Split tunneling of one machine

katorce

I have a raspberry pi (server), with a computer in the same network (computer4), locally.

I also have another 3 devices that connects to the network, but they are not in local.

What I want is to make a split tunnel, so computer4, it is in the net (to share desktop, access files, printer and so on), but I don´t want that all traffic of computer4 cross through the server, only the local one.

At the same time, I do want all the traffic of the others 3 devices, cross through the server for security reasons.

I have been researching and it according to this: http://swimminginthought.com/routing-traffic-vpn/ I do only need to remove the line

 redirect-gateway def1

from server.conf
and add the following line

route 192.168.1.4 255.255.255.0 vpn_gateway

to the computer4.ovpn

My question are:
1.- Is this correct?
2.- Will the other devices, fully connect through the VPN just as now.
3.- Will only local traffic be available?

Thank you in advance.

Traffic

katorce wroteI don´t want that all traffic of computer4 cross through the server, only the local one.

At the same time, I do want all the traffic of the others 3 devices, cross through the server for security reasons.

<..> I do only need to remove the line
Code:
redirect-gateway def1

from server.conf

You are on the right lines.

You need to use the --client-config-dir directive to setup separate rules for each client so that you push the redirect to your three remote clients but not to your one local client.

It is not particularly well documented but See --client-config-dir in The Manual v23x

Also, see The Howto for some examples.

katorce

I have to say I am completely lost.

It seems I have to remove the

redirect-gateway def1

from server.conf and I have to execute the server with the flag --client-config-dir dir
Where dir is a directory that must contain some kind of files for each one of the clients, so client1, client2, client3, and client4.

But I don´t really know what should I introduce inside of each of this files. It seems also that the option is redundant and I could do the same modifying only the client4.ovpn which is executed in the computer4 machine.
For example now the 4 clients are as follow:

client 
dev tun 
proto udp 
remote xyz.net 1194 
resolv-retry infinite 
nobind 
persist-key 
persist-tun 
mute-replay-warnings 
ns-cert-type server 
key-direction 1 
cipher AES-128-CBC 
comp-lzo 
verb 1 
mute 20

Then I should add for clients 1 to 3 inside the ovpn the line

redirect-gateway def1

But I have no idea what should I add into the client4, in order to be locally in the VPN (I want to access files, and remote desktop) but this clients connects to internet directly.
Perhaps this line, but I am not really sure.

redirect-gateway local

Traffic

You do not want to redirect client4's gateway at all as it is local to the server .. So the file can just be empty.

FYI: (For clients 1-3) You still need to push "options" to the client even in a --client-config-dir file.

katorce

Well I did the following,

in the server.conf I commented this line and add this one

# push "redirect-gateway def1" 
client-config-dir ccd

I created a directory with mkdir called ccd under /etc/openvpn/ccd

And inside this file I created 4 files with the names: WIN4, WIN5, phone, and ipad. Which are the names of each client, where WIN4 is the local computer.
WIN5, phone, and ipad has this line inside and only this line:

redirect-gateway def1

Now I would like to give WIN4 an static ip inside the range 10.8.0.X, it usually connects as 10.8.0.6 but not always. I would like to give the 10.8.0.4, I tried doing the following:

ifconfig-push 10.8.0.53 10.8.0.54

To give the 10.8.0.53, however the WIN4 machine connects to the 10.8.0.6 (with 10.8.0.5 as DHCP-server). This make me thing, that I have done something wrong in the config-dir option and that the other clients are not using the VPN at all.

Edit: I am right I have just tried with my phone, and when connected to the VPN, my ip public is the one I got with my data connection instead of using the one where my raspberry is.

What did I do wrong?

Traffic

Please,

either post you server log at --verb 4
or use --ccd-exclusive in your server config ..

Be warned: Your client will not be able to connect at all if you have setup your CCD files incorrectly.

The Manual wrote
--ccd-exclusive
Require, as a condition of authentication, that a connecting client has a --client-config-dir file.

katorce

Server log with verb 4, I am trying to connect with a device that must be fully encrypted.

