Openvpn 2 Clients 1 Server

baldry

Hello

I am new to the Server Config stuff so i will try to explain my problem. I am trying to connect to 2 Clients from my server. 1 Connection works great but the 2th wont connect. first of all the conf files

server client 1 config:

port 1194
proto tcp
dev tun
link-mtu 1420
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/xx.crt
key /etc/openvpn/keys/xx.key
dh /etc/openvpn/keys/xx.pem
server 10.1.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.110.0 255.255.255.0"
keepalive 10 120
auth SHA1
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
verb 3

server client 2 config

port 1195
proto tcp
dev tun
link-mtu 1420
ca /etc/openvpn/keys2/ca.crt
cert /etc/openvpn/keys2/server1.crt
key /etc/openvpn/keys2/server1.key
dh /etc/openvpn/keys2/dh.pem
server 10.1.1.0 255.255.255.0
ifconfig-pool-persist ipp2.txt
push "route 192.168.110.0 255.255.255.0"
keepalive 10 120
auth SHA1
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
verb 4

tun0 and tun1 is created at ifconfig

server log for server client 2

Current Parameter Settings:
config = '/etc/openvpn/openvpn2.conf'
mode = 1
persist_config = DISABLED
persist_mode = 1
show_ciphers = DISABLED
show_digests = DISABLED
show_engines = DISABLED
genkey = DISABLED
key_pass_file = '[UNDEF]'
show_tls_ciphers = DISABLED
Connection profiles [default]:
proto = tcp-server
local = '[UNDEF]'
local_port = 1195
remote = '[UNDEF]'
remote_port = 1195
remote_float = DISABLED
bind_defined = DISABLED
bind_local = ENABLED
connect_retry_seconds = 5
connect_timeout = 10
connect_retry_max = 0
socks_proxy_server = '[UNDEF]'
socks_proxy_port = 0
socks_proxy_retry = DISABLED
tun_mtu = 1500
tun_mtu_defined = DISABLED
   link_mtu = 1420
   link_mtu_defined = ENABLED
   tun_mtu_extra = 0
   tun_mtu_extra_defined = DISABLED
   mtu_discover_type = -1
   fragment = 0
   mssfix = 1450
   explicit_exit_notification = 0
 Connection profiles END
   remote_random = DISABLED
   ipchange = '[UNDEF]'
   dev = 'tun'
   dev_type = '[UNDEF]'
   dev_node = '[UNDEF]'
   lladdr = '[UNDEF]'
   topology = 1
   tun_ipv6 = DISABLED
   ifconfig_local = '10.1.1.1'
   ifconfig_remote_netmask = '10.1.1.2'

   ifconfig_nowarn = DISABLED
   ifconfig_ipv6_local = '[UNDEF]'
   ifconfig_ipv6_netbits = 0
   ifconfig_ipv6_remote = '[UNDEF]'
   shaper = 0
   mtu_test = 0
   mlock = DISABLED
   keepalive_ping = 10
   keepalive_timeout = 120
   inactivity_timeout = 0
   ping_send_timeout = 10
   ping_rec_timeout = 240
   ping_rec_timeout_action = 2
   ping_timer_remote = DISABLED
   remap_sigusr1 = 0
   persist_tun = ENABLED
   persist_local_ip = DISABLED
   persist_remote_ip = DISABLED
   persist_key = ENABLED
   passtos = DISABLED
   resolve_retry_seconds = 1000000000
   username = 'nobody'
   groupname = 'nogroup'
   chroot_dir = '[UNDEF]'
   cd_dir = '/etc/openvpn'
   writepid = '/run/openvpn/openvpn2.pid'
   up_script = '[UNDEF]'
   down_script = '[UNDEF]'
   down_pre = DISABLED
   up_restart = DISABLED
   up_delay = DISABLED
   daemon = ENABLED
   inetd = 0
   log = DISABLED
   suppress_timestamps = DISABLED
   nice = 0
   verbosity = 4
   mute = 0
   gremlin = 0
   status_file = '/run/openvpn/openvpn2.status'
   status_file_version = 1
   status_file_update_freq = 10
   occ = ENABLED
   rcvbuf = 65536
   sndbuf = 65536
   mark = 0
   sockflags = 0
   fast_io = DISABLED
   lzo = 0
   route_script = '[UNDEF]'
   route_default_gateway = '[UNDEF]'
   route_default_metric = 0
   route_noexec = DISABLED
   route_delay = 0
   route_delay_window = 30
   route_delay_defined = DISABLED
   route_nopull = DISABLED
   route_gateway_via_dhcp = DISABLED
   max_routes = 100
   allow_pull_fqdn = DISABLED
   route 10.1.1.0/255.255.255.0/nil/nil
   management_addr = '[UNDEF]'

