client to client don't work

oscaroxy

I configure server (ip4 LAN 192.168.1.44) so:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.1.253 255.255.255.0"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

I stopped any iptables ... when I connect client to sever the access is correct, with openvpn I enter into server OpenVpn with LAN ip (that is 192.168.1.44) without openvpn connect I can't enter into 1.44. When I ping or ssh to 192.168.1.26 (other client into LAN) I obtain Operation timed out.
192.168.1.253 is the router into LAN.
Into 1.44 I ping 1.26 correctly, from my client ping and enter into 1.44 but not in any other client into LAN ...

How do I resolve?
thanks

Traffic

See the HOWTO:
HOWTO: Expanding the scope of the VPN to include additional machines

Also,

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

You are advised to change your server LAN to a more unique RFC1918 compliant subnet. f.e 192.168.143.0/24

Also, ensure IP forwarding is enabled on your server.

Please see the Forum rules (top of page)

oscaroxy

First of all thanks 😃

I know this, in fact the LAN is into 192.168.1.0/24 while the client is into 192.168.0.0/24.
The forwarding is correct and the 192.168.1.253 is the gateway.

Do I do to have reply in order to understand what happen?

for me is strange:

- into VPN Connection client go to 1.44 (server openvpn), but not go to 1.26
- out VPN Connection client don't go 1.44 and 1.26

thanks

Traffic

Because I do not understand what you are trying to say ..

This is important reading for you:

Traffic wroteSee the HOWTO:
HOWTO: Expanding the scope of the VPN to include additional machines

This is important reading for you:

Traffic wroteAlso, ensure IP forwarding is enabled on your server.

Traffic wrotePlease see the Forum rules (top of page)

Please read:

Post your configs from client and server
post your logfiles from server and client after using verb 4 in both configs

From your server config:

oscaroxy wrotepush "route 192.168.1.253 255.255.255.0"

change this to

push "route 192.168.1.0 255.255.255.0"

oscaroxy

thanks for the patience...

I follow your advice, I read all, but it seem correct, included forwarding.
I change route from 192.168.1.253 (gateway lan) to 192.168.1.0

My issue:
if I connect by VPN I can to go into 1.44 (server open vpn), but not into other client into LAN 192.168.1.0/24, and if I disconnect VPN I can't, rightly, to go not even into 1.44.
Why?

server.conf

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 4

client.conf

client

dev tun

proto udp

remote [redacted].com 1194

resolv-retry infinite

nobind

persist-key
persist-tun

ca ca.crt
cert client.crt
key client.key

remote-cert-tls server

comp-lzo

verb 4

client detail tunnelblinck

2016-03-18 17:31:02 OpenVPN 2.3.6 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Mar  2 2016
2016-03-18 17:31:02 library versions: OpenSSL 1.0.1s  1 Mar 2016, LZO 2.08
2016-03-18 17:31:02 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1337
2016-03-18 17:31:02 Need hold release from management interface, waiting...
2016-03-18 17:31:01 *Tunnelblick: OS X 10.10.5; Tunnelblick 3.5.8 (build 4270.4530); prior version 3.5.7 (build 4270.4517)
2016-03-18 17:31:01 *Tunnelblick: Attempting connection with salcef; Set nameserver = 1; monitoring connection
2016-03-18 17:31:01 *Tunnelblick: openvpnstart start salcef.tblk 1337 1 0 3 0 16688 -ptADGNWradsgnw 2.3.6
2016-03-18 17:31:03 *Tunnelblick: openvpnstart log:
     OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):
     
          /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3.6/openvpn
          --daemon
          --log
          /Library/Application Support/Tunnelblick/Logs/-SLibrary-SApplication Support-STunnelblick-SShared-Ssalcef.tblk-SContents-SResources-Sconfig.ovpn.1_0_3_0_16688.1337.openvpn.log
          --cd
          /Library/Application Support/Tunnelblick/Shared/salcef.tblk/Contents/Resources
          --config
          /Library/Application Support/Tunnelblick/Shared/salcef.tblk/Contents/Resources/config.ovpn
          --cd
          /Library/Application Support/Tunnelblick/Shared/salcef.tblk/Contents/Resources
          --management
          127.0.0.1
          1337
          --management-query-passwords
          --management-hold
          --script-security
          2
          --up
          /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -d -f -m -w -ptADGNWradsgnw
          --down
          /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -d -f -m -w -ptADGNWradsgnw

