Hello everyone!!!
first of all, sorry for my terrible English(
But I could not find help elsewhere. I have some problem with double vpn connection. I have two VPS KVM with Debian 8. And my config all time worked on other servers. But now I don't know what's happened. looks like all works, but in browser I can't connect any website. But ping works to this site, and sometimes can't connect on ssh to another VPS when vpn works. I'm newbie to the study of networks. Maybe this is the reason I could not understand the problem.
Can someone tell me what I'm doing wrong or how to fix the problem?
And thank you for your help!
client
dev tun
persist-key
persist-tun
nobind
remote o.90.60.p 1193 udp
comp-lzo
tls-client
ns-cert-type server
verb 3
script-security 2
auth-nocache
tun-mtu 1500
cipher AES-256-CBC
auth SHA512
ns-cert-type server
tls-auth ta.key 1
cert client.crt
key client.key
ca ca.crt
up update-resolv-conf
dev tun0
port 1194
persist-tun
persist-key
server 10.10.0.0 255.255.255.0
management 127.0.0.1 7505
duplicate-cn
tun-mtu 1500
ping-timer-rem
keepalive 10 60
comp-lzo
auth SHA512
cipher AES-256-CBC
tls-server
tls-auth ssl/ta.key 0
dh ssl/dh4096.pem
cert ssl/server.crt
key ssl/server.key
ca ssl/ca.crt
verb 3
log /var/log/openvpn.log
status /var/log/openvpn-status.log
dev tun0
proto udp
port 1193
persist-tun
persist-key
server 10.11.0.0 255.255.255.0
management 127.0.0.1 7505
duplicate-cn
tun-mtu 1500
push "redirect-gateway def1"
push "dhcp-option DNS 10.10.0.1"
ping-timer-rem
keepalive 10 60
comp-lzo
auth SHA512
cipher AES-256-CBC
tls-server
tls-auth ssl/ta.key 0
dh ssl/dh4096.pem
cert ssl/server.crt
key ssl/server.key
ca ssl/ca.crt
verb 3
log /var/log/openvpn.log
status /var/log/openvpn-status.log
client
dev tun3
persist-key
persist-tun
nobind
remote 91.o.p.69 1194
proto udp
management 127.0.0.1 7506
comp-lzo
tls-client
ns-cert-type server
script-security 2
auth-nocache
tun-mtu 1500
cipher AES-256-CBC
auth SHA512
ns-cert-type server
tls-auth ssl2/ta.key 1
cert ssl2/client.crt
key ssl2/client.key
ca ssl2/ca.crt
verb 3
log /var/log/openvpn.log
status /var/log/openvpn-status.log
up uproute.sh
#!/bin/sh
ip rule add from 10.11.0.0/24 table vpn
ip route add default dev tun3 table vpn
iptables -t nat -A POSTROUTING -s 10.11.0.0/24 -o tun3 -j MASQUERADE
And logs
Wed Aug 31 19:11:09 2016 OpenVPN 2.3.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Nov 12 2015
Wed Aug 31 19:11:09 2016 library versions: OpenSSL 1.0.1t 3 May 2016, LZO 2.08
Wed Aug 31 19:11:09 2016 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Wed Aug 31 19:11:09 2016 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Wed Aug 31 19:11:09 2016 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Aug 31 19:11:09 2016 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Aug 31 19:11:09 2016 Socket Buffers: R=[212992->131072] S=[212992->131072]
Wed Aug 31 19:11:09 2016 UDPv4 link local: [undef]
Wed Aug 31 19:11:09 2016 UDPv4 link remote: [AF_INET]185.90.60.73:1193
Wed Aug 31 19:11:10 2016 TLS: Initial packet from [AF_INET]185.90.60.73:1193, sid=706a4869 b1542a4d
Wed Aug 31 19:11:11 2016 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=
me@myhost.mydomain
Wed Aug 31 19:11:11 2016 VERIFY OK: nsCertType=SERVER
Wed Aug 31 19:11:11 2016 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=server, name=EasyRSA, emailAddress=
me@myhost.mydomain
Wed Aug 31 19:11:12 2016 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Aug 31 19:11:12 2016 Data Channel Encrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Aug 31 19:11:12 2016 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Aug 31 19:11:12 2016 Data Channel Decrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Aug 31 19:11:12 2016 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Wed Aug 31 19:11:12 2016 [server] Peer Connection Initiated with [AF_INET]185.90.60.73:1193