   management_port = 0
   management_user_pass = '[UNDEF]'
   management_log_history_cache = 250
   management_echo_buffer_size = 100
   management_write_peer_info_file = '[UNDEF]'
   management_client_user = '[UNDEF]'
   management_client_group = '[UNDEF]'
   management_flags = 0
   shared_secret_file = '[UNDEF]'
   key_direction = 0
   ciphername_defined = ENABLED
   ciphername = 'AES-256-CBC'
   authname_defined = ENABLED
   authname = 'SHA1'
   prng_hash = 'SHA1'
   prng_nonce_secret_len = 16
   keysize = 0
   engine = DISABLED
   replay = ENABLED
   mute_replay_warnings = DISABLED
   replay_window = 64
   replay_time = 15
   packet_id_file = '[UNDEF]'
   use_iv = ENABLED
   test_crypto = DISABLED
   tls_server = ENABLED
   tls_client = DISABLED
   key_method = 2
   ca_file = '/etc/openvpn/keys2/xx.crt'
   ca_path = '[UNDEF]'
   dh_file = '/etc/openvpn/keys2/xx.pem'
   cert_file = '/etc/openvpn/keys2/xx.crt'
   priv_key_file = '/etc/openvpn/keys2/xx.key'
   pkcs12_file = '[UNDEF]'
   cipher_list = '[UNDEF]'
   tls_verify = '[UNDEF]'
   tls_export_cert = '[UNDEF]'
   verify_x509_type = 0
   verify_x509_name = '[UNDEF]'
   crl_file = '[UNDEF]'
   ns_cert_type = 0
   remote_cert_ku[i] = 0
 message repeated 15 times: [   remote_cert_ku[i] = remote_cert_eku = '[UNDEF]'
   ssl_flags = 0
   tls_timeout = 2
   renegotiate_bytes = 0
   renegotiate_packets = 0
   renegotiate_seconds = 3600
   handshake_window = 60
   transition_window = 3600
   single_session = DISABLED
   push_peer_info = DISABLED
   tls_exit = DISABLED
   tls_auth_file = '[UNDEF]'
   pkcs11_protected_authentication = DISABLED
 message repeated 15 times: [   
   pkcs11_private_mode = 00000000
 message repeated 15 times: [   
   pkcs11_cert_private = DISABLED
 message repeated 15 times: [   pkcs11_cert_private 
   pkcs11_pin_cache_period = -1

