SOLVED - Server OpenVPN only works with TCP 1194

javalin

Hi, I have setup OpenVPN server on my router Asus RT-N66U with tomatoUSB firmware using suggested openvpn tutorial on the web. I was able to configure the setup for a enigma2 box openvpn client and the tunnelling is working correctly with the router when using the TCP protocol.

But if i try to change to UDP protocol (everything else is not changed), it is not working at all. The client is connected to the server but I can see an error message on openvpn.log client that the packet on port 1194 is rejected. Openvpn is setup with firewall option set to "automatic". It is like that when the protocol is UDP, this firewall option does not setup a rule correctly so the packet on port 1194 is rejected by the router?

Here is the client config:

client
dev tap
proto udp
remote xxxxxx.ddns.net 1194
resolv-retry infinite
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/client.crt
key /etc/openvpn/client.key
log /etc/openvpn/openvpn.log
ns-cert-type server
cipher AES-128-CBC
comp-lzo no
verb 4

And this is the server config:

daemon
server-bridge 192.168.130.1 255.255.255.0 192.168.130.225 192.168.130.250
proto udp
port 1194
dev tap21
cipher AES-128-CBC
comp-lzo no
keepalive 15 60
verb 3
client-config-dir ccd
client-to-client
push "dhcp-option DNS 192.168.130.1"
ca ca.crt
dh dh.pem
cert server.crt
key server.key
status-version 2
status status

openvpn.log client:

SENT CONTROL [servidor]: 'PUSH_REQUEST' (status=1)
PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 192.168.130.1,route-gateway 192.168.130.1,ping 15,ping-restart 60,ifconfig 192.168.130.225 255.255.255.0'
OPTIONS IMPORT: timers and/or timeouts modified
OPTIONS IMPORT: --ifconfig/up options modified
OPTIONS IMPORT: route-related options modified
OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
TUN/TAP device tap1 opened
TUN/TAP TX queue length set to 100
do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
/sbin/ifconfig tap1 192.168.130.225 netmask 255.255.255.0 mtu 1500 broadcast 192.168.130.255
Initialization Sequence Completed
TCP connect to [AF_INET]79.xxx.xxx.xx:1194 failed, will try again in 5 seconds: Connection timed out

I'll appreciate any help
Thanks

TinCanTech

Please see:
HOWTO: Request Help ! {2}

It would help to see your logs ..

javalin

TinCanTech wrotePlease see:
HOWTO: Request Help ! {2}

It would help to see your logs ..

Of course, this is the server log:

Jan 22 21:17:30 TOMATO daemon.notice openvpn[1626]: OpenVPN 2.4.1 mipsel-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Nov 17 2017
Jan 22 21:17:30 TOMATO daemon.notice openvpn[1626]: library versions: OpenSSL 1.0.2k 26 Jan 2017, LZO 2.09
Jan 22 21:17:30 TOMATO daemon.notice openvpn[1630]: Outgoing Static Key Encryption: Cipher 'AES-128-CBC' initialized with 128 bit key
Jan 22 21:17:30 TOMATO daemon.notice openvpn[1630]: Outgoing Static Key Encryption: Using 160 bit message hash 'SHA1' for HMAC authentication
Jan 22 21:17:30 TOMATO daemon.notice openvpn[1630]: Incoming Static Key Encryption: Cipher 'AES-128-CBC' initialized with 128 bit key
Jan 22 21:17:30 TOMATO daemon.notice openvpn[1630]: Incoming Static Key Encryption: Using 160 bit message hash 'SHA1' for HMAC authentication
Jan 22 21:17:30 TOMATO daemon.notice openvpn[1630]: TUN/TAP device tap22 opened
Jan 22 21:17:30 TOMATO daemon.notice openvpn[1630]: TUN/TAP TX queue length set to 100
Jan 22 21:17:30 TOMATO daemon.warn openvpn[1630]: Could not determine IPv4/IPv6 protocol. Using AF_INET6
Jan 22 21:17:30 TOMATO daemon.notice openvpn[1630]: Socket Buffers: R=[114688->114688] S=[114688->114688]
Jan 22 21:17:30 TOMATO daemon.notice openvpn[1630]: setsockopt(IPV6_V6ONLY=0)
Jan 22 21:17:30 TOMATO daemon.err openvpn[1630]: TCP/UDP: Socket bind failed on local address [AF_INET6][undef]:1194: Address already in use
Jan 22 21:17:30 TOMATO daemon.notice openvpn[1630]: Exiting due to fatal error
Jan 22 21:17:30 TOMATO daemon.notice openvpn[1630]: Closing TUN/TAP interface
Jan 22 21:17:38 TOMATO daemon.err nmbd[644]: Samba name server TOMATO is now a local master browser for workgroup TOMATO on subnet 192.168.130.1
Jan 22 21:17:54 TOMATO daemon.notice openvpn[1614]: 81.34.245.337 TLS: Initial packet from [AF_INET6]::ffff:81.34.245.337:1194, sid=ddb9413b 2564841b
Jan 22 21:18:03 TOMATO cron.err crond[619]: time disparity of 25277597 minutes detected
Jan 22 21:18:53 TOMATO daemon.err openvpn[1614]: event_wait : Interrupted system call (code=4)
Jan 22 21:18:53 TOMATO daemon.notice openvpn[1614]: TITLE,OpenVPN 2.4.1 mipsel-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Nov 17 2017
Jan 22 21:18:53 TOMATO daemon.notice openvpn[1614]: TIME,Mon Jan 22 21:18:53 2018,1516655933
Jan 22 21:18:53 TOMATO daemon.notice openvpn[1614]: HEADER,CLIENT_LIST,Common Name,Real Address,Virtual Address,Virtual IPv6 Address,Bytes Received,Bytes Sent,Connected Since,Connected Since (time_t),Username,Client ID,Peer ID
Jan 22 21:18:53 TOMATO daemon.notice openvpn[1614]: CLIENT_LIST,UNDEF,81.34.245.337,,,70,160,Mon Jan 22 21:17:54 2018,1516655874,UNDEF,0,0
Jan 22 21:18:53 TOMATO daemon.notice openvpn[1614]: HEADER,ROUTING_TABLE,Virtual Address,Common Name,Real Address,Last Ref,Last Ref (time_t)
Jan 22 21:18:53 TOMATO daemon.notice openvpn[1614]: GLOBAL_STATS,Max bcast/mcast queue length,1
Jan 22 21:18:53 TOMATO daemon.notice openvpn[1614]: END
Jan 22 21:18:54 TOMATO daemon.err openvpn[1614]: 81.34.245.337 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Jan 22 21:18:54 TOMATO daemon.err openvpn[1614]: 81.34.245.337 TLS Error: TLS handshake failed
Jan 22 21:18:54 TOMATO daemon.notice openvpn[1614]: 81.34.245.337 SIGUSR1[soft,tls-error] received, client-instance restarting
Jan 22 21:18:56 TOMATO daemon.notice openvpn[1614]: 81.34.245.337 TLS: Initial packet from [AF_INET6]::ffff:81.34.245.337:1194, sid=7d8eab0d 963a0a64
Jan 22 21:19:56 TOMATO daemon.err openvpn[1614]: 81.34.245.337 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

Sent from my SM-G920F using Tapatalk

javalin

TinCanTech wrotePlease see:
HOWTO: Request Help ! {2}

It would help to see your logs ..

