[Solved] Connection to home lan drops during vpn client connection

telewy

Hi everyone,

For last 2 weeks i have been fighting with my openvpn setup and finally I reached the point where I am stacked. Here is description on my network:

My home lan is 192.168.1.0/24

I connect to the internet using wrt160nl router with openWRT installed ??? it has 192.168.1.1. This is also my gteway and dhcp server. I have gsm lte modem connected to this router and gsm is my internet provider. I have on this router openvpn client installed and running all the time.

I have external vps server with debian system installed. It has public and static ip address. Lets assume that addres of this server is 100.100.100.100. I have openvpn server installed on this vps server. My vpn network is 172.16.0.0/24

I connect to vpn using laptop (tomek_itm) and mobile with android (tomek_sgcpt)

My goal is quite simple. I would like to connect to any computers in my lan using openvpn client installed on wrt160nl router (I don't want to install vpn client on each device within lan). For the moment I am able to connect my lan from internet, following ping from vpn client 172.16.0.5 (tomek_itm) works fine:

c:\ping 192.168.1.1
Pinging 192.168.1.1 with 32 bytes of data:
Reply from 192.168.1.1: bytes=32 time=49ms TTL=63
Reply from 192.168.1.1: bytes=32 time=53ms TTL=63
.....

But connection to network 192.168.1.0 is lost everytime when new client is connecting. In server log file I attached below i happened after line:

...
Mon Feb  6 16:57:14 2017 us=253300 MULTI: Learn: 192.168.1.1 -> tomek_wrt160nl/94.254.227.198:19854
...

To get it back I run following command:

service openvpn restart

and connection is back after about 2 minutes (quite long time for me). From server log connections returns after line:

....
Mon Feb  6 16:56:53 2017 us=885510 MULTI: multi_create_instance called
....

During lost connection to 192.168.1.0 conection within vpn network 172.16.0.0 is working (pings between 172.16.0.XXX work fine).
Anyone can have any clue why connection to my home lan is dropped during new client connection?

Here is my setup

server configuration

port 1194
proto udp
dev tun
mode server
tls-server

ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key  # This file should be kept secret
dh /etc/openvpn/dh2048.pem
tls-auth /etc/openvpn/ta.key
cipher AES-256-CBC

ifconfig 172.16.0.1 255.255.255.0
topology subnet
#client-to-client
client-config-dir /etc/openvpn/ccd
route 192.168.1.0 255.255.255.0 172.16.0.2
push "route 192.168.1.0 255.255.255.0 172.16.0.2"

push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"

push "route-gateway 172.16.0.1"
push "redirect-gateway def1"
push "topology subnet"

keepalive 10 120
comp-lzo yes
push "comp-lzo yes"
user nobody
group nogroup
persist-key
persist-tun
status /etc/openvpn/openvpn-status.log
log /etc/openvpn/openvpn.log

verb 4

client configuration wrt160nl

config openvpn 'tomek_wrt160nl'
        option enabled '1'
        option dev 'tun'
        option proto 'udp'
        option cipher 'AES-256-CBC'
        option log '/tmp/openvpn.log'
        option verb '3'
        option ca '/etc/openvpn/ca.crt'
        option cert '/etc/openvpn/tomek_wrt160nl.crt'
        option key '/etc/openvpn/tomek_wrt160nl.key'
        option tls_auth '/etc/openvpn/ta.key'
        option client '1'
        option remote_cert_tls 'server'
        option remote '100.100.100.100 1194'
        option comp_lzo 'adaptive'
        option route_nopull '1'
        option log '/etc/openvpn/openvpn.log'

server route -n

route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         100.100.100.1    0.0.0.0         UG    0      0        0 eth0
37.233.103.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 eth0
172.16.0.0      0.0.0.0         255.255.255.0   U     0      0        0 tun0
192.168.1.0     172.16.0.2      255.255.255.0   UG    0      0        0 tun0

server if config

# ifconfig
eth0      Link encap:Ethernet  HWaddr e6:fe:a9:df:58:bc
          inet addr:100.100.100.100  Bcast:37.233.103.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1014737 errors:0 dropped:0 overruns:0 frame:0
          TX packets:177651 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:59852967 (57.0 MiB)  TX bytes:45058244 (42.9 MiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:37 errors:0 dropped:0 overruns:0 frame:0
          TX packets:37 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:4564 (4.4 KiB)  TX bytes:4564 (4.4 KiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:172.16.0.1  P-t-P:172.16.0.1  Mask:255.255.255.0
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:2369 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2547 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:142264 (138.9 KiB)  TX bytes:157038 (153.3 KiB)

client log wrt160nl

Mon Feb  6 16:48:43 2017 us=522878 OpenVPN 2.3.6 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jan  6 2015
Mon Feb  6 16:48:43 2017 us=538825 library versions: OpenSSL 1.0.2f  28 Jan 2016, LZO 2.08
Mon Feb  6 16:48:43 2017 us=586388 WARNING: file '/etc/openvpn/tomek_wrt160nl.key' is group or others accessible
Mon Feb  6 16:48:43 2017 us=628559 WARNING: file '/etc/openvpn/ta.key' is group or others accessible
Mon Feb  6 16:48:43 2017 us=633641 Control Channel Authentication: using '/etc/openvpn/ta.key' as a OpenVPN static key file
Mon Feb  6 16:48:43 2017 us=639153 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb  6 16:48:43 2017 us=644883 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb  6 16:48:43 2017 us=650369 LZO compression initialized
Mon Feb  6 16:48:43 2017 us=656485 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Mon Feb  6 16:48:43 2017 us=662075 Socket Buffers: R=[163840->131072] S=[163840->131072]
Mon Feb  6 16:48:43 2017 us=667374 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Feb  6 16:48:43 2017 us=673148 UDPv4 link local (bound): [undef]
Mon Feb  6 16:48:43 2017 us=678211 UDPv4 link remote: [AF_INET]100.100.100.100:1194
Mon Feb  6 16:48:43 2017 us=724804 TLS: Initial packet from [AF_INET]100.100.100.100:1194, sid=50c84790 f1bf2b19
Mon Feb  6 16:48:44 2017 us=307990 TLS Error: local/remote TLS keys are out of sync: [AF_INET]100.100.100.100:1194 [0]
Mon Feb  6 16:48:44 2017 us=505854 TLS Error: local/remote TLS keys are out of sync: [AF_INET]100.100.100.100:1194 [0]
Mon Feb  6 16:48:44 2017 us=616053 TLS Error: local/remote TLS keys are out of sync: [AF_INET]100.100.100.100:1194 [0]
Mon Feb  6 16:48:44 2017 us=626183 TLS Error: local/remote TLS keys are out of sync: [AF_INET]100.100.100.100:1194 [0]
Mon Feb  6 16:48:45 2017 us=226872 TLS Error: local/remote TLS keys are out of sync: [AF_INET]100.100.100.100:1194 [0]
Mon Feb  6 16:48:46 2017 us=430586 TLS Error: local/remote TLS keys are out of sync: [AF_INET]100.100.100.100:1194 [0]
Mon Feb  6 16:48:48 2017 us=507140 TLS Error: local/remote TLS keys are out of sync: [AF_INET]100.100.100.100:1194 [0]
Mon Feb  6 16:48:48 2017 us=831170 TLS Error: local/remote TLS keys are out of sync: [AF_INET]100.100.100.100:1194 [0]
Mon Feb  6 16:48:53 2017 us=516232 TLS Error: local/remote TLS keys are out of sync: [AF_INET]100.100.100.100:1194 [0]
Mon Feb  6 16:48:53 2017 us=618848 VERIFY OK: depth=1, C=PL, ST=mazowieckie, L=Warsaw, O=Tomasz Lewandowski, OU=TomaszLewandowski, CN=Tomasz Lewandowski CA, name=server, emailAddress=tomasz.lewandowski@mail.com
Mon Feb  6 16:48:53 2017 us=634277 Validating certificate key usage
Mon Feb  6 16:48:53 2017 us=639437 ++ Certificate has key usage  00a0, expects 00a0
Mon Feb  6 16:48:53 2017 us=644442 VERIFY KU OK
Mon Feb  6 16:48:53 2017 us=649506 Validating certificate extended key usage
Mon Feb  6 16:48:53 2017 us=654529 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Feb  6 16:48:53 2017 us=659895 VERIFY EKU OK
Mon Feb  6 16:48:53 2017 us=664735 VERIFY OK: depth=0, C=PL, ST=mazowieckie, L=Warsaw, O=Tomasz Lewandowski, OU=TomaszLewandowski, CN=server, name=server, emailAddress=tomasz.lewandowski@mail.com
Mon Feb  6 16:48:58 2017 us=514914 TLS Error: local/remote TLS keys are out of sync: [AF_INET]100.100.100.100:1194 [0]
Mon Feb  6 16:49:04 2017 us=630165 TLS Error: local/remote TLS keys are out of sync: [AF_INET]100.100.100.100:1194 [0]
Mon Feb  6 16:49:04 2017 us=636181 TLS Error: local/remote TLS keys are out of sync: [AF_INET]100.100.100.100:1194 [0]
Mon Feb  6 16:49:08 2017 us=514807 TLS Error: local/remote TLS keys are out of sync: [AF_INET]100.100.100.100:1194 [0]
Mon Feb  6 16:49:13 2017 us=513768 TLS Error: local/remote TLS keys are out of sync: [AF_INET]100.100.100.100:1194 [0]
Mon Feb  6 16:49:18 2017 us=130462 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Feb  6 16:49:18 2017 us=135757 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb  6 16:49:18 2017 us=181026 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Feb  6 16:49:18 2017 us=186247 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb  6 16:49:18 2017 us=192290 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Feb  6 16:49:18 2017 us=197945 [server] Peer Connection Initiated with [AF_INET]100.100.100.100:1194
Mon Feb  6 16:49:20 2017 us=573376 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Feb  6 16:49:20 2017 us=628678 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0 172.16.0.2,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route-gateway 172.16.0.1,redirect-gateway def1,topology subnet,comp-lzo yes,ping 10,ping-restart 120,ifconfig 172.16.0.2 255.255.255.0'
Mon Feb  6 16:49:20 2017 us=635795 Options error: option 'route' cannot be used in this context ([PUSH-OPTIONS])
Mon Feb  6 16:49:20 2017 us=641119 Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
Mon Feb  6 16:49:20 2017 us=646484 Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
Mon Feb  6 16:49:20 2017 us=652089 Options error: option 'redirect-gateway' cannot be used in this context ([PUSH-OPTIONS])
Mon Feb  6 16:49:20 2017 us=658187 OPTIONS IMPORT: timers and/or timeouts modified
Mon Feb  6 16:49:20 2017 us=663200 OPTIONS IMPORT: LZO parms modified
Mon Feb  6 16:49:20 2017 us=668321 OPTIONS IMPORT: --ifconfig/up options modified
Mon Feb  6 16:49:20 2017 us=673326 OPTIONS IMPORT: route-related options modified
Mon Feb  6 16:49:20 2017 us=689448 TUN/TAP device tun0 opened
Mon Feb  6 16:49:20 2017 us=694600 TUN/TAP TX queue length set to 100
Mon Feb  6 16:49:20 2017 us=709195 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Feb  6 16:49:20 2017 us=714532 /sbin/ifconfig tun0 172.16.0.2 netmask 255.255.255.0 mtu 1500 broadcast 172.16.0.255
Mon Feb  6 16:49:20 2017 us=746765 Initialization Sequence Completed
Mon Feb  6 16:52:50 2017 us=712742 [server] Inactivity timeout (--ping-restart), restarting
Mon Feb  6 16:52:50 2017 us=721067 TCP/UDP: Closing socket
Mon Feb  6 16:52:50 2017 us=726387 Closing TUN/TAP interface
Mon Feb  6 16:52:50 2017 us=731355 /sbin/ifconfig tun0 0.0.0.0
Mon Feb  6 16:52:50 2017 us=763497 SIGUSR1[soft,ping-restart] received, process restarting
Mon Feb  6 16:52:50 2017 us=768624 Restart pause, 2 second(s)
Mon Feb  6 16:52:52 2017 us=788129 WARNING: file '/etc/openvpn/tomek_wrt160nl.key' is group or others accessible
Mon Feb  6 16:52:52 2017 us=797398 WARNING: file '/etc/openvpn/ta.key' is group or others accessible
Mon Feb  6 16:52:52 2017 us=802489 Control Channel Authentication: using '/etc/openvpn/ta.key' as a OpenVPN static key file
Mon Feb  6 16:52:52 2017 us=807876 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb  6 16:52:52 2017 us=813581 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb  6 16:52:52 2017 us=818936 LZO compression initialized
Mon Feb  6 16:52:52 2017 us=824823 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Mon Feb  6 16:52:52 2017 us=830700 Socket Buffers: R=[163840->131072] S=[163840->131072]
Mon Feb  6 16:52:52 2017 us=835967 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Feb  6 16:52:52 2017 us=841329 UDPv4 link local (bound): [undef]
Mon Feb  6 16:52:52 2017 us=846600 UDPv4 link remote: [AF_INET]100.100.100.100:1194
Mon Feb  6 16:52:52 2017 us=880772 TLS: Initial packet from [AF_INET]100.100.100.100:1194, sid=bfe9172e e741806d
Mon Feb  6 16:53:12 2017 us=874975 VERIFY OK: depth=1, C=PL, ST=mazowieckie, L=Warsaw, O=Tomasz Lewandowski, OU=TomaszLewandowski, CN=Tomasz Lewandowski CA, name=server, emailAddress=tomasz.lewandowski@mail.com
Mon Feb  6 16:53:12 2017 us=889929 Validating certificate key usage
Mon Feb  6 16:53:12 2017 us=895119 ++ Certificate has key usage  00a0, expects 00a0
Mon Feb  6 16:53:12 2017 us=932925 VERIFY KU OK
Mon Feb  6 16:53:12 2017 us=937929 Validating certificate extended key usage
Mon Feb  6 16:53:12 2017 us=942957 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Feb  6 16:53:12 2017 us=948207 VERIFY EKU OK
Mon Feb  6 16:53:12 2017 us=953061 VERIFY OK: depth=0, C=PL, ST=mazowieckie, L=Warsaw, O=Tomasz Lewandowski, OU=TomaszLewandowski, CN=server, name=server, emailAddress=tomasz.lewandowski@mail.com
Mon Feb  6 16:53:33 2017 us=343431 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Feb  6 16:53:33 2017 us=348796 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb  6 16:53:33 2017 us=354539 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Feb  6 16:53:33 2017 us=359699 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb  6 16:53:33 2017 us=365414 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Feb  6 16:53:33 2017 us=371394 [server] Peer Connection Initiated with [AF_INET]100.100.100.100:1194
Mon Feb  6 16:53:35 2017 us=861829 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Feb  6 16:53:40 2017 us=653050 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Feb  6 16:53:44 2017 us=107152 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0 172.16.0.2,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route-gateway 172.16.0.1,redirect-gateway def1,topology subnet,comp-lzo yes,ping 10,ping-restart 120,ifconfig 172.16.0.2 255.255.255.0'
Mon Feb  6 16:53:44 2017 us=114500 Options error: option 'route' cannot be used in this context ([PUSH-OPTIONS])
Mon Feb  6 16:53:44 2017 us=119794 Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
Mon Feb  6 16:53:44 2017 us=125216 Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
Mon Feb  6 16:53:44 2017 us=130949 Options error: option 'redirect-gateway' cannot be used in this context ([PUSH-OPTIONS])
Mon Feb  6 16:53:44 2017 us=136504 OPTIONS IMPORT: timers and/or timeouts modified
Mon Feb  6 16:53:44 2017 us=141555 OPTIONS IMPORT: LZO parms modified
Mon Feb  6 16:53:44 2017 us=146577 OPTIONS IMPORT: --ifconfig/up options modified
Mon Feb  6 16:53:44 2017 us=151593 OPTIONS IMPORT: route-related options modified
Mon Feb  6 16:53:44 2017 us=164340 TUN/TAP device tun0 opened
Mon Feb  6 16:53:44 2017 us=169467 TUN/TAP TX queue length set to 100
Mon Feb  6 16:53:44 2017 us=184227 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Feb  6 16:53:44 2017 us=189524 /sbin/ifconfig tun0 172.16.0.2 netmask 255.255.255.0 mtu 1500 broadcast 172.16.0.255
Mon Feb  6 16:53:44 2017 us=253058 Initialization Sequence Completed
Mon Feb  6 16:56:50 2017 us=897050 [server] Inactivity timeout (--ping-restart), restarting
Mon Feb  6 16:56:50 2017 us=905282 TCP/UDP: Closing socket
Mon Feb  6 16:56:50 2017 us=910923 Closing TUN/TAP interface
Mon Feb  6 16:56:50 2017 us=915911 /sbin/ifconfig tun0 0.0.0.0
Mon Feb  6 16:56:50 2017 us=948002 SIGUSR1[soft,ping-restart] received, process restarting
Mon Feb  6 16:56:50 2017 us=953112 Restart pause, 2 second(s)
Mon Feb  6 16:56:52 2017 us=972761 WARNING: file '/etc/openvpn/tomek_wrt160nl.key' is group or others accessible
Mon Feb  6 16:56:52 2017 us=981591 WARNING: file '/etc/openvpn/ta.key' is group or others accessible
Mon Feb  6 16:56:52 2017 us=986699 Control Channel Authentication: using '/etc/openvpn/ta.key' as a OpenVPN static key file
Mon Feb  6 16:56:52 2017 us=992372 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb  6 16:56:52 2017 us=997752 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb  6 16:56:53 2017 us=3108 LZO compression initialized
Mon Feb  6 16:56:53 2017 us=9125 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Mon Feb  6 16:56:53 2017 us=47210 Socket Buffers: R=[163840->131072] S=[163840->131072]
Mon Feb  6 16:56:53 2017 us=52365 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Feb  6 16:56:53 2017 us=57799 UDPv4 link local (bound): [undef]
Mon Feb  6 16:56:53 2017 us=62802 UDPv4 link remote: [AF_INET]100.100.100.100:1194
Mon Feb  6 16:56:53 2017 us=93469 TLS: Initial packet from [AF_INET]100.100.100.100:1194, sid=3581193b 7444571b
Mon Feb  6 16:56:57 2017 us=816033 VERIFY OK: depth=1, C=PL, ST=mazowieckie, L=Warsaw, O=Tomasz Lewandowski, OU=TomaszLewandowski, CN=Tomasz Lewandowski CA, name=server, emailAddress=tomasz.lewandowski@mail.com
Mon Feb  6 16:56:57 2017 us=831156 Validating certificate key usage
Mon Feb  6 16:56:57 2017 us=836189 ++ Certificate has key usage  00a0, expects 00a0
Mon Feb  6 16:56:57 2017 us=841249 VERIFY KU OK
Mon Feb  6 16:56:57 2017 us=846178 Validating certificate extended key usage
Mon Feb  6 16:56:57 2017 us=851622 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Feb  6 16:56:57 2017 us=856868 VERIFY EKU OK
Mon Feb  6 16:56:57 2017 us=861881 VERIFY OK: depth=0, C=PL, ST=mazowieckie, L=Warsaw, O=Tomasz Lewandowski, OU=TomaszLewandowski, CN=server, name=server, emailAddress=tomasz.lewandowski@mail.com
Mon Feb  6 16:57:10 2017 us=793865 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Feb  6 16:57:10 2017 us=799212 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb  6 16:57:10 2017 us=804570 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Feb  6 16:57:10 2017 us=810306 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb  6 16:57:10 2017 us=815926 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Feb  6 16:57:10 2017 us=821598 [server] Peer Connection Initiated with [AF_INET]100.100.100.100:1194
Mon Feb  6 16:57:12 2017 us=66703 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Feb  6 16:57:12 2017 us=101204 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0 172.16.0.2,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route-gateway 172.16.0.1,redirect-gateway def1,topology subnet,comp-lzo yes,ping 10,ping-restart 120,ifconfig 172.16.0.2 255.255.255.0'
Mon Feb  6 16:57:12 2017 us=107691 Options error: option 'route' cannot be used in this context ([PUSH-OPTIONS])
Mon Feb  6 16:57:12 2017 us=113067 Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
Mon Feb  6 16:57:12 2017 us=118745 Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
Mon Feb  6 16:57:12 2017 us=124093 Options error: option 'redirect-gateway' cannot be used in this context ([PUSH-OPTIONS])
Mon Feb  6 16:57:12 2017 us=129700 OPTIONS IMPORT: timers and/or timeouts modified
Mon Feb  6 16:57:12 2017 us=134939 OPTIONS IMPORT: LZO parms modified
Mon Feb  6 16:57:12 2017 us=139899 OPTIONS IMPORT: --ifconfig/up options modified
Mon Feb  6 16:57:12 2017 us=144948 OPTIONS IMPORT: route-related options modified
Mon Feb  6 16:57:12 2017 us=158632 TUN/TAP device tun0 opened
Mon Feb  6 16:57:12 2017 us=163818 TUN/TAP TX queue length set to 100
Mon Feb  6 16:57:12 2017 us=178330 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Feb  6 16:57:12 2017 us=183655 /sbin/ifconfig tun0 172.16.0.2 netmask 255.255.255.0 mtu 1500 broadcast 172.16.0.255
Mon Feb  6 16:57:12 2017 us=226715 Initialization Sequence Completed