Fri Jan  1 23:38:42 2016 us=462439 Current Parameter Settings:
Fri Jan  1 23:38:42 2016 us=462953   config = '/etc/openvpn/server.conf'
Fri Jan  1 23:38:42 2016 us=463057   mode = 1
Fri Jan  1 23:38:42 2016 us=463143   persist_config = DISABLED
Fri Jan  1 23:38:42 2016 us=463225   persist_mode = 1
Fri Jan  1 23:38:42 2016 us=463307   show_ciphers = DISABLED
Fri Jan  1 23:38:42 2016 us=463388   show_digests = DISABLED
Fri Jan  1 23:38:42 2016 us=463468   show_engines = DISABLED
Fri Jan  1 23:38:42 2016 us=463548   genkey = DISABLED
Fri Jan  1 23:38:42 2016 us=463630   key_pass_file = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=463712   show_tls_ciphers = DISABLED
Fri Jan  1 23:38:42 2016 us=463793 Connection profiles [default]:
Fri Jan  1 23:38:42 2016 us=463878   proto = udp
Fri Jan  1 23:38:42 2016 us=463958   local = '192.168.1.31'
Fri Jan  1 23:38:42 2016 us=464039   local_port = 1194
Fri Jan  1 23:38:42 2016 us=464119   remote = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=464199   remote_port = 1194
Fri Jan  1 23:38:42 2016 us=464279   remote_float = DISABLED
Fri Jan  1 23:38:42 2016 us=464359   bind_defined = DISABLED
Fri Jan  1 23:38:42 2016 us=464439   bind_local = ENABLED
Fri Jan  1 23:38:42 2016 us=464520   connect_retry_seconds = 5
Fri Jan  1 23:38:42 2016 us=464601   connect_timeout = 10
Fri Jan  1 23:38:42 2016 us=464682   connect_retry_max = 0
Fri Jan  1 23:38:42 2016 us=464763   socks_proxy_server = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=464844   socks_proxy_port = 0
Fri Jan  1 23:38:42 2016 us=464925   socks_proxy_retry = DISABLED
Fri Jan  1 23:38:42 2016 us=465007 Connection profiles END
Fri Jan  1 23:38:42 2016 us=465088   remote_random = DISABLED
Fri Jan  1 23:38:42 2016 us=465168   ipchange = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=465248   dev = 'tun'
Fri Jan  1 23:38:42 2016 us=465328   dev_type = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=465409   dev_node = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=465488   lladdr = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=465569   topology = 1
Fri Jan  1 23:38:42 2016 us=465649   tun_ipv6 = DISABLED
Fri Jan  1 23:38:42 2016 us=465729   ifconfig_local = '10.8.0.1'
Fri Jan  1 23:38:42 2016 us=466045   ifconfig_remote_netmask = '10.8.0.2'
Fri Jan  1 23:38:42 2016 us=466153   ifconfig_noexec = DISABLED
Fri Jan  1 23:38:42 2016 us=466241   ifconfig_nowarn = DISABLED
Fri Jan  1 23:38:42 2016 us=466324   ifconfig_ipv6_local = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=466407   ifconfig_ipv6_netbits = 0
Fri Jan  1 23:38:42 2016 us=466522   ifconfig_ipv6_remote = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=466633   shaper = 0
Fri Jan  1 23:38:42 2016 us=466719   tun_mtu = 1500
Fri Jan  1 23:38:42 2016 us=466800   tun_mtu_defined = ENABLED
Fri Jan  1 23:38:42 2016 us=466880   link_mtu = 1500
Fri Jan  1 23:38:42 2016 us=466959   link_mtu_defined = DISABLED
Fri Jan  1 23:38:42 2016 us=467041   tun_mtu_extra = 0
Fri Jan  1 23:38:42 2016 us=467121   tun_mtu_extra_defined = DISABLED
Fri Jan  1 23:38:42 2016 us=467202   fragment = 0
Fri Jan  1 23:38:42 2016 us=467282   mtu_discover_type = -1
Fri Jan  1 23:38:42 2016 us=467363   mtu_test = 0
Fri Jan  1 23:38:42 2016 us=467443   mlock = DISABLED
Fri Jan  1 23:38:42 2016 us=467523   keepalive_ping = 10
Fri Jan  1 23:38:42 2016 us=467604   keepalive_timeout = 120
Fri Jan  1 23:38:42 2016 us=467684   inactivity_timeout = 0
Fri Jan  1 23:38:42 2016 us=467764   ping_send_timeout = 10
Fri Jan  1 23:38:42 2016 us=467845   ping_rec_timeout = 240
Fri Jan  1 23:38:42 2016 us=467925   ping_rec_timeout_action = 2
Fri Jan  1 23:38:42 2016 us=468007   ping_timer_remote = DISABLED
Fri Jan  1 23:38:42 2016 us=468089   remap_sigusr1 = 0
Fri Jan  1 23:38:42 2016 us=468170   explicit_exit_notification = 0
Fri Jan  1 23:38:42 2016 us=468310   persist_tun = ENABLED
Fri Jan  1 23:38:42 2016 us=468420   persist_local_ip = DISABLED
