Hello there, I'm trying to make internet work when I connect to my openvpn server. I can connect to the server, but when I ping 8.8.8.8 I get [code]From 10.8.0.1 icmp_seq=34 Destination Host Prohibited[/code] Both pings to the server and client are fine. I may have made mess with my server's iptables and routes seem kinda strange to me, but I'm new with this so I need help to figure it out. My server runs centos 6.4 and I tried to connect to it from windows and raspbian. server.conf [code]port 1194 proto udp dev tun ca ca.crt cert server.crt key server.key dh dh2048.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "redirect-gateway def1" push "dhcp-option DNS 10.8.0.1" push "dhcp-option DNS 8.8.8.8" keepalive 10 120 comp-lzo max-clients 100 user nobody group nobody persist-key persist-tun status /var/log/openvpn-status.log log-append /var/log/openvpn.log verb 4a [/code] client.conf [code]client dev tun proto udp remote my.public.ip.204 1194 resolv-retry infinite nobind user nobody group nogroup persist-key persist-tun ca ca.crt cert client1.crt key client1.key ns-cert-type server comp-lzo verb 3 [/code] route -n [code]Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0 my.public.ip.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 169.254.0.0 0.0.0.0 255.255.0.0 U 1002 0 0 eth0 0.0.0.0 my.public.ip.1 0.0.0.0 UG 0 0 0 eth0[/code] iptables -S [code]-P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 5060 -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 5060 -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 10000:20000 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 5038 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 1719:1720 -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 1719:1720 -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 2048:3329 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited -A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i tun0 -o eth0 -j ACCEPT -A FORWARD -s 10.8.0.0/24 -j ACCEPT -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT[/code] I also got these when I connect with my raspbian [code] /sbin/ip route add my.public.ip.204/32 via 192.168.1.1 RTNETLINK answers: File exists Wed Mar 23 19:22:40 2016 ERROR: Linux route add command failed: external program exited with error status: 2[/code] route -n #on raspbian [code]Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 10.8.0.5 128.0.0.0 UG 0 0 0 tun0 0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0 0.0.0.0 192.168.1.1 0.0.0.0 UG 202 0 0 eth0 10.8.0.1 10.8.0.5 255.255.255.255 UGH 0 0 0 tun0 10.8.0.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 my.public.ip.204 192.168.1.1 255.255.255.255 UGH 0 0 0 eth0 128.0.0.0 10.8.0.5 128.0.0.0 UG 0 0 0 tun0 192.168.1.0 0.0.0.0 255.255.255.0 U 202 0 0 eth0 [/code] ifconfig #raspbian [code]eth0 Link encap:Ethernet HWaddr b8:27:eb:1f:35:ed inet addr:192.168.1.37 Bcast:192.168.1.255 Mask:255.255.255.0 inet6 addr: fe80::68a4:96ba:840b:39aa/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:23663 errors:0 dropped:13 overruns:0 frame:0 TX packets:9517 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:1678654 (1.6 MiB) TX bytes:1321090 (1.2 MiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:208 errors:0 dropped:0 overruns:0 frame:0 TX packets:208 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:17224 (16.8 KiB) TX bytes:17224 (16.8 KiB) tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.8.0.6 P-t-P:10.8.0.5 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:27 errors:0 dropped:0 overruns:0 frame:0 TX packets:31 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:2832 (2.7 KiB) TX bytes:2380 (2.3 KiB) [/code] ifconfig #server [code]eth0 Link encap:Ethernet HWaddr 00:15:5D:0A:32:17 inet addr:my.public.ip.204 Bcast:my.public.ip.255 Mask:255.255.255.0 inet6 addr: fe80::215:5dff:fe0a:3217/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:522723644 errors:0 dropped:0 overruns:0 frame:0 TX packets:111142077 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:101796823536 (94.8 GiB) TX bytes:28925236790 (26.9 GiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:10833277 errors:0 dropped:0 overruns:0 frame:0 TX packets:10833277 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:2377947379 (2.2 GiB) TX bytes:2377947379 (2.2 GiB) tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:240 errors:0 dropped:0 overruns:0 frame:0 TX packets:229 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:18960 (18.5 KiB) TX bytes:24488 (23.9 KiB) [/code] Hope for your help :roll:

[url=http://openvpn.net/index.php/open-source/documentation/howto.html#redirect]HOWTO: Routing all client traffic (including web-traffic) through the VPN[/url] Note: iptables NAT

[quote="fullbring3r"]Am I missing something?[/quote]Your logs are [i]missing[/i] ..

