VPN traffic forwarding problem - MULTI bad source address

jjjames

Hi all

Yet another post on getting internet traffic through through the OpenVPN server!

I'm using the latest and greatest Community version of OpenVPN and I'm running it on a Raspberry Pi 3.
I've ploughed through several online guides, correcting typos en route and now at last I have got traffic working over the VPN.

Despite this forum being a tremendous help in getting this far, I have come unstuck on getting my network and the internet
visible to the client machines routed through the OpenVPN server. I can't see anything on my VPN except both ends of the tunnel, and
can't ping any external addresses. (so DNS won't work anyway, as you can't see 8.8.8.8 etc )

So, in terms of what I have setup... all the configs and logs are attached per below with verbosity set at 4 for a windows client session.

This is for a home setup, the Pi/VPN server is at 192.168.200.200. Gateway/router is at 192.168.200.1.

So far:
- Redirection is set on in the server: push "redirect-gateway local def1"
- The DNS is set to my local router: push "dhcp-option DNS 192.168.200.1" - changing this makes no difference as its not reachable anyway
- The iptables are setup to configure at startup: "iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE"
(through a script fireall-openvpn-rules.sh)
- IP Port forwarding is enabled: /etc/sysctl.conf and uncomment net.ipv4.ip_forward=1

I am a clueless Linux noob so no surprise if I've got another typo or left something blindingly obvious out. The server logs show 'Bad source address from client' so I have to believe that might be something to do with it?

Note: the server does not come up cleanly on reboot because on the Pi you need to restart the OpenVPN service to get it to work. I understand this is a standard feature of OpenVPN on the Pi.

Any clues would be most welcome!

thanks in advance!
local 192.168.200.200
dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/OpenVPN-Server.crt
key /etc/openvpn/easy-rsa/keys/OpenVPN-Server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig 10.8.0.1 10.8.0.2
push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"
push "route 192.168.200.0 255.255.255.0"
push "dhcp-option DNS 192.168.200.1"
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 4 client
dev tun
proto udp
remote #my-static-ip# 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
key-direction 1
cipher AES-128-CBC
comp-lzo
verb 4
mute 20

<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN RSA PRIVATE KEY-----
-----END RSA PRIVATE KEY-----
</key>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
-----END OpenVPN Static key V1-----
</tls-auth>