2016-03-18 17:31:01 *Tunnelblick: openvpnstart starting OpenVPN
2016-03-18 17:31:03 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1337
2016-03-18 17:31:03 *Tunnelblick: Established communication with OpenVPN
2016-03-18 17:31:03 MANAGEMENT: CMD 'pid'
2016-03-18 17:31:03 MANAGEMENT: CMD 'state on'
2016-03-18 17:31:03 MANAGEMENT: CMD 'state'
2016-03-18 17:31:03 MANAGEMENT: CMD 'bytecount 1'
2016-03-18 17:31:03 MANAGEMENT: CMD 'hold release'
2016-03-18 17:31:03 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2016-03-18 17:31:03 Socket Buffers: R=[196724->65536] S=[9216->65536]
2016-03-18 17:31:03 MANAGEMENT: >STATE:1458318663,RESOLVE,,,
2016-03-18 17:31:03 UDPv4 link local: [undef]
2016-03-18 17:31:03 UDPv4 link remote: [AF_INET][redacted]:1194
2016-03-18 17:31:03 MANAGEMENT: >STATE:1458318663,WAIT,,,
2016-03-18 17:31:03 MANAGEMENT: >STATE:1458318663,AUTH,,,
2016-03-18 17:31:03 TLS: Initial packet from [AF_INET][redacted]:1194, sid=cb103a62 b03a19f0
2016-03-18 17:31:03 VERIFY OK: depth=1, C=IT, ST=Italy, L=Roma, O=Salcef srl, OU=server, CN=Salcef srl CA, name=server, emailAddress=emanuele.asci@salcef.com
2016-03-18 17:31:03 Validating certificate key usage
2016-03-18 17:31:03 ++ Certificate has key usage  00a0, expects 00a0
2016-03-18 17:31:03 VERIFY KU OK
2016-03-18 17:31:03 Validating certificate extended key usage
2016-03-18 17:31:03 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2016-03-18 17:31:03 VERIFY EKU OK
2016-03-18 17:31:03 VERIFY OK: depth=0, C=IT, ST=Italy, L=Roma, O=Salcef srl, OU=server, CN=server, name=server, emailAddress=emanuele.asci@salcef.com
2016-03-18 17:31:03 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
2016-03-18 17:31:03 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2016-03-18 17:31:03 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
2016-03-18 17:31:03 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2016-03-18 17:31:03 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
2016-03-18 17:31:03 [server] Peer Connection Initiated with [AF_INET][redacted]:1194
2016-03-18 17:31:04 MANAGEMENT: >STATE:1458318664,GET_CONFIG,,,
2016-03-18 17:31:06 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
2016-03-18 17:31:06 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.50 10.8.0.49'
2016-03-18 17:31:06 OPTIONS IMPORT: timers and/or timeouts modified
2016-03-18 17:31:06 OPTIONS IMPORT: --ifconfig/up options modified
2016-03-18 17:31:06 OPTIONS IMPORT: route options modified
2016-03-18 17:31:06 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2016-03-18 17:31:06 Opened utun device utun0
2016-03-18 17:31:06 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
2016-03-18 17:31:06 MANAGEMENT: >STATE:1458318666,ASSIGN_IP,,10.8.0.50,
2016-03-18 17:31:06 /sbin/ifconfig utun0 delete
                                        ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2016-03-18 17:31:06 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2016-03-18 17:31:06 /sbin/ifconfig utun0 10.8.0.50 10.8.0.49 mtu 1500 netmask 255.255.255.255 up
2016-03-18 17:31:06 /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -d -f -m -w -ptADGNWradsgnw utun0 1500 1542 10.8.0.50 10.8.0.49 init
                                        **********************************************
                                        Start of output from client.up.tunnelblick.sh
                                        Retrieved from OpenVPN: name server(s) [ 8.8.8.8 8.8.4.4 ], search domain(s) [  ] and SMB server(s) [  ] and using default domain name [ openvpn ]
                                        Ignoring ServerAddresses '8.8.8.8 8.8.4.4' because ServerAddresses was set manually
                                        Setting search domains to 'openvpn' because running under OS X 10.6 or higher and the search domains were not set manually and 'Prepend domain name to search domains' was not selected
                                        Saved the DNS and SMB configurations so they can be restored
                                        Did not change DNS ServerAddresses setting of '8.8.8.8' (but re-set it)
                                        Changed DNS SearchDomains setting from '' to 'openvpn'
                                        Changed DNS DomainName setting from '' to 'openvpn'
                                        Did not change SMB NetBIOSName setting of ''
                                        Did not change SMB Workgroup setting of ''
                                        Did not change SMB WINSAddresses setting of ''
                                        DNS servers '8.8.8.8' were set manually
                                        DNS servers '8.8.8.8' will be used for DNS queries when the VPN is active
                                        The DNS servers include only free public DNS servers known to Tunnelblick.
                                        Flushed the DNS cache via dscacheutil
                                        /usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil
                                        Notified mDNSResponder that the DNS cache was flushed
                                        Setting up to monitor system configuration with process-network-changes
                                        End of output from client.up.tunnelblick.sh
                                        **********************************************
2016-03-18 17:31:09 MANAGEMENT: >STATE:1458318669,ADD_ROUTES,,,
2016-03-18 17:31:09 /sbin/route add -net 192.168.1.0 10.8.0.49 255.255.255.0
                                        add net 192.168.1.0: gateway 10.8.0.49
2016-03-18 17:31:09 /sbin/route add -net 10.8.0.0 10.8.0.49 255.255.255.0
                                        add net 10.8.0.0: gateway 10.8.0.49
2016-03-18 17:31:09 Initialization Sequence Completed
2016-03-18 17:31:09 MANAGEMENT: >STATE:1458318669,CONNECTED,SUCCESS,10.8.0.50,[redacted]
2016-03-18 17:31:09 *Tunnelblick: No 'connected.sh' script to execute
2016-03-18 17:31:14 *Tunnelblick: This computer's apparent public IP address ([redacted]) was unchanged after the connection was made
2016-03-18 17:31:17 *Tunnelblick process-network-changes: A system configuration change was ignored

