Multiple instance - back route missing?

Crashdemon

Hello folks,

i've configured openvpn to run with one instance on port 443 @ tcp and one instance on port 1194 @ udp as described here:
http://thomas.gouverneur.name/2014/02/openvpn-listen-on-tcp-and-udp-with-tun/

The tcp openvpn instance runs very well and is only used when connecting from hotels which block other ports then web....

But the udp openvpn instance makes some problems. I can connect pretty well to the udp instance, but i'm getting no response from the other side
of the tunnel (route to lan behind openvpn server). Ping and tracert fails.

My udp server config:

port 1194 # Port running OpenVPN @ UDP
local 192.168.0.1
proto udp # UDP is most common
dev tun1 # No Bridge setup
tun-ipv6 # IPv6 support
opt-verify # Check client config
ca keys/XXX/ca.crt
cert keys/XXX/server.crt
key keys/XXX/server.key
dh keys/XXX/dh1024.pem
server 172.16.0.0 255.255.255.0 # IP Pool for OpenVPN
crl-verify keys/XXX/crl.pem
user root
group root
status servers/gate/logs/openvpn-status-udp.log
log-append servers/gate/logs/openvpn_udp.log
verb 6 # Log Level
mute 20
max-clients 10 # Limit the amount of clients
tls-auth keys/XXX/ta.key 0
link-mtu 1400 # MTU of the link
keepalive 10 120 # Ping every 10 sec, restart tunnel after 120 sec no reply
client-config-dir /etc/openvpn/servers/gate/ccd # Client specified parameters
comp-lzo # Compression
persist-key # Do not load new key after SIGUSR1
persist-tun
persist-remote-ip
mssfix
client-to-client
cipher AES-256-CBC # Cipher used by OpenVPN
push "redirect-gateway def1 bypass-dhcp"
push "ip-win32 dynamic 0 3600"
push "explicit-exit-notify 3"
push "dhcp-option NTP 192.53.103.108"
push "dhcp-option DNS 172.16.0.1" # primary dns
push "dhcp-option DNS 213.73.91.35" # secondary dns
push "dhcp-option WINS 172.16.0.1"
push "route 129.217.64.0 255.255.192.0"
push "route 192.168.172.0 255.255.255.0"
learn-address /etc/openvpn/clients/learn-address.sh

My tcp server config:

local 192.168.0.1
port 443
proto tcp
port-share 127.0.0.1 443
dev tun0 # No Bridge setup
tun-ipv6 # IPv6 support
opt-verify # Check client config
ca keys/XXX/ca.crt
cert keys/XXX/server.crt
key keys/XXX/server.key
dh keys/XXX/dh1024.pem
server 172.16.0.0 255.255.255.0 # IP Pool for OpenVPN
crl-verify keys/XXX/crl.pem
user root
group root
status servers/gate/logs/openvpn-status-tcp.log
log-append servers/gate/logs/openvpn_tcp.log
verb 3 # Log Level
mute 20
max-clients 10 # Limit the amount of clients
tls-auth keys/XXX/ta.key 0
link-mtu 1400 # MTU of the link
keepalive 10 120 # Ping every 10 sec, restart tunnel after 120 sec no reply
client-config-dir /etc/openvpn/servers/gate/ccd # Client specified parameters
comp-lzo # Compression
persist-key # Do not load new key after SIGUSR1
persist-tun
persist-remote-ip
mssfix
client-to-client
cipher AES-256-CBC # Cipher used by OpenVPN
push "redirect-gateway def1 bypass-dhcp"
push "ip-win32 dynamic 0 3600"
push "explicit-exit-notify 3"
push "dhcp-option NTP 192.53.103.108"
push "dhcp-option DNS 172.16.0.1" # primary dns
push "dhcp-option DNS 213.73.91.35" # secondary dns
push "dhcp-option WINS 172.16.0.1"
push "route 192.168.178.0 255.255.255.0"
learn-address /etc/openvpn/clients/learn-address.sh

routing table on the server:

[root@XXX openvpn]# route -v -n
Kernel IP Routentabelle
Ziel                Router          Genmask            Flags  Metric Ref    Use Iface
172.16.0.2      0.0.0.0          255.255.255.255 UH     0      0        0 tun0
172.16.0.2      0.0.0.0          255.255.255.255 UH     0      0        0 tun1
172.16.0.0      172.16.0.2     255.255.255.0    UG     0      0        0 tun0
192.168.0.0     0.0.0.0         255.255.255.0    U       0      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0       U       1002   0        0 eth0
0.0.0.0           192.168.0.2   0.0.0.0              UG     0      0        0 eth0

So from my point of view there is a back route for interface tun1 (udp) missing!?