Sun Oct 23 14:20:19 2016 us=727346 Current Parameter Settings:
Sun Oct 23 14:20:19 2016 us=727515   config = '/etc/openvpn/server.conf'
Sun Oct 23 14:20:19 2016 us=727550   mode = 1
Sun Oct 23 14:20:19 2016 us=727580   persist_config = DISABLED
Sun Oct 23 14:20:19 2016 us=727609   persist_mode = 1
Sun Oct 23 14:20:19 2016 us=727637   show_ciphers = DISABLED
Sun Oct 23 14:20:19 2016 us=727666   show_digests = DISABLED
Sun Oct 23 14:20:19 2016 us=727694   show_engines = DISABLED
Sun Oct 23 14:20:19 2016 us=727721   genkey = DISABLED
Sun Oct 23 14:20:19 2016 us=727749   key_pass_file = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=727777   show_tls_ciphers = DISABLED
Sun Oct 23 14:20:19 2016 us=727805 Connection profiles [default]:
Sun Oct 23 14:20:19 2016 us=727835   proto = udp
Sun Oct 23 14:20:19 2016 us=727863   local = '192.168.200.200'
Sun Oct 23 14:20:19 2016 us=727891   local_port = 1194
Sun Oct 23 14:20:19 2016 us=727918   remote = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=727947   remote_port = 1194
Sun Oct 23 14:20:19 2016 us=727975   remote_float = DISABLED
Sun Oct 23 14:20:19 2016 us=728002   bind_defined = DISABLED
Sun Oct 23 14:20:19 2016 us=728030   bind_local = ENABLED
Sun Oct 23 14:20:19 2016 us=728058   connect_retry_seconds = 5
Sun Oct 23 14:20:19 2016 us=728085   connect_timeout = 10
Sun Oct 23 14:20:19 2016 us=728113   connect_retry_max = 0
Sun Oct 23 14:20:19 2016 us=728141   socks_proxy_server = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=728169   socks_proxy_port = 0
Sun Oct 23 14:20:19 2016 us=728196   socks_proxy_retry = DISABLED
Sun Oct 23 14:20:19 2016 us=728224   tun_mtu = 1500
Sun Oct 23 14:20:19 2016 us=728251   tun_mtu_defined = ENABLED
Sun Oct 23 14:20:19 2016 us=728279   link_mtu = 1500
Sun Oct 23 14:20:19 2016 us=728306   link_mtu_defined = DISABLED
Sun Oct 23 14:20:19 2016 us=728334   tun_mtu_extra = 0
Sun Oct 23 14:20:19 2016 us=728361   tun_mtu_extra_defined = DISABLED
Sun Oct 23 14:20:19 2016 us=728390   mtu_discover_type = -1
Sun Oct 23 14:20:19 2016 us=728417   fragment = 0
Sun Oct 23 14:20:19 2016 us=728444   mssfix = 1450
Sun Oct 23 14:20:19 2016 us=728472   explicit_exit_notification = 0
Sun Oct 23 14:20:19 2016 us=728499 Connection profiles END
Sun Oct 23 14:20:19 2016 us=728527   remote_random = DISABLED
Sun Oct 23 14:20:19 2016 us=728555   ipchange = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=728582   dev = 'tun'
Sun Oct 23 14:20:19 2016 us=728609   dev_type = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=728637   dev_node = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=728664   lladdr = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=728692   topology = 1
Sun Oct 23 14:20:19 2016 us=728719   tun_ipv6 = DISABLED
Sun Oct 23 14:20:19 2016 us=728746   ifconfig_local = '10.8.0.1'
Sun Oct 23 14:20:19 2016 us=728774   ifconfig_remote_netmask = '10.8.0.2'
Sun Oct 23 14:20:19 2016 us=728802   ifconfig_noexec = DISABLED
Sun Oct 23 14:20:19 2016 us=728829   ifconfig_nowarn = DISABLED
Sun Oct 23 14:20:19 2016 us=728857   ifconfig_ipv6_local = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=728885   ifconfig_ipv6_netbits = 0
Sun Oct 23 14:20:19 2016 us=728912   ifconfig_ipv6_remote = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=728940   shaper = 0
Sun Oct 23 14:20:19 2016 us=728967   mtu_test = 0
Sun Oct 23 14:20:19 2016 us=728994   mlock = DISABLED
Sun Oct 23 14:20:19 2016 us=729022   keepalive_ping = 10
Sun Oct 23 14:20:19 2016 us=729049   keepalive_timeout = 120
Sun Oct 23 14:20:19 2016 us=729077   inactivity_timeout = 0
Sun Oct 23 14:20:19 2016 us=729104   ping_send_timeout = 10
Sun Oct 23 14:20:19 2016 us=729131   ping_rec_timeout = 240
Sun Oct 23 14:20:19 2016 us=729160   ping_rec_timeout_action = 2
Sun Oct 23 14:20:19 2016 us=729187   ping_timer_remote = DISABLED
Sun Oct 23 14:20:19 2016 us=729216   remap_sigusr1 = 0
Sun Oct 23 14:20:19 2016 us=729243   persist_tun = ENABLED
Sun Oct 23 14:20:19 2016 us=729270   persist_local_ip = DISABLED
Sun Oct 23 14:20:19 2016 us=729298   persist_remote_ip = DISABLED
Sun Oct 23 14:20:19 2016 us=729325   persist_key = ENABLED
Sun Oct 23 14:20:19 2016 us=729352   passtos = DISABLED
Sun Oct 23 14:20:19 2016 us=729380   resolve_retry_seconds = 1000000000
Sun Oct 23 14:20:19 2016 us=729424   username = 'nobody'
Sun Oct 23 14:20:19 2016 us=729452   groupname = 'nogroup'
Sun Oct 23 14:20:19 2016 us=729480   chroot_dir = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=729507   cd_dir = '/etc/openvpn'
Sun Oct 23 14:20:19 2016 us=729534   writepid = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=729562   up_script = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=729589   down_script = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=729617   down_pre = DISABLED
Sun Oct 23 14:20:19 2016 us=729644   up_restart = DISABLED
Sun Oct 23 14:20:19 2016 us=729671   up_delay = DISABLED
Sun Oct 23 14:20:19 2016 us=729698   daemon = ENABLED
Sun Oct 23 14:20:19 2016 us=729725   inetd = 0
Sun Oct 23 14:20:19 2016 us=729752   log = ENABLED
Sun Oct 23 14:20:19 2016 us=729780   suppress_timestamps = DISABLED
Sun Oct 23 14:20:19 2016 us=729807   nice = 0
Sun Oct 23 14:20:19 2016 us=729834   verbosity = 4
Sun Oct 23 14:20:19 2016 us=729862   mute = 0
Sun Oct 23 14:20:19 2016 us=729889   gremlin = 0
Sun Oct 23 14:20:19 2016 us=729916   status_file = '/var/log/openvpn-status.log'
Sun Oct 23 14:20:19 2016 us=729944   status_file_version = 1
Sun Oct 23 14:20:19 2016 us=729971   status_file_update_freq = 20
Sun Oct 23 14:20:19 2016 us=729999   occ = ENABLED
Sun Oct 23 14:20:19 2016 us=730026   rcvbuf = 65536
Sun Oct 23 14:20:19 2016 us=730053   sndbuf = 65536
Sun Oct 23 14:20:19 2016 us=730138   mark = 0
Sun Oct 23 14:20:19 2016 us=730166   sockflags = 0
Sun Oct 23 14:20:19 2016 us=730194   fast_io = DISABLED
Sun Oct 23 14:20:19 2016 us=730221   lzo = 7
Sun Oct 23 14:20:19 2016 us=730248   route_script = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=730276   route_default_gateway = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=730303   route_default_metric = 0
Sun Oct 23 14:20:19 2016 us=730331   route_noexec = DISABLED