server log

Mon Feb  6 16:54:50 2017 us=672169 Current Parameter Settings:
Mon Feb  6 16:54:50 2017 us=672299   config = '/etc/openvpn/server.conf'
Mon Feb  6 16:54:50 2017 us=672319   mode = 1
Mon Feb  6 16:54:50 2017 us=672335   persist_config = DISABLED
Mon Feb  6 16:54:50 2017 us=672350   persist_mode = 1
Mon Feb  6 16:54:50 2017 us=672365   show_ciphers = DISABLED
Mon Feb  6 16:54:50 2017 us=672380   show_digests = DISABLED
Mon Feb  6 16:54:50 2017 us=672395   show_engines = DISABLED
Mon Feb  6 16:54:50 2017 us=672410   genkey = DISABLED
Mon Feb  6 16:54:50 2017 us=672425   key_pass_file = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=672441   show_tls_ciphers = DISABLED
Mon Feb  6 16:54:50 2017 us=672456 Connection profiles [default]:
Mon Feb  6 16:54:50 2017 us=672472   proto = udp
Mon Feb  6 16:54:50 2017 us=672488   local = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=672503   local_port = 1194
Mon Feb  6 16:54:50 2017 us=672518   remote = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=672533   remote_port = 1194
Mon Feb  6 16:54:50 2017 us=672548   remote_float = DISABLED
Mon Feb  6 16:54:50 2017 us=672563   bind_defined = DISABLED
Mon Feb  6 16:54:50 2017 us=672578   bind_local = ENABLED
Mon Feb  6 16:54:50 2017 us=672593   connect_retry_seconds = 5
Mon Feb  6 16:54:50 2017 us=672609   connect_timeout = 10
Mon Feb  6 16:54:50 2017 us=672624   connect_retry_max = 0
Mon Feb  6 16:54:50 2017 us=672639   socks_proxy_server = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=672654   socks_proxy_port = 0
Mon Feb  6 16:54:50 2017 us=672669   socks_proxy_retry = DISABLED
Mon Feb  6 16:54:50 2017 us=672684   tun_mtu = 1500
Mon Feb  6 16:54:50 2017 us=672700   tun_mtu_defined = ENABLED
Mon Feb  6 16:54:50 2017 us=672715   link_mtu = 1500
Mon Feb  6 16:54:50 2017 us=672730   link_mtu_defined = DISABLED
Mon Feb  6 16:54:50 2017 us=672745   tun_mtu_extra = 0
Mon Feb  6 16:54:50 2017 us=672760   tun_mtu_extra_defined = DISABLED
Mon Feb  6 16:54:50 2017 us=672775   mtu_discover_type = -1
Mon Feb  6 16:54:50 2017 us=672790   fragment = 0
Mon Feb  6 16:54:50 2017 us=672806   mssfix = 1450
Mon Feb  6 16:54:50 2017 us=672821   explicit_exit_notification = 0
Mon Feb  6 16:54:50 2017 us=672836 Connection profiles END
Mon Feb  6 16:54:50 2017 us=672851   remote_random = DISABLED
Mon Feb  6 16:54:50 2017 us=672866   ipchange = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=672881   dev = 'tun'
Mon Feb  6 16:54:50 2017 us=672896   dev_type = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=672911   dev_node = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=672926   lladdr = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=672942   topology = 3
Mon Feb  6 16:54:50 2017 us=672957   tun_ipv6 = DISABLED
Mon Feb  6 16:54:50 2017 us=672972   ifconfig_local = '172.16.0.1'
Mon Feb  6 16:54:50 2017 us=672987   ifconfig_remote_netmask = '255.255.255.0'
Mon Feb  6 16:54:50 2017 us=673002   ifconfig_noexec = DISABLED
Mon Feb  6 16:54:50 2017 us=673018   ifconfig_nowarn = DISABLED
Mon Feb  6 16:54:50 2017 us=673033   ifconfig_ipv6_local = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=673048   ifconfig_ipv6_netbits = 0
Mon Feb  6 16:54:50 2017 us=673063   ifconfig_ipv6_remote = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=673078   shaper = 0
Mon Feb  6 16:54:50 2017 us=673094   mtu_test = 0
Mon Feb  6 16:54:50 2017 us=673109   mlock = DISABLED
Mon Feb  6 16:54:50 2017 us=673124   keepalive_ping = 10
Mon Feb  6 16:54:50 2017 us=673139   keepalive_timeout = 120
Mon Feb  6 16:54:50 2017 us=673154   inactivity_timeout = 0
Mon Feb  6 16:54:50 2017 us=673175   ping_send_timeout = 10
Mon Feb  6 16:54:50 2017 us=673201   ping_rec_timeout = 240
Mon Feb  6 16:54:50 2017 us=673230   ping_rec_timeout_action = 2
Mon Feb  6 16:54:50 2017 us=673248   ping_timer_remote = DISABLED
Mon Feb  6 16:54:50 2017 us=673263   remap_sigusr1 = 0
Mon Feb  6 16:54:50 2017 us=673279   persist_tun = ENABLED
Mon Feb  6 16:54:50 2017 us=673294   persist_local_ip = DISABLED
Mon Feb  6 16:54:50 2017 us=673309   persist_remote_ip = DISABLED
Mon Feb  6 16:54:50 2017 us=673324   persist_key = ENABLED
Mon Feb  6 16:54:50 2017 us=673339   passtos = DISABLED
Mon Feb  6 16:54:50 2017 us=673354   resolve_retry_seconds = 1000000000
Mon Feb  6 16:54:50 2017 us=673380   username = 'nobody'
Mon Feb  6 16:54:50 2017 us=673397   groupname = 'nogroup'
Mon Feb  6 16:54:50 2017 us=673412   chroot_dir = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=673427   cd_dir = '/etc/openvpn'
Mon Feb  6 16:54:50 2017 us=673442   writepid = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=673457   up_script = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=673472   down_script = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=673487   down_pre = DISABLED
Mon Feb  6 16:54:50 2017 us=673503   up_restart = DISABLED
Mon Feb  6 16:54:50 2017 us=673518   up_delay = DISABLED
Mon Feb  6 16:54:50 2017 us=673542   daemon = ENABLED
Mon Feb  6 16:54:50 2017 us=673559   inetd = 0
Mon Feb  6 16:54:50 2017 us=673574   log = ENABLED
Mon Feb  6 16:54:50 2017 us=673590   suppress_timestamps = DISABLED
Mon Feb  6 16:54:50 2017 us=673639   nice = 0
Mon Feb  6 16:54:50 2017 us=673655   verbosity = 4
Mon Feb  6 16:54:50 2017 us=673671   mute = 0
Mon Feb  6 16:54:50 2017 us=673686   gremlin = 0
Mon Feb  6 16:54:50 2017 us=673701   status_file = '/etc/openvpn/openvpn-status.log'
Mon Feb  6 16:54:50 2017 us=673717   status_file_version = 1
Mon Feb  6 16:54:50 2017 us=673732   status_file_update_freq = 10
Mon Feb  6 16:54:50 2017 us=673747   occ = ENABLED
Mon Feb  6 16:54:50 2017 us=673762   rcvbuf = 65536
Mon Feb  6 16:54:50 2017 us=673778   sndbuf = 65536
Mon Feb  6 16:54:50 2017 us=673793   mark = 0
Mon Feb  6 16:54:50 2017 us=673809   sockflags = 0
Mon Feb  6 16:54:50 2017 us=673824   fast_io = DISABLED
Mon Feb  6 16:54:50 2017 us=673839   lzo = 3
Mon Feb  6 16:54:50 2017 us=673854   route_script = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=673869   route_default_gateway = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=673885   route_default_metric = 0
Mon Feb  6 16:54:50 2017 us=673900   route_noexec = DISABLED
Mon Feb  6 16:54:50 2017 us=673916   route_delay = 0
Mon Feb  6 16:54:50 2017 us=673931   route_delay_window = 30
Mon Feb  6 16:54:50 2017 us=673947   route_delay_defined = DISABLED
Mon Feb  6 16:54:50 2017 us=673962   route_nopull = DISABLED
Mon Feb  6 16:54:50 2017 us=673978   route_gateway_via_dhcp = DISABLED
Mon Feb  6 16:54:50 2017 us=673993   max_routes = 100
Mon Feb  6 16:54:50 2017 us=674008   allow_pull_fqdn = DISABLED
Mon Feb  6 16:54:50 2017 us=674025   route 192.168.1.0/255.255.255.0/172.16.0.2/nil
Mon Feb  6 16:54:50 2017 us=674040   management_addr = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=674056   management_port = 0
Mon Feb  6 16:54:50 2017 us=674071   management_user_pass = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=674087   management_log_history_cache = 250
Mon Feb  6 16:54:50 2017 us=674103   management_echo_buffer_size = 100
Mon Feb  6 16:54:50 2017 us=674118   management_write_peer_info_file = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=674134   management_client_user = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=674149   management_client_group = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=674164   management_flags = 0
Mon Feb  6 16:54:50 2017 us=674180   shared_secret_file = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=674196   key_direction = 0
Mon Feb  6 16:54:50 2017 us=674211   ciphername_defined = ENABLED
Mon Feb  6 16:54:50 2017 us=674226   ciphername = 'AES-256-CBC'
Mon Feb  6 16:54:50 2017 us=674242   authname_defined = ENABLED
Mon Feb  6 16:54:50 2017 us=674257   authname = 'SHA1'
Mon Feb  6 16:54:50 2017 us=674272   prng_hash = 'SHA1'
Mon Feb  6 16:54:50 2017 us=674288   prng_nonce_secret_len = 16
Mon Feb  6 16:54:50 2017 us=674303   keysize = 0
Mon Feb  6 16:54:50 2017 us=674318   engine = DISABLED
Mon Feb  6 16:54:50 2017 us=674334   replay = ENABLED
Mon Feb  6 16:54:50 2017 us=674349   mute_replay_warnings = DISABLED
Mon Feb  6 16:54:50 2017 us=674364   replay_window = 64
Mon Feb  6 16:54:50 2017 us=674380   replay_time = 15
Mon Feb  6 16:54:50 2017 us=674395   packet_id_file = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=674410   use_iv = ENABLED
Mon Feb  6 16:54:50 2017 us=674425   test_crypto = DISABLED
Mon Feb  6 16:54:50 2017 us=674440   tls_server = ENABLED
Mon Feb  6 16:54:50 2017 us=674456   tls_client = DISABLED
Mon Feb  6 16:54:50 2017 us=674481   key_method = 2
Mon Feb  6 16:54:50 2017 us=674498   ca_file = '/etc/openvpn/ca.crt'
Mon Feb  6 16:54:50 2017 us=674513   ca_path = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=674529   dh_file = '/etc/openvpn/dh2048.pem'
Mon Feb  6 16:54:50 2017 us=674544   cert_file = '/etc/openvpn/server.crt'
Mon Feb  6 16:54:50 2017 us=674560   priv_key_file = '/etc/openvpn/server.key'
Mon Feb  6 16:54:50 2017 us=674576   pkcs12_file = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=674591   cipher_list = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=674606   tls_verify = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=674621   tls_export_cert = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=674637   verify_x509_type = 0
Mon Feb  6 16:54:50 2017 us=674653   verify_x509_name = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=674668   crl_file = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=674683   ns_cert_type = 0
Mon Feb  6 16:54:50 2017 us=674699   remote_cert_ku[i] = 0
Mon Feb  6 16:54:50 2017 us=674714   remote_cert_ku[i] = 0
Mon Feb  6 16:54:50 2017 us=674925   remote_cert_ku[i] = 0
Mon Feb  6 16:54:50 2017 us=674941   remote_cert_eku = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=674956   ssl_flags = 0
Mon Feb  6 16:54:50 2017 us=674971   tls_timeout = 2
Mon Feb  6 16:54:50 2017 us=674986   renegotiate_bytes = 0
Mon Feb  6 16:54:50 2017 us=675002   renegotiate_packets = 0
Mon Feb  6 16:54:50 2017 us=675017   renegotiate_seconds = 3600
Mon Feb  6 16:54:50 2017 us=675032   handshake_window = 60
Mon Feb  6 16:54:50 2017 us=675048   transition_window = 3600
Mon Feb  6 16:54:50 2017 us=675063   single_session = DISABLED
Mon Feb  6 16:54:50 2017 us=675078   push_peer_info = DISABLED
Mon Feb  6 16:54:50 2017 us=675093   tls_exit = DISABLED
Mon Feb  6 16:54:50 2017 us=675109   tls_auth_file = '/etc/openvpn/ta.key'
Mon Feb  6 16:54:50 2017 us=675124   pkcs11_protected_authentication = DISABLED
Mon Feb  6 16:54:50 2017 us=675140   pkcs11_protected_authentication = DISABLED
Mon Feb  6 16:54:50 2017 us=675155   pkcs11_protected_authentication = DISABLED
Mon Feb  6 16:54:50 2017 us=675338   pkcs11_protected_authentication = DISABLED
Mon Feb  6 16:54:50 2017 us=675354   pkcs11_protected_authentication = DISABLED
Mon Feb  6 16:54:50 2017 us=675370   pkcs11_private_mode = 00000000
Mon Feb  6 16:54:50 2017 us=675385   pkcs11_private_mode = 00000000
Mon Feb  6 16:54:50 2017 us=675593   pkcs11_private_mode = 00000000
Mon Feb  6 16:54:50 2017 us=675608   pkcs11_private_mode = 00000000
Mon Feb  6 16:54:50 2017 us=675623   pkcs11_cert_private = DISABLED
Mon Feb  6 16:54:50 2017 us=675819   pkcs11_cert_private = DISABLED
Mon Feb  6 16:54:50 2017 us=675834   pkcs11_cert_private = DISABLED
Mon Feb  6 16:54:50 2017 us=675849   pkcs11_cert_private = DISABLED
Mon Feb  6 16:54:50 2017 us=675938   pkcs11_pin_cache_period = -1
Mon Feb  6 16:54:50 2017 us=675956   pkcs11_id = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=675971   pkcs11_id_management = DISABLED
Mon Feb  6 16:54:50 2017 us=675997   server_network = 0.0.0.0
Mon Feb  6 16:54:50 2017 us=676014   server_netmask = 0.0.0.0
Mon Feb  6 16:54:50 2017 us=676054   server_network_ipv6 = ::
Mon Feb  6 16:54:50 2017 us=676071   server_netbits_ipv6 = 0
Mon Feb  6 16:54:50 2017 us=676088   server_bridge_ip = 0.0.0.0
Mon Feb  6 16:54:50 2017 us=676104   server_bridge_netmask = 0.0.0.0
Mon Feb  6 16:54:50 2017 us=676121   server_bridge_pool_start = 0.0.0.0
Mon Feb  6 16:54:50 2017 us=676138   server_bridge_pool_end = 0.0.0.0
Mon Feb  6 16:54:50 2017 us=676154   push_entry = 'route 192.168.1.0 255.255.255.0 172.16.0.2'
Mon Feb  6 16:54:50 2017 us=676169   push_entry = 'dhcp-option DNS 208.67.222.222'
Mon Feb  6 16:54:50 2017 us=676185   push_entry = 'dhcp-option DNS 208.67.220.220'
Mon Feb  6 16:54:50 2017 us=676201   push_entry = 'route-gateway 172.16.0.1'
Mon Feb  6 16:54:50 2017 us=676216   push_entry = 'redirect-gateway def1'
Mon Feb  6 16:54:50 2017 us=676232   push_entry = 'topology subnet'
Mon Feb  6 16:54:50 2017 us=676247   push_entry = 'comp-lzo yes'
Mon Feb  6 16:54:50 2017 us=676262   push_entry = 'ping 10'
Mon Feb  6 16:54:50 2017 us=676278   push_entry = 'ping-restart 120'
Mon Feb  6 16:54:50 2017 us=676293   ifconfig_pool_defined = DISABLED
Mon Feb  6 16:54:50 2017 us=676310   ifconfig_pool_start = 0.0.0.0
Mon Feb  6 16:54:50 2017 us=676326   ifconfig_pool_end = 0.0.0.0
Mon Feb  6 16:54:50 2017 us=676343   ifconfig_pool_netmask = 0.0.0.0
Mon Feb  6 16:54:50 2017 us=676358   ifconfig_pool_persist_filename = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=676374   ifconfig_pool_persist_refresh_freq = 600
Mon Feb  6 16:54:50 2017 us=676389   ifconfig_ipv6_pool_defined = DISABLED
Mon Feb  6 16:54:50 2017 us=676406   ifconfig_ipv6_pool_base = ::
Mon Feb  6 16:54:50 2017 us=676422   ifconfig_ipv6_pool_netbits = 0
Mon Feb  6 16:54:50 2017 us=676437   n_bcast_buf = 256
Mon Feb  6 16:54:50 2017 us=676453   tcp_queue_limit = 64
Mon Feb  6 16:54:50 2017 us=676468   real_hash_size = 256
Mon Feb  6 16:54:50 2017 us=676493   virtual_hash_size = 256
Mon Feb  6 16:54:50 2017 us=676510   client_connect_script = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=676525   learn_address_script = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=676540   client_disconnect_script = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=676556   client_config_dir = '/etc/openvpn/ccd'
Mon Feb  6 16:54:50 2017 us=676571   ccd_exclusive = DISABLED
Mon Feb  6 16:54:50 2017 us=676586   tmp_dir = '/tmp'
Mon Feb  6 16:54:50 2017 us=676602   push_ifconfig_defined = DISABLED
Mon Feb  6 16:54:50 2017 us=676618   push_ifconfig_local = 0.0.0.0
Mon Feb  6 16:54:50 2017 us=676635   push_ifconfig_remote_netmask = 0.0.0.0
Mon Feb  6 16:54:50 2017 us=676651   push_ifconfig_ipv6_defined = DISABLED
Mon Feb  6 16:54:50 2017 us=676667   push_ifconfig_ipv6_local = ::/0
Mon Feb  6 16:54:50 2017 us=676683   push_ifconfig_ipv6_remote = ::
Mon Feb  6 16:54:50 2017 us=676699   enable_c2c = DISABLED
Mon Feb  6 16:54:50 2017 us=676714   duplicate_cn = DISABLED
Mon Feb  6 16:54:50 2017 us=676730   cf_max = 0
Mon Feb  6 16:54:50 2017 us=676745   cf_per = 0
Mon Feb  6 16:54:50 2017 us=676761   max_clients = 1024
Mon Feb  6 16:54:50 2017 us=676776   max_routes_per_client = 256
Mon Feb  6 16:54:50 2017 us=676792   auth_user_pass_verify_script = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=676807   auth_user_pass_verify_script_via_file = DISABLED
Mon Feb  6 16:54:50 2017 us=676823   port_share_host = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=676838   port_share_port = 0
