Network drops after connect

Nizen

I'm trying to configure a VPN server, and when I try to connect with my current configuration, my remote machine drops me, and I have to reboot it. This is how my configuration looks:

/etc/openvpn/server.conf #change with your port
port 1194

#You can use udp or tcp
proto udp

# "dev tun" will create a routed IP tunnel.
dev tun

#Certificate Configuration

#ca certificate
ca /etc/openvpn/easy-rsa/keys/ca.crt

#Server Certificate
cert /etc/openvpn/easy-rsa/keys/server.crt

#Server Key and keep this is secret
key /etc/openvpn/easy-rsa/keys/server.key

#See the size a dh key in /etc/openvpn/keys/
dh /etc/openvpn/easy-rsa/keys/dh2048.pem

#Internal IP will get when already connect
server 10.8.0.0 255.255.255.0

#this line will redirect all traffic through our OpenVPN
push "redirect-gateway def1"
#push "remote-gateway 10.8.0.5"
#Provide DNS servers to the client, you can use goolge DNS
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

#Enable multiple client to connect with same key
duplicate-cn

keepalive 20 60
comp-lzo
persist-key
persist-tun
daemon

#enable log
log-append /var/log/myvpn/openvpn.log

#Log Level
verb 3 client.ovpn client
dev tun
proto udp
remote xxx.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
ca /root/ca.crt
cert /root/client.crt
key /root/client.key iptables

*nat
:PREROUTING ACCEPT [671:56750]
:INPUT ACCEPT [665:56294]
:OUTPUT ACCEPT [165:12223]
:POSTROUTING ACCEPT [165:12223]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT

When I run openvpn, I get output until it hits the routing, and it drops my connection:

[root@vpntestserver ~]# openvpn --config test.ovpn

Server side:

Aug 24 19:23:21 wulong openvpn[20344]: 166.78.244.39:46985 TLS: Initial packet from [AF_INET]PUBLIC_IP:46985, sid=a18792ce 0e216f9a
Aug 24 19:23:21 wulong openvpn[20344]: 166.78.244.39:46985 VERIFY OK: depth=1, C=US, ST=TX, L=*********, O=************, OU=*************, CN=**********, name=*********
Wed Aug 24 19:23:21 2016 VERIFY OK: depth=0, C=US, ST=TX, L=*********, O=************, OU=S*************, CN=**********, name=*********, emailAddress=********
Aug 24 19:23:21 wulong openvpn[20344]: 166.78.244.39:46985 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Aug 24 19:23:21 wulong openvpn[20344]: 166.78.244.39:46985 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Aug 24 19:23:21 wulong openvpn[20344]: 166.78.244.39:46985 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Aug 24 19:23:21 wulong openvpn[20344]: 166.78.244.39:46985 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Aug 24 19:23:21 wulong openvpn[20344]: 166.78.244.39:46985 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Aug 24 19:23:21 wulong openvpn[20344]: 166.78.244.39:46985 [nizen] Peer Connection Initiated with [AF_INET]166.78.244.39:46985
Aug 24 19:23:21 wulong openvpn[20344]: nizen/166.78.244.39:46985 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Aug 24 19:23:21 wulong openvpn[20344]: nizen/166.78.244.39:46985 MULTI: Learn: 10.8.0.6 -> nizen/166.78.244.39:46985
Aug 24 19:23:21 wulong openvpn[20344]: nizen/166.78.244.39:46985 MULTI: primary virtual IP for nizen/166.78.244.39:46985: 10.8.0.6
Aug 24 19:23:23 wulong openvpn[20344]: nizen/166.78.244.39:46985 PUSH: Received control message: 'PUSH_REQUEST'
Aug 24 19:23:23 wulong openvpn[20344]: nizen/166.78.244.39:46985 send_push_reply(): safe_cap=940
Aug 24 19:23:23 wulong openvpn[20344]: nizen/166.78.244.39:46985 SENT CONTROL [nizen]: 'PUSH_REPLY,redirect-gateway def1,remote-gateway 10.8.0.5,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 20,ping-restart 60,ifconfig 10.8.0.6 10.8.0.5' (status=1)

Client side:

Wed Aug 24 19:23:21 2016 OpenVPN 2.3.11 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on May 10 2016
Wed Aug 24 19:23:21 2016 library versions: OpenSSL 1.0.1e-fips 11 Feb 2013, LZO 2.06
Wed Aug 24 19:23:21 2016 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Aug 24 19:23:21 2016 Socket Buffers: R=[212992->212992] S=[212992->212992]
Wed Aug 24 19:23:21 2016 UDPv4 link local: [undef]
Wed Aug 24 19:23:21 2016 UDPv4 link remote: [AF_INET]198.101.146.50:1194
Wed Aug 24 19:23:21 2016 TLS: Initial packet from [AF_INET]198.101.146.50:1194, sid=989f523a f07a9246
Wed Aug 24 19:23:21 2016 VERIFY OK: depth=1, C=US, ST=TX, L=*********, O=************, OU=*************, CN=**********, name=*********, emailAddress=********
Wed Aug 24 19:23:21 2016 VERIFY OK: depth=0, C=US, ST=TX, L=*********, O=************, OU=S*************, CN=**********, name=*********, emailAddress=********
Wed Aug 24 19:23:21 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Aug 24 19:23:21 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 24 19:23:21 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Aug 24 19:23:21 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 24 19:23:21 2016 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Wed Aug 24 19:23:21 2016 [wulong] Peer Connection Initiated with [AF_INET]198.101.146.50:1194
Wed Aug 24 19:23:23 2016 SENT CONTROL [wulong]: 'PUSH_REQUEST' (status=1)
Wed Aug 24 19:23:23 2016 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,remote-gateway 10.8.0.5,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 20,ping-restart 60,ifconfig 10.8.0.6 10.8.0.5'
Wed Aug 24 19:23:23 2016 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:2: remote-gateway (2.3.11)
Wed Aug 24 19:23:23 2016 OPTIONS IMPORT: timers and/or timeouts modified
Wed Aug 24 19:23:23 2016 OPTIONS IMPORT: --ifconfig/up options modified
Wed Aug 24 19:23:23 2016 OPTIONS IMPORT: route options modified
Wed Aug 24 19:23:23 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Aug 24 19:23:23 2016 ROUTE_GATEWAY 166.78.244.1/255.255.255.0 IFACE=eth0 HWADDR=bc:76:4e:10:d0:22
Wed Aug 24 19:23:23 2016 TUN/TAP device tun0 opened
Wed Aug 24 19:23:23 2016 TUN/TAP TX queue length set to 100
Wed Aug 24 19:23:23 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Aug 24 19:23:23 2016 /usr/sbin/ip link set dev tun0 up mtu 1500
Wed Aug 24 19:23:23 2016 /usr/sbin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
Wed Aug 24 19:23:23 2016 /usr/sbin/ip route add 198.101.146.50/32 via 166.78.244.1
Wed Aug 24 19:23:23 2016 /usr/sbin/ip route add 0.0.0.0/1 via 10.8.0.5
Wed Aug 24 19:23:23 2016 /usr/sbin/ip route add 128.0.0.0/1 via 10.8.0.

I'm sure this has been addressed, and I'm missing it, and if so, feel free to let me know harshly and then direct me to a response. Thanks in advance!! This is really frustrating me.

TinCanTech

Nizen wroteOptions error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:2: remote-gateway (2.3.11)

You must have posted the wrong server config .. because your config is not configured to push that unrecognised option.

Nizen

TinCanTech wrote
Nizen wroteOptions error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:2: remote-gateway (2.3.11)
You must have posted the wrong server config .. because your config is not configured to push that unrecognised option.

Yes, I noticed that too, but I posted the exact one I am using.

TinCanTech

No you did not.

Nizen

I actually blew it all away and started over, so I will update with my current configuration.

server.conf

;local a.b.c.d
port 1194
;proto tcp
proto udp
;dev tap
dev tun
;dev-node MyTap

ca ca.crt
cert wulong.crt
key wulong.key  # This file should be kept secret

dh dh2048.pem

;topology subnet

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100

;server-bridge

;push "route 192.168.10.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"

;client-config-dir ccd
;route 192.168.40.128 255.255.255.248
;client-config-dir ccd
;route 10.9.0.0 255.255.255.252


push "redirect-gateway def1"

push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

;client-to-client

;duplicate-cn

keepalive 10 120

;tls-auth ta.key 0 # This file is secret

comp-lzo

;max-clients 100
user nobody
group nobody

persist-key
persist-tun

status openvpn-status.log

verb 3

iptables

# Generated by iptables-save v1.4.21 on Wed Aug 24 22:59:26 2016
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Wed Aug 24 22:59:26 2016

client.ovpn

client
dev tun
proto udp
remote myhostname.here.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
ca /root/ca.crt
cert /root/client.crt
key /root/client.key