Sun Oct 23 14:20:19 2016 us=730359   route_delay = 0
Sun Oct 23 14:20:19 2016 us=730387   route_delay_window = 30
Sun Oct 23 14:20:19 2016 us=730415   route_delay_defined = DISABLED
Sun Oct 23 14:20:19 2016 us=730443   route_nopull = DISABLED
Sun Oct 23 14:20:19 2016 us=730471   route_gateway_via_dhcp = DISABLED
Sun Oct 23 14:20:19 2016 us=730499   max_routes = 100
Sun Oct 23 14:20:19 2016 us=730527   allow_pull_fqdn = DISABLED
Sun Oct 23 14:20:19 2016 us=730557   route 10.8.0.0/255.255.255.0/nil/nil
Sun Oct 23 14:20:19 2016 us=730586   management_addr = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=730615   management_port = 0
Sun Oct 23 14:20:19 2016 us=730644   management_user_pass = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=730673   management_log_history_cache = 250
Sun Oct 23 14:20:19 2016 us=730702   management_echo_buffer_size = 100
Sun Oct 23 14:20:19 2016 us=730731   management_write_peer_info_file = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=730760   management_client_user = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=730789   management_client_group = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=730817   management_flags = 0
Sun Oct 23 14:20:19 2016 us=730845   shared_secret_file = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=730873   key_direction = 1
Sun Oct 23 14:20:19 2016 us=730902   ciphername_defined = ENABLED
Sun Oct 23 14:20:19 2016 us=730930   ciphername = 'AES-128-CBC'
Sun Oct 23 14:20:19 2016 us=730959   authname_defined = ENABLED
Sun Oct 23 14:20:19 2016 us=730987   authname = 'SHA1'
Sun Oct 23 14:20:19 2016 us=731014   prng_hash = 'SHA1'
Sun Oct 23 14:20:19 2016 us=731044   prng_nonce_secret_len = 16
Sun Oct 23 14:20:19 2016 us=731072   keysize = 0
Sun Oct 23 14:20:19 2016 us=731099   engine = DISABLED
Sun Oct 23 14:20:19 2016 us=731127   replay = ENABLED
Sun Oct 23 14:20:19 2016 us=731155   mute_replay_warnings = DISABLED
Sun Oct 23 14:20:19 2016 us=731183   replay_window = 64
Sun Oct 23 14:20:19 2016 us=731211   replay_time = 15
Sun Oct 23 14:20:19 2016 us=731238   packet_id_file = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=731266   use_iv = ENABLED
Sun Oct 23 14:20:19 2016 us=731293   test_crypto = DISABLED
Sun Oct 23 14:20:19 2016 us=731321   tls_server = ENABLED
Sun Oct 23 14:20:19 2016 us=731349   tls_client = DISABLED
Sun Oct 23 14:20:19 2016 us=731391   key_method = 2
Sun Oct 23 14:20:19 2016 us=731420   ca_file = '/etc/openvpn/easy-rsa/keys/ca.crt'
Sun Oct 23 14:20:19 2016 us=731449   ca_path = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=731477   dh_file = '/etc/openvpn/easy-rsa/keys/dh2048.pem'
Sun Oct 23 14:20:19 2016 us=731506   cert_file = '/etc/openvpn/easy-rsa/keys/OpenVPN-Server.crt'
Sun Oct 23 14:20:19 2016 us=731535   priv_key_file = '/etc/openvpn/easy-rsa/keys/OpenVPN-Server.key'
Sun Oct 23 14:20:19 2016 us=731564   pkcs12_file = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=731592   cipher_list = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=731621   tls_verify = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=731649   tls_export_cert = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=731677   verify_x509_type = 0
Sun Oct 23 14:20:19 2016 us=731705   verify_x509_name = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=731734   crl_file = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=731762   ns_cert_type = 0
Sun Oct 23 14:20:19 2016 us=731790   remote_cert_ku[i] = 0
Sun Oct 23 14:20:19 2016 us=731818   remote_cert_ku[i] = 0
Sun Oct 23 14:20:19 2016 us=731846   remote_cert_ku[i] = 0
Sun Oct 23 14:20:19 2016 us=731874   remote_cert_ku[i] = 0
Sun Oct 23 14:20:19 2016 us=731902   remote_cert_ku[i] = 0
Sun Oct 23 14:20:19 2016 us=731930   remote_cert_ku[i] = 0
Sun Oct 23 14:20:19 2016 us=731957   remote_cert_ku[i] = 0
Sun Oct 23 14:20:19 2016 us=731985   remote_cert_ku[i] = 0
Sun Oct 23 14:20:19 2016 us=732013   remote_cert_ku[i] = 0
Sun Oct 23 14:20:19 2016 us=732040   remote_cert_ku[i] = 0
Sun Oct 23 14:20:19 2016 us=732068   remote_cert_ku[i] = 0
Sun Oct 23 14:20:19 2016 us=732096   remote_cert_ku[i] = 0
Sun Oct 23 14:20:19 2016 us=732124   remote_cert_ku[i] = 0
Sun Oct 23 14:20:19 2016 us=732156   remote_cert_ku[i] = 0
Sun Oct 23 14:20:19 2016 us=732185   remote_cert_ku[i] = 0
Sun Oct 23 14:20:19 2016 us=732213   remote_cert_ku[i] = 0
Sun Oct 23 14:20:19 2016 us=732242   remote_cert_eku = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=732270   ssl_flags = 0
Sun Oct 23 14:20:19 2016 us=732297   tls_timeout = 2
Sun Oct 23 14:20:19 2016 us=732325   renegotiate_bytes = 0
Sun Oct 23 14:20:19 2016 us=732353   renegotiate_packets = 0
Sun Oct 23 14:20:19 2016 us=732380   renegotiate_seconds = 3600
Sun Oct 23 14:20:19 2016 us=732408   handshake_window = 60
Sun Oct 23 14:20:19 2016 us=732436   transition_window = 3600
Sun Oct 23 14:20:19 2016 us=732464   single_session = DISABLED
Sun Oct 23 14:20:19 2016 us=732491   push_peer_info = DISABLED
Sun Oct 23 14:20:19 2016 us=732519   tls_exit = DISABLED
Sun Oct 23 14:20:19 2016 us=732547   tls_auth_file = '/etc/openvpn/easy-rsa/keys/ta.key'
Sun Oct 23 14:20:19 2016 us=732576   pkcs11_protected_authentication = DISABLED
Sun Oct 23 14:20:19 2016 us=732604   pkcs11_protected_authentication = DISABLED
Sun Oct 23 14:20:19 2016 us=732632   pkcs11_protected_authentication = DISABLED
Sun Oct 23 14:20:19 2016 us=732660   pkcs11_protected_authentication = DISABLED
Sun Oct 23 14:20:19 2016 us=732688   pkcs11_protected_authentication = DISABLED
Sun Oct 23 14:20:19 2016 us=732717   pkcs11_protected_authentication = DISABLED
Sun Oct 23 14:20:19 2016 us=732745   pkcs11_protected_authentication = DISABLED
Sun Oct 23 14:20:19 2016 us=732773   pkcs11_protected_authentication = DISABLED
Sun Oct 23 14:20:19 2016 us=732801   pkcs11_protected_authentication = DISABLED
Sun Oct 23 14:20:19 2016 us=732829   pkcs11_protected_authentication = DISABLED
Sun Oct 23 14:20:19 2016 us=732857   pkcs11_protected_authentication = DISABLED
Sun Oct 23 14:20:19 2016 us=732885   pkcs11_protected_authentication = DISABLED
Sun Oct 23 14:20:19 2016 us=732913   pkcs11_protected_authentication = DISABLED