And this is the client log:


Mon Jan 22 22:50:25 2018 us=602461 Current Parameter Settings:
Mon Jan 22 22:50:25 2018 us=604423   config = '/etc/openvpn/client.conf'
Mon Jan 22 22:50:25 2018 us=605082   mode = 0
Mon Jan 22 22:50:25 2018 us=605933   persist_config = DISABLED
Mon Jan 22 22:50:25 2018 us=606317   persist_mode = 1
Mon Jan 22 22:50:25 2018 us=606844   show_ciphers = DISABLED
Mon Jan 22 22:50:25 2018 us=607488   show_digests = DISABLED
Mon Jan 22 22:50:25 2018 us=607974   show_engines = DISABLED
Mon Jan 22 22:50:25 2018 us=608441   genkey = DISABLED
Mon Jan 22 22:50:25 2018 us=609000   key_pass_file = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=609400   show_tls_ciphers = DISABLED
Mon Jan 22 22:50:25 2018 us=609910 Connection profiles [default]:
Mon Jan 22 22:50:25 2018 us=610316   proto = udp
Mon Jan 22 22:50:25 2018 us=610663   local = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=611282   local_port = 1194
Mon Jan 22 22:50:25 2018 us=611637   remote = 'xxxxxxxx.ddns.net'
Mon Jan 22 22:50:25 2018 us=612136   remote_port = 1194
Mon Jan 22 22:50:25 2018 us=612496   remote_float = DISABLED
Mon Jan 22 22:50:25 2018 us=613010   bind_defined = DISABLED
Mon Jan 22 22:50:25 2018 us=613354   bind_local = ENABLED
Mon Jan 22 22:50:25 2018 us=614323   connect_retry_seconds = 5
Mon Jan 22 22:50:25 2018 us=614650   connect_timeout = 10
Mon Jan 22 22:50:25 2018 us=615166   connect_retry_max = 0
Mon Jan 22 22:50:25 2018 us=615479   socks_proxy_server = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=615887   socks_proxy_port = 0
Mon Jan 22 22:50:25 2018 us=616218   socks_proxy_retry = DISABLED
Mon Jan 22 22:50:25 2018 us=617664   tun_mtu = 1500
Mon Jan 22 22:50:25 2018 us=618259   tun_mtu_defined = ENABLED
Mon Jan 22 22:50:25 2018 us=618612   link_mtu = 1500
Mon Jan 22 22:50:25 2018 us=619201   link_mtu_defined = DISABLED
Mon Jan 22 22:50:25 2018 us=619573   tun_mtu_extra = 32
Mon Jan 22 22:50:25 2018 us=620057   tun_mtu_extra_defined = ENABLED
Mon Jan 22 22:50:25 2018 us=620421   mtu_discover_type = -1
Mon Jan 22 22:50:25 2018 us=620964   fragment = 0
Mon Jan 22 22:50:25 2018 us=621603   mssfix = 1450
Mon Jan 22 22:50:25 2018 us=622120   explicit_exit_notification = 0
Mon Jan 22 22:50:25 2018 us=622480 Connection profiles END
Mon Jan 22 22:50:25 2018 us=623034   remote_random = DISABLED
Mon Jan 22 22:50:25 2018 us=623420   ipchange = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=623889   dev = 'tap'
Mon Jan 22 22:50:25 2018 us=624264   dev_type = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=624607   dev_node = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=625475   lladdr = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=626026   topology = 1
Mon Jan 22 22:50:25 2018 us=626389   tun_ipv6 = DISABLED
Mon Jan 22 22:50:25 2018 us=626934   ifconfig_local = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=627349   ifconfig_remote_netmask = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=627696   ifconfig_noexec = DISABLED
Mon Jan 22 22:50:25 2018 us=628375   ifconfig_nowarn = DISABLED
Mon Jan 22 22:50:25 2018 us=629012   ifconfig_ipv6_local = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=629445   ifconfig_ipv6_netbits = 0
Mon Jan 22 22:50:25 2018 us=629950   ifconfig_ipv6_remote = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=630338   shaper = 0