Traffic

Please post your server and client log files.

Also,

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

Crashdemon

Traffic wrotePlease post your server and client log files.

Here is the server log:

Wed Sep  2 18:49:29 2015 us=647055 MULTI: multi_create_instance called
Wed Sep  2 18:49:29 2015 us=647192 XXX.XXX.XXX.XXX:1194 Re-using SSL/TLS context
Wed Sep  2 18:49:29 2015 us=647248 XXX.XXX.XXX.XXX:1194 LZO compression initialized
Wed Sep  2 18:49:29 2015 us=647286 XXX.XXX.XXX.XXX:1194 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1342)
Wed Sep  2 18:49:29 2015 us=647500 XXX.XXX.XXX.XXX:1194 Control Channel MTU parms [ L:1400 D:166 EF:66 EB:0 ET:0 EL:0 ]
Wed Sep  2 18:49:29 2015 us=647549 XXX.XXX.XXX.XXX:1194 Data Channel MTU parms [ L:1400 D:1400 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Sep  2 18:49:29 2015 us=647842 XXX.XXX.XXX.XXX:1194 Local Options String: 'V4,dev-type tun,link-mtu 1400,tun-mtu 1342,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls

-auth,key-method 2,tls-server'
Wed Sep  2 18:49:29 2015 us=647881 XXX.XXX.XXX.XXX:1194 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1400,tun-mtu 1342,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth 

SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Wed Sep  2 18:49:29 2015 us=669355 XXX.XXX.XXX.XXX:1194 Local Options hash (VER=V4): '0af20bac'
Wed Sep  2 18:49:29 2015 us=669421 XXX.XXX.XXX.XXX:1194 Expected Remote Options hash (VER=V4): '152ae5e8'
Wed Sep  2 18:49:29 2015 us=669528 XXX.XXX.XXX.XXX:1194 UDPv4 READ [42] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #1 ] [ ] pid=0 DATA len=0
Wed Sep  2 18:49:29 2015 us=681247 XXX.XXX.XXX.XXX:1194 TLS: Initial packet from [AF_INET]XXX.XXX.XXX.XXX:1194, sid=b114a96f 447d386d
Wed Sep  2 18:49:29 2015 us=681348 XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [54] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 pid=[ #1 ] [ 0 ] pid=0 DATA len=0
Wed Sep  2 18:49:29 2015 us=768038 XXX.XXX.XXX.XXX:1194 UDPv4 READ [50] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #2 ] [ 0 ]
Wed Sep  2 18:49:29 2015 us=779874 XXX.XXX.XXX.XXX:1194 UDPv4 READ [142] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #3 ] [ ] pid=1 DATA len=100
Wed Sep  2 18:49:29 2015 us=780017 XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [50] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #2 ] [ 1 ]
Wed Sep  2 18:49:29 2015 us=782798 XXX.XXX.XXX.XXX:1194 UDPv4 READ [142] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #4 ] [ ] pid=2 DATA len=100
Wed Sep  2 18:49:29 2015 us=782906 XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [50] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #3 ] [ 2 ]
Wed Sep  2 18:49:29 2015 us=785541 XXX.XXX.XXX.XXX:1194 UDPv4 READ [52] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #5 ] [ ] pid=3 DATA len=10
Wed Sep  2 18:49:29 2015 us=840664 XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [154] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #4 ] [ 3 ] pid=1 DATA len=100
Wed Sep  2 18:49:29 2015 us=840768 XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [142] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #5 ] [ ] pid=2 DATA len=100
Wed Sep  2 18:49:29 2015 us=840830 XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [142] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #6 ] [ ] pid=3 DATA len=100
Wed Sep  2 18:49:29 2015 us=840885 XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [142] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #7 ] [ ] pid=4 DATA len=100
Wed Sep  2 18:49:29 2015 us=921674 XXX.XXX.XXX.XXX:1194 UDPv4 READ [50] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #6 ] [ 1 ]
Wed Sep  2 18:49:29 2015 us=921804 XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [142] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #8 ] [ ] pid=5 DATA len=100
Wed Sep  2 18:49:29 2015 us=943931 XXX.XXX.XXX.XXX:1194 UDPv4 READ [50] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #7 ] [ 2 ]
Wed Sep  2 18:49:29 2015 us=944037 XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [142] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #9 ] [ ] pid=6 DATA len=100
Wed Sep  2 18:49:29 2015 us=967145 XXX.XXX.XXX.XXX:1194 UDPv4 READ [50] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #8 ] [ 3 ]
Wed Sep  2 18:49:29 2015 us=967297 XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [142] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #10 ] [ ] pid=7 DATA len=100
Wed Sep  2 18:49:29 2015 us=985588 XXX.XXX.XXX.XXX:1194 UDPv4 READ [50] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #9 ] [ 4 ]
Wed Sep  2 18:49:29 2015 us=985691 XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [142] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #11 ] [ ] pid=8 DATA len=100
Wed Sep  2 18:49:29 2015 us=998317 XXX.XXX.XXX.XXX:1194 UDPv4 READ [50] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #10 ] [ 5 ]
Wed Sep  2 18:49:29 2015 us=998407 XXX.XXX.XXX.XXX:1194 NOTE: --mute triggered...
Wed Sep  2 18:49:31 2015 us=113086 XXX.XXX.XXX.XXX:1194 83 variation(s) on previous 20 message(s) suppressed by --mute
Wed Sep  2 18:49:31 2015 us=113152 XXX.XXX.XXX.XXX:1194 CRL: CRL keys/XXX/crl.pem is from a different issuer than the issuer of certificate C=XX, ST=XXX, L=XX, O=XXX, OU=XXX, CN=XXX, name=changeme, 

emailAddress=XXX@XXX.org
Wed Sep  2 18:49:31 2015 us=113228 XXX.XXX.XXX.XXX:1194 VERIFY OK: depth=1, C=XX, ST=XXX, L=XX, O=XXX, OU=DCC VPN, CN=OpenVPN-CA, name=changeme, emailAddress=XXX@XXX.org
Wed Sep  2 18:49:31 2015 us=113841 XXX.XXX.XXX.XXX:1194 CRL: CRL keys/XXX/crl.pem is from a different issuer than the issuer of certificate C=XX, ST=XXX, L=XX, O=XXX, OU=changeme, CN=red-box, 

