Hi, I have a problem with OpenVpn when trying to connect by windows client.
Where I went wrong the configuration?
Config by server side
dev tun
port 51005
script-security 2
proto tcp-server
max-clients 1
ifconfig 172.35.1.1 172.35.1.2
tls-server
dh /etc/openvpn/keys/dh1024.pem
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
tls-auth /etc/openvpn/keys/chave.key
comp-lzo
push "route 192.168.0.0 255.255.255.0"
ping 4
ping-restart 6
persist-tun
verb 3
log-append /etc/openvpn/clients/client/openvpn.log
Config by client side
dev tun
proto udp
port 51005
tls-client
remote-cert-tls server
script-security 2
remote ip.server
max-clients 1
ifconfig 172.35.1.2 172.35.1.1
dh dh1024.pem
ca ca.crt
cert client.crt
key client.key
tls-auth chave.key
comp-lzo
pull
ping 4
ping-restart 6
persist-tun
verb 6
Tcpdump running on OpenVpn server
tcpdump -n -i eth0 port 51005
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
13:48:18.081543 IP ip.client.22385 > ip.server.51005: UDP, length 42
13:48:20.414843 IP ip.client.22385 > ip.server.51005: UDP, length 42
13:48:27.144504 IP ip.client.22385 > ip.server.51005: UDP, length 42
13:48:29.522181 IP ip.client.22385 > ip.server.51005: UDP, length 42
13:48:35.051443 IP ip.client.22385 > ip.server.51005: UDP, length 42
13:48:37.416562 IP ip.client.22385 > ip.server.51005: UDP, length 42
13:48:44.166363 IP ip.client.22385 > ip.server.51005: UDP, length 42
13:48:46.455138 IP ip.client.22385 > ip.server.51005: UDP, length 42
Log of client side
Tue Mar 24 14:00:43 2015 pkcs11_protected_authentication = DISABLED
Tue Mar 24 14:00:43 2015 pkcs11_protected_authentication = DISABLED
Tue Mar 24 14:00:43 2015 pkcs11_protected_authentication = DISABLED
Tue Mar 24 14:00:43 2015 pkcs11_protected_authentication = DISABLED
Tue Mar 24 14:00:43 2015 pkcs11_private_mode = 00000000
Tue Mar 24 14:00:43 2015 pkcs11_private_mode = 00000000
Tue Mar 24 14:00:43 2015 pkcs11_private_mode = 00000000
Tue Mar 24 14:00:43 2015 pkcs11_private_mode = 00000000
Tue Mar 24 14:00:43 2015 pkcs11_private_mode = 00000000
Tue Mar 24 14:00:43 2015 pkcs11_private_mode = 00000000
Tue Mar 24 14:00:43 2015 pkcs11_private_mode = 00000000
Tue Mar 24 14:00:43 2015 pkcs11_private_mode = 00000000
Tue Mar 24 14:00:43 2015 pkcs11_private_mode = 00000000
Tue Mar 24 14:00:43 2015 pkcs11_private_mode = 00000000
Tue Mar 24 14:00:43 2015 pkcs11_private_mode = 00000000
Tue Mar 24 14:00:43 2015 pkcs11_private_mode = 00000000
Tue Mar 24 14:00:43 2015 pkcs11_private_mode = 00000000
Tue Mar 24 14:00:43 2015 pkcs11_private_mode = 00000000
Tue Mar 24 14:00:43 2015 pkcs11_private_mode = 00000000
Tue Mar 24 14:00:43 2015 pkcs11_private_mode = 00000000
Tue Mar 24 14:00:43 2015 pkcs11_cert_private = DISABLED
Tue Mar 24 14:00:43 2015 pkcs11_cert_private = DISABLED
Tue Mar 24 14:00:43 2015 pkcs11_cert_private = DISABLED
Tue Mar 24 14:00:43 2015 pkcs11_cert_private = DISABLED
Tue Mar 24 14:00:43 2015 pkcs11_cert_private = DISABLED
Tue Mar 24 14:00:43 2015 pkcs11_cert_private = DISABLED
Tue Mar 24 14:00:43 2015 pkcs11_cert_private = DISABLED
Tue Mar 24 14:00:43 2015 pkcs11_cert_private = DISABLED
Tue Mar 24 14:00:43 2015 pkcs11_cert_private = DISABLED
Tue Mar 24 14:00:43 2015 pkcs11_cert_private = DISABLED
Tue Mar 24 14:00:43 2015 pkcs11_cert_private = DISABLED
Tue Mar 24 14:00:43 2015 pkcs11_cert_private = DISABLED
Tue Mar 24 14:00:43 2015 pkcs11_cert_private = DISABLED
Tue Mar 24 14:00:43 2015 pkcs11_cert_private = DISABLED
Tue Mar 24 14:00:43 2015 pkcs11_cert_private = DISABLED
Tue Mar 24 14:00:43 2015 pkcs11_cert_private = DISABLED