Server logs

Aug 24 22:54:02 localhost openvpn[1635]: 198.101.146.53:32799 TLS: Initial packet from [AF_INET]198.101.146.53:32799, sid=262ff39f 404b0270
Aug 24 22:54:02 localhost openvpn[1635]: 198.101.146.53:32799 VERIFY OK: depth=1, C=US, ST=TX, L=SanAntonio, O=******, OU=******, CN=******, name=*****, emailAddress=******
Aug 24 22:54:02 localhost openvpn[1635]: 198.101.146.53:32799 VERIFY OK: depth=0, C=US, ST=TX, L=SanAntonio, O=******, OU=******, CN=***** name=wulong, emailAddress=******
Aug 24 22:54:02 localhost openvpn[1635]: 198.101.146.53:32799 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Aug 24 22:54:02 localhost openvpn[1635]: 198.101.146.53:32799 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Aug 24 22:54:02 localhost openvpn[1635]: 198.101.146.53:32799 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Aug 24 22:54:02 localhost openvpn[1635]: 198.101.146.53:32799 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Aug 24 22:54:02 localhost openvpn[1635]: 198.101.146.53:32799 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Aug 24 22:54:02 localhost openvpn[1635]: 198.101.146.53:32799 [nizen] Peer Connection Initiated with [AF_INET]198.101.146.53:32799
Aug 24 22:54:02 localhost openvpn[1635]: nizen/198.101.146.53:32799 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Aug 24 22:54:02 localhost openvpn[1635]: nizen/198.101.146.53:32799 MULTI: Learn: 10.8.0.6 -> nizen/198.101.146.53:32799
Aug 24 22:54:02 localhost openvpn[1635]: nizen/198.101.146.53:32799 MULTI: primary virtual IP for nizen/198.101.146.53:32799: 10.8.0.6
Aug 24 22:54:04 localhost openvpn[1635]: nizen/198.101.146.53:32799 PUSH: Received control message: 'PUSH_REQUEST'
Aug 24 22:54:04 localhost openvpn[1635]: nizen/198.101.146.53:32799 send_push_reply(): safe_cap=940
Aug 24 22:54:04 localhost openvpn[1635]: nizen/198.101.146.53:32799 SENT CONTROL [nizen]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

Client side

[root@vpntest ~]# openvpn --config test.ovpn 
Wed Aug 24 23:14:30 2016 OpenVPN 2.3.11 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on May 10 2016
Wed Aug 24 23:14:30 2016 library versions: OpenSSL 1.0.1e-fips 11 Feb 2013, LZO 2.06
Wed Aug 24 23:14:30 2016 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Aug 24 23:14:30 2016 Socket Buffers: R=[212992->212992] S=[212992->212992]
Wed Aug 24 23:14:30 2016 UDPv4 link local: [undef]
Wed Aug 24 23:14:30 2016 UDPv4 link remote: [AF_INET]*******:1194
Wed Aug 24 23:14:30 2016 TLS: Initial packet from [AF_INET]*******:1194, sid=2dea07e6 b490cb55
Wed Aug 24 23:14:30 2016 VERIFY OK: depth=1, C=US, ST=TX, L=SanAntonio, O=*******, OU=*******, CN=*******, name=******, emailAddress=******
Wed Aug 24 23:14:30 2016 VERIFY OK: depth=0, C=US, ST=TX, L=SanAntonio, O=******, OU=*******, CN=******, name=*****, emailAddress=*****
Wed Aug 24 23:14:30 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Aug 24 23:14:30 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 24 23:14:30 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Aug 24 23:14:30 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 24 23:14:30 2016 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Wed Aug 24 23:14:30 2016 [wulong] Peer Connection Initiated with [AF_INET]166.78.124.174:1194
Wed Aug 24 23:14:32 2016 SENT CONTROL [wulong]: 'PUSH_REQUEST' (status=1)
Wed Aug 24 23:14:32 2016 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Wed Aug 24 23:14:32 2016 OPTIONS IMPORT: timers and/or timeouts modified
Wed Aug 24 23:14:32 2016 OPTIONS IMPORT: --ifconfig/up options modified
Wed Aug 24 23:14:32 2016 OPTIONS IMPORT: route options modified
Wed Aug 24 23:14:32 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Aug 24 23:14:32 2016 ROUTE_GATEWAY 198.101.146.1/255.255.255.0 IFACE=eth0 HWADDR=bc:76:4e:10:0d:40
Wed Aug 24 23:14:32 2016 TUN/TAP device tun0 opened
Wed Aug 24 23:14:32 2016 TUN/TAP TX queue length set to 100
Wed Aug 24 23:14:32 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Aug 24 23:14:32 2016 /usr/sbin/ip link set dev tun0 up mtu 1500
Wed Aug 24 23:14:32 2016 /usr/sbin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
Wed Aug 24 23:14:32 2016 /usr/sbin/ip route add ******/32 via 198.101.146.1
Wed Aug 24 23:14:32 2016 /usr/sbin/ip route add 0.0.0.0/1 via 10.8.0.5
Wed Aug 24 23:14:32 2016 /usr/sbin/ip route add 128.0.0.0/1 via 10.8.0.5

Nizen

TinCanTech wroteNo you did not.