name=changeme, emailAddress=XXX@defcon-cc.dyndns.org
Wed Sep  2 18:49:31 2015 us=113915 XXX.XXX.XXX.XXX:1194 VERIFY OK: depth=0, C=XX, ST=XXX, L=XX, O=XXX, OU=changeme, CN=red-box, name=changeme, emailAddress=XXX@XXX.org
Wed Sep  2 18:49:31 2015 us=114023 XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [50] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #52 ] [ 24 ]
Wed Sep  2 18:49:31 2015 us=114139 XXX.XXX.XXX.XXX:1194 UDPv4 READ [142] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #54 ] [ ] pid=25 DATA len=100
Wed Sep  2 18:49:31 2015 us=114241 XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [50] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #53 ] [ 25 ]
Wed Sep  2 18:49:31 2015 us=190978 XXX.XXX.XXX.XXX:1194 UDPv4 READ [142] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #55 ] [ ] pid=26 DATA len=100
Wed Sep  2 18:49:31 2015 us=200167 XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [50] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #54 ] [ 26 ]
Wed Sep  2 18:49:31 2015 us=200289 XXX.XXX.XXX.XXX:1194 UDPv4 READ [142] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #56 ] [ ] pid=27 DATA len=100
Wed Sep  2 18:49:31 2015 us=200960 XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [50] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #55 ] [ 27 ]
Wed Sep  2 18:49:31 2015 us=201069 XXX.XXX.XXX.XXX:1194 UDPv4 READ [51] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #57 ] [ ] pid=28 DATA len=9
Wed Sep  2 18:49:31 2015 us=201383 XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [113] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #56 ] [ 28 ] pid=29 DATA len=59
Wed Sep  2 18:49:31 2015 us=309698 XXX.XXX.XXX.XXX:1194 UDPv4 READ [154] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #58 ] [ 29 ] pid=29 DATA len=100
Wed Sep  2 18:49:31 2015 us=309848 XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [50] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #57 ] [ 29 ]
Wed Sep  2 18:49:31 2015 us=312417 XXX.XXX.XXX.XXX:1194 UDPv4 READ [142] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #59 ] [ ] pid=30 DATA len=100
Wed Sep  2 18:49:31 2015 us=312545 XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [50] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #58 ] [ 30 ]
Wed Sep  2 18:49:31 2015 us=315616 XXX.XXX.XXX.XXX:1194 UDPv4 READ [142] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #60 ] [ ] pid=31 DATA len=100
Wed Sep  2 18:49:31 2015 us=315708 XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [50] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #59 ] [ 31 ]
Wed Sep  2 18:49:31 2015 us=317496 XXX.XXX.XXX.XXX:1194 UDPv4 READ [88] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #61 ] [ ] pid=32 DATA len=46
Wed Sep  2 18:49:31 2015 us=332544 XXX.XXX.XXX.XXX:1194 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Sep  2 18:49:31 2015 us=332605 XXX.XXX.XXX.XXX:1194 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep  2 18:49:31 2015 us=332646 XXX.XXX.XXX.XXX:1194 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Sep  2 18:49:31 2015 us=332684 XXX.XXX.XXX.XXX:1194 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep  2 18:49:31 2015 us=332792 XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [154] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #60 ] [ 32 ] pid=30 DATA len=100
Wed Sep  2 18:49:31 2015 us=332897 XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [142] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #61 ] [ ] pid=31 DATA len=100
Wed Sep  2 18:49:31 2015 us=332993 XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [140] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #62 ] [ ] pid=32 DATA len=98
Wed Sep  2 18:49:31 2015 us=392730 XXX.XXX.XXX.XXX:1194 UDPv4 READ [50] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #62 ] [ 30 ]
Wed Sep  2 18:49:31 2015 us=395508 XXX.XXX.XXX.XXX:1194 UDPv4 READ [50] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #63 ] [ 31 ]
Wed Sep  2 18:49:31 2015 us=398435 XXX.XXX.XXX.XXX:1194 UDPv4 READ [50] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #64 ] [ 32 ]
Wed Sep  2 18:49:31 2015 us=398528 XXX.XXX.XXX.XXX:1194 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Sep  2 18:49:31 2015 us=398588 XXX.XXX.XXX.XXX:1194 [red-box] Peer Connection Initiated with [AF_INET]XXX.XXX.XXX.XXX:1194
Wed Sep  2 18:49:31 2015 us=421953 red-box/XXX.XXX.XXX.XXX:1194 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/servers/gate/ccd/red-box
sudo: sorry, you must have a tty to run sudo
sudo: sorry, you must have a tty to run sudo
Wed Sep  2 18:49:31 2015 us=631765 red-box/XXX.XXX.XXX.XXX:1194 MULTI: Learn: 172.16.0.10 -> red-box/XXX.XXX.XXX.XXX:1194
Wed Sep  2 18:49:31 2015 us=631804 red-box/XXX.XXX.XXX.XXX:1194 MULTI: primary virtual IP for red-box/XXX.XXX.XXX.XXX:1194: 172.16.0.10
Wed Sep  2 18:49:31 2015 us=631826 red-box/XXX.XXX.XXX.XXX:1194 MULTI: internal route 172.16.0.10 -> red-box/XXX.XXX.XXX.XXX:1194
Wed Sep  2 18:49:33 2015 us=898703 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 READ [132] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #65 ] [ ] pid=33 DATA len=90
Wed Sep  2 18:49:33 2015 us=898911 red-box/XXX.XXX.XXX.XXX:1194 PUSH: Received control message: 'PUSH_REQUEST'
Wed Sep  2 18:49:33 2015 us=898956 red-box/XXX.XXX.XXX.XXX:1194 send_push_reply(): safe_cap=940
Wed Sep  2 18:49:33 2015 us=899060 red-box/XXX.XXX.XXX.XXX:1194 SENT CONTROL [red-box]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,ip-win32 dynamic 0 3600,explicit-exit-notify 3,dhcp-option NTP 

