OpenVPN Unifi USG Ubizuiti

2600

I have a very nicely running split tunnel vpn on vtun0, with a server listening on local port tcp 443. I have configured a duplicate on vtun1, with a different local listening port (1194 udp).

What happens is that I want the tunnel terminating on vtun1 on the USG is to be a full tunnel--- without split tunneling.

I find in the TLS authentication, I don't get a reply.

Is there an elegant way to switch between split tunneling and full tunneling? Below is my NOT-split tunnel configuration, which doesn't work?

600Edge# show interfaces openvpn vtun1
 encryption aes256
 local-port 1194
 mode server
 openvpn-option "--keepalive 8 30"
 openvpn-option --comp-lzo
 openvpn-option --duplicate-cn
 openvpn-option "--user nobody --group nogroup"
 openvpn-option "--plugin /usr/lib/openvpn/openvpn-auth-pam.so login"
 openvpn-option "--client-cert-not-required --username-as-common-name"
 openvpn-option "--push redirect-gateway def1"  #This is the main difference. The other (vtun0) vpn pushes specific routes.
 openvpn-option "--verb 1"
 openvpn-option "--push dhcp-option DNS 8.8.8.8"
 openvpn-option "--push dhcp-option DNS 8.8.4.4"
 server {
     subnet 10.0.7.0/24
 }
 tls {
     ca-cert-file /config/auth/keys/ca.crt
     cert-file /config/auth/keys/server.crt
     dh-file /config/auth/keys/dh2048.pem
     key-file /config/auth/keys/server.key
 }

Here is the fail log file from a device that works on the normal tunnel:

2017-03-12 17:54:29 official build 0.6.65 running on nvidia SHIELD Tablet K1 (unknown), Android 7.0 (NRD90M) API 24, ABI armeabi-v7a, (nvidia/sb_na_wf/shieldtablet:7.0/NRD90M/1928188_850.6612:user/release-keys)
2017-03-12 17:54:29 Used x 1 tries to get current version (6/6) of the profile
2017-03-12 17:54:29 Building configuration…
2017-03-12 17:54:29 New OpenVPN Status (VPN_GENERATE_CONFIG->LEVEL_START): 
2017-03-12 17:54:29 New OpenVPN Status (VPN_GENERATE_CONFIG->LEVEL_START): 
2017-03-12 17:54:29 started Socket Thread
2017-03-12 17:54:29 Network Status: CONNECTED  to WIFI "DangerousWIFI"
2017-03-12 17:54:29 P:Initializing Google Breakpad!
2017-03-12 17:54:29 Current Parameter Settings:
2017-03-12 17:54:29   config = '/data/user/0/de.blinkt.openvpn/cache/android.conf'
2017-03-12 17:54:29 Waiting 0s seconds between connection attempt
2017-03-12 17:54:29   mode = 0
2017-03-12 17:54:29   show_ciphers = DISABLED
2017-03-12 17:54:29   show_digests = DISABLED
2017-03-12 17:54:29   show_engines = DISABLED
2017-03-12 17:54:29   genkey = DISABLED
2017-03-12 17:54:29   key_pass_file = '[UNDEF]'
2017-03-12 17:54:29   show_tls_ciphers = DISABLED
2017-03-12 17:54:29   connect_retry_max = 0
2017-03-12 17:54:29 Connection profiles [0]:
2017-03-12 17:54:29   proto = udp
2017-03-12 17:54:29   local = '[UNDEF]'
2017-03-12 17:54:29   local_port = '[UNDEF]'
2017-03-12 17:54:29   remote = 'public.dnsname'
2017-03-12 17:54:29   remote_port = '1194'
2017-03-12 17:54:29   remote_float = ENABLED
2017-03-12 17:54:29   bind_defined = DISABLED
2017-03-12 17:54:29   bind_local = DISABLED
2017-03-12 17:54:29   bind_ipv6_only = DISABLED
2017-03-12 17:54:29   connect_retry_seconds = 2
2017-03-12 17:54:29   connect_timeout = 120
2017-03-12 17:54:29   socks_proxy_server = '[UNDEF]'
2017-03-12 17:54:29   socks_proxy_port = '[UNDEF]'
2017-03-12 17:54:29   tun_mtu = 1500
2017-03-12 17:54:29   tun_mtu_defined = ENABLED
2017-03-12 17:54:29   link_mtu = 1500
2017-03-12 17:54:29   link_mtu_defined = DISABLED
2017-03-12 17:54:29   tun_mtu_extra = 0
2017-03-12 17:54:29   tun_mtu_extra_defined = DISABLED
2017-03-12 17:54:29   mtu_discover_type = -1
2017-03-12 17:54:29   fragment = 0
2017-03-12 17:54:29   mssfix = 1450
2017-03-12 17:54:29   explicit_exit_notification = 0
2017-03-12 17:54:29 Connection profiles END
2017-03-12 17:54:29   remote_random = DISABLED
2017-03-12 17:54:29   ipchange = '[UNDEF]'
2017-03-12 17:54:29   dev = 'tun'
2017-03-12 17:54:29   dev_type = '[UNDEF]'
2017-03-12 17:54:29   dev_node = '[UNDEF]'
2017-03-12 17:54:29   lladdr = '[UNDEF]'
2017-03-12 17:54:29   topology = 1
2017-03-12 17:54:29   ifconfig_local = '[UNDEF]'
2017-03-12 17:54:29   ifconfig_remote_netmask = '[UNDEF]'
2017-03-12 17:54:29   ifconfig_noexec = DISABLED
2017-03-12 17:54:29   ifconfig_nowarn = ENABLED
2017-03-12 17:54:29   ifconfig_ipv6_local = '[UNDEF]'
2017-03-12 17:54:29   ifconfig_ipv6_netbits = 0
2017-03-12 17:54:29   ifconfig_ipv6_remote = '[UNDEF]'
2017-03-12 17:54:29   shaper = 0
2017-03-12 17:54:29   mtu_test = 0
2017-03-12 17:54:29   mlock = DISABLED
2017-03-12 17:54:29   keepalive_ping = 0
2017-03-12 17:54:29   keepalive_timeout = 0
2017-03-12 17:54:29   inactivity_timeout = 0
2017-03-12 17:54:29   ping_send_timeout = 0
2017-03-12 17:54:29   ping_rec_timeout = 0
2017-03-12 17:54:29   ping_rec_timeout_action = 0
2017-03-12 17:54:29   ping_timer_remote = DISABLED
2017-03-12 17:54:29   remap_sigusr1 = 0
2017-03-12 17:54:29   persist_tun = ENABLED
2017-03-12 17:54:29   persist_local_ip = DISABLED
2017-03-12 17:54:29   persist_remote_ip = DISABLED
2017-03-12 17:54:29   persist_key = DISABLED
2017-03-12 17:54:29   passtos = DISABLED
2017-03-12 17:54:29   resolve_retry_seconds = 1000000000
2017-03-12 17:54:29   resolve_in_advance = ENABLED
2017-03-12 17:54:29   username = '[UNDEF]'
2017-03-12 17:54:29   groupname = '[UNDEF]'
2017-03-12 17:54:29   chroot_dir = '[UNDEF]'
2017-03-12 17:54:29   cd_dir = '[UNDEF]'
2017-03-12 17:54:29   writepid = '[UNDEF]'
2017-03-12 17:54:29   up_script = '[UNDEF]'
2017-03-12 17:54:29   down_script = '[UNDEF]'
2017-03-12 17:54:29   down_pre = DISABLED
2017-03-12 17:54:29   up_restart = DISABLED
2017-03-12 17:54:29   up_delay = DISABLED
2017-03-12 17:54:29   daemon = DISABLED
2017-03-12 17:54:29   inetd = 0
2017-03-12 17:54:29   log = DISABLED
2017-03-12 17:54:29   suppress_timestamps = DISABLED
2017-03-12 17:54:29   machine_readable_output = ENABLED
2017-03-12 17:54:29   nice = 0
2017-03-12 17:54:29   verbosity = 4
2017-03-12 17:54:29   mute = 0
2017-03-12 17:54:29   gremlin = 0
2017-03-12 17:54:29   status_file = '[UNDEF]'
2017-03-12 17:54:29   status_file_version = 1
2017-03-12 17:54:29   status_file_update_freq = 60
2017-03-12 17:54:29   occ = ENABLED
2017-03-12 17:54:29   rcvbuf = 0
2017-03-12 17:54:29   sndbuf = 0
2017-03-12 17:54:29   sockflags = 0
2017-03-12 17:54:29   fast_io = DISABLED
2017-03-12 17:54:29   comp.alg = 2
2017-03-12 17:54:29   comp.flags = 1
2017-03-12 17:54:29   route_script = '[UNDEF]'
2017-03-12 17:54:29   route_default_gateway = '[UNDEF]'
2017-03-12 17:54:29   route_default_metric = 0
2017-03-12 17:54:29   route_noexec = DISABLED
2017-03-12 17:54:29   route_delay = 0
2017-03-12 17:54:29   route_delay_window = 30
2017-03-12 17:54:29   route_delay_defined = DISABLED
2017-03-12 17:54:29   route_nopull = DISABLED
2017-03-12 17:54:29   route_gateway_via_dhcp = DISABLED
2017-03-12 17:54:29   allow_pull_fqdn = DISABLED
2017-03-12 17:54:29   management_addr = '/data/user/0/de.blinkt.openvpn/cache/mgmtsocket'
2017-03-12 17:54:29   management_port = 'unix'
2017-03-12 17:54:29   management_user_pass = '[UNDEF]'
2017-03-12 17:54:29   management_log_history_cache = 250
2017-03-12 17:54:29   management_echo_buffer_size = 100
2017-03-12 17:54:29   management_write_peer_info_file = '[UNDEF]'
2017-03-12 17:54:29   management_client_user = '[UNDEF]'
2017-03-12 17:54:29   management_client_group = '[UNDEF]'
2017-03-12 17:54:29   management_flags = 4390
2017-03-12 17:54:29   shared_secret_file = '[UNDEF]'
2017-03-12 17:54:29   key_direction = (null)
2017-03-12 17:54:29   ciphername = 'AES-256-CBC'
2017-03-12 17:54:29   ncp_enabled = ENABLED
2017-03-12 17:54:29   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
2017-03-12 17:54:29   authname = 'SHA1'
2017-03-12 17:54:29   prng_hash = 'SHA1'
2017-03-12 17:54:29   prng_nonce_secret_len = 16
2017-03-12 17:54:29   keysize = 0
2017-03-12 17:54:29   engine = DISABLED
2017-03-12 17:54:29   replay = ENABLED
2017-03-12 17:54:29   mute_replay_warnings = DISABLED
2017-03-12 17:54:29   replay_window = 64
2017-03-12 17:54:29   replay_time = 15
2017-03-12 17:54:29   packet_id_file = '[UNDEF]'
2017-03-12 17:54:29   test_crypto = DISABLED
2017-03-12 17:54:29   tls_server = DISABLED
2017-03-12 17:54:29   tls_client = ENABLED
2017-03-12 17:54:29   key_method = 2
2017-03-12 17:54:29   ca_file = '[[INLINE]]'
2017-03-12 17:54:29   ca_path = '[UNDEF]'
2017-03-12 17:54:29   dh_file = '[UNDEF]'
2017-03-12 17:54:29   cert_file = '[[INLINE]]'
2017-03-12 17:54:29   extra_certs_file = '[UNDEF]'
2017-03-12 17:54:29   priv_key_file = '[[INLINE]]'
2017-03-12 17:54:29   pkcs12_file = '[UNDEF]'
2017-03-12 17:54:29   cipher_list = '[UNDEF]'
2017-03-12 17:54:29   tls_verify = '[UNDEF]'
2017-03-12 17:54:29   tls_export_cert = '[UNDEF]'
2017-03-12 17:54:29   verify_x509_type = 0
2017-03-12 17:54:29   verify_x509_name = '[UNDEF]'
2017-03-12 17:54:29   crl_file = '[UNDEF]'
2017-03-12 17:54:29   ns_cert_type = 0
2017-03-12 17:54:29   remote_cert_ku[i] = 0
2017-03-12 17:54:29   remote_cert_ku[i] = 0
2017-03-12 17:54:29   remote_cert_ku[i] = 0
2017-03-12 17:54:29   remote_cert_ku[i] = 0
2017-03-12 17:54:29   remote_cert_ku[i] = 0
2017-03-12 17:54:29   remote_cert_ku[i] = 0
2017-03-12 17:54:29   remote_cert_ku[i] = 0
2017-03-12 17:54:29   remote_cert_ku[i] = 0
2017-03-12 17:54:29   remote_cert_ku[i] = 0
2017-03-12 17:54:29   remote_cert_ku[i] = 0
2017-03-12 17:54:29   remote_cert_ku[i] = 0
2017-03-12 17:54:29   remote_cert_ku[i] = 0
2017-03-12 17:54:29   remote_cert_ku[i] = 0
2017-03-12 17:54:29   remote_cert_ku[i] = 0
2017-03-12 17:54:29   remote_cert_ku[i] = 0
2017-03-12 17:54:29   remote_cert_ku[i] = 0
2017-03-12 17:54:29   remote_cert_eku = '[UNDEF]'
2017-03-12 17:54:29   ssl_flags = 0
2017-03-12 17:54:29   tls_timeout = 2
2017-03-12 17:54:29   renegotiate_bytes = -1
2017-03-12 17:54:29   renegotiate_packets = 0
2017-03-12 17:54:29   renegotiate_seconds = 3600
2017-03-12 17:54:29   handshake_window = 60
2017-03-12 17:54:29   transition_window = 3600
2017-03-12 17:54:29   single_session = DISABLED
2017-03-12 17:54:29   push_peer_info = DISABLED
2017-03-12 17:54:29   tls_exit = DISABLED
2017-03-12 17:54:29   tls_auth_file = '[UNDEF]'
2017-03-12 17:54:29   tls_crypt_file = '[UNDEF]'
2017-03-12 17:54:29   client = ENABLED
2017-03-12 17:54:29   pull = ENABLED
2017-03-12 17:54:29   auth_user_pass_file = '[UNDEF]'
2017-03-12 17:54:29 OpenVPN 2.5-icsopenvpn [git:icsopenvpn-5711c5bd3a04f48b] android-14-armeabi-v7a [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Feb  4 2017
2017-03-12 17:54:29 library versions: OpenSSL 1.0.2k  26 Jan 2017, LZO 2.09
2017-03-12 17:54:29 MANAGEMENT: Connected to management server at /data/user/0/de.blinkt.openvpn/cache/mgmtsocket
2017-03-12 17:54:29 MANAGEMENT: CMD 'hold release'
2017-03-12 17:54:29 MANAGEMENT: CMD 'bytecount 2'
2017-03-12 17:54:29 MANAGEMENT: CMD 'proxy NONE'
2017-03-12 17:54:29 MANAGEMENT: CMD 'state on'
2017-03-12 17:54:30 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
2017-03-12 17:54:30 LZO compression initializing
2017-03-12 17:54:30 Control Channel MTU parms [ L:1622 D:1212 EF:38 EB:0 ET:0 EL:3 ]
2017-03-12 17:54:30 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
2017-03-12 17:54:30 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
2017-03-12 17:54:30 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
2017-03-12 17:54:30 TCP/UDP: Preserving recently used remote address: [AF_INET]PUB.IP.ADD.RES:1194
2017-03-12 17:54:30 Socket Buffers: R=[163840->163840] S=[163840->163840]
2017-03-12 17:54:30 MANAGEMENT: CMD 'needok 'PROTECTFD' ok'
2017-03-12 17:54:30 UDP link local: (not bound)
2017-03-12 17:54:30 UDP link remote: [AF_INET]PUB.IP.ADD.RES:1194
2017-03-12 17:54:30 MANAGEMENT: >STATE:1489355670,WAIT,,,,,,
2017-03-12 17:54:30 New OpenVPN Status (WAIT->LEVEL_CONNECTING_NO_SERVER_REPLY_YET): ,,,,,
2017-03-12 17:54:30 New OpenVPN Status (WAIT->LEVEL_CONNECTING_NO_SERVER_REPLY_YET): ,,,,,

