Okay 1.) is solved. Add info: What I forgot to write btw.
- Enter the client password, but would result in:
Tue Jun 27 14:21:42 2017 MANAGEMENT: CMD 'password [...]'
Tue Jun 27 14:21:42 2017 SIGUSR1[soft,private-key-password-failure] received, process restarting
Tue Jun 27 14:21:42 2017 MANAGEMENT: >STATE:1498566102,RECONNECTING,private-key-password-failure,,,,,
Tue Jun 27 14:21:42 2017 Restart pause, 5 second(s)
- I deactivated most not essential options on client/server (hardening, dns)
- I did take a look if all names and IP addresses are correct.
- Check if user/passwords use allowed characters:
To protect against a client passing a maliciously formed username or password string, the username string must consist only of these characters: alphanumeric, underbar ('_'), dash ('-'), dot ('.'), or at ('@'). The password string can consist of any printable characters except for CR or LF. Any illegal characters in either the username or password string will be converted to underbar ('_').
- (of course read how to and searched for many pages.
Now the solution was a wrong copied password for certificate creation. Well, I see now it is there, but I guess I didn't believe it expecting something in the config wrong. -.-
3.a) Then I had another error:
Tue Jun 27 14:46:28 2017 TLS: Initial packet from [AF_INET]1.1.1.1:1194, sid=***
Tue Jun 27 14:46:28 2017 VERIFY OK: depth=1, C=changeme1, ST=changeme2, L=changeme3, O=changeme4, OU=changeme5, CN=changeme6, name=changeme7, emailAddress=changeme8
Tue Jun 27 14:46:28 2017 VERIFY KU OK
Tue Jun 27 14:46:28 2017 Validating certificate extended key usage
Tue Jun 27 14:46:28 2017 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Jun 27 14:46:28 2017 VERIFY EKU OK
Tue Jun 27 14:46:28 2017 VERIFY X509NAME ERROR: C=changeme1, ST=changeme2, L=changeme3, O=changeme4, OU=changeme5, CN=changeme6, name=changeme7, emailAddress=changeme8
Tue Jun 27 14:46:28 2017 OpenSSL: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
Tue Jun 27 14:46:28 2017 TLS_ERROR: BIO read tls_read_plaintext error
Tue Jun 27 14:46:28 2017 TLS Error: TLS object -> incoming plaintext read error
Tue Jun 27 14:46:28 2017 TLS Error: TLS handshake failed
Tue Jun 27 14:46:28 2017 SIGUSR1[soft,tls-error] received, process restarting
I played with the verify x509 name, till I just turned that off for now (do I need that with remote-cert-tls server anyway?).
3.b) Log would look now like:
Tue Jun 27 17:00:25 2017 OpenVPN 2.4.3 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Jun 20 2017
Tue Jun 27 17:00:25 2017 Windows version 6.2 (Windows 8 or greater) 64bit
Tue Jun 27 17:00:25 2017 library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.10
Enter Management Password:
Tue Jun 27 17:00:25 2017 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Jun 27 17:00:25 2017 Need hold release from management interface, waiting...
Tue Jun 27 17:00:25 2017 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Jun 27 17:00:25 2017 MANAGEMENT: CMD 'state on'
Tue Jun 27 17:00:25 2017 MANAGEMENT: CMD 'log all on'
Tue Jun 27 17:00:25 2017 MANAGEMENT: CMD 'echo all on'
Tue Jun 27 17:00:25 2017 MANAGEMENT: CMD 'hold off'
Tue Jun 27 17:00:25 2017 MANAGEMENT: CMD 'hold release'
Tue Jun 27 17:00:25 2017 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue Jun 27 17:00:25 2017 MANAGEMENT: CMD 'password [...]'