/var/log/message

Mar 18 17:25:28 localhost openvpn[953]: Current Parameter Settings:
Mar 18 17:25:28 localhost openvpn[953]:   config = 'server.conf'
Mar 18 17:25:28 localhost openvpn[953]:   mode = 1
Mar 18 17:25:28 localhost openvpn[953]:   persist_config = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   persist_mode = 1
Mar 18 17:25:28 localhost openvpn[953]:   show_ciphers = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   show_digests = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   show_engines = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   genkey = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   key_pass_file = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   show_tls_ciphers = DISABLED
Mar 18 17:25:28 localhost openvpn[953]: Connection profiles [default]:
Mar 18 17:25:28 localhost openvpn[953]:   proto = udp
Mar 18 17:25:28 localhost openvpn[953]:   local = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   local_port = 1194
Mar 18 17:25:28 localhost openvpn[953]:   remote = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   remote_port = 1194
Mar 18 17:25:28 localhost openvpn[953]:   remote_float = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   bind_defined = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   bind_local = ENABLED
Mar 18 17:25:28 localhost openvpn[953]:   connect_retry_seconds = 5
Mar 18 17:25:28 localhost openvpn[953]:   connect_timeout = 10
Mar 18 17:25:28 localhost openvpn[953]:   connect_retry_max = 0
Mar 18 17:25:28 localhost openvpn[953]:   socks_proxy_server = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   socks_proxy_port = 0
Mar 18 17:25:28 localhost openvpn[953]:   socks_proxy_retry = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   tun_mtu = 1500
Mar 18 17:25:28 localhost openvpn[953]:   tun_mtu_defined = ENABLED
Mar 18 17:25:28 localhost openvpn[953]:   link_mtu = 1500
Mar 18 17:25:28 localhost openvpn[953]:   link_mtu_defined = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   tun_mtu_extra = 0
Mar 18 17:25:28 localhost openvpn[953]:   tun_mtu_extra_defined = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   mtu_discover_type = -1
Mar 18 17:25:28 localhost openvpn[953]:   fragment = 0
Mar 18 17:25:28 localhost openvpn[953]:   mssfix = 1450
Mar 18 17:25:28 localhost openvpn[953]:   explicit_exit_notification = 0
Mar 18 17:25:28 localhost openvpn[953]: Connection profiles END
Mar 18 17:25:28 localhost openvpn[953]:   remote_random = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   ipchange = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   dev = 'tun'
Mar 18 17:25:28 localhost openvpn[953]:   dev_type = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   dev_node = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   lladdr = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   topology = 1
Mar 18 17:25:28 localhost openvpn[953]:   tun_ipv6 = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   ifconfig_local = '10.8.0.1'
Mar 18 17:25:28 localhost openvpn[953]:   ifconfig_remote_netmask = '10.8.0.2'
Mar 18 17:25:28 localhost openvpn[953]:   ifconfig_noexec = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   ifconfig_nowarn = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   ifconfig_ipv6_local = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   ifconfig_ipv6_netbits = 0
Mar 18 17:25:28 localhost openvpn[953]:   ifconfig_ipv6_remote = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   shaper = 0
Mar 18 17:25:28 localhost openvpn[953]:   mtu_test = 0
Mar 18 17:25:28 localhost openvpn[953]:   mlock = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   keepalive_ping = 10
Mar 18 17:25:28 localhost openvpn[953]:   keepalive_timeout = 120
Mar 18 17:25:28 localhost openvpn[953]:   inactivity_timeout = 0
Mar 18 17:25:28 localhost openvpn[953]:   ping_send_timeout = 10