Sun Oct 23 14:20:19 2016 us=732942   pkcs11_protected_authentication = DISABLED
Sun Oct 23 14:20:19 2016 us=732970   pkcs11_protected_authentication = DISABLED
Sun Oct 23 14:20:19 2016 us=732998   pkcs11_protected_authentication = DISABLED
Sun Oct 23 14:20:19 2016 us=733028   pkcs11_private_mode = 00000000
Sun Oct 23 14:20:19 2016 us=733057   pkcs11_private_mode = 00000000
Sun Oct 23 14:20:19 2016 us=733086   pkcs11_private_mode = 00000000
Sun Oct 23 14:20:19 2016 us=733127   pkcs11_private_mode = 00000000
Sun Oct 23 14:20:19 2016 us=733156   pkcs11_private_mode = 00000000
Sun Oct 23 14:20:19 2016 us=733185   pkcs11_private_mode = 00000000
Sun Oct 23 14:20:19 2016 us=733215   pkcs11_private_mode = 00000000
Sun Oct 23 14:20:19 2016 us=733244   pkcs11_private_mode = 00000000
Sun Oct 23 14:20:19 2016 us=733273   pkcs11_private_mode = 00000000
Sun Oct 23 14:20:19 2016 us=733301   pkcs11_private_mode = 00000000
Sun Oct 23 14:20:19 2016 us=733330   pkcs11_private_mode = 00000000
Sun Oct 23 14:20:19 2016 us=733358   pkcs11_private_mode = 00000000
Sun Oct 23 14:20:19 2016 us=733387   pkcs11_private_mode = 00000000
Sun Oct 23 14:20:19 2016 us=733415   pkcs11_private_mode = 00000000
Sun Oct 23 14:20:19 2016 us=733444   pkcs11_private_mode = 00000000
Sun Oct 23 14:20:19 2016 us=733472   pkcs11_private_mode = 00000000
Sun Oct 23 14:20:19 2016 us=733501   pkcs11_cert_private = DISABLED
Sun Oct 23 14:20:19 2016 us=733529   pkcs11_cert_private = DISABLED
Sun Oct 23 14:20:19 2016 us=733558   pkcs11_cert_private = DISABLED
Sun Oct 23 14:20:19 2016 us=733586   pkcs11_cert_private = DISABLED
Sun Oct 23 14:20:19 2016 us=733614   pkcs11_cert_private = DISABLED
Sun Oct 23 14:20:19 2016 us=733642   pkcs11_cert_private = DISABLED
Sun Oct 23 14:20:19 2016 us=733670   pkcs11_cert_private = DISABLED
Sun Oct 23 14:20:19 2016 us=733698   pkcs11_cert_private = DISABLED
Sun Oct 23 14:20:19 2016 us=733726   pkcs11_cert_private = DISABLED
Sun Oct 23 14:20:19 2016 us=733753   pkcs11_cert_private = DISABLED
Sun Oct 23 14:20:19 2016 us=733781   pkcs11_cert_private = DISABLED
Sun Oct 23 14:20:19 2016 us=733809   pkcs11_cert_private = DISABLED
Sun Oct 23 14:20:19 2016 us=733837   pkcs11_cert_private = DISABLED
Sun Oct 23 14:20:19 2016 us=733864   pkcs11_cert_private = DISABLED
Sun Oct 23 14:20:19 2016 us=733892   pkcs11_cert_private = DISABLED
Sun Oct 23 14:20:19 2016 us=733920   pkcs11_cert_private = DISABLED
Sun Oct 23 14:20:19 2016 us=733948   pkcs11_pin_cache_period = -1
Sun Oct 23 14:20:19 2016 us=733976   pkcs11_id = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=734004   pkcs11_id_management = DISABLED
Sun Oct 23 14:20:19 2016 us=734040   server_network = 10.8.0.0
Sun Oct 23 14:20:19 2016 us=734073   server_netmask = 255.255.255.0
Sun Oct 23 14:20:19 2016 us=734105   server_network_ipv6 = ::
Sun Oct 23 14:20:19 2016 us=734134   server_netbits_ipv6 = 0
Sun Oct 23 14:20:19 2016 us=734165   server_bridge_ip = 0.0.0.0
Sun Oct 23 14:20:19 2016 us=734197   server_bridge_netmask = 0.0.0.0
Sun Oct 23 14:20:19 2016 us=734228   server_bridge_pool_start = 0.0.0.0
Sun Oct 23 14:20:19 2016 us=734260   server_bridge_pool_end = 0.0.0.0
Sun Oct 23 14:20:19 2016 us=734289   push_entry = 'route 10.8.0.1 255.255.255.255'
Sun Oct 23 14:20:19 2016 us=734318   push_entry = 'route 10.8.0.0 255.255.255.0'
Sun Oct 23 14:20:19 2016 us=734347   push_entry = 'route 192.168.200.0 255.255.255.0'
Sun Oct 23 14:20:19 2016 us=734375   push_entry = 'dhcp-option DNS 192.168.200.1'
Sun Oct 23 14:20:19 2016 us=734404   push_entry = 'redirect-gateway def1'
Sun Oct 23 14:20:19 2016 us=734432   push_entry = 'route 10.8.0.0 255.255.255.0'
Sun Oct 23 14:20:19 2016 us=734460   push_entry = 'topology net30'
Sun Oct 23 14:20:19 2016 us=734488   push_entry = 'ping 10'
Sun Oct 23 14:20:19 2016 us=734515   push_entry = 'ping-restart 120'
Sun Oct 23 14:20:19 2016 us=734544   ifconfig_pool_defined = ENABLED
Sun Oct 23 14:20:19 2016 us=734575   ifconfig_pool_start = 10.8.0.4
Sun Oct 23 14:20:19 2016 us=734607   ifconfig_pool_end = 10.8.0.251
Sun Oct 23 14:20:19 2016 us=734639   ifconfig_pool_netmask = 0.0.0.0
Sun Oct 23 14:20:19 2016 us=734667   ifconfig_pool_persist_filename = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=734696   ifconfig_pool_persist_refresh_freq = 600
Sun Oct 23 14:20:19 2016 us=734724   ifconfig_ipv6_pool_defined = DISABLED
Sun Oct 23 14:20:19 2016 us=734754   ifconfig_ipv6_pool_base = ::
Sun Oct 23 14:20:19 2016 us=734782   ifconfig_ipv6_pool_netbits = 0
Sun Oct 23 14:20:19 2016 us=734810   n_bcast_buf = 256
Sun Oct 23 14:20:19 2016 us=734850   tcp_queue_limit = 64
Sun Oct 23 14:20:19 2016 us=734879   real_hash_size = 256
Sun Oct 23 14:20:19 2016 us=734907   virtual_hash_size = 256
Sun Oct 23 14:20:19 2016 us=734935   client_connect_script = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=734963   learn_address_script = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=734992   client_disconnect_script = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=735020   client_config_dir = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=735048   ccd_exclusive = DISABLED
Sun Oct 23 14:20:19 2016 us=735075   tmp_dir = '/tmp'
Sun Oct 23 14:20:19 2016 us=735103   push_ifconfig_defined = DISABLED
Sun Oct 23 14:20:19 2016 us=735135   push_ifconfig_local = 0.0.0.0
Sun Oct 23 14:20:19 2016 us=735167   push_ifconfig_remote_netmask = 0.0.0.0
Sun Oct 23 14:20:19 2016 us=735196   push_ifconfig_ipv6_defined = DISABLED
Sun Oct 23 14:20:19 2016 us=735226   push_ifconfig_ipv6_local = ::/0
Sun Oct 23 14:20:19 2016 us=735256   push_ifconfig_ipv6_remote = ::
Sun Oct 23 14:20:19 2016 us=735285   enable_c2c = ENABLED
Sun Oct 23 14:20:19 2016 us=735312   duplicate_cn = ENABLED
Sun Oct 23 14:20:19 2016 us=735340   cf_max = 0
Sun Oct 23 14:20:19 2016 us=735367   cf_per = 0
Sun Oct 23 14:20:19 2016 us=735394   max_clients = 1024
Sun Oct 23 14:20:19 2016 us=735421   max_routes_per_client = 256
Sun Oct 23 14:20:19 2016 us=735449   auth_user_pass_verify_script = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=735478   auth_user_pass_verify_script_via_file = DISABLED