Tue Jun 27 17:00:25 2017 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Tue Jun 27 17:00:25 2017 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Jun 27 17:00:25 2017 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Tue Jun 27 17:00:25 2017 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Jun 27 17:00:25 2017 TCP/UDP: Preserving recently used remote address: [AF_INET]1.1.1.2:1194
Tue Jun 27 17:00:25 2017 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Jun 27 17:00:25 2017 UDPv4 link local: (not bound)
Tue Jun 27 17:00:25 2017 UDPv4 link remote: [AF_INET]1.1.1.2:1194
Tue Jun 27 17:00:25 2017 MANAGEMENT: >STATE:1498575625,WAIT,,,,,,
Tue Jun 27 17:00:25 2017 MANAGEMENT: >STATE:1498575625,AUTH,,,,,,
Tue Jun 27 17:00:25 2017 TLS: Initial packet from [AF_INET]1.1.1.2:1194, sid=******
Tue Jun 27 17:00:25 2017 VERIFY OK: depth=1, C=changeme1, ST=changeme2, L=changeme3, O=changeme4, OU=changeme5, CN=changeme6, name=changeme7, emailAddress=changeme8
Tue Jun 27 17:00:25 2017 VERIFY KU OK
Tue Jun 27 17:00:25 2017 Validating certificate extended key usage
Tue Jun 27 17:00:25 2017 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Jun 27 17:00:25 2017 VERIFY EKU OK
Tue Jun 27 17:00:25 2017 VERIFY OK: depth=0, C=changeme1, ST=changeme2, L=changeme3, O=changeme4, OU=changeme5, CN=changeme6, name=changeme7, emailAddress=changeme8
Tue Jun 27 17:00:26 2017 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Jun 27 17:00:26 2017 [BanozKG] Peer Connection Initiated with [AF_INET]1.1.1.2:1194
Tue Jun 27 17:00:27 2017 MANAGEMENT: >STATE:1498575627,GET_CONFIG,,,,,,
Tue Jun 27 17:00:27 2017 SENT CONTROL [BanozKG]: 'PUSH_REQUEST' (status=1)
Tue Jun 27 17:00:27 2017 PUSH: Received control message: 'PUSH_REPLY,route 1.1.1.2 255.255.255.0,route 10.0.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.0.0.6 10.0.0.5,peer-id 1,cipher AES-256-GCM'
Tue Jun 27 17:00:27 2017 OPTIONS IMPORT: timers and/or timeouts modified
Tue Jun 27 17:00:27 2017 OPTIONS IMPORT: --ifconfig/up options modified
Tue Jun 27 17:00:27 2017 OPTIONS IMPORT: route options modified
Tue Jun 27 17:00:27 2017 OPTIONS IMPORT: peer-id set
Tue Jun 27 17:00:27 2017 OPTIONS IMPORT: adjusting link_mtu to 1625
Tue Jun 27 17:00:27 2017 OPTIONS IMPORT: data channel crypto options modified
Tue Jun 27 17:00:27 2017 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Jun 27 17:00:27 2017 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Jun 27 17:00:27 2017 interactive service msg_channel=0
Tue Jun 27 17:00:27 2017 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 I=8 HWADDR=00:00:00:00:00:00
Tue Jun 27 17:00:27 2017 open_tun
Tue Jun 27 17:00:27 2017 TAP-WIN32 device [OpenVPN-A] opened: \\.\Global\{23****}.tap
Tue Jun 27 17:00:27 2017 TAP-Windows Driver Version 9.21
Tue Jun 27 17:00:27 2017 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.0.0.6/255.255.255.252 on interface {23******} [DHCP-serv: 10.0.0.5, lease-time: 31536000]
Tue Jun 27 17:00:27 2017 Successful ARP Flush on interface [3] {23****}
Tue Jun 27 17:00:27 2017 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Tue Jun 27 17:00:27 2017 MANAGEMENT: >STATE:1498575627,ASSIGN_IP,,10.0.0.6,,,,
Tue Jun 27 17:00:29 2017 TEST ROUTES: 3/3 succeeded len=2 ret=1 a=0 u/d=up
Tue Jun 27 17:00:29 2017 C:\WINDOWS\system32\route.exe ADD 1.1.1.2 MASK 255.255.255.255 192.168.0.1
Tue Jun 27 17:00:29 2017 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Tue Jun 27 17:00:29 2017 Route addition via IPAPI succeeded [adaptive]
Tue Jun 27 17:00:29 2017 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.0.0.5
Tue Jun 27 17:00:29 2017 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=35 and dwForwardType=4
Tue Jun 27 17:00:29 2017 Route addition via IPAPI succeeded [adaptive]
Tue Jun 27 17:00:29 2017 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.0.0.5
Tue Jun 27 17:00:29 2017 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=35 and dwForwardType=4
Tue Jun 27 17:00:29 2017 Route addition via IPAPI succeeded [adaptive]
Tue Jun 27 17:00:29 2017 MANAGEMENT: >STATE:1498575629,ADD_ROUTES,,,,,,
Tue Jun 27 17:00:29 2017 C:\WINDOWS\system32\route.exe ADD 1.1.1.2 MASK 255.255.255.0 10.0.0.5
Tue Jun 27 17:00:29 2017 Warning: address 1.1.1.2 is not a network address in relation to netmask 255.255.255.0
Tue Jun 27 17:00:29 2017 ROUTE: route addition failed using CreateIpForwardEntry: Falscher Parameter. [status=87 if_index=3]
Tue Jun 27 17:00:29 2017 Route addition via IPAPI failed [adaptive]
Tue Jun 27 17:00:29 2017 Route addition fallback to route.exe
Tue Jun 27 17:00:29 2017 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Jun 27 17:00:29 2017 C:\WINDOWS\system32\route.exe ADD 10.0.0.1 MASK 255.255.255.255 10.0.0.5
Tue Jun 27 17:00:29 2017 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=35 and dwForwardType=4
Tue Jun 27 17:00:29 2017 Route addition via IPAPI succeeded [adaptive]
Tue Jun 27 17:00:29 2017 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Jun 27 17:00:29 2017 Initialization Sequence Completed
Tue Jun 27 17:00:29 2017 MANAGEMENT: >STATE:1498575629,CONNECTED,SUCCESS,10.0.0.6,1.1.1.2,1194,,
I am not that into the routing. While I am somewhat connected, I can't load any pages, so what to do now? (did test with and without route-method exe)