Your client connection is good:[quote="fullbring3r"]Thu Mar 24 14:17:57 2016 us=277123 PUSH: Received control message: 'PUSH_REPLY,route 10.10.0.0 255.255.255.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.10.0.1,dhcp-option DNS 8.8.8.8,route 10.10.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.10.0.6 10.10.0.5' Thu Mar 24 14:17:57 2016 us=278483 OPTIONS IMPORT: timers and/or timeouts modified Thu Mar 24 14:17:57 2016 us=279272 OPTIONS IMPORT: --ifconfig/up options modified Thu Mar 24 14:17:57 2016 us=280055 OPTIONS IMPORT: route options modified Thu Mar 24 14:17:57 2016 us=280799 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified Thu Mar 24 14:17:57 2016 us=282625 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=eth0 HWADDR=b8:27:eb:1f:35:ed Thu Mar 24 14:17:57 2016 us=285269 TUN/TAP device tun0 opened Thu Mar 24 14:17:57 2016 us=286893 TUN/TAP TX queue length set to 100 Thu Mar 24 14:17:57 2016 us=288298 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Thu Mar 24 14:17:57 2016 us=289469 /sbin/ip link set dev tun0 up mtu 1500 Thu Mar 24 14:17:57 2016 us=299334 /sbin/ip addr add dev tun0 local 10.10.0.6 peer 10.10.0.5[/quote]All good. [quote="fullbring3r"]Thu Mar 24 14:17:57 2016 us=321321 /sbin/ip route add my.server.ip/32 via 192.168.1.1 RTNETLINK answers: [b]File exists[/b] Thu Mar 24 14:17:57 2016 us=328851 ERROR: Linux route add command failed: external program exited with error status: 2[/quote]Probably left over from restarting openvpn .. [quote="fullbring3r"]Thu Mar 24 14:17:57 2016 us=329206 /sbin/ip route add 0.0.0.0/1 via 10.10.0.5 Thu Mar 24 14:17:57 2016 us=336235 /sbin/ip route add 128.0.0.0/1 via 10.10.0.5 Thu Mar 24 14:17:57 2016 us=344664 /sbin/ip route add 10.10.0.0/24 via 10.10.0.5 Thu Mar 24 14:17:57 2016 us=353010 /sbin/ip route add 10.10.0.1/32 via 10.10.0.5[/quote]All good. [quote="fullbring3r"]Thu Mar 24 14:17:57 2016 us=361415 GID [b]set to nogroup[/b] Thu Mar 24 14:17:57 2016 us=362790 UID [b]set to nobody[/b][/quote]This will cause you all sorts of problems .. remove the --[b]user[/b] & --[b]group[/b] setting from your client config. [quote="fullbring3r"]Thu Mar 24 14:17:57 2016 us=363660 [b]Initialization Sequence Completed[/b][/quote]All good. However, because you have the --[b]user[/b] & --[b]group[/b] setting, if your client reconnects then it will fail as your log shows:[quote="fullbring3r"][b]^C[/b]Thu Mar 24 14:18:49 2016 us=549995 event_wait : Interrupted system call (code=4) Thu Mar 24 14:18:49 2016 us=552606 TCP/UDP: Closing socket Thu Mar 24 14:18:49 2016 us=553923 /sbin/ip route del 10.10.0.1/32 RTNETLINK answers: [b]Operation not permitted[/b] Thu Mar 24 14:18:49 2016 us=562206 ERROR: Linux route delete command failed: external program exited with error status: 2 Thu Mar 24 14:18:49 2016 us=562627 /sbin/ip route del 10.10.0.0/24 RTNETLINK answers: [b]Operation not permitted[/b] Thu Mar 24 14:18:49 2016 us=570846 ERROR: Linux route delete command failed: external program exited with error status: 2 Thu Mar 24 14:18:49 2016 us=571324 /sbin/ip route del my.server.ip/32 RTNETLINK answers: [b]Operation not permitted[/b] Thu Mar 24 14:18:49 2016 us=579546 ERROR: Linux route delete command failed: external program exited with error status: 2 Thu Mar 24 14:18:49 2016 us=579965 /sbin/ip route del 0.0.0.0/1 RTNETLINK answers: [b]Operation not permitted[/b] Thu Mar 24 14:18:49 2016 us=588199 ERROR: Linux route delete command failed: external program exited with error status: 2 Thu Mar 24 14:18:49 2016 us=588608 /sbin/ip route del 128.0.0.0/1 RTNETLINK answers: [b]Operation not permitted[/b] Thu Mar 24 14:18:49 2016 us=597016 ERROR: Linux route delete command failed: external program exited with error status: 2 Thu Mar 24 14:18:49 2016 us=597342 Closing TUN/TAP interface Thu Mar 24 14:18:49 2016 us=597621 /sbin/ip addr del dev tun0 local 10.10.0.6 peer 10.10.0.5 RTNETLINK answers: [b]Operation not permitted[/b] Thu Mar 24 14:18:49 2016 us=606199 Linux ip addr del failed: external program exited with error status: 2 Thu Mar 24 14:18:49 2016 us=681404 SIGINT[hard,] received, process exiting[/quote]

