I have setup OpenVPN on my freeNAS 9.3 server. I am intending to use it through a firewall which blocks all UDP traffic, so TCP is a must. No connection is made over UDP but both my laptop running Win10 pro and my Oneplus Two(stock) can connect through the firewall over TCP. Once the connection is made all traffic goes through the firewall as if the VPN was not turned on on my phone, and all access is lost on my computer. My freenas server is using no-ip and has a hostname that gets updated whenever it changes. It is connected to my personal router that is in a DMZ of another router that is on the internet. The DMZ setup is stable and works for webdav, game server hosting, ssh, etc, all of which are run on my freenas server. Using verbosity 4 on the clients gets this result when connecting to the server from my laptop:
Note that I am using port 25 because it is not blocked in the firewall. All forwarding is set up correctly I believe.
Tue Apr 05 13:09:31 2016 us=324772 ping_rec_timeout = 0
Tue Apr 05 13:09:31 2016 us=324772 ping_rec_timeout_action = 0
Tue Apr 05 13:09:31 2016 us=324772 ping_timer_remote = DISABLED
Tue Apr 05 13:09:31 2016 us=324772 remap_sigusr1 = 0
Tue Apr 05 13:09:31 2016 us=324772 persist_tun = ENABLED
Tue Apr 05 13:09:31 2016 us=324772 persist_local_ip = DISABLED
Tue Apr 05 13:09:31 2016 us=324772 persist_remote_ip = DISABLED
Tue Apr 05 13:09:31 2016 us=324772 persist_key = ENABLED
Tue Apr 05 13:09:31 2016 us=324772 passtos = DISABLED
Tue Apr 05 13:09:31 2016 us=324772 resolve_retry_seconds = 1000000000
Tue Apr 05 13:09:31 2016 us=324772 username = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=324772 groupname = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=324772 chroot_dir = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=324772 cd_dir = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=324772 writepid = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=324772 up_script = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=324772 down_script = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=324772 down_pre = DISABLED
Tue Apr 05 13:09:31 2016 us=324772 up_restart = DISABLED
Tue Apr 05 13:09:31 2016 us=324772 up_delay = DISABLED
Tue Apr 05 13:09:31 2016 us=324772 daemon = DISABLED
Tue Apr 05 13:09:31 2016 us=324772 inetd = 0
Tue Apr 05 13:09:31 2016 us=324772 log = DISABLED
Tue Apr 05 13:09:31 2016 us=324772 suppress_timestamps = DISABLED
Tue Apr 05 13:09:31 2016 us=324772 nice = 0
Tue Apr 05 13:09:31 2016 us=324772 verbosity = 4
Tue Apr 05 13:09:31 2016 us=324772 mute = 0
Tue Apr 05 13:09:31 2016 us=324772 gremlin = 0
Tue Apr 05 13:09:31 2016 us=324772 status_file = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=324772 status_file_version = 1
Tue Apr 05 13:09:31 2016 us=324772 status_file_update_freq = 60
Tue Apr 05 13:09:31 2016 us=324772 occ = ENABLED
Tue Apr 05 13:09:31 2016 us=324772 rcvbuf = 0
Tue Apr 05 13:09:31 2016 us=324772 sndbuf = 0
Tue Apr 05 13:09:31 2016 us=324772 sockflags = 0
Tue Apr 05 13:09:31 2016 us=324772 fast_io = DISABLED
Tue Apr 05 13:09:31 2016 us=324772 lzo = 7
Tue Apr 05 13:09:31 2016 us=324772 route_script = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=324772 route_default_gateway = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=324772 route_default_metric = 0
Tue Apr 05 13:09:31 2016 us=324772 route_noexec = DISABLED
Tue Apr 05 13:09:31 2016 us=324772 route_delay = 5
Tue Apr 05 13:09:31 2016 us=324772 route_delay_window = 30
Tue Apr 05 13:09:31 2016 us=324772 route_delay_defined = ENABLED
Tue Apr 05 13:09:31 2016 us=340398 route_nopull = DISABLED