192.53.103.108,dhcp-option DNS 172.16.0.1,dhcp-option DNS 213.73.91.35,dhcp-option WINS 172.16.0.1,route 129.217.64.0 255.255.192.0,route 192.168.172.0 255.255.255.0,route 172.16.0.0 

255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 172.16.0.10 172.16.0.9' (status=1)
Wed Sep  2 18:49:33 2015 us=899136 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [50] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #63 ] [ 33 ]
Wed Sep  2 18:49:33 2015 us=899240 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [142] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #64 ] [ ] pid=33 DATA len=100
Wed Sep  2 18:49:33 2015 us=899329 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [142] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #65 ] [ ] pid=34 DATA len=100
Wed Sep  2 18:49:33 2015 us=899416 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [142] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #66 ] [ ] pid=35 DATA len=100
Wed Sep  2 18:49:33 2015 us=899534 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [142] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #67 ] [ ] pid=36 DATA len=100
Wed Sep  2 18:49:34 2015 us=73147 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 READ [50] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #66 ] [ 33 ]
Wed Sep  2 18:49:34 2015 us=73263 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [84] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_CONTROL_V1 kid=0 pid=[ #68 ] [ ] pid=37 DATA len=42
Wed Sep  2 18:49:34 2015 us=74295 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 READ [50] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #67 ] [ 34 ]
Wed Sep  2 18:49:34 2015 us=75879 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 READ [50] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #68 ] [ 35 ]
Wed Sep  2 18:49:34 2015 us=77494 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 READ [50] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #69 ] [ 36 ]
Wed Sep  2 18:49:34 2015 us=272746 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 READ [50] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_ACK_V1 kid=0 pid=[ #70 ] [ 37 ]
Wed Sep  2 18:49:34 2015 us=683024 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 READ [117] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_DATA_V1 kid=0 DATA len=116
Wed Sep  2 18:49:34 2015 us=685485 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 READ [101] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_DATA_V1 kid=0 DATA len=100
Wed Sep  2 18:49:34 2015 us=688220 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 READ [117] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_DATA_V1 kid=0 DATA len=116
Wed Sep  2 18:49:34 2015 us=688304 red-box/XXX.XXX.XXX.XXX:1194 MULTI: bad source address from client [::], packet dropped
Wed Sep  2 18:49:35 2015 us=122401 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 READ [117] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_DATA_V1 kid=0 DATA len=116
Wed Sep  2 18:49:38 2015 us=645988 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 READ [101] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_DATA_V1 kid=0 DATA len=100
Wed Sep  2 18:49:39 2015 us=185259 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 READ [149] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_DATA_V1 kid=0 DATA len=148
Wed Sep  2 18:49:39 2015 us=185371 red-box/XXX.XXX.XXX.XXX:1194 TUN WRITE [96]
Wed Sep  2 18:49:40 2015 us=128863 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 READ [117] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_DATA_V1 kid=0 DATA len=116
Wed Sep  2 18:49:40 2015 us=128962 red-box/XXX.XXX.XXX.XXX:1194 TUN WRITE [62]
Wed Sep  2 18:49:40 2015 us=684325 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 READ [149] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_DATA_V1 kid=0 DATA len=148
Wed Sep  2 18:49:40 2015 us=684426 red-box/XXX.XXX.XXX.XXX:1194 TUN WRITE [96]
Wed Sep  2 18:49:41 2015 us=128565 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 READ [117] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_DATA_V1 kid=0 DATA len=116
Wed Sep  2 18:49:41 2015 us=128665 red-box/XXX.XXX.XXX.XXX:1194 TUN WRITE [62]
Wed Sep  2 18:49:42 2015 us=186225 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 READ [149] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_DATA_V1 kid=0 DATA len=148
Wed Sep  2 18:49:42 2015 us=186333 red-box/XXX.XXX.XXX.XXX:1194 TUN WRITE [96]
Wed Sep  2 18:49:42 2015 us=622887 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 READ [101] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_DATA_V1 kid=0 DATA len=100
Wed Sep  2 18:49:43 2015 us=134481 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 READ [117] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_DATA_V1 kid=0 DATA len=116
Wed Sep  2 18:49:43 2015 us=134576 red-box/XXX.XXX.XXX.XXX:1194 TUN WRITE [62]
Wed Sep  2 18:49:44 2015 us=174761 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 WRITE [69] to [AF_INET]XXX.XXX.XXX.XXX:1194: P_DATA_V1 kid=0 DATA len=68
Wed Sep  2 18:49:45 2015 us=189323 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 READ [101] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_DATA_V1 kid=0 DATA len=100
Wed Sep  2 18:49:45 2015 us=189421 red-box/XXX.XXX.XXX.XXX:1194 TUN WRITE [53]
Wed Sep  2 18:49:46 2015 us=190544 red-box/XXX.XXX.XXX.XXX:1194 UDPv4 READ [101] from [AF_INET]XXX.XXX.XXX.XXX:1194: P_DATA_V1 kid=0 DATA len=100
Wed Sep  2 18:49:46 2015 us=190647 red-box/XXX.XXX.XXX.XXX:1194 TUN WRITE [53]
Wed Sep  2 18:49:47 2015 us=189514 red-box/XXX.XXX.XXX.XXX:1194 NOTE: --mute triggered...