Mon Feb  6 16:54:50 2017 us=676853   client = DISABLED
Mon Feb  6 16:54:50 2017 us=676869   pull = DISABLED
Mon Feb  6 16:54:50 2017 us=676884   auth_user_pass_file = '[UNDEF]'
Mon Feb  6 16:54:50 2017 us=676901 OpenVPN 2.3.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Nov 12 2015
Mon Feb  6 16:54:50 2017 us=676936 library versions: OpenSSL 1.0.1t  3 May 2016, LZO 2.08
Mon Feb  6 16:54:50 2017 us=677784 Diffie-Hellman initialized with 2048 bit key
Mon Feb  6 16:54:50 2017 us=678557 Control Channel Authentication: using '/etc/openvpn/ta.key' as a OpenVPN static key file
Mon Feb  6 16:54:50 2017 us=678591 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb  6 16:54:50 2017 us=678611 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb  6 16:54:50 2017 us=678634 TLS-Auth MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Mon Feb  6 16:54:50 2017 us=678669 Socket Buffers: R=[212992->131072] S=[212992->131072]
Mon Feb  6 16:54:50 2017 us=678851 ROUTE_GATEWAY 100.100.100.1/255.255.255.0 IFACE=eth0 HWADDR=e6:fe:a9:df:58:bc
Mon Feb  6 16:54:50 2017 us=679168 TUN/TAP device tun0 opened
Mon Feb  6 16:54:50 2017 us=679204 TUN/TAP TX queue length set to 100
Mon Feb  6 16:54:50 2017 us=679232 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Feb  6 16:54:50 2017 us=679265 /sbin/ip link set dev tun0 up mtu 1500
Mon Feb  6 16:54:50 2017 us=682579 /sbin/ip addr add dev tun0 172.16.0.1/24 broadcast 172.16.0.255
Mon Feb  6 16:54:50 2017 us=685424 /sbin/ip route add 192.168.1.0/24 via 172.16.0.2
Mon Feb  6 16:54:50 2017 us=691169 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Feb  6 16:54:50 2017 us=693199 GID set to nogroup
Mon Feb  6 16:54:50 2017 us=693284 UID set to nobody
Mon Feb  6 16:54:50 2017 us=693309 UDPv4 link local (bound): [undef]
Mon Feb  6 16:54:50 2017 us=693320 UDPv4 link remote: [undef]
Mon Feb  6 16:54:50 2017 us=693333 MULTI: multi_init called, r=256 v=256
Mon Feb  6 16:54:50 2017 us=693511 Initialization Sequence Completed
Mon Feb  6 16:56:51 2017 us=839076 MULTI: multi_create_instance called
Mon Feb  6 16:56:51 2017 us=839186 94.254.227.198:19854 Re-using SSL/TLS context
Mon Feb  6 16:56:51 2017 us=839251 94.254.227.198:19854 LZO compression initialized
Mon Feb  6 16:56:51 2017 us=839523 94.254.227.198:19854 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Mon Feb  6 16:56:51 2017 us=839543 94.254.227.198:19854 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Feb  6 16:56:51 2017 us=839630 94.254.227.198:19854 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Mon Feb  6 16:56:51 2017 us=839643 94.254.227.198:19854 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Mon Feb  6 16:56:51 2017 us=839686 94.254.227.198:19854 Local Options hash (VER=V4): '0b024030'
Mon Feb  6 16:56:51 2017 us=839704 94.254.227.198:19854 Expected Remote Options hash (VER=V4): '5b243d85'
Mon Feb  6 16:56:51 2017 us=839739 94.254.227.198:19854 TLS: Initial packet from [AF_INET]94.254.227.198:19854, sid=fcb72af4 f5485f8f
Mon Feb  6 16:56:53 2017 us=885510 MULTI: multi_create_instance called
Mon Feb  6 16:56:53 2017 us=885626 77.114.12.156:61065 Re-using SSL/TLS context
Mon Feb  6 16:56:55 2017 us=48166 77.114.12.156:61065 LZO compression initialized
Mon Feb  6 16:56:55 2017 us=48372 77.114.12.156:61065 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Mon Feb  6 16:56:55 2017 us=48394 77.114.12.156:61065 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Feb  6 16:56:55 2017 us=48453 77.114.12.156:61065 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Mon Feb  6 16:56:55 2017 us=48467 77.114.12.156:61065 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Mon Feb  6 16:56:55 2017 us=48493 77.114.12.156:61065 Local Options hash (VER=V4): '0b024030'
Mon Feb  6 16:56:55 2017 us=48517 77.114.12.156:61065 Expected Remote Options hash (VER=V4): '5b243d85'
Mon Feb  6 16:56:55 2017 us=48559 77.114.12.156:61065 TLS: Initial packet from [AF_INET]77.114.12.156:61065, sid=a5e9d3fd c9353ec8
Mon Feb  6 16:56:59 2017 us=345897 77.114.12.156:61065 VERIFY OK: depth=1, C=PL, ST=mazowieckie, L=Warsaw, O=Tomasz Lewandowski, OU=TomaszLewandowski, CN=Tomasz Lewandowski CA, name=server, emailAddress=tomasz.lewandowski@mail.com
Mon Feb  6 16:57:02 2017 us=20395 77.114.12.156:61065 VERIFY OK: depth=0, C=PL, ST=mazowieckie, L=Warsaw, O=Tomasz Lewandowski, OU=TomaszLewandowski, CN=tomek_itm, name=server, emailAddress=tomasz.lewandowski@mail.com
Mon Feb  6 16:57:02 2017 us=70469 77.114.12.156:61065 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Feb  6 16:57:02 2017 us=70507 77.114.12.156:61065 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb  6 16:57:02 2017 us=70527 77.114.12.156:61065 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Feb  6 16:57:02 2017 us=70546 77.114.12.156:61065 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb  6 16:57:02 2017 us=118159 77.114.12.156:61065 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Feb  6 16:57:02 2017 us=118227 77.114.12.156:61065 [tomek_itm] Peer Connection Initiated with [AF_INET]77.114.12.156:61065
Mon Feb  6 16:57:02 2017 us=118302 tomek_itm/77.114.12.156:61065 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/tomek_itm
Mon Feb  6 16:57:02 2017 us=118468 tomek_itm/77.114.12.156:61065 MULTI: Learn: 172.16.0.5 -> tomek_itm/77.114.12.156:61065
Mon Feb  6 16:57:02 2017 us=118493 tomek_itm/77.114.12.156:61065 MULTI: primary virtual IP for tomek_itm/77.114.12.156:61065: 172.16.0.5
Mon Feb  6 16:57:02 2017 us=118513 tomek_itm/77.114.12.156:61065 MULTI: internal route 192.168.1.0/24 -> tomek_itm/77.114.12.156:61065
Mon Feb  6 16:57:02 2017 us=118535 tomek_itm/77.114.12.156:61065 MULTI: Learn: 192.168.1.0/24 -> tomek_itm/77.114.12.156:61065
Mon Feb  6 16:57:03 2017 us=150337 tomek_itm/77.114.12.156:61065 PUSH: Received control message: 'PUSH_REQUEST'
Mon Feb  6 16:57:03 2017 us=150429 tomek_itm/77.114.12.156:61065 send_push_reply(): safe_cap=940
Mon Feb  6 16:57:03 2017 us=150473 tomek_itm/77.114.12.156:61065 SENT CONTROL [tomek_itm]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0 172.16.0.2,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route-gateway 172.16.0.1,redirect-gateway def1,topology subnet,comp-lzo yes,ping 10,ping-restart 120,ifconfig 172.16.0.5 255.255.255.0' (status=1)
Mon Feb  6 16:57:04 2017 us=253294 MULTI: Learn: 192.168.1.1 -> tomek_itm/77.114.12.156:61065
Mon Feb  6 16:57:06 2017 us=214286 94.254.227.198:19854 VERIFY OK: depth=1, C=PL, ST=mazowieckie, L=Warsaw, O=Tomasz Lewandowski, OU=TomaszLewandowski, CN=Tomasz Lewandowski CA, name=server, emailAddress=tomasz.lewandowski@mail.com
Mon Feb  6 16:57:06 2017 us=214640 94.254.227.198:19854 VERIFY OK: depth=0, C=PL, ST=mazowieckie, L=Warsaw, O=Tomasz Lewandowski, OU=TomaszLewandowski, CN=tomek_wrt160nl, name=server, emailAddress=tomasz.lewandowski@mail.com
Mon Feb  6 16:57:09 2017 us=535815 94.254.227.198:19854 NOTE: Options consistency check may be skewed by version differences
Mon Feb  6 16:57:09 2017 us=535896 94.254.227.198:19854 WARNING: 'version' is used inconsistently, local='version V4', remote='version V0 UNDEF'
Mon Feb  6 16:57:09 2017 us=535945 94.254.227.198:19854 WARNING: 'dev-type' is present in local config but missing in remote config, local='dev-type tun'
Mon Feb  6 16:57:09 2017 us=535965 94.254.227.198:19854 WARNING: 'link-mtu' is present in local config but missing in remote config, local='link-mtu 1558'
Mon Feb  6 16:57:09 2017 us=535984 94.254.227.198:19854 WARNING: 'tun-mtu' is present in local config but missing in remote config, local='tun-mtu 1500'
Mon Feb  6 16:57:09 2017 us=536002 94.254.227.198:19854 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Mon Feb  6 16:57:09 2017 us=536021 94.254.227.198:19854 WARNING: 'cipher' is present in local config but missing in remote config, local='cipher AES-256-CBC'
Mon Feb  6 16:57:09 2017 us=536039 94.254.227.198:19854 WARNING: 'auth' is present in local config but missing in remote config, local='auth SHA1'
Mon Feb  6 16:57:09 2017 us=536057 94.254.227.198:19854 WARNING: 'keysize' is present in local config but missing in remote config, local='keysize 256'
Mon Feb  6 16:57:09 2017 us=536075 94.254.227.198:19854 WARNING: 'tls-auth' is present in local config but missing in remote config, local='tls-auth'
Mon Feb  6 16:57:09 2017 us=536093 94.254.227.198:19854 WARNING: 'key-method' is present in local config but missing in remote config, local='key-method 2'
Mon Feb  6 16:57:09 2017 us=536111 94.254.227.198:19854 WARNING: 'tls-client' is present in local config but missing in remote config, local='tls-client'
Mon Feb  6 16:57:09 2017 us=536253 94.254.227.198:19854 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Feb  6 16:57:09 2017 us=536277 94.254.227.198:19854 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb  6 16:57:09 2017 us=536295 94.254.227.198:19854 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Feb  6 16:57:09 2017 us=536313 94.254.227.198:19854 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb  6 16:57:09 2017 us=576871 94.254.227.198:19854 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Feb  6 16:57:09 2017 us=576956 94.254.227.198:19854 [tomek_wrt160nl] Peer Connection Initiated with [AF_INET]94.254.227.198:19854
Mon Feb  6 16:57:09 2017 us=577020 tomek_wrt160nl/94.254.227.198:19854 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/tomek_wrt160nl
Mon Feb  6 16:57:09 2017 us=577182 tomek_wrt160nl/94.254.227.198:19854 MULTI: Learn: 172.16.0.2 -> tomek_wrt160nl/94.254.227.198:19854
Mon Feb  6 16:57:09 2017 us=577211 tomek_wrt160nl/94.254.227.198:19854 MULTI: primary virtual IP for tomek_wrt160nl/94.254.227.198:19854: 172.16.0.2
Mon Feb  6 16:57:09 2017 us=577246 tomek_wrt160nl/94.254.227.198:19854 MULTI: internal route 192.168.1.0/24 -> tomek_wrt160nl/94.254.227.198:19854
Mon Feb  6 16:57:09 2017 us=577299 tomek_wrt160nl/94.254.227.198:19854 MULTI: Learn: 192.168.1.0/24 -> tomek_wrt160nl/94.254.227.198:19854
Mon Feb  6 16:57:10 2017 us=844137 tomek_wrt160nl/94.254.227.198:19854 PUSH: Received control message: 'PUSH_REQUEST'
Mon Feb  6 16:57:10 2017 us=844220 tomek_wrt160nl/94.254.227.198:19854 send_push_reply(): safe_cap=940
Mon Feb  6 16:57:10 2017 us=844275 tomek_wrt160nl/94.254.227.198:19854 SENT CONTROL [tomek_wrt160nl]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0 172.16.0.2,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route-gateway 172.16.0.1,redirect-gateway def1,topology subnet,comp-lzo yes,ping 10,ping-restart 120,ifconfig 172.16.0.2 255.255.255.0' (status=1)
Mon Feb  6 16:57:14 2017 us=253300 MULTI: Learn: 192.168.1.1 -> tomek_wrt160nl/94.254.227.198:19854
Mon Feb  6 16:57:52 2017 us=263090 tomek_itm/77.114.12.156:61065 MULTI: bad source address from client [fe80::945:a361:76f2:fd9e], packet dropped
Mon Feb  6 16:57:52 2017 us=672927 tomek_itm/77.114.12.156:61065 MULTI: bad source address from client [fe80::945:a361:76f2:fd9e], packet dropped
Mon Feb  6 16:58:03 2017 us=348518 MULTI: multi_create_instance called
Mon Feb  6 16:58:03 2017 us=348619 94.254.130.42:63866 Re-using SSL/TLS context
Mon Feb  6 16:58:03 2017 us=348666 94.254.130.42:63866 LZO compression initialized
Mon Feb  6 16:58:03 2017 us=348802 94.254.130.42:63866 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Mon Feb  6 16:58:03 2017 us=348823 94.254.130.42:63866 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Feb  6 16:58:03 2017 us=348865 94.254.130.42:63866 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Mon Feb  6 16:58:03 2017 us=348878 94.254.130.42:63866 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Mon Feb  6 16:58:03 2017 us=348904 94.254.130.42:63866 Local Options hash (VER=V4): '0b024030'
Mon Feb  6 16:58:03 2017 us=348924 94.254.130.42:63866 Expected Remote Options hash (VER=V4): '5b243d85'
Mon Feb  6 16:58:03 2017 us=348963 94.254.130.42:63866 TLS: Initial packet from [AF_INET]94.254.130.42:63866, sid=11fd70b0 07273e59
Mon Feb  6 16:58:03 2017 us=417608 94.254.130.42:63866 PID_ERR replay-window backtrack occurred [1] [TLS_AUTH-0] [0_0] 1486396681:3 1486396681:2 t=1486396683[0] r=[0,64,15,1,1] sl=[61,3,64,528]
Mon Feb  6 16:58:04 2017 us=129180 94.254.130.42:63866 VERIFY OK: depth=1, C=PL, ST=mazowieckie, L=Warsaw, O=Tomasz Lewandowski, OU=TomaszLewandowski, CN=Tomasz Lewandowski CA, name=server, emailAddress=tomasz.lewandowski@mail.com
Mon Feb  6 16:58:04 2017 us=129532 94.254.130.42:63866 VERIFY OK: depth=0, C=PL, ST=mazowieckie, L=Warsaw, O=Tomasz Lewandowski, OU=TomaszLewandowski, CN=tomek_sgcpt, name=server, emailAddress=tomasz.lewandowski@mail.com
Mon Feb  6 16:58:04 2017 us=177340 94.254.130.42:63866 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Feb  6 16:58:04 2017 us=177398 94.254.130.42:63866 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb  6 16:58:04 2017 us=177419 94.254.130.42:63866 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Feb  6 16:58:04 2017 us=177440 94.254.130.42:63866 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb  6 16:58:04 2017 us=208716 94.254.130.42:63866 Control Channel: TLSv1, cipher TLSv1/SSLv3 EDH-RSA-DES-CBC3-SHA, 2048 bit RSA
Mon Feb  6 16:58:04 2017 us=208790 94.254.130.42:63866 [tomek_sgcpt] Peer Connection Initiated with [AF_INET]94.254.130.42:63866
Mon Feb  6 16:58:04 2017 us=208834 tomek_sgcpt/94.254.130.42:63866 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/tomek_sgcpt
Mon Feb  6 16:58:04 2017 us=208955 tomek_sgcpt/94.254.130.42:63866 MULTI: Learn: 172.16.0.4 -> tomek_sgcpt/94.254.130.42:63866
Mon Feb  6 16:58:04 2017 us=208988 tomek_sgcpt/94.254.130.42:63866 MULTI: primary virtual IP for tomek_sgcpt/94.254.130.42:63866: 172.16.0.4
Mon Feb  6 16:58:04 2017 us=209001 tomek_sgcpt/94.254.130.42:63866 MULTI: internal route 192.168.1.0/24 -> tomek_sgcpt/94.254.130.42:63866
Mon Feb  6 16:58:04 2017 us=209014 tomek_sgcpt/94.254.130.42:63866 MULTI: Learn: 192.168.1.0/24 -> tomek_sgcpt/94.254.130.42:63866
Mon Feb  6 16:58:04 2017 us=209080 tomek_sgcpt/94.254.130.42:63866 PUSH: Received control message: 'PUSH_REQUEST'
Mon Feb  6 16:58:04 2017 us=209095 tomek_sgcpt/94.254.130.42:63866 send_push_reply(): safe_cap=940
Mon Feb  6 16:58:04 2017 us=209141 tomek_sgcpt/94.254.130.42:63866 SENT CONTROL [tomek_sgcpt]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0 172.16.0.2,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route-gateway 172.16.0.1,redirect-gateway def1,topology subnet,comp-lzo yes,ping 10,ping-restart 120,ifconfig 172.16.0.4 255.255.255.0' (status=1)
Mon Feb  6 16:58:04 2017 us=693307 MULTI: Learn: 192.168.1.1 -> tomek_sgcpt/94.254.130.42:63866
Mon Feb  6 16:58:20 2017 us=630004 tomek_itm/77.114.12.156:61065 MULTI: bad source address from client [fe80::945:a361:76f2:fd9e], packet dropped
Mon Feb  6 16:58:20 2017 us=790055 tomek_itm/77.114.12.156:61065 MULTI: bad source address from client [fe80::945:a361:76f2:fd9e], packet dropped
Mon Feb  6 16:58:21 2017 us=100081 tomek_itm/77.114.12.156:61065 MULTI: bad source address from client [fe80::945:a361:76f2:fd9e], packet dropped
Mon Feb  6 16:58:21 2017 us=559059 tomek_itm/77.114.12.156:61065 MULTI: bad source address from client [fe80::945:a361:76f2:fd9e], packet dropped