Tue Apr 05 13:09:31 2016 us=340398 route_gateway_via_dhcp = DISABLED
Tue Apr 05 13:09:31 2016 us=340398 max_routes = 100
Tue Apr 05 13:09:31 2016 us=340398 allow_pull_fqdn = DISABLED
Tue Apr 05 13:09:31 2016 us=340398 route 192.168.1.0/255.255.255.0/vpn_gateway/3
Tue Apr 05 13:09:31 2016 us=340398 management_addr = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=340398 management_port = 0
Tue Apr 05 13:09:31 2016 us=340398 management_user_pass = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=340398 management_log_history_cache = 250
Tue Apr 05 13:09:31 2016 us=340398 management_echo_buffer_size = 100
Tue Apr 05 13:09:31 2016 us=340398 management_write_peer_info_file = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=340398 management_client_user = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=340398 management_client_group = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=340398 management_flags = 0
Tue Apr 05 13:09:31 2016 us=340398 shared_secret_file = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=340398 key_direction = 0
Tue Apr 05 13:09:31 2016 us=340398 ciphername_defined = ENABLED
Tue Apr 05 13:09:31 2016 us=340398 ciphername = 'BF-CBC'
Tue Apr 05 13:09:31 2016 us=340398 authname_defined = ENABLED
Tue Apr 05 13:09:31 2016 us=340398 authname = 'SHA1'
Tue Apr 05 13:09:31 2016 us=340398 prng_hash = 'SHA1'
Tue Apr 05 13:09:31 2016 us=340398 prng_nonce_secret_len = 16
Tue Apr 05 13:09:31 2016 us=340398 keysize = 0
Tue Apr 05 13:09:31 2016 us=340398 engine = DISABLED
Tue Apr 05 13:09:31 2016 us=340398 replay = ENABLED
Tue Apr 05 13:09:31 2016 us=340398 mute_replay_warnings = DISABLED
Tue Apr 05 13:09:31 2016 us=340398 replay_window = 64
Tue Apr 05 13:09:31 2016 us=340398 replay_time = 15
Tue Apr 05 13:09:31 2016 us=340398 packet_id_file = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=340398 use_iv = ENABLED
Tue Apr 05 13:09:31 2016 us=340398 test_crypto = DISABLED
Tue Apr 05 13:09:31 2016 us=340398 tls_server = DISABLED
Tue Apr 05 13:09:31 2016 us=340398 tls_client = ENABLED
Tue Apr 05 13:09:31 2016 us=340398 key_method = 2
Tue Apr 05 13:09:31 2016 us=340398 ca_file = '[[INLINE]]'
Tue Apr 05 13:09:31 2016 us=340398 ca_path = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=340398 dh_file = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=340398 cert_file = '[[INLINE]]'
Tue Apr 05 13:09:31 2016 us=340398 extra_certs_file = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=340398 priv_key_file = '[[INLINE]]'
Tue Apr 05 13:09:31 2016 us=340398 pkcs12_file = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=340398 cryptoapi_cert = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=340398 cipher_list = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=340398 tls_verify = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=340398 tls_export_cert = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=340398 verify_x509_type = 0
Tue Apr 05 13:09:31 2016 us=340398 verify_x509_name = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=340398 crl_file = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=340398 ns_cert_type = 0
Tue Apr 05 13:09:31 2016 us=340398 remote_cert_ku[i] = 160
Tue Apr 05 13:09:31 2016 us=340398 remote_cert_ku[i] = 136
Tue Apr 05 13:09:31 2016 us=340398 remote_cert_ku[i] = 0
Tue Apr 05 13:09:31 2016 us=340398 remote_cert_ku[i] = 0
Tue Apr 05 13:09:31 2016 us=340398 remote_cert_ku[i] = 0
Tue Apr 05 13:09:31 2016 us=340398 remote_cert_ku[i] = 0
Tue Apr 05 13:09:31 2016 us=340398 remote_cert_ku[i] = 0
Tue Apr 05 13:09:31 2016 us=340398 remote_cert_ku[i] = 0
