Apologies if this is not the right part of the forums. With only three obvious options the pickings are slim. So I am running Fedora 25, OpenVPN and connecting to the OpenVPN server package in pfSense at work. Windows clients work perfectly, better than perfectly.. they work amazingly. Linux however, has issues. I want to preface this with the fact that I know nothing about Linux and Openvpn until two days ago. The configs are copied from the working Windows side. Below is my config: dev tun persist-tun persist-key cipher CAMELLIA-256-CBC auth RSA-SHA224 tls-client client resolv-retry infinite remote xx.xxx.xx.xx 34448 udp auth-user-pass ca gntc-fw-1-udp-34448-ca.crt tls-auth gntc-fw-1-udp-34448-tls.key 1 ns-cert-type server comp-lzo adaptive Im about to reboot into windows and Ill grab the screenshots of the pfSesne Openvpn config. Here's from my Fedora side, 10.0.20.1 is my works internal subnet, 10.0.40 is the vpn subnet. ➜ ~ ping 10.0.20.1 PING 10.0.20.1 (10.0.20.1) 56(84) bytes of data. ^C --- 10.0.20.1 ping statistics --- 83 packets transmitted, 0 received, 100% packet loss, time 83974ms ➜ ~ route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default gateway 0.0.0.0 UG 50 0 0 tun0 default gateway 0.0.0.0 UG 600 0 0 wlp2s0 10.0.20.0 gateway 255.255.255.0 UG 50 0 0 tun0 10.0.40.0 0.0.0.0 255.255.255.0 U 50 0 0 tun0 gntc-fw-1 gateway 255.255.255.255 UGH 600 0 0 wlp2s0 192.168.15.0 0.0.0.0 255.255.255.0 U 600 0 0 wlp2s0 gateway 0.0.0.0 255.255.255.255 UH 600 0 0 wlp2s0 192.168.100.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr0 ➜ ~ ifconfig brwifi: flags=4099 mtu 1500 ether aa:ce:8b:6e:18:a1 txqueuelen 1000 (Ethernet) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 0 bytes 0 (0.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 enp0s20f0u1u3i5: flags=4163 mtu 1500 ether 9c:eb:e8:41:2c:e8 txqueuelen 1000 (Ethernet) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 0 bytes 0 (0.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 lo: flags=73 mtu 65536 inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10 loop txqueuelen 1 (Local Loopback) RX packets 2013 bytes 157752 (154.0 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 2013 bytes 157752 (154.0 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 tun0: flags=4305 mtu 1500 inet 10.0.40.2 netmask 255.255.255.0 destination 10.0.40.2 inet6 fe80::1485:fb75:7a5d:1f5 prefixlen 64 scopeid 0x20 unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 490 bytes 37448 (36.5 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 virbr0: flags=4099 mtu 1500 inet 192.168.100.1 netmask 255.255.255.0 broadcast 192.168.100.255 ether 52:54:00:36:8f:26 txqueuelen 1000 (Ethernet) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 0 bytes 0 (0.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 wlp2s0: flags=4163 mtu 1500 inet 192.168.15.177 netmask 255.255.255.0 broadcast 192.168.15.255 inet6 fe80::ba60:23ff:ec7:280d prefixlen 64 scopeid 0x20 ether 9c:b6:d0:0f:3a:77 txqueuelen 1000 (Ethernet) RX packets 48571 bytes 71228018 (67.9 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 26949 bytes 2479194 (2.3 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 ➜ ~ And the routing table before connection: ➜ ~ route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default Barrier.jinxed. 0.0.0.0 UG 600 0 0 wlp2s0 192.168.15.0 0.0.0.0 255.255.255.0 U 600 0 0 wlp2s0 192.168.100.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr0 ➜ ~ I am unable to ping the vpn gateway, works own internet gateway, or even googles public dns servers. nothing. I don;t have access to SSH into pf so here's it's config in a short series of screenshots, hopping this is ok here: http://imgur.com/gallery/ZJXy4

Oh and the OpenVPN package info: OpenVPN 2.3.11 i386-portbld-freebsd10.3 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Jul 19 2016

Check your logs as per: [url=https://forums.openvpn.net/viewtopic.php?f=30&t=22603]HOWTO: Request Help ![/url]