TinCanTech

You appear to be trying to do this without reading the HOWTO.

HOWTO: Expanding the scope of the VPN to include additional machines

Also,

Use --server in the server config ..
Do not use --route-nopull in the client config .. do it how the HOWTO explains.
Use --verb 4 (until you get it working)

TinCanTech

Server:

telewy wroteOpenVPN 2.3.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Nov 12 2015

Client:

telewy wroteOpenVPN 2.3.6 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jan 6 2015

Get these up-to-date ..

https://openvpn.net/index.php/open-source/downloads.html

telewy

TinCanTech wroteYou appear to be trying to do this without reading the HOWTO.

HOWTO: Expanding the scope of the VPN to include additional machines

Also,

Use --server in the server config ..
Do not use --route-nopull in the client config .. do it how the HOWTO explains.
Use --verb 4 (until you get it working)

Thanks for you answers. I have red this documentation but was confused by some other articles. So I again read carefully this hwoto and updated my server.conf according to my understanding of it:

ort 1194
proto udp
dev tun
mode server
tls-server

ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key  # This file should be kept secret
dh /etc/openvpn/dh2048.pem
tls-auth /etc/openvpn/ta.key
cipher AES-256-CBC

server 172.16.0.0 255.255.255.0
ifconfig 172.16.0.1 255.255.255.0
topology subnet
client-config-dir /etc/openvpn/ccd
route 192.168.1.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"

push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"

push "topology subnet"

keepalive 10 120
comp-lzo yes
push "comp-lzo yes"
user nobody
group nogroup
persist-key
persist-tun
status /etc/openvpn/openvpn-status.log
log /etc/openvpn/openvpn.log

verb 4

and on client wrt160nl i removed "route_nopull"

config openvpn 'tomek_wrt160nl'
        option enabled '1'
        option dev 'tun'
        option proto 'udp'
        option cipher 'AES-256-CBC'
        option log '/tmp/openvpn.log'
        option verb '4'
        option ca '/etc/openvpn/ca.crt'
        option cert '/etc/openvpn/tomek_wrt160nl.crt'
        option key '/etc/openvpn/tomek_wrt160nl.key'
        option tls_auth '/etc/openvpn/ta.key'
        option client '1'
        option remote_cert_tls 'server'
        option remote 'XXX.XXX.XXX.XXX 1194'
        option comp_lzo 'adaptive'
        option log '/etc/openvpn/openvpn.log'

Also, which i forgot to mention in my first post, i have /etc/openvpn/ccd/tomek_wrt160nl file which has this line:

iroute 192.168.1.0 255.255.255.0

TinCanTech wroteServer:
telewy wroteOpenVPN 2.3.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Nov 12 2015
Client:
telewy wroteOpenVPN 2.3.6 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jan 6 2015
Get these up-to-date ..

https://openvpn.net/index.php/open-source/downloads.html

I updated the server version but I am not able to compile client for OpenWRT system. I will look at this tomorrow. For the moment is stil 2.3.6

To better understanding i attached simple schema of my network:
http://telewy.republika.pl/tmp/siec_domowa_20170127_simple.jpg

But these changes didn't solve my problem. Everything works fine till i run connection from client when connection to lan (192.168.1.0) was lost after line:

Tue Feb  7 01:06:44 2017 us=85495 MULTI: Learn: 192.168.1.2 -> tomek_wrt160nl/94.254.227.198:19854