pkcs11_id_management = DISABLED
server_network = 10.1.1.0
server_netmask = 255.255.255.0
server_network_ipv6 = ::
server_netbits_ipv6 = 0
server_bridge_ip = 0.0.0.0
server_bridge_netmask = 0.0.0.0
server_bridge_pool_start = 0.0.0.0
server_bridge_pool_end = 0.0.0.0
push_entry = 'route 192.168.110.0 255.255.255.0'
push_entry = 'route 10.1.1.1'
push_entry = 'topology net30'
push_entry = 'ping 10'
push_entry = 'ping-restart 120'
ifconfig_pool_defined = ENABLED
   ifconfig_pool_start = 10.1.1.4
   ifconfig_pool_end = 10.1.1.251
   ifconfig_pool_netmask = 0.0.0.0
   ifconfig_pool_persist_filename = 'ipp2.txt'
ifconfig_pool_persist_refresh_freq = 600
ifconfig_ipv6_pool_defined = DISABLED
ifconfig_ipv6_pool_base = ::
ifconfig_ipv6_pool_netbits = 0
n_bcast_buf = 256
tcp_queue_limit = 64
real_hash_size = 256
virtual_hash_size = 256
client_connect_script = '[UNDEF]'
learn_address_script = '[UNDEF]'
client_disconnect_script = '[UNDEF]'
   client_config_dir = '[UNDEF]'
   ccd_exclusive = DISABLED
   tmp_dir = '/tmp'
   push_ifconfig_defined = DISABLED
   push_ifconfig_local = 0.0.0.0
   push_ifconfig_remote_netmask = 0.0.0.0
   push_ifconfig_ipv6_defined = DISABLED
   push_ifconfig_ipv6_local = ::/0
   push_ifconfig_ipv6_remote = ::
   enable_c2c = DISABLED
   duplicate_cn = DISABLED
cf_max = 0
cf_per = 0
max_clients = 1024
max_routes_per_client = 256
auth_user_pass_verify_script = '[UNDEF]'
auth_user_pass_verify_script_via_file = DISABLED
port_share_host = '[UNDEF]'
port_share_port = 0
client = DISABLED
pull = DISABLED
auth_user_pass_file = '[UNDEF]'
Diffie-Hellman initialized with 4096 bit key
WARNING: normally if you use --mssfix and/or --rrently it is 1361)
TLS-Auth MTU parms [ L:1420 D:140 EF:40 EB:0 
Socket Buffers: R=[87380->131072] S=[16384-
ROUTE_GATEWAY 192.168.110.10/255.255.255.0 
TUN/TAP device tun0 opened
TUN/TAP TX queue length set to 100
do_ifconfig, tt->ipv6=0, tt-
/sbin/ip link set dev tun0 up mtu 1361
/sbin/ip addr add dev tun0 local 10.1.1.1 peer 
/sbin/ip route add 10.1.1.0/24 via 10.1.1.2
Data Channel MTU parms [ L:1420 D:1420 EF:59 
GID set to nogroup
UID set to nobody
Listening for incoming TCP connection on [undef]
TCPv4_SERVER link local (bound): [undef]
TCPv4_SERVER link remote: [undef]
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL: base=10.1.1.4 size=62, ipv6=0
IFCONFIG POOL LIST
MULTI: TCP INIT maxclients=1024 maxevents=1028
Initialization Sequence Completed

Client 2 conf (thats the one that doesnt connect)

client
remote-cert-tls server
dev tun
link-mtu 1420
proto tcp
remote IP 1195
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/keys/xx.crt
cert /etc/openvpn/keys/xx.crt
key /etc/openvpn/keys/xx.key
cipher AES-256-CBC
verb 4
user nobody
group nogroup