Below is the pfSense logs from a connection I did a few minutes ago: Feb 28 05:52:45openvpn13095MANAGEMENT: Client disconnected Feb 28 05:52:45openvpn13095MANAGEMENT: CMD 'status 2' Feb 28 05:52:45openvpn13095MANAGEMENT: Client connected from /var/etc/openvpn/server2.sock Feb 28 05:52:35openvpn13095MANAGEMENT: Client disconnected Feb 28 05:52:35openvpn13095MANAGEMENT: CMD 'status 2' Feb 28 05:52:35openvpn13095MANAGEMENT: Client connected from /var/etc/openvpn/server2.sock Feb 28 05:52:30openvpn13095bhart/69.xx.xx.xx:30140 SENT CONTROL [bhart]: 'PUSH_REPLY,route 10.0.20.0 255.255.255.0,dhcp-option DOMAIN gntc.egovmt.com,dhcp-option DNS 10.0.20.19,dhcp-option DNS 10.0.20.20,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,register-dns,route-gateway 10.0.40.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.0.40.2 255.255.255.0' (status=1) Feb 28 05:52:30openvpn13095bhart/69.xx.xx.xx:30140 send_push_reply(): safe_cap=940 Feb 28 05:52:30openvpn13095bhart/69.xx.xx.xx:30140 PUSH: Received control message: 'PUSH_REQUEST' Feb 28 05:52:27openvpn13095bhart/69.xx.xx.xx:30140 MULTI: primary virtual IP for bhart/69.xx.xx.xx:30140: 10.0.40.2 Feb 28 05:52:27openvpn13095bhart/69.xx.xx.xx:30140 MULTI: Learn: 10.0.40.2 -> bhart/69.xx.xx.xx:30140 Feb 28 05:52:27openvpn13095bhart/69.xx.xx.xx:30140 OPTIONS IMPORT: reading client specific options from: /tmp/openvpn_cc_e3aba4e3a225ef5c5c399b8f0cc6d01b.tmp Feb 28 05:52:27openvpn13095bhart/69.xx.xx.xx:30140 MULTI_sva: pool returned IPv4=10.0.40.2, IPv6=(Not enabled) Feb 28 05:52:27openvpn1309569.xx.xx.xx:30140 [bhart] Peer Connection Initiated with [AF_INET]69.xx.xx.xx:30140 Feb 28 05:52:27openvpn1309569.xx.xx.xx:30140 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384 Feb 28 05:52:27openvpn1309569.xx.xx.xx:30140 Data Channel Decrypt: Using 224 bit message hash 'SHA224' for HMAC authentication Feb 28 05:52:27openvpn1309569.xx.xx.xx:30140 Data Channel Decrypt: Cipher 'CAMELLIA-256-CBC' initialized with 256 bit key Feb 28 05:52:27openvpn1309569.xx.xx.xx:30140 Data Channel Encrypt: Using 224 bit message hash 'SHA224' for HMAC authentication Feb 28 05:52:27openvpn1309569.xx.xx.xx:30140 Data Channel Encrypt: Cipher 'CAMELLIA-256-CBC' initialized with 256 bit key Feb 28 05:52:27openvpn1309569.xx.xx.xx:30140 TLS: Username/Password authentication succeeded for username 'bhart' [CN SET] Feb 28 05:52:27openvpnuser 'bhart' authenticated Feb 28 05:52:27openvpn1309569.xx.xx.xx:30140 TLS: Initial packet from [AF_INET]69.xx.xx.xx:30140, sid=4dbfbe1e 74b238c2 Feb 28 05:52:27openvpn1309569.xx.xx.xx:30140 Expected Remote Options hash (VER=V4): 'af0e084a' Feb 28 05:52:27openvpn1309569.xx.xx.xx:30140 Local Options hash (VER=V4): 'ee0248bc' Feb 28 05:52:27openvpn1309569.xx.xx.xx:30140 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1566,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher CAMELLIA-256-CBC,auth SHA224,keysize 256,tls-auth,key-method 2,tls-client' Feb 28 05:52:27openvpn1309569.xx.xx.xx:30140 Local Options String: 'V4,dev-type tun,link-mtu 1566,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher CAMELLIA-256-CBC,auth SHA224,keysize 256,tls-auth,key-method 2,tls-server' Feb 28 05:52:27openvpn1309569.xx.xx.xx:30140 Data Channel MTU parms [ L:1566 D:1450 EF:66 EB:143 ET:0 EL:3 AF:3/1 ] Feb 28 05:52:27openvpn1309569.xx.xx.xx:30140 Control Channel MTU parms [ L:1566 D:1176 EF:74 EB:0 ET:0 EL:3 ] Feb 28 05:52:27openvpn1309569.xx.xx.xx:30140 LZO compression initialized Feb 28 05:52:27openvpn1309569.xx.xx.xx:30140 Re-using SSL/TLS context Feb 28 05:52:27openvpn13095MULTI: multi_create_instance called Feb 28 05:52:15openvpn13095MANAGEMENT: Client connected from /var/etc/openvpn/server2.sock Feb 28 05:52:08openvpn11213bhart/69.xx.xx.xx:4845 [bhart] Inactivity timeout (--ping-restart), restarting Feb 28 05:52:05openvpn13095MANAGEMENT: Client disconnected Feb 28 05:48:10openvpn13095MANAGEMENT: Client connected from /var/etc/openvpn/server2.sock Feb 28 05:48:06openvpn11213bhart/69.xx.xx.xx:4845 send_push_reply(): safe_cap=940 Feb 28 05:48:05openvpn11213bhart/69.xx.xx.xx:4845 MULTI_sva: pool returned IPv4=10.0.40.2, IPv6=(Not enabled) Feb 28 05:48:05openvpn1121369.xx.xx.xx:4845 [bhart] Peer Connection Initiated with [AF_INET]69.xx.xx.xx:4845 Feb 28 05:48:05openvpn1121369.xx.xx.xx:4845 WARNING: cipher with small block size in use, reducing reneg-bytes to 64MB to mitigate SWEET32 attacks. Feb 28 05:48:05openvpn1121369.xx.xx.xx:4845 WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC). Feb 28 05:48:05openvpn1121369.xx.xx.xx:4845 WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC). Feb 28 05:48:05openvpnuser 'bhart' authenticated

