v23x

You could try setting this in ALL your configs:

tun-mtu 1500
fragment 1300
mssfix

Before you start changing your configs be aware you may loose connectivity with your other client.

BTW: I do not think this a firewall problem now.

superinterstellar

hi traffic,

the problem is actually my router. my ipad works.
i think i have spotted the problem in the log. the verb 4 log on the server suggest as follows:-

Below is the server log:-

Tue Feb 24 17:02:25 2015 us=734468 125.24.175.183:23442 Re-using SSL/TLS context
Tue Feb 24 17:02:25 2015 us=734503 125.24.175.183:23442 LZO compression initialized
Tue Feb 24 17:02:25 2015 us=734633 125.24.175.183:23442 Control Channel MTU parms [ L:1546 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Feb 24 17:02:25 2015 us=734711 125.24.175.183:23442 Data Channel MTU parms [ L:1546 D:1300 EF:46 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Feb 24 17:02:25 2015 us=734737 125.24.175.183:23442 Fragmentation MTU parms [ L:1546 D:1300 EF:45 EB:135 ET:1 EL:0 AF:3/1 ]
Tue Feb 24 17:02:25 2015 us=734804 125.24.175.183:23442 Local Options String: 'V4,dev-type tun,link-mtu 1546,tun-mtu 1500,proto UDPv4,comp-lzo,mtu-dynamic,c$
Tue Feb 24 17:02:25 2015 us=734826 125.24.175.183:23442 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1546,tun-mtu 1500,proto UDPv4,comp-lzo,mtu$
Tue Feb 24 17:02:25 2015 us=734863 125.24.175.183:23442 Local Options hash (VER=V4): '8e7959c7'
Tue Feb 24 17:02:25 2015 us=734894 125.24.175.183:23442 Expected Remote Options hash (VER=V4): 'c086e1aa'
Tue Feb 24 17:02:25 2015 us=734956 125.24.175.183:23442 TLS: Initial packet from [AF_INET]125.24.175.183:23442, sid=9dc36dc0 261fd383
Tue Feb 24 17:02:25 2015 us=914452 125.24.175.183:47390 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue Feb 24 17:02:25 2015 us=914535 125.24.175.183:47390 TLS Error: TLS handshake failed
Tue Feb 24 17:02:25 2015 us=914666 125.24.175.183:47390 SIGUSR1[soft,tls-error] received, client-instance restarting
Tue Feb 24 17:02:26 2015 us=442650 N18UHK/203.186.64.152:31511 MULTI: bad source address from client [192.168.50.146], packet dropped
Tue Feb 24 17:02:26 2015 us=696791 N18UHK/203.186.64.152:31511 MULTI: bad source address from client [192.168.50.146], packet dropped
Tue Feb 24 17:02:27 2015 us=137819 N18UHK/203.186.64.152:31511 MULTI: bad source address from client [192.168.50.115], packet dropped
Tue Feb 24 17:02:27 2015 us=186146 N18UHK/203.186.64.152:31511 MULTI: bad source address from client [192.168.50.115], packet dropped
Tue Feb 24 17:02:27 2015 us=211549 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Feb 24 17:02:27 2015 us=301210 N18UHK/203.186.64.152:31511 MULTI: bad source address from client [192.168.50.146], packet dropped
Tue Feb 24 17:02:27 2015 us=582973 N18UHK/203.186.64.152:31511 MULTI: bad source address from client [192.168.50.146], packet dropped
Tue Feb 24 17:02:27 2015 us=583950 N18UHK/203.186.64.152:31511 MULTI: bad source address from client [203.186.64.152], packet dropped
Tue Feb 24 17:02:27 2015 us=764090 N18UHK/203.186.64.152:31511 MULTI: bad source address from client [192.168.50.146], packet dropped
Tue Feb 24 17:02:28 2015 us=25661 N18UHK/203.186.64.152:31511 MULTI: bad source address from client [192.168.50.146], packet dropped
Tue Feb 24 17:02:28 2015 us=129967 N18UHK/203.186.64.152:31511 MULTI: bad source address from client [192.168.50.115], packet dropped
Tue Feb 24 17:02:28 2015 us=177655 N18UHK/203.186.64.152:31511 MULTI: bad source address from client [192.168.50.115], packet dropped
Tue Feb 24 17:02:28 2015 us=305196 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Feb 24 17:02:28 2015 us=441661 N18UHK/203.186.64.152:31511 MULTI: bad source address from client [203.186.64.152], packet dropped
Tue Feb 24 17:02:28 2015 us=550726 N18UHK/203.186.64.152:31511 MULTI: bad source address from client [192.168.50.146], packet dropped
Tue Feb 24 17:02:28 2015 us=642352 N18UHK/203.186.64.152:31511 MULTI: bad source address from client [192.168.50.146], packet dropped
Tue Feb 24 17:02:28 2015 us=801809 N18UHK/203.186.64.152:31511 MULTI: bad source address from client [192.168.50.146], packet dropped
Tue Feb 24 17:02:28 2015 us=894254 N18UHK/203.186.64.152:31511 MULTI: bad source address from client [192.168.50.146], packet dropped
Tue Feb 24 17:02:28 2015 us=913969 N18UHK/203.186.64.152:31511 MULTI: bad source address from client [192.168.50.146], packet dropped
Tue Feb 24 17:02:28 2015 us=930909 N18UHK/203.186.64.152:31511 MULTI: bad source address from client [192.168.50.146], packet dropped
Tue Feb 24 17:02:29 2015 us=159712 N18UHK/203.186.64.152:31511 MULTI: bad source address from client [192.168.50.146], packet dropped