Tue Mar 24 14:00:43 2015 pkcs11_pin_cache_period = -1
Tue Mar 24 14:00:43 2015 pkcs11_id = '[UNDEF]'
Tue Mar 24 14:00:43 2015 pkcs11_id_management = DISABLED
Tue Mar 24 14:00:43 2015 server_network = 0.0.0.0
Tue Mar 24 14:00:43 2015 server_netmask = 0.0.0.0
Tue Mar 24 14:00:43 2015 server_network_ipv6 = ::
Tue Mar 24 14:00:43 2015 server_netbits_ipv6 = 0
Tue Mar 24 14:00:43 2015 server_bridge_ip = 0.0.0.0
Tue Mar 24 14:00:43 2015 server_bridge_netmask = 0.0.0.0
Tue Mar 24 14:00:43 2015 server_bridge_pool_start = 0.0.0.0
Tue Mar 24 14:00:43 2015 server_bridge_pool_end = 0.0.0.0
Tue Mar 24 14:00:43 2015 ifconfig_pool_defined = DISABLED
Tue Mar 24 14:00:43 2015 ifconfig_pool_start = 0.0.0.0
Tue Mar 24 14:00:43 2015 ifconfig_pool_end = 0.0.0.0
Tue Mar 24 14:00:43 2015 ifconfig_pool_netmask = 0.0.0.0
Tue Mar 24 14:00:43 2015 ifconfig_pool_persist_filename = '[UNDEF]'
Tue Mar 24 14:00:43 2015 ifconfig_pool_persist_refresh_freq = 600
Tue Mar 24 14:00:43 2015 ifconfig_ipv6_pool_defined = DISABLED
Tue Mar 24 14:00:43 2015 ifconfig_ipv6_pool_base = ::
Tue Mar 24 14:00:43 2015 ifconfig_ipv6_pool_netbits = 0
Tue Mar 24 14:00:43 2015 n_bcast_buf = 256
Tue Mar 24 14:00:43 2015 tcp_queue_limit = 64
Tue Mar 24 14:00:43 2015 real_hash_size = 256
Tue Mar 24 14:00:43 2015 virtual_hash_size = 256
Tue Mar 24 14:00:43 2015 client_connect_script = '[UNDEF]'
Tue Mar 24 14:00:43 2015 learn_address_script = '[UNDEF]'
Tue Mar 24 14:00:43 2015 client_disconnect_script = '[UNDEF]'
Tue Mar 24 14:00:43 2015 client_config_dir = '[UNDEF]'
Tue Mar 24 14:00:43 2015 ccd_exclusive = DISABLED
Tue Mar 24 14:00:43 2015 tmp_dir = 'C:\Users\admin\AppData\Local\Temp\'
Tue Mar 24 14:00:43 2015 push_ifconfig_defined = DISABLED
Tue Mar 24 14:00:43 2015 push_ifconfig_local = 0.0.0.0
Tue Mar 24 14:00:43 2015 push_ifconfig_remote_netmask = 0.0.0.0
Tue Mar 24 14:00:43 2015 push_ifconfig_ipv6_defined = DISABLED
Tue Mar 24 14:00:43 2015 push_ifconfig_ipv6_local = ::/0
Tue Mar 24 14:00:43 2015 push_ifconfig_ipv6_remote = ::
Tue Mar 24 14:00:43 2015 enable_c2c = DISABLED
Tue Mar 24 14:00:43 2015 duplicate_cn = DISABLED
Tue Mar 24 14:00:43 2015 cf_max = 0
Tue Mar 24 14:00:43 2015 cf_per = 0
Tue Mar 24 14:00:43 2015 max_clients = 1
Tue Mar 24 14:00:43 2015 max_routes_per_client = 256
Tue Mar 24 14:00:43 2015 auth_user_pass_verify_script = '[UNDEF]'
Tue Mar 24 14:00:43 2015 auth_user_pass_verify_script_via_file = DISABLED
Tue Mar 24 14:00:43 2015 client = DISABLED
Tue Mar 24 14:00:43 2015 pull = ENABLED
Tue Mar 24 14:00:43 2015 auth_user_pass_file = '[UNDEF]'
Tue Mar 24 14:00:43 2015 show_net_up = DISABLED
Tue Mar 24 14:00:43 2015 route_method = 0
Tue Mar 24 14:00:43 2015 ip_win32_defined = DISABLED
Tue Mar 24 14:00:43 2015 ip_win32_type = 3
Tue Mar 24 14:00:43 2015 dhcp_masq_offset = 0
Tue Mar 24 14:00:43 2015 dhcp_lease_time = 31536000
Tue Mar 24 14:00:43 2015 tap_sleep = 0
Tue Mar 24 14:00:43 2015 dhcp_options = DISABLED
Tue Mar 24 14:00:43 2015 dhcp_renew = DISABLED
Tue Mar 24 14:00:43 2015 dhcp_pre_release = DISABLED
Tue Mar 24 14:00:43 2015 dhcp_release = DISABLED
Tue Mar 24 14:00:43 2015 domain = '[UNDEF]'
Tue Mar 24 14:00:43 2015 netbios_scope = '[UNDEF]'
Tue Mar 24 14:00:43 2015 netbios_node_type = 0
Tue Mar 24 14:00:43 2015 disable_nbt = DISABLED
Tue Mar 24 14:00:43 2015 OpenVPN 2.3.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Jun 5 2014
Tue Mar 24 14:00:43 2015 library versions: OpenSSL 1.0.1h 5 Jun 2014, LZO 2.05
Tue Mar 24 14:00:43 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Mar 24 14:00:43 2015 Need hold release from management interface, waiting...