Sun Oct 23 14:20:19 2016 us=735506   port_share_host = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=735534   port_share_port = 0
Sun Oct 23 14:20:19 2016 us=735562   client = DISABLED
Sun Oct 23 14:20:19 2016 us=735589   pull = DISABLED
Sun Oct 23 14:20:19 2016 us=735617   auth_user_pass_file = '[UNDEF]'
Sun Oct 23 14:20:19 2016 us=735650 OpenVPN 2.3.4 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jan 23 2016
Sun Oct 23 14:20:19 2016 us=735693 library versions: OpenSSL 1.0.1t  3 May 2016, LZO 2.08
Sun Oct 23 14:20:19 2016 us=737406 Diffie-Hellman initialized with 2048 bit key
Sun Oct 23 14:20:19 2016 us=739325 Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVPN static key file
Sun Oct 23 14:20:19 2016 us=739384 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct 23 14:20:19 2016 us=739422 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct 23 14:20:19 2016 us=739465 TLS-Auth MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Sun Oct 23 14:20:19 2016 us=739524 Socket Buffers: R=[163840->131072] S=[163840->131072]
Sun Oct 23 14:20:19 2016 us=739826 ROUTE_GATEWAY 192.168.200.1/255.255.255.0 IFACE=eth0 HWADDR=b8:27:eb:3c:4b:7f
Sun Oct 23 14:20:19 2016 us=741902 TUN/TAP device tun0 opened
Sun Oct 23 14:20:19 2016 us=742036 TUN/TAP TX queue length set to 100
Sun Oct 23 14:20:19 2016 us=742099 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Oct 23 14:20:19 2016 us=742171 /sbin/ip link set dev tun0 up mtu 1500
Sun Oct 23 14:20:19 2016 us=745936 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Sun Oct 23 14:20:19 2016 us=750969 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Sun Oct 23 14:20:19 2016 us=754572 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Oct 23 14:20:19 2016 us=757130 GID set to nogroup
Sun Oct 23 14:20:19 2016 us=757370 UID set to nobody
Sun Oct 23 14:20:19 2016 us=757459 UDPv4 link local (bound): [AF_INET]192.168.200.200:1194
Sun Oct 23 14:20:19 2016 us=757501 UDPv4 link remote: [undef]
Sun Oct 23 14:20:19 2016 us=757544 MULTI: multi_init called, r=256 v=256
Sun Oct 23 14:20:19 2016 us=757831 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Sun Oct 23 14:20:19 2016 us=757977 Initialization Sequence Completed
Sun Oct 23 14:25:33 2016 us=313893 MULTI: multi_create_instance called
Sun Oct 23 14:25:33 2016 us=314264 149.254.56.54:16617 Re-using SSL/TLS context
Sun Oct 23 14:25:33 2016 us=314442 149.254.56.54:16617 LZO compression initialized
Sun Oct 23 14:25:33 2016 us=315428 149.254.56.54:16617 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Sun Oct 23 14:25:33 2016 us=315513 149.254.56.54:16617 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Oct 23 14:25:33 2016 us=315797 149.254.56.54:16617 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Sun Oct 23 14:25:33 2016 us=315858 149.254.56.54:16617 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Sun Oct 23 14:25:33 2016 us=315999 149.254.56.54:16617 Local Options hash (VER=V4): 'a2e63101'
Sun Oct 23 14:25:33 2016 us=316099 149.254.56.54:16617 Expected Remote Options hash (VER=V4): '272f1b58'
Sun Oct 23 14:25:33 2016 us=316260 149.254.56.54:16617 TLS: Initial packet from [AF_INET]149.254.56.54:16617, sid=6ef485d5 7f17184a
Sun Oct 23 14:25:43 2016 us=190422 149.254.56.54:16617 VERIFY OK: depth=1, C=UK, ST=Be, L=Ma, O=Ri, OU=MyOrganizationalUnit, CN=Ri CA, name=EasyRSA, emailAddress=ja
Sun Oct 23 14:25:43 2016 us=192831 149.254.56.54:16617 VERIFY OK: depth=0, C=UK, ST=Be, L=Ma, O=Ri, OU=MyOrganizationalUnit, CN=Client1, name=EasyRSA, emailAddress=jam
Sun Oct 23 14:25:43 2016 us=476747 149.254.56.54:16617 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Oct 23 14:25:43 2016 us=476860 149.254.56.54:16617 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct 23 14:25:43 2016 us=476896 149.254.56.54:16617 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Oct 23 14:25:43 2016 us=476932 149.254.56.54:16617 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct 23 14:25:43 2016 us=576326 149.254.56.54:16617 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sun Oct 23 14:25:43 2016 us=576413 149.254.56.54:16617 [Client1] Peer Connection Initiated with [AF_INET]149.254.56.54:16617
Sun Oct 23 14:25:43 2016 us=576483 Client1/149.254.56.54:16617 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Sun Oct 23 14:25:43 2016 us=576612 Client1/149.254.56.54:16617 MULTI: Learn: 10.8.0.6 -> Client1/149.254.56.54:16617
Sun Oct 23 14:25:43 2016 us=576653 Client1/149.254.56.54:16617 MULTI: primary virtual IP for Client1/149.254.56.54:16617: 10.8.0.6
Sun Oct 23 14:25:45 2016 us=607826 Client1/149.254.56.54:16617 PUSH: Received control message: 'PUSH_REQUEST'
Sun Oct 23 14:25:45 2016 us=608009 Client1/149.254.56.54:16617 send_push_reply(): safe_cap=940
Sun Oct 23 14:25:45 2016 us=608241 Client1/149.254.56.54:16617 SENT CONTROL [Client1]: 'PUSH_REPLY,route 10.8.0.1 255.255.255.255,route 10.8.0.0 255.255.255.0,route 192.168.200.0 255.255.255.0,dhcp-option DNS 192.168.200.1,redirect-gateway def1,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Sun Oct 23 14:25:48 2016 us=57045 Client1/149.254.56.54:16617 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:25:48 2016 us=57308 Client1/149.254.56.54:16617 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:25:48 2016 us=66018 Client1/149.254.56.54:16617 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:25:48 2016 us=96182 Client1/149.254.56.54:16617 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:25:48 2016 us=126169 Client1/149.254.56.54:16617 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:25:48 2016 us=137232 Client1/149.254.56.54:16617 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:25:48 2016 us=137368 Client1/149.254.56.54:16617 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:25:49 2016 us=506637 Client1/149.254.56.54:16617 MULTI: bad source address from client [::], packet dropped
Sun Oct 23 14:25:49 2016 us=536245 Client1/149.254.56.54:16617 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:25:49 2016 us=566238 Client1/149.254.56.54:16617 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:25:49 2016 us=586207 Client1/149.254.56.54:16617 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped

*cut out lots of reported packet drops*

Sun Oct 23 14:33:02 2016 us=531362 Client1/149.254.56.54:16617 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:33:10 2016 us=482022 Client1/149.254.56.54:16617 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:33:26 2016 us=530680 Client1/149.254.56.54:16617 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:33:58 2016 us=464869 Client1/149.254.56.54:16617 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:34:29 2016 us=292131 Client1/149.254.56.54:16617 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:34:29 2016 us=631749 Client1/149.254.56.54:16617 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:39:13 2016 us=231133 Client1/149.254.56.54:16617 [Client1] Inactivity timeout (--ping-restart), restarting
Sun Oct 23 14:39:13 2016 us=231357 Client1/149.254.56.54:16617 SIGUSR1[soft,ping-restart] received, client-instance restarting
Sun Oct 23 14:42:14 2016 us=881776 MULTI: multi_create_instance called
Sun Oct 23 14:42:14 2016 us=882131 149.254.56.199:42392 Re-using SSL/TLS context
Sun Oct 23 14:42:14 2016 us=882258 149.254.56.199:42392 LZO compression initialized
Sun Oct 23 14:42:14 2016 us=882654 149.254.56.199:42392 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Sun Oct 23 14:42:14 2016 us=882738 149.254.56.199:42392 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Oct 23 14:42:14 2016 us=882920 149.254.56.199:42392 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Sun Oct 23 14:42:14 2016 us=882983 149.254.56.199:42392 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Sun Oct 23 14:42:14 2016 us=883102 149.254.56.199:42392 Local Options hash (VER=V4): 'a2e63101'
Sun Oct 23 14:42:14 2016 us=883206 149.254.56.199:42392 Expected Remote Options hash (VER=V4): '272f1b58'
Sun Oct 23 14:42:14 2016 us=883439 149.254.56.199:42392 TLS: Initial packet from [AF_INET]149.254.56.199:42392, sid=6fb88817 b8a7e0c6
Sun Oct 23 14:42:23 2016 us=986264 149.254.56.199:42392 VERIFY OK: depth=1, C=UK, ST=Be, L=Ma, O=Ri, OU=MyOrganizationalUnit, CN=Ri CA, name=EasyRSA, emailAddress=ja
Sun Oct 23 14:42:23 2016 us=988687 149.254.56.199:42392 VERIFY OK: depth=0, C=UK, ST=Be, L=Ma, O=Ri, OU=MyOrganizationalUnit, CN=Client1, name=EasyRSA, emailAddress=ja
Sun Oct 23 14:42:24 2016 us=262908 149.254.56.199:42392 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Oct 23 14:42:24 2016 us=263027 149.254.56.199:42392 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct 23 14:42:24 2016 us=263063 149.254.56.199:42392 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Oct 23 14:42:24 2016 us=263101 149.254.56.199:42392 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct 23 14:42:24 2016 us=352176 149.254.56.199:42392 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sun Oct 23 14:42:24 2016 us=352270 149.254.56.199:42392 [Client1] Peer Connection Initiated with [AF_INET]149.254.56.199:42392
Sun Oct 23 14:42:24 2016 us=352340 Client1/149.254.56.199:42392 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Sun Oct 23 14:42:24 2016 us=352468 Client1/149.254.56.199:42392 MULTI: Learn: 10.8.0.6 -> Client1/149.254.56.199:42392
Sun Oct 23 14:42:24 2016 us=352508 Client1/149.254.56.199:42392 MULTI: primary virtual IP for Client1/149.254.56.199:42392: 10.8.0.6
Sun Oct 23 14:42:29 2016 us=362801 Client1/149.254.56.199:42392 PUSH: Received control message: 'PUSH_REQUEST'
Sun Oct 23 14:42:29 2016 us=362986 Client1/149.254.56.199:42392 send_push_reply(): safe_cap=940
Sun Oct 23 14:42:29 2016 us=363252 Client1/149.254.56.199:42392 SENT CONTROL [Client1]: 'PUSH_REPLY,route 10.8.0.1 255.255.255.255,route 10.8.0.0 255.255.255.0,route 192.168.200.0 255.255.255.0,dhcp-option DNS 192.168.200.1,redirect-gateway def1,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Sun Oct 23 14:42:29 2016 us=632146 Client1/149.254.56.199:42392 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:42:29 2016 us=672674 Client1/149.254.56.199:42392 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:42:29 2016 us=672843 Client1/149.254.56.199:42392 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped

* cut out lots of packet drops *

Sun Oct 23 14:42:29 2016 us=682101 Client1/149.254.56.199:42392 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:43:30 2016 us=703846 Client1/149.254.56.199:42392 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:43:30 2016 us=713833 Client1/149.254.56.199:42392 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:43:30 2016 us=843630 Client1/149.254.56.199:42392 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:43:30 2016 us=974131 Client1/149.254.56.199:42392 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:43:32 2016 us=654375 Client1/149.254.56.199:42392 MULTI: bad source address from client [fe80::5164:e12a:f28b:e922], packet dropped
Sun Oct 23 14:49:33 2016 us=440748 Client1/149.254.56.199:42392 [Client1] Inactivity timeout (--ping-restart), restarting
Sun Oct 23 14:49:33 2016 us=440971 Client1/149.254.56.199:42392 SIGUSR1[soft,ping-restart] received, client-instance restarting

[oconf=CLIENTLOG]Sun Oct 23 15:44:00 2016 us=394779 Current Parameter Settings:
Sun Oct 23 15:44:00 2016 us=394779   config = 'Client1.ovpn'
Sun Oct 23 15:44:00 2016 us=394779   mode = 0
Sun Oct 23 15:44:00 2016 us=394779   show_ciphers = DISABLED
Sun Oct 23 15:44:00 2016 us=394779   show_digests = DISABLED
Sun Oct 23 15:44:00 2016 us=394779   show_engines = DISABLED
Sun Oct 23 15:44:00 2016 us=394779   genkey = DISABLED
Sun Oct 23 15:44:00 2016 us=394779   key_pass_file = '[UNDEF]'
Sun Oct 23 15:44:00 2016 us=394779   show_tls_ciphers = DISABLED
Sun Oct 23 15:44:00 2016 us=394779 Connection profiles [default]:
Sun Oct 23 15:44:00 2016 us=394779   proto = udp
Sun Oct 23 15:44:00 2016 us=394779   local = '[UNDEF]'
Sun Oct 23 15:44:00 2016 us=394779   local_port = 0
Sun Oct 23 15:44:00 2016 us=394779   remote = '#my-static-ip#'
Sun Oct 23 15:44:00 2016 us=394779   remote_port = 1194
Sun Oct 23 15:44:00 2016 us=394779   remote_float = DISABLED
Sun Oct 23 15:44:00 2016 us=394779   bind_defined = DISABLED
Sun Oct 23 15:44:00 2016 us=394779   bind_local = DISABLED
Sun Oct 23 15:44:00 2016 us=394779   connect_retry_seconds = 5
Sun Oct 23 15:44:00 2016 us=394779   connect_timeout = 10
Sun Oct 23 15:44:00 2016 us=394779 NOTE: --mute triggered...
Sun Oct 23 15:44:00 2016 us=394779 268 variation(s) on previous 20 message(s) suppressed by --mute
Sun Oct 23 15:44:00 2016 us=394779 OpenVPN 2.3.12 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Oct  3 2016
Sun Oct 23 15:44:00 2016 us=394779 Windows version 6.2 (Windows 8 or greater) 64bit
Sun Oct 23 15:44:00 2016 us=394779 library versions: OpenSSL 1.0.1u  22 Sep 2016, LZO 2.09
Enter Management Password:
Sun Oct 23 15:44:00 2016 us=394779 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sun Oct 23 15:44:00 2016 us=394779 Need hold release from management interface, waiting...
Sun Oct 23 15:44:00 2016 us=910573 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sun Oct 23 15:44:01 2016 us=19950 MANAGEMENT: CMD 'state on'
Sun Oct 23 15:44:01 2016 us=19950 MANAGEMENT: CMD 'log all on'
Sun Oct 23 15:44:01 2016 us=98017 MANAGEMENT: CMD 'hold off'
Sun Oct 23 15:44:01 2016 us=98017 MANAGEMENT: CMD 'hold release'
Sun Oct 23 15:44:22 2016 us=724096 MANAGEMENT: CMD 'password [...]'
Sun Oct 23 15:44:22 2016 us=724096 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sun Oct 23 15:44:22 2016 us=724096 Control Channel Authentication: tls-auth using INLINE static key file
Sun Oct 23 15:44:22 2016 us=724096 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct 23 15:44:22 2016 us=724096 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct 23 15:44:22 2016 us=724096 LZO compression initialized
Sun Oct 23 15:44:22 2016 us=724096 Control Channel MTU parms [ L:1558 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Sun Oct 23 15:44:22 2016 us=724096 Socket Buffers: R=[65536->65536] S=[64512->64512]
Sun Oct 23 15:44:22 2016 us=724096 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:143 ET:0 EL:3 AF:3/1 ]
Sun Oct 23 15:44:22 2016 us=724096 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Sun Oct 23 15:44:22 2016 us=724096 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Sun Oct 23 15:44:22 2016 us=724096 Local Options hash (VER=V4): '272f1b58'
Sun Oct 23 15:44:22 2016 us=724096 Expected Remote Options hash (VER=V4): 'a2e63101'
Sun Oct 23 15:44:22 2016 us=724096 UDPv4 link local: [undef]
Sun Oct 23 15:44:22 2016 us=724096 UDPv4 link remote: [AF_INET]#my-static-ip#:1194
Sun Oct 23 15:44:22 2016 us=724096 MANAGEMENT: >STATE:1477233862,WAIT,,,
Sun Oct 23 15:44:24 2016 us=477513 MANAGEMENT: >STATE:1477233864,AUTH,,,
Sun Oct 23 15:44:24 2016 us=477513 TLS: Initial packet from [AF_INET]#my-static-ip#:1194, sid=14041d22 4f8e04b6
Sun Oct 23 15:44:29 2016 us=41895 VERIFY OK: depth=1, C=UK, ST=Be, L=Ma, O=Ri, OU=MyOrganizationalUnit, CN=Ri CA, name=EasyRSA, emailAddress=ja
Sun Oct 23 15:44:29 2016 us=41895 VERIFY OK: nsCertType=SERVER
Sun Oct 23 15:44:29 2016 us=41895 VERIFY OK: depth=0, C=UK, ST=Be, L=Ma, O=Ri, OU=MyOrganizationalUnit, CN=OpenVPN-Server, name=EasyRSA, emailAddress=ja
Sun Oct 23 15:44:33 2016 us=694038 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Oct 23 15:44:33 2016 us=694038 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct 23 15:44:33 2016 us=694038 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Oct 23 15:44:33 2016 us=694038 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Oct 23 15:44:36 2016 us=245618 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sun Oct 23 15:44:36 2016 us=245618 [OpenVPN-Server] Peer Connection Initiated with [AF_INET]95.172.233.143:1194
Sun Oct 23 15:44:37 2016 us=461895 MANAGEMENT: >STATE:1477233877,GET_CONFIG,,,
Sun Oct 23 15:44:38 2016 us=671773 SENT CONTROL [OpenVPN-Server]: 'PUSH_REQUEST' (status=1)
Sun Oct 23 15:44:38 2016 us=921726 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.1 255.255.255.255,route 10.8.0.0 255.255.255.0,route 192.168.200.0 255.255.255.0,dhcp-option DNS 192.168.200.1,redirect-gateway def1,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Sun Oct 23 15:44:38 2016 us=921726 OPTIONS IMPORT: timers and/or timeouts modified
Sun Oct 23 15:44:38 2016 us=921726 OPTIONS IMPORT: --ifconfig/up options modified
Sun Oct 23 15:44:38 2016 us=921726 OPTIONS IMPORT: route options modified
Sun Oct 23 15:44:38 2016 us=921726 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Oct 23 15:44:38 2016 us=921726 ROUTE_GATEWAY 192.168.8.1/255.255.255.0 I=3 HWADDR=f8:16:54:08:af:c0
Sun Oct 23 15:44:38 2016 us=937350 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Oct 23 15:44:38 2016 us=937350 MANAGEMENT: >STATE:1477233878,ASSIGN_IP,,10.8.0.6,
Sun Oct 23 15:44:38 2016 us=937350 open_tun, tt->ipv6=0
Sun Oct 23 15:44:38 2016 us=937350 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{8D0619C4-D476-458F-A14C-830524CFAD92}.tap
Sun Oct 23 15:44:38 2016 us=937350 TAP-Windows Driver Version 9.21 
Sun Oct 23 15:44:38 2016 us=937350 TAP-Windows MTU=1500
Sun Oct 23 15:44:38 2016 us=937350 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {8D0619C4-D476-458F-A14C-830524CFAD92} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Sun Oct 23 15:44:38 2016 us=937350 DHCP option string: 0604c0a8 c801
Sun Oct 23 15:44:38 2016 us=937350 Successful ARP Flush on interface [14] {8D0619C4-D476-458F-A14C-830524CFAD92}
Sun Oct 23 15:44:43 2016 us=188925 TEST ROUTES: 5/5 succeeded len=4 ret=1 a=0 u/d=up
Sun Oct 23 15:44:43 2016 us=188925 C:\windows\system32\route.exe ADD 95.172.233.143 MASK 255.255.255.255 192.168.8.1
Sun Oct 23 15:44:43 2016 us=188925 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Sun Oct 23 15:44:43 2016 us=188925 Route addition via IPAPI succeeded [adaptive]
Sun Oct 23 15:44:43 2016 us=188925 C:\windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Sun Oct 23 15:44:43 2016 us=188925 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Sun Oct 23 15:44:43 2016 us=188925 Route addition via IPAPI succeeded [adaptive]
Sun Oct 23 15:44:43 2016 us=188925 C:\windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Sun Oct 23 15:44:43 2016 us=204492 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Sun Oct 23 15:44:43 2016 us=204492 Route addition via IPAPI succeeded [adaptive]
Sun Oct 23 15:44:43 2016 us=204492 MANAGEMENT: >STATE:1477233883,ADD_ROUTES,,,
Sun Oct 23 15:44:43 2016 us=204492 C:\windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Sun Oct 23 15:44:43 2016 us=204492 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Sun Oct 23 15:44:43 2016 us=204492 Route addition via IPAPI succeeded [adaptive]
Sun Oct 23 15:44:43 2016 us=204492 C:\windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.5
Sun Oct 23 15:44:43 2016 us=204492 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Sun Oct 23 15:44:43 2016 us=204492 Route addition via IPAPI succeeded [adaptive]
Sun Oct 23 15:44:43 2016 us=220116 C:\windows\system32\route.exe ADD 192.168.200.0 MASK 255.255.255.0 10.8.0.5
Sun Oct 23 15:44:43 2016 us=220116 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Sun Oct 23 15:44:43 2016 us=220116 Route addition via IPAPI succeeded [adaptive]
Sun Oct 23 15:44:43 2016 us=220116 C:\windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.5
Sun Oct 23 15:44:43 2016 us=220116 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists.   [status=5010 if_index=14]
Sun Oct 23 15:44:43 2016 us=220116 Route addition via IPAPI failed [adaptive]
Sun Oct 23 15:44:43 2016 us=220116 Route addition fallback to route.exe
Sun Oct 23 15:44:43 2016 us=220116 env_block: add PATH=C:\windows\System32;C:\windows;C:\windows\System32\Wbem
Sun Oct 23 15:44:43 2016 us=251365 Initialization Sequence Completed
Sun Oct 23 15:44:43 2016 us=251365 MANAGEMENT: >STATE:1477233883,CONNECTED,SUCCESS,10.8.0.6,95.172.233.143
Sun Oct 23 15:47:44 2016 us=555802 TCP/UDP: Closing socket
Sun Oct 23 15:47:44 2016 us=555802 C:\windows\system32\route.exe DELETE 10.8.0.0 MASK 255.255.255.0 10.8.0.5
Sun Oct 23 15:47:44 2016 us=555802 Route deletion via IPAPI succeeded [adaptive]
Sun Oct 23 15:47:44 2016 us=555802 C:\windows\system32\route.exe DELETE 192.168.200.0 MASK 255.255.255.0 10.8.0.5
Sun Oct 23 15:47:44 2016 us=555802 Route deletion via IPAPI succeeded [adaptive]
Sun Oct 23 15:47:44 2016 us=555802 C:\windows\system32\route.exe DELETE 10.8.0.0 MASK 255.255.255.0 10.8.0.5
Sun Oct 23 15:47:44 2016 us=555802 ROUTE: route deletion failed using DeleteIpForwardEntry: Element not found.  
Sun Oct 23 15:47:44 2016 us=555802 Route deletion via IPAPI failed [adaptive]
Sun Oct 23 15:47:44 2016 us=555802 Route deletion fallback to route.exe
Sun Oct 23 15:47:44 2016 us=555802 env_block: add PATH=C:\windows\System32;C:\windows;C:\windows\System32\Wbem
Sun Oct 23 15:47:44 2016 us=571437 C:\windows\system32\route.exe DELETE 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Sun Oct 23 15:47:44 2016 us=571437 Route deletion via IPAPI succeeded [adaptive]
Sun Oct 23 15:47:44 2016 us=571437 C:\windows\system32\route.exe DELETE 95.172.233.143 MASK 255.255.255.255 192.168.8.1
Sun Oct 23 15:47:44 2016 us=571437 Route deletion via IPAPI succeeded [adaptive]
Sun Oct 23 15:47:44 2016 us=571437 C:\windows\system32\route.exe DELETE 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Sun Oct 23 15:47:44 2016 us=571437 Route deletion via IPAPI succeeded [adaptive]
Sun Oct 23 15:47:44 2016 us=571437 C:\windows\system32\route.exe DELETE 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Sun Oct 23 15:47:44 2016 us=571437 Route deletion via IPAPI succeeded [adaptive]
Sun Oct 23 15:47:44 2016 us=571437 Closing TUN/TAP interface
Sun Oct 23 15:47:44 2016 us=571437 SIGTERM[hard,] received, process exiting
Sun Oct 23 15:47:44 2016 us=571437 MANAGEMENT: >STATE:1477234064,EXITING,SIGTERM,,[/oconf]

