Hi,
I have a client.ovpn file I received which is to be used to connect to the server. However, I needed to add DNS and Domains to is as well. I appended the following code at end of the client.ovpn file
script-security 2
dhcp-option DNS 10.104.21.31
dhcp-option DOMAIN sysint.local
dhcp-option DOMAIN development.local
dhcp-option DOMAIN bl.internal.xyz.com
dhcp-option DOMAIN bb.internal.xyz.com
dhcp-option DOMAIN internal.xyz.com
dhcp-option DOMAIN xyz.local
dhcp-option DOMAIN xyz.local
dhcp-option DOMAIN production.local
Following is the log generated while I try connecting
Tue Jun 13 11:42:30 2017 OpenVPN 2.4.2 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 11 2017
Tue Jun 13 11:42:30 2017 library versions: OpenSSL 1.0.1e-fips 11 Feb 2013, LZO 2.06
Enter Auth Username: prchoudh
Enter Auth Password: **********
Tue Jun 13 11:42:36 2017 WARNING: --ns-cert-type is DEPRECATED. Use --remote-cert-tls instead.
Tue Jun 13 11:42:36 2017 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jun 13 11:42:36 2017 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jun 13 11:42:42 2017 TCP/UDP: Preserving recently used remote address: [AF_INET]9.184.5.10:443
Tue Jun 13 11:42:42 2017 Socket Buffers: R=[87380->200000] S=[16384->200000]
Tue Jun 13 11:42:42 2017 Attempting to establish TCP connection with [AF_INET]9.184.5.10:443 [nonblock]
Tue Jun 13 11:42:43 2017 TCP connection established with [AF_INET]9.184.5.10:443
Tue Jun 13 11:42:43 2017 TCP_CLIENT link local: (not bound)
Tue Jun 13 11:42:43 2017 TCP_CLIENT link remote: [AF_INET]9.184.5.10:443
Tue Jun 13 11:42:43 2017 TLS: Initial packet from [AF_INET]9.184.5.10:443, sid=93f77dc8 ff0bf781
Tue Jun 13 11:42:43 2017 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Jun 13 11:42:43 2017 VERIFY OK: depth=1, CN=OpenVPN CA
Tue Jun 13 11:42:43 2017 VERIFY OK: nsCertType=SERVER
Tue Jun 13 11:42:43 2017 VERIFY OK: depth=0, CN=OpenVPN Server
Tue Jun 13 11:42:43 2017 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Jun 13 11:42:43 2017 [OpenVPN Server] Peer Connection Initiated with [AF_INET]9.184.5.10:443
Tue Jun 13 11:42:44 2017 SENT CONTROL [OpenVPN Server]: 'PUSH_REQUEST' (status=1)
Tue Jun 13 11:42:44 2017 PUSH: Received control message: 'PUSH_REPLY,explicit-exit-notify,topology subnet,route-delay 5 30,dhcp-pre-release,dhcp-renew,dhcp-release,route-metric 101,ping 12,ping-restart 50,socket-flags TCP_NODELAY,auth-tokenSESS_ID,comp-lzo yes,redirect-private def1,redirect-private bypass-dhcp,redirect-private autolocal,route-gateway 10.104.26.1,route 108.168.188.140,route 158.85.21.74,route 169.38.87.144 255.255.255.240,route 119.81.110.128 255.255.255.224,route 10.116.47.128 255.255.255.192,route 10.116.55.192 255.255.255.192,route 10.117.232.192 255.255.255.192,route 10.121.176.64 255.255.255.192,route 88.205.104.128 255.255.255.192,route 59.144.107.0 255.255.255.128,route 208.76.128.0 255.255.248.0,route 10.1.0.0 255.255.0.0,route 10.2.0.0 255.255.0.0,route 10.104.0.0 255.255.0.0,dhcp-option DNS 10.104.21.31,dhcp-option DNS 10.1.20.97,register-dns,block-ipv6,ifconfig 10.104.26.6 255.255.254.0'
Tue Jun 13 11:42:44 2017 Option 'explicit-exit-notify' in [PUSH-OPTIONS]:1 is ignored by previous <connection> blocks
Tue Jun 13 11:42:44 2017 Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:4: dhcp-pre-release (2.4.2)
Tue Jun 13 11:42:44 2017 Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:5: dhcp-renew (2.4.2)
Tue Jun 13 11:42:44 2017 Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:6: dhcp-release (2.4.2)