client 2 log

Current Parameter Settings:
  config = '/etc/openvpn/openvpn.conf'
  mode = 0
  persist_config = DISABLED
  persist_mode = 1
  show_ciphers = DISABLED
  show_digests = DISABLED
  show_engines = DISABLED
  genkey = DISABLED
  key_pass_file = '[UNDEF]'
  show_tls_ciphers = DISABLED
Connection profiles [default]:
  proto = tcp-client
  local = '[UNDEF]'
  local_port = 0
  remote = 'IP'
  remote_port = 1195
  remote_float = DISABLED
  bind_defined = DISABLED
  bind_local = DISABLED
  connect_retry_seconds = 5
  connect_timeout = 10
  connect_retry_max = 0
  socks_proxy_server = '[UNDEF]'
  socks_proxy_port = 0
  socks_proxy_retry = DISABLED
  tun_mtu = 1500
  tun_mtu_defined = DISABLED
  link_mtu = 1420
  link_mtu_defined = ENABLED
  tun_mtu_extra = 0
  tun_mtu_extra_defined = DISABLED
  mtu_discover_type = -1
  fragment = 0
  mssfix = 1450
  explicit_exit_notification = 0
Connection profiles END
  remote_random = DISABLED
  ipchange = '[UNDEF]'
  dev = 'tun'
  dev_type = '[UNDEF]'
  dev_node = '[UNDEF]'
  lladdr = '[UNDEF]'
  topology = 1
  tun_ipv6 = DISABLED
  ifconfig_local = '[UNDEF]'
  ifconfig_remote_netmask = '[UNDEF]'
  ifconfig_noexec = DISABLED
  ifconfig_nowarn = DISABLED
  ifconfig_ipv6_local = '[UNDEF]'
  ifconfig_ipv6_netbits = 0
  ifconfig_ipv6_remote = '[UNDEF]'
  shaper = 0
  mtu_test = 0
  mlock = DISABLED
  keepalive_ping = 0
  keepalive_timeout = 0
  inactivity_timeout = 0
  ping_send_timeout = 0
  ping_rec_timeout = 0
  ping_rec_timeout_action = 0
  ping_timer_remote = DISABLED
  remap_sigusr1 = 0
  persist_tun = ENABLED
  persist_local_ip = DISABLED
  persist_remote_ip = DISABLED
  persist_key = ENABLED
  passtos = DISABLED
  resolve_retry_seconds = 1000000000
  username = 'nobody'
  groupname = 'nogroup'
  chroot_dir = '[UNDEF]'
  cd_dir = '/etc/openvpn'
  writepid = '/run/openvpn/openvpn.pid'
  up_script = '[UNDEF]'
  down_script = '[UNDEF]'
  down_pre = DISABLED
  up_restart = DISABLED
  up_delay = DISABLED
  daemon = ENABLED
  inetd = 0
  log = DISABLED
  suppress_timestamps = DISABLED
  nice = 0
  verbosity = 4
  mute = 0
  gremlin = 0
  status_file = '/run/openvpn/openvpn.status'
  status_file_version = 1
  status_file_update_freq = 10
  occ = ENABLED
  rcvbuf = 65536
  sndbuf = 65536
  mark = 0
  sockflags = 0
  fast_io = DISABLED
  lzo = 0
  route_script = '[UNDEF]'
  route_default_gateway = '[UNDEF]'
  route_default_metric = 0
  route_noexec = DISABLED
  route_delay = 0
  route_delay_window = 30
  route_delay_defined = DISABLED
  route_nopull = DISABLED
  route_gateway_via_dhcp = DISABLED
  max_routes = 100
  allow_pull_fqdn = DISABLED
  management_addr = '[UNDEF]'
  management_port = 0
  management_user_pass = '[UNDEF]'
  management_log_history_cache = 250
  management_echo_buffer_size = 100
  management_write_peer_info_file = '[UNDEF]'
  management_client_user = '[UNDEF]'
  management_client_group = '[UNDEF]'
  management_flags = 0
  shared_secret_file = '[UNDEF]'
  key_direction = 0
  ciphername_defined = ENABLED
  ciphername = 'AES-256-CBC'
  authname_defined = ENABLED
  authname = 'SHA1'
  prng_hash = 'SHA1'
  prng_nonce_secret_len = 16
  keysize = 0
  engine = DISABLED
  replay = ENABLED
  mute_replay_warnings = DISABLED
  replay_window = 64
  replay_time = 15
  packet_id_file = '[UNDEF]'
  use_iv = ENABLED
  test_crypto = DISABLED
  tls_server = DISABLED
  tls_client = ENABLED
  key_method = 2
  ca_file = '/etc/openvpn/keys/xx.crt'
  ca_path = '[UNDEF]'
  dh_file = '[UNDEF]'
  cert_file = '/etc/openvpn/keys/xx.crt'
  priv_key_file = '/etc/openvpn/keys/xx.key'
  pkcs12_file = '[UNDEF]'
  cipher_list = '[UNDEF]'
  tls_verify = '[UNDEF]'
  tls_export_cert = '[UNDEF]'
  verify_x509_type = 0
  verify_x509_name = '[UNDEF]'
  crl_file = '[UNDEF]'
  ns_cert_type = 0
  remote_cert_ku[i] = 160
  remote_cert_ku[i] = 136
  remote_cert_ku[i] = 0
message repeated 13 times: [   remote_cert_ku[i] = 
  remote_cert_eku = 'TLS Web Server Authentication'
  ssl_flags = 0
  tls_timeout = 2
  renegotiate_bytes = 0
  renegotiate_packets = 0
  renegotiate_seconds = 3600
  handshake_window = 60
  transition_window = 3600
  single_session = DISABLED
  push_peer_info = DISABLED
  tls_exit = DISABLED
  tls_auth_file = '[UNDEF]'
  pkcs11_protected_authentication = DISABLED
message repeated 15 times: [   
  pkcs11_private_mode = 00000000
message repeated 15 times: [   
  pkcs11_cert_private = DISABLED
message repeated 15 times: [   pkcs11_cert_private 
  pkcs11_pin_cache_period = -1
  pkcs11_id = '[UNDEF]'
  pkcs11_id_management = DISABLED
  server_network = 0.0.0.0
  server_netmask = 0.0.0.0
  server_network_ipv6 = ::
  server_netbits_ipv6 = 0
  server_bridge_ip = 0.0.0.0
  server_bridge_netmask = 0.0.0.0
  server_bridge_pool_start = 0.0.0.0
  server_bridge_pool_end = 0.0.0.0
  ifconfig_pool_defined = DISABLED
  ifconfig_pool_start = 0.0.0.0
  ifconfig_pool_end = 0.0.0.0
  ifconfig_pool_netmask = 0.0.0.0
  ifconfig_pool_persist_filename = '[UNDEF]'
  ifconfig_pool_persist_refresh_freq = 600
  ifconfig_ipv6_pool_defined = DISABLED
  ifconfig_ipv6_pool_base = ::
  ifconfig_ipv6_pool_netbits = 0
  n_bcast_buf = 256
  tcp_queue_limit = 64
  real_hash_size = 256
  virtual_hash_size = 256
  client_connect_script = '[UNDEF]'
  learn_address_script = '[UNDEF]'
  client_disconnect_script = '[UNDEF]'
  client_config_dir = '[UNDEF]'
  ccd_exclusive = DISABLED
  tmp_dir = '/tmp'
  push_ifconfig_defined = DISABLED
  push_ifconfig_local = 0.0.0.0
  push_ifconfig_remote_netmask = 0.0.0.0
  push_ifconfig_ipv6_defined = DISABLED
  push_ifconfig_ipv6_local = ::/0
  push_ifconfig_ipv6_remote = ::
  enable_c2c = DISABLED
  duplicate_cn = DISABLED
  cf_max = 0
  cf_per = 0
  max_clients = 1024
  max_routes_per_client = 256
  auth_user_pass_verify_script = '[UNDEF]'
  auth_user_pass_verify_script_via_file = DISABLED
  port_share_host = '[UNDEF]'
  port_share_port = 0
  client = ENABLED
  pull = ENABLED
  auth_user_pass_file = '[UNDEF]'
OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec  1 2014
WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1361)
Control Channel MTU parms [ L:1420 D:140 EF:40 EB:0 ET:0 EL:0 ]
Socket Buffers: R=[87380->131072] S=[16384->131072]
Data Channel MTU parms [ L:1420 D:1420 EF:59 EB:4 ET:0 EL:0 ]
Local Options String: 'V4,dev-type tun,link-mtu 1420,tun-mtu 1361,proto TCPv4_CLIENT,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Expected Remote Options String: 'V4,dev-type tun,link-mtu 1420,tun-mtu 1361,proto TCPv4_SERVER,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Local Options hash (VER=V4): '352398c0'
Expected Remote Options hash (VER=V4): '48918586'
NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Attempting to establish TCP connection with [AF_INET]IP:1195 [nonblock]
TCP: connect to [AF_INET]92.229.3.2:1195 failed, will try again in 5 seconds: Connection timed out
message repeated 3 times: [ TCP: connect to [AF_INET]IP:1195 failed, will try again in 5 seconds: Connection timed out]

