Strange: MULTI: bad source address from client

john_es

My config and logs are below.

I am seeing a couple of weird things... first, on Windows 10x64, I don't have ipv6 enabled anywhere, yet I kept getting lots of MULTI: bad source address from client [MYPUBIP], packet dropped errors that had the ipv6 address noted. I solved this by going to Network Connections, selecting the TAP-Windows Adapter v9 and unchecking ipv6 in Properties.
Question: Should that be necessary? is there a better alternative?

Secondly, when I connect to UDP VPN from my android client, I see a lot of Tue Mar 22 11:52:43 2016 us=181521 user1-street-phone/PUBLICIP:18199 MULTI: bad source address from client [MYPUBIP], packet dropped errors.
Question: I am wondering how to solve this.

iptables rules

sudo iptables -F
sudo iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -s 10.0.8.0/24 -j ACCEPT
sudo iptables -A FORWARD -s 10.0.9.0/24 -j ACCEPT
sudo iptables -A FORWARD -j REJECT
sudo iptables -t nat -A POSTROUTING -s 10.0.8.0/24 -o eth0 -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -s 10.0.9.0/24 -o eth0 -j MASQUERADE

log

Tue Mar 22 11:51:54 2016 us=306287 PUBLICIP:18196 Validating certificate extended key usage
Tue Mar 22 11:51:54 2016 us=306976 PUBLICIP:18196 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Tue Mar 22 11:51:54 2016 us=307642 PUBLICIP:18196 VERIFY EKU OK
Tue Mar 22 11:51:54 2016 us=308283 PUBLICIP:18196 VERIFY OK: depth=0, C=US, ST=MI, L=NewYork, O=MyVPNN, OU=Office, CN=user1-street-phone, name=user1-street-phone, emailAddress=cert@mydomain.com
Tue Mar 22 11:51:58 2016 us=500431 PUBLICIP:18196 PID_ERR replay [0] [TLS_AUTH-0] [446666999_9>>>>_>>_>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>EEE] 1458661897:63 1458661897:63 t=1458661918[0] r=[-4,64,15,1,1] sl=[1,63,64,272]
Tue Mar 22 11:51:58 2016 us=511767 PUBLICIP:18196 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #63 / time = (1458661897) Tue Mar 22 11:51:37 2016 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Tue Mar 22 11:51:58 2016 us=512395 PUBLICIP:18196 TLS Error: incoming packet authentication failed from [AF_INET]PUBLICIP:18196
Tue Mar 22 11:51:58 2016 us=753171 PUBLICIP:55743 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue Mar 22 11:51:58 2016 us=764959 PUBLICIP:55743 TLS Error: TLS handshake failed
Tue Mar 22 11:51:58 2016 us=766482 PUBLICIP:55743 SIGUSR1[soft,tls-error] received, client-instance restarting
Tue Mar 22 11:52:11 2016 us=693240 MULTI: multi_create_instance called
Tue Mar 22 11:52:11 2016 us=693877 PUBLICIP:18199 Re-using SSL/TLS context
Tue Mar 22 11:52:11 2016 us=694220 PUBLICIP:18199 LZO compression initialized
Tue Mar 22 11:52:11 2016 us=696693 PUBLICIP:18199 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Mar 22 11:52:11 2016 us=698171 PUBLICIP:18199 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Mar 22 11:52:11 2016 us=701394 PUBLICIP:18199 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Tue Mar 22 11:52:11 2016 us=702929 PUBLICIP:18199 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Tue Mar 22 11:52:11 2016 us=704591 PUBLICIP:18199 Local Options hash (VER=V4): '162b04de'
Tue Mar 22 11:52:11 2016 us=712551 PUBLICIP:18199 Expected Remote Options hash (VER=V4): '9e7066d2'
Tue Mar 22 11:52:11 2016 us=714195 PUBLICIP:18199 TLS: Initial packet from [AF_INET]PUBLICIP:18199, sid=132dbd96 ea4f0691
Tue Mar 22 11:52:17 2016 us=149293 PUBLICIP:18199 PID_ERR replay [0] [TLS_AUTH-0] [666] 1458661928:3 1458661928:3 t=1458661937[0] r=[0,64,15,0,1] sl=[61,3,64,272]
Tue Mar 22 11:52:17 2016 us=150919 PUBLICIP:18199 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #3 / time = (1458661928) Tue Mar 22 11:52:08 2016 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Tue Mar 22 11:52:17 2016 us=152506 PUBLICIP:18199 TLS Error: incoming packet authentication failed from [AF_INET]PUBLICIP:18199
Tue Mar 22 11:52:31 2016 us=107862 PUBLICIP:18199 VERIFY OK: depth=1, C=US, ST=MI, L=NewYork, O=MyVPNN, OU=Office, CN=MyVPNN-CA, name=OpenVPN-CA, emailAddress=cert@mydomain.com
Tue Mar 22 11:52:31 2016 us=120107 PUBLICIP:18199 Validating certificate key usage
Tue Mar 22 11:52:31 2016 us=134904 PUBLICIP:18199 ++ Certificate has key usage 0080, expects 0080
Tue Mar 22 11:52:31 2016 us=136291 PUBLICIP:18199 VERIFY KU OK
Tue Mar 22 11:52:31 2016 us=137649 PUBLICIP:18199 Validating certificate extended key usage
Tue Mar 22 11:52:31 2016 us=139456 PUBLICIP:18199 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Tue Mar 22 11:52:31 2016 us=140665 PUBLICIP:18199 VERIFY EKU OK