Tue Jun 13 11:42:44 2017 Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:33: register-dns (2.4.2)
Tue Jun 13 11:42:44 2017 Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:34: block-ipv6 (2.4.2)
Tue Jun 13 11:42:44 2017 OPTIONS IMPORT: timers and/or timeouts modified
Tue Jun 13 11:42:44 2017 OPTIONS IMPORT: --explicit-exit-notify can only be used with --proto udp
Tue Jun 13 11:42:44 2017 OPTIONS IMPORT: compression parms modified
Tue Jun 13 11:42:44 2017 OPTIONS IMPORT: --socket-flags option modified
Tue Jun 13 11:42:44 2017 Socket flags: TCP_NODELAY=1 succeeded
Tue Jun 13 11:42:44 2017 OPTIONS IMPORT: --ifconfig/up options modified
Tue Jun 13 11:42:44 2017 OPTIONS IMPORT: route options modified
Tue Jun 13 11:42:44 2017 OPTIONS IMPORT: route-related options modified
Tue Jun 13 11:42:44 2017 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Jun 13 11:42:44 2017 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jun 13 11:42:44 2017 WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Tue Jun 13 11:42:44 2017 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jun 13 11:42:44 2017 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jun 13 11:42:44 2017 WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Tue Jun 13 11:42:44 2017 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jun 13 11:42:44 2017 WARNING: cipher with small block size in use, reducing reneg-bytes to 64MB to mitigate SWEET32 attacks.
Tue Jun 13 11:42:44 2017 ROUTE_GATEWAY 9.109.246.1/255.255.254.0 IFACE=wlp4s0 HWADDR=14:ab:c5:01:95:64
Tue Jun 13 11:42:44 2017 TUN/TAP device tun0 opened
Tue Jun 13 11:42:44 2017 TUN/TAP TX queue length set to 100
Tue Jun 13 11:42:44 2017 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Tue Jun 13 11:42:44 2017 /sbin/ip link set dev tun0 up mtu 1500
Tue Jun 13 11:42:44 2017 /sbin/ip addr add dev tun0 10.104.26.6/23 broadcast 10.104.27.255
Tue Jun 13 11:42:49 2017 ROUTE remote_host is NOT LOCAL
Tue Jun 13 11:42:49 2017 /sbin/ip route add 9.184.5.10/32 via 9.109.246.1
Tue Jun 13 11:42:49 2017 /sbin/ip route add 108.168.188.140/32 metric 101 via 10.104.26.1
Tue Jun 13 11:42:49 2017 /sbin/ip route add 158.85.21.74/32 metric 101 via 10.104.26.1
Tue Jun 13 11:42:49 2017 /sbin/ip route add 169.38.87.144/28 metric 101 via 10.104.26.1
Tue Jun 13 11:42:49 2017 /sbin/ip route add 119.81.110.128/27 metric 101 via 10.104.26.1
Tue Jun 13 11:42:49 2017 /sbin/ip route add 10.116.47.128/26 metric 101 via 10.104.26.1
Tue Jun 13 11:42:49 2017 /sbin/ip route add 10.116.55.192/26 metric 101 via 10.104.26.1
Tue Jun 13 11:42:49 2017 /sbin/ip route add 10.117.232.192/26 metric 101 via 10.104.26.1
Tue Jun 13 11:42:49 2017 /sbin/ip route add 10.121.176.64/26 metric 101 via 10.104.26.1
Tue Jun 13 11:42:49 2017 /sbin/ip route add 88.205.104.128/26 metric 101 via 10.104.26.1
Tue Jun 13 11:42:49 2017 /sbin/ip route add 59.144.107.0/25 metric 101 via 10.104.26.1
Tue Jun 13 11:42:49 2017 /sbin/ip route add 208.76.128.0/21 metric 101 via 10.104.26.1
Tue Jun 13 11:42:49 2017 /sbin/ip route add 10.1.0.0/16 metric 101 via 10.104.26.1
Tue Jun 13 11:42:49 2017 /sbin/ip route add 10.2.0.0/16 metric 101 via 10.104.26.1
Tue Jun 13 11:42:49 2017 /sbin/ip route add 10.104.0.0/16 metric 101 via 10.104.26.1
Tue Jun 13 11:42:49 2017 Initialization Sequence Completed
Even though the Initialization sequence shows as completed, I'm unable to access the resources which should have been available had vpn connected successfully.
I'm using RHEL 7.3 OS.
Is there something I've missed of done wrong?
Thank you.