Mon Jan 22 22:50:25 2018 us=630677   mtu_test = 0
Mon Jan 22 22:50:25 2018 us=631278   mlock = DISABLED
Mon Jan 22 22:50:25 2018 us=631626   keepalive_ping = 0
Mon Jan 22 22:50:25 2018 us=632125   keepalive_timeout = 0
Mon Jan 22 22:50:25 2018 us=632554   inactivity_timeout = 0
Mon Jan 22 22:50:25 2018 us=633278   ping_send_timeout = 0
Mon Jan 22 22:50:25 2018 us=633601   ping_rec_timeout = 0
Mon Jan 22 22:50:25 2018 us=634024   ping_rec_timeout_action = 0
Mon Jan 22 22:50:25 2018 us=634332   ping_timer_remote = DISABLED
Mon Jan 22 22:50:25 2018 us=634625   remap_sigusr1 = 0
Mon Jan 22 22:50:25 2018 us=635125   persist_tun = ENABLED
Mon Jan 22 22:50:25 2018 us=635436   persist_local_ip = DISABLED
Mon Jan 22 22:50:25 2018 us=635721   persist_remote_ip = DISABLED
Mon Jan 22 22:50:25 2018 us=636445   persist_key = ENABLED
Mon Jan 22 22:50:25 2018 us=639248   passtos = DISABLED
Mon Jan 22 22:50:25 2018 us=639622   resolve_retry_seconds = 1000000000
Mon Jan 22 22:50:25 2018 us=640338   username = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=641076   groupname = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=641936   chroot_dir = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=642356   cd_dir = '/etc/openvpn'
Mon Jan 22 22:50:25 2018 us=642711   writepid = '/var/run/openvpn.client.pid'
Mon Jan 22 22:50:25 2018 us=643220   up_script = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=643570   down_script = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=644139   down_pre = DISABLED
Mon Jan 22 22:50:25 2018 us=644506   up_restart = DISABLED
Mon Jan 22 22:50:25 2018 us=644970   up_delay = DISABLED
Mon Jan 22 22:50:25 2018 us=645679   daemon = ENABLED
Mon Jan 22 22:50:25 2018 us=646306   inetd = 0
Mon Jan 22 22:50:25 2018 us=646646   log = ENABLED
Mon Jan 22 22:50:25 2018 us=647143   suppress_timestamps = DISABLED
Mon Jan 22 22:50:25 2018 us=647501   nice = 0
Mon Jan 22 22:50:25 2018 us=648129   verbosity = 4
Mon Jan 22 22:50:25 2018 us=648524   mute = 0
Mon Jan 22 22:50:25 2018 us=649012   gremlin = 0
Mon Jan 22 22:50:25 2018 us=650319   status_file = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=650707   status_file_version = 1
Mon Jan 22 22:50:25 2018 us=651222   status_file_update_freq = 60
Mon Jan 22 22:50:25 2018 us=651564   occ = ENABLED
Mon Jan 22 22:50:25 2018 us=652138   rcvbuf = 65536
Mon Jan 22 22:50:25 2018 us=652519   sndbuf = 65536
Mon Jan 22 22:50:25 2018 us=652930   mark = 0
Mon Jan 22 22:50:25 2018 us=653253   sockflags = 0
Mon Jan 22 22:50:25 2018 us=653543   fast_io = DISABLED
Mon Jan 22 22:50:25 2018 us=654020   lzo = 1
Mon Jan 22 22:50:25 2018 us=655289   route_script = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=655667   route_default_gateway = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=656402   route_default_metric = 0
Mon Jan 22 22:50:25 2018 us=662197   route_noexec = DISABLED
Mon Jan 22 22:50:25 2018 us=664145   route_delay = 0
Mon Jan 22 22:50:25 2018 us=666661   route_delay_window = 30
Mon Jan 22 22:50:25 2018 us=668492   route_delay_defined = DISABLED
Mon Jan 22 22:50:25 2018 us=669058   route_nopull = DISABLED
Mon Jan 22 22:50:25 2018 us=669427   route_gateway_via_dhcp = DISABLED
Mon Jan 22 22:50:25 2018 us=669995   max_routes = 100