Fri Jan  1 23:38:42 2016 us=468507   persist_remote_ip = DISABLED
Fri Jan  1 23:38:42 2016 us=468589   persist_key = ENABLED
Fri Jan  1 23:38:42 2016 us=468669   mssfix = 1450
Fri Jan  1 23:38:42 2016 us=468749   passtos = DISABLED
Fri Jan  1 23:38:42 2016 us=468831   resolve_retry_seconds = 1000000000
Fri Jan  1 23:38:42 2016 us=468962   username = 'nobody'
Fri Jan  1 23:38:42 2016 us=469051   groupname = 'nogroup'
Fri Jan  1 23:38:42 2016 us=469131   chroot_dir = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=469212   cd_dir = '/etc/openvpn'
Fri Jan  1 23:38:42 2016 us=469293   writepid = '/var/run/openvpn.server.pid'
Fri Jan  1 23:38:42 2016 us=469375   up_script = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=469456   down_script = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=469536   down_pre = DISABLED
Fri Jan  1 23:38:42 2016 us=469616   up_restart = DISABLED
Fri Jan  1 23:38:42 2016 us=469696   up_delay = DISABLED
Fri Jan  1 23:38:42 2016 us=469775   daemon = ENABLED
Fri Jan  1 23:38:42 2016 us=469854   inetd = 0
Fri Jan  1 23:38:42 2016 us=469934   log = ENABLED
Fri Jan  1 23:38:42 2016 us=470013   suppress_timestamps = DISABLED
Fri Jan  1 23:38:42 2016 us=470095   nice = 0
Fri Jan  1 23:38:42 2016 us=470175   verbosity = 4
Fri Jan  1 23:38:42 2016 us=470255   mute = 0
Fri Jan  1 23:38:42 2016 us=470334   gremlin = 0
Fri Jan  1 23:38:42 2016 us=470415   status_file = '/var/log/openvpn-status.log'
Fri Jan  1 23:38:42 2016 us=470495   status_file_version = 1
Fri Jan  1 23:38:42 2016 us=470575   status_file_update_freq = 20
Fri Jan  1 23:38:42 2016 us=470656   occ = ENABLED
Fri Jan  1 23:38:42 2016 us=470736   rcvbuf = 65536
Fri Jan  1 23:38:42 2016 us=470816   sndbuf = 65536
Fri Jan  1 23:38:42 2016 us=470896   sockflags = 0
Fri Jan  1 23:38:42 2016 us=470976   fast_io = DISABLED
Fri Jan  1 23:38:42 2016 us=471056   lzo = 7
Fri Jan  1 23:38:42 2016 us=471136   route_script = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=471217   route_default_gateway = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=471298   route_default_metric = 0
Fri Jan  1 23:38:42 2016 us=471378   route_noexec = DISABLED
Fri Jan  1 23:38:42 2016 us=471460   route_delay = 0
Fri Jan  1 23:38:42 2016 us=471543   route_delay_window = 30
Fri Jan  1 23:38:42 2016 us=471626   route_delay_defined = DISABLED
Fri Jan  1 23:38:42 2016 us=471707   route_nopull = DISABLED
Fri Jan  1 23:38:42 2016 us=471788   route_gateway_via_dhcp = DISABLED
Fri Jan  1 23:38:42 2016 us=471871   max_routes = 100
Fri Jan  1 23:38:42 2016 us=471952   allow_pull_fqdn = DISABLED
Fri Jan  1 23:38:42 2016 us=472038   route 10.8.0.0/255.255.255.0/nil/nil
Fri Jan  1 23:38:42 2016 us=472122   management_addr = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=472204   management_port = 0
Fri Jan  1 23:38:42 2016 us=472284   management_user_pass = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=472367   management_log_history_cache = 250
Fri Jan  1 23:38:42 2016 us=472449   management_echo_buffer_size = 100
Fri Jan  1 23:38:42 2016 us=472531   management_write_peer_info_file = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=472614   management_client_user = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=472696   management_client_group = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=472778   management_flags = 0
Fri Jan  1 23:38:42 2016 us=472859   shared_secret_file = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=472943   key_direction = 1
Fri Jan  1 23:38:42 2016 us=473024   ciphername_defined = ENABLED
Fri Jan  1 23:38:42 2016 us=473106   ciphername = 'AES-128-CBC'
Fri Jan  1 23:38:42 2016 us=473189   authname_defined = ENABLED
Fri Jan  1 23:38:42 2016 us=473271   authname = 'SHA1'
Fri Jan  1 23:38:42 2016 us=473352   prng_hash = 'SHA1'
Fri Jan  1 23:38:42 2016 us=473435   prng_nonce_secret_len = 16
Fri Jan  1 23:38:42 2016 us=473518   keysize = 0
Fri Jan  1 23:38:42 2016 us=473599   engine = DISABLED
