NOTE to board admin:
I tried to use the prescribed oconf tag for the configuration data but it failed to work, so I reverted to code tags instead.
My problem:
OpenVPN 2.4.4 server on Windows 2016 in process of being set up.
Configuration file server.ovpn:
;local a.b.c.d #I want to be bound on Ethernet and not knowing the IP address beforehand
port 1199
proto udp
dev tun
;dev-node MyTap
ca "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\server.crt"
key "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\server.key" # This file should be kept secret
dh "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\dh4096.pem"
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
push "route 192.168.119.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
;client-to-client
duplicate-cn
keepalive 10 120
tls-auth "C:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ta.key" 0 # This file is secret
cipher AES-256-CBC
;compress lz4-v2
;push "compress lz4-v2"
comp-lzo
max-clients 20
persist-key
persist-tun
status openvpn-status.log
;log openvpn.log
log-append "C:\\Program Files\\OpenVPN\\log\\openvpn.log"
verb 4
;mute 20
explicit-exit-notify 1
When I connect to this server from my Android phone I get a number of error lines in the server log as follows:
Tue Oct 24 14:42:29 2017 us=80146 MULTI: multi_create_instance called
Tue Oct 24 14:42:29 2017 us=80146 95.204.77.24 Re-using SSL/TLS context
Tue Oct 24 14:42:29 2017 us=80146 95.204.77.24 LZO compression initializing
Tue Oct 24 14:42:29 2017 us=80146 95.204.77.24 Control Channel MTU parms [ L:1622 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Tue Oct 24 14:42:29 2017 us=80146 95.204.77.24 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Tue Oct 24 14:42:29 2017 us=80146 95.204.77.24 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Tue Oct 24 14:42:29 2017 us=80146 95.204.77.24 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Tue Oct 24 14:42:29 2017 us=80146 95.204.77.24 TLS: Initial packet from [AF_INET6]::ffff:95.204.77.24:34507, sid=a7816099 33714694
Tue Oct 24 14:42:31 2017 us=861236 95.204.77.24 VERIFY OK: depth=1, C=US, ST=TX, L=Austin, O=AGI, OU=IT, CN=AGI_OpenVPN, name=AGI_OpenVPN, emailAddress=bosse@agiusa.com
Tue Oct 24 14:42:31 2017 us=861236 95.204.77.24 VERIFY OK: depth=0, C=US, ST=TX, L=Austin, O=AGI, OU=IT, CN=BosseAGI, name=BosseAGI, emailAddress=bosse@agiusa.com
Tue Oct 24 14:42:31 2017 us=861236 95.204.77.24 PID_ERR replay-window backtrack occurred [1] [TLS_WRAP-0] [00222222] 1508848948:8 1508848948:7 t=1508848951[0] r=[-2,64,15,1,1] sl=[56,8,64,528]
Tue Oct 24 14:42:31 2017 us=861236 95.204.77.24 PID_ERR replay [1] [TLS_WRAP-0] [00222222] 1508848948:8 1508848948:7 t=1508848951[0] r=[-2,64,15,1,1] sl=[56,8,64,528]
Tue Oct 24 14:42:31 2017 us=861236 95.204.77.24 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #7 / time = (1508848948) Tue Oct 24 14:42:28 2017 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Tue Oct 24 14:42:31 2017 us=861236 95.204.77.24 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:95.204.77.24:34507
Tue Oct 24 14:42:31 2017 us=861236 95.204.77.24 PID_ERR replay [0] [TLS_WRAP-0] [00222222] 1508848948:8 1508848948:8 t=1508848951[0] r=[-2,64,15,1,1] sl=[56,8,64,528]
Tue Oct 24 14:42:31 2017 us=861236 95.204.77.24 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #8 / time = (1508848948) Tue Oct 24 14:42:28 2017 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Tue Oct 24 14:42:31 2017 us=861236 95.204.77.24 TLS Error: incoming packet authentication failed from [AF_INET6]::ffff:95.204.77.24:34507
Tue Oct 24 14:42:31 2017 us=939186 95.204.77.24 peer info: IV_GUI_VER=net.openvpn.connect.android_1.1.17-76
Tue Oct 24 14:42:31 2017 us=939186 95.204.77.24 peer info: IV_VER=3.0.12
Tue Oct 24 14:42:31 2017 us=939186 95.204.77.24 peer info: IV_PLAT=android
Tue Oct 24 14:42:31 2017 us=939186 95.204.77.24 peer info: IV_NCP=2
Tue Oct 24 14:42:31 2017 us=939186 95.204.77.24 peer info: IV_TCPNL=1
Tue Oct 24 14:42:31 2017 us=939186 95.204.77.24 peer info: IV_PROTO=2
Tue Oct 24 14:42:31 2017 us=939186 95.204.77.24 peer info: IV_LZO=1
Tue Oct 24 14:42:31 2017 us=971255 95.204.77.24 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
Tue Oct 24 14:42:31 2017 us=971255 95.204.77.24 [BosseAGI] Peer Connection Initiated with [AF_INET6]::ffff:95.204.77.24:34507
Tue Oct 24 14:42:31 2017 us=971255 BosseAGI/95.204.77.24 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Tue Oct 24 14:42:31 2017 us=971255 BosseAGI/95.204.77.24 MULTI: Learn: 10.8.0.2 -> BosseAGI/95.204.77.24
Tue Oct 24 14:42:31 2017 us=971255 BosseAGI/95.204.77.24 MULTI: primary virtual IP for BosseAGI/95.204.77.24: 10.8.0.2
Tue Oct 24 14:42:32 2017 us=17211 BosseAGI/95.204.77.24 PUSH: Received control message: 'PUSH_REQUEST'
Tue Oct 24 14:42:32 2017 us=17211 BosseAGI/95.204.77.24 SENT CONTROL [BosseAGI]: 'PUSH_REPLY,route 192.168.119.0 255.255.255.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Tue Oct 24 14:42:32 2017 us=17211 BosseAGI/95.204.77.24 Data Channel: using negotiated cipher 'AES-256-GCM'
Tue Oct 24 14:42:32 2017 us=17211 BosseAGI/95.204.77.24 Data Channel MTU parms [ L:1550 D:1450 EF:50 EB:406 ET:0 EL:3 ]
Tue Oct 24 14:42:32 2017 us=17211 BosseAGI/95.204.77.24 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Oct 24 14:42:32 2017 us=17211 BosseAGI/95.204.77.24 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Oct 24 14:42:32 2017 us=267237 BosseAGI/95.204.77.24 MULTI: bad source address from client [192.168.117.212], packet dropped
Tue Oct 24 14:42:32 2017 us=267237 BosseAGI/95.204.77.24 MULTI: bad source address from client [192.168.117.212], packet dropped
Tue Oct 24 14:42:32 2017 us=267237 BosseAGI/95.204.77.24 MULTI: bad source address from client [192.168.117.212], packet dropped
Tue Oct 24 14:42:32 2017 us=267237 BosseAGI/95.204.77.24 MULTI: bad source address from client [192.168.117.212], packet dropped
Tue Oct 24 14:42:32 2017 us=549253 BosseAGI/95.204.77.24 MULTI: bad source address from client [192.168.117.212], packet dropped
Tue Oct 24 14:42:33 2017 us=17267 BosseAGI/95.204.77.24 MULTI: bad source address from client [192.168.117.212], packet dropped
Tue Oct 24 14:42:33 2017 us=939188 BosseAGI/95.204.77.24 MULTI: bad source address from client [192.168.117.212], packet dropped
Tue Oct 24 14:42:35 2017 us=783343 BosseAGI/95.204.77.24 MULTI: bad source address from client [192.168.117.212], packet dropped
Tue Oct 24 14:42:39 2017 us=470504 BosseAGI/95.204.77.24 MULTI: bad source address from client [192.168.117.212], packet dropped
Tue Oct 24 14:42:42 2017 us=298575 BosseAGI/95.204.77.24 MULTI: bad source address from client [192.168.117.212], packet dropped
Tue Oct 24 14:42:42 2017 us=314554 BosseAGI/95.204.77.24 MULTI: bad source address from client [192.168.117.212], packet dropped
My connected phone cannot browse the Internet at all. It loses its connectivity when the tunnel connects.
It is connected to a WiFi network running off a mobile broadband connection.
On the WiFi it has IP address 192.168.117.212
And the WiFi router itself uses a mobile dongle and has external address 95.204.77.24
What could be the reason for the routing not to work?
The client ovpn file looks like this (slightly edited for privacy):
#--- OpenVPN configuration file for login BosseAGI
client
dev tun
proto udp
remote xxx.yyy.com 1199
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
remote-cert-tls server
key-direction 1
cipher AES-256-CBC
comp-lzo
verb 3
mute 20
<ca>
-----BEGIN CERTIFICATE-----
etc etc
