Bad source address

Nizen

I'm having connectivity issues with my VPN. Looking at the server logs, I'm seeing a bad source address...

Aug 25 17:44:47 hostname openvpn[1071]: nizen/A.B.C.D:53655 MULTI: bad source address from client [A.B.C.D], packet dropped

My configurations are as follow:

server.conf

;local a.b.c.d
port 1194
proto udp
dev tun

ca ca.crt
cert server.crt
key server.key  # This file should be kept secret

dh dh2048.pem

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

client-config-dir ccd
route 10.8.0.0 255.255.255.0

push "redirect-gateway def1"

push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

keepalive 10 120

comp-lzo

user nobody
group nobody

persist-key
persist-tun

status openvpn-status.log

verb 4

client.ovpn

client
dev tun
proto udp
remote wulong.starvingnomads.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 4
ca /root/ca.crt
cert /root/client.crt
key /root/client.key

iptables

# Generated by iptables-save v1.4.21 on Thu Aug 25 17:47:26 2016
*nat
:PREROUTING ACCEPT [2:120]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Thu Aug 25 17:47:26 2016

/var/log/messages

Aug 25 18:19:02 wulong openvpn[1071]: MULTI: multi_create_instance called
Aug 25 18:19:02 wulong openvpn[1071]: A.B.C.D:52055 Re-using SSL/TLS context
Aug 25 18:19:02 wulong openvpn[1071]: A.B.C.D:52055 LZO compression initialized
Aug 25 18:19:02 wulong openvpn[1071]: A.B.C.D:52055 Control Channel MTU parms [ L:1542 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Aug 25 18:19:02 wulong openvpn[1071]: A.B.C.D:52055 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
Aug 25 18:19:02 wulong openvpn[1071]: A.B.C.D:52055 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Aug 25 18:19:02 wulong openvpn[1071]: A.B.C.D:52055 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Aug 25 18:19:02 wulong openvpn[1071]: A.B.C.D:52055 Local Options hash (VER=V4): '530fdded'
Aug 25 18:19:02 wulong openvpn[1071]: A.B.C.D:52055 Expected Remote Options hash (VER=V4): '41690919'
Aug 25 18:19:02 wulong openvpn[1071]: A.B.C.D:52055 TLS: Initial packet from [AF_INET]198.101.146.53:52055, sid=7cc16a98 43585b72
Aug 25 18:19:02 wulong openvpn[1071]: A.B.C.D:52055 VERIFY OK: 
Aug 25 18:19:02 wulong openvpn[1071]: A.B.C.D:52055 VERIFY OK: 
Aug 25 18:19:02 wulong openvpn[1071]: A.B.C.D:52055 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Aug 25 18:19:02 wulong openvpn[1071]: A.B.C.D:52055 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Aug 25 18:19:02 wulong openvpn[1071]: A.B.C.D:52055 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Aug 25 18:19:02 wulong openvpn[1071]: A.B.C.D:52055 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Aug 25 18:19:02 wulong openvpn[1071]: A.B.C.D:52055 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Aug 25 18:19:02 wulong openvpn[1071]: A.B.C.D:52055 [nizen] Peer Connection Initiated with [AF_INET]198.101.146.53:52055
Aug 25 18:19:02 wulong openvpn[1071]: nizen/A.B.C.D:52055 OPTIONS IMPORT: reading client specific options from: ccd/nizen
Aug 25 18:19:02 wulong openvpn[1071]: nizen/A.B.C.D:52055 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Aug 25 18:19:02 wulong openvpn[1071]: nizen/A.B.C.D:52055 MULTI: Learn: 10.8.0.6 -> nizen/198.101.146.53:52055
Aug 25 18:19:02 wulong openvpn[1071]: nizen/A.B.C.D:52055 MULTI: primary virtual IP for nizen/198.101.146.53:52055: 10.8.0.6
Aug 25 18:19:02 wulong openvpn[1071]: nizen/A.B.C.D:52055 MULTI: internal route 10.8.0.0/24 -> nizen/198.101.146.53:52055
Aug 25 18:19:02 wulong openvpn[1071]: nizen/A.B.C.D:52055 MULTI: Learn: 10.8.0.0/24 -> nizen/198.101.146.53:52055
Aug 25 18:19:04 wulong openvpn[1071]: nizen/A.B.C.D:52055 PUSH: Received control message: 'PUSH_REQUEST'
Aug 25 18:19:04 wulong openvpn[1071]: nizen/A.B.C.D:52055 send_push_reply(): safe_cap=940
Aug 25 18:19:04 wulong openvpn[1071]: nizen/A.B.C.D:52055 SENT CONTROL [nizen]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