Fri Jan  1 23:38:42 2016 us=473681   replay = ENABLED
Fri Jan  1 23:38:42 2016 us=473762   mute_replay_warnings = DISABLED
Fri Jan  1 23:38:42 2016 us=473845   replay_window = 64
Fri Jan  1 23:38:42 2016 us=473927   replay_time = 15
Fri Jan  1 23:38:42 2016 us=474009   packet_id_file = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=474090   use_iv = ENABLED
Fri Jan  1 23:38:42 2016 us=474172   test_crypto = DISABLED
Fri Jan  1 23:38:42 2016 us=474252   tls_server = ENABLED
Fri Jan  1 23:38:42 2016 us=474333   tls_client = DISABLED
Fri Jan  1 23:38:42 2016 us=474415   key_method = 2
Fri Jan  1 23:38:42 2016 us=474569   ca_file = '/etc/openvpn/easy-rsa/keys/ca.crt'
Fri Jan  1 23:38:42 2016 us=474683   ca_path = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=474769   dh_file = '/etc/openvpn/easy-rsa/keys/dh1024.pem'
Fri Jan  1 23:38:42 2016 us=474853   cert_file = '/etc/openvpn/easy-rsa/keys/Server.crt'
Fri Jan  1 23:38:42 2016 us=474936   priv_key_file = '/etc/openvpn/easy-rsa/keys/Server.key'
Fri Jan  1 23:38:42 2016 us=475019   pkcs12_file = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=475101   cipher_list = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=475182   tls_verify = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=475263   tls_export_cert = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=475346   tls_remote = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=475429   crl_file = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=475511   ns_cert_type = 0
Fri Jan  1 23:38:42 2016 us=475594   remote_cert_ku[i] = 0
Fri Jan  1 23:38:42 2016 us=475676   remote_cert_ku[i] = 0
Fri Jan  1 23:38:42 2016 us=475759   remote_cert_ku[i] = 0
Fri Jan  1 23:38:42 2016 us=475841   remote_cert_ku[i] = 0
Fri Jan  1 23:38:42 2016 us=475923   remote_cert_ku[i] = 0
Fri Jan  1 23:38:42 2016 us=476004   remote_cert_ku[i] = 0
Fri Jan  1 23:38:42 2016 us=476085   remote_cert_ku[i] = 0
Fri Jan  1 23:38:42 2016 us=476166   remote_cert_ku[i] = 0
Fri Jan  1 23:38:42 2016 us=476248   remote_cert_ku[i] = 0
Fri Jan  1 23:38:42 2016 us=476329   remote_cert_ku[i] = 0
Fri Jan  1 23:38:42 2016 us=476412   remote_cert_ku[i] = 0
Fri Jan  1 23:38:42 2016 us=476494   remote_cert_ku[i] = 0
Fri Jan  1 23:38:42 2016 us=476576   remote_cert_ku[i] = 0
Fri Jan  1 23:38:42 2016 us=476658   remote_cert_ku[i] = 0
Fri Jan  1 23:38:42 2016 us=476740   remote_cert_ku[i] = 0
Fri Jan  1 23:38:42 2016 us=476822   remote_cert_ku[i] = 0
Fri Jan  1 23:38:42 2016 us=476904   remote_cert_eku = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=476986   tls_timeout = 2
Fri Jan  1 23:38:42 2016 us=477066   renegotiate_bytes = 0
Fri Jan  1 23:38:42 2016 us=477147   renegotiate_packets = 0
Fri Jan  1 23:38:42 2016 us=477229   renegotiate_seconds = 3600
Fri Jan  1 23:38:42 2016 us=477311   handshake_window = 60
Fri Jan  1 23:38:42 2016 us=477392   transition_window = 3600
Fri Jan  1 23:38:42 2016 us=477472   single_session = DISABLED
Fri Jan  1 23:38:42 2016 us=477553   push_peer_info = DISABLED
Fri Jan  1 23:38:42 2016 us=477634   tls_exit = DISABLED
Fri Jan  1 23:38:42 2016 us=477716   tls_auth_file = '/etc/openvpn/easy-rsa/keys/ta.key'
Fri Jan  1 23:38:42 2016 us=477799   pkcs11_protected_authentication = DISABLED
Fri Jan  1 23:38:42 2016 us=477882   pkcs11_protected_authentication = DISABLED
Fri Jan  1 23:38:42 2016 us=477964   pkcs11_protected_authentication = DISABLED
Fri Jan  1 23:38:42 2016 us=478047   pkcs11_protected_authentication = DISABLED
Fri Jan  1 23:38:42 2016 us=478129   pkcs11_protected_authentication = DISABLED
Fri Jan  1 23:38:42 2016 us=478212   pkcs11_protected_authentication = DISABLED
Fri Jan  1 23:38:42 2016 us=478352   pkcs11_protected_authentication = DISABLED
Fri Jan  1 23:38:42 2016 us=478439   pkcs11_protected_authentication = DISABLED
Fri Jan  1 23:38:42 2016 us=478523   pkcs11_protected_authentication = DISABLED
Fri Jan  1 23:38:42 2016 us=478606   pkcs11_protected_authentication = DISABLED