TinCanTech

jjjames wroteI can't see anything on my VPN except both ends of the tunnel

So you can ping the server from the client :?:

jjjames wroteThe server logs show 'Bad source address from client' so I have to believe that might be something to do with it?

For now you can simply ignore these ..

jjjames wroteSo far:
- Redirection is set on in the server: push "redirect-gateway local def1"
- The DNS is set to my local router: push "dhcp-option DNS 192.168.200.1" - changing this makes no difference as its not reachable anyway
- The iptables are setup to configure at startup: "iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE"
(through a script fireall-openvpn-rules.sh)
- IP Port forwarding is enabled: /etc/sysctl.conf and uncomment net.ipv4.ip_forward=1

Looks good .. but .. I would double check.

jjjames

Yep, I can ping the server (either 10.8.0.1 or 192.168.200.200) from the client, and on both clients I can connect to the server and look at its virtual desktop thru VNC or access SSH. Just can't get to (or see) anything else. Haven't tried pinging from the server back to the client though I can see the connection details in the openvpn status log. The server can see the internet if I fire up a browser on the desktop...

My lack of Linux know how is not helping as I have no idea how to check the status of the iptables, port forwarding etc ... I spent yesterday afternoon going thru the steps above, twice, checking I hadn't capitalized something or missed something out. Also tried different DNS settings. If someone could write a script to check the port forwarding, now that would save a lot of postings here! By the time I'm done with this, I'd be tempted to have a crack myself!

Alternately I could just chuck in the towel and use the PiVPN scripts buto try and eliminate any human errors but the published setup steps I've used have all needed tweaking to fix, I suspect PiVPN would very likely be the same.

TinCanTech

As this is on a Pi .. make sure your network interface names are the names you are expecting.

jjjames

Good point, it's not that, the Pi does have wifi built in but that is turned off. I now have it working, but there is still an error I need to fix. 😃

Debugging... so I ran some checks ... as clearly going thru the config files by hand wasn't working. Usually the effort of posting up your query is enough to get the brain cells to wake up and spot the error. It didn't work this time!

So, check the obvious and

cat /proc/sys/net/ipv4/ip_forward

which came back as 1 [on] so IP forwarding was switched on.

Second, check the NAT setup and

iptables -t nat -L

comes back with

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  10.8.0.0/24          anywhere

or rather - it should when it is working properly (you can "grep" the above to make it a one line result, but I wanted to show the full output from iptables)

in my case it seems the NAT was not being initialized properly on reboot of the Pi, so when I did the check above the MASQUERADE entry was missing. Add it back in by running the script that is supposed to be running when the network comes up and bingo it all works. So, clearly I need to do some messing around to get the OpenVPN service to 1) restart itself after a boot and 2) make sure that NAT is working properly. At least it is obvious where the problem is now, somewhere in that startup! Thanks for reading 😉

jjjames

Okay so after more tooling around with the network interfaces file on the Pi I gave up. Googling this problem and reading the Debian manuals just gave me no idea what could be wrong. I couldn't get the post-up option to work, whether I tried embedding the iptables ... MASQUERADE command in the interfaces file or executing it in a separate shell file. I imagine that Openvpn failing immediately on the Pi on startup is also beyond my ken, possibly a 'feature' of my hardware or the build. I guess that OpenVPN doesn't wait long enough for the ethernet interface to come up before it starts.

So, in the end I just bolted both the iptables config and the restart of the Openvpn service into the existing shell script, stuck a delay of 30 seconds in and ended up with this: #!/bin/sh

sleep 30
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
service openvpn restart]

This was launched from rc.local with #!/bin/sh -e

# Restart Openvpn to get it to work
nohup /etc/firewall-openvpn-rules.sh & And it all now works sweetly on reboot - crude but effective! If anyone else has a Pi and a similar issue, you might need these startup options!

TinCanTech

What OS are you using ?

jjjames

Raspbian Jessie.

On further reading, I think a simpler solution may just be to tick the 'wait for network start' in the boot options in the graphical config tool on the Pi Pixel desktop. I have another project with the Raspberry with a network share not connecting because the network wasn't up at boot time. More experimenting....

TinCanTech

Systemd is quite good at managing service start up dependencies.

Also, look for a package called iptables-persist (or something to that effect).

jjjames

As it turned out the OpenVPN server crashing on boot was a simple server config issue with the OpenVPN software...
just remove line 1 of the file -

local 192.168.200.200

and it comes up sweetly. I'm not assigning a static IP on the Pi itself, only on the router via DHCP. Maybe if you set it all up as static on the Pi it would work.

One more post when I get to the bottom of the network issue, it works with the delay in the script file above but you should be able to put this into the /etc/network/interfaces file: something like this. Not entirely sure why you need to fire it off into a shell command....

iface eth0 inet manual
	pre-up iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE