Hello,
I have an openVPN Server running on a LEDE Router and two openVPN Clients as LEDE Routers as well (But the fact that it is runnning on routers is not the problem).
I am having a perfect connection when only one client is connected, everything works fine. But as soon as the second client connects, the first one looses its connection. Then, after the defined "keepalive" time the first client reconnects and kicks out the second, ending up in an alternating connection to one of the two clients.
I made two set of client keys using "build-key-pkcs12" (Don't get fooled by my names: "my-client-3" ist the first client and "my-client-4" is the second).
What am I missing?
Additional Information:
I am using tap as this is a connection between two gigabit ISP WAN-Ports in one house (don't have access to the wires, neither can I lay some) and I want to stream music, play lan games, use mDNS etc.).
Here are the configs (Please note, I changed the public ips to "1.2.3.<Server/Client3/4>"):
config openvpn 'WGvpnTUN'
option verb '4'
option port '1194'
option proto 'udp'
option keepalive '10 120'
option ca '/etc/openvpn/ca.crt'
option cert '/etc/openvpn/my-server.crt'
option key '/etc/openvpn/my-server.key'
option dh '/etc/openvpn/dh2048.pem'
option log 'openvpn.log'
option tls_server '1'
option enabled '1'
option dev 'tap0'
option 'comp_lzo' 'yes'
option cipher 'AES-256-CBC'
config openvpn 'WGvpnTUN'
option enabled '1'
option log 'openvpn.log'
option verb '4'
option client '1'
option dev 'tap0'
option dev_type 'tap'
option proto 'udp'
option resolv_retry 'infinite'
option nobind '1'
option ca '/etc/openvpn/ca.crt'
option cert '/etc/openvpn/my-client-3.crt'
option key '/etc/openvpn/my-client-3.key'
option remote_cert_tls 'server'
option tls_client '1'
option cipher 'AES-256-CBC'
option remote '1.2.3.Server'
option port '1194'
option 'comp_lzo' 'yes'
option keepalive '10 120'
config openvpn 'WGvpnTUN'
option enabled '1'
option log 'openvpn.log'
option verb '4'
option client '1'
option dev 'tap0'
option dev_type 'tap'
option proto 'udp'
option resolv_retry 'infinite'
option nobind '1'
option ca '/etc/openvpn/ca.crt'
option cert '/etc/openvpn/my-client-4.crt'
option key '/etc/openvpn/my-client-4.key'
option remote_cert_tls 'server'
option tls_client '1'
option cipher 'AES-256-CBC'
option remote '1.2.3.4'
option port '1194'
option 'comp_lzo' 'yes'
option keepalive '10 120'
Here are the logs:
Server Log:
Thu Apr 27 12:24:12 2017 us=617582 TLS: new session incoming connection from [AF_INET]1.2.3.Client4:43781
Thu Apr 27 12:24:12 2017 us=878160 VERIFY OK: depth=1, C=De, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=WG-Server, name=EasyRSA, emailAddress=me@myhost.mydomain
Thu Apr 27 12:24:12 2017 us=887626 VERIFY OK: depth=0, C=DE, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=my-client-4, name=EasyRSA, emailAddress=me@myhost.mydomain
Thu Apr 27 12:24:12 2017 us=908017 peer info: IV_VER=2.4.0
Thu Apr 27 12:24:12 2017 us=908301 peer info: IV_PLAT=linux
Thu Apr 27 12:24:12 2017 us=908542 peer info: IV_PROTO=2
Thu Apr 27 12:24:12 2017 us=908779 peer info: IV_NCP=2
Thu Apr 27 12:24:12 2017 us=909014 peer info: IV_LZ4=1
Thu Apr 27 12:24:12 2017 us=909251 peer info: IV_LZ4v2=1
Thu Apr 27 12:24:12 2017 us=909487 peer info: IV_LZO=1
Thu Apr 27 12:24:12 2017 us=909751 peer info: IV_COMP_STUB=1
Thu Apr 27 12:24:12 2017 us=910000 peer info: IV_COMP_STUBv2=1
Thu Apr 27 12:24:12 2017 us=910240 peer info: IV_TCPNL=1
Thu Apr 27 12:24:12 2017 us=911447 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Apr 27 12:24:12 2017 us=911740 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 27 12:24:12 2017 us=911986 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Apr 27 12:24:12 2017 us=912249 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 27 12:24:12 2017 us=912615 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Thu Apr 27 12:24:12 2017 us=913822 TLS: tls_multi_process: untrusted session promoted to trusted
Thu Apr 27 12:24:12 2017 us=914877 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Apr 27 12:24:12 2017 us=915261 [my-client-4] Peer Connection Initiated with [AF_INET]1.2.3.Client4:43781
Thu Apr 27 12:24:13 2017 us=439503 PUSH: Received control message: 'PUSH_REQUEST'
Thu Apr 27 12:24:13 2017 us=439882 SENT CONTROL [my-client-4]: 'PUSH_REPLY,peer-id 0' (status=1)
Thu Apr 27 12:24:17 2017 us=447925 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:53333 [0]
Thu Apr 27 12:24:18 2017 us=447863 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:53333 [0]
Thu Apr 27 12:24:19 2017 us=447869 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:53333 [0]
Thu Apr 27 12:24:22 2017 us=788791 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:53333 [0]
Thu Apr 27 12:24:23 2017 us=787920 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:53333 [0]
Thu Apr 27 12:24:24 2017 us=787926 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:53333 [0]
Thu Apr 27 12:24:28 2017 us=296978 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:53333 [0]
Thu Apr 27 12:24:29 2017 us=287902 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:53333 [0]
Thu Apr 27 12:24:30 2017 us=288257 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:53333 [0]
Thu Apr 27 12:24:38 2017 us=563960 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:53333 [0]
Thu Apr 27 12:24:46 2017 us=917009 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:53333 [0]
Thu Apr 27 12:24:54 2017 us=317161 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:53333 [0]
Thu Apr 27 12:25:02 2017 us=787566 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:53333 [0]
Thu Apr 27 12:25:11 2017 us=27528 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:53333 [0]
Thu Apr 27 12:25:19 2017 us=524488 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:53333 [0]
Thu Apr 27 12:25:27 2017 us=777045 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:53333 [0]
Thu Apr 27 12:25:36 2017 us=147775 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:53333 [0]
Thu Apr 27 12:25:44 2017 us=378943 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:53333 [0]
Thu Apr 27 12:25:52 2017 us=467787 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:53333 [0]
Thu Apr 27 12:26:00 2017 us=532333 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:53333 [0]
Thu Apr 27 12:26:08 2017 us=556697 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:53333 [0]
Thu Apr 27 12:26:15 2017 us=759654 TLS: new session incoming connection from [AF_INET]1.2.3.Client3:35737
Thu Apr 27 12:26:16 2017 us=36366 VERIFY OK: depth=1, C=De, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=WG-Server, name=EasyRSA, emailAddress=me@myhost.mydomain
Thu Apr 27 12:26:16 2017 us=47384 VERIFY OK: depth=0, C=DE, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=my-client-3, name=EasyRSA, emailAddress=me@myhost.mydomain
Thu Apr 27 12:26:16 2017 us=66790 peer info: IV_VER=2.4.0
Thu Apr 27 12:26:16 2017 us=67073 peer info: IV_PLAT=linux
Thu Apr 27 12:26:16 2017 us=67312 peer info: IV_PROTO=2
Thu Apr 27 12:26:16 2017 us=67548 peer info: IV_NCP=2
Thu Apr 27 12:26:16 2017 us=67786 peer info: IV_LZ4=1
Thu Apr 27 12:26:16 2017 us=68023 peer info: IV_LZ4v2=1
Thu Apr 27 12:26:16 2017 us=68261 peer info: IV_LZO=1
Thu Apr 27 12:26:16 2017 us=68502 peer info: IV_COMP_STUB=1
Thu Apr 27 12:26:16 2017 us=68744 peer info: IV_COMP_STUBv2=1
Thu Apr 27 12:26:16 2017 us=68980 peer info: IV_TCPNL=1
Thu Apr 27 12:26:16 2017 us=70186 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Apr 27 12:26:16 2017 us=70531 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 27 12:26:16 2017 us=70786 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Apr 27 12:26:16 2017 us=71049 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 27 12:26:16 2017 us=71413 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Thu Apr 27 12:26:16 2017 us=72951 TLS: tls_multi_process: untrusted session promoted to trusted
Thu Apr 27 12:26:16 2017 us=74012 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Apr 27 12:26:16 2017 us=74396 [my-client-3] Peer Connection Initiated with [AF_INET]1.2.3.Client3:35737
Thu Apr 27 12:26:17 2017 us=157618 PUSH: Received control message: 'PUSH_REQUEST'
Thu Apr 27 12:26:17 2017 us=158001 SENT CONTROL [my-client-3]: 'PUSH_REPLY,peer-id 0' (status=1)
Thu Apr 27 12:26:24 2017 us=439388 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client4:43781 [0]
Thu Apr 27 12:26:36 2017 us=465848 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client4:43781 [0]
Thu Apr 27 12:26:48 2017 us=471640 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client4:43781 [0]
Thu Apr 27 12:27:00 2017 us=472222 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client4:43781 [0]
Thu Apr 27 12:27:12 2017 us=472419 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client4:43781 [0]
Thu Apr 27 12:27:24 2017 us=513605 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client4:43781 [0]
Thu Apr 27 12:27:36 2017 us=505980 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client4:43781 [0]
Thu Apr 27 12:27:48 2017 us=547085 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client4:43781 [0]
Thu Apr 27 12:28:00 2017 us=539251 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client4:43781 [0]
Thu Apr 27 12:28:12 2017 us=538436 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client4:43781 [0]
Thu Apr 27 12:28:20 2017 us=801005 TLS: new session incoming connection from [AF_INET]1.2.3.Client4:33407
Thu Apr 27 12:28:21 2017 us=61399 VERIFY OK: depth=1, C=De, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=WG-Server, name=EasyRSA, emailAddress=me@myhost.mydomain
Thu Apr 27 12:28:21 2017 us=72924 VERIFY OK: depth=0, C=DE, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=my-client-4, name=EasyRSA, emailAddress=me@myhost.mydomain
Thu Apr 27 12:28:21 2017 us=93121 peer info: IV_VER=2.4.0
Thu Apr 27 12:28:21 2017 us=93406 peer info: IV_PLAT=linux
Thu Apr 27 12:28:21 2017 us=93644 peer info: IV_PROTO=2
Thu Apr 27 12:28:21 2017 us=93881 peer info: IV_NCP=2
Thu Apr 27 12:28:21 2017 us=94118 peer info: IV_LZ4=1
Thu Apr 27 12:28:21 2017 us=94356 peer info: IV_LZ4v2=1
Thu Apr 27 12:28:21 2017 us=94592 peer info: IV_LZO=1
Thu Apr 27 12:28:21 2017 us=94832 peer info: IV_COMP_STUB=1
Thu Apr 27 12:28:21 2017 us=95073 peer info: IV_COMP_STUBv2=1
Thu Apr 27 12:28:21 2017 us=95576 peer info: IV_TCPNL=1
Thu Apr 27 12:28:21 2017 us=96748 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Apr 27 12:28:21 2017 us=97037 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 27 12:28:21 2017 us=97285 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Apr 27 12:28:21 2017 us=97547 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 27 12:28:21 2017 us=97913 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Thu Apr 27 12:28:21 2017 us=99103 TLS: tls_multi_process: untrusted session promoted to trusted
Thu Apr 27 12:28:21 2017 us=100169 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Apr 27 12:28:21 2017 us=100892 [my-client-4] Peer Connection Initiated with [AF_INET]1.2.3.Client4:33407
Thu Apr 27 12:28:22 2017 us=98923 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:35737 [0]
Thu Apr 27 12:28:22 2017 us=111500 PUSH: Received control message: 'PUSH_REQUEST'
Thu Apr 27 12:28:22 2017 us=111883 SENT CONTROL [my-client-4]: 'PUSH_REPLY,peer-id 0' (status=1)
Thu Apr 27 12:28:23 2017 us=98954 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:35737 [0]
Thu Apr 27 12:28:24 2017 us=98901 TLS Error: local/remote TLS keys are out of sync: [AF_INET]1.2.3.Client3:35737 [0]
Client 4 Log
Thu Apr 27 12:24:07 2017 us=564630 [WG-Server] Inactivity timeout (--ping-restart), restarting
Thu Apr 27 12:24:07 2017 us=566194 TCP/UDP: Closing socket
Thu Apr 27 12:24:07 2017 us=566614 Closing TUN/TAP interface
Thu Apr 27 12:24:07 2017 us=609097 SIGUSR1[soft,ping-restart] received, process restarting
Thu Apr 27 12:24:07 2017 us=609403 Restart pause, 5 second(s)
Thu Apr 27 12:24:12 2017 us=613639 LZO compression initializing
Thu Apr 27 12:24:12 2017 us=614597 Control Channel MTU parms [ L:1654 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Thu Apr 27 12:24:12 2017 us=615013 Data Channel MTU parms [ L:1654 D:1450 EF:122 EB:411 ET:32 EL:3 ]
Thu Apr 27 12:24:12 2017 us=615423 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Thu Apr 27 12:24:12 2017 us=615644 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Thu Apr 27 12:24:12 2017 us=615898 TCP/UDP: Preserving recently used remote address: [AF_INET]1.2.3.Server:1194
Thu Apr 27 12:24:12 2017 us=616149 Socket Buffers: R=[163840->163840] S=[163840->163840]
Thu Apr 27 12:24:12 2017 us=616369 UDP link local: (not bound)
Thu Apr 27 12:24:12 2017 us=616613 UDP link remote: [AF_INET]1.2.3.Server:1194
Thu Apr 27 12:24:12 2017 us=618117 TLS: Initial packet from [AF_INET]1.2.3.Server:1194, sid=d66e061e ebefe609
Thu Apr 27 12:24:12 2017 us=727726 VERIFY OK: depth=1, C=De, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=WG-Server, name=EasyRSA, emailAddress=me@myhost.mydomain
Thu Apr 27 12:24:12 2017 us=732460 Validating certificate key usage
Thu Apr 27 12:24:12 2017 us=732699 ++ Certificate has key usage 00a0, expects 00a0
Thu Apr 27 12:24:12 2017 us=732909 VERIFY KU OK
Thu Apr 27 12:24:12 2017 us=733162 Validating certificate extended key usage
Thu Apr 27 12:24:12 2017 us=733663 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Thu Apr 27 12:24:12 2017 us=733931 VERIFY EKU OK
Thu Apr 27 12:24:12 2017 us=734150 VERIFY OK: depth=0, C=DE, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=WG-Server, name=EasyRSA, emailAddress=me@myhost.mydomain
Thu Apr 27 12:24:12 2017 us=914660 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Apr 27 12:24:12 2017 us=915041 [WG-Server] Peer Connection Initiated with [AF_INET]1.2.3.Server:1194
Thu Apr 27 12:24:13 2017 us=438124 Key [AF_INET]1.2.3.Server:1194 [0] not initialized (yet), dropping packet.
Thu Apr 27 12:24:13 2017 us=438461 SENT CONTROL [WG-Server]: 'PUSH_REQUEST' (status=1)
Thu Apr 27 12:24:13 2017 us=440547 PUSH: Received control message: 'PUSH_REPLY,peer-id 0'
Thu Apr 27 12:24:13 2017 us=440913 OPTIONS IMPORT: peer-id set
Thu Apr 27 12:24:13 2017 us=441139 OPTIONS IMPORT: adjusting link_mtu to 1657
Thu Apr 27 12:24:13 2017 us=441423 Data Channel MTU parms [ L:1593 D:1450 EF:61 EB:411 ET:32 EL:3 ]
Thu Apr 27 12:24:13 2017 us=442403 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Apr 27 12:24:13 2017 us=442686 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 27 12:24:13 2017 us=442934 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Apr 27 12:24:13 2017 us=443194 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 27 12:24:13 2017 us=466602 TUN/TAP device tap0 opened
Thu Apr 27 12:24:13 2017 us=466895 TUN/TAP TX queue length set to 100
Thu Apr 27 12:24:13 2017 us=467330 Initialization Sequence Completed
Thu Apr 27 12:28:15 2017 us=738010 [WG-Server] Inactivity timeout (--ping-restart), restarting
Thu Apr 27 12:28:15 2017 us=739706 TCP/UDP: Closing socket
Thu Apr 27 12:28:15 2017 us=740141 Closing TUN/TAP interface
Thu Apr 27 12:28:15 2017 us=782568 SIGUSR1[soft,ping-restart] received, process restarting
Thu Apr 27 12:28:15 2017 us=782871 Restart pause, 5 second(s)
Thu Apr 27 12:28:20 2017 us=796995 LZO compression initializing
Thu Apr 27 12:28:20 2017 us=798380 Control Channel MTU parms [ L:1654 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Thu Apr 27 12:28:20 2017 us=798817 Data Channel MTU parms [ L:1654 D:1450 EF:122 EB:411 ET:32 EL:3 ]
Thu Apr 27 12:28:20 2017 us=799232 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Thu Apr 27 12:28:20 2017 us=799456 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Thu Apr 27 12:28:20 2017 us=799713 TCP/UDP: Preserving recently used remote address: [AF_INET]1.2.3.Server:1194
Thu Apr 27 12:28:20 2017 us=799966 Socket Buffers: R=[163840->163840] S=[163840->163840]
Thu Apr 27 12:28:20 2017 us=800237 UDP link local: (not bound)
Thu Apr 27 12:28:20 2017 us=800495 UDP link remote: [AF_INET]1.2.3.Server:1194
Thu Apr 27 12:28:20 2017 us=801954 TLS: Initial packet from [AF_INET]1.2.3.Server:1194, sid=0a74823d 80630709
Thu Apr 27 12:28:20 2017 us=911904 VERIFY OK: depth=1, C=De, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=WG-Server, name=EasyRSA, emailAddress=me@myhost.mydomain
Thu Apr 27 12:28:20 2017 us=916592 Validating certificate key usage
Thu Apr 27 12:28:20 2017 us=916834 ++ Certificate has key usage 00a0, expects 00a0
Thu Apr 27 12:28:20 2017 us=917045 VERIFY KU OK
Thu Apr 27 12:28:20 2017 us=917297 Validating certificate extended key usage
Thu Apr 27 12:28:20 2017 us=917524 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Thu Apr 27 12:28:20 2017 us=917737 VERIFY EKU OK
Thu Apr 27 12:28:20 2017 us=918036 VERIFY OK: depth=0, C=DE, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=WG-Server, name=EasyRSA, emailAddress=me@myhost.mydomain
Thu Apr 27 12:28:21 2017 us=100292 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Apr 27 12:28:21 2017 us=100688 [WG-Server] Peer Connection Initiated with [AF_INET]1.2.3.Server:1194
Thu Apr 27 12:28:21 2017 us=103907 Key [AF_INET]1.2.3.Server:1194 [0] not initialized (yet), dropping packet.
Thu Apr 27 12:28:22 2017 us=110709 Key [AF_INET]1.2.3.Server:1194 [0] not initialized (yet), dropping packet.
Thu Apr 27 12:28:22 2017 us=111049 SENT CONTROL [WG-Server]: 'PUSH_REQUEST' (status=1)
Thu Apr 27 12:28:22 2017 us=112957 PUSH: Received control message: 'PUSH_REPLY,peer-id 0'
Thu Apr 27 12:28:22 2017 us=113323 OPTIONS IMPORT: peer-id set
Thu Apr 27 12:28:22 2017 us=113548 OPTIONS IMPORT: adjusting link_mtu to 1657
Thu Apr 27 12:28:22 2017 us=113828 Data Channel MTU parms [ L:1593 D:1450 EF:61 EB:411 ET:32 EL:3 ]
Thu Apr 27 12:28:22 2017 us=114807 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Apr 27 12:28:22 2017 us=115085 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 27 12:28:22 2017 us=115334 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Apr 27 12:28:22 2017 us=115593 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 27 12:28:22 2017 us=139302 TUN/TAP device tap0 opened
Thu Apr 27 12:28:22 2017 us=139597 TUN/TAP TX queue length set to 100
Thu Apr 27 12:28:22 2017 us=140025 Initialization Sequence Completed
Thu Apr 27 12:28:22 2017 us=528624 write UDP: Operation not permitted (code=1)
Thu Apr 27 12:22:13 2017 us=113623 Initialization Sequence Completed
Thu Apr 27 12:26:10 2017 us=708144 [WG-Server] Inactivity timeout (--ping-restart), restarting
Thu Apr 27 12:26:10 2017 us=709758 TCP/UDP: Closing socket
Thu Apr 27 12:26:10 2017 us=710226 Closing TUN/TAP interface
Thu Apr 27 12:26:10 2017 us=753330 SIGUSR1[soft,ping-restart] received, process restarting
Thu Apr 27 12:26:10 2017 us=753634 Restart pause, 5 second(s)
Thu Apr 27 12:26:15 2017 us=758217 LZO compression initializing
Thu Apr 27 12:26:15 2017 us=759190 Control Channel MTU parms [ L:1654 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Thu Apr 27 12:26:15 2017 us=759604 Data Channel MTU parms [ L:1654 D:1450 EF:122 EB:411 ET:32 EL:3 ]
Thu Apr 27 12:26:15 2017 us=760064 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Thu Apr 27 12:26:15 2017 us=760302 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Thu Apr 27 12:26:15 2017 us=760555 TCP/UDP: Preserving recently used remote address: [AF_INET]1.2.3.Server:1194
Thu Apr 27 12:26:15 2017 us=760806 Socket Buffers: R=[163840->163840] S=[163840->163840]
Thu Apr 27 12:26:15 2017 us=761028 UDP link local: (not bound)
Thu Apr 27 12:26:15 2017 us=761273 UDP link remote: [AF_INET]1.2.3.Server:1194
Thu Apr 27 12:26:15 2017 us=762742 TLS: Initial packet from [AF_INET]1.2.3.Server:1194, sid=eff68b7b 7341136f
Thu Apr 27 12:26:15 2017 us=888834 VERIFY OK: depth=1, C=De, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=WG-Server, name=EasyRSA, emailAddress=me@myhost.mydomain
Thu Apr 27 12:26:15 2017 us=893593 Validating certificate key usage
Thu Apr 27 12:26:15 2017 us=893837 ++ Certificate has key usage 00a0, expects 00a0
Thu Apr 27 12:26:15 2017 us=894048 VERIFY KU OK
Thu Apr 27 12:26:15 2017 us=894306 Validating certificate extended key usage
Thu Apr 27 12:26:15 2017 us=894535 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Thu Apr 27 12:26:15 2017 us=894750 VERIFY EKU OK
Thu Apr 27 12:26:15 2017 us=894960 VERIFY OK: depth=0, C=DE, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=WG-Server, name=EasyRSA, emailAddress=me@myhost.mydomain
Thu Apr 27 12:26:16 2017 us=76275 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Apr 27 12:26:16 2017 us=76654 [WG-Server] Peer Connection Initiated with [AF_INET]1.2.3.Server:1194
Thu Apr 27 12:26:17 2017 us=159205 SENT CONTROL [WG-Server]: 'PUSH_REQUEST' (status=1)
Thu Apr 27 12:26:17 2017 us=161281 PUSH: Received control message: 'PUSH_REPLY,peer-id 0'
Thu Apr 27 12:26:17 2017 us=161646 OPTIONS IMPORT: peer-id set
Thu Apr 27 12:26:17 2017 us=161872 OPTIONS IMPORT: adjusting link_mtu to 1657
Thu Apr 27 12:26:17 2017 us=162155 Data Channel MTU parms [ L:1593 D:1450 EF:61 EB:411 ET:32 EL:3 ]
Thu Apr 27 12:26:17 2017 us=163128 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Apr 27 12:26:17 2017 us=163408 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 27 12:26:17 2017 us=163674 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Apr 27 12:26:17 2017 us=163946 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 27 12:26:17 2017 us=187251 TUN/TAP device tap0 opened
Thu Apr 27 12:26:17 2017 us=187539 TUN/TAP TX queue length set to 100
Thu Apr 27 12:26:17 2017 us=188033 Initialization Sequence Completed
Thu Apr 27 12:30:19 2017 us=509917 [WG-Server] Inactivity timeout (--ping-restart), restarting
Thu Apr 27 12:30:19 2017 us=511615 TCP/UDP: Closing socket
Thu Apr 27 12:30:19 2017 us=512048 Closing TUN/TAP interface
Thu Apr 27 12:30:19 2017 us=553894 SIGUSR1[soft,ping-restart] received, process restarting
Thu Apr 27 12:30:19 2017 us=554196 Restart pause, 5 second(s)
Thu Apr 27 12:30:24 2017 us=558539 LZO compression initializing
Thu Apr 27 12:30:24 2017 us=559500 Control Channel MTU parms [ L:1654 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Thu Apr 27 12:30:24 2017 us=560158 Data Channel MTU parms [ L:1654 D:1450 EF:122 EB:411 ET:32 EL:3 ]
Thu Apr 27 12:30:24 2017 us=560596 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Thu Apr 27 12:30:24 2017 us=560821 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Thu Apr 27 12:30:24 2017 us=561077 TCP/UDP: Preserving recently used remote address: [AF_INET]1.2.3.Server:1194
Thu Apr 27 12:30:24 2017 us=561330 Socket Buffers: R=[163840->163840] S=[163840->163840]
Thu Apr 27 12:30:24 2017 us=561552 UDP link local: (not bound)
Thu Apr 27 12:30:24 2017 us=561796 UDP link remote: [AF_INET]1.2.3.Server:1194
Thu Apr 27 12:30:24 2017 us=563260 TLS: Initial packet from [AF_INET]1.2.3.Server:1194, sid=a5ce0d04 37e8d01b
Thu Apr 27 12:30:24 2017 us=674267 VERIFY OK: depth=1, C=De, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=WG-Server, name=EasyRSA, emailAddress=me@myhost.mydomain
Thu Apr 27 12:30:24 2017 us=679029 Validating certificate key usage
Thu Apr 27 12:30:24 2017 us=679271 ++ Certificate has key usage 00a0, expects 00a0
Thu Apr 27 12:30:24 2017 us=679483 VERIFY KU OK
Thu Apr 27 12:30:24 2017 us=679767 Validating certificate extended key usage
Thu Apr 27 12:30:24 2017 us=680051 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Thu Apr 27 12:30:24 2017 us=680268 VERIFY EKU OK
Thu Apr 27 12:30:24 2017 us=680481 VERIFY OK: depth=0, C=DE, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=WG-Server, name=EasyRSA, emailAddress=me@myhost.mydomain
Thu Apr 27 12:30:24 2017 us=862862 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Apr 27 12:30:24 2017 us=863245 [WG-Server] Peer Connection Initiated with [AF_INET]1.2.3.Server:1194
Thu Apr 27 12:30:25 2017 us=989996 SENT CONTROL [WG-Server]: 'PUSH_REQUEST' (status=1)
Thu Apr 27 12:30:25 2017 us=992031 PUSH: Received control message: 'PUSH_REPLY,peer-id 0'
Thu Apr 27 12:30:25 2017 us=992394 OPTIONS IMPORT: peer-id set
Thu Apr 27 12:30:25 2017 us=992621 OPTIONS IMPORT: adjusting link_mtu to 1657
Thu Apr 27 12:30:25 2017 us=992904 Data Channel MTU parms [ L:1593 D:1450 EF:61 EB:411 ET:32 EL:3 ]
Thu Apr 27 12:30:25 2017 us=993913 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Apr 27 12:30:25 2017 us=994198 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 27 12:30:25 2017 us=994447 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Apr 27 12:30:25 2017 us=994708 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 27 12:30:26 2017 us=17939 TUN/TAP device tap0 opened
Thu Apr 27 12:30:26 2017 us=18229 TUN/TAP TX queue length set to 100
Thu Apr 27 12:30:26 2017 us=18660 Initialization Sequence Completed