I've figured it out, problem was with iptables at my server. It was [code]-A FORWARD -j REJECT --reject-with icmp-host-prohibited[/code] in front of all my ACCEPT rules. Got my [code]64 bytes from 8.8.8.8: icmp_seq=15750 ttl=59 time=6.24 ms [/code] happy now :)

No internet with connceted VPN

fullbring3r

Hello there, I'm trying to make internet work when I connect to my openvpn server.
I can connect to the server, but when I ping 8.8.8.8 I get

From 10.8.0.1 icmp_seq=34 Destination Host Prohibited

Both pings to the server and client are fine.

I may have made mess with my server's iptables and routes seem kinda strange to me, but I'm new with this so I need help to figure it out.

My server runs centos 6.4 and I tried to connect to it from windows and raspbian.

server.conf

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 10.8.0.1"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
comp-lzo
max-clients 100
user nobody
group nobody
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 4a

client.conf

client
dev tun
proto udp
remote my.public.ip.204 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
comp-lzo
verb 3

route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
my.public.ip.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     1002   0        0 eth0
0.0.0.0         my.public.ip.1    0.0.0.0         UG    0      0        0 eth0

iptables -S

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 5060 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 5060 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 10000:20000 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 5038 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 1719:1720 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 1719:1720 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 2048:3329 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i tun0 -o eth0 -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

I also got these when I connect with my raspbian

 /sbin/ip route add my.public.ip.204/32 via 192.168.1.1
RTNETLINK answers: File exists
Wed Mar 23 19:22:40 2016 ERROR: Linux route add command failed: external program exited with error status: 2

route -n #on raspbian

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.8.0.5        128.0.0.0       UG    0      0        0 tun0
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 eth0
0.0.0.0         192.168.1.1     0.0.0.0         UG    202    0        0 eth0
10.8.0.1        10.8.0.5        255.255.255.255 UGH   0      0        0 tun0
10.8.0.5        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
my.public.ip.204  192.168.1.1     255.255.255.255 UGH   0      0        0 eth0
128.0.0.0       10.8.0.5        128.0.0.0       UG    0      0        0 tun0
192.168.1.0     0.0.0.0         255.255.255.0   U     202    0        0 eth0

ifconfig #raspbian

eth0      Link encap:Ethernet  HWaddr b8:27:eb:1f:35:ed
          inet addr:192.168.1.37  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::68a4:96ba:840b:39aa/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:23663 errors:0 dropped:13 overruns:0 frame:0
          TX packets:9517 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:1678654 (1.6 MiB)  TX bytes:1321090 (1.2 MiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:208 errors:0 dropped:0 overruns:0 frame:0
          TX packets:208 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:17224 (16.8 KiB)  TX bytes:17224 (16.8 KiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.6  P-t-P:10.8.0.5  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:27 errors:0 dropped:0 overruns:0 frame:0
          TX packets:31 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:2832 (2.7 KiB)  TX bytes:2380 (2.3 KiB)

ifconfig #server

eth0      Link encap:Ethernet  HWaddr 00:15:5D:0A:32:17
          inet addr:my.public.ip.204  Bcast:my.public.ip.255  Mask:255.255.255.0
          inet6 addr: fe80::215:5dff:fe0a:3217/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:522723644 errors:0 dropped:0 overruns:0 frame:0
          TX packets:111142077 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:101796823536 (94.8 GiB)  TX bytes:28925236790 (26.9 GiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:10833277 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10833277 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:2377947379 (2.2 GiB)  TX bytes:2377947379 (2.2 GiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:240 errors:0 dropped:0 overruns:0 frame:0
          TX packets:229 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:18960 (18.5 KiB)  TX bytes:24488 (23.9 KiB)

