Hello,
I'm trying to upgrade our current openvpn infrastructure to the latest version running on CentOS 7. I am new to OpenVPN so I'm not sure what I missed.
All my clients are Mac OS X El Capitan or Sierra using TunnelBlick client.
I am able to get the service started but am seeing this in logs when I try to connect:
Tue Dec 5 21:47:32 2017 us=211114 MULTI: multi_create_instance called
Tue Dec 5 21:47:32 2017 us=211261 10.1.10.50:58801 Re-using SSL/TLS context
Tue Dec 5 21:47:32 2017 us=211297 10.1.10.50:58801 LZO compression initializing
Tue Dec 5 21:47:32 2017 us=211358 10.1.10.50:58801 PID packet_id_init seq_backtrack=64 time_backtrack=15
Tue Dec 5 21:47:32 2017 us=211482 10.1.10.50:58801 PID packet_id_init seq_backtrack=64 time_backtrack=15
Tue Dec 5 21:47:32 2017 us=211578 10.1.10.50:58801 PID packet_id_init seq_backtrack=64 time_backtrack=15
Tue Dec 5 21:47:32 2017 us=211638 10.1.10.50:58801 PID packet_id_init seq_backtrack=64 time_backtrack=15
Tue Dec 5 21:47:32 2017 us=211661 10.1.10.50:58801 Control Channel MTU parms [ L:1622 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Tue Dec 5 21:47:32 2017 us=211674 10.1.10.50:58801 MTU DYNAMIC mtu=1450, flags=2, 1622 -> 1450
Tue Dec 5 21:47:32 2017 us=211700 10.1.10.50:58801 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Tue Dec 5 21:47:32 2017 us=211733 10.1.10.50:58801 crypto_adjust_frame_parameters: Adjusting frame parameters for crypto by 56 bytes
Tue Dec 5 21:47:32 2017 us=211764 10.1.10.50:58801 calc_options_string_link_mtu: link-mtu 1622 -> 1558
Tue Dec 5 21:47:32 2017 us=211812 10.1.10.50:58801 crypto_adjust_frame_parameters: Adjusting frame parameters for crypto by 56 bytes
Tue Dec 5 21:47:32 2017 us=211831 10.1.10.50:58801 calc_options_string_link_mtu: link-mtu 1622 -> 1558
Tue Dec 5 21:47:32 2017 us=211849 10.1.10.50:58801 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Tue Dec 5 21:47:32 2017 us=211861 10.1.10.50:58801 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Tue Dec 5 21:47:32 2017 us=211876 10.1.10.50:58801 SENT PING
Tue Dec 5 21:47:32 2017 us=211900 10.1.10.50:58801 GET INST BY REAL: 10.1.10.50:58801 [ok]
Tue Dec 5 21:47:32 2017 us=211924 10.1.10.50:58801 UDPv4 READ [42] from [AF_INET]10.1.10.50:58801: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ 3684236990 533466855 815180960 1532945663 2802471936 346 655619072 0 ]
Tue Dec 5 21:47:32 2017 us=211943 10.1.10.50:58801 TLS: Initial packet from [AF_INET]10.1.10.50:58801, sid=e15bbad8 7df07dd3
Tue Dec 5 21:47:32 2017 us=211954 10.1.10.50:58801 TLS Error: reading acknowledgement record from packet
Tue Dec 5 21:47:32 2017 us=211988 10.1.10.50:58801 UDPv4 WRITE [14] to [AF_INET]10.1.10.50:58801: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ ] pid=0 DATA len=0
Tue Dec 5 21:47:33 2017 us=271211 MULTI: REAP range 192 -> 208
Tue Dec 5 21:47:34 2017 us=330448 MULTI: REAP range 208 -> 224
Tue Dec 5 21:47:34 2017 us=330552 10.1.10.50:58801 UDPv4 WRITE [14] to [AF_INET]10.1.10.50:58801: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ ] pid=0 DATA len=0
Tue Dec 5 21:47:34 2017 us=336375 GET INST BY REAL: 10.1.10.50:58801 [ok]
Tue Dec 5 21:47:34 2017 us=336416 10.1.10.50:58801 UDPv4 READ [42] from [AF_INET]10.1.10.50:58801: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ 4291839343 2893249581 871177992 3952880462 2576994048 602 655619072 0 ]
Tue Dec 5 21:47:34 2017 us=336432 10.1.10.50:58801 TLS Error: reading acknowledgement record from packet
Tue Dec 5 21:47:35 2017 us=395554 MULTI: REAP range 224 -> 240
Tue Dec 5 21:47:36 2017 us=454761 MULTI: REAP range 240 -> 256
Tue Dec 5 21:47:37 2017 us=513943 MULTI: REAP range 0 -> 16
Tue Dec 5 21:47:38 2017 us=573137 MULTI: REAP range 16 -> 32
Tue Dec 5 21:47:38 2017 us=573276 10.1.10.50:58801 UDPv4 WRITE [14] to [AF_INET]10.1.10.50:58801: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ ] pid=0 DATA len=0
Tue Dec 5 21:47:39 2017 us=632471 MULTI: REAP range 32 -> 48
Tue Dec 5 21:47:40 2017 us=691696 MULTI: REAP range 48 -> 64
Tue Dec 5 21:47:41 2017 us=750896 MULTI: REAP range 64 -> 80
Tue Dec 5 21:47:42 2017 us=810098 MULTI: REAP range 80 -> 96
Tue Dec 5 21:47:43 2017 us=825253 MULTI: REAP range 96 -> 112
Tue Dec 5 21:47:44 2017 us=840393 MULTI: REAP range 112 -> 128
Tue Dec 5 21:47:45 2017 us=855528 MULTI: REAP range 128 -> 144
Tue Dec 5 21:47:46 2017 us=870671 MULTI: REAP range 144 -> 160
Tue Dec 5 21:47:46 2017 us=870786 10.1.10.50:58801 UDPv4 WRITE [14] to [AF_INET]10.1.10.50:58801: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ ] pid=0 DATA len=0
Can I do both TCP AND UDP? Is this going to cause a problem?
Here is my config
[root@openvpn01 ~]# grep -v '^#' /etc/openvpn/server.conf
;local a.b.c.d
port 1194
proto tcp
proto udp
;dev tap
dev tun
;dev-node MyTap
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
;topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
;server-bridge
;push "route 192.168.10.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"
;client-config-dir ccd
;route 192.168.40.128 255.255.255.248
;client-config-dir ccd
;route 10.9.0.0 255.255.255.252
;learn-address ./script
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.1.6.140"
push "dhcp-option DNS 10.1.6.141"
;client-to-client
;duplicate-cn
keepalive 10 120
cipher AES-256-CBC
;compress lz4-v2
;push "compress lz4-v2"
comp-lzo
;max-clients 100
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log /var/log/openvpn/openvpn.log
;log-append openvpn.log
verb 7
;mute 20
explicit-exit-notify 1
plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-ldap.so /etc/openvpn/auth/ldap.conf
