hi, several days trying to set it up
client log
Mon Sep 26 15:42:47 2016 Control Channel Authentication: using '/etc/openvpn/ta.key' as a OpenVPN static key file
Mon Sep 26 15:42:47 2016 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Sep 26 15:42:47 2016 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Sep 26 15:42:47 2016 Socket Buffers: R=[212992->131072] S=[212992->131072]
Mon Sep 26 15:42:47 2016 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Mon Sep 26 15:42:47 2016 UDPv4 link local (bound): [undef]
Mon Sep 26 15:42:47 2016 UDPv4 link remote: [AF_INET]192.168.1.37:1194
Mon Sep 26 15:42:47 2016 TLS: Initial packet from [AF_INET]192.168.1.37:1194, sid=c20d12c1 e53683c8
Mon Sep 26 15:42:47 2016 VERIFY OK: depth=1, C=NL, ST=NH, L=DeRijp, O=Fort-Koper, OU=Koper, CN=server, name=Server, emailAddress=koper97@o2.pl
Mon Sep 26 15:42:47 2016 VERIFY OK: nsCertType=SERVER
Mon Sep 26 15:42:47 2016 VERIFY OK: depth=0, C=NL, ST=NH, L=DeRijp, O=Fort-Koper, OU=Koper, CN=server, name=Server, emailAddress=koper97@o2.pl
Mon Sep 26 15:42:49 2016 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1562', remote='link-mtu 1558'
Mon Sep 26 15:42:49 2016 WARNING: 'mtu-dynamic' is present in local config but missing in remote config, local='mtu-dynamic'
Mon Sep 26 15:42:49 2016 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Sep 26 15:42:49 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Sep 26 15:42:49 2016 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Sep 26 15:42:49 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Sep 26 15:42:49 2016 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Sep 26 15:42:49 2016 [server] Peer Connection Initiated with [AF_INET]192.168.1.37:1194
Mon Sep 26 15:42:52 2016 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Sep 26 15:42:52 2016 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,redirect-gateway local def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.0.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.0.0.5 10.0.0.6'
Mon Sep 26 15:42:52 2016 OPTIONS IMPORT: timers and/or timeouts modified
Mon Sep 26 15:42:52 2016 OPTIONS IMPORT: --ifconfig/up options modified
Mon Sep 26 15:42:52 2016 OPTIONS IMPORT: route options modified
Mon Sep 26 15:42:52 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon Sep 26 15:42:52 2016 ROUTE_GATEWAY 192.168.1.254/255.255.255.0 IFACE=wlp6s0 HWADDR=00:1f:e1:9f:fc:30
Mon Sep 26 15:42:52 2016 TUN/TAP device tun0 opened
Mon Sep 26 15:42:52 2016 TUN/TAP TX queue length set to 100
Mon Sep 26 15:42:52 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Sep 26 15:42:52 2016 /sbin/ip link set dev tun0 up mtu 1500
Mon Sep 26 15:42:52 2016 /sbin/ip addr add dev tun0 local 10.0.0.5 peer 10.0.0.6
Mon Sep 26 15:42:52 2016 /sbin/ip route add 0.0.0.0/1 via 10.0.0.6
Mon Sep 26 15:42:52 2016 /sbin/ip route add 128.0.0.0/1 via 10.0.0.6
Mon Sep 26 15:42:52 2016 /sbin/ip route add 192.168.1.0/24 via 10.0.0.6
Mon Sep 26 15:42:52 2016 /sbin/ip route add 10.0.0.1/32 via 10.0.0.6
Mon Sep 26 15:42:52 2016 GID set to nogroup
Mon Sep 26 15:42:52 2016 UID set to nobody
Mon Sep 26 15:42:52 2016 Initialization Sequence Completed
Mon Sep 26 15:44:52 2016 [server] Inactivity timeout (--ping-restart), restarting
Mon Sep 26 15:44:52 2016 SIGUSR1[soft,ping-restart] received, process restarting
Mon Sep 26 15:44:52 2016 Restart pause, 2 second(s)
Mon Sep 26 15:44:54 2016 Socket Buffers: R=[212992->131072] S=[212992->131072]
Mon Sep 26 15:44:54 2016 UDPv4 link local (bound): [undef]
Mon Sep 26 15:44:54 2016 UDPv4 link remote: [AF_INET]192.168.1.37:1194
Mon Sep 26 15:45:54 2016 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
here is client setup (ubuntu) - this same local network
remote 192.168.1.36 1194
client
fragment 1000
dev tun
proto udp
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/client1.crt
key /etc/openvpn/client1.key
ns-cert-type server
tls-auth /etc/openvpn/ta.key 1
cipher AES-256-CBC
verb 3
keepalive 10 120
comp-lzo
and here server setup (debian):
local 192.168.1.36
port 1194
proto udp
dev tun
keepalive 10 120
ca /etc/mojeCA/keys/ca.crt
cert /etc/mojeCA/keys/server.crt
key /etc/mojeCA/keys/server.key
dh /etc/mojeCA/keys/dh2048.pem
tls-auth /etc/mojeCA/ta.key 0
cipher AES-256-CBC
server 10.0.0.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"
push "redirect-gateway local def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
max-clients 10
user nobody
group nogroup
comp-lzo
persist-key
persist-tun
ifconfig serwer
wlan0 Link encap:Ethernet HWaddr ac:e0:10:68:6d:c8
inet addr:192.168.1.36 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::aee0:10ff:fe68:6dc8/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:17557 errors:0 dropped:0 overruns:0 frame:0
TX packets:5491 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:9415101 (8.9 MiB) TX bytes:1007777 (984.1 KiB)
ipconfig server (client everything accept)
iptables -F
iptables -X
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -j SNAT --to-source 192.168.1.36
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i wlan0 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -i tun0 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -i wlan0 -p udp -m udp --dport 1194 -j ACCEPT
iptables -A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -j LOG --log-prefix 'iptables INPUT: '
iptables -P INPUT DROP
what am i doing wrong?