Hope for your help :roll:

Traffic

HOWTO: Routing all client traffic (including web-traffic) through the VPN

Note: iptables NAT

fullbring3r

Got this if I edit it with vi

# Generated by iptables-save v1.4.7 on Tue Mar 22 19:21:06 2016
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [38:11356]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 5060 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 5060 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 10000:20000 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 5038 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 1719:1720 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 1719:1720 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 2048:3329 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i tun0 -o eth0 -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Tue Mar 22 19:21:06 2016
# Generated by iptables-save v1.4.7 on Tue Mar 22 19:21:06 2016
*nat
:PREROUTING ACCEPT [89:16836]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Tue Mar 22 19:21:06 2016

It was there already. Am I missing something?

Traffic

fullbring3r wroteAm I missing something?

Your logs are missing ..

fullbring3r

Thu Mar 24 15:13:53 2016 us=983423 MULTI: multi_create_instance called
Thu Mar 24 15:13:53 2016 us=983515 my.client.ip:34367 Re-using SSL/TLS context
Thu Mar 24 15:13:53 2016 us=983551 my.client.ip:34367 LZO compression initialized
Thu Mar 24 15:13:53 2016 us=983655 my.client.ip:34367 Control Channel MTU parms [ L:1542 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Thu Mar 24 15:13:53 2016 us=983675 my.client.ip:34367 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
Thu Mar 24 15:13:53 2016 us=983784 my.client.ip:34367 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Mar 24 15:13:53 2016 us=983799 my.client.ip:34367 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Thu Mar 24 15:13:53 2016 us=983840 my.client.ip:34367 Local Options hash (VER=V4): '530fdded'
Thu Mar 24 15:13:53 2016 us=983866 my.client.ip:34367 Expected Remote Options hash (VER=V4): '41690919'
Thu Mar 24 15:13:53 2016 us=983907 my.client.ip:34367 TLS: Initial packet from [AF_INET]my.client.ip:34367, sid=913af74b 8d77a32c
Thu Mar 24 15:13:54 2016 us=643693 my.client.ip:34367 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=me@myhost.mydomain
Thu Mar 24 15:13:54 2016 us=643933 my.client.ip:34367 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=client1, name=EasyRSA, emailAddress=me@myhost.mydomain
Thu Mar 24 15:13:54 2016 us=659266 my.client.ip:34367 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Mar 24 15:13:54 2016 us=659354 my.client.ip:34367 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 24 15:13:54 2016 us=659424 my.client.ip:34367 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Mar 24 15:13:54 2016 us=659460 my.client.ip:34367 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 24 15:13:54 2016 us=664701 my.client.ip:34367 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu Mar 24 15:13:54 2016 us=664741 my.client.ip:34367 [client1] Peer Connection Initiated with [AF_INET]my.client.ip:34367
Thu Mar 24 15:13:54 2016 us=664935 MULTI: new connection by client 'client1' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Thu Mar 24 15:13:54 2016 us=664959 MULTI_sva: pool returned IPv4=10.10.0.6, IPv6=(Not enabled)
Thu Mar 24 15:13:54 2016 us=665002 MULTI: Learn: 10.10.0.6 -> client1/my.client.ip:34367
Thu Mar 24 15:13:54 2016 us=665016 MULTI: primary virtual IP for client1/my.client.ip:34367: 10.10.0.6
Thu Mar 24 15:13:57 2016 us=163021 client1/my.client.ip:34367 PUSH: Received control message: 'PUSH_REQUEST'
Thu Mar 24 15:13:57 2016 us=163079 client1/my.client.ip:34367 send_push_reply(): safe_cap=940
Thu Mar 24 15:13:57 2016 us=163111 client1/my.client.ip:34367 SENT CONTROL [client1]: 'PUSH_REPLY,route 10.10.0.0 255.255.255.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.10.0.1,dhcp-option DNS 8.8.8.8,route 10.10.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.10.0.6 10.10.0.5' (status=1)
Thu Mar 24 15:13:57 2016 us=397338 client1/my.client.ip:34367 MULTI: bad source address from client [192.168.1.37], packet dropped
Thu Mar 24 15:13:57 2016 us=397688 client1/my.client.ip:34367 MULTI: bad source address from client [192.168.1.37], packet dropped
Thu Mar 24 15:13:57 2016 us=397924 client1/my.client.ip:34367 MULTI: bad source address from client [192.168.1.37], packet dropped
Thu Mar 24 15:13:57 2016 us=397979 client1/my.client.ip:34367 MULTI: bad source address from client [192.168.1.37], packet dropped