TinCanTech

Does your server log show the client connecting ?

2600

I see now on the server logs, a comparison of a good connection on vtun0 to the bad on vtun1:

Mar 13 20:43:33 2600Edge openvpn[2622]: 172.X.X.210:39965 [rmilton-client] Peer Con
nection Initiated with [AF_INET]172.56.37.210:39965                                  
Mar 13 20:43:33 2600Edge openvpn[2622]: rmilton-client/172.X.X.210:39965 MULTI_sva:
 pool returned IPv4=10.0.8.2, IPv6=(Not enabled)                                     
Mar 13 20:43:34 2600Edge openvpn[2622]: rmilton-client/172.X.X.210:39965 send_push_
reply(): safe_cap=940                                                                
Mar 13 20:43:48 2600Edge openvpn[2622]: rmilton-client/172.X.X.210:39965 Co
nnection reset, restarting [0]                                                       
Mar 13 20:43:50 2600Edge ddclient[3364]: FAILED:   updating DNS.Name.net: ba
dauth: Bad authorization (username or password)

So, I need to recreate the client-key for the vtun1?

I can't use an already existing key? I don't understand.

TinCanTech

Focus on one problem at a time ..

This looks obvious:

2600 wroteBad authorization (username or password)

2600

Certainly. However, I used the same key. Do I need to have separate TLS setting for vtun1?