Client logs only found in /var/log/messages: Feb 28 06:39:06 localhost NetworkManager[1276]: [1488289146.2387] audit: op="connection-activate" uuid="e1630f07-daa2-4654-9b99-0daa7616334e" name="GNTC VPN" pid=3113 uid=1000 result="success" Feb 28 06:39:06 localhost NetworkManager[1276]: [1488289146.2415] vpn-connection[0x5635ff542340,e1630f07-daa2-4654-9b99-0daa7616334e,"GNTC VPN",0]: Started the VPN service, PID 3320 Feb 28 06:39:06 localhost NetworkManager[1276]: [1488289146.2485] vpn-connection[0x5635ff542340,e1630f07-daa2-4654-9b99-0daa7616334e,"GNTC VPN",0]: Saw the service appear; activating connection Feb 28 06:39:06 localhost kdeinit5: plasma-nm: Unhandled VPN connection state change: 2 Feb 28 06:39:06 localhost kdeinit5: plasma-nm: Unhandled VPN connection state change: 3 Feb 28 06:39:06 localhost NetworkManager[1276]: [1488289146.2744] vpn-connection[0x5635ff542340,e1630f07-daa2-4654-9b99-0daa7616334e,"GNTC VPN",0]: VPN plugin: state changed: starting (3) Feb 28 06:39:06 localhost nm-openvpn[3325]: OpenVPN 2.3.14 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Dec 7 2016 Feb 28 06:39:06 localhost nm-openvpn[3325]: library versions: OpenSSL 1.0.2k-fips 26 Jan 2017, LZO 2.08 Feb 28 06:39:06 localhost nm-openvpn[3325]: WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info. Feb 28 06:39:06 localhost nm-openvpn[3325]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts Feb 28 06:39:06 localhost nm-openvpn[3325]: WARNING: file '/home/bhart/openvpn/gntc-fw-1-udp-34448-tls.key' is group or others accessible Feb 28 06:39:06 localhost nm-openvpn[3325]: Control Channel Authentication: using '/home/bhart/openvpn/gntc-fw-1-udp-34448-tls.key' as a OpenVPN static key file Feb 28 06:39:06 localhost nm-openvpn[3325]: NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay Feb 28 06:39:06 localhost nm-openvpn[3325]: UDPv4 link local: [undef] Feb 28 06:39:06 localhost nm-openvpn[3325]: UDPv4 link remote: [AF_INET]72.174.xxx.xxx:34448 Feb 28 06:39:07 localhost nm-openvpn[3325]: [gntc-vpn-1] Peer Connection Initiated with [AF_INET]72.174.xxx.xxx:34448 Feb 28 06:39:10 localhost nm-openvpn[3325]: Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:5: register-dns (2.3.14) Feb 28 06:39:10 localhost nm-openvpn[3325]: TUN/TAP device tun0 opened Feb 28 06:39:10 localhost nm-openvpn[3325]: /usr/libexec/nm-openvpn-service-openvpn-helper --debug 0 3320 --bus-name org.freedesktop.NetworkManager.openvpn.Connection_8 --tun -- tun0 1500 1566 10.0.40.3 255.255.255.0 init Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0188] manager: (tun0): new Tun device (/org/freedesktop/NetworkManager/Devices/9) Feb 28 06:39:10 localhost org_kde_powerdevil: networkmanager-qt: void NetworkManager::NetworkManagerPrivate::propertiesChanged(const QVariantMap&) Unhandled property "AllDevices" Feb 28 06:39:10 localhost org_kde_powerdevil: networkmanager-qt: void NetworkManager::NetworkManagerPrivate::propertiesChanged(const QVariantMap&) Unhandled property "Devices" Feb 28 06:39:10 localhost baloo_file: QObject::connect: invalid null parameter Feb 28 06:39:10 localhost kde5-nm-connection-editor: networkmanager-qt: virtual void NetworkManager::DevicePrivate::propertyChanged(const QString&, const QVariant&) Unhandled property "LldpNeighbors" Feb 28 06:39:10 localhost kde5-nm-connection-editor: networkmanager-qt: virtual void NetworkManager::DevicePrivate::propertyChanged(const QString&, const QVariant&) Unhandled property "Real" Feb 28 06:39:10 localhost kdeinit5: networkmanager-qt: virtual void NetworkManager::DevicePrivate::propertyChanged(const QString&, const QVariant&) Unhandled property "LldpNeighbors" Feb 28 06:39:10 localhost kdeinit5: networkmanager-qt: virtual void NetworkManager::DevicePrivate::propertyChanged(const QString&, const QVariant&) Unhandled property "Real" Feb 28 06:39:10 localhost plasmashell: networkmanager-qt: virtual void NetworkManager::DevicePrivate::propertyChanged(const QString&, const QVariant&) Unhandled property "LldpNeighbors" Feb 28 06:39:10 localhost plasmashell: networkmanager-qt: virtual void NetworkManager::DevicePrivate::propertyChanged(const QString&, const QVariant&) Unhandled property "Real" Feb 28 06:39:10 localhost kde5-nm-connection-editor: networkmanager-qt: virtual void NetworkManager::DevicePrivate::propertyChanged(const QString&, const QVariant&) Unhandled property "LldpNeighbors" Feb 28 06:39:10 localhost kde5-nm-connection-editor: networkmanager-qt: virtual void NetworkManager::DevicePrivate::propertyChanged(const QString&, const QVariant&) Unhandled property "Real" Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0395] vpn-connection[0x5635ff542340,e1630f07-daa2-4654-9b99-0daa7616334e,"GNTC VPN",0]: VPN connection: (IP Config Get) reply received. Feb 28 06:39:10 localhost kdeinit5: networkmanager-qt: virtual void NetworkManager::DevicePrivate::propertyChanged(const QString&, const QVariant&) Unhandled property "LldpNeighbors" Feb 28 06:39:10 localhost kdeinit5: networkmanager-qt: virtual void NetworkManager::DevicePrivate::propertyChanged(const QString&, const QVariant&) Unhandled property "Real" Feb 28 06:39:10 localhost kde5-nm-connection-editor: networkmanager-qt: void NetworkManager::NetworkManagerPrivate::propertiesChanged(const QVariantMap&) Unhandled property "AllDevices" Feb 28 06:39:10 localhost kde5-nm-connection-editor: networkmanager-qt: void NetworkManager::NetworkManagerPrivate::propertiesChanged(const QVariantMap&) Unhandled property "Devices" Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0448] vpn-connection[0x5635ff542340,e1630f07-daa2-4654-9b99-0daa7616334e,"GNTC VPN",10:(tun0)]: VPN connection: (IP4 Config Get) reply received Feb 28 06:39:10 localhost kdeinit5: networkmanager-qt: void NetworkManager::NetworkManagerPrivate::propertiesChanged(const QVariantMap&) Unhandled property "AllDevices" Feb 28 06:39:10 localhost kdeinit5: networkmanager-qt: void NetworkManager::NetworkManagerPrivate::propertiesChanged(const QVariantMap&) Unhandled property "Devices" Feb 28 06:39:10 localhost nm-openvpn[3325]: GID set to nm-openvpn Feb 28 06:39:10 localhost kdeinit5: plasma-nm: Unhandled VPN connection state change: 4 Feb 28 06:39:10 localhost nm-openvpn[3325]: UID set to nm-openvpn Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0469] vpn-connection[0x5635ff542340,e1630f07-daa2-4654-9b99-0daa7616334e,"GNTC VPN",10:(tun0)]: Data: VPN Gateway: 72.174.xxx.xx Feb 28 06:39:10 localhost nm-openvpn[3325]: Initialization Sequence Completed Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0470] vpn-connection[0x5635ff542340,e1630f07-daa2-4654-9b99-0daa7616334e,"GNTC VPN",10:(tun0)]: Data: Tunnel Device: "tun0" Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0470] vpn-connection[0x5635ff542340,e1630f07-daa2-4654-9b99-0daa7616334e,"GNTC VPN",10:(tun0)]: Data: IPv4 configuration: Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0471] vpn-connection[0x5635ff542340,e1630f07-daa2-4654-9b99-0daa7616334e,"GNTC VPN",10:(tun0)]: Data: Internal Gateway: 10.0.40.1 Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0471] vpn-connection[0x5635ff542340,e1630f07-daa2-4654-9b99-0daa7616334e,"GNTC VPN",10:(tun0)]: Data: Internal Address: 10.0.40.3 Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0471] vpn-connection[0x5635ff542340,e1630f07-daa2-4654-9b99-0daa7616334e,"GNTC VPN",10:(tun0)]: Data: Internal Prefix: 24 Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0472] vpn-connection[0x5635ff542340,e1630f07-daa2-4654-9b99-0daa7616334e,"GNTC VPN",10:(tun0)]: Data: Internal Point-to-Point Address: 10.0.40.3 Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0472] vpn-connection[0x5635ff542340,e1630f07-daa2-4654-9b99-0daa7616334e,"GNTC VPN",10:(tun0)]: Data: Maximum Segment Size (MSS): 0 Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0473] vpn-connection[0x5635ff542340,e1630f07-daa2-4654-9b99-0daa7616334e,"GNTC