Thu Mar 24 14:17:53 2016 us=961356 OpenVPN 2.3.4 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jan 23 2016
Thu Mar 24 14:17:53 2016 us=961560 library versions: OpenSSL 1.0.1k 8 Jan 2015, LZO 2.08
Thu Mar 24 14:17:53 2016 us=966806 WARNING: file 'client1.key' is group or others accessible
Thu Mar 24 14:17:53 2016 us=968689 LZO compression initialized
Thu Mar 24 14:17:53 2016 us=969354 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Mar 24 14:17:53 2016 us=969712 Socket Buffers: R=[163840->131072] S=[163840->131072]
Thu Mar 24 14:17:53 2016 us=970065 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Mar 24 14:17:53 2016 us=970329 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Thu Mar 24 14:17:53 2016 us=970494 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Mar 24 14:17:53 2016 us=970768 Local Options hash (VER=V4): '41690919'
Thu Mar 24 14:17:53 2016 us=971105 Expected Remote Options hash (VER=V4): '530fdded'
Thu Mar 24 14:17:53 2016 us=973992 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Thu Mar 24 14:17:53 2016 us=974272 UDPv4 link local: [undef]
Thu Mar 24 14:17:53 2016 us=974471 UDPv4 link remote: [AF_INET]my.server.ip:1194
Thu Mar 24 14:17:53 2016 us=978470 TLS: Initial packet from [AF_INET]my.server.ip:1194, sid=3a249e64 c51879e1
Thu Mar 24 14:17:53 2016 us=998917 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=me@myhost.mydomain
Thu Mar 24 14:17:54 2016 us=4075 VERIFY OK: nsCertType=SERVER
Thu Mar 24 14:17:54 2016 us=4972 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=server, name=EasyRSA, emailAddress=me@myhost.mydomain
Thu Mar 24 14:17:54 2016 us=743417 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Mar 24 14:17:54 2016 us=744564 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 24 14:17:54 2016 us=745696 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Mar 24 14:17:54 2016 us=746393 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 24 14:17:54 2016 us=747498 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu Mar 24 14:17:54 2016 us=748289 [server] Peer Connection Initiated with [AF_INET]my.server.ip:1194
Thu Mar 24 14:17:57 2016 us=272091 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Mar 24 14:17:57 2016 us=277123 PUSH: Received control message: 'PUSH_REPLY,route 10.10.0.0 255.255.255.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.10.0.1,dhcp-option DNS 8.8.8.8,route 10.10.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.10.0.6 10.10.0.5'
Thu Mar 24 14:17:57 2016 us=278483 OPTIONS IMPORT: timers and/or timeouts modified
Thu Mar 24 14:17:57 2016 us=279272 OPTIONS IMPORT: --ifconfig/up options modified
Thu Mar 24 14:17:57 2016 us=280055 OPTIONS IMPORT: route options modified
Thu Mar 24 14:17:57 2016 us=280799 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Mar 24 14:17:57 2016 us=282625 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=eth0 HWADDR=b8:27:eb:1f:35:ed
Thu Mar 24 14:17:57 2016 us=285269 TUN/TAP device tun0 opened
Thu Mar 24 14:17:57 2016 us=286893 TUN/TAP TX queue length set to 100
Thu Mar 24 14:17:57 2016 us=288298 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Mar 24 14:17:57 2016 us=289469 /sbin/ip link set dev tun0 up mtu 1500
Thu Mar 24 14:17:57 2016 us=299334 /sbin/ip addr add dev tun0 local 10.10.0.6 peer 10.10.0.5
Thu Mar 24 14:17:57 2016 us=321321 /sbin/ip route add my.server.ip/32 via 192.168.1.1
RTNETLINK answers: File exists
Thu Mar 24 14:17:57 2016 us=328851 ERROR: Linux route add command failed: external program exited with error status: 2
Thu Mar 24 14:17:57 2016 us=329206 /sbin/ip route add 0.0.0.0/1 via 10.10.0.5
Thu Mar 24 14:17:57 2016 us=336235 /sbin/ip route add 128.0.0.0/1 via 10.10.0.5
Thu Mar 24 14:17:57 2016 us=344664 /sbin/ip route add 10.10.0.0/24 via 10.10.0.5
Thu Mar 24 14:17:57 2016 us=353010 /sbin/ip route add 10.10.0.1/32 via 10.10.0.5
Thu Mar 24 14:17:57 2016 us=361415 GID set to nogroup
Thu Mar 24 14:17:57 2016 us=362790 UID set to nobody
Thu Mar 24 14:17:57 2016 us=363660 Initialization Sequence Completed
^CThu Mar 24 14:18:49 2016 us=549995 event_wait : Interrupted system call (code=4)
Thu Mar 24 14:18:49 2016 us=552606 TCP/UDP: Closing socket
Thu Mar 24 14:18:49 2016 us=553923 /sbin/ip route del 10.10.0.1/32
RTNETLINK answers: Operation not permitted
Thu Mar 24 14:18:49 2016 us=562206 ERROR: Linux route delete command failed: external program exited with error status: 2
Thu Mar 24 14:18:49 2016 us=562627 /sbin/ip route del 10.10.0.0/24
RTNETLINK answers: Operation not permitted
Thu Mar 24 14:18:49 2016 us=570846 ERROR: Linux route delete command failed: external program exited with error status: 2
Thu Mar 24 14:18:49 2016 us=571324 /sbin/ip route del my.server.ip/32
RTNETLINK answers: Operation not permitted
Thu Mar 24 14:18:49 2016 us=579546 ERROR: Linux route delete command failed: external program exited with error status: 2
Thu Mar 24 14:18:49 2016 us=579965 /sbin/ip route del 0.0.0.0/1
RTNETLINK answers: Operation not permitted
Thu Mar 24 14:18:49 2016 us=588199 ERROR: Linux route delete command failed: external program exited with error status: 2
Thu Mar 24 14:18:49 2016 us=588608 /sbin/ip route del 128.0.0.0/1
RTNETLINK answers: Operation not permitted
Thu Mar 24 14:18:49 2016 us=597016 ERROR: Linux route delete command failed: external program exited with error status: 2
Thu Mar 24 14:18:49 2016 us=597342 Closing TUN/TAP interface
Thu Mar 24 14:18:49 2016 us=597621 /sbin/ip addr del dev tun0 local 10.10.0.6 peer 10.10.0.5
RTNETLINK answers: Operation not permitted
Thu Mar 24 14:18:49 2016 us=606199 Linux ip addr del failed: external program exited with error status: 2
Thu Mar 24 14:18:49 2016 us=681404 SIGINT[hard,] received, process exiting