from server log

Tue Feb  7 01:02:09 2017 us=988217 Current Parameter Settings:
Tue Feb  7 01:02:09 2017 us=988285   config = '/etc/openvpn/server.conf'
Tue Feb  7 01:02:09 2017 us=988298   mode = 1
Tue Feb  7 01:02:09 2017 us=988307   persist_config = DISABLED
Tue Feb  7 01:02:09 2017 us=988316   persist_mode = 1
Tue Feb  7 01:02:09 2017 us=988325   show_ciphers = DISABLED
Tue Feb  7 01:02:09 2017 us=988334   show_digests = DISABLED
Tue Feb  7 01:02:09 2017 us=988343   show_engines = DISABLED
Tue Feb  7 01:02:09 2017 us=988352   genkey = DISABLED
Tue Feb  7 01:02:09 2017 us=988361   key_pass_file = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=988371   show_tls_ciphers = DISABLED
Tue Feb  7 01:02:09 2017 us=988380   connect_retry_max = 0
Tue Feb  7 01:02:09 2017 us=988389 Connection profiles [0]:
Tue Feb  7 01:02:09 2017 us=988399   proto = udp
Tue Feb  7 01:02:09 2017 us=988408   local = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=988417   local_port = '1194'
Tue Feb  7 01:02:09 2017 us=988426   remote = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=988435   remote_port = '1194'
Tue Feb  7 01:02:09 2017 us=988444   remote_float = DISABLED
Tue Feb  7 01:02:09 2017 us=988458   bind_defined = DISABLED
Tue Feb  7 01:02:09 2017 us=988469   bind_local = ENABLED
Tue Feb  7 01:02:09 2017 us=988478   bind_ipv6_only = DISABLED
Tue Feb  7 01:02:09 2017 us=988487   connect_retry_seconds = 5
Tue Feb  7 01:02:09 2017 us=988496   connect_timeout = 120
Tue Feb  7 01:02:09 2017 us=988505   socks_proxy_server = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=988514   socks_proxy_port = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=988523   tun_mtu = 1500
Tue Feb  7 01:02:09 2017 us=988532   tun_mtu_defined = ENABLED
Tue Feb  7 01:02:09 2017 us=988541   link_mtu = 1500
Tue Feb  7 01:02:09 2017 us=988550   link_mtu_defined = DISABLED
Tue Feb  7 01:02:09 2017 us=988559   tun_mtu_extra = 0
Tue Feb  7 01:02:09 2017 us=988568   tun_mtu_extra_defined = DISABLED
Tue Feb  7 01:02:09 2017 us=988578   mtu_discover_type = -1
Tue Feb  7 01:02:09 2017 us=988587   fragment = 0
Tue Feb  7 01:02:09 2017 us=988596   mssfix = 1450
Tue Feb  7 01:02:09 2017 us=988605   explicit_exit_notification = 0
Tue Feb  7 01:02:09 2017 us=988614 Connection profiles END
Tue Feb  7 01:02:09 2017 us=988624   remote_random = DISABLED
Tue Feb  7 01:02:09 2017 us=988633   ipchange = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=988642   dev = 'tun'
Tue Feb  7 01:02:09 2017 us=988651   dev_type = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=988660   dev_node = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=988669   lladdr = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=988678   topology = 3
Tue Feb  7 01:02:09 2017 us=988687   ifconfig_local = '172.16.0.1'
Tue Feb  7 01:02:09 2017 us=988697   ifconfig_remote_netmask = '255.255.255.0'
Tue Feb  7 01:02:09 2017 us=988706   ifconfig_noexec = DISABLED
Tue Feb  7 01:02:09 2017 us=988715   ifconfig_nowarn = DISABLED
Tue Feb  7 01:02:09 2017 us=988724   ifconfig_ipv6_local = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=988733   ifconfig_ipv6_netbits = 0
Tue Feb  7 01:02:09 2017 us=988742   ifconfig_ipv6_remote = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=988752   shaper = 0
Tue Feb  7 01:02:09 2017 us=988761   mtu_test = 0
Tue Feb  7 01:02:09 2017 us=988770   mlock = DISABLED
Tue Feb  7 01:02:09 2017 us=988779   keepalive_ping = 10
Tue Feb  7 01:02:09 2017 us=988788   keepalive_timeout = 120
Tue Feb  7 01:02:09 2017 us=988798   inactivity_timeout = 0
Tue Feb  7 01:02:09 2017 us=988807   ping_send_timeout = 10
Tue Feb  7 01:02:09 2017 us=988816   ping_rec_timeout = 240
Tue Feb  7 01:02:09 2017 us=988825   ping_rec_timeout_action = 2
Tue Feb  7 01:02:09 2017 us=988834   ping_timer_remote = DISABLED
Tue Feb  7 01:02:09 2017 us=988844   remap_sigusr1 = 0
Tue Feb  7 01:02:09 2017 us=988853   persist_tun = ENABLED
Tue Feb  7 01:02:09 2017 us=988862   persist_local_ip = DISABLED
Tue Feb  7 01:02:09 2017 us=988871   persist_remote_ip = DISABLED
Tue Feb  7 01:02:09 2017 us=988880   persist_key = ENABLED
Tue Feb  7 01:02:09 2017 us=988889   passtos = DISABLED
Tue Feb  7 01:02:09 2017 us=988899   resolve_retry_seconds = 1000000000
Tue Feb  7 01:02:09 2017 us=988908   resolve_in_advance = DISABLED
Tue Feb  7 01:02:09 2017 us=988924   username = 'nobody'
Tue Feb  7 01:02:09 2017 us=988933   groupname = 'nogroup'
Tue Feb  7 01:02:09 2017 us=988943   chroot_dir = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=988952   cd_dir = '/etc/openvpn'
Tue Feb  7 01:02:09 2017 us=988961   writepid = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=988970   up_script = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=988979   down_script = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=988988   down_pre = DISABLED
Tue Feb  7 01:02:09 2017 us=988997   up_restart = DISABLED
Tue Feb  7 01:02:09 2017 us=989006   up_delay = DISABLED
Tue Feb  7 01:02:09 2017 us=989015   daemon = ENABLED
Tue Feb  7 01:02:09 2017 us=989024   inetd = 0
Tue Feb  7 01:02:09 2017 us=989033   log = ENABLED
Tue Feb  7 01:02:09 2017 us=989042   suppress_timestamps = DISABLED
Tue Feb  7 01:02:09 2017 us=989051   machine_readable_output = DISABLED
Tue Feb  7 01:02:09 2017 us=989061   nice = 0
Tue Feb  7 01:02:09 2017 us=989070   verbosity = 4
Tue Feb  7 01:02:09 2017 us=989079   mute = 0
Tue Feb  7 01:02:09 2017 us=989088   gremlin = 0
Tue Feb  7 01:02:09 2017 us=989097   status_file = '/etc/openvpn/openvpn-status.log'
Tue Feb  7 01:02:09 2017 us=989106   status_file_version = 1
Tue Feb  7 01:02:09 2017 us=989116   status_file_update_freq = 10
Tue Feb  7 01:02:09 2017 us=989125   occ = ENABLED
Tue Feb  7 01:02:09 2017 us=989134   rcvbuf = 0
Tue Feb  7 01:02:09 2017 us=989143   sndbuf = 0
Tue Feb  7 01:02:09 2017 us=989152   mark = 0
Tue Feb  7 01:02:09 2017 us=989161   sockflags = 0
Tue Feb  7 01:02:09 2017 us=989170   fast_io = DISABLED
Tue Feb  7 01:02:09 2017 us=989179   comp.alg = 2
Tue Feb  7 01:02:09 2017 us=989188   comp.flags = 0
Tue Feb  7 01:02:09 2017 us=989198   route_script = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=989207   route_default_gateway = '172.16.0.2'
Tue Feb  7 01:02:09 2017 us=989216   route_default_metric = 0
Tue Feb  7 01:02:09 2017 us=989225   route_noexec = DISABLED
Tue Feb  7 01:02:09 2017 us=989235   route_delay = 0
Tue Feb  7 01:02:09 2017 us=989244   route_delay_window = 30
Tue Feb  7 01:02:09 2017 us=989253   route_delay_defined = DISABLED
Tue Feb  7 01:02:09 2017 us=989263   route_nopull = DISABLED
Tue Feb  7 01:02:09 2017 us=989272   route_gateway_via_dhcp = DISABLED
Tue Feb  7 01:02:09 2017 us=989281   allow_pull_fqdn = DISABLED
Tue Feb  7 01:02:09 2017 us=989291   route 192.168.1.0/255.255.255.0/default (not set)/default (not set)
Tue Feb  7 01:02:09 2017 us=989300   management_addr = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=989310   management_port = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=989323   management_user_pass = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=989333   management_log_history_cache = 250
Tue Feb  7 01:02:09 2017 us=989343   management_echo_buffer_size = 100
Tue Feb  7 01:02:09 2017 us=989353   management_write_peer_info_file = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=989362   management_client_user = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=989372   management_client_group = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=989381   management_flags = 0
Tue Feb  7 01:02:09 2017 us=989391   shared_secret_file = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=989401   key_direction = 0
Tue Feb  7 01:02:09 2017 us=989410   ciphername = 'AES-256-CBC'
Tue Feb  7 01:02:09 2017 us=989420   ncp_enabled = ENABLED
Tue Feb  7 01:02:09 2017 us=989430   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
Tue Feb  7 01:02:09 2017 us=989439   authname = 'SHA1'
Tue Feb  7 01:02:09 2017 us=989449   prng_hash = 'SHA1'
Tue Feb  7 01:02:09 2017 us=989462   prng_nonce_secret_len = 16
Tue Feb  7 01:02:09 2017 us=989471   keysize = 0
Tue Feb  7 01:02:09 2017 us=989480   engine = DISABLED
Tue Feb  7 01:02:09 2017 us=989489   replay = ENABLED
Tue Feb  7 01:02:09 2017 us=989498   mute_replay_warnings = DISABLED
Tue Feb  7 01:02:09 2017 us=989507   replay_window = 64
Tue Feb  7 01:02:09 2017 us=989516   replay_time = 15
Tue Feb  7 01:02:09 2017 us=989525   packet_id_file = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=989534   use_iv = ENABLED
Tue Feb  7 01:02:09 2017 us=989543   test_crypto = DISABLED
Tue Feb  7 01:02:09 2017 us=989560   tls_server = ENABLED
Tue Feb  7 01:02:09 2017 us=989569   tls_client = DISABLED
Tue Feb  7 01:02:09 2017 us=989579   key_method = 2
Tue Feb  7 01:02:09 2017 us=989588   ca_file = '/etc/openvpn/ca.crt'
Tue Feb  7 01:02:09 2017 us=989597   ca_path = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=989610   dh_file = '/etc/openvpn/dh2048.pem'
Tue Feb  7 01:02:09 2017 us=989620   cert_file = '/etc/openvpn/server.crt'
Tue Feb  7 01:02:09 2017 us=989629   extra_certs_file = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=989639   priv_key_file = '/etc/openvpn/server.key'
Tue Feb  7 01:02:09 2017 us=989649   pkcs12_file = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=989659   cipher_list = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=989668   tls_verify = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=989681   tls_export_cert = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=989690   verify_x509_type = 0
Tue Feb  7 01:02:09 2017 us=989699   verify_x509_name = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=989708   crl_file = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=989717   ns_cert_type = 0
Tue Feb  7 01:02:09 2017 us=989726   remote_cert_ku[i] = 0
Tue Feb  7 01:02:09 2017 us=989735   remote_cert_ku[i] = 0
Tue Feb  7 01:02:09 2017 us=989744   remote_cert_ku[i] = 0
Tue Feb  7 01:02:09 2017 us=989753   remote_cert_ku[i] = 0
Tue Feb  7 01:02:09 2017 us=989762   remote_cert_ku[i] = 0
Tue Feb  7 01:02:09 2017 us=989771   remote_cert_ku[i] = 0
Tue Feb  7 01:02:09 2017 us=989780   remote_cert_ku[i] = 0
Tue Feb  7 01:02:09 2017 us=989788   remote_cert_ku[i] = 0
Tue Feb  7 01:02:09 2017 us=989797   remote_cert_ku[i] = 0
Tue Feb  7 01:02:09 2017 us=989806   remote_cert_ku[i] = 0