i didnt add the client 1 conf or log because that one works but the sec one gets the failed will try again. i tried a lot but its not working and i dont know why. i cut some stuff from the logs if you miss anything i will be back later
Thanks

Traffic

Do you understand OpenVPN --server is a one(Server) to many(Clients) application ?
You do not need one server per client ..

Other than that .. have you checked your firewall logs ?

baldry

i didnt check the firewall logs yet because client 1 is connecting withought a problem and i didnt enter any firewall rules to that one too. after my first try with 1 server conf and 2 clients i had the problem that one client always tried too take the IP from another client so i always lost the connection to one client. maybe i didnt put enough effort into the 1server conf way. thanks for pointing that out. i cant work on that right now i will be back at my PC on monday and than i will first look for the log and afterwards read about 1 server conf - 2 clients again.

Sorry my english is not very good.

Traffic

baldry wrotei didnt check the firewall logs yet because client 1 is connecting withought a problem and i didnt enter any firewall rules to that one

Your second server is on a different port which you will need to allow on your firewall and possibly forward to your server.

baldry

After setting up 1 server 2 Clients both of them run withought a problem so i dont really understand why 2server/2clients didnt work it cant be a port problem because its working now with 1 server 2 clients. Thanks anyway!

baldry

After watching the logs it happend 1 time that i lost the connection with the reason
MULTI: new connection by client 'client1' will cause previous active sessions by this client to be dropped. Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.

MULTI: new connection by client 'client2' will cause previous active sessions by this client to be dropped. Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.

its running for 18 hours now and every hour he gets a new session key but this was the only time it didnt work. i am not using the same client cert for both clients i created with

./easyrsa gen-req client2 nopass
./easyrsa sign-req client client2

so it should have its own certs right? 17 times it worked and 1 time i lost the connection. why? sry for double post but i cant edit my post because i had to wait for the admin to check my post.

baldry

I dont know why but my Posts are not showing here. Every day at 09:07 the VPN looses Connection and reconnect again and i dont know why.