Tue Mar 24 14:00:44 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Mar 24 14:00:44 2015 MANAGEMENT: CMD 'state on'
Tue Mar 24 14:00:44 2015 MANAGEMENT: CMD 'log all on'
Tue Mar 24 14:00:44 2015 MANAGEMENT: CMD 'hold off'
Tue Mar 24 14:00:44 2015 MANAGEMENT: CMD 'hold release'
Tue Mar 24 14:00:44 2015 WARNING: using --pull/--client and --ifconfig together is probably not what you want
Tue Mar 24 14:00:44 2015 Control Channel Authentication: using 'chave.key' as a OpenVPN static key file
Tue Mar 24 14:00:44 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 24 14:00:44 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 24 14:00:44 2015 LZO compression initialized
Tue Mar 24 14:00:44 2015 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Mar 24 14:00:44 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Mar 24 14:00:44 2015 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Mar 24 14:00:44 2015 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Tue Mar 24 14:00:44 2015 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Tue Mar 24 14:00:44 2015 Local Options hash (VER=V4): '02af3434'
Tue Mar 24 14:00:44 2015 Expected Remote Options hash (VER=V4): '3f08d474'
Tue Mar 24 14:00:44 2015 UDPv4 link local (bound): [undef]
Tue Mar 24 14:00:44 2015 UDPv4 link remote: [AF_INET]ip.server:51005
Tue Mar 24 14:00:44 2015 MANAGEMENT: >STATE:1427216444,WAIT,,,
Tue Mar 24 14:00:44 2015 UDPv4 WRITE [42] to [AF_INET]ip.server:51005: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #1 ] [ ] pid=0 DATA len=0
Tue Mar 24 14:00:46 2015 UDPv4 WRITE [42] to [AF_INET]ip.server:51005: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #2 ] [ ] pid=0 DATA len=0
Tue Mar 24 14:00:50 2015 [UNDEF] Inactivity timeout (--ping-restart), restarting
Tue Mar 24 14:00:50 2015 TCP/UDP: Closing socket
Tue Mar 24 14:00:50 2015 SIGUSR1[soft,ping-restart] received, process restarting
Tue Mar 24 14:00:50 2015 MANAGEMENT: >STATE:1427216450,RECONNECTING,ping-restart,,
Tue Mar 24 14:00:50 2015 Restart pause, 2 second(s)
Tue Mar 24 14:00:52 2015 Control Channel Authentication: using 'chave.key' as a OpenVPN static key file
Tue Mar 24 14:00:52 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 24 14:00:52 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 24 14:00:52 2015 LZO compression initialized
Tue Mar 24 14:00:52 2015 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Mar 24 14:00:52 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Mar 24 14:00:52 2015 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Mar 24 14:00:52 2015 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Tue Mar 24 14:00:52 2015 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Tue Mar 24 14:00:52 2015 Local Options hash (VER=V4): '02af3434'
Tue Mar 24 14:00:52 2015 Expected Remote Options hash (VER=V4): '3f08d474'
Tue Mar 24 14:00:52 2015 UDPv4 link local (bound): [undef]
Tue Mar 24 14:00:52 2015 UDPv4 link remote: [AF_INET]ip.server:51005
Tue Mar 24 14:00:52 2015 MANAGEMENT: >STATE:1427216452,WAIT,,,
Tue Mar 24 14:00:52 2015 UDPv4 WRITE [42] to [AF_INET]ip.server:51005: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #1 ] [ ] pid=0 DATA len=0
Tue Mar 24 14:00:54 2015 UDPv4 WRITE [42] to [AF_INET]ip.server:51005: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #2 ] [ ] pid=0 DATA len=0
My firewall rules:
/sbin/iptables -A INPUT -i eth0 -s 0/0 -m multiport -p udp --dports 51001,51002,51003,51004,51005,51006 -j ACCEPT
/sbin/iptables -A FORWARD -i eth0 -s 0/0 -m multiport -p udp --dports 51001,51002,51003,51004,51005,51006 -j ACCEPT
/sbin/iptables -A INPUT -i eth0 -d 0/0 -m multiport -p udp --sports 51001,51002,51003,51004,51005,51006 -j ACCEPT
/sbin/iptables -A FORWARD -i eth0 -d 0/0 -m multiport -p udp --sports 51001,51002,51003,51004,51005,51006 -j ACCEPT
/sbin/iptables -A FORWARD -i tun0 -j ACCEPT
/sbin/iptables -A INPUT -i tun0 -j ACCEPT
Best Regards,