Tue Apr 05 13:09:31 2016 us=340398 remote_cert_ku[i] = 0
Tue Apr 05 13:09:31 2016 us=340398 remote_cert_ku[i] = 0
Tue Apr 05 13:09:31 2016 us=340398 remote_cert_ku[i] = 0
Tue Apr 05 13:09:31 2016 us=340398 remote_cert_ku[i] = 0
Tue Apr 05 13:09:31 2016 us=356024 remote_cert_ku[i] = 0
Tue Apr 05 13:09:31 2016 us=356024 remote_cert_ku[i] = 0
Tue Apr 05 13:09:31 2016 us=356024 remote_cert_ku[i] = 0
Tue Apr 05 13:09:31 2016 us=356024 remote_cert_ku[i] = 0
Tue Apr 05 13:09:31 2016 us=356024 remote_cert_eku = 'TLS Web Server Authentication'
Tue Apr 05 13:09:31 2016 us=356024 ssl_flags = 0
Tue Apr 05 13:09:31 2016 us=356024 tls_timeout = 2
Tue Apr 05 13:09:31 2016 us=356024 renegotiate_bytes = 0
Tue Apr 05 13:09:31 2016 us=356024 renegotiate_packets = 0
Tue Apr 05 13:09:31 2016 us=356024 renegotiate_seconds = 3600
Tue Apr 05 13:09:31 2016 us=356024 handshake_window = 60
Tue Apr 05 13:09:31 2016 us=356024 transition_window = 3600
Tue Apr 05 13:09:31 2016 us=356024 single_session = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 push_peer_info = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 tls_exit = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 tls_auth_file = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_protected_authentication = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_protected_authentication = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_protected_authentication = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_protected_authentication = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_protected_authentication = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_protected_authentication = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_protected_authentication = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_protected_authentication = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_protected_authentication = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_protected_authentication = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_protected_authentication = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_protected_authentication = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_protected_authentication = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_protected_authentication = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_protected_authentication = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_protected_authentication = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_private_mode = 00000000
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_private_mode = 00000000
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_private_mode = 00000000
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_private_mode = 00000000
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_private_mode = 00000000
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_private_mode = 00000000
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_private_mode = 00000000
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_private_mode = 00000000
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_private_mode = 00000000
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_private_mode = 00000000
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_private_mode = 00000000
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_private_mode = 00000000
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_private_mode = 00000000
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_private_mode = 00000000
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_private_mode = 00000000