Wed Aug 31 19:11:15 2016 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Aug 31 19:11:15 2016 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 10.10.0.1,route 10.11.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.11.0.6 10.11.0.5'
Wed Aug 31 19:11:15 2016 OPTIONS IMPORT: timers and/or timeouts modified
Wed Aug 31 19:11:15 2016 OPTIONS IMPORT: --ifconfig/up options modified
Wed Aug 31 19:11:15 2016 OPTIONS IMPORT: route options modified
Wed Aug 31 19:11:15 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Aug 31 19:11:15 2016 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=wlan0 HWADDR=38:91:fb:30:84:7b
Wed Aug 31 19:11:15 2016 TUN/TAP device tun0 opened
Wed Aug 31 19:11:15 2016 TUN/TAP TX queue length set to 100
Wed Aug 31 19:11:15 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Aug 31 19:11:15 2016 /sbin/ip link set dev tun0 up mtu 1500
Wed Aug 31 19:11:15 2016 /sbin/ip addr add dev tun0 local 10.11.0.6 peer 10.11.0.5
Wed Aug 31 19:11:15 2016 update-resolv-conf tun0 1500 1602 10.11.0.6 10.11.0.5 init
Wed Aug 31 19:11:15 2016 /sbin/ip route add 185.90.60.73/32 via 192.168.1.1
Wed Aug 31 19:11:15 2016 /sbin/ip route add 0.0.0.0/1 via 10.11.0.5
Wed Aug 31 19:11:15 2016 /sbin/ip route add 128.0.0.0/1 via 10.11.0.5
Wed Aug 31 19:11:15 2016 /sbin/ip route add 10.11.0.1/32 via 10.11.0.5
Wed Aug 31 19:11:15 2016 Initialization Sequence Completed
Wed Aug 31 18:14:43 2016 OpenVPN 2.3.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Nov 12 2015
Wed Aug 31 18:14:43 2016 library versions: OpenSSL 1.0.1t 3 May 2016, LZO 2.08
Wed Aug 31 18:14:43 2016 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:7505
Wed Aug 31 18:14:43 2016 Diffie-Hellman initialized with 4096 bit key
Wed Aug 31 18:14:43 2016 Control Channel Authentication: using 'ssl/ta.key' as a OpenVPN static key file
Wed Aug 31 18:14:43 2016 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Aug 31 18:14:43 2016 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Aug 31 18:14:43 2016 Socket Buffers: R=[212992->131072] S=[212992->131072]
Wed Aug 31 18:14:43 2016 ROUTE_GATEWAY 185.90.60.1/255.255Wed Aug 31 18:14:43 2016 UDPv4 link local: Wed Aug 31 18:14:43 2016 TUN/TAP device tun0 opened
Wed Aug 31 18:14:43 2016 TUNWed Aug 31 18:14:43 2016 TLS: Initial packet from [AF_INET]91.219.237.69:1194, sid=043611a3 b5aea894
Wed Aug 31 18:14:44 2016 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=
me@myhost.mydomain
Wed Aug 31 18:14:44 2016 VERIFY OK: nsCertType=SERVER
Wed Aug 31 18:14:44 2016 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=server, name=EasyRSA, emailAddress=
me@myhost.mydomain
Wed Aug 31 18:14:45 2016 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Aug 31 18:14:45 2016 Data Channel Encrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Aug 31 18:14:45 2016 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Aug 31 18:14:45 2016 Data Channel Decrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Aug 31 18:14:45 2016 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Wed Aug 31 18:14:45 2016 [server] Peer Connection Initiated with [AF_INET]91.219.237.69:1194
Wed Aug 31 18:14:47 2016 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Aug 31 18:14:47 2016 PUSH: Received control message: 'PUSH_REPLY,route 10.10.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.10.0.6 10.10.0.5'
Wed Aug 31 18:14:47 2016 OPTIONS IMPORT: timers and/or timeouts modified
Wed Aug 31 18:14:47 2016 OPTIONS IMPORT: --ifconfig/up options modified
Wed Aug 31 18:14:47 2016 OPTIONS IMPORT: route options modified
Wed Aug 31 18:14:47 2016 ROUTE_GATEWAY 185.90.60.1/255.255.255.0 IFACE=eth0 HWADDR=00:16:3c:fc:1a:e2