Mar 18 17:25:28 localhost openvpn[953]:   ping_rec_timeout = 240
Mar 18 17:25:28 localhost openvpn[953]:   ping_rec_timeout_action = 2
Mar 18 17:25:28 localhost openvpn[953]:   ping_timer_remote = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   remap_sigusr1 = 0
Mar 18 17:25:28 localhost openvpn[953]:   persist_tun = ENABLED
Mar 18 17:25:28 localhost openvpn[953]:   persist_local_ip = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   persist_remote_ip = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   persist_key = ENABLED
Mar 18 17:25:28 localhost openvpn[953]:   passtos = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   resolve_retry_seconds = 1000000000
Mar 18 17:25:28 localhost openvpn[953]:   username = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   groupname = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   chroot_dir = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   cd_dir = '/etc/openvpn'
Mar 18 17:25:28 localhost openvpn[953]:   writepid = '/var/run/openvpn/server.pid'
Mar 18 17:25:28 localhost openvpn[953]:   up_script = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   down_script = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   down_pre = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   up_restart = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   up_delay = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   daemon = ENABLED
Mar 18 17:25:28 localhost openvpn[953]:   inetd = 0
Mar 18 17:25:28 localhost openvpn[953]:   log = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   suppress_timestamps = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   nice = 0
Mar 18 17:25:28 localhost openvpn[953]:   verbosity = 4
Mar 18 17:25:28 localhost openvpn[953]:   mute = 0
Mar 18 17:25:28 localhost openvpn[953]:   gremlin = 0
Mar 18 17:25:28 localhost openvpn[953]:   status_file = 'openvpn-status.log'
Mar 18 17:25:28 localhost openvpn[953]:   status_file_version = 1
Mar 18 17:25:28 localhost openvpn[953]:   status_file_update_freq = 60
Mar 18 17:25:28 localhost openvpn[953]:   occ = ENABLED
Mar 18 17:25:28 localhost openvpn[953]:   rcvbuf = 65536
Mar 18 17:25:28 localhost openvpn[953]:   sndbuf = 65536
Mar 18 17:25:28 localhost openvpn[953]:   mark = 0
Mar 18 17:25:28 localhost openvpn[953]:   sockflags = 0
Mar 18 17:25:28 localhost openvpn[953]:   fast_io = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   lzo = 7
Mar 18 17:25:28 localhost openvpn[953]:   route_script = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   route_default_gateway = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   route_default_metric = 0
Mar 18 17:25:28 localhost openvpn[953]:   route_noexec = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   route_delay = 0
Mar 18 17:25:28 localhost openvpn[953]:   route_delay_window = 30
Mar 18 17:25:28 localhost openvpn[953]:   route_delay_defined = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   route_nopull = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   route_gateway_via_dhcp = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   max_routes = 100
Mar 18 17:25:28 localhost openvpn[953]:   allow_pull_fqdn = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   route 10.8.0.0/255.255.255.0/nil/nil
Mar 18 17:25:28 localhost openvpn[953]:   management_addr = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   management_port = 0
Mar 18 17:25:28 localhost openvpn[953]:   management_user_pass = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   management_log_history_cache = 250
Mar 18 17:25:28 localhost openvpn[953]:   management_echo_buffer_size = 100
Mar 18 17:25:28 localhost openvpn[953]:   management_write_peer_info_file = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   management_client_user = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   management_client_group = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   management_flags = 0