Fri Jan  1 23:38:42 2016 us=478690   pkcs11_protected_authentication = DISABLED
Fri Jan  1 23:38:42 2016 us=478773   pkcs11_protected_authentication = DISABLED
Fri Jan  1 23:38:42 2016 us=478855   pkcs11_protected_authentication = DISABLED
Fri Jan  1 23:38:42 2016 us=478938   pkcs11_protected_authentication = DISABLED
Fri Jan  1 23:38:42 2016 us=479021   pkcs11_protected_authentication = DISABLED
Fri Jan  1 23:38:42 2016 us=479103   pkcs11_protected_authentication = DISABLED
Fri Jan  1 23:38:42 2016 us=479190   pkcs11_private_mode = 00000000
Fri Jan  1 23:38:42 2016 us=479273   pkcs11_private_mode = 00000000
Fri Jan  1 23:38:42 2016 us=479358   pkcs11_private_mode = 00000000
Fri Jan  1 23:38:42 2016 us=479441   pkcs11_private_mode = 00000000
Fri Jan  1 23:38:42 2016 us=479526   pkcs11_private_mode = 00000000
Fri Jan  1 23:38:42 2016 us=479650   pkcs11_private_mode = 00000000
Fri Jan  1 23:38:42 2016 us=479741   pkcs11_private_mode = 00000000
Fri Jan  1 23:38:42 2016 us=479826   pkcs11_private_mode = 00000000
Fri Jan  1 23:38:42 2016 us=479911   pkcs11_private_mode = 00000000
Fri Jan  1 23:38:42 2016 us=479994   pkcs11_private_mode = 00000000
Fri Jan  1 23:38:42 2016 us=480080   pkcs11_private_mode = 00000000
Fri Jan  1 23:38:42 2016 us=480165   pkcs11_private_mode = 00000000
Fri Jan  1 23:38:42 2016 us=480249   pkcs11_private_mode = 00000000
Fri Jan  1 23:38:42 2016 us=480332   pkcs11_private_mode = 00000000
Fri Jan  1 23:38:42 2016 us=480416   pkcs11_private_mode = 00000000
Fri Jan  1 23:38:42 2016 us=480500   pkcs11_private_mode = 00000000
Fri Jan  1 23:38:42 2016 us=480582   pkcs11_cert_private = DISABLED
Fri Jan  1 23:38:42 2016 us=480663   pkcs11_cert_private = DISABLED
Fri Jan  1 23:38:42 2016 us=480745   pkcs11_cert_private = DISABLED
Fri Jan  1 23:38:42 2016 us=480827   pkcs11_cert_private = DISABLED
Fri Jan  1 23:38:42 2016 us=480910   pkcs11_cert_private = DISABLED
Fri Jan  1 23:38:42 2016 us=480992   pkcs11_cert_private = DISABLED
Fri Jan  1 23:38:42 2016 us=481074   pkcs11_cert_private = DISABLED
Fri Jan  1 23:38:42 2016 us=481156   pkcs11_cert_private = DISABLED
Fri Jan  1 23:38:42 2016 us=481239   pkcs11_cert_private = DISABLED
Fri Jan  1 23:38:42 2016 us=481321   pkcs11_cert_private = DISABLED
Fri Jan  1 23:38:42 2016 us=481402   pkcs11_cert_private = DISABLED
Fri Jan  1 23:38:42 2016 us=481484   pkcs11_cert_private = DISABLED
Fri Jan  1 23:38:42 2016 us=481565   pkcs11_cert_private = DISABLED
Fri Jan  1 23:38:42 2016 us=481646   pkcs11_cert_private = DISABLED
Fri Jan  1 23:38:42 2016 us=481728   pkcs11_cert_private = DISABLED
Fri Jan  1 23:38:42 2016 us=481810   pkcs11_cert_private = DISABLED
Fri Jan  1 23:38:42 2016 us=481893   pkcs11_pin_cache_period = -1
Fri Jan  1 23:38:42 2016 us=481974   pkcs11_id = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=482056   pkcs11_id_management = DISABLED
Fri Jan  1 23:38:42 2016 us=482163   server_network = 10.8.0.0
Fri Jan  1 23:38:42 2016 us=482258   server_netmask = 255.255.255.0
Fri Jan  1 23:38:42 2016 us=482350   server_network_ipv6 = ::
Fri Jan  1 23:38:42 2016 us=482433   server_netbits_ipv6 = 0
Fri Jan  1 23:38:42 2016 us=482547   server_bridge_ip = 0.0.0.0
Fri Jan  1 23:38:42 2016 us=482663   server_bridge_netmask = 0.0.0.0
Fri Jan  1 23:38:42 2016 us=482756   server_bridge_pool_start = 0.0.0.0
Fri Jan  1 23:38:42 2016 us=482848   server_bridge_pool_end = 0.0.0.0
Fri Jan  1 23:38:42 2016 us=482931   push_entry = 'route 10.8.0.1 255.255.255.255'
Fri Jan  1 23:38:42 2016 us=483014   push_entry = 'route 10.8.0.0 255.255.255.0'
Fri Jan  1 23:38:42 2016 us=483096   push_entry = 'route 192.168.1.31 255.255.255.0'
Fri Jan  1 23:38:42 2016 us=483178   push_entry = 'route 192.168.1.1 255.255.255.0'
Fri Jan  1 23:38:42 2016 us=483261   push_entry = 'route 192.168.1.4 255.255.255.0'
Fri Jan  1 23:38:42 2016 us=483344   push_entry = 'dhcp-option DNS 192.168.1.1'
Fri Jan  1 23:38:42 2016 us=483427   push_entry = 'dhcp-option DNS 8.8.8.8'