note that I've changed my vpn network to 10.10.0.0 and edited iptables accordingly

Traffic

Your client connection is good:

fullbring3r wroteThu Mar 24 14:17:57 2016 us=277123 PUSH: Received control message: 'PUSH_REPLY,route 10.10.0.0 255.255.255.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.10.0.1,dhcp-option DNS 8.8.8.8,route 10.10.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.10.0.6 10.10.0.5'
Thu Mar 24 14:17:57 2016 us=278483 OPTIONS IMPORT: timers and/or timeouts modified
Thu Mar 24 14:17:57 2016 us=279272 OPTIONS IMPORT: --ifconfig/up options modified
Thu Mar 24 14:17:57 2016 us=280055 OPTIONS IMPORT: route options modified
Thu Mar 24 14:17:57 2016 us=280799 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Mar 24 14:17:57 2016 us=282625 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=eth0 HWADDR=b8:27:eb:1f:35:ed
Thu Mar 24 14:17:57 2016 us=285269 TUN/TAP device tun0 opened
Thu Mar 24 14:17:57 2016 us=286893 TUN/TAP TX queue length set to 100
Thu Mar 24 14:17:57 2016 us=288298 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Mar 24 14:17:57 2016 us=289469 /sbin/ip link set dev tun0 up mtu 1500
Thu Mar 24 14:17:57 2016 us=299334 /sbin/ip addr add dev tun0 local 10.10.0.6 peer 10.10.0.5