Wed Aug 31 18:14:47 2016 TUN/TAP device tun3 opened
Wed Aug 31 18:14:47 2016 TUN/TAP TX queue length set to 100
Wed Aug 31 18:14:47 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Aug 31 18:14:47 2016 /sbin/ip link set dev tun3 up mtu 1500
Wed Aug 31 18:14:47 2016 /sbin/ip addr add dev tun3 local 10.10.0.6 peer 10.10.0.5
Wed Aug 31 18:14:47 2016 uproute.sh tun3 1500 1602 10.10.0.6 10.10.0.5 init
Wed Aug 31 18:14:48 2016 /sbin/ip route add 10.10.0.1/32 via 10.10.0.5
Wed Aug 31 18:14:48 2016 Initialization Sequence Completed
Wed Aug 31 18:15:05 2016 OpenVPN 2.3.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Nov 12 2015
Wed Aug 31 18:15:05 2016 library versions: OpenSSL 1.0.1t 3 May 2016, LZO 2.08
Wed Aug 31 18:15:05 2016 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:7505
Wed Aug 31 18:15:05 2016 Diffie-Hellman initialized with 4096 bit key
Wed Aug 31 18:15:05 2016 Control Channel Authentication: using 'ssl/ta.key' as a OpenVPN static key file
Wed Aug 31 18:15:05 2016 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Aug 31 18:15:05 2016 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Aug 31 18:15:05 2016 Socket Buffers: R=[212992->131072] S=[212992->131072]
Wed Aug 31 18:15:05 2016 ROUTE_GATEWAY 91.219.237.1/255.255.255.0 IFACE=eth0 HWADDR=aa:00:00:f5:a6:11
Wed Aug 31 18:15:05 2016 TUN/TAP device tun0 opened
Wed Aug 31 18:15:05 2016 TUN/TAP TX queue length set to 100
Wed Aug 31 18:15:05 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Aug 31 18:15:05 2016 /sbin/ip link set dev tun0 up mtu 1500
Wed Aug 31 18:15:05 2016 /sbin/ip addr add dev tun0 local 10.10.0.1 peer 10.10.0.2
Wed Aug 31 18:15:05 2016 /sbin/ip route add 10.10.0.0/24 via 10.10.0.2
Wed Aug 31 18:15:05 2016 UDPv4 link local (bound): [undef]
Wed Aug 31 18:15:05 2016 UDPv4 link remote: [undef]
Wed Aug 31 18:15:05 2016 MULTI: multi_init called, r=256 v=256
Wed Aug 31 18:15:05 2016 IFCONFIG POOL: base=10.10.0.4 size=62, ipv6=0
Wed Aug 31 18:15:05 2016 Initialization Sequence Completed
Wed Aug 31 18:15:14 2016 185.90.60.73:35629 TLS: Initial packet from [AF_INET]185.90.60.73:35629, sid=03591868 e93fd232
Wed Aug 31 18:15:15 2016 185.90.60.73:35629 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=
me@myhost.mydomain
Wed Aug 31 18:15:15 2016 185.90.60.73:35629 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=client, name=EasyRSA, emailAddress=
me@myhost.mydomain
Wed Aug 31 18:15:16 2016 185.90.60.73:35629 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Aug 31 18:15:16 2016 185.90.60.73:35629 Data Channel Encrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Aug 31 18:15:16 2016 185.90.60.73:35629 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Aug 31 18:15:16 2016 185.90.60.73:35629 Data Channel Decrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Aug 31 18:15:16 2016 185.90.60.73:35629 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Wed Aug 31 18:15:16 2016 185.90.60.73:35629 [client] Peer Connection Initiated with [AF_INET]185.90.60.73:35629
Wed Aug 31 18:15:16 2016 client/185.90.60.73:35629 MULTI_sva: pool returned IPv4=10.10.0.6, IPv6=(Not enabled)
Wed Aug 31 18:15:16 2016 client/185.90.60.73:35629 MULTI: Learn: 10.10.0.6 -> client/185.90.60.73:35629
Wed Aug 31 18:15:16 2016 client/185.90.60.73:35629 MULTI: primary virtual IP for client/185.90.60.73:35629: 10.10.0.6
Wed Aug 31 18:15:18 2016 client/185.90.60.73:35629 PUSH: Received control message: 'PUSH_REQUEST'
Wed Aug 31 18:15:18 2016 client/185.90.60.73:35629 send_push_reply(): safe_cap=940
Wed Aug 31 18:15:18 2016 client/185.90.60.73:35629 SENT CONTROL [client]: 'PUSH_REPLY,route 10.10.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.10.0.6 10.10.0.5' (status=1)
