Hi guys, have a weird problem here. I managed to get the server running and it works just fine. When I connect from an external ip, it is able to authenticate just fine; however, when I try to connect while I'm inside the house it doesn't connect. It gives me the below error: [code] Sun Jan 31 15:28:52 2016 192.168.0.102:54549 TLS Error: reading acknowledgement record from packet Sun Jan 31 15:28:54 2016 192.168.0.102:54549 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #2 / time = (1454272131) Sun Jan 31 15:28:51 2016 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings Sun Jan 31 15:28:54 2016 192.168.0.102:54549 TLS Error: incoming packet authentication failed from [AF_INET]192.168.0.102:54549 [/code] I suspect it's a router issue and not a server set up issue as I'm able to authenticate, connect, and use as expected. However, the weird part is that when I'm internally connected to the wifi I am not. Is this an issue with the router's routing or my server? Any ideas? [code] Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 0.0.0.0 192.168.0.1 0.0.0.0 UG 0 0 0 wlan0 10.9.0.0 10.9.0.2 255.255.255.0 UG 0 0 0 tun0 10.9.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 wlan0 [/code]

How does your client identify your server ?

You ask a good question ... though I don't know how to fix it; something with iptables? It identifies it through the public ip not the private ip. In lines with excerpt above, the server is running on .105 while the client is accessing it from .102.

Try using your private IP [.105] while inside your LAN.

You mean accessing it? If that's what you mean, yes I can access it.

I mean, as the parameter to --[b]remote[/b] ...

Ok just tested it and it looks like when I use the .105 address it still fails ... so maybe it's not a routing issue? Let me dig into my setup more. Feel free to offer suggestions etc

I expect that your router does not support [i]internal[/i] clients .. Do you have your server config file ?

That's why I kind of thought but not sure why or how it would block internal udp traffic Doing some google searches, it looks it may be due to some sort of replay error where they are saying that it is behaving like a replay attack. Below is the server conf [code] dev tun proto udp port 1194 ca /etc/openvpn/easy-rsa/keys/file here cert /etc/openvpn/easy-rsa/keys/file here key /etc/openvpn/easy-rsa/keys/file here dh /etc/openvpn/easy-rsa/keys/file here server 10.9.0.0 255.255.255.0 ifconfig 10.9.0.1 10.9.0.2 push "route 10.9.0.1 255.255.255.255" push "route 10.9.0.0 255.255.255.0" push "route 192.168.0.105 255.255.255.0" push "dhcp-option DNS 8.8.8.8" push "redirect-gateway def1" client-to-client duplicate-cn keepalive 10 120 tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0 cipher AES-256-CBC comp-lzo user nobody group nogroup persist-key persist-tun status /var/log/openvpn-status.log 20 log /var/log/openvpn.log verb 4 [/code]

[quote="casperpaul"]not sure why or how it would block internal udp traffic[/quote]It is called "looback" and my presumption is that your router does not support it .. which is very common for retail routers.

Any workaround for this? Ok if it is not known then let me see if I can figure out a workaround. I'll post it to this thread when I find it.

Connecting via external good, internal not good

casperpaul

Ok that makes sense. I will try that tonight and see what happens. I'll update you and this post the results. Thanks.

casperpaul

Ugh. Tried changing the network but it doesn't work. I think it's router specific because when I tried it on a different router it works. At this point I guess it's something to do with the internal router.

Traffic, you or any networking gurus out there know what may be the name of the blocking or non-routing?

If not, still wondering if there could be a workaround.

Traffic

For testing, try disabling the push "redirect-gateway def1" in your server, restart it and try reconnecting from your phone. Maybe we can find something ..

« Previous Page