All good.

fullbring3r wroteThu Mar 24 14:17:57 2016 us=321321 /sbin/ip route add my.server.ip/32 via 192.168.1.1
RTNETLINK answers: File exists
Thu Mar 24 14:17:57 2016 us=328851 ERROR: Linux route add command failed: external program exited with error status: 2

Probably left over from restarting openvpn ..

fullbring3r wroteThu Mar 24 14:17:57 2016 us=329206 /sbin/ip route add 0.0.0.0/1 via 10.10.0.5
Thu Mar 24 14:17:57 2016 us=336235 /sbin/ip route add 128.0.0.0/1 via 10.10.0.5
Thu Mar 24 14:17:57 2016 us=344664 /sbin/ip route add 10.10.0.0/24 via 10.10.0.5
Thu Mar 24 14:17:57 2016 us=353010 /sbin/ip route add 10.10.0.1/32 via 10.10.0.5

All good.

fullbring3r wroteThu Mar 24 14:17:57 2016 us=361415 GID set to nogroup
Thu Mar 24 14:17:57 2016 us=362790 UID set to nobody

This will cause you all sorts of problems .. remove the --user & --group setting from your client config.

fullbring3r wroteThu Mar 24 14:17:57 2016 us=363660 Initialization Sequence Completed

All good.

However, because you have the --user & --group setting, if your client reconnects then it will fail as your log shows:

fullbring3r wrote^CThu Mar 24 14:18:49 2016 us=549995 event_wait : Interrupted system call (code=4)
Thu Mar 24 14:18:49 2016 us=552606 TCP/UDP: Closing socket
Thu Mar 24 14:18:49 2016 us=553923 /sbin/ip route del 10.10.0.1/32
RTNETLINK answers: Operation not permitted
Thu Mar 24 14:18:49 2016 us=562206 ERROR: Linux route delete command failed: external program exited with error status: 2
Thu Mar 24 14:18:49 2016 us=562627 /sbin/ip route del 10.10.0.0/24
RTNETLINK answers: Operation not permitted
Thu Mar 24 14:18:49 2016 us=570846 ERROR: Linux route delete command failed: external program exited with error status: 2
Thu Mar 24 14:18:49 2016 us=571324 /sbin/ip route del my.server.ip/32
RTNETLINK answers: Operation not permitted
Thu Mar 24 14:18:49 2016 us=579546 ERROR: Linux route delete command failed: external program exited with error status: 2
Thu Mar 24 14:18:49 2016 us=579965 /sbin/ip route del 0.0.0.0/1
RTNETLINK answers: Operation not permitted
Thu Mar 24 14:18:49 2016 us=588199 ERROR: Linux route delete command failed: external program exited with error status: 2
Thu Mar 24 14:18:49 2016 us=588608 /sbin/ip route del 128.0.0.0/1
RTNETLINK answers: Operation not permitted
Thu Mar 24 14:18:49 2016 us=597016 ERROR: Linux route delete command failed: external program exited with error status: 2
Thu Mar 24 14:18:49 2016 us=597342 Closing TUN/TAP interface
Thu Mar 24 14:18:49 2016 us=597621 /sbin/ip addr del dev tun0 local 10.10.0.6 peer 10.10.0.5
RTNETLINK answers: Operation not permitted
Thu Mar 24 14:18:49 2016 us=606199 Linux ip addr del failed: external program exited with error status: 2
Thu Mar 24 14:18:49 2016 us=681404 SIGINT[hard,] received, process exiting

fullbring3r

I've figured it out, problem was with iptables at my server.

It was

-A FORWARD -j REJECT --reject-with icmp-host-prohibited

in front of all my ACCEPT rules.

Got my

64 bytes from 8.8.8.8: icmp_seq=15750 ttl=59 time=6.24 ms

happy now 🙂