openvpn --config client.ovpn

Thu Aug 25 18:19:04 2016 us=427033 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Thu Aug 25 18:19:04 2016 us=427310 OPTIONS IMPORT: timers and/or timeouts modified
Thu Aug 25 18:19:04 2016 us=427342 OPTIONS IMPORT: --ifconfig/up options modified
Thu Aug 25 18:19:04 2016 us=427366 OPTIONS IMPORT: route options modified
Thu Aug 25 18:19:04 2016 us=427388 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Aug 25 18:19:04 2016 us=427925 ROUTE_GATEWAY A.B.C.1/255.255.255.0 IFACE=eth0 HWADDR=bc:76:4e:10:0d:40
Thu Aug 25 18:19:04 2016 us=459918 TUN/TAP device tun0 opened
Thu Aug 25 18:19:04 2016 us=460016 TUN/TAP TX queue length set to 100
Thu Aug 25 18:19:04 2016 us=460073 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Aug 25 18:19:04 2016 us=460136 /usr/sbin/ip link set dev tun0 up mtu 1500
Thu Aug 25 18:19:04 2016 us=466842 /usr/sbin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
Thu Aug 25 18:19:04 2016 us=473657 /usr/sbin/ip route add W.X.Y.Z/32 via 198.101.146.1
Thu Aug 25 18:19:04 2016 us=478625 /usr/sbin/ip route add 0.0.0.0/1 via 10.8.0.5
Thu Aug 25 18:19:04 2016 us=479873 /usr/sbin/ip route add 128.0.0.0/1 via 10.8.0.5

ccd/client1

iroute 10.8.0.0 255.255.255.0

This is the exact configuration that I am using right now. I see a couple of things, and I'm not sure why. I see that the addresses in the log file match, which doesn't make sense to me. I also see the gateway address for the client matches its original gateway while running openvpn. Is that to be expected?

When I run ovpn --config client.ovpn, my network drops and I am disconnected.

Nizen

I seem to miss the IP address sometimes. I should add a disclaimer that these are test servers and will be taken down. 🙂

TinCanTech

Nizen wroteccd/client1

Code: Select all
iroute 10.8.0.0 255.255.255.0

You have used the wrong address .. are you trying to route the VPN subnet through the VPN ?

You need the client's IP address .. eg: 192.168.x.x

Please see https://openvpn.net/index.php/open-source/documentation/howto.html#scope

Nizen

TinCanTech wrote
Nizen wroteccd/client1

Code: Select all
iroute 10.8.0.0 255.255.255.0
You have used the wrong address .. are you trying to route the VPN subnet through the VPN ?

You need the client's IP address .. eg: 192.168.x.x

Please see https://openvpn.net/index.php/open-source/documentation/howto.html#scope

Is there any way to make that global?

TinCanTech

What do you mean global ?

Nizen

I mean, I would like for the VPN server to accept connections from any IP.

TinCanTech

Generally, you can safely ignore the problem as your client ought to use the VPN IP 10.8.0.6 (or what ever you have configured) to connect to sites over the VPN. Packets from your client local IP will be logged and dropped.

If you have specific applications which do not use the correct source address then you will have to manually configure your VPN for every remote location you connect from .. there is no global configuration possible.