Mar 18 17:25:28 localhost openvpn[953]:   shared_secret_file = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   key_direction = 0
Mar 18 17:25:28 localhost openvpn[953]:   ciphername_defined = ENABLED
Mar 18 17:25:28 localhost openvpn[953]:   ciphername = 'BF-CBC'
Mar 18 17:25:28 localhost openvpn[953]:   authname_defined = ENABLED
Mar 18 17:25:28 localhost openvpn[953]:   authname = 'SHA1'
Mar 18 17:25:28 localhost openvpn[953]:   prng_hash = 'SHA1'
Mar 18 17:25:28 localhost openvpn[953]:   prng_nonce_secret_len = 16
Mar 18 17:25:28 localhost openvpn[953]:   keysize = 0
Mar 18 17:25:28 localhost openvpn[953]:   engine = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   replay = ENABLED
Mar 18 17:25:28 localhost openvpn[953]:   mute_replay_warnings = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   replay_window = 64
Mar 18 17:25:28 localhost openvpn[953]:   replay_time = 15
Mar 18 17:25:28 localhost openvpn[953]:   packet_id_file = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   use_iv = ENABLED
Mar 18 17:25:28 localhost openvpn[953]:   test_crypto = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   tls_server = ENABLED
Mar 18 17:25:28 localhost openvpn[953]:   tls_client = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   key_method = 2
Mar 18 17:25:28 localhost openvpn[953]:   ca_file = 'ca.crt'
Mar 18 17:25:28 localhost openvpn[953]:   ca_path = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   dh_file = 'dh2048.pem'
Mar 18 17:25:28 localhost openvpn[953]:   cert_file = 'server.crt'
Mar 18 17:25:28 localhost openvpn[953]:   priv_key_file = 'server.key'
Mar 18 17:25:28 localhost openvpn[953]:   pkcs12_file = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   cipher_list = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   tls_verify = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   tls_export_cert = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   verify_x509_type = 0
Mar 18 17:25:28 localhost openvpn[953]:   verify_x509_name = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   crl_file = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   ns_cert_type = 0
Mar 18 17:25:28 localhost openvpn[953]:   remote_cert_ku[i] = 0
Mar 18 17:25:28 localhost openvpn[953]:   remote_cert_ku[i] = 0
Mar 18 17:25:28 localhost openvpn[953]:   remote_cert_ku[i] = 0
Mar 18 17:25:28 localhost openvpn[953]:   remote_cert_ku[i] = 0
Mar 18 17:25:28 localhost openvpn[953]:   remote_cert_ku[i] = 0
Mar 18 17:25:28 localhost openvpn[953]:   remote_cert_ku[i] = 0
Mar 18 17:25:28 localhost openvpn[953]:   remote_cert_ku[i] = 0
Mar 18 17:25:28 localhost openvpn[953]:   remote_cert_ku[i] = 0
Mar 18 17:25:28 localhost openvpn[953]:   remote_cert_ku[i] = 0
Mar 18 17:25:28 localhost openvpn[953]:   remote_cert_ku[i] = 0
Mar 18 17:25:28 localhost openvpn[953]:   remote_cert_ku[i] = 0
Mar 18 17:25:28 localhost openvpn[953]:   remote_cert_ku[i] = 0
Mar 18 17:25:28 localhost openvpn[953]:   remote_cert_ku[i] = 0
Mar 18 17:25:28 localhost openvpn[953]:   remote_cert_ku[i] = 0
Mar 18 17:25:28 localhost openvpn[953]:   remote_cert_ku[i] = 0
Mar 18 17:25:28 localhost openvpn[953]:   remote_cert_ku[i] = 0
Mar 18 17:25:28 localhost openvpn[953]:   remote_cert_eku = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   ssl_flags = 0
Mar 18 17:25:28 localhost openvpn[953]:   tls_timeout = 2
Mar 18 17:25:28 localhost openvpn[953]:   renegotiate_bytes = 0
Mar 18 17:25:28 localhost openvpn[953]:   renegotiate_packets = 0
Mar 18 17:25:28 localhost openvpn[953]:   renegotiate_seconds = 3600
Mar 18 17:25:28 localhost openvpn[953]:   handshake_window = 60
Mar 18 17:25:28 localhost openvpn[953]:   transition_window = 3600
Mar 18 17:25:28 localhost openvpn[953]:   single_session = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   push_peer_info = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   tls_exit = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   tls_auth_file = '[UNDEF]'