A little big because of the high log level. XXX.XXX.XXX.XXX is the inet ip.

The client log:

Try to start OpenVPN connection red-box-udp 
Wed Sep 02 18:49:27 2015 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Wed Sep 02 18:49:27 2015 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Wed Sep 02 18:49:27 2015 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Sep 02 18:49:27 2015 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Sep 02 18:49:27 2015 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Wed Sep 02 18:49:27 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 02 18:49:27 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 02 18:49:27 2015 LZO compression initialized
Wed Sep 02 18:49:27 2015 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1342)
Wed Sep 02 18:49:27 2015 Control Channel MTU parms [ L:1400 D:166 EF:66 EB:0 ET:0 EL:0 ]
Wed Sep 02 18:49:27 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Sep 02 18:49:28 2015 Data Channel MTU parms [ L:1400 D:1400 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Sep 02 18:49:28 2015 Local Options hash (VER=V4): '152ae5e8'
Wed Sep 02 18:49:28 2015 Expected Remote Options hash (VER=V4): '0af20bac'
Wed Sep 02 18:49:28 2015 UDPv4 link local (bound): [undef]:1194
Wed Sep 02 18:49:28 2015 UDPv4 link remote: XXX.XXX.XXX.XXX:1194
Wed Sep 02 18:49:28 2015 TLS: Initial packet from XXX.XXX.XXX.XXX:1194, sid=b429ef95 af464471
Wed Sep 02 18:49:29 2015 VERIFY OK: depth=1, /C=XX/ST=XXX/L=XX/O=XXX/OU=XXX/CN=OpenVPN-CA/name=changeme/emailAddress=XXX@XXX.org
Wed Sep 02 18:49:29 2015 VERIFY OK: depth=0, /C=XX/ST=XXX/L=XX/O=XXX/OU=changeme/CN=server/name=changeme/emailAddress=XXX@XXX.org
Wed Sep 02 18:49:29 2015 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Sep 02 18:49:29 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 02 18:49:29 2015 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Sep 02 18:49:29 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 02 18:49:29 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Sep 02 18:49:29 2015 [server] Peer Connection Initiated with XXX.XXX.XXX.XXX:1194
Wed Sep 02 18:49:32 2015 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Sep 02 18:49:32 2015 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,ip-win32 dynamic 0 3600,explicit-exit-notify 3,dhcp-option NTP 192.53.103.108,dhcp-option DNS 172.16.0.1,dhcp-option DNS 213.73.91.35,dhcp-option WINS 172.16.0.1,route 129.217.64.0 255.255.192.0,route 192.168.172.0 255.255.255.0,route 172.16.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 172.16.0.10 172.16.0.9'
Wed Sep 02 18:49:32 2015 OPTIONS IMPORT: timers and/or timeouts modified
Wed Sep 02 18:49:32 2015 OPTIONS IMPORT: explicit notify parm(s) modified
Wed Sep 02 18:49:32 2015 OPTIONS IMPORT: --ifconfig/up options modified
Wed Sep 02 18:49:32 2015 OPTIONS IMPORT: route options modified
Wed Sep 02 18:49:32 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Sep 02 18:49:32 2015 ROUTE default_gateway=192.168.178.1
Wed Sep 02 18:49:32 2015 TAP-WIN32 device [OPENVPN] opened: \\.\Global\{02A14CC6-59C7-4333-B726-5AFC32F84F89}.tap
Wed Sep 02 18:49:32 2015 TAP-Win32 Driver Version 9.9 
Wed Sep 02 18:49:32 2015 TAP-Win32 MTU=1500
Wed Sep 02 18:49:32 2015 WARNING: because you are using '--dev tun' mode, the '--ip-win32 dynamic [offset]' option is ignoring the offset parameter
Wed Sep 02 18:49:32 2015 Notified TAP-Win32 driver to set a DHCP IP/netmask of 172.16.0.10/255.255.255.252 on interface {02A14CC6-59C7-4333-B726-5AFC32F84F89} [DHCP-serv: 172.16.0.9, lease-time: 3600]
Wed Sep 02 18:49:32 2015 Successful ARP Flush on interface [4] {02A14CC6-59C7-4333-B726-5AFC32F84F89}
Wed Sep 02 18:49:37 2015 TEST ROUTES: 4/4 succeeded len=3 ret=1 a=0 u/d=up
Wed Sep 02 18:49:37 2015 C:\WINDOWS\system32\route.exe ADD XXX.XXX.XXX.XXX MASK 255.255.255.255 192.168.178.1
Wed Sep 02 18:49:37 2015 Route addition via IPAPI succeeded [adaptive]
Wed Sep 02 18:49:37 2015 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 172.16.0.9
Wed Sep 02 18:49:37 2015 Route addition via IPAPI succeeded [adaptive]
Wed Sep 02 18:49:37 2015 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 172.16.0.9
Wed Sep 02 18:49:37 2015 Route addition via IPAPI succeeded [adaptive]
Wed Sep 02 18:49:37 2015 C:\WINDOWS\system32\route.exe ADD 129.217.64.0 MASK 255.255.192.0 172.16.0.9
Wed Sep 02 18:49:37 2015 Route addition via IPAPI succeeded [adaptive]
Wed Sep 02 18:49:37 2015 C:\WINDOWS\system32\route.exe ADD 192.168.172.0 MASK 255.255.255.0 172.16.0.9
Wed Sep 02 18:49:37 2015 Route addition via IPAPI succeeded [adaptive]
Wed Sep 02 18:49:37 2015 C:\WINDOWS\system32\route.exe ADD 172.16.0.0 MASK 255.255.255.0 172.16.0.9
Wed Sep 02 18:49:37 2015 Route addition via IPAPI succeeded [adaptive]
Wed Sep 02 18:49:37 2015 Initialization Sequence Completed
Wed Sep 02 18:49:32 2015 ROUTE default_gateway=192.168.178.1
Wed Sep 02 18:49:32 2015 TAP-WIN32 device [OPENVPN] opened: \\.\Global\{02A14CC6-59C7-4333-B726-5AFC32F84F89}.tap
Wed Sep 02 18:49:32 2015 TAP-Win32 Driver Version 9.9 
Wed Sep 02 18:49:32 2015 TAP-Win32 MTU=1500
Wed Sep 02 18:49:32 2015 WARNING: because you are using '--dev tun' mode, the '--ip-win32 dynamic [offset]' option is ignoring the offset parameter
Wed Sep 02 18:49:32 2015 Notified TAP-Win32 driver to set a DHCP IP/netmask of 172.16.0.10/255.255.255.252 on interface {02A14CC6-59C7-4333-B726-5AFC32F84F89} [DHCP-serv: 172.16.0.9, lease-time: 3600]
Wed Sep 02 18:49:32 2015 Successful ARP Flush on interface [4] {02A14CC6-59C7-4333-B726-5AFC32F84F89}