VPN",10:(tun0)]: Data: Static Route: 10.0.20.0/24 Next Hop: 10.0.40.1 Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0473] vpn-connection[0x5635ff542340,e1630f07-daa2-4654-9b99-0daa7616334e,"GNTC VPN",10:(tun0)]: Data: Forbid Default Route: no Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0474] vpn-connection[0x5635ff542340,e1630f07-daa2-4654-9b99-0daa7616334e,"GNTC VPN",10:(tun0)]: Data: Internal DNS: 10.0.20.19 Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0474] vpn-connection[0x5635ff542340,e1630f07-daa2-4654-9b99-0daa7616334e,"GNTC VPN",10:(tun0)]: Data: Internal DNS: 10.0.20.20 Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0474] vpn-connection[0x5635ff542340,e1630f07-daa2-4654-9b99-0daa7616334e,"GNTC VPN",10:(tun0)]: Data: DNS Domain: 'gntc.egovmt.com' Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0475] vpn-connection[0x5635ff542340,e1630f07-daa2-4654-9b99-0daa7616334e,"GNTC VPN",10:(tun0)]: Data: No IPv6 configuration Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0478] vpn-connection[0x5635ff542340,e1630f07-daa2-4654-9b99-0daa7616334e,"GNTC VPN",10:(tun0)]: VPN plugin: state changed: started (4) Feb 28 06:39:10 localhost plasmashell: networkmanager-qt: virtual void NetworkManager::DevicePrivate::propertyChanged(const QString&, const QVariant&) Unhandled property "LldpNeighbors" Feb 28 06:39:10 localhost plasmashell: networkmanager-qt: virtual void NetworkManager::DevicePrivate::propertyChanged(const QString&, const QVariant&) Unhandled property "Real" Feb 28 06:39:10 localhost kdeinit5: QObject::connect: invalid null parameter Feb 28 06:39:10 localhost plasmashell: networkmanager-qt: void NetworkManager::NetworkManagerPrivate::propertiesChanged(const QVariantMap&) Unhandled property "AllDevices" Feb 28 06:39:10 localhost plasmashell: networkmanager-qt: void NetworkManager::NetworkManagerPrivate::propertiesChanged(const QVariantMap&) Unhandled property "Devices" Feb 28 06:39:10 localhost audit: NETFILTER_CFG table=nat family=10 entries=76 Feb 28 06:39:10 localhost audit: NETFILTER_CFG table=raw family=10 entries=42 Feb 28 06:39:10 localhost audit: NETFILTER_CFG table=mangle family=10 entries=52 Feb 28 06:39:10 localhost audit: NETFILTER_CFG table=filter family=10 entries=122 Feb 28 06:39:10 localhost audit: NETFILTER_CFG table=nat family=2 entries=81 Feb 28 06:39:10 localhost audit: NETFILTER_CFG table=raw family=2 entries=40 Feb 28 06:39:10 localhost audit: NETFILTER_CFG table=mangle family=2 entries=53 Feb 28 06:39:10 localhost audit: NETFILTER_CFG table=filter family=2 entries=131 Feb 28 06:39:10 localhost acvpnagent[3072]: A new network interface has been detected. Feb 28 06:39:10 localhost acvpnagent[3072]: Function: logInterfaces File: ../../vpn/AgentUtilities/Routing/InterfaceRouteMonitorCommon.cpp Line: 477 IP Address Interface List: 192.168.15.177 FE80:0:0:0:BA60:23FF:EC7:280D FE80:0:0:0:DC64:185:3EA1:4AC6 Feb 28 06:39:10 localhost acvpnagent[3072]: Function: netInterfaceNoticeCategoryHandler File: ../../vpn/Agent/MainThread.cpp Line: 7388 Network Interface change detected, refreshing physical MAC addresses Feb 28 06:39:10 localhost acvpnagent[3072]: A new network interface has been detected. Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0648] vpn-connection[0x5635ff542340,e1630f07-daa2-4654-9b99-0daa7616334e,"GNTC VPN",10:(tun0)]: VPN connection: (IP Config Get) complete Feb 28 06:39:10 localhost acvpnagent[3072]: Function: logInterfaces File: ../../vpn/AgentUtilities/Routing/InterfaceRouteMonitorCommon.cpp Line: 477 IP Address Interface List: 192.168.15.177 10.0.40.3 FE80:0:0:0:BA60:23FF:EC7:280D FE80:0:0:0:DC64:185:3EA1:4AC6 Feb 28 06:39:10 localhost acvpnagent[3072]: Function: netInterfaceNoticeCategoryHandler File: ../../vpn/Agent/MainThread.cpp Line: 7388 Network Interface change detected, refreshing physical MAC addresses Feb 28 06:39:10 localhost dbus-daemon[894]: [system] Activating via systemd: service name='org.freedesktop.nm_dispatcher' unit='dbus-org.freedesktop.nm-dispatcher.service' requested by ':1.11' (uid=0 pid=1276 comm="/usr/sbin/NetworkManager --no-daemon ") Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0656] device (tun0): state change: unmanaged -> unavailable (reason 'connection-assumed') [10 20 41] Feb 28 06:39:10 localhost kdeinit5: networkmanager-qt: virtual void NetworkManager::DevicePrivate::propertyChanged(const QString&, const QVariant&) Unhandled property "TxBytes" Feb 28 06:39:10 localhost systemd: Starting Network Manager Script Dispatcher Service... Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0680] keyfile: add connection in-memory (e758696e-b90c-4b59-9a20-ab6d3f9bd6f7,"tun0") Feb 28 06:39:10 localhost kde5-nm-connection-editor: networkmanager-qt: virtual void NetworkManager::DevicePrivate::propertyChanged(const QString&, const QVariant&) Unhandled property "TxBytes" Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0686] device (tun0): state change: unavailable -> disconnected (reason 'connection-assumed') [20 30 41] Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0697] device (tun0): Activation: starting connection 'tun0' (e758696e-b90c-4b59-9a20-ab6d3f9bd6f7) Feb 28 06:39:10 localhost dbus-daemon[894]: [system] Successfully activated service 'org.freedesktop.nm_dispatcher' Feb 28 06:39:10 localhost audit: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=NetworkManager-dispatcher comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' Feb 28 06:39:10 localhost systemd: Started Network Manager Script Dispatcher Service. Feb 28 06:39:10 localhost nm-dispatcher: req:1 'vpn-pre-up' [tun0]: new request (1 scripts) Feb 28 06:39:10 localhost plasmashell: networkmanager-qt: virtual void NetworkManager::DevicePrivate::propertyChanged(const QString&, const QVariant&) Unhandled property "TxBytes" Feb 28 06:39:10 localhost dnsmasq[1880]: reading /etc/resolv.conf Feb 28 06:39:10 localhost dnsmasq[1880]: using nameserver 10.0.20.19#53 Feb 28 06:39:10 localhost dnsmasq[1880]: using nameserver 10.0.20.20#53 Feb 28 06:39:10 localhost dnsmasq[1880]: using nameserver 192.168.15.2#53 Feb 28 06:39:10 localhost nm-dispatcher: req:2 'vpn-up' [tun0]: new request (6 scripts) Feb 28 06:39:10 localhost nm-dispatcher: req:2 'vpn-up' [tun0]: start running ordered scripts... Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0903] device (tun0): state change: disconnected -> prepare (reason 'none') [30 40 0] Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0918] device (tun0): state change: prepare -> config (reason 'none') [40 50 0] Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0922] device (tun0): state change: config -> ip-config (reason 'none') [50 70 0] Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.0924] device (tun0): state change: ip-config -> ip-check (reason 'none') [70 80 0] Feb 28 06:39:10 localhost nm-dispatcher: req:3 'pre-up' [tun0]: new request (1 scripts) Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.1026] device (tun0): state change: ip-check -> secondaries (reason 'none') [80 90 0] Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.1074] device (tun0): state change: secondaries -> activated (reason 'none') [90 100 0] Feb 28 06:39:10 localhost systemd: iscsi.service: Unit cannot be reloaded because it is inactive. Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.1152] policy: set 'tun0' (tun0) as default for IPv4 routing and DNS Feb 28 06:39:10 localhost NetworkManager[1276]: [1488289150.1153] device (tun0): Activation: successful, device activated. Feb 28 06:39:10 localhost nm-dispatcher: req:4 'up' [tun0]: new request (6 scripts) Feb 28 06:39:10 localhost nm-dispatcher: req:4 'up' [tun0]: start running ordered scripts... Feb 28 06:39:10 localhost systemd: iscsi.service: Unit cannot be reloaded because it is inactive.