Mar 18 17:25:28 localhost openvpn[953]:   pkcs11_protected_authentication = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   pkcs11_protected_authentication = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   pkcs11_protected_authentication = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   pkcs11_protected_authentication = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   pkcs11_protected_authentication = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   pkcs11_protected_authentication = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   pkcs11_protected_authentication = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   pkcs11_protected_authentication = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   pkcs11_protected_authentication = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   pkcs11_protected_authentication = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   pkcs11_protected_authentication = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   pkcs11_protected_authentication = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   pkcs11_protected_authentication = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   pkcs11_protected_authentication = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   pkcs11_protected_authentication = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   pkcs11_protected_authentication = DISABLED
Mar 18 17:25:28 localhost openvpn[953]:   pkcs11_private_mode = 00000000
Mar 18 17:25:28 localhost openvpn[953]:   pkcs11_private_mode = 00000000
Mar 18 17:25:28 localhost openvpn[953]:   pkcs11_private_mode = 00000000
Mar 18 17:25:28 localhost openvpn[953]:   pkcs11_private_mode = 00000000
Mar 18 17:25:28 localhost openvpn[953]:   pkcs11_private_mode = 00000000
Mar 18 17:25:28 localhost rsyslogd-2177: imuxsock begins to drop messages from pid 953 due to rate-limiting
Mar 18 17:25:28 localhost openvpn[954]: NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Mar 18 17:25:28 localhost openvpn[954]: Diffie-Hellman initialized with 2048 bit key
Mar 18 17:25:28 localhost openvpn[954]: TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:3 ]
Mar 18 17:25:28 localhost openvpn[954]: Socket Buffers: R=[124928->131072] S=[124928->131072]
Mar 18 17:25:28 localhost openvpn[954]: ROUTE_GATEWAY 192.168.1.253/255.255.255.0 IFACE=eth0 HWADDR=00:15:5d:01:4c:25
Mar 18 17:25:28 localhost openvpn[954]: TUN/TAP device tun0 opened
Mar 18 17:25:28 localhost openvpn[954]: TUN/TAP TX queue length set to 100
Mar 18 17:25:28 localhost kernel: tun0: Disabled Privacy Extensions
Mar 18 17:25:28 localhost openvpn[954]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mar 18 17:25:28 localhost openvpn[954]: /sbin/ip link set dev tun0 up mtu 1500
Mar 18 17:25:28 localhost openvpn[954]: /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Mar 18 17:25:28 localhost openvpn[954]: /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Mar 18 17:25:28 localhost openvpn[954]: Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
Mar 18 17:25:28 localhost openvpn[954]: UDPv4 link local (bound): [undef]
Mar 18 17:25:28 localhost openvpn[954]: UDPv4 link remote: [undef]
Mar 18 17:25:28 localhost openvpn[954]: MULTI: multi_init called, r=256 v=256
Mar 18 17:25:28 localhost openvpn[954]: IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Mar 18 17:25:28 localhost openvpn[954]: ifconfig_pool_read(), in='emanuele.asci,10.8.0.48', TODO: IPv6
Mar 18 17:25:28 localhost openvpn[954]: succeeded -> ifconfig_pool_set()
Mar 18 17:25:28 localhost openvpn[954]: IFCONFIG POOL LIST
Mar 18 17:25:28 localhost openvpn[954]: emanuele.asci,10.8.0.48
Mar 18 17:25:28 localhost openvpn[954]: Initialization Sequence Completed
Mar 18 17:25:29 localhost ntpd[1004]: ntpd 4.2.6p5@1.2349-o Fri Jul 24 10:56:17 UTC 2015 (1)
