The problem:
OpenVZ container (tun option enabled on control panel) running OpenVPN v2.2.1 as a server, clients authenticates, assigns IP address to client, and promptly crashes. I've tried multiple ciphers. Same result.
Server Config:
port 1194
proto udp
dev tun0
ca keys/mycertauthority/ca.crt
cert keys/mycertauthority/myserver.crt
key keys/mycertauthority/myserver.key
dh keys/mycertauthority/dh2048.pem
server 10.50.1.0 255.255.255.0
crl-verify keys/mycertauthority/crl.pem
ifconfig-pool-persist servers/MyVPN/logs/ipp.txt
cipher AES-256-CFB
user nobody
group nogroup
status servers/MyVPN/logs/openvpn-status.log
log-append servers/MyVPN/logs/openvpn.log
verb 4444
mute 20
max-clients 100
keepalive 10 120
client-config-dir /etc/openvpn/servers/MyVPN/ccd
comp-lzo adaptive
persist-key
persist-tun
ccd-exclusive
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
Client Config:
client
proto udp
dev tun
ca ca.crt
dh dh2048.pem
cert myclient.crt
key myclient.key
remote <MyVPN> 1194
cipher AES-256-CFB
verb 2
mute 20
keepalive 10 120
comp-lzo
persist-key
persist-tun
float
resolv-retry infinite
nobind
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
Iptables Rules Config:
# Generated by iptables-save v1.4.14 on Mon Nov 30 01:51:21 2015
*nat
:PREROUTING ACCEPT [3:809]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Mon Nov 30 01:51:21 2015
# Generated by iptables-save v1.4.14 on Mon Nov 30 01:51:21 2015
*filter
:INPUT ACCEPT [24:5433]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [22:5997]
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Mon Nov 30 01:51:21 2015
# Generated by iptables-save v1.4.14 on Mon Nov 30 01:51:21 2015
*mangle
:PREROUTING ACCEPT [339:37718]
:INPUT ACCEPT [339:37718]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [362:40823]
:POSTROUTING ACCEPT [362:40823]
COMMIT
# Completed on Mon Nov 30 01:51:21 2015
# Generated by iptables-save v1.4.14 on Mon Nov 30 01:51:21 2015
*raw
:PREROUTING ACCEPT [339:37718]
:OUTPUT ACCEPT [362:40823]
COMMIT
# Completed on Mon Nov 30 01:51:21 2015
Server Log:
The entire 400k log is available at:
http://pastebin.com/LPaPzyNT
Sat Dec 5 16:45:30 2015 us=278780 I/O WAIT status=0x0001
Sat Dec 5 16:45:30 2015 us=278790 MULTI: REAP range 176 -> 192
Sat Dec 5 16:45:30 2015 us=278806 UDPv4 read returned 110
Sat Dec 5 16:45:30 2015 us=278820 GET INST BY REAL: <MyIP>:55985 [succeeded]
Sat Dec 5 16:45:30 2015 us=278861 myclient/<MyIP>:55985 UDPv4 READ [110] from [AF_INET]<MyIP>:55985: P_DATA_V1 kid=0 DATA b2e5a274 7a18e66d ca4d2079 0046cd49 8ee010e0 00000021 56631498 0000000[more...]
Sat Dec 5 16:45:30 2015 us=278874 myclient/<MyIP>:55985 TLS: tls_pre_decrypt, key_id=0, IP=[AF_INET]<MyIP>:55985
Sat Dec 5 16:45:30 2015 us=278898 myclient/<MyIP>:55985 DECRYPT IV: 00000021 56631498 00000000 00000000
Sat Dec 5 16:45:30 2015 us=278928 myclient/<MyIP>:55985 DECRYPT TO: fa600000 00002011 01fe8000 00000000 000ce726 616cb663 03ff0200 0000000[more...]
Sat Dec 5 16:45:30 2015 us=278940 myclient/<MyIP>:55985 PID TEST 1449333912:32 1449333912:33
Sat Dec 5 16:45:30 2015 us=278955 myclient/<MyIP>:55985 GET INST BY VIRT: fe80::ce7:2661:6cb6:6303 [failed]
Sat Dec 5 16:45:30 2015 us=278967 myclient/<MyIP>:55985 MULTI: bad source address from client [fe80::ce7:2661:6cb6:6303], packet dropped
Sat Dec 5 16:45:30 2015 us=278978 myclient/<MyIP>:55985 TLS: tls_pre_encrypt: key_id=0
Sat Dec 5 16:45:30 2015 us=278991 myclient/<MyIP>:55985 ENCRYPT IV: 00000001 566314aa 00000000 00000000
Sat Dec 5 16:45:30 2015 us=279003 myclient/<MyIP>:55985 ENCRYPT FROM: fa2a187b f3641eb4 cb07ed2d 0a981fc7 48
Sat Dec 5 16:45:30 2015 us=279015 myclient/<MyIP>:55985 Assertion failed at crypto.c:179
Sat Dec 5 16:45:30 2015 us=279023 myclient/<MyIP>:55985 Exiting
Sat Dec 5 16:45:30 2015 us=279048 myclient/<MyIP>:55985 /sbin/route del -net 10.50.1.0 netmask 255.255.255.0
Sat Dec 5 16:45:30 2015 us=279317 myclient/<MyIP>:55985 PKCS#11: __pkcs11h_forkFixup entry pid=14242, activate_slotevent=1
Sat Dec 5 16:45:30 2015 us=279364 myclient/<MyIP>:55985 PKCS#11: __pkcs11h_forkFixup return
SIOCDELRT: Operation not permitted
Sat Dec 5 16:45:30 2015 us=279853 myclient/<MyIP>:55985 ERROR: Linux route delete command failed: external program exited with error status: 7
Sat Dec 5 16:45:30 2015 us=279882 myclient/<MyIP>:55985 Closing TUN/TAP interface
Sat Dec 5 16:45:30 2015 us=279896 myclient/<MyIP>:55985 /sbin/ifconfig tun0 0.0.0.0
Sat Dec 5 16:45:30 2015 us=280062 myclient/<MyIP>:55985 PKCS#11: __pkcs11h_forkFixup entry pid=14243, activate_slotevent=1
Sat Dec 5 16:45:30 2015 us=280097 myclient/<MyIP>:55985 PKCS#11: __pkcs11h_forkFixup return
SIOCSIFADDR: Permission denied
SIOCSIFFLAGS: Permission denied
Sat Dec 5 16:45:30 2015 us=280569 myclient/<MyIP>:55985 Linux ip addr del failed: external program exited with error status: 255
Any thoughts?
Thank you.
