write UDPv4: Network is unreachable (code=101)

kovica

Client is OpenVPN 2.3.2 on Linux (32-bit Xubutnu 14.04.3 with kernel 3.16.0-50-generic).
Server is OpenVPN 2.2.1 on Linux (64-bit Ubuntu server 12.04.4 with kernel 3.2.0-88-generic).

The problem I experience is that client sometimes gets "write UDPv4: Network is unreachable (code=101)".
I've been running OpenVPN 2.3.3 (with the same configuration as on Linux) on Windows 7 64-bit and do not get any error of that kind.
I've been running it on a different machine, but the physical line (network cable) is the same.

How can I diagnose the problem that I have on Linux?

Traffic

kovica wroteI've been running it on a different machine, but the physical line (network cable) is the same

eth0 problem :geek:

kovica

Yeah, I've thought of that too.
So I tested the eth0 and transferred about 100 GB of data without a problem. I've done it without VPN and with VPN.
Is there another way of testing it?

Traffic

You could try the Forum rules (top of page)

kovica

client.conf:
client
proto udp
remote VPN_SERVER_IP
port 1194
comp-lzo
dev tun
nobind
verb 4
ca CA.crt
cert CLIENT.crt
key CLIENT.key
remote-cert-tls server

server.conf:
proto udp
port 1194
dev tun0
comp-lzo
server 172.200.1.0 255.255.255.0
route 172.200.4.0 255.255.255.0
push route "172.20.11.0 255.255.255.0"
ca CA.crt
cert SERVER.crt
key SERVER.key
dh dh2048.pem
persist-key
persist-tun
persist-local-ip
persist-remote-ip
push "persist-key"
push "persist-tun"
keepalive 10 60
user vpn
group vpn
daemon
log-append /var/log/openvpn.log
status /var/log/openvpn-status.log
verb 3
management localhost 7505
client-config-dir ccd
ccd-exclusive

CLIENT.ccd:
ifconfig-push 172.200.4.109 172.200.4.110
push "route 172.200.0.0 255.255.0.0"

client.log:
Sep 18 00:12:40 ubuntu ovpn-CLIENT[921]: write UDPv4: Network is unreachable (code=101)
Sep 18 00:12:56 ubuntu ovpn-CLIENT[921]: message repeated 6 times: [ write UDPv4: Network is unreachable (code=101)]
Sep 18 00:12:58 ubuntu ovpn-CLIENT[921]: TLS: tls_process: killed expiring key
Sep 18 00:13:00 ubuntu ovpn-CLIENT[921]: TLS: soft reset sec=-1 bytes=515790/0 pkts=3366/0
Sep 18 00:13:01 ubuntu ovpn-CLIENT[921]: VERIFY OK: depth=1, C=SI, ST=Slovenia, L=Celje, O=BiLumina, OU=, CN=BiLumina_CA, name=BiLumina_CA, emailAddress=info@example.com
Sep 18 00:13:01 ubuntu ovpn-CLIENT[921]: Validating certificate key usage
Sep 18 00:13:01 ubuntu ovpn-CLIENT[921]: ++ Certificate has key usage 00a0, expects 00a0
Sep 18 00:13:01 ubuntu ovpn-CLIENT[921]: VERIFY KU OK
Sep 18 00:13:01 ubuntu ovpn-CLIENT[921]: Validating certificate extended key usage
Sep 18 00:13:01 ubuntu ovpn-CLIENT[921]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sep 18 00:13:01 ubuntu ovpn-CLIENT[921]: VERIFY EKU OK
Sep 18 00:13:01 ubuntu ovpn-CLIENT[921]: VERIFY OK: depth=0, C=SI, ST=Slovenia, L=Celje, O=BiLumina, OU=, CN=SERVER_IP_OR_HOSTNAME, name=SERVER_IP_OR_HOSTNAME, emailAddress=info@example.com
Sep 18 00:13:01 ubuntu ovpn-CLIENT[921]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep 18 00:13:01 ubuntu ovpn-CLIENT[921]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep 18 00:13:01 ubuntu ovpn-CLIENT[921]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep 18 00:13:01 ubuntu ovpn-CLIENT[921]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep 18 00:13:01 ubuntu ovpn-CLIENT[921]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sep 18 00:26:46 ubuntu ovpn-CLIENT[921]: write UDPv4: Network is unreachable (code=101)
Sep 18 00:27:01 ubuntu ovpn-CLIENT[921]: message repeated 4 times: [ write UDPv4: Network is unreachable (code=101)]
Sep 18 01:13:00 ubuntu ovpn-CLIENT[921]: TLS: tls_process: killed expiring key
Sep 18 01:13:01 ubuntu ovpn-CLIENT[921]: TLS: soft reset sec=0 bytes=478309/0 pkts=3016/0
Sep 18 01:13:01 ubuntu ovpn-CLIENT[921]: VERIFY OK: depth=1, C=SI, ST=Slovenia, L=Celje, O=BiLumina, OU=, CN=BiLumina_CA, name=BiLumina_CA, emailAddress=info@example.com
Sep 18 01:13:01 ubuntu ovpn-CLIENT[921]: Validating certificate key usage
Sep 18 01:13:01 ubuntu ovpn-CLIENT[921]: ++ Certificate has key usage 00a0, expects 00a0
Sep 18 01:13:01 ubuntu ovpn-CLIENT[921]: VERIFY KU OK
Sep 18 01:13:01 ubuntu ovpn-CLIENT[921]: Validating certificate extended key usage
Sep 18 01:13:01 ubuntu ovpn-CLIENT[921]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sep 18 01:13:01 ubuntu ovpn-CLIENT[921]: VERIFY EKU OK
Sep 18 01:13:01 ubuntu ovpn-CLIENT[921]: VERIFY OK: depth=0, C=SI, ST=Slovenia, L=Celje, O=BiLumina, OU=, CN=SERVER_IP_OR_HOSTNAME, name=SERVER_IP_OR_HOSTNAME, emailAddress=info@example.com
Sep 18 01:13:02 ubuntu ovpn-CLIENT[921]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep 18 01:13:02 ubuntu ovpn-CLIENT[921]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep 18 01:13:02 ubuntu ovpn-CLIENT[921]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep 18 01:13:02 ubuntu ovpn-CLIENT[921]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep 18 01:13:02 ubuntu ovpn-CLIENT[921]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sep 18 02:13:01 ubuntu ovpn-CLIENT[921]: TLS: tls_process: killed expiring key
Sep 18 02:13:02 ubuntu ovpn-CLIENT[921]: VERIFY OK: depth=1, C=SI, ST=Slovenia, L=Celje, O=BiLumina, OU=, CN=BiLumina_CA, name=BiLumina_CA, emailAddress=info@example.com
Sep 18 02:13:02 ubuntu ovpn-CLIENT[921]: Validating certificate key usage
Sep 18 02:13:02 ubuntu ovpn-CLIENT[921]: ++ Certificate has key usage 00a0, expects 00a0
Sep 18 02:13:02 ubuntu ovpn-CLIENT[921]: VERIFY KU OK
Sep 18 02:13:02 ubuntu ovpn-CLIENT[921]: Validating certificate extended key usage
Sep 18 02:13:02 ubuntu ovpn-CLIENT[921]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sep 18 02:13:02 ubuntu ovpn-CLIENT[921]: VERIFY EKU OK
Sep 18 02:13:02 ubuntu ovpn-CLIENT[921]: VERIFY OK: depth=0, C=SI, ST=Slovenia, L=Celje, O=BiLumina, OU=, CN=SERVER_IP_OR_HOSTNAME, name=SERVER_IP_OR_HOSTNAME, emailAddress=info@example.com
Sep 18 02:13:03 ubuntu ovpn-CLIENT[921]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep 18 02:13:03 ubuntu ovpn-CLIENT[921]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep 18 02:13:03 ubuntu ovpn-CLIENT[921]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep 18 02:13:03 ubuntu ovpn-CLIENT[921]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep 18 02:13:03 ubuntu ovpn-CLIENT[921]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sep 18 02:13:14 ubuntu ovpn-CLIENT[921]: write UDPv4: Network is unreachable (code=101)
Sep 18 02:57:45 ubuntu ovpn-CLIENT[921]: message repeated 23 times: [ write UDPv4: Network is unreachable (code=101)]
Sep 18 03:13:02 ubuntu ovpn-CLIENT[921]: TLS: tls_process: killed expiring key
Sep 18 03:13:03 ubuntu ovpn-CLIENT[921]: VERIFY OK: depth=1, C=SI, ST=Slovenia, L=Celje, O=BiLumina, OU=, CN=BiLumina_CA, name=BiLumina_CA, emailAddress=info@example.com
Sep 18 03:13:03 ubuntu ovpn-CLIENT[921]: Validating certificate key usage
Sep 18 03:13:03 ubuntu ovpn-CLIENT[921]: ++ Certificate has key usage 00a0, expects 00a0
Sep 18 03:13:03 ubuntu ovpn-CLIENT[921]: VERIFY KU OK
Sep 18 03:13:03 ubuntu ovpn-CLIENT[921]: Validating certificate extended key usage
Sep 18 03:13:03 ubuntu ovpn-CLIENT[921]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sep 18 03:13:03 ubuntu ovpn-CLIENT[921]: VERIFY EKU OK
Sep 18 03:13:03 ubuntu ovpn-CLIENT[921]: VERIFY OK: depth=0, C=SI, ST=Slovenia, L=Celje, O=BiLumina, OU=, CN=SERVER_IP_OR_HOSTNAME, name=SERVER_IP_OR_HOSTNAME, emailAddress=info@example.com
Sep 18 03:13:03 ubuntu ovpn-CLIENT[921]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep 18 03:13:03 ubuntu ovpn-CLIENT[921]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep 18 03:13:03 ubuntu ovpn-CLIENT[921]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep 18 03:13:03 ubuntu ovpn-CLIENT[921]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep 18 03:13:03 ubuntu ovpn-CLIENT[921]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sep 18 03:17:02 ubuntu ovpn-CLIENT[921]: write UDPv4: Network is unreachable (code=101)
Sep 18 03:59:51 ubuntu ovpn-CLIENT[921]: message repeated 79 times: [ write UDPv4: Network is unreachable (code=101)]
Sep 18 04:13:04 ubuntu ovpn-CLIENT[921]: TLS: soft reset sec=-1 bytes=490194/0 pkts=3239/0
Sep 18 04:13:04 ubuntu ovpn-CLIENT[921]: VERIFY OK: depth=1, C=SI, ST=Slovenia, L=Celje, O=BiLumina, OU=, CN=BiLumina_CA, name=BiLumina_CA, emailAddress=info@example.com
Sep 18 04:13:04 ubuntu ovpn-CLIENT[921]: Validating certificate key usage
Sep 18 04:13:04 ubuntu ovpn-CLIENT[921]: ++ Certificate has key usage 00a0, expects 00a0
Sep 18 04:13:04 ubuntu ovpn-CLIENT[921]: VERIFY KU OK
Sep 18 04:13:04 ubuntu ovpn-CLIENT[921]: Validating certificate extended key usage
Sep 18 04:13:04 ubuntu ovpn-CLIENT[921]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sep 18 04:13:04 ubuntu ovpn-CLIENT[921]: VERIFY EKU OK
Sep 18 04:13:04 ubuntu ovpn-CLIENT[921]: VERIFY OK: depth=0, C=SI, ST=Slovenia, L=Celje, O=BiLumina, OU=, CN=SERVER_IP_OR_HOSTNAME, name=SERVER_IP_OR_HOSTNAME, emailAddress=info@example.com
Sep 18 04:13:04 ubuntu ovpn-CLIENT[921]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep 18 04:13:04 ubuntu ovpn-CLIENT[921]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep 18 04:13:04 ubuntu ovpn-CLIENT[921]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep 18 04:13:04 ubuntu ovpn-CLIENT[921]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep 18 04:13:04 ubuntu ovpn-CLIENT[921]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sep 18 04:27:01 ubuntu ovpn-CLIENT[921]: write UDPv4: Network is unreachable (code=101)
Sep 18 04:45:58 ubuntu ovpn-CLIENT[921]: message repeated 28 times: [ write UDPv4: Network is unreachable (code=101)]
Sep 18 05:13:04 ubuntu ovpn-CLIENT[921]: TLS: soft reset sec=0 bytes=497877/0 pkts=3266/0
Sep 18 05:13:04 ubuntu ovpn-CLIENT[921]: VERIFY OK: depth=1, C=SI, ST=Slovenia, L=Celje, O=BiLumina, OU=, CN=BiLumina_CA, name=BiLumina_CA, emailAddress=info@example.com
Sep 18 05:13:04 ubuntu ovpn-CLIENT[921]: Validating certificate key usage
Sep 18 05:13:04 ubuntu ovpn-CLIENT[921]: ++ Certificate has key usage 00a0, expects 00a0
Sep 18 05:13:04 ubuntu ovpn-CLIENT[921]: VERIFY KU OK
Sep 18 05:13:04 ubuntu ovpn-CLIENT[921]: Validating certificate extended key usage
Sep 18 05:13:04 ubuntu ovpn-CLIENT[921]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sep 18 05:13:04 ubuntu ovpn-CLIENT[921]: VERIFY EKU OK
Sep 18 05:13:04 ubuntu ovpn-CLIENT[921]: VERIFY OK: depth=0, C=SI, ST=Slovenia, L=Celje, O=BiLumina, OU=, CN=SERVER_IP_OR_HOSTNAME, name=SERVER_IP_OR_HOSTNAME, emailAddress=info@example.com
Sep 18 05:13:04 ubuntu ovpn-CLIENT[921]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep 18 05:13:04 ubuntu ovpn-CLIENT[921]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep 18 05:13:04 ubuntu ovpn-CLIENT[921]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep 18 05:13:04 ubuntu ovpn-CLIENT[921]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep 18 05:13:04 ubuntu ovpn-CLIENT[921]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sep 18 05:35:56 ubuntu ovpn-CLIENT[921]: write UDPv4: Network is unreachable (code=101)
Sep 18 05:59:24 ubuntu ovpn-CLIENT[921]: message repeated 23 times: [ write UDPv4: Network is unreachable (code=101)]
Sep 18 06:13:03 ubuntu ovpn-CLIENT[921]: VERIFY OK: depth=1, C=SI, ST=Slovenia, L=Celje, O=BiLumina, OU=, CN=BiLumina_CA, name=BiLumina_CA, emailAddress=info@example.com
Sep 18 06:13:03 ubuntu ovpn-CLIENT[921]: Validating certificate key usage
Sep 18 06:13:03 ubuntu ovpn-CLIENT[921]: ++ Certificate has key usage 00a0, expects 00a0
Sep 18 06:13:03 ubuntu ovpn-CLIENT[921]: VERIFY KU OK
Sep 18 06:13:03 ubuntu ovpn-CLIENT[921]: Validating certificate extended key usage
Sep 18 06:13:03 ubuntu ovpn-CLIENT[921]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sep 18 06:13:03 ubuntu ovpn-CLIENT[921]: VERIFY EKU OK
Sep 18 06:13:03 ubuntu ovpn-CLIENT[921]: VERIFY OK: depth=0, C=SI, ST=Slovenia, L=Celje, O=BiLumina, OU=, CN=SERVER_IP_OR_HOSTNAME, name=SERVER_IP_OR_HOSTNAME, emailAddress=info@example.com
Sep 18 06:13:04 ubuntu ovpn-CLIENT[921]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep 18 06:13:04 ubuntu ovpn-CLIENT[921]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep 18 06:13:04 ubuntu ovpn-CLIENT[921]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep 18 06:13:04 ubuntu ovpn-CLIENT[921]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep 18 06:13:04 ubuntu ovpn-CLIENT[921]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sep 18 06:40:19 ubuntu ovpn-CLIENT[921]: write UDPv4: Network is unreachable (code=101)
Sep 18 07:10:20 ubuntu ovpn-CLIENT[921]: message repeated 51 times: [ write UDPv4: Network is unreachable (code=101)]
Sep 18 07:13:03 ubuntu ovpn-CLIENT[921]: TLS: tls_process: killed expiring key
Sep 18 07:13:04 ubuntu ovpn-CLIENT[921]: TLS: soft reset sec=0 bytes=611348/0 pkts=3506/0
Sep 18 07:13:05 ubuntu ovpn-CLIENT[921]: VERIFY OK: depth=1, C=SI, ST=Slovenia, L=Celje, O=BiLumina, OU=, CN=BiLumina_CA, name=BiLumina_CA, emailAddress=info@example.com
Sep 18 07:13:05 ubuntu ovpn-CLIENT[921]: Validating certificate key usage
Sep 18 07:13:05 ubuntu ovpn-CLIENT[921]: ++ Certificate has key usage 00a0, expects 00a0
Sep 18 07:13:05 ubuntu ovpn-CLIENT[921]: VERIFY KU OK
Sep 18 07:13:05 ubuntu ovpn-CLIENT[921]: Validating certificate extended key usage
Sep 18 07:13:05 ubuntu ovpn-CLIENT[921]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sep 18 07:13:05 ubuntu ovpn-CLIENT[921]: VERIFY EKU OK
Sep 18 07:13:05 ubuntu ovpn-CLIENT[921]: VERIFY OK: depth=0, C=SI, ST=Slovenia, L=Celje, O=BiLumina, OU=, CN=SERVER_IP_OR_HOSTNAME, name=SERVER_IP_OR_HOSTNAME, emailAddress=info@example.com
Sep 18 07:13:05 ubuntu ovpn-CLIENT[921]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep 18 07:13:05 ubuntu ovpn-CLIENT[921]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep 18 07:13:05 ubuntu ovpn-CLIENT[921]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sep 18 07:13:05 ubuntu ovpn-CLIENT[921]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sep 18 07:13:05 ubuntu ovpn-CLIENT[921]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sep 18 07:13:38 ubuntu ovpn-CLIENT[921]: write UDPv4: Network is unreachable (code=101)

Could the problem be in the fact that two machines on the network have the same hostname, but different static IP addresses?

Traffic

kovica wroteserver 172.200.1.0 255.255.255.0

kovica wroteifconfig-push 172.200.4.109 172.200.4.110

Can you see your mistake :mrgreen: ?

kovica

Sorry, but I don't.
Especially, because I have 20 different VPN clients running at any given time without a problem.
I personally run it all the time and have never seen this problem before.

Traffic

Traffic wrotekovica wrote:
server 172.200.1.0 255.255.255.0
kovica wrote:
ifconfig-push 172.200.4.109 172.200.4.110
Can you see your mistake :mrgreen: ?

kovica wroteSorry, but I don't.

server 172.200.1.0 255.255.255.0 is not in the same subnet as 172.200.4.109

Try:

ifconfig-push 172.200.1.109 172.200.1.110

You could also try --topology subnet .. See --topology in The Manual v23x.

Do not implement --topology subnet without fully understanding the ramifications.

kovica

Agreed, that server is not on the same subnet as the client, but it does not have to be. Trust me. I have clients running on 172.200.2.X, 172.200.3.X, ....

Since I'm using net30 topology, client also has this routing table:
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.0.1 0.0.0.0 UG 0 0 0 wlan0
172.20.11.0 172.200.4.110 255.255.255.0 UG 0 0 0 tun0
172.200.0.0 172.200.4.110 255.255.0.0 UG 0 0 0 tun0
172.200.1.1 172.200.4.110 255.255.255.255 UGH 0 0 0 tun0
172.200.4.110 0.0.0.0 255.255.255.255 UH 0 0 0 tun0

Server is running on a machine inside our corporate network and on the router I have set routing so that, for example, 172.200.4.X is routed to whatever IP server machine has.
This has been working like this for three years. I only have a problem with "Network is unreachable" on this one machine.

Traffic

kovica wroteAgreed, that server is not on the same subnet as the client, but it does not have to be. Trust me. I have clients running on 172.200.2.X, 172.200.3.X, ....

kovica wroteI only have a problem with "Network is unreachable" on this one machine.

I trust in "Sod's Law" ..

kovica

So why is there a chapter "Configuring client-specific rules and access policies" in HOWTO (https://openvpn.net/index.php/open-source/documentation/howto.html#policy) that described the exact same config (IPs are different) that I have?

Traffic

I agree, that is a badly written HOWTO ... not written by me.

Let me put it this way; As far as I am concerned, your config does not work for the reasons I have highlighted. If you have proof that it does work then post configs and logs and I will try to replicate your setup. Otherwise, I maintain my position.

kovica

If the HOWTO is bad/wrong, ... then it should be removed, right?

And I did post server conf, client conf and logs. I'm not sure what else I can do.

Traffic

kovica wroteIf the HOWTO is bad/wrong, ... then it should be removed, right?

You could try the mailing list ..

kovica wroteI did post server conf, client conf and logs

And I clearly showed why it does not work.

kovica wroteI'm not sure what else I can do

Post the configs and logs at --verb 4 of a client receiving an "out of --server subnet" IP address which works as you claim .. at least give me a chance of debugging this :mrgreen:

kovica

OK, just let me send the machine back to the client. I'll get back. 🙂

Traffic

Take as long as you need ..

We would much prefer a good example than a bad one. 8-)