Mar 18 17:25:29 localhost ntpd[1005]: proto: precision = 0.900 usec
Mar 18 17:25:29 localhost ntpd[1005]: 0.0.0.0 c01d 0d kern kernel time sync enabled
Mar 18 17:25:29 localhost ntpd[1005]: Listen and drop on 0 v4wildcard 0.0.0.0 UDP 123
Mar 18 17:25:29 localhost ntpd[1005]: Listen and drop on 1 v6wildcard :: UDP 123
Mar 18 17:25:29 localhost ntpd[1005]: Listen normally on 2 lo 127.0.0.1 UDP 123
Mar 18 17:25:29 localhost ntpd[1005]: Listen normally on 3 eth0 192.168.1.44 UDP 123
Mar 18 17:25:29 localhost ntpd[1005]: Listen normally on 4 tun0 10.8.0.1 UDP 123
Mar 18 17:25:29 localhost ntpd[1005]: Listen normally on 5 eth0 fe80::215:5dff:fe01:4c25 UDP 123
Mar 18 17:25:29 localhost ntpd[1005]: Listen normally on 6 lo ::1 UDP 123
Mar 18 17:25:29 localhost ntpd[1005]: Listening on routing socket on fd #23 for interface updates
Mar 18 17:25:29 localhost ntpd[1005]: 0.0.0.0 c016 06 restart
Mar 18 17:25:29 localhost ntpd[1005]: 0.0.0.0 c012 02 freq_set kernel 16.718 PPM
Mar 18 17:23:00 localhost ntpd[1005]: 0.0.0.0 c61c 0c clock_step -149.976163 s
Mar 18 17:23:00 localhost ntpd[1005]: 0.0.0.0 c614 04 freq_mode
Mar 18 17:23:01 localhost ntpd[1005]: 0.0.0.0 c618 08 no_sys_peer
Mar 18 17:25:36 localhost ntpd[1005]: 0.0.0.0 c628 08 no_sys_peer
Mar 18 17:26:52 localhost openvpn[954]: MULTI: multi_create_instance called
Mar 18 17:26:52 localhost openvpn[954]: [redacted]:54320 Re-using SSL/TLS context
Mar 18 17:26:52 localhost openvpn[954]: [redacted]:54320 LZO compression initialized
Mar 18 17:26:52 localhost openvpn[954]: [redacted]:54320 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:3 ]
Mar 18 17:26:52 localhost openvpn[954]: [redacted]:54320 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
Mar 18 17:26:52 localhost openvpn[954]: [redacted]:54320 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mar 18 17:26:52 localhost openvpn[954]: [redacted]:54320 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mar 18 17:26:52 localhost openvpn[954]: [redacted]:54320 Local Options hash (VER=V4): '530fdded'
Mar 18 17:26:52 localhost openvpn[954]: [redacted]:54320 Expected Remote Options hash (VER=V4): '41690919'
Mar 18 17:26:52 localhost openvpn[954]: [redacted]:54320 TLS: Initial packet from [AF_INET][redacted]:54320, sid=15c7840b 239e46a4
Mar 18 17:26:52 localhost openvpn[954]: [redacted]:54320 VERIFY OK: depth=1, C=IT, ST=Italy, L=Roma, O=Salcef srl, OU=server, CN=Salcef srl CA, name=server, emailAddress=emanuele.asci@salcef.com
Mar 18 17:26:52 localhost openvpn[954]: [redacted]:54320 VERIFY OK: depth=0, C=IT, ST=Italy, L=Roma, O=Salcef srl, OU=server, CN=emanuele.asci, name=server, emailAddress=emanuele.asci@salcef.com
Mar 18 17:26:52 localhost openvpn[954]: [redacted]:54320 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mar 18 17:26:52 localhost openvpn[954]: [redacted]:54320 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar 18 17:26:52 localhost openvpn[954]: [redacted]:54320 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mar 18 17:26:52 localhost openvpn[954]: [redacted]:54320 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar 18 17:26:52 localhost openvpn[954]: [redacted]:54320 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mar 18 17:26:52 localhost openvpn[954]: [redacted]:54320 [emanuele.asci] Peer Connection Initiated with [AF_INET][redacted]:54320
Mar 18 17:26:52 localhost openvpn[954]: emanuele.asci/[redacted]:54320 MULTI_sva: pool returned IPv4=10.8.0.50, IPv6=(Not enabled)
Mar 18 17:26:52 localhost openvpn[954]: emanuele.asci/[redacted]:54320 MULTI: Learn: 10.8.0.50 -> emanuele.asci/[redacted]:54320
Mar 18 17:26:52 localhost openvpn[954]: emanuele.asci/[redacted]:54320 MULTI: primary virtual IP for emanuele.asci/[redacted]:54320: 10.8.0.50
Mar 18 17:26:55 localhost openvpn[954]: emanuele.asci/[redacted]:54320 PUSH: Received control message: 'PUSH_REQUEST'
Mar 18 17:26:55 localhost openvpn[954]: emanuele.asci/[redacted]:54320 send_push_reply(): safe_cap=940