Tue Feb  7 01:02:09 2017 us=989815   remote_cert_ku[i] = 0
Tue Feb  7 01:02:09 2017 us=989824   remote_cert_ku[i] = 0
Tue Feb  7 01:02:09 2017 us=989833   remote_cert_ku[i] = 0
Tue Feb  7 01:02:09 2017 us=989842   remote_cert_ku[i] = 0
Tue Feb  7 01:02:09 2017 us=989851   remote_cert_ku[i] = 0
Tue Feb  7 01:02:09 2017 us=989860   remote_cert_ku[i] = 0
Tue Feb  7 01:02:09 2017 us=989869   remote_cert_eku = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=989878   ssl_flags = 0
Tue Feb  7 01:02:09 2017 us=989887   tls_timeout = 2
Tue Feb  7 01:02:09 2017 us=989896   renegotiate_bytes = -1
Tue Feb  7 01:02:09 2017 us=989905   renegotiate_packets = 0
Tue Feb  7 01:02:09 2017 us=989914   renegotiate_seconds = 3600
Tue Feb  7 01:02:09 2017 us=989923   handshake_window = 60
Tue Feb  7 01:02:09 2017 us=989932   transition_window = 3600
Tue Feb  7 01:02:09 2017 us=989942   single_session = DISABLED
Tue Feb  7 01:02:09 2017 us=989951   push_peer_info = DISABLED
Tue Feb  7 01:02:09 2017 us=989960   tls_exit = DISABLED
Tue Feb  7 01:02:09 2017 us=989969   tls_auth_file = '/etc/openvpn/ta.key'
Tue Feb  7 01:02:09 2017 us=989978   tls_crypt_file = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=989989   server_network = 172.16.0.0
Tue Feb  7 01:02:09 2017 us=989999   server_netmask = 255.255.255.0
Tue Feb  7 01:02:09 2017 us=990011   server_network_ipv6 = ::
Tue Feb  7 01:02:09 2017 us=990021   server_netbits_ipv6 = 0
Tue Feb  7 01:02:09 2017 us=990031   server_bridge_ip = 0.0.0.0
Tue Feb  7 01:02:09 2017 us=990047   server_bridge_netmask = 0.0.0.0
Tue Feb  7 01:02:09 2017 us=990058   server_bridge_pool_start = 0.0.0.0
Tue Feb  7 01:02:09 2017 us=990068   server_bridge_pool_end = 0.0.0.0
Tue Feb  7 01:02:09 2017 us=990077   push_entry = 'route 192.168.1.0 255.255.255.0'
Tue Feb  7 01:02:09 2017 us=990086   push_entry = 'dhcp-option DNS 208.67.222.222'
Tue Feb  7 01:02:09 2017 us=990096   push_entry = 'dhcp-option DNS 208.67.220.220'
Tue Feb  7 01:02:09 2017 us=990105   push_entry = 'topology subnet'
Tue Feb  7 01:02:09 2017 us=990114   push_entry = 'route-gateway 172.16.0.1'
Tue Feb  7 01:02:09 2017 us=990123   push_entry = 'topology subnet'
Tue Feb  7 01:02:09 2017 us=990132   push_entry = 'ping 10'
Tue Feb  7 01:02:09 2017 us=990142   push_entry = 'ping-restart 120'
Tue Feb  7 01:02:09 2017 us=990151   ifconfig_pool_defined = ENABLED
Tue Feb  7 01:02:09 2017 us=990161   ifconfig_pool_start = 172.16.0.2
Tue Feb  7 01:02:09 2017 us=990176   ifconfig_pool_end = 172.16.0.253
Tue Feb  7 01:02:09 2017 us=990186   ifconfig_pool_netmask = 255.255.255.0
Tue Feb  7 01:02:09 2017 us=990196   ifconfig_pool_persist_filename = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=990205   ifconfig_pool_persist_refresh_freq = 600
Tue Feb  7 01:02:09 2017 us=990214   ifconfig_ipv6_pool_defined = DISABLED
Tue Feb  7 01:02:09 2017 us=990224   ifconfig_ipv6_pool_base = ::
Tue Feb  7 01:02:09 2017 us=990233   ifconfig_ipv6_pool_netbits = 0
Tue Feb  7 01:02:09 2017 us=990243   n_bcast_buf = 256
Tue Feb  7 01:02:09 2017 us=990252   tcp_queue_limit = 64
Tue Feb  7 01:02:09 2017 us=990261   real_hash_size = 256
Tue Feb  7 01:02:09 2017 us=990270   virtual_hash_size = 256
Tue Feb  7 01:02:09 2017 us=990279   client_connect_script = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=990289   learn_address_script = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=990298   client_disconnect_script = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=990307   client_config_dir = '/etc/openvpn/ccd'
Tue Feb  7 01:02:09 2017 us=990316   ccd_exclusive = DISABLED
Tue Feb  7 01:02:09 2017 us=990325   tmp_dir = '/tmp'
Tue Feb  7 01:02:09 2017 us=990334   push_ifconfig_defined = DISABLED
Tue Feb  7 01:02:09 2017 us=990345   push_ifconfig_local = 0.0.0.0
Tue Feb  7 01:02:09 2017 us=990354   push_ifconfig_remote_netmask = 0.0.0.0
Tue Feb  7 01:02:09 2017 us=990364   push_ifconfig_ipv6_defined = DISABLED
Tue Feb  7 01:02:09 2017 us=990373   push_ifconfig_ipv6_local = ::/0
Tue Feb  7 01:02:09 2017 us=990383   push_ifconfig_ipv6_remote = ::
Tue Feb  7 01:02:09 2017 us=990392   enable_c2c = DISABLED
Tue Feb  7 01:02:09 2017 us=990402   duplicate_cn = DISABLED
Tue Feb  7 01:02:09 2017 us=990411   cf_max = 0
Tue Feb  7 01:02:09 2017 us=990420   cf_per = 0
Tue Feb  7 01:02:09 2017 us=990429   max_clients = 1024
Tue Feb  7 01:02:09 2017 us=990439   max_routes_per_client = 256
Tue Feb  7 01:02:09 2017 us=990448   auth_user_pass_verify_script = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=990457   auth_user_pass_verify_script_via_file = DISABLED
Tue Feb  7 01:02:09 2017 us=990466   auth_token_generate = DISABLED
Tue Feb  7 01:02:09 2017 us=990475   auth_token_lifetime = 0
Tue Feb  7 01:02:09 2017 us=990485   port_share_host = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=990494   port_share_port = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=990503   client = DISABLED
Tue Feb  7 01:02:09 2017 us=990512   pull = DISABLED
Tue Feb  7 01:02:09 2017 us=990521   auth_user_pass_file = '[UNDEF]'
Tue Feb  7 01:02:09 2017 us=990531 OpenVPN 2.4.0 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Feb  6 2017
Tue Feb  7 01:02:09 2017 us=990552 library versions: OpenSSL 1.0.1t  3 May 2016, LZO 2.08
Tue Feb  7 01:02:09 2017 us=992374 Diffie-Hellman initialized with 2048 bit key
Tue Feb  7 01:02:09 2017 us=992931 Failed to extract curve from certificate (UNDEF), using secp384r1 instead.
Tue Feb  7 01:02:09 2017 us=992955 ECDH curve secp384r1 added
Tue Feb  7 01:02:09 2017 us=993107 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb  7 01:02:09 2017 us=993124 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb  7 01:02:09 2017 us=993138 TLS-Auth MTU parms [ L:1622 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Tue Feb  7 01:02:09 2017 us=993411 ROUTE_GATEWAY XXX.XXX.XXX.1/255.255.255.0 IFACE=eth0 HWADDR=e6:fe:a9:df:58:bc
Tue Feb  7 01:02:09 2017 us=993642 TUN/TAP device tun0 opened
Tue Feb  7 01:02:09 2017 us=993667 TUN/TAP TX queue length set to 100
Tue Feb  7 01:02:09 2017 us=993685 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Tue Feb  7 01:02:09 2017 us=993703 /sbin/ifconfig tun0 172.16.0.1 netmask 255.255.255.0 mtu 1500 broadcast 172.16.0.255
Tue Feb  7 01:02:10 2017 us=56482 /sbin/route add -net 192.168.1.0 netmask 255.255.255.0 gw 172.16.0.2
Tue Feb  7 01:02:10 2017 us=59094 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Tue Feb  7 01:02:10 2017 us=59924 Could not determine IPv4/IPv6 protocol. Using AF_INET
Tue Feb  7 01:02:10 2017 us=59990 Socket Buffers: R=[212992->212992] S=[212992->212992]
Tue Feb  7 01:02:10 2017 us=60024 UDPv4 link local (bound): [AF_INET][undef]:1194
Tue Feb  7 01:02:10 2017 us=60042 UDPv4 link remote: [AF_UNSPEC]
Tue Feb  7 01:02:10 2017 us=60062 GID set to nogroup
Tue Feb  7 01:02:10 2017 us=60086 UID set to nobody
Tue Feb  7 01:02:10 2017 us=60110 MULTI: multi_init called, r=256 v=256
Tue Feb  7 01:02:10 2017 us=60181 IFCONFIG POOL: base=172.16.0.2 size=252, ipv6=0
Tue Feb  7 01:02:10 2017 us=60252 Initialization Sequence Completed
Tue Feb  7 01:04:08 2017 us=137041 MULTI: multi_create_instance called
Tue Feb  7 01:04:08 2017 us=137185 94.254.227.198:19854 Re-using SSL/TLS context
Tue Feb  7 01:04:08 2017 us=137221 94.254.227.198:19854 LZO compression initializing
Tue Feb  7 01:04:08 2017 us=137493 94.254.227.198:19854 Control Channel MTU parms [ L:1622 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Tue Feb  7 01:04:08 2017 us=137520 94.254.227.198:19854 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Tue Feb  7 01:04:08 2017 us=137578 94.254.227.198:19854 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Tue Feb  7 01:04:08 2017 us=137598 94.254.227.198:19854 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Tue Feb  7 01:04:08 2017 us=137650 94.254.227.198:19854 TLS: Initial packet from [AF_INET]94.254.227.198:19854, sid=b38d0d80 84709d7a
Tue Feb  7 01:04:09 2017 us=624363 MULTI: multi_create_instance called
Tue Feb  7 01:04:09 2017 us=624449 77.114.12.156:59867 Re-using SSL/TLS context
Tue Feb  7 01:04:09 2017 us=624487 77.114.12.156:59867 LZO compression initializing
Tue Feb  7 01:04:09 2017 us=624711 77.114.12.156:59867 Control Channel MTU parms [ L:1622 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Tue Feb  7 01:04:09 2017 us=624737 77.114.12.156:59867 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Tue Feb  7 01:04:09 2017 us=624784 77.114.12.156:59867 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Tue Feb  7 01:04:09 2017 us=624802 77.114.12.156:59867 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Tue Feb  7 01:04:09 2017 us=624850 77.114.12.156:59867 TLS: Initial packet from [AF_INET]77.114.12.156:59867, sid=028cffa9 5e356ebc
Tue Feb  7 01:04:09 2017 us=830127 77.114.12.156:59867 VERIFY OK: depth=1, C=PL, ST=mazowieckie, L=Warsaw, O=Tomasz Lewandowski, OU=TomaszLewandowski, CN=Tomasz Lewandowski CA, name=server, emailAddress=tomasz.lewandowski@mail.com
Tue Feb  7 01:04:09 2017 us=830553 77.114.12.156:59867 VERIFY OK: depth=0, C=PL, ST=mazowieckie, L=Warsaw, O=Tomasz Lewandowski, OU=TomaszLewandowski, CN=tomek_itm, name=server, emailAddress=tomasz.lewandowski@mail.com
Tue Feb  7 01:04:09 2017 us=951399 77.114.12.156:59867 peer info: IV_VER=2.4.0
Tue Feb  7 01:04:09 2017 us=951466 77.114.12.156:59867 peer info: IV_PLAT=win
Tue Feb  7 01:04:09 2017 us=951485 77.114.12.156:59867 peer info: IV_PROTO=2
Tue Feb  7 01:04:09 2017 us=951502 77.114.12.156:59867 peer info: IV_NCP=2
Tue Feb  7 01:04:09 2017 us=951519 77.114.12.156:59867 peer info: IV_LZ4=1
Tue Feb  7 01:04:09 2017 us=951535 77.114.12.156:59867 peer info: IV_LZ4v2=1
Tue Feb  7 01:04:09 2017 us=951552 77.114.12.156:59867 peer info: IV_LZO=1
Tue Feb  7 01:04:09 2017 us=951569 77.114.12.156:59867 peer info: IV_COMP_STUB=1
Tue Feb  7 01:04:09 2017 us=951586 77.114.12.156:59867 peer info: IV_COMP_STUBv2=1
Tue Feb  7 01:04:09 2017 us=951603 77.114.12.156:59867 peer info: IV_TCPNL=1
Tue Feb  7 01:04:09 2017 us=951620 77.114.12.156:59867 peer info: IV_GUI_VER=OpenVPN_GUI_11
Tue Feb  7 01:04:10 2017 us=84360 77.114.12.156:59867 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Feb  7 01:04:10 2017 us=84478 77.114.12.156:59867 [tomek_itm] Peer Connection Initiated with [AF_INET]77.114.12.156:59867