Tue Mar 22 11:52:31 2016 us=141753 PUBLICIP:18199 VERIFY OK: depth=0, C=US, ST=MI, L=NewYork, O=MyVPNN, OU=Office, CN=user1-street-phone, name=user1-street-phone, emailAddress=cert@mydomain.com
Tue Mar 22 11:52:35 2016 us=327146 PUBLICIP:18199 PID_ERR replay [0] [TLS_AUTH-0] [44666667777777777777799>>__>>>>>>>>>>>>>>EEEEEEEEEEEEEEEEEEEEEEE] 1458661928:64 1458661928:64 t=1458661955[0] r=[0,64,15,0,1] sl=[0,64,64,272]
Tue Mar 22 11:52:35 2016 us=328631 PUBLICIP:18199 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #64 / time = (1458661928) Tue Mar 22 11:52:08 2016 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Tue Mar 22 11:52:35 2016 us=329993 PUBLICIP:18199 TLS Error: incoming packet authentication failed from [AF_INET]PUBLICIP:18199
Tue Mar 22 11:52:35 2016 us=428985 PUBLICIP:18199 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Mar 22 11:52:35 2016 us=430336 PUBLICIP:18199 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 22 11:52:35 2016 us=431510 PUBLICIP:18199 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Mar 22 11:52:35 2016 us=432699 PUBLICIP:18199 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 22 11:52:35 2016 us=538990 PUBLICIP:18199 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Mar 22 11:52:35 2016 us=554771 PUBLICIP:18199 [user1-street-phone] Peer Connection Initiated with [AF_INET]PUBLICIP:18199
Tue Mar 22 11:52:35 2016 us=557360 MULTI: new connection by client 'user1-street-phone' will cause previous active sessions by this client to be dropped. Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Tue Mar 22 11:52:35 2016 us=558741 MULTI_sva: pool returned IPv4=10.0.9.6, IPv6=(Not enabled)
Tue Mar 22 11:52:35 2016 us=560352 MULTI: Learn: 10.0.9.6 -> user1-street-phone/PUBLICIP:18199
Tue Mar 22 11:52:35 2016 us=561655 MULTI: primary virtual IP for user1-street-phone/PUBLICIP:18199: 10.0.9.6
Tue Mar 22 11:52:35 2016 us=563404 user1-street-phone/PUBLICIP:18199 PUSH: Received control message: 'PUSH_REQUEST'
Tue Mar 22 11:52:35 2016 us=564750 user1-street-phone/PUBLICIP:18199 send_push_reply(): safe_cap=940
Tue Mar 22 11:52:35 2016 us=566336 user1-street-phone/PUBLICIP:18199 SENT CONTROL [user1-street-phone]: 'PUSH_REPLY,route 10.0.0.0 255.255.255.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.0.9.1,topology net30,ping 10,ping-restart 120,ifconfig 10.0.9.6 10.0.9.5' (status=1)
Tue Mar 22 11:52:36 2016 us=60817 user1-street-phone/PUBLICIP:18199 MULTI: bad source address from client [MYPUBIP], packet dropped
Tue Mar 22 11:52:36 2016 us=140022 user1-street-phone/PUBLICIP:18199 MULTI: bad source address from client [MYPUBIP], packet dropped
Tue Mar 22 11:52:36 2016 us=179800 user1-street-phone/PUBLICIP:18199 MULTI: bad source address from client [MYPUBIP], packet dropped
Tue Mar 22 11:52:36 2016 us=415269 user1-street-phone/PUBLICIP:18199 MULTI: bad source address from client [MYPUBIP], packet dropped
Tue Mar 22 11:52:36 2016 us=973465 user1-street-phone/PUBLICIP:18199 MULTI: bad source address from client [MYPUBIP], packet dropped
Tue Mar 22 11:52:38 2016 us=93967 user1-street-phone/PUBLICIP:18199 MULTI: bad source address from client [MYPUBIP], packet dropped
Tue Mar 22 11:52:40 2016 us=352096 user1-street-phone/PUBLICIP:18199 MULTI: bad source address from client [MYPUBIP], packet dropped
Tue Mar 22 11:52:42 2016 us=404778 user1-street-phone/PUBLICIP:18199 MULTI: bad source address from client [MYPUBIP], packet dropped
Tue Mar 22 11:52:42 2016 us=653890 user1-street-phone/PUBLICIP:18199 MULTI: bad source address from client [MYPUBIP], packet dropped
Tue Mar 22 11:52:43 2016 us=181521 user1-street-phone/PUBLICIP:18199 MULTI: bad source address from client [MYPUBIP], packet dropped
Tue Mar 22 11:52:46 2016 us=309105 user1-street-phone/PUBLICIP:18199 MULTI: bad source address from client [MYPUBIP], packet dropped
Tue Mar 22 11:52:51 2016 us=160205 user1-street-phone/PUBLICIP:18199 MULTI: bad source address from client [MYPUBIP], packet dropped
Tue Mar 22 11:52:53 2016 us=917833 user1-street-phone/PUBLICIP:18199 MULTI: bad source address from client [MYPUBIP], packet dropped
Tue Mar 22 11:52:58 2016 us=827860 user1-street-phone/PUBLICIP:18199 MULTI: bad source address from client [MYPUBIP], packet dropped
Tue Mar 22 11:53:01 2016 us=68999 user1-street-phone/PUBLICIP:18199 MULTI: bad source address from client [MYPUBIP], packet dropped
Tue Mar 22 11:53:01 2016 us=69700 user1-street-phone/PUBLICIP:18199 MULTI: bad source address from client [MYPUBIP], packet dropped
Tue Mar 22 11:53:01 2016 us=316931 user1-street-phone/PUBLICIP:18199 MULTI: bad source address from client [MYPUBIP], packet dropped
Tue