Fri Jan  1 23:38:42 2016 us=483510   push_entry = 'dhcp-option DNS 8.8.4.4'
Fri Jan  1 23:38:42 2016 us=483594   push_entry = 'route 10.8.0.0 255.255.255.0'
Fri Jan  1 23:38:42 2016 us=483676   push_entry = 'topology net30'
Fri Jan  1 23:38:42 2016 us=483758   push_entry = 'ping 10'
Fri Jan  1 23:38:42 2016 us=483840   push_entry = 'ping-restart 120'
Fri Jan  1 23:38:42 2016 us=483924   ifconfig_pool_defined = ENABLED
Fri Jan  1 23:38:42 2016 us=484015   ifconfig_pool_start = 10.8.0.4
Fri Jan  1 23:38:42 2016 us=484106   ifconfig_pool_end = 10.8.0.251
Fri Jan  1 23:38:42 2016 us=484196   ifconfig_pool_netmask = 0.0.0.0
Fri Jan  1 23:38:42 2016 us=484279   ifconfig_pool_persist_filename = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=484362   ifconfig_pool_persist_refresh_freq = 600
Fri Jan  1 23:38:42 2016 us=484445   ifconfig_ipv6_pool_defined = DISABLED
Fri Jan  1 23:38:42 2016 us=484533   ifconfig_ipv6_pool_base = ::
Fri Jan  1 23:38:42 2016 us=484616   ifconfig_ipv6_pool_netbits = 0
Fri Jan  1 23:38:42 2016 us=484737   n_bcast_buf = 256
Fri Jan  1 23:38:42 2016 us=484823   tcp_queue_limit = 64
Fri Jan  1 23:38:42 2016 us=484904   real_hash_size = 256
Fri Jan  1 23:38:42 2016 us=484987   virtual_hash_size = 256
Fri Jan  1 23:38:42 2016 us=485069   client_connect_script = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=485151   learn_address_script = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=485233   client_disconnect_script = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=485315   client_config_dir = 'ccd'
Fri Jan  1 23:38:42 2016 us=485396   ccd_exclusive = DISABLED
Fri Jan  1 23:38:42 2016 us=485476   tmp_dir = '/tmp'
Fri Jan  1 23:38:42 2016 us=485558   push_ifconfig_defined = DISABLED
Fri Jan  1 23:38:42 2016 us=485648   push_ifconfig_local = 0.0.0.0
Fri Jan  1 23:38:42 2016 us=485739   push_ifconfig_remote_netmask = 0.0.0.0
Fri Jan  1 23:38:42 2016 us=485821   push_ifconfig_ipv6_defined = DISABLED
Fri Jan  1 23:38:42 2016 us=485911   push_ifconfig_ipv6_local = ::/0
Fri Jan  1 23:38:42 2016 us=485999   push_ifconfig_ipv6_remote = ::
Fri Jan  1 23:38:42 2016 us=486082   enable_c2c = ENABLED
Fri Jan  1 23:38:42 2016 us=486163   duplicate_cn = ENABLED
Fri Jan  1 23:38:42 2016 us=486243   cf_max = 0
Fri Jan  1 23:38:42 2016 us=486324   cf_per = 0
Fri Jan  1 23:38:42 2016 us=486404   max_clients = 1024
Fri Jan  1 23:38:42 2016 us=486486   max_routes_per_client = 256
Fri Jan  1 23:38:42 2016 us=486569   auth_user_pass_verify_script = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=486652   auth_user_pass_verify_script_via_file = DISABLED
Fri Jan  1 23:38:42 2016 us=486734   ssl_flags = 0
Fri Jan  1 23:38:42 2016 us=486815   port_share_host = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=486898   port_share_port = 0
Fri Jan  1 23:38:42 2016 us=486979   client = DISABLED
Fri Jan  1 23:38:42 2016 us=487060   pull = DISABLED
Fri Jan  1 23:38:42 2016 us=487142   auth_user_pass_file = '[UNDEF]'
Fri Jan  1 23:38:42 2016 us=487233 OpenVPN 2.2.1 arm-linux-gnueabihf [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec  1 2014
Fri Jan  1 23:38:42 2016 us=487879 WARNING: using --duplicate-cn and --client-config-dir together is probably not what you want
Fri Jan  1 23:38:42 2016 us=488465 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Fri Jan  1 23:38:42 2016 us=488602 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Fri Jan  1 23:38:42 2016 us=516412 Diffie-Hellman initialized with 1024 bit key
Fri Jan  1 23:38:42 2016 us=521489 Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVPN static key file
Fri Jan  1 23:38:42 2016 us=521627 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jan  1 23:38:42 2016 us=521703 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jan  1 23:38:42 2016 us=521783 TLS-Auth MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Fri Jan  1 23:38:42 2016 us=521896 Socket Buffers: R=[163840->131072] S=[163840->131072]