Client

[server1] 
Inactivity timeout (--ping-restart), restarting
Aug 19 09:07:35 server1 ovpn-openvpn[26733]: TCP/UDP: Closing socket
Aug 19 09:07:35 server1 ovpn-openvpn[26733]: SIGUSR1[soft,ping-restart] received, process restarting
Aug 19 09:07:35 server1 ovpn-openvpn[26733]: Restart pause, 5 second(s)
Aug 19 09:07:40 server1 ovpn-openvpn[26733]: Re-using SSL/TLS context
Aug 19 09:07:40 server1 ovpn-openvpn[26733]: WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1361)
Aug 19 09:07:40 server1 ovpn-openvpn[26733]: Control Channel MTU parms [ L:1420 D:140 EF:40 EB:0 ET:0 EL:0 ]
Aug 19 09:07:40 server1 ovpn-openvpn[26733]: Socket Buffers: R=[87380->131072] S=[16384->131072]
Aug 19 09:07:40 server1 ovpn-openvpn[26733]: Data Channel MTU parms [ L:1420 D:1420 EF:59 EB:4 ET:0 EL:0 ]
Aug 19 09:07:40 server1 ovpn-openvpn[26733]: Local Options String: 'V4,dev-type tun,link-mtu 1420,tun-mtu 1361,proto TCPv4_CLIENT,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Aug 19 09:07:40 server1 ovpn-openvpn[26733]: Expected Remote Options String: 'V4,dev-type tun,link-mtu 1420,tun-mtu 1361,proto TCPv4_SERVER,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Aug 19 09:07:40 server1 ovpn-openvpn[26733]: Local Options hash (VER=V4): '352398c0'
Aug 19 09:07:40 server1 ovpn-openvpn[26733]: Expected Remote Options hash (VER=V4): '48918586'
Aug 19 09:07:40 server1 ovpn-openvpn[26733]: Attempting to establish TCP connection with [AF_INET]IP:1194 [nonblock]
Aug 19 09:07:41 server1 ovpn-openvpn[26733]: TCP connection established with [AF_INET]IP:1194
Aug 19 09:07:41 server1 ovpn-openvpn[26733]: TCPv4_CLIENT link local: [undef]
Aug 19 09:07:41 server1 ovpn-openvpn[26733]: TCPv4_CLIENT link remote: [AF_INET]IP:1194
Aug 19 09:07:41 server1 ovpn-openvpn[26733]: TLS: Initial packet from [AF_INET]IP:1194, sid=22b5387c 2d2fd3fc
Aug 19 09:07:42 server1 ovpn-openvpn[26733]: VERIFY OK: depth=1, CN=server1
Aug 19 09:07:42 server1 ovpn-openvpn[26733]: Validating certificate key usage
Aug 19 09:07:42 server1 ovpn-openvpn[26733]: ++ Certificate has key usage  00a0, expects 00a0
Aug 19 09:07:42 server1 ovpn-openvpn[26733]: VERIFY KU OK
Aug 19 09:07:42 server1 ovpn-openvpn[26733]: Validating certificate extended key usage
Aug 19 09:07:42 server1 ovpn-openvpn[26733]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Aug 19 09:07:42 server1 ovpn-openvpn[26733]: VERIFY EKU OK
Aug 19 09:07:42 server1 ovpn-openvpn[26733]: VERIFY OK: depth=0, CN=server1
Aug 19 09:07:43 server1 ovpn-openvpn[26733]: Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Aug 19 09:07:43 server1 ovpn-openvpn[26733]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Aug 19 09:07:43 server1 ovpn-openvpn[26733]: Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Aug 19 09:07:43 server1 ovpn-openvpn[26733]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Aug 19 09:07:43 server1 ovpn-openvpn[26733]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Aug 19 09:07:43 server1 ovpn-openvpn[26733]: [server1] Peer Connection Initiated with [AF_INET]IP:1194
Aug 19 09:07:46 server1 ovpn-openvpn[26733]: SENT CONTROL [server1]: 'PUSH_REQUEST' (status=1)
Aug 19 09:07:46 server1 ovpn-openvpn[26733]: PUSH: Received control message: 'PUSH_REPLY,route 192.168.110.0 255.255.255.0,route 10.1.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.1.0.22 10.1.0.21'
Aug 19 09:07:46 server1 ovpn-openvpn[26733]: OPTIONS IMPORT: timers and/or timeouts modified
Aug 19 09:07:46 server1 ovpn-openvpn[26733]: OPTIONS IMPORT: --ifconfig/up options modified
Aug 19 09:07:46 server1 ovpn-openvpn[26733]: OPTIONS IMPORT: route options modified
Aug 19 09:07:46 server1 ovpn-openvpn[26733]: Preserving previous TUN/TAP instance: tun0
Aug 19 09:07:46 server1 ovpn-openvpn[26733]: Initialization Sequence Completed