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_private_mode = 00000000
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_cert_private = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_cert_private = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_cert_private = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_cert_private = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_cert_private = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_cert_private = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_cert_private = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_cert_private = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_cert_private = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_cert_private = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_cert_private = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_cert_private = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_cert_private = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_cert_private = DISABLED
Tue Apr 05 13:09:31 2016 us=356024 pkcs11_cert_private = DISABLED
Tue Apr 05 13:09:31 2016 us=371650 pkcs11_cert_private = DISABLED
Tue Apr 05 13:09:31 2016 us=371650 pkcs11_pin_cache_period = -1
Tue Apr 05 13:09:31 2016 us=371650 pkcs11_id = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=371650 pkcs11_id_management = DISABLED
Tue Apr 05 13:09:31 2016 us=371650 server_network = 0.0.0.0
Tue Apr 05 13:09:31 2016 us=371650 server_netmask = 0.0.0.0
Tue Apr 05 13:09:31 2016 us=371650 server_network_ipv6 = ::
Tue Apr 05 13:09:31 2016 us=371650 server_netbits_ipv6 = 0
Tue Apr 05 13:09:31 2016 us=371650 server_bridge_ip = 0.0.0.0
Tue Apr 05 13:09:31 2016 us=371650 server_bridge_netmask = 0.0.0.0
Tue Apr 05 13:09:31 2016 us=371650 server_bridge_pool_start = 0.0.0.0
Tue Apr 05 13:09:31 2016 us=371650 server_bridge_pool_end = 0.0.0.0
Tue Apr 05 13:09:31 2016 us=371650 ifconfig_pool_defined = DISABLED
Tue Apr 05 13:09:31 2016 us=371650 ifconfig_pool_start = 0.0.0.0
Tue Apr 05 13:09:31 2016 us=371650 ifconfig_pool_end = 0.0.0.0
Tue Apr 05 13:09:31 2016 us=371650 ifconfig_pool_netmask = 0.0.0.0
Tue Apr 05 13:09:31 2016 us=371650 ifconfig_pool_persist_filename = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=371650 ifconfig_pool_persist_refresh_freq = 600
Tue Apr 05 13:09:31 2016 us=371650 ifconfig_ipv6_pool_defined = DISABLED
Tue Apr 05 13:09:31 2016 us=371650 ifconfig_ipv6_pool_base = ::
Tue Apr 05 13:09:31 2016 us=371650 ifconfig_ipv6_pool_netbits = 0
Tue Apr 05 13:09:31 2016 us=371650 n_bcast_buf = 256
Tue Apr 05 13:09:31 2016 us=371650 tcp_queue_limit = 64
Tue Apr 05 13:09:31 2016 us=371650 real_hash_size = 256
Tue Apr 05 13:09:31 2016 us=371650 virtual_hash_size = 256
Tue Apr 05 13:09:31 2016 us=371650 client_connect_script = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=371650 learn_address_script = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=371650 client_disconnect_script = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=371650 client_config_dir = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=371650 ccd_exclusive = DISABLED
Tue Apr 05 13:09:31 2016 us=371650 tmp_dir = 'C:\Users\name\AppData\Local\Temp\'
Tue Apr 05 13:09:31 2016 us=371650 push_ifconfig_defined = DISABLED
Tue Apr 05 13:09:31 2016 us=371650 push_ifconfig_local = 0.0.0.0
Tue Apr 05 13:09:31 2016 us=371650 push_ifconfig_remote_netmask = 0.0.0.0
Tue Apr 05 13:09:31 2016 us=371650 push_ifconfig_ipv6_defined = DISABLED
Tue Apr 05 13:09:31 2016 us=371650 push_ifconfig_ipv6_local = ::/0