[quote="skeer"]Client logs only found in /var/log/messages[/quote]See --[b]log[/b] & --[b]verb[/b] in [url=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage]The Manual v24x[/url]

Does that mean that everything I pasted is useless? I do have the verbosity set at 5.. both in client .ovpn and on the server. I will however set the --log file on the linux side and see what happens.

[quote="skeer"]Does that mean that everything I pasted is useless?[/quote]Not completely .. [quote="skeer"]I do have the verbosity set at 5[/quote]--[b]verb 4[/b] is usually sufficient. --[b]register-dns[/b] is a Windows only option which you are pushing to a Linux client. Also, we don't support Network-Manager so I advise you to stop using it, instead use systemd to start openvpn. And please post complete client details of [code]$ openvpn --version[/code]

--register-dns, is this part of: Force DNS cache update Run "net stop dnscache", "net start dnscache", "ipconfig /flushdns" and "ipconfig /registerdns" on connection initiation. This is known to kick Windows into recognizing pushed DNS servers? Oh wait.. PUSH-OPTIONS.. Yeah I saw that. Not sure exactly where that's coming from.

[quote]Also, we don't support Network-Manager so I advise you to stop using it, instead use systemd to start openvpn.[/quote] I did have reservations about that. Kinda sucks but I understand.. are there any future plans on supporting NM? I'm not as noob-ish as most but being able to use such a reliable vpn solution in the easiest (and most windows-like) manner is good for those first-time switchers from Windows to Linux. Any way that's not the point of this thread... So using the cli or a script to call systemctl start openvpn@foo.service is the most common way then yes?

Ok here's a connection attempt from cli.. looks like I have a ton of issues. [quote] ➜ openvpn openvpn gntc.conf Tue Feb 28 16:56:03 2017 OpenVPN 2.3.14 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Dec 7 2016 Tue Feb 28 16:56:03 2017 library versions: OpenSSL 1.0.2k-fips 26 Jan 2017, LZO 2.08 Enter Auth Username: ***** Enter Auth Password: ************************ Tue Feb 28 16:56:29 2017 WARNING: file 'gntc.key' is group or others accessible Tue Feb 28 16:56:29 2017 Control Channel Authentication: using 'gntc.key' as a OpenVPN static key file Tue Feb 28 16:56:29 2017 UDPv4 link local (bound): [undef] Tue Feb 28 16:56:29 2017 UDPv4 link remote: [AF_INET]72.174.xx.xx:34448 Tue Feb 28 16:56:29 2017 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this Tue Feb 28 16:56:29 2017 VERIFY ERROR: depth=0, error=certificate signature failure: C=US, ST=MT, O=Montana_Interactive, OU=Operations, CN=gntc-vpn-1, emailAddress=email@domain.com Tue Feb 28 16:56:29 2017 OpenSSL: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed Tue Feb 28 16:56:29 2017 TLS_ERROR: BIO read tls_read_plaintext error Tue Feb 28 16:56:29 2017 TLS Error: TLS object -> incoming plaintext read error Tue Feb 28 16:56:29 2017 TLS Error: TLS handshake failed Tue Feb 28 16:56:29 2017 SIGUSR1[soft,tls-error] received, process restarting Tue Feb 28 16:56:31 2017 UDPv4 link local (bound): [undef] Tue Feb 28 16:56:31 2017 UDPv4 link remote: [AF_INET]72.174.xx.xx:34448 Tue Feb 28 16:56:31 2017 VERIFY ERROR: depth=0, error=certificate signature failure: C=US, ST=MT, O=Montana_Interactive, OU=Operations, CN=gntc-vpn-1, emailAddress=email@domain.com Tue Feb 28 16:56:31 2017 OpenSSL: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed Tue Feb 28 16:56:31 2017 TLS_ERROR: BIO read tls_read_plaintext error Tue Feb 28 16:56:31 2017 TLS Error: TLS object -> incoming plaintext read error Tue Feb 28 16:56:31 2017 TLS Error: TLS handshake failed Tue Feb 28 16:56:31 2017 SIGUSR1[soft,tls-error] received, process restarting Tue Feb 28 16:56:33 2017 UDPv4 link local (bound): [undef] Tue Feb 28 16:56:33 2017 UDPv4 link remote: [AF_INET]72.174.xx.xx:34448 Tue Feb 28 16:56:33 2017 TLS Error: Unroutable control packet received from [AF_INET]72.174.xx.xx:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:56:33 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx:34448 (si=3 op=P_ACK_V1) Tue Feb 28 16:56:35 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:56:35 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_ACK_V1) Tue Feb 28 16:56:36 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:56:37 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:56:37 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:56:38 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:56:39 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:56:39 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_ACK_V1) Tue Feb 28 16:56:46 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:56:47 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:56:47 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:56:48 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:57:02 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:57:03 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:57:03 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:57:03 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_ACK_V1) Tue Feb 28 16:57:05 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:57:33 2017 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Tue Feb 28 16:57:33 2017 TLS Error: TLS handshake failed Tue Feb 28 16:57:33 2017 SIGUSR1[soft,tls-error] received, process restarting Tue Feb 28 16:57:35 2017 UDPv4 link local (bound): [undef] Tue Feb 28 16:57:35 2017 UDPv4 link remote: [AF_INET]72.xx.xx.34:34448 Tue Feb 28 16:57:35 2017 VERIFY ERROR: depth=0, error=certificate signature failure: C=US, ST=MT, O=Montana_Interactive, OU=Operations, CN=gntc-vpn-1, emailAddress=email@domain.com Tue Feb 28 16:57:35 2017 OpenSSL: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed Tue Feb 28 16:57:35 2017 TLS_ERROR: BIO read tls_read_plaintext error Tue Feb 28 16:57:35 2017 TLS Error: TLS object -> incoming plaintext read error Tue Feb 28 16:57:35 2017 TLS Error: TLS handshake failed Tue Feb 28 16:57:35 2017 SIGUSR1[soft,tls-error] received, process restarting Tue Feb 28 16:57:37 2017 UDPv4 link local (bound): [undef] Tue Feb 28 16:57:37 2017 UDPv4 link remote: [AF_INET]72.xx.xx.34:34448 Tue Feb 28 16:57:37 2017 VERIFY ERROR: depth=0, error=certificate signature failure: C=US, ST=MT, O=Montana_Interactive, OU=Operations, CN=gntc-vpn-1, emailAddress=email@domain.com Tue Feb 28 16:57:37 2017 OpenSSL: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed Tue Feb 28 16:57:37 2017 TLS_ERROR: BIO read tls_read_plaintext error Tue Feb 28 16:57:37 2017 TLS Error: TLS object -> incoming plaintext read error Tue Feb 28 16:57:37 2017 TLS Error: TLS handshake failed Tue Feb 28 16:57:37 2017 SIGUSR1[soft,tls-error] received, process restarting Tue Feb 28 16:57:39 2017 UDPv4 link local (bound): [undef] Tue Feb 28 16:57:39 2017 UDPv4 link remote: [AF_INET]72.xx.xx.34:34448 Tue Feb 28 16:57:39 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:57:39 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_ACK_V1) Tue Feb 28 16:57:40 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:57:41 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:57:41 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_ACK_V1) Tue Feb 28 16:57:42 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:57:43 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:57:45 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:57:45 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_ACK_V1) Tue Feb 28 16:57:46 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:57:50 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:57:51 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:57:52 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:57:53 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:57:53 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_ACK_V1) Tue Feb 28 16:58:07 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:58:08 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:58:09 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:58:09 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_ACK_V1) Tue Feb 28 16:58:10 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:58:39 2017 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Tue Feb 28 16:58:39 2017 TLS Error: TLS handshake failed Tue Feb 28 16:58:39 2017 SIGUSR1[soft,tls-error] received, process restarting Tue Feb 28 16:58:41 2017 UDPv4 link local (bound): [undef] Tue Feb 28 16:58:41 2017 UDPv4 link remote: [AF_INET]72.xx.xx.34:34448 Tue Feb 28 16:58:41 2017 VERIFY ERROR: depth=0, error=certificate signature failure: C=US, ST=MT, O=Montana_Interactive, OU=Operations, CN=gntc-vpn-1, emailAddress=email@domain.com Tue Feb 28 16:58:41 2017 OpenSSL: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed Tue Feb 28 16:58:41 2017 TLS_ERROR: BIO read tls_read_plaintext error Tue Feb 28 16:58:41 2017 TLS Error: TLS object -> incoming plaintext read error Tue Feb 28 16:58:41 2017 TLS Error: TLS handshake failed Tue Feb 28 16:58:41 2017 SIGUSR1[soft,tls-error] received, process restarting Tue Feb 28 16:58:43 2017 UDPv4 link local (bound): [undef] Tue Feb 28 16:58:43 2017 UDPv4 link remote: [AF_INET]72xx.xx.34:34448 Tue Feb 28 16:58:43 2017 VERIFY ERROR: depth=0, error=certificate signature failure: C=US, ST=MT, O=Montana_Interactive, OU=Operations, CN=gntc-vpn-1, emailAddress=email@domain.com Tue Feb 28 16:58:43 2017 OpenSSL: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed Tue Feb 28 16:58:43 2017 TLS_ERROR: BIO read tls_read_plaintext error Tue Feb 28 16:58:43 2017 TLS Error: TLS object -> incoming plaintext read error Tue Feb 28 16:58:43 2017 TLS Error: TLS handshake failed Tue Feb 28 16:58:43 2017 SIGUSR1[soft,tls-error] received, process restarting Tue Feb 28 16:58:45 2017 UDPv4 link local (bound): [undef] Tue Feb 28 16:58:45 2017 UDPv4 link remote: [AF_INET]72.xx.xx.34:34448 Tue Feb 28 16:58:45 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:58:45 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_ACK_V1) Tue Feb 28 16:58:46 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:58:47 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:58:47 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_ACK_V1) Tue Feb 28 16:58:48 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:58:49 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:58:50 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:58:51 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:58:51 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_ACK_V1) Tue Feb 28 16:58:55 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:58:56 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:58:57 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:58:58 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_CONTROL_V1) Tue Feb 28 16:58:59 2017 TLS Error: Unroutable control packet received from [AF_INET]72.xx.xx.34:34448 (si=3 op=P_ACK_V1) ^CTue Feb 28 16:59:05 2017 event_wait : Interrupted system call (code=4) Tue Feb 28 16:59:05 2017 SIGINT[hard,] received, process exiting [/quote] I cut it off here due to the repeating nature.