Fri Jan  1 23:38:42 2016 us=522539 ROUTE default_gateway=192.168.1.1
Fri Jan  1 23:38:42 2016 us=524061 TUN/TAP device tun0 opened
Fri Jan  1 23:38:42 2016 us=524219 TUN/TAP TX queue length set to 100
Fri Jan  1 23:38:42 2016 us=524338 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Jan  1 23:38:42 2016 us=524467 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Fri Jan  1 23:38:42 2016 us=540896 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Fri Jan  1 23:38:42 2016 us=546818 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Fri Jan  1 23:38:42 2016 us=552427 GID set to nogroup
Fri Jan  1 23:38:42 2016 us=552708 UID set to nobody
Fri Jan  1 23:38:42 2016 us=552890 UDPv4 link local (bound): [AF_INET]192.168.1.31:1194
Fri Jan  1 23:38:42 2016 us=553091 UDPv4 link remote: [undef]
Fri Jan  1 23:38:42 2016 us=553256 MULTI: multi_init called, r=256 v=256
Fri Jan  1 23:38:42 2016 us=553749 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Fri Jan  1 23:38:42 2016 us=554124 Initialization Sequence Completed
Fri Jan  1 23:39:48 2016 us=448056 MULTI: multi_create_instance called
Fri Jan  1 23:39:48 2016 us=448536 84.XX.24.151:56882 Re-using SSL/TLS context
Fri Jan  1 23:39:48 2016 us=448814 84.XX.24.151:56882 LZO compression initialized
Fri Jan  1 23:39:48 2016 us=450011 84.XX.24.151:56882 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Fri Jan  1 23:39:48 2016 us=450169 84.XX.24.151:56882 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Fri Jan  1 23:39:48 2016 us=450569 84.XX.24.151:56882 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Fri Jan  1 23:39:48 2016 us=450672 84.XX.24.151:56882 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Fri Jan  1 23:39:48 2016 us=450849 84.XX.24.151:56882 Local Options hash (VER=V4): 'a2e63101'
Fri Jan  1 23:39:48 2016 us=450983 84.XX.24.151:56882 Expected Remote Options hash (VER=V4): '272f1b58'
Fri Jan  1 23:39:48 2016 us=451212 84.XX.24.151:56882 TLS: Initial packet from [AF_INET]84.XX.24.151:56882, sid=7c679487 4885f076
Fri Jan  1 23:39:49 2016 us=107834 84.XX.24.151:56882 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/OU=changeme/CN=Server/name=Server/emailAddress=mail@host.domain
Fri Jan  1 23:39:49 2016 us=109626 84.XX.24.151:56882 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/OU=changeme/CN=phone/name=changeme/emailAddress=mail@host.domain
Fri Jan  1 23:39:49 2016 us=220916 84.XX.24.151:56882 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Fri Jan  1 23:39:49 2016 us=221144 84.XX.24.151:56882 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jan  1 23:39:49 2016 us=221256 84.XX.24.151:56882 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Fri Jan  1 23:39:49 2016 us=221366 84.XX.24.151:56882 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jan  1 23:39:49 2016 us=294384 84.XX.24.151:56882 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Fri Jan  1 23:39:49 2016 us=294648 84.XX.24.151:56882 [phone] Peer Connection Initiated with [AF_INET]84.XX.24.151:56882
Fri Jan  1 23:39:49 2016 us=294931 phone/84.XX.24.151:56882 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=1861:e054:4ef:e054:682e:c976:7c0b:d676
Fri Jan  1 23:39:49 2016 us=295263 phone/84.XX.24.151:56882 MULTI: Learn: 10.8.0.6 -> phone/84.XX.24.151:56882
Fri Jan  1 23:39:49 2016 us=295379 phone/84.XX.24.151:56882 MULTI: primary virtual IP for phone/84.XX.24.151:56882: 10.8.0.6
Fri Jan  1 23:39:50 2016 us=534936 phone/84.XX.24.151:56882 PUSH: Received control message: 'PUSH_REQUEST'
Fri Jan  1 23:39:50 2016 us=535180 phone/84.XX.24.151:56882 send_push_reply(): safe_cap=960
Fri Jan  1 23:39:50 2016 us=535514 phone/84.XX.24.151:56882 SENT CONTROL [phone]: 'PUSH_REPLY,route 10.8.0.1 255.255.255.255,route 10.8.0.0 255.255.255.0,route 192.168.1.31 255.255.255.0,route 192.168.1.1 255.255.255.0,route 192.168.1.4 255.255.255.0,dhcp-option DNS 192.168.1.1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

katorce

I don´t know why but I cannot connect when I do the ccd-exclusive.

I have add this line to the server.conf

client-config-dir /etc/openvpn/ccd
ccd-exclusive

Then I created the folder /etc/openvpn/ccd, and I created 4 files, with the exact name that I find in the openvpn-status.log, when they were connected (before the changes)

WIN4, WIN5, phone, ipad

WIN4, is the local one, the others are not the local ones. None of the machines can´t connect. The content inside of those files are:

WIN4:

ifconfig-push 10.8.0.10 10.8.0.11

WIN5 and ipad:

redirect-gateway def1

phone:

config /etc/openvpn/ccd/phone.config

The file phone.config exist and contains this:

client
dev tun
proto udp
remote xxx.yyy.org 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
key-direction 1
cipher AES-128-CBC
comp-lzo
verb 1
mute 20
redirect-gateway def1

None of the machines can´t connect, they give me a failure in the auth. And I do not know why. Of course everything works perfectly, if I go back to the previous setting.

I am wondering if maybe changing only in the server.conf the line

--redirect-gateway  def1

--redirect-gateway  autolocal

may solve my problems in a easy way, but I don´t really understand what the wiki says about this 🙁

Traffic

katorce wroteFri Jan 1 23:38:42 2016 us=468962 username = 'nobody'
Fri Jan 1 23:38:42 2016 us=469051 groupname = 'nogroup'

Try disabling these in your server config ..