Tue Apr 05 13:09:31 2016 us=371650 push_ifconfig_ipv6_remote = ::
Tue Apr 05 13:09:31 2016 us=371650 enable_c2c = DISABLED
Tue Apr 05 13:09:31 2016 us=371650 duplicate_cn = DISABLED
Tue Apr 05 13:09:31 2016 us=371650 cf_max = 0
Tue Apr 05 13:09:31 2016 us=371650 cf_per = 0
Tue Apr 05 13:09:31 2016 us=371650 max_clients = 1024
Tue Apr 05 13:09:31 2016 us=371650 max_routes_per_client = 256
Tue Apr 05 13:09:31 2016 us=371650 auth_user_pass_verify_script = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=371650 auth_user_pass_verify_script_via_file = DISABLED
Tue Apr 05 13:09:31 2016 us=371650 client = ENABLED
Tue Apr 05 13:09:31 2016 us=371650 pull = ENABLED
Tue Apr 05 13:09:31 2016 us=371650 auth_user_pass_file = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=371650 show_net_up = DISABLED
Tue Apr 05 13:09:31 2016 us=371650 route_method = 0
Tue Apr 05 13:09:31 2016 us=371650 block_outside_dns = DISABLED
Tue Apr 05 13:09:31 2016 us=371650 ip_win32_defined = DISABLED
Tue Apr 05 13:09:31 2016 us=371650 ip_win32_type = 3
Tue Apr 05 13:09:31 2016 us=371650 dhcp_masq_offset = 0
Tue Apr 05 13:09:31 2016 us=371650 dhcp_lease_time = 31536000
Tue Apr 05 13:09:31 2016 us=371650 tap_sleep = 0
Tue Apr 05 13:09:31 2016 us=387276 dhcp_options = DISABLED
Tue Apr 05 13:09:31 2016 us=387276 dhcp_renew = DISABLED
Tue Apr 05 13:09:31 2016 us=387276 dhcp_pre_release = DISABLED
Tue Apr 05 13:09:31 2016 us=387276 dhcp_release = DISABLED
Tue Apr 05 13:09:31 2016 us=387276 domain = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=387276 netbios_scope = '[UNDEF]'
Tue Apr 05 13:09:31 2016 us=387276 netbios_node_type = 0
Tue Apr 05 13:09:31 2016 us=387276 disable_nbt = DISABLED
Tue Apr 05 13:09:31 2016 us=387276 OpenVPN 2.3.10 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar 10 2016
Tue Apr 05 13:09:31 2016 us=387276 Windows version 6.2 (Windows 8 or greater)
Tue Apr 05 13:09:31 2016 us=387276 library versions: OpenSSL 1.0.1s 1 Mar 2016, LZO 2.09
Enter Private Key Password:
Tue Apr 05 13:09:34 2016 us=85106 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Apr 05 13:09:34 2016 us=85106 LZO compression initialized
Tue Apr 05 13:09:34 2016 us=85106 Control Channel MTU parms [ L:1544 D:1210 EF:40 EB:0 ET:0 EL:3 ]
Tue Apr 05 13:09:34 2016 us=85106 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Apr 05 13:09:34 2016 us=288244 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:143 ET:0 EL:3 AF:3/1 ]
Tue Apr 05 13:09:34 2016 us=288244 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Tue Apr 05 13:09:34 2016 us=288244 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Tue Apr 05 13:09:34 2016 us=288244 Local Options hash (VER=V4): '69109d17'
Tue Apr 05 13:09:34 2016 us=288244 Expected Remote Options hash (VER=V4): 'c0103fa8'
Tue Apr 05 13:09:34 2016 us=288244 Attempting to establish TCP connection with [AF_INET]x.x.x.x:25 [nonblock]
Tue Apr 05 13:09:35 2016 us=303955 TCP connection established with [AF_INET]x.x.x.x:25
Tue Apr 05 13:09:35 2016 us=303955 TCPv4_CLIENT link local: [undef]
Tue Apr 05 13:09:35 2016 us=303955 TCPv4_CLIENT link remote: [AF_INET]x.x.x.x:25
Tue Apr 05 13:09:35 2016 us=319580 TLS: Initial packet from [AF_INET]x.x.x.x:25, sid=874c4b5f accbacc9
Tue Apr 05 13:09:35 2016 us=851168 VERIFY OK: depth=1, CN=vpn
Tue Apr 05 13:09:35 2016 us=851168 Validating certificate key usage
Tue Apr 05 13:09:35 2016 us=851168 ++ Certificate has key usage 00a0, expects 00a0
Tue Apr 05 13:09:35 2016 us=851168 VERIFY KU OK
Tue Apr 05 13:09:35 2016 us=851168 Validating certificate extended key usage
Tue Apr 05 13:09:35 2016 us=851168 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Apr 05 13:09:35 2016 us=851168 VERIFY EKU OK
Tue Apr 05 13:09:35 2016 us=851168 VERIFY OK: depth=0, CN=openvpn-server
Tue Apr 05 13:09:35 2016 us=913672 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Apr 05 13:09:35 2016 us=913672 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Apr 05 13:09:35 2016 us=913672 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Apr 05 13:09:35 2016 us=913672 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Apr 05 13:09:35 2016 us=913672 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Apr 05 13:09:35 2016 us=913672 [openvpn-server] Peer Connection Initiated with [AF_INET]x.x.x.x:25
Tue Apr 05 13:09:37 2016 us=974368 SENT CONTROL [openvpn-server]: 'PUSH_REQUEST' (status=1)
Tue Apr 05 13:09:38 2016 us=391920 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,route 10.8.0.0 255.255.255.0,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9'
Tue Apr 05 13:09:38 2016 us=407511 OPTIONS IMPORT: timers and/or timeouts modified
Tue Apr 05 13:09:38 2016 us=407511 OPTIONS IMPORT: --ifconfig/up options modified
Tue Apr 05 13:09:38 2016 us=407511 OPTIONS IMPORT: route options modified
Tue Apr 05 13:09:38 2016 us=407511 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Apr 05 13:09:38 2016 us=407511 ROUTE_GATEWAY 10.236.72.1/255.255.0.0 I=14 HWADDR=60:6c:66:da:8f:7c
Tue Apr 05 13:09:38 2016 us=407511 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Apr 05 13:09:38 2016 us=407511 open_tun, tt->ipv6=0
Tue Apr 05 13:09:38 2016 us=407511 TAP-WIN32 device [Ethernet 3] opened: \\.\Global\{66542B63-F614-4D10-848C-DD80A4F7A383}.tap
Tue Apr 05 13:09:38 2016 us=407511 TAP-Windows Driver Version 9.21
Tue Apr 05 13:09:38 2016 us=407511 TAP-Windows MTU=1500
Tue Apr 05 13:09:38 2016 us=407511 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.10/255.255.255.252 on interface {66542B63-F614-4D10-848C-DD80A4F7A383} [DHCP-serv: 10.8.0.9, lease-time: 31536000]
Tue Apr 05 13:09:38 2016 us=407511 DHCP option string: 06040808 0808
Tue Apr 05 13:09:38 2016 us=407511 Successful ARP Flush on interface [38] {66542B63-F614-4D10-848C-DD80A4F7A383}
Tue Apr 05 13:09:43 2016 us=18753 TEST ROUTES: 4/4 succeeded len=3 ret=1 a=0 u/d=up
Tue Apr 05 13:09:43 2016 us=18753 C:\WINDOWS\system32\route.exe ADD 85.164.189.239 MASK 255.255.255.255 10.236.72.1
Tue Apr 05 13:09:43 2016 us=18753 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Tue Apr 05 13:09:43 2016 us=18753 Route addition via IPAPI succeeded [adaptive]
Tue Apr 05 13:09:43 2016 us=18753 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.9
Tue Apr 05 13:09:43 2016 us=18753 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Apr 05 13:09:43 2016 us=18753 Route addition via IPAPI succeeded [adaptive]
Tue Apr 05 13:09:43 2016 us=18753 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.9
Tue Apr 05 13:09:43 2016 us=18753 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Apr 05 13:09:43 2016 us=18753 Route addition via IPAPI succeeded [adaptive]
Tue Apr 05 13:09:43 2016 us=18753 C:\WINDOWS\system32\route.exe ADD 192.168.1.0 MASK 255.255.255.0 10.8.0.9 METRIC 3
Tue Apr 05 13:09:43 2016 us=18753 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Apr 05 13:09:43 2016 us=34348 Route addition via IPAPI succeeded [adaptive]
Tue Apr 05 13:09:43 2016 us=34348 C:\WINDOWS\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.9
Tue Apr 05 13:09:43 2016 us=34348 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Apr 05 13:09:43 2016 us=34348 Route addition via IPAPI succeeded [adaptive]
Tue Apr 05 13:09:43 2016 us=34348 C:\WINDOWS\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.9
Tue Apr 05 13:09:43 2016 us=34348 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Apr 05 13:09:43 2016 us=34348 Route addition via IPAPI succeeded [adaptive]
Tue Apr 05 13:09:43 2016 us=34348 Initialization Sequence Completed
At this point I lose all connectivity to any network besides the default gateway of the wireless network. Cannot ping across the tunnel, or any hostname or IP address. The client config I am using on my computer is the following:
client
dev tun
#dev-node MyTAP
proto tcp
remote myhostname 25
route 192.168.1.0 255.255.255.0 vpn_gateway 3
#redirect-gateway
#dhcp-option DNS 8.8.8.8
resolv-retry infinite
nobind
persist-key
persist-tun
<ca>
-----BEGIN CERTIFICATE-----
XXXXXXXXXXXXXXXXXXXXXXXXXXX
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
XXXXXXXXXXXXXXXXXXXXXXXXXXX
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN RSA PRIVATE KEY-----
XXXXXXXXXXXXXXXXXXXXXXXXXXX
-----END RSA PRIVATE KEY-----
</key>
remote-cert-tls server
cipher BF-CBC # Blowfish (default) encrytion
comp-lzo
verb 4
And the server config:
port 444
proto tcp
dev tun
ca /mnt/openvpn/keys/ca.crt
cert /mnt/openvpn/keys/issued/openvpn-server.crt
key /mnt/openvpn/keys/private/openvpn-server.key
dh /mnt/openvpn/keys/dh.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "route 10.8.0.0 255.255.255.0"
route 192.168.1.25 255.255.255.0 10.8.0.1
keepalive 10 120
group nobody
user nobody
comp-lzo
persist-key
persist-tun
verb 3
I dont have the opportunity to post the client config of my phone but I will probably work out how to make it work if anybody helps me with this issue, so im going to leave it out.
The output of netstat -rn on the server:
Routing tables
Internet:
Destination Gateway Flags Refs Use Netif Expire
default 192.168.1.1 UGS 0 27220217 re0
127.0.0.1 link#9 UH 0 397229 lo0
192.168.1.0/24 link#1 U 0 50448256 re0
192.168.1.4 link#1 UHS 0 4729 lo0
192.168.5.0/24 192.168.1.1 UGS 0 0 re0
Internet6:
Destination Gateway Flags Netif Expire
::/96 ::1 UGRS lo0
::1 link#9 UH lo0
::ffff:0.0.0.0/96 ::1 UGRS lo0
fe80::/10 ::1 UGRS lo0
fe80::%lo0/64 link#9 U lo0
fe80::1%lo0 link#9 UHS lo0
ff01::%lo0/32 ::1 U lo0
ff02::/16 ::1 UGRS lo0
ff02::%lo0/32 ::1 U lo0
And from the jail which Openvpn is running on, in case theres a difference:
Routing tables
Internet:
Destination Gateway Flags Refs Use Netif Expire
default 192.168.1.1 UGS 0 1820 epair3
10.8.0.0/24 10.8.0.2 UGS 0 0 tun0
10.8.0.1 link#3 UHS 0 0 lo0
10.8.0.2 link#3 UH 0 0 tun0
127.0.0.1 link#1 UH 0 0 lo0
192.168.1.0/24 link#2 U 0 0 epair3
192.168.1.25 link#2 UHS 0 0 lo0
Internet6:
Destination Gateway Flags Netif Expire
::/96 ::1 UGRS lo0
::1 link#1 UH lo0
::ffff:0.0.0.0/96 ::1 UGRS lo0
fe80::/10 ::1 UGRS lo0
fe80::%lo0/64 link#1 U lo0
fe80::1%lo0 link#1 UHS lo0
ff01::%lo0/32 ::1 U lo0
ff02::/16 ::1 UGRS lo0
ff02::%lo0/32 ::1 U lo0
ifconfig on the jail:
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
inet 127.0.0.1 netmask 0xff000000
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
epair3b: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8<VLAN_MTU>
ether 02:77:5c:00:0f:0b
inet 192.168.1.25 netmask 0xffffff00 broadcast 192.168.1.255
nd6 options=9<PERFORMNUD,IFDISABLED>
media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
status: active
tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
options=80000<LINKSTATE>
inet 10.8.0.1 --> 10.8.0.2 netmask 0xffffffff
nd6 options=9<PERFORMNUD,IFDISABLED>
Im relatively new to linux, especially BSD so this is very foreign to me. Any help would be greatly appreciated! If you need any other information let me know.