Output of the ifconfig on the server

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  

          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255

          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1

          RX packets:184 errors:0 dropped:0 overruns:0 frame:0

          TX packets:180 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:100 

          RX bytes:11353 (11.3 KB)  TX bytes:20933 (20.9 KB)

Output of client ifconfig :-


tun11      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
           inet addr:10.8.0.14  P-t-P:10.8.0.13  Mask:255.255.255.255
           UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
           RX packets:229 errors:0 dropped:0 overruns:0 frame:0
           TX packets:7594 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:100 
           RX bytes:29441 (28.7 KiB)  TX bytes:691356 (675.1 KiB)

vlan1      Link encap:Ethernet  HWaddr AC:9E:17:E9:89:D4  
           UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
           RX packets:46571 errors:0 dropped:0 overruns:0 frame:0
           TX packets:121974 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:0 
           RX bytes:9444368 (9.0 MiB)  TX bytes:16725025 (15.9 MiB)

vlan2      Link encap:Ethernet  HWaddr AC:9E:17:E9:89:D5  
           inet addr:203.xxx.xx.152  Bcast:203.xx.xx.191  Mask:255.255.255.192
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
           RX packets:38544472 errors:0 dropped:0 overruns:0 frame:0
           TX packets:16785322 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:0 
           RX bytes:48915735419 (45.5 GiB)  TX bytes:1939590793 (1.8 GiB)

superinterstellar

Hi

I suppose I need to do this to have it working, need to add clients individually?
I have a question . What if there are new clients that will connect to the router, how would they be able to access the internet if they have to be added manually?

Does this make sense?

"MULTI: bad source address from client , packet dropped" or "GET INST BY VIRT: [failed]"?
These errors occur because OpenVPN doesn't have an internal route for 192.168.100.249. Consequently, it doesn't know how to route the packet to this machine, so it drops the packet.
Use client-config-dir and create a ccd file for your client containing the iroute option to tell OpenVPN that the 192.168.100.0/24 network is available behind this client.
"MULTI: bad source address from client [192.168.100.249], packet dropped" or "GET INST BY VIRT: 192.168.100.249 [failed]"?