Tue Feb  7 01:04:10 2017 us=84573 tomek_itm/77.114.12.156:59867 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/tomek_itm
Tue Feb  7 01:04:10 2017 us=84801 tomek_itm/77.114.12.156:59867 MULTI: Learn: 172.16.0.5 -> tomek_itm/77.114.12.156:59867
Tue Feb  7 01:04:10 2017 us=84827 tomek_itm/77.114.12.156:59867 MULTI: primary virtual IP for tomek_itm/77.114.12.156:59867: 172.16.0.5
Tue Feb  7 01:04:10 2017 us=84847 tomek_itm/77.114.12.156:59867 MULTI: internal route 192.168.1.0/24 -> tomek_itm/77.114.12.156:59867
Tue Feb  7 01:04:10 2017 us=84869 tomek_itm/77.114.12.156:59867 MULTI: Learn: 192.168.1.0/24 -> tomek_itm/77.114.12.156:59867
Tue Feb  7 01:04:10 2017 us=84889 tomek_itm/77.114.12.156:59867 REMOVE PUSH ROUTE: 'route 192.168.1.0 255.255.255.0'
Tue Feb  7 01:04:11 2017 us=94447 tomek_itm/77.114.12.156:59867 PUSH: Received control message: 'PUSH_REQUEST'
Tue Feb  7 01:04:11 2017 us=94557 tomek_itm/77.114.12.156:59867 SENT CONTROL [tomek_itm]: 'PUSH_REPLY,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,topology subnet,route-gateway 172.16.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 172.16.0.5 255.255.255.0,peer-id 1,cipher AES-256-GCM' (status=1)
Tue Feb  7 01:04:11 2017 us=94592 tomek_itm/77.114.12.156:59867 Data Channel MTU parms [ L:1550 D:1450 EF:50 EB:406 ET:0 EL:3 ]
Tue Feb  7 01:04:11 2017 us=94787 tomek_itm/77.114.12.156:59867 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Feb  7 01:04:11 2017 us=94825 tomek_itm/77.114.12.156:59867 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Feb  7 01:04:19 2017 us=210784 94.254.227.198:19854 VERIFY OK: depth=1, C=PL, ST=mazowieckie, L=Warsaw, O=Tomasz Lewandowski, OU=TomaszLewandowski, CN=Tomasz Lewandowski CA, name=server, emailAddress=tomasz.lewandowski@mail.com
Tue Feb  7 01:04:19 2017 us=211232 94.254.227.198:19854 VERIFY OK: depth=0, C=PL, ST=mazowieckie, L=Warsaw, O=Tomasz Lewandowski, OU=TomaszLewandowski, CN=tomek_wrt160nl, name=server, emailAddress=tomasz.lewandowski@mail.com
Tue Feb  7 01:04:19 2017 us=258023 94.254.227.198:19854 peer info: IV_VER=2.3.6
Tue Feb  7 01:04:19 2017 us=258091 94.254.227.198:19854 peer info: IV_PLAT=linux
Tue Feb  7 01:04:19 2017 us=258110 94.254.227.198:19854 peer info: IV_PROTO=2
Tue Feb  7 01:04:19 2017 us=258129 94.254.227.198:19854 NOTE: Options consistency check may be skewed by version differences
Tue Feb  7 01:04:19 2017 us=258154 94.254.227.198:19854 WARNING: 'version' is used inconsistently, local='version V4', remote='version V0 UNDEF'
Tue Feb  7 01:04:19 2017 us=258174 94.254.227.198:19854 WARNING: 'dev-type' is present in local config but missing in remote config, local='dev-type tun'
Tue Feb  7 01:04:19 2017 us=258192 94.254.227.198:19854 WARNING: 'link-mtu' is present in local config but missing in remote config, local='link-mtu 1558'
Tue Feb  7 01:04:19 2017 us=258210 94.254.227.198:19854 WARNING: 'tun-mtu' is present in local config but missing in remote config, local='tun-mtu 1500'
Tue Feb  7 01:04:19 2017 us=258228 94.254.227.198:19854 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Tue Feb  7 01:04:19 2017 us=258246 94.254.227.198:19854 WARNING: 'cipher' is present in local config but missing in remote config, local='cipher AES-256-CBC'
Tue Feb  7 01:04:19 2017 us=258264 94.254.227.198:19854 WARNING: 'auth' is present in local config but missing in remote config, local='auth SHA1'
Tue Feb  7 01:04:19 2017 us=258320 94.254.227.198:19854 WARNING: 'keysize' is present in local config but missing in remote config, local='keysize 256'
Tue Feb  7 01:04:19 2017 us=258358 94.254.227.198:19854 WARNING: 'tls-auth' is present in local config but missing in remote config, local='tls-auth'
Tue Feb  7 01:04:19 2017 us=258388 94.254.227.198:19854 WARNING: 'key-method' is present in local config but missing in remote config, local='key-method 2'
Tue Feb  7 01:04:19 2017 us=258440 94.254.227.198:19854 WARNING: 'tls-client' is present in local config but missing in remote config, local='tls-client'
Tue Feb  7 01:04:19 2017 us=258648 94.254.227.198:19854 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Feb  7 01:04:19 2017 us=258690 94.254.227.198:19854 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb  7 01:04:19 2017 us=258719 94.254.227.198:19854 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Feb  7 01:04:19 2017 us=258750 94.254.227.198:19854 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb  7 01:04:19 2017 us=302192 94.254.227.198:19854 Control Channel: TLSv1, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-SHA, 2048 bit RSA
Tue Feb  7 01:04:19 2017 us=302271 94.254.227.198:19854 [tomek_wrt160nl] Peer Connection Initiated with [AF_INET]94.254.227.198:19854
Tue Feb  7 01:04:19 2017 us=302340 tomek_wrt160nl/94.254.227.198:19854 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/tomek_wrt160nl
Tue Feb  7 01:04:19 2017 us=302464 tomek_wrt160nl/94.254.227.198:19854 MULTI_sva: pool returned IPv4=172.16.0.2, IPv6=(Not enabled)
Tue Feb  7 01:04:19 2017 us=302532 tomek_wrt160nl/94.254.227.198:19854 MULTI: Learn: 172.16.0.2 -> tomek_wrt160nl/94.254.227.198:19854
Tue Feb  7 01:04:19 2017 us=302553 tomek_wrt160nl/94.254.227.198:19854 MULTI: primary virtual IP for tomek_wrt160nl/94.254.227.198:19854: 172.16.0.2
Tue Feb  7 01:04:19 2017 us=302572 tomek_wrt160nl/94.254.227.198:19854 MULTI: internal route 192.168.1.0/24 -> tomek_wrt160nl/94.254.227.198:19854
Tue Feb  7 01:04:19 2017 us=302594 tomek_wrt160nl/94.254.227.198:19854 MULTI: Learn: 192.168.1.0/24 -> tomek_wrt160nl/94.254.227.198:19854
Tue Feb  7 01:04:19 2017 us=302614 tomek_wrt160nl/94.254.227.198:19854 REMOVE PUSH ROUTE: 'route 192.168.1.0 255.255.255.0'
Tue Feb  7 01:04:21 2017 us=442313 tomek_wrt160nl/94.254.227.198:19854 PUSH: Received control message: 'PUSH_REQUEST'
Tue Feb  7 01:04:21 2017 us=599149 tomek_wrt160nl/94.254.227.198:19854 SENT CONTROL [tomek_wrt160nl]: 'PUSH_REPLY,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,topology subnet,route-gateway 172.16.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 172.16.0.2 255.255.255.0,peer-id 0' (status=1)
Tue Feb  7 01:04:57 2017 us=616271 MULTI: Learn: 192.168.1.2 -> tomek_wrt160nl/94.254.227.198:19854
Tue Feb  7 01:06:44 2017 us=85495 MULTI: Learn: 192.168.1.2 -> tomek_wrt160nl/94.254.227.198:19854
Tue Feb  7 01:06:59 2017 us=186605 MULTI: multi_create_instance called
Tue Feb  7 01:06:59 2017 us=186713 94.254.227.101:45024 Re-using SSL/TLS context
Tue Feb  7 01:06:59 2017 us=186737 94.254.227.101:45024 LZO compression initializing
Tue Feb  7 01:06:59 2017 us=186943 94.254.227.101:45024 Control Channel MTU parms [ L:1622 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Tue Feb  7 01:06:59 2017 us=186970 94.254.227.101:45024 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Tue Feb  7 01:06:59 2017 us=187026 94.254.227.101:45024 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Tue Feb  7 01:06:59 2017 us=187045 94.254.227.101:45024 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Tue Feb  7 01:06:59 2017 us=187094 94.254.227.101:45024 TLS: Initial packet from [AF_INET]94.254.227.101:45024, sid=3234fead 049a5373
Tue Feb  7 01:06:59 2017 us=215260 94.254.227.101:45024 PID_ERR replay-window backtrack occurred [1] [TLS_WRAP-0] [0_0] 1486426019:3 1486426019:2 t=1486426019[0] r=[0,64,15,1,1] sl=[61,3,64,528]
Tue Feb  7 01:06:59 2017 us=385036 94.254.227.101:45024 VERIFY OK: depth=1, C=PL, ST=mazowieckie, L=Warsaw, O=Tomasz Lewandowski, OU=TomaszLewandowski, CN=Tomasz Lewandowski CA, name=server, emailAddress=tomasz.lewandowski@mail.com
Tue Feb  7 01:06:59 2017 us=385473 94.254.227.101:45024 VERIFY OK: depth=0, C=PL, ST=mazowieckie, L=Warsaw, O=Tomasz Lewandowski, OU=TomaszLewandowski, CN=tomek_sgcpt, name=server, emailAddress=tomasz.lewandowski@mail.com
Tue Feb  7 01:06:59 2017 us=412219 94.254.227.101:45024 peer info: IV_GUI_VER=net.openvpn.connect.android_1.1.17-76
Tue Feb  7 01:06:59 2017 us=412252 94.254.227.101:45024 peer info: IV_VER=3.0.12
Tue Feb  7 01:06:59 2017 us=412270 94.254.227.101:45024 peer info: IV_PLAT=android
Tue Feb  7 01:06:59 2017 us=412286 94.254.227.101:45024 peer info: IV_NCP=2
Tue Feb  7 01:06:59 2017 us=412303 94.254.227.101:45024 peer info: IV_TCPNL=1
Tue Feb  7 01:06:59 2017 us=412319 94.254.227.101:45024 peer info: IV_PROTO=2
Tue Feb  7 01:06:59 2017 us=412334 94.254.227.101:45024 peer info: IV_LZO=1
Tue Feb  7 01:06:59 2017 us=435478 94.254.227.101:45024 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Feb  7 01:06:59 2017 us=435526 94.254.227.101:45024 [tomek_sgcpt] Peer Connection Initiated with [AF_INET]94.254.227.101:45024
Tue Feb  7 01:06:59 2017 us=435590 tomek_sgcpt/94.254.227.101:45024 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/tomek_sgcpt
Tue Feb  7 01:06:59 2017 us=435756 tomek_sgcpt/94.254.227.101:45024 MULTI: Learn: 172.16.0.4 -> tomek_sgcpt/94.254.227.101:45024
Tue Feb  7 01:06:59 2017 us=435781 tomek_sgcpt/94.254.227.101:45024 MULTI: primary virtual IP for tomek_sgcpt/94.254.227.101:45024: 172.16.0.4
Tue Feb  7 01:06:59 2017 us=435801 tomek_sgcpt/94.254.227.101:45024 MULTI: internal route 192.168.1.0/24 -> tomek_sgcpt/94.254.227.101:45024
Tue Feb  7 01:06:59 2017 us=435823 tomek_sgcpt/94.254.227.101:45024 MULTI: Learn: 192.168.1.0/24 -> tomek_sgcpt/94.254.227.101:45024
Tue Feb  7 01:06:59 2017 us=435843 tomek_sgcpt/94.254.227.101:45024 REMOVE PUSH ROUTE: 'route 192.168.1.0 255.255.255.0'
Tue Feb  7 01:06:59 2017 us=435991 tomek_sgcpt/94.254.227.101:45024 PUSH: Received control message: 'PUSH_REQUEST'
Tue Feb  7 01:06:59 2017 us=436044 tomek_sgcpt/94.254.227.101:45024 SENT CONTROL [tomek_sgcpt]: 'PUSH_REPLY,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,topology subnet,route-gateway 172.16.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 172.16.0.4 255.255.255.0,peer-id 2,cipher AES-256-GCM' (status=1)
Tue Feb  7 01:06:59 2017 us=436074 tomek_sgcpt/94.254.227.101:45024 Data Channel MTU parms [ L:1550 D:1450 EF:50 EB:406 ET:0 EL:3 ]
Tue Feb  7 01:06:59 2017 us=436189 tomek_sgcpt/94.254.227.101:45024 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Feb  7 01:06:59 2017 us=436209 tomek_sgcpt/94.254.227.101:45024 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Feb  7 01:07:08 2017 us=229589 MULTI: Learn: 192.168.1.2 -> tomek_sgcpt/94.254.227.101:45024
Tue Feb  7 01:07:12 2017 us=220696 tomek_sgcpt/94.254.227.101:45024 SIGTERM[soft,remote-exit] received, client-instance exiting

