Loads of "bad source address" errors in log

red-lichtie

I spend quite a bit of time on the move and I am trying to set up my OpenVPN server to transparently connect/forward all my data when I am at something like an airport, inet cafe or customer site.

I can connect to my server so all the "basic" configuration works (addresses, ports, certificates, etc).

But when connected I get the following repeated in the server log:

openvpn@server[1710]: client.sample.net/11.22.33.44:45594 MULTI: bad source address from client [192.168.1.131], packet dropped

I can't predict the address that my laptop will get (it sure isn't always 192.168.1.131 ..), so setting up a static route on the server isn't going to work.

I'm also getting the following when loading more complex web sites:

MULTI: packet dropped due to output saturation (multi_process_incoming_tun)

So it all basically works but I don't like the look of all the errors.

What am I missing? Is there another server option that I need to set ?

Configuration files ------------------------------------

Both server and client have "/proc/sys/net/ipv4/ip_forward" enabled (i.e. 1)

(I'm not a Linux iptables expert, the NAT options I set I found somewhere else regarding the same message)

IP Tables

# iptables -L -t nat -v
Chain PREROUTING (policy ACCEPT 527 packets, 84721 bytes)
pkts bytes target prot opt in out source destination

Chain INPUT (policy ACCEPT 63 packets, 9768 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
61 46947 MASQUERADE all -- any eth0 10.9.0.0/24 anywhere

Client routing:

# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.9.0.5 0.0.0.0 UG 50 0 0 tun0
0.0.0.0 192.168.1.254 0.0.0.0 UG 600 0 0 wlp2s0
5.6.7.185 192.168.1.254 255.255.255.255 UGH 600 0 0 wlp2s0
10.9.0.1 10.9.0.5 255.255.255.255 UGH 50 0 0 tun0
10.9.0.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
10.9.0.6 0.0.0.0 255.255.255.255 UH 50 0 0 tun0
192.168.1.0 0.0.0.0 255.255.255.0 U 600 0 0 wlp2s0
192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr0

Server routing:

# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 5.6.7.1 0.0.0.0 UG 202 0 0 eth0
5.6.7.0 0.0.0.0 255.255.255.0 U 202 0 0 eth0
10.9.0.0 10.9.0.2 255.255.255.0 UG 0 0 0 tun0
10.9.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0

server.conf:

proto tcp
port 443
dev tun0
ca keys/myca.crt
cert keys/vpn-cert.pem
key keys/vpn-key.pem
dh keys/dh2048.pem
tls-auth keys/ta.key 0
server 10.9.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "redirect-gateway"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 4

Client (Network Manager):

...

[vpn]
ta-dir=1
connection-type=tls
remote=vpn.sample.net
comp-lzo=yes
cert-pass-flags=1
proto-tcp=yes
port=443
cert=/home/user/.openvpn/client-cert.pem
ca=/home/user/.openvpn/myca.crt
key=/home/user/.openvpn/client-key.pem
ta=/home/user/.openvpn2/ta.key
service-type=org.freedesktop.NetworkManager.openvpn

[ipv4]
dns-search=
method=auto

[ipv6]
dns-search=
ip6-privacy=0
method=ignore

Traffic

red-lichtie wroteBut when connected I get the following repeated in the server log:

Quote:
openvpn@server[1710]: client.sample.net/11.22.33.44:45594 MULTI: bad source address from client [192.168.1.131], packet dropped

I can't predict the address that my laptop will get (it sure isn't always 192.168.1.131 ..), so setting up a static route on the server isn't going to work.

You can safely ignore this error. You can add --mute to your server config to silence the message.

red-lichtie wroteI'm also getting the following when loading more complex web sites:
Quote:
MULTI: packet dropped due to output saturation (multi_process_incoming_tun)

So it all basically works but I don't like the look of all the errors.

Output saturation .. maybe you need a bigger internet connection. If it basically works you should be ok.

It may be possible to slightly improve the server performance with some of the options documented in The Manual v23x.

EG:
--sendbuf / --rcvbuf and --txqueuelen

red-lichtie wroteServer routing:
Quote:
# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 5.6.7.1 0.0.0.0 UG 202 0 0 eth0

I presume this is a fake IP .. just make sure your server LAN is a unique subnet ie. not 192.168.0.0/24 or 192.168.1.0/24 etc

red-lichtie

I've added:

mute 1

to the configuration, although I would rather it not be identified as an "error" at all.

With regards to the package drops this is what solved it

tcp-queue-limit 256

, I guess all the "little" pieces of a modern HTML page amounts to quite a few requests (roll on HTML2).

Yes, the IP address was indeed manipulated ;-)

Traffic

red-lichtie wroteI've added:
Code:
mute 1
to the configuration, although I would rather it not be identified as an "error" at all.

Try --verb 0 instead ..

red-lichtie wroteWith regards to the package drops this is what solved it
Code:
tcp-queue-limit 256
, I guess all the "little" pieces of a modern HTML page amounts to quite a few requests (roll on HTML2).

Thanks for letting us know 8-)