Yes, I did, because I read the same log a number of times before I even came to this forum. 🙂

TinCanTech

Nizen wroteYes, I did

Then prove how your server pushed an option which does not even exist in openvpn.

Whatever you posted, you posted the wrong details ..

Nizen

TinCanTech wrote
Nizen wroteYes, I did
Then prove how your server pushed an option which does not even exist in openvpn.

Whatever you posted, you posted the wrong details ..

Except for I didn't. I have checked, and I have checked again. I posted exactly what was in each relative label.

TinCanTech

First things first, your new configs and logs look normal and your iptables has only the masquerade rule, so does your client still get dropped ? If so please use verb 4 in your configs and post complete logs on this forum showing the disconnect (remove any personal data you do not want to make public)

Secondly, and this is only because of your insistence .. Read the manual and you will see there is no such option as --remote-gateway and the only way that it can appear in your log as it does is for you to have customised your server config with the incorrect option. Openvpn does not randomly push spurious data and if it did there would be rioting on the mailing list. Ergo .. you posted the wrong data. If you can work out what mistake you made then perhaps you will find the root cause .. or you can just move on with what appears to be a working vpn.

Nizen

Ok, so I can slightly understand where the skepticism is coming from, however, I hadn't touched the configuration files between the time I copied it from the server, and the time I pasted it on this forum.

Moving along, I did as you suggested and changed verb 3 to verb 4. I'm getting this now:

Aug 25 16:23:48 localhost openvpn[27762]: nizen/IP:54393 MULTI: bad source address from client [IP], packet dropped

Looking in to this now.

TinCanTech

See this section of the HOWTO:
HOWTO: Expanding the scope of the VPN to include additional machines

You need to configure the server to understand how to --iroute the client IP

TinCanTech

Nizen wroteI hadn't touched the configuration files between the time I copied it from the server, and the time I pasted it on this forum

It is not skepticism[sic] it is an out right fact .. What ever you did .. you did it wrong.

Nizen

I'm looking at the iroute now. Thanks.

TinCanTech wrote
Nizen wroteI hadn't touched the configuration files between the time I copied it from the server, and the time I pasted it on this forum
It is not skepticism[sic] it is an out right fact .. What ever you did .. you did it wrong.

Well, looking at the exact configuration I used, and posted would tell you what I did or did not do wrong, since I posted the configuration I was using.

TinCanTech

TinCanTech wrote
Nizen wroteOptions error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:2: remote-gateway (2.3.11)
You must have posted the wrong server config .. because your config is not configured to push that unrecognised option.

Perhaps you posted the wrong log .. either way, your posted config cannot generate your posted log. :roll:

Ciao ..

Nizen

I'd rather figure it out on my own than waste my time with someone who is obviously trying to stroke their own ego. Thanks for whatever you've kind of provided so far. I'll take it from here.

TinCanTech

Nizen wrotefeel free to let me know harshly and then direct me to a response. Thanks in advance!! .

You literally gave me your permission ..

Nizen wroteThis is really frustrating me

Tell me about it ..

Nizen wroteI'd rather figure it out on my own than waste my time with someone who is obviously trying to stroke their own ego

I pointed out what you did wrong and I have explained why it must be wrong .. you insist that I am wrong and that openvpn is indeed pushing an option that does not exist in either your config or even in openvpn itself. No matter how you look at it you are wrong .. your config does not match your log or you are not using a supported version of openvpn.

Nizen wroteI'll take it from here

Good luck .. Ciao.

Nizen

TinCanTech wroteYou literally gave me your permission ..

I feel like you didn't read it completely. I said

nizen wroteI'm sure this has been addressed, and I'm missing it, and if so, feel free to let me know harshly and then direct me to a response.

This was specifically in reference to a pre-existing thread with the same subject matter.😉

TinCanTech

Nizen wroteI feel like you didn't read it completely. I said
nizen wroteI'm sure this has been addressed, and I'm missing it, and if so, feel free to let me know harshly and then direct me to a response.
This was specifically in reference to a pre-existing thread with the same subject matter

If you want to spend hours looking through other peoples threads for a solution be my guest .. use googles site: tag like so:

Google

site:forums.openvpn.net your search term

Note: no space after site:

On the other hand you can try working with me, admit that you don't know why your configs and logs do not match and try to get to a timely resolution .. that is if it is not fixed already and you are just trolling .. :mrgreen:

nizen wrotethen direct me to a response

The most efficient way for you to solve this yourself is by following the HOWTO .. which, by now, I am sure you have read cover to cover many times .. :geek:

Nizen wroteNice rephrase, though. You should work for Fox News

There is no room for the truth in Fox News .. so that idea is a non-starter right off the bat ..

Although, perhaps you should work for the NSA, you are in such deep denial.