client log

Tue Feb  7 00:59:59 2017 us=76510 OpenVPN 2.3.6 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jan  6 2015
Tue Feb  7 00:59:59 2017 us=82248 library versions: OpenSSL 1.0.2f  28 Jan 2016, LZO 2.08
Tue Feb  7 00:59:59 2017 us=100191 WARNING: file '/etc/openvpn/tomek_wrt160nl.key' is group or others accessible
Tue Feb  7 00:59:59 2017 us=110039 WARNING: file '/etc/openvpn/ta.key' is group or others accessible
Tue Feb  7 00:59:59 2017 us=122769 Control Channel Authentication: using '/etc/openvpn/ta.key' as a OpenVPN static key file
Tue Feb  7 00:59:59 2017 us=128405 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb  7 00:59:59 2017 us=143360 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb  7 00:59:59 2017 us=148774 LZO compression initialized
Tue Feb  7 00:59:59 2017 us=163807 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Feb  7 00:59:59 2017 us=169264 Socket Buffers: R=[163840->131072] S=[163840->131072]
Tue Feb  7 00:59:59 2017 us=182901 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Feb  7 00:59:59 2017 us=188448 UDPv4 link local (bound): [undef]
Tue Feb  7 00:59:59 2017 us=203474 UDPv4 link remote: [AF_INET]XXX.XXX.XXX.XXX:1194
Tue Feb  7 00:59:59 2017 us=237320 TLS: Initial packet from [AF_INET]XXX.XXX.XXX.XXX:1194, sid=029f6f66 60a09090
Tue Feb  7 00:59:59 2017 us=284950 VERIFY OK: depth=1, C=PL, ST=mazowieckie, L=Warsaw, O=Tomasz Lewandowski, OU=TomaszLewandowski, CN=Tomasz Lewandowski CA, name=server, emailAddress=tomasz.lewandowski@mail.com
Tue Feb  7 00:59:59 2017 us=313698 Validating certificate key usage
Tue Feb  7 00:59:59 2017 us=318779 ++ Certificate has key usage  00a0, expects 00a0
Tue Feb  7 00:59:59 2017 us=334474 VERIFY KU OK
Tue Feb  7 00:59:59 2017 us=339481 Validating certificate extended key usage
Tue Feb  7 00:59:59 2017 us=359509 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Feb  7 00:59:59 2017 us=364894 VERIFY EKU OK
Tue Feb  7 00:59:59 2017 us=369827 VERIFY OK: depth=0, C=PL, ST=mazowieckie, L=Warsaw, O=Tomasz Lewandowski, OU=TomaszLewandowski, CN=server, name=server, emailAddress=tomasz.lewandowski@mail.com
Tue Feb  7 01:00:04 2017 us=183447 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Feb  7 01:00:04 2017 us=188954 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb  7 01:00:04 2017 us=194232 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Feb  7 01:00:04 2017 us=199457 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb  7 01:00:04 2017 us=205431 Control Channel: TLSv1, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-SHA, 2048 bit RSA
Tue Feb  7 01:00:04 2017 us=211049 [server] Peer Connection Initiated with [AF_INET]XXX.XXX.XXX.XXX:1194
Tue Feb  7 01:00:06 2017 us=267138 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue Feb  7 01:00:06 2017 us=314597 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route-gateway 172.16.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 172.16.0.2 255.255.255.0,peer-id 0'
Tue Feb  7 01:00:06 2017 us=321858 OPTIONS IMPORT: timers and/or timeouts modified
Tue Feb  7 01:00:06 2017 us=327004 OPTIONS IMPORT: --ifconfig/up options modified
Tue Feb  7 01:00:06 2017 us=332111 OPTIONS IMPORT: route-related options modified
Tue Feb  7 01:00:06 2017 us=337132 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Feb  7 01:00:06 2017 us=342263 OPTIONS IMPORT: peer-id set
Tue Feb  7 01:00:06 2017 us=353639 TUN/TAP device tun0 opened
Tue Feb  7 01:00:06 2017 us=358776 TUN/TAP TX queue length set to 100
Tue Feb  7 01:00:06 2017 us=373747 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Feb  7 01:00:06 2017 us=379082 /sbin/ifconfig tun0 172.16.0.2 netmask 255.255.255.0 mtu 1500 broadcast 172.16.0.255
Tue Feb  7 01:00:06 2017 us=411189 Initialization Sequence Completed
Tue Feb  7 01:04:07 2017 us=352103 [server] Inactivity timeout (--ping-restart), restarting
Tue Feb  7 01:04:07 2017 us=360750 TCP/UDP: Closing socket
Tue Feb  7 01:04:07 2017 us=366128 Closing TUN/TAP interface
Tue Feb  7 01:04:07 2017 us=371232 /sbin/ifconfig tun0 0.0.0.0
Tue Feb  7 01:04:07 2017 us=402899 SIGUSR1[soft,ping-restart] received, process restarting
Tue Feb  7 01:04:07 2017 us=408118 Restart pause, 2 second(s)
Tue Feb  7 01:04:09 2017 us=427407 WARNING: file '/etc/openvpn/tomek_wrt160nl.key' is group or others accessible
Tue Feb  7 01:04:09 2017 us=436248 WARNING: file '/etc/openvpn/ta.key' is group or others accessible
Tue Feb  7 01:04:09 2017 us=441620 Control Channel Authentication: using '/etc/openvpn/ta.key' as a OpenVPN static key file
Tue Feb  7 01:04:09 2017 us=446969 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb  7 01:04:09 2017 us=452387 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb  7 01:04:09 2017 us=457949 LZO compression initialized
Tue Feb  7 01:04:09 2017 us=463804 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Feb  7 01:04:09 2017 us=469202 Socket Buffers: R=[163840->131072] S=[163840->131072]
Tue Feb  7 01:04:09 2017 us=474791 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Feb  7 01:04:09 2017 us=479931 UDPv4 link local (bound): [undef]
Tue Feb  7 01:04:09 2017 us=485133 UDPv4 link remote: [AF_INET]XXX.XXX.XXX.XXX:1194
Tue Feb  7 01:04:09 2017 us=515272 TLS: Initial packet from [AF_INET]XXX.XXX.XXX.XXX:1194, sid=ca9c3c61 b09b8fcc
Tue Feb  7 01:04:09 2017 us=564346 VERIFY OK: depth=1, C=PL, ST=mazowieckie, L=Warsaw, O=Tomasz Lewandowski, OU=TomaszLewandowski, CN=Tomasz Lewandowski CA, name=server, emailAddress=tomasz.lewandowski@mail.com
Tue Feb  7 01:04:09 2017 us=579357 Validating certificate key usage
Tue Feb  7 01:04:09 2017 us=584467 ++ Certificate has key usage  00a0, expects 00a0
Tue Feb  7 01:04:09 2017 us=589531 VERIFY KU OK
Tue Feb  7 01:04:09 2017 us=594531 Validating certificate extended key usage
Tue Feb  7 01:04:09 2017 us=599612 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Feb  7 01:04:09 2017 us=605254 VERIFY EKU OK
Tue Feb  7 01:04:09 2017 us=610134 VERIFY OK: depth=0, C=PL, ST=mazowieckie, L=Warsaw, O=Tomasz Lewandowski, OU=TomaszLewandowski, CN=server, name=server, emailAddress=tomasz.lewandowski@mail.com
Tue Feb  7 01:04:20 2017 us=637784 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Feb  7 01:04:20 2017 us=643392 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb  7 01:04:20 2017 us=648637 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Feb  7 01:04:20 2017 us=653925 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb  7 01:04:20 2017 us=659783 Control Channel: TLSv1, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-SHA, 2048 bit RSA
Tue Feb  7 01:04:20 2017 us=665458 [server] Peer Connection Initiated with [AF_INET]XXX.XXX.XXX.XXX:1194
Tue Feb  7 01:04:22 2017 us=789492 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue Feb  7 01:04:22 2017 us=978562 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,topology subnet,route-gateway 172.16.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 172.16.0.2 255.255.255.0,peer-id 0'
Tue Feb  7 01:04:22 2017 us=985985 OPTIONS IMPORT: timers and/or timeouts modified
Tue Feb  7 01:04:22 2017 us=991063 OPTIONS IMPORT: --ifconfig/up options modified
Tue Feb  7 01:04:22 2017 us=996177 OPTIONS IMPORT: route-related options modified
Tue Feb  7 01:04:23 2017 us=1164 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Feb  7 01:04:23 2017 us=6344 OPTIONS IMPORT: peer-id set
Tue Feb  7 01:04:23 2017 us=23761 TUN/TAP device tun0 opened
Tue Feb  7 01:04:23 2017 us=28907 TUN/TAP TX queue length set to 100
Tue Feb  7 01:04:23 2017 us=112793 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Feb  7 01:04:23 2017 us=118390 /sbin/ifconfig tun0 172.16.0.2 netmask 255.255.255.0 mtu 1500 broadcast 172.16.0.255
Tue Feb  7 01:04:23 2017 us=160975 Initialization Sequence Completed

telewy

Small update. I noticed that my /etc/openvpn/tomek_sgcpt looked like:

ifconfig-push 172.16.0.4 255.255.255.0
iroute 192.168.1.0 255.255.255.0

After changing it to

ifconfig-push 172.16.0.4 255.255.255.0

connection to my lan is alive after connecting from tomek_sgcpt. Looks that problem is solved. Thanks a lot

TinCanTech

Before you worry about any other configuration .. I strongly advise you to not use 192.168.1.0/24 on any of the networks you control. If you connect from a remote location which also uses the same subnet then you will not be able to connect to your client LAN. Use something like 192.168.149.0/24 instead ..

Then work through the HOWTO again. (Practice makes perfect, or at least better)

telewy

TinCanTech wroteBefore you worry about any other configuration .. I strongly advise you to not use 192.168.1.0/24 on any of the networks you control. If you connect from a remote location which also uses the same subnet then you will not be able to connect to your client LAN. Use something like 192.168.149.0/24 instead ..

Thanks for this advise, wasn't aware about it, I will do it asap.

TinCanTech wrote Then work through the HOWTO again. (Practice makes perfect, or at least better)

You are right, I always say "Have patience. All things are difficult before they become easy." 🙂

Cheers