Thanks
Kevin

Traffic

superinterstellar wroteOutput of the ifconfig on the server
Code:
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00

inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255

UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1

We actually need the eth0 (or equivalent) data.

superinterstellar wrotei think i have spotted the problem in the log. the verb 4 log on the server suggest as follows:-

Below is the server log:-
Code:

Tue Feb 24 17:02:25 2015 us=734804 125.24.175.183:23442 Local Options String: 'V4,dev-type tun,link-mtu 1546,tun-mtu 1500,proto UDPv4,comp-lzo,mtu-dynamic,c$
Tue Feb 24 17:02:25 2015 us=734826 125.24.175.183:23442 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1546,tun-mtu 1500,proto UDPv4,comp-lzo,mtu$

### Possible MTU problems persist ...

Tue Feb 24 17:02:25 2015 us=914452 125.24.175.183:47390 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue Feb 24 17:02:25 2015 us=914535 125.24.175.183:47390 TLS Error: TLS handshake failed
Tue Feb 24 17:02:25 2015 us=914666 125.24.175.183:47390 SIGUSR1[soft,tls-error] received, client-instance restarting

These are standard errors:

superinterstellar wrote Tue Feb 24 17:02:26 2015 us=442650 N18UHK/203.186.64.152:31511 MULTI: bad source address from client [192.168.50.146], packet dropped

Tue Feb 24 17:02:27 2015 us=137819 N18UHK/203.186.64.152:31511 MULTI: bad source address from client [192.168.50.115], packet dropped

Tue Feb 24 17:02:27 2015 us=583950 N18UHK/203.186.64.152:31511 MULTI: bad source address from client [203.186.64.152], packet dropped

which can be resolved by re-instating this in your server config:

superinterstellar wrote#client-config-dir ccd

You must include the appropriate --iroute statement: eg.

ifconfig-push 10.8.x.x
iroute 192.168.50.146

Traffic

superinterstellar wroteWhat if there are new clients that will connect to the router, how would they be able to access the internet if they have to be added manually?

Does this make sense?

It does not make sense but .. you must create unique CCD and cert/keys for each of your clients.

superinterstellar

all the clients have individual cert and keys.
Do all clients need to be in ccd with iroute entry?
For example , I will have the router on ccd but what about the computers connected to the router?

Traffic

superinterstellar wroteDo all clients need to be in ccd with iroute entry?

Traffic wroteyou must create unique CCD and cert/keys for each of your clients

Come on now .. it is time you started reading the HOWTO ...

HOWTO: Expanding the scope of the VPN to include additional machines

superinterstellar

How come the iPad and MacBook doesn't need this config?

Traffic

From the point of view of OpenVPN .. They do.

Not all operating systems are created equal ..

superinterstellar

hey traffic,
i am really sorry if i am being a pain. I have tried to understand the manuals but I am having a hard time wrapping my head around all the concepts(I am familiar with TAP setup only).
So I would really appreciate if you could help me figure a correct configuration for my router. I only need to figure out this 1 configuration.
If I can through this, one configuration the rest I will be able to manage.
Everytime I have a wrong configuration, the router crashes(and it is frustrating). So i really need to have this correct .

My router ip address is 192.168.90.1 and I am trying to have it pushed on my server. Is the config below correct?
Please confirm if I am doing it correctly.

**I am not sure if it should be 192.168.90.0 or 192.168.90.1 for the configuration listed below. Also advise if more config need to be added.

My server (Ubuntu 12.04 VPS)

local 46.226.108.41
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
persist-key
persist-tun
status openvpn-status.log
verb 4
comp-lzo
client-to-client
client-config-dir ccd
route 192.168.90.0 255.255.255.0
push "route 192.168.90.0 255.255.255.0"
log-append /var/log/openvpn.log

/etc/openvpn/ccd

iroute 192.168.90.0 255.255.255.0

Error Message

Wed Feb 25 12:32:44 2015 us=601965 MULTI: multi_create_instance called
Wed Feb 25 12:32:44 2015 us=602057 101.108.148.164:25651 Re-using SSL/TLS context
Wed Feb 25 12:32:44 2015 us=602089 101.108.148.164:25651 LZO compression initialized
Wed Feb 25 12:32:44 2015 us=602181 101.108.148.164:25651 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Feb 25 12:32:44 2015 us=602212 101.108.148.164:25651 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Feb 25 12:32:44 2015 us=602281 101.108.148.164:25651 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF$
Wed Feb 25 12:32:44 2015 us=602303 101.108.148.164:25651 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo$
Wed Feb 25 12:32:44 2015 us=602338 101.108.148.164:25651 Local Options hash (VER=V4): '530fdded'
Wed Feb 25 12:32:44 2015 us=602370 101.108.148.164:25651 Expected Remote Options hash (VER=V4): '41690919'
Wed Feb 25 12:32:44 2015 us=602425 101.108.148.164:25651 TLS: Initial packet from [AF_INET]101.108.148.164:25651, sid=8e287923 16dab9a1
Wed Feb 25 12:32:44 2015 us=747490 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Wed Feb 25 12:32:44 2015 us=890841 N18UHK/203.186.64.152:18398 MULTI: bad source address from client [203.186.64.152], packet dropped
Wed Feb 25 12:32:45 2015 us=441265 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Wed Feb 25 12:32:46 2015 us=417224 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Wed Feb 25 12:32:46 2015 us=685741 N18UHK/203.186.64.152:18398 MULTI: bad source address from client [203.186.64.152], packet dropped
Wed Feb 25 12:32:47 2015 us=519003 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)

Thanks
Kevin

Traffic

For clarity, this is a new problem from this point on:

superinterstellar wroteThe ipad client now seems to work, it can access the internet but another client(the router does not work).
https://forums.openvpn.net/post49723.html#p49723

Item #1

In order to solve these minor errors:

superinterstellar wroteWed Feb 25 12:32:46 2015 us=685741 N18UHK/203.186.64.152:18398 MULTI: bad source address from client [203.186.64.152], packet dropped

the server needs to have an iroute (internal route) for IP address N18UHK/203.186.64.152 .. the way to do that is to have a CCD file for client:N18UHK which has an --iroute x.x.x.x

However, in this case it appears it should be: iroute 203.186.64.152 but that may not be accurate as your client is not behind a NAT and so the iroute may confuse the server routing. This is because your client is a router [†].. I suspect you will have to change the router setup but I do not know how/what needs to be changed .. Perhaps Maikcat can advise us both !

Done correctly the error should look like this:

Wed Feb 25 12:49:47 2015 us=281481 client3/2.99.79.x:4597 MULTI: bad source address from client [10.1.101.199], packet dropped

Where client3/2.99.79.x is the client3/public IP address and 10.1.101.199 is client3 LAN address behind a NAT firewall.
.: the CCD would be: filename=client3 content=iroute 10.1.101.199

Item #2

What is this error:

superinterstellar wroteWed Feb 25 12:32:47 2015 us=519003 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)

If this is the same client (ie: You only have one client trying to connect at this time and that client is the same router as above) then I suspect the router/firewall needs a rule to allow incoming/returning packets from ServerIP(46.226.108.41):UDP1194 .. again I cannot offer much help for your router, try the router manual.

superinterstellar wroteMy router ip address is 192.168.90.1

Your router Private IP address ..

superinterstellar wroteI am not sure if it should be 192.168.90.0 or 192.168.90.1

it can be either depending on the desired result:

iroute 192.168.90.1 - For the client only, to resolve the error above only
iroute 192.168.90.0 255.255.255.0 - For the entire client LAN and to resolve the error above

However, see my previous comment [†]..

superinterstellar wroteMy router ip address is 192.168.90.1 and I am trying to have it pushed on my server. Is the config below correct?

Your server config looks to be correct but the client is a router and so I am not sure what needs to be done .. see my previous comment [†]..

I may be able to help if you tell me the exact make/model of the router and the firmware in use .. I can run OpenWRT for testing.

superinterstellar

hi traffic,
thanks for your feedback.
Will try to troubleshoot it a little more.
on tap network the setup was alot easier.
I am running a router with tomato advanced. Its the latest one for N18U
https://advancedtomato.com/downloads/router/rt-n18u

Hope micheal can provide a sample config to follow.

Thanks
kevin

superinterstellar

hi traffic.
i think i have a bad firmware. will change it to shibby, its more popular and less likely to run into problems.
in case others are having similar problem, please see link below:-

http://blog.qnology.com/2013/02/tutorial-30-minutes-or-less-site-to.html