Traffic wrote Also,
NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

Jep, I know.

Traffic

Crashdemon wroteTraffic wrote:
Also,

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or <..>

Jep, I know.

OK then ..

Crashdemon wrotei've configured openvpn to run with one instance on port 443 @ tcp and one instance on port 1194 @ udp

Crashdemon wroteMy tcp server config:

Code:
local 192.168.0.1
port 443
proto tcp
port-share 127.0.0.1 443
dev tun0 # No Bridge setup
server 172.16.0.0 255.255.255.0 # IP Pool for OpenVPN
log-append servers/gate/logs/openvpn_tcp.log
verb 3 # Log Level
mute 20
push "route 192.168.178.0 255.255.255.0"

Crashdemon wroteMy udp server config:

Code:
port 1194 # Port running OpenVPN @ UDP
local 192.168.0.1
proto udp # UDP is most common
dev tun1 # No Bridge setup
server 172.16.0.0 255.255.255.0 # IP Pool for OpenVPN
verb 6 # Log Level
mute 20
push "route 129.217.64.0 255.255.192.0"
push "route 192.168.172.0 255.255.255.0"

--server networks overlap .. they must be unique.

Crashdemon wroterouting table on the server:

Code:
[root@XXX openvpn]# route -v -n
Kernel IP Routentabelle
Ziel Router Genmask Flags Metric Ref Use Iface
172.16.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
172.16.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun1
172.16.0.0 172.16.0.2 255.255.255.0 UG 0 0 0 tun0
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 1002 0 0 eth0
0.0.0.0 192.168.0.2 0.0.0.0 UG 0 0 0 eth0

So from my point of view there is a back route for interface tun1 (udp) missing!?

Your server does not have a route for 192.168.172.0 ..

Crashdemon

Ok, there is a misspelling failure on server and client config. It should be

push "route 192.168.178.0 255.255.255.0"

on booth. Do i have to set a static route for the network 192.168.178.0/24?
192.168.178.0/24 is the network behind a client. I'm using a ccd file to push the route
on client side. I thought openvpn manages this for me.

--server overlaps is correct. I'm trying to use one instance @ udp and one instance @ tcp sharing
the same network and ip adress pool, as described here:

http://thomas.gouverneur.name/2014/02/openvpn-listen-on-tcp-and-udp-with-tun/

Curious is that the instance @ tcp is running withou any problem (ping, tracert, route..).

Crashdemon

Ok I ask different. What is the common procedure to run openvpn on udp and tcp with the same ip pool?

Traffic

There is no such common procedure ...

The normal method would use unique subnets for each VPN which works perfectly when setup correctly.

I have tested your link and it does appear to work, however, I would not use it as it introduces a level of complexity which I am not comfortable with.

Crashdemon

Ok, I will try it with different subnets.

Crashdemon

Ok I've tested it with different subnets.... and it's working. So the problem was the missing route for tun1.

Kernel IP Routentabelle
Ziel            Router          Genmask         Flags Metric Ref    Use Iface
172.16.0.2      0.0.0.0         255.255.255.255 UH    0      0        0 tun0
172.16.1.2      0.0.0.0         255.255.255.255 UH    0      0        0 tun1
172.16.0.0      172.16.0.2      255.255.255.0   UG    0      0        0 tun0
172.16.1.0      172.16.1.2      255.255.255.0   UG    0      0        0 tun1
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     1002   0        0 eth0
0.0.0.0         192.168.0.2     0.0.0.0         UG    0      0        0 eth0