Server

Aug 19 09:07:37 ovpn-openvpn[20441]: WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1361)
Aug 19 09:07:37 ovpn-openvpn[20441]: TCP connection established with [AF_INET]IP:48824
Aug 19 09:07:38 ovpn-openvpn[20441]: IP TLS: Initial packet from [AF_INET]IP:48824, sid=6e3b92fc bf2cc905
Aug 19 09:07:40 ovpn-openvpn[20441]: IP VERIFY OK: depth=1, CN=server1
Aug 19 09:07:40 ovpn-openvpn[20441]: IP VERIFY OK: depth=0, CN=client2
Aug 19 09:07:40 ovpn-openvpn[20441]: WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1361)
Aug 19 09:07:40 ovpn-openvpn[20441]: TCP connection established with [AF_INET]IP
Aug 19 09:07:40 ovpn-openvpn[20441]: IP Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Aug 19 09:07:40 ovpn-openvpn[20441]: IP Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Aug 19 09:07:40 ovpn-openvpn[20441]: IP Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Aug 19 09:07:40 ovpn-openvpn[20441]: IP Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Aug 19 09:07:40 ovpn-openvpn[20441]: IP Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Aug 19 09:07:40 ovpn-openvpn[20441]: IP [client2] Peer Connection Initiated with [AF_INET]IP
Aug 19 09:07:40 ovpn-openvpn[20441]: MULTI: new connection by client 'client2' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Aug 19 09:07:40 ovpn-openvpn[20441]: MULTI_sva: pool returned IPv4=10.1.0.18, IPv6=(Not enabled)
Aug 19 09:07:40 ovpn-openvpn[20441]: MULTI: Learn: 10.1.0.18 -> client2/IP
Aug 19 09:07:40 ovpn-openvpn[20441]: MULTI: primary virtual IP for client2/IP: 10.1.0.18
Aug 19 09:07:41 ovpn-openvpn[20441]: IP TLS: Initial packet from [AF_INET]IP, sid=8d98a3d5 6bd94719
Aug 19 09:07:42 ovpn-openvpn[20441]: IP VERIFY OK: depth=1, CN=server1
Aug 19 09:07:42 ovpn-openvpn[20441]: IPVERIFY OK: depth=0, CN=client1
Aug 19 09:07:43 ovpn-openvpn[20441]: client2/IP PUSH: Received control message: 'PUSH_REQUEST'
Aug 19 09:07:43 ovpn-openvpn[20441]: client2/IP send_push_reply(): safe_cap=940
Aug 19 09:07:43 ovpn-openvpn[20441]: client2/IP SENT CONTROL [client2]: 'PUSH_REPLY,route 192.168.110.0 255.255.255.0,route 10.1.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.1.0.18 10.1.0.17' (status=1)
Aug 19 09:07:43 ovpn-openvpn[20441]: IP Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Aug 19 09:07:43 ovpn-openvpn[20441]: IP Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Aug 19 09:07:43 ovpn-openvpn[20441]: IP Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Aug 19 09:07:43 ovpn-openvpn[20441]: IP Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Aug 19 09:07:43 ovpn-openvpn[20441]: IP Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Aug 19 09:07:43 ovpn-openvpn[20441]: IP [client1] Peer Connection Initiated with [AF_INET]IP
Aug 19 09:07:43 ovpn-openvpn[20441]: MULTI: new connection by client 'client1' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Aug 19 09:07:43 ovpn-openvpn[20441]: MULTI_sva: pool returned IPv4=10.1.0.22, IPv6=(Not enabled)
Aug 19 09:07:43 ovpn-openvpn[20441]: MULTI: Learn: 10.1.0.22 -> client1/IP
Aug 19 09:07:43 ovpn-openvpn[20441]: MULTI: primary virtual IP for client1/IP: 10.1.0.22
Aug 19 09:07:46 ovpn-openvpn[20441]: client1/IP PUSH: Received control message: 'PUSH_REQUEST'
Aug 19 09:07:46 ovpn-openvpn[20441]: client1/IP send_push_reply(): safe_cap=940
Aug 19 09:07:46 ovpn-openvpn[20441]: client1/IP SENT CONTROL [client1]: 'PUSH_REPLY,route 192.168.110.0 255.255.255.0,route 10.1.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.1.0.22 10.1.0.21' (status=1)

i dont use duplicate keys i created 1 client 1 key pair and 1 client 2 key pair

Traffic

baldry wroteEvery day at 09:07 the VPN looses Connection and reconnect again

Perhaps your client IP is refreshed by your Internet Service Provider ..

baldry

oh jeah thats right. Thank you for your time and help. everything is working now!