OpenVPN on pfSense, Fedora 25 client routing issues

TinCanTech

You have not posted your server config.

Anyway, I don't think this is an openvpn problem it is a pfSense/networking setup problem.

I don't know pfSense well enough to diagnose your fault.

TinCanTech

Googling around suggests the problem has something to do with your certificates ..

skeer

4 posts above is what my server/Pf is putting out in terms of logs. The verbosity was set to 6 on the server and 5 for the client. Which even I can see there's not much to go on there. The client config I posted last night was after I disabled TLS checking. Which was weird because my own client logs indicate TLS handshaking still failed.

What is flatly irritating is how Windows doesn't care one bit.. same certs and all it just works. I don;t expect Linux to process everything exactly the same but it should at least be ok with the certs as they are because that's one thing that is static. They can only be interpreted one way.

Thanks very much for the time you've spent here TinCan

TinCanTech

I have just setup pfSense 2.3.3 with openvpn and one Linux client .. All the setting are the same (or similar) to what you have posted and it works ok. I do not know what you have done wrong but my suspicion would be something to do with incorrect cert/key ..

skeer

Today I went through and exported every single cert and key on the firewall. Here in an hour or two Ill retry and report back.

skeer

So let me ask a stupid question.. one that I have not been able to ascertain myself from google results yet. If my ovpn is specifying the CA crt, and the tls-key. If I wanted to specify the server's crt, would I still need the tls-key or the server key?

skeer

Tin Can.. Do you mind sharing the config that worked for you? Feel free to email to keep a level of privacy=, I want to mirror your settings as much as I can to test.

TinCanTech

skeer wrotelet me ask a stupid question

I don't understand the question .. please try again.

skeer wroteDo you mind sharing the config that worked for you?

There is nothing special about my config: client
dev tun1
proto udp
remote x.x.x.x 1194
resolv-retry infinite
nobind