Mar 18 17:26:55 localhost openvpn[954]: emanuele.asci/[redacted]:54320 SENT CONTROL [emanuele.asci]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.50 10.8.0.49' (status=1)
Mar 18 17:33:33 localhost openvpn[954]: MULTI: multi_create_instance called
Mar 18 17:33:33 localhost openvpn[954]: [redacted]:54490 Re-using SSL/TLS context
Mar 18 17:33:33 localhost openvpn[954]: [redacted]:54490 LZO compression initialized
Mar 18 17:33:33 localhost openvpn[954]: [redacted]:54490 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:3 ]
Mar 18 17:33:33 localhost openvpn[954]: [redacted]:54490 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
Mar 18 17:33:33 localhost openvpn[954]: [redacted]:54490 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mar 18 17:33:33 localhost openvpn[954]: [redacted]:54490 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mar 18 17:33:33 localhost openvpn[954]: [redacted]:54490 Local Options hash (VER=V4): '530fdded'
Mar 18 17:33:33 localhost openvpn[954]: [redacted]:54490 Expected Remote Options hash (VER=V4): '41690919'
Mar 18 17:33:33 localhost openvpn[954]: [redacted]:54490 TLS: Initial packet from [AF_INET][redacted]:54490, sid=2a109302 dd6ba320
Mar 18 17:33:33 localhost openvpn[954]: [redacted]:54490 VERIFY OK: depth=1, C=IT, ST=Italy, L=Roma, O=Salcef srl, OU=server, CN=Salcef srl CA, name=server, emailAddress=emanuele.asci@salcef.com
Mar 18 17:33:33 localhost openvpn[954]: [redacted]:54490 VERIFY OK: depth=0, C=IT, ST=Italy, L=Roma, O=Salcef srl, OU=server, CN=emanuele.asci, name=server, emailAddress=emanuele.asci@salcef.com
Mar 18 17:33:33 localhost openvpn[954]: [redacted]:54490 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mar 18 17:33:33 localhost openvpn[954]: [redacted]:54490 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar 18 17:33:33 localhost openvpn[954]: [redacted]:54490 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mar 18 17:33:33 localhost openvpn[954]: [redacted]:54490 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar 18 17:33:33 localhost openvpn[954]: [redacted]:54490 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mar 18 17:33:33 localhost openvpn[954]: [redacted]:54490 [emanuele.asci] Peer Connection Initiated with [AF_INET][redacted]:54490
Mar 18 17:33:33 localhost openvpn[954]: MULTI: new connection by client 'emanuele.asci' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Mar 18 17:33:33 localhost openvpn[954]: MULTI_sva: pool returned IPv4=10.8.0.50, IPv6=(Not enabled)
Mar 18 17:33:33 localhost openvpn[954]: MULTI: Learn: 10.8.0.50 -> emanuele.asci/[redacted]:54490
Mar 18 17:33:33 localhost openvpn[954]: MULTI: primary virtual IP for emanuele.asci/[redacted]:54490: 10.8.0.50
Mar 18 17:33:36 localhost openvpn[954]: emanuele.asci/[redacted]:54490 PUSH: Received control message: 'PUSH_REQUEST'
Mar 18 17:33:36 localhost openvpn[954]: emanuele.asci/[redacted]:54490 send_push_reply(): safe_cap=940
Mar 18 17:33:36 localhost openvpn[954]: emanuele.asci/[redacted]:54490 SENT CONTROL [emanuele.asci]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.50 10.8.0.49' (status=1)

Traffic

Please also see this HOWTO:
HOWTO: Routing all client traffic (including web-traffic) through the VPN

oscaroxy

I read, but nothing...
Why do the connect is right but don't go client-to-client and Client enter into openvpn server (ip LAN 1.44)????

where Do I mistake?

is there a way in order to understand the trip?

Traffic

Normally:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

oscaroxy wroteis there a way in order to understand the trip?

Read the entire HOWTO carefully ..

oscaroxy

I wrote

oscaroxy wrote I stopped any iptables ...

You are a genius ... It was the iptables without NAT how do it work?????

the key:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

thanks a lot my hero, I'm very grateful for your big patience