bad source address from client [x.x.x.x], packet dropp

travel247

I've been trying to get this working all day, literally. I've killed about 12 hours on this.

I have a simple VPN config. A VPN server at home. And a small raspberry PI VPN router I travel with. I boot my raspberry pi up, it connects to my server back at home automatically, and I plug my laptop onto the other ethernet port on the PI, I get a DHCP address and I'm VPN'd in. Everything works fine, but I keep seeing this error sporadically in the logs:

MULTI: bad source address from client [192.168.23.10], packet dropped

192.168.23.10 is the address of my laptop that is connected to raspberry pi vpn router.

I've mangled my configs through the entire today, but I'll paste my current config, which is still working. But it still gives the bad source address error.

VPN SERVER:
dev tun
proto udp
port 1194
ca /etc/openvpn/easyrsa/keys/BLAH.crt
cert /etc/openvpn/easyrsa/keys/BLAH.crt
key /etc/openvpn/easyrsa/keys/BLAH.key
dh /etc/openvpn/easyrsa/keys/BLAH.pem
user nobody
group nogroup
server 192.168.22.0 255.255.255.0
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 5
client-to-client
auth SHA512
push "redirect-gateway def1"
tls-auth /etc/openvpn/easyrsa/keys/ta.key 0
client-config-dir ccd
route 192.168.23.0 255.255.255.0

#set the dns servers
push "dhcp-option DNS x.x.x.x"
push "dhcp-option DNS x.x.x.x"
log-append /var/log/openvpn
comp-lzo

MY CCD FILE:
cat /etc/openvpn/ccd/client1
iroute 192.168.23.0 255.255.255.0

CLIENT CONFIG:
# Raspberry Pi VPN Client Config
client
dev tun
proto udp
# VERIZON CONFIG:
remote x.x.x.x my_port
resolv-retry infinite
nobind
persist-key
persist-tun
ns-cert-type server
auth SHA512
verb 5
mute 20
tls-auth ta.key 1
comp-lzo
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/dan4606.crt
key /etc/openvpn/keys/dan4606.key

IPTABLES SAVED RULES:
# Generated by iptables-save
*filter
:INPUT ACCEPT [2965:1424084]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1425:182707]
-A INPUT -i tun+ -m comment --comment "OpenVPN Rule 001" -j ACCEPT
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 1194 -m comment --comment "OpenVPN Rule 005" -j ACCEPT
-A FORWARD -s 192.168.22.0/24 -d 192.168.21.0/24 -i tun0 -o eth0 -m conntrack --ctstate NEW -m comment --comment "OpenVPN Rule 004" -j ACCEPT
-A FORWARD -d 192.168.23.0/24 -i any -o tun0 -m conntrack --ctstate NEW -m comment --comment "OpenVPN Rule 004b" -j ACCEPT
-A FORWARD -i tun+ -m comment --comment "OpenVPN Rule 006" -j ACCEPT
-A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -m comment --comment "OpenVPN Rule 007" -j ACCEPT
-A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -m comment --comment "OpenVPN Rule 008" -j ACCEPT
-A OUTPUT -o tun+ -m comment --comment "OpenVPN Rule 002" -j ACCEPT
COMMIT
# Completed
# Generated by
*nat
😛REROUTING ACCEPT [165:30310]
:INPUT ACCEPT [161:29926]
:OUTPUT ACCEPT [50:3357]
😛OSTROUTING ACCEPT [50:3357]
-A POSTROUTING -s 192.168.22.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -d 192.168.23.0/24 -o tun0 -j MASQUERADE
COMMIT
# Completed on Fri Jan 2 22:09:25 2015

## MY NETWORK RANGES
192.168.23.0/24 is the dhcp range that the raspberry pi travel vpn router leases out
192.168.23.10 is the IP that my laptop gets from the PI
192.168.22.0/24 is the VPN tunnel range
192.168.21.0/24 is my internal home router range

maikcat

something is missing here...

I plug my laptop onto the other ethernet port on the PI, I get a DHCP address and I'm VPN'd in.

ok lan to lan setup

## MY NETWORK RANGES
192.168.23.0/24 is the dhcp range that the raspberry pi travel vpn router leases out
192.168.23.10 is the IP that my laptop gets from the PI

so your pc BEHIND the pi gets 192.168.23.10,

your pi uses

cert /etc/openvpn/keys/dan4606.crt
key /etc/openvpn/keys/dan4606.key

dan4606 cert , with CN the same maybe?

but your ccd

MY CCD FILE:
cat /etc/openvpn/ccd/client1
iroute 192.168.23.0 255.255.255.0

is for client1? who is client1?
if the above are correct your lan to lan scenario does NOT my friend...

btw the iptables rules are from the pi?
if yes remove the NAT to check that your setup is not functional...

Michael.