auth-user-pass pf_userpass.txt

# Try to preserve some state across restarts.
;persist-key
;persist-tun

ns-cert-type server
key-direction 1

;cipher AES-128-CBC
;auth SHA224

cipher CAMELLIA-256-CBC
auth RSA-SHA224

comp-lzo

verb 4

log /etc/openvpn/pf_31194/cli.log

<ca>
-----BEGIN CERTIFICATE-----
MIIEOzCCAyOgAwIBAgIBADANBgkqhkiG9w0BAQ4FADB2MQswCQYDVQQGEwJVUzEQ
MA4GA1UECBMHcHJpdmF0ZTENMAsGA1UEBxMEaG9tZTEQMA4GA1UEChMHcGZzZW5z
ZTEiMCAGCSqGSIb3DQEJARYTcGZzZW5zZUBleGFtcGxlLm5vdDEQMA4GA1UEAxQH
T1ZQTl8wMTAeFw0xNzAzMDIxODUxMDlaFw0yNzAyMjgxODUxMDlaMHYxCzAJBgNV
BAYTAlVTMRAwDgYDVQQIEwdwcml2YXRlMQ0wCwYDVQQHEwRob21lMRAwDgYDVQQK
EwdwZnNlbnNlMSIwIAYJKoZIhvcNAQkBFhNwZnNlbnNlQGV4YW1wbGUubm90MRAw
DgYDVQQDFAdPVlBOXzAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
oSCaJQT+UY3LMW5g7tByB16u8atCgjHocURpbHHF6QY9qkaDRwuJwQh28vuXPVTB
qDasTPK7svTsPAWxxRcQmHpXziMrBZSJ8tvfEcV5w6jwsNtLLf72f+JjugqnOVDC
kazCClsAYlikb70EvKLQqmi3UWjsbBFqKozZC0yoxvO2mEwfYbD3a3VWHSF33elV
zhmNfh3avjVhNiBBv+j8UYxEixPOyf6O/KTT897xQ5OV13YcWqDS+vVxaVXlnOfv
T7d3mUkhhck1b0o9rmoZi6ZOjy4USCr/BSMYwchDl0xT6oiKGPFgy+vJxMYmfa7K
goATQWd3wQYjT43IpjKr2wIDAQABo4HTMIHQMB0GA1UdDgQWBBQtqaAqf3qO03/B
wx/APmjbCIyomTCBoAYDVR0jBIGYMIGVgBQtqaAqf3qO03/Bwx/APmjbCIyomaF6
pHgwdjELMAkGA1UEBhMCVVMxEDAOBgNVBAgTB3ByaXZhdGUxDTALBgNVBAcTBGhv
bWUxEDAOBgNVBAoTB3Bmc2Vuc2UxIjAgBgkqhkiG9w0BCQEWE3Bmc2Vuc2VAZXhh
bXBsZS5ub3QxEDAOBgNVBAMUB09WUE5fMDGCAQAwDAYDVR0TBAUwAwEB/zANBgkq
hkiG9w0BAQ4FAAOCAQEAjEeuf97/Lam0L3hJPZmEv+hfOE9kr9fQAEERMFhps8aH
32BA0kHfKQaiwiEN2O0gq8cVkrKr11SH6IAgeqRv7NktMBfF89MBbWZO7QhqJrUZ
0aIBMa5ofFtxomHqPkRc6gWvUbuOTi7jRN2L68FB5h8BePbF4EL0jDkd4L+SFoYu
+pGGxoOvTVq+uJMxDtLPnJQAqcU0Yuux0MPPTH22Px90Ie0ScpYD2j0jg7OM+Ecb
wAiKXUJt5vD+MMYkkIPjOR/WCJFxyzT67Opdp3yF6xiAb+hS0qOIHIgxhiQbbgou
tXVPDs9JdHr++UJr+kUmw1FDNt91nTMDXg2+kih4hw==
-----END CERTIFICATE-----
</ca>

<cert>
-----BEGIN CERTIFICATE-----
MIIEeTCCA2GgAwIBAgIBAjANBgkqhkiG9w0BAQ4FADB2MQswCQYDVQQGEwJVUzEQ
MA4GA1UECBMHcHJpdmF0ZTENMAsGA1UEBxMEaG9tZTEQMA4GA1UEChMHcGZzZW5z
ZTEiMCAGCSqGSIb3DQEJARYTcGZzZW5zZUBleGFtcGxlLm5vdDEQMA4GA1UEAxQH
T1ZQTl8wMTAeFw0xNzAzMDIxODU0NTBaFw0yNzAyMjgxODU0NTBaMIGBMQswCQYD
VQQGEwJVUzEQMA4GA1UECBMHcHJpdmF0ZTENMAsGA1UEBxMEaG9tZTEQMA4GA1UE
ChMHcGZzZW5zZTEiMCAGCSqGSIb3DQEJARYTcGZzZW5zZUBleGFtcGxlLm5vdDEb
MBkGA1UEAxQSb3Zwbl9wZnNlbnNlX2NsaTAxMIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEAzIAcPk7BFYBPO3zxV8IF2nyD18W5XfpbyfsVTWPfndAJgqsK
P9NEroZcJlI4xfpDpvsyeHnwJMzmBXJrS50SiugjPvQBTywWQxdu3r0HbS22r0i1
3ddXU/9xLSgbxB740m+jNajXuafsdrw7SOSpeZOfcGBADSasmMJtXtGBrYqC++/G
BhOrUS9KNIqtjTLfLgs2EWFWwExFHA1h33C+RRHNmq0e1SN6Cxuuk8rAcsE1tGBH
bLYz89wEawPpiRf86c569QVl5MaOHVQfHaZam0nsG4c4GCaD1EoXD78W+wK4NlQP
v8I1sDbmg5Qkyb0vhmhSw5lclM1ehBLHv0XYoQIDAQABo4IBBDCCAQAwCQYDVR0T
BAIwADAxBglghkgBhvhCAQ0EJBYiT3BlblNTTCBHZW5lcmF0ZWQgVXNlciBDZXJ0
aWZpY2F0ZTAdBgNVHQ4EFgQU/MN+kbKs0/hn3ku+uAFQ++4WqQwwgaAGA1UdIwSB
mDCBlYAULamgKn96jtN/wcMfwD5o2wiMqJmheqR4MHYxCzAJBgNVBAYTAlVTMRAw
DgYDVQQIEwdwcml2YXRlMQ0wCwYDVQQHEwRob21lMRAwDgYDVQQKEwdwZnNlbnNl
MSIwIAYJKoZIhvcNAQkBFhNwZnNlbnNlQGV4YW1wbGUubm90MRAwDgYDVQQDFAdP
VlBOXzAxggEAMA0GCSqGSIb3DQEBDgUAA4IBAQA5CEozHZPpC8x5Px2CK3WAQWwv
hqHN+VI3wkp1VvvtbojY1kDyHmlnErq33L2k1KjHOz1uMLXP5QfmFcVqXHlIjPuo
Q+8zQv7gDgCzDjRD8cJnHZSXc/bmfqpHpAyt60PY89oMm9Zgz4cKi1lHEgx3FEee
lMrd/S4oh24fCIB1LDFQc+uG0gHKcgdFWP5gmlC+B+q6AC7Ip56PCznWjCmz4lGx
YToPJKYgGPuybhLeKxFUwirJRibzC6WnbYSZTMvuXlae1VXUavf6SUo8G2V2z6no
a/t6155G9uwvBQKPzYkx8itv/HIfZTXG8iCZAQ80kcgQuZXXBhO7j5TBMpoT
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDMgBw+TsEVgE87
fPFXwgXafIPXxbld+lvJ+xVNY9+d0AmCqwo/00SuhlwmUjjF+kOm+zJ4efAkzOYF
cmtLnRKK6CM+9AFPLBZDF27evQdtLbavSLXd11dT/3EtKBvEHvjSb6M1qNe5p+x2
vDtI5Kl5k59wYEANJqyYwm1e0YGtioL778YGE6tRL0o0iq2NMt8uCzYRYVbATEUc
DWHfcL5FEc2arR7VI3oLG66TysBywTW0YEdstjPz3ARrA+mJF/zpznr1BWXkxo4d
VB8dplqbSewbhzgYJoPUShcPvxb7Arg2VA+/wjWwNuaDlCTJvS+GaFLDmVyUzV6E
Ese/RdihAgMBAAECggEBAIRPdvaRObfRlnHkurmO3P6phRv7350AOJcMDpJNxgZy
7VRPmYgGBu/sGn7ov7bH3zGQYO0157vHniN0DhuT+sVIwFUgxiAVZCnwZVlTcBSh
eQsbvh9UDjpYkT8oLh7L8y0j8bLsFPcXwJRp4OmemFACxSuN+qMHnLARS3YHkyFV
zXrUkDASEfaTz255loaXHV+RwbcBObK1lbov5a7rFG0I0gO5An7mzXOO5VNrx7XR
e0kAjPdGG6VzupnYdFKvqann3hOdpBkpsd2vqmGmjRYpFourRx8N8hxh3XShqf3R
BOks7iHSWldqau3ErEYkrDPGpyg49Gae6vljhWZnkmECgYEA+jRdbLK2n5cEs2IH
c8WDXy9p0o1YnMLTOB6yT7DWVw3hDqFcwdV3Rz00nhnlVzYuOcMHxk51r9xXvCbx
iLhEVwWZ3xRiu1aVTddQNwzIUWzJbcMyKVKRIqCEvYPk7Rg7PWWTHBrg2/h9+Q1p
rBLkkacPWJ41oIUFvBerGX0cVfUCgYEA0Ty78/DhBjeW+THfv+guaEywFpT7SG0S
zD7UAH/c1MhV1XEmsQQ0eUJZ0aLumvanPTqUu/K6QvyU1i9PBG+TWNgVyznuV2QH
MB763Kva6oToq+lBnMIyM5TOEaAL+AUHlL00lc4ymftQJs3eSm0ccHfWGozABPLE
mBLLTlLkYH0CgYEA7ACistnriqMPKwjnUJtYbFszrQfoMo1OYFwMA0EhHCIaTAuG
i8sHZGnmDM8OVXHkrlU5KyNsvMHQ+8ecAkMVKyQ8XIBFFMH5uN/EaPikprE/WkpJ
MVMRVSEltAEJ2V4G2sXJujPcL4C3ikjNiSKU+JIk1oj8unlezGli2Xr6VFUCgYBa
0X/LTDx/1FUlaK5zv7WU8+RiiNvg/ebw3Dxs0xLpEOOgt3JR1z9nepM92Pi0Lmc8
vlaclaifNr7rkLE9fah5IaGkCksXh4VPL8M3USi+Ll5HcAFYpznfBbHEGLHZP2Wg
+9b9RvjTuS97CFR5/Y4giwNVls4p163ZTB8OqhASiQKBgQDobo6wYhLWqX1RO3Fd
SGSSekPluWt9ldeUOY9JgTH//Dl316tdof8q6WpgVLNacN7/00dQe7CG19IcQAgK
Q7brvQl8+gS6KgVC8bDChhgseZLG1UQaMMg+QQIqrO0jp6DoD57v3I2bc/NSS9Vy
aYT/F7bYEqqOoKN9baoaG4nfpw==
-----END PRIVATE KEY-----
</key>