server-udp.conf

port 1194
proto udp
dev tun
ca ca.crt
cert MyVPNNServer.crt
key MyVPNNServer.key
dh dh4096.pem
server 10.0.9.0 255.255.255.0
ifconfig-pool-persist ipp-udp.txt
push "route 10.0.0.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
tls-auth ta.key 0
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA
cipher AES-256-CBC
comp-lzo
max-clients 10
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status-udp.log
log-append openvpn-udp.log
verb 4
mode server
tls-server
remote-cert-tls client

server-tcp.conf

port 1195
proto tcp
dev tun
ca ca.crt
cert MyVPNNServer.crt
key MyVPNNServer.key
dh dh4096.pem
server 10.0.8.0 255.255.255.0
ifconfig-pool-persist ipp-tcp.txt
push "route 10.0.0.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
tls-auth ta.key 0
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA
cipher AES-256-CBC
comp-lzo
max-clients 10
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status-tcp.log
log-append openvpn-tcp.log
verb 4
mode server
tls-server
remote-cert-tls client

Client Config

client
tls-client
remote-cert-tls server
dev tun0
resolv-retry infinite
nobind
persist-key
persist-tun
float
cipher AES-256-CBC
ca user1-street-laptop-udp/ca.crt
cert user1-street-laptop-udp/user1-street-laptop.crt
key user1-street-laptop-udp/user1-street-laptop.key
tls-auth user1-street-laptop-udp/ta.key 1
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA
redirect-gateway def1
comp-lzo
register-dns
#----------#
#   Home   #
#----------#
remote PUBIP 1194
proto udp
verb 3

Traffic

john_es wroteMULTI: bad source address from client [MYPUBIP], packet dropped errors

Generally, nothing to worry about .. as you can see, openvpn dropped the packets.

Cause:
https://community.openvpn.net/openvpn/wiki/317-qmulti-bad-source-address-from-client--packet-droppedq-or-qget-inst-by-virt-failedq

Cure:
HOWTO: Expanding the scope of the VPN to include additional machines

Pippin

Yes, i see this allot too and only for Android client via LTE 3/4G.
I suspect it has something to do with many phones sharing one public IP.
In my logs I always see two IP`s, client IP 100.x.x.x and it`s public IP.

Seems to me that iroute isn`t an option in such case.

Traffic

I do not have a mobile phone to test this on but, I suspect, it is that the only other IP address the phone has is a public IP not a private one (eg. not 192.168/16 etc) .. As Pippin says,

Pippin wroteiroute isn`t an option in such case

but it is of little consequence because the server drops the packets without interruption to services.