<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
-- Manually Stripped Because OConf does not do this, yet --
</tls-auth>

skeer

This is awesome.. one of the things I've questioned was the actual formatting of the .ovpn file. I had tossed around the idea of coding my certs/keys into the file too just to see if things change.
Last night I did upgrade to client version 2.4.0 in an unpushed but mostly reported stable Fedora openvpn client release but had the exact same weird TLS issues.

So you included a password file, the CA certificate, (cert and key == user cert and key right?), and your TLS static key?

TinCanTech

Questions all answered in the documentation.

I really do not know what the problem is you have, especially if windows truly works and Linux not !

Here is an extract I pulled from the mailing list:

> My question is, what does this mean:
> "TLS Error: Unroutable control packet received"
>
> Is it a network problem or is this something to do with security ?
>
>
this error is triggered when someone sends a "random" TLS control packet to the server. Normally, when an OpenVPN connection is set up, security parameters are negotiated. After that, packets coming from the client to the server with the right encryption and security signature are accepted and processed. If the server receives a packet for a client that it does not know, then the above message is shown. In particular, it is triggered by this code in ssl.c:
3563                 /*
3564                  * Packet must belong to an existing session.
3565                  */
3566                 if (i != TM_ACTIVE && i != TM_UNTRUSTED)
3567                 {
3568                     msg(D_TLS_ERRORS,
3569                         "TLS Error: Unroutable control packet received from %s (si=%d op=%s)",
3570                         print_link_socket_actual(from, &gc),
3571                         i,
3572                         packet_opcode_name(op));
3573                     goto error;
3574                 }
Thus, it seems that a packet is received that is no longer associated with a session .
The same applies to packets received by the client from the server.

HTH,

JJK

Perhaps you need the pfSense Forum.

skeer

In the off chance this info changes things.. I finally found teh actual server config from the pfsense shell.

[2.3.3-RELEASE][root@gntc-fw-1.egovmt.com]/var/etc/openvpn: cat server2.conf
dev ovpns2
verb 4
dev-type tun
tun-ipv6
dev-node /dev/tun2
writepid /var/run/openvpn_server2.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher CAMELLIA-256-CBC
auth SHA1
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local 72.xx.xx.34
tls-server
server 10.0.40.0 255.255.255.0
client-config-dir /var/etc/openvpn-csc/server2
lport 34448
management /var/etc/openvpn/server2.sock unix
max-clients 10
push "route 10.0.20.0 255.255.255.0"
push "dhcp-option DNS 10.0.20.19"
push "dhcp-option DNS 10.0.20.20"
push "dhcp-option NTP 198.206.133.14"
push "dhcp-option NTP 96.126.100.203"
ca /var/etc/openvpn/server2.ca
cert /var/etc/openvpn/server2.cert
key /var/etc/openvpn/server2.key
dh /etc/dh-parameters.2048
comp-lzo yes
persist-remote-ip
float
topology subnet

TinCanTech

skeer wroteWhat is flatly irritating is how Windows doesn't care one bit.. same certs and all it just works. I don;t expect Linux to process everything exactly the same but it should at least be ok with the certs as they are because that's one thing that is static

Does windows work and Linux not ? (Please check that thoroughly)

Here is my pfsense server config, perhaps it can help:

[2.3.3-RELEASE][admin@pfsense.localdomain]/var/etc/openvpn: cat server1.conf
dev ovpns1
verb 4
dev-type tun
tun-ipv6
dev-node /dev/tun1
writepid /var/run/openvpn_server1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher CAMELLIA-256-CBC
auth RSA-SHA224
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
client-connect /usr/local/sbin/openvpn.attributes.sh
client-disconnect /usr/local/sbin/openvpn.attributes.sh
local 172.17.2.245
engine cryptodev
tls-server
server 10.245.37.0 255.255.255.0
client-config-dir /var/etc/openvpn-csc/server1
username-as-common-name
auth-user-pass-verify "/usr/local/sbin/ovpn_auth_verify user ????????????????????????= false server1 31194" via-env
tls-verify "/usr/local/sbin/ovpn_auth_verify tls 'ovpn_pfsense_srv01' 1"
lport 31194
management /var/etc/openvpn/server1.sock unix
ca /var/etc/openvpn/server1.ca 
cert /var/etc/openvpn/server1.cert 
key /var/etc/openvpn/server1.key 
dh /etc/dh-parameters.2048
tls-auth /var/etc/openvpn/server1.tls-auth 0
comp-lzo no
topology net30
keepalive 10 30
 comp-lzo no
 push "comp-lzo no"
 push "explicit-exit-notify 3"
[2.3.3-RELEASE][admin@pfsense.localdomain]/var/etc/openvpn:

« Previous Page