Mon Jan 22 22:50:25 2018 us=670396   allow_pull_fqdn = DISABLED
Mon Jan 22 22:50:25 2018 us=670877   management_addr = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=671270   management_port = 0
Mon Jan 22 22:50:25 2018 us=671614   management_user_pass = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=672199   management_log_history_cache = 250
Mon Jan 22 22:50:25 2018 us=672562   management_echo_buffer_size = 100
Mon Jan 22 22:50:25 2018 us=672980   management_write_peer_info_file = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=673301   management_client_user = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=673603   management_client_group = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=674210   management_flags = 0
Mon Jan 22 22:50:25 2018 us=674528   shared_secret_file = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=674950   key_direction = 0
Mon Jan 22 22:50:25 2018 us=675277   ciphername_defined = ENABLED
Mon Jan 22 22:50:25 2018 us=675577   ciphername = 'AES-128-CBC'
Mon Jan 22 22:50:25 2018 us=676077   authname_defined = ENABLED
Mon Jan 22 22:50:25 2018 us=676397   authname = 'SHA1'
Mon Jan 22 22:50:25 2018 us=678287   prng_hash = 'SHA1'
Mon Jan 22 22:50:25 2018 us=678694   prng_nonce_secret_len = 16
Mon Jan 22 22:50:25 2018 us=679214   keysize = 0
Mon Jan 22 22:50:25 2018 us=679570   engine = DISABLED
Mon Jan 22 22:50:25 2018 us=680155   replay = ENABLED
Mon Jan 22 22:50:25 2018 us=680540   mute_replay_warnings = DISABLED
Mon Jan 22 22:50:25 2018 us=681040   replay_window = 64
Mon Jan 22 22:50:25 2018 us=681421   replay_time = 15
Mon Jan 22 22:50:25 2018 us=681989   packet_id_file = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=682385   use_iv = ENABLED
Mon Jan 22 22:50:25 2018 us=682857   test_crypto = DISABLED
Mon Jan 22 22:50:25 2018 us=683260   tls_server = DISABLED
Mon Jan 22 22:50:25 2018 us=683613   tls_client = ENABLED
Mon Jan 22 22:50:25 2018 us=684209   key_method = 2
Mon Jan 22 22:50:25 2018 us=684584   ca_file = '/etc/openvpn/ca.crt'
Mon Jan 22 22:50:25 2018 us=686019   ca_path = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=686679   dh_file = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=687221   cert_file = '/etc/openvpn/client.crt'
Mon Jan 22 22:50:25 2018 us=687586   priv_key_file = '/etc/openvpn/client.key'
Mon Jan 22 22:50:25 2018 us=689282   pkcs12_file = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=689860   cipher_list = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=690372   tls_verify = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=690852   tls_export_cert = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=691252   verify_x509_type = 0
Mon Jan 22 22:50:25 2018 us=692163   verify_x509_name = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=692579   crl_file = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=693047   ns_cert_type = 1
Mon Jan 22 22:50:25 2018 us=693383   remote_cert_ku[i] = 0
Mon Jan 22 22:50:25 2018 us=693699   remote_cert_ku[i] = 0
Mon Jan 22 22:50:25 2018 us=694231   remote_cert_ku[i] = 0
Mon Jan 22 22:50:25 2018 us=694543   remote_cert_ku[i] = 0
Mon Jan 22 22:50:25 2018 us=695074   remote_cert_ku[i] = 0
Mon Jan 22 22:50:25 2018 us=695407   remote_cert_ku[i] = 0
Mon Jan 22 22:50:25 2018 us=695709   remote_cert_ku[i] = 0
Mon Jan 22 22:50:25 2018 us=696235   remote_cert_ku[i] = 0
Mon Jan 22 22:50:25 2018 us=698226   remote_cert_ku[i] = 0
Mon Jan 22 22:50:25 2018 us=698991   remote_cert_ku[i] = 0
Mon Jan 22 22:50:25 2018 us=699503   remote_cert_ku[i] = 0
Mon Jan 22 22:50:25 2018 us=701223   remote_cert_ku[i] = 0
Mon Jan 22 22:50:25 2018 us=702299   remote_cert_ku[i] = 0
Mon Jan 22 22:50:25 2018 us=702989   remote_cert_ku[i] = 0
Mon Jan 22 22:50:25 2018 us=703495   remote_cert_ku[i] = 0
Mon Jan 22 22:50:25 2018 us=704271   remote_cert_ku[i] = 0
Mon Jan 22 22:50:25 2018 us=704945   remote_cert_eku = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=706111   ssl_flags = 0
Mon Jan 22 22:50:25 2018 us=707244   tls_timeout = 2
Mon Jan 22 22:50:25 2018 us=708459   renegotiate_bytes = 0
Mon Jan 22 22:50:25 2018 us=709457   renegotiate_packets = 0
Mon Jan 22 22:50:25 2018 us=710629   renegotiate_seconds = 3600
Mon Jan 22 22:50:25 2018 us=711672   handshake_window = 60
Mon Jan 22 22:50:25 2018 us=712689   transition_window = 3600
Mon Jan 22 22:50:25 2018 us=713307   single_session = DISABLED
Mon Jan 22 22:50:25 2018 us=714468   push_peer_info = DISABLED
Mon Jan 22 22:50:25 2018 us=715095   tls_exit = DISABLED
Mon Jan 22 22:50:25 2018 us=715557   tls_auth_file = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=719156   server_network = 0.0.0.0
Mon Jan 22 22:50:25 2018 us=719702   server_netmask = 0.0.0.0
Mon Jan 22 22:50:25 2018 us=720358   server_network_ipv6 = ::
Mon Jan 22 22:50:25 2018 us=720960   server_netbits_ipv6 = 0
Mon Jan 22 22:50:25 2018 us=722692   server_bridge_ip = 0.0.0.0
Mon Jan 22 22:50:25 2018 us=727579   server_bridge_netmask = 0.0.0.0
Mon Jan 22 22:50:25 2018 us=728316   server_bridge_pool_start = 0.0.0.0
Mon Jan 22 22:50:25 2018 us=729144   server_bridge_pool_end = 0.0.0.0
Mon Jan 22 22:50:25 2018 us=729523   ifconfig_pool_defined = DISABLED
Mon Jan 22 22:50:25 2018 us=730154   ifconfig_pool_start = 0.0.0.0
Mon Jan 22 22:50:25 2018 us=730558   ifconfig_pool_end = 0.0.0.0
Mon Jan 22 22:50:25 2018 us=731095   ifconfig_pool_netmask = 0.0.0.0
Mon Jan 22 22:50:25 2018 us=731455   ifconfig_pool_persist_filename = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=732021   ifconfig_pool_persist_refresh_freq = 600
Mon Jan 22 22:50:25 2018 us=732411   ifconfig_ipv6_pool_defined = DISABLED
Mon Jan 22 22:50:25 2018 us=733089   ifconfig_ipv6_pool_base = ::
Mon Jan 22 22:50:25 2018 us=733448   ifconfig_ipv6_pool_netbits = 0
Mon Jan 22 22:50:25 2018 us=733935   n_bcast_buf = 256
Mon Jan 22 22:50:25 2018 us=734287   tcp_queue_limit = 64
Mon Jan 22 22:50:25 2018 us=734592   real_hash_size = 256
Mon Jan 22 22:50:25 2018 us=735024   virtual_hash_size = 256
Mon Jan 22 22:50:25 2018 us=735334   client_connect_script = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=735626   learn_address_script = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=736131   client_disconnect_script = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=736435   client_config_dir = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=742453   ccd_exclusive = DISABLED
Mon Jan 22 22:50:25 2018 us=743726   tmp_dir = '/tmp'
Mon Jan 22 22:50:25 2018 us=744712   push_ifconfig_defined = DISABLED
Mon Jan 22 22:50:25 2018 us=746677   push_ifconfig_local = 0.0.0.0
Mon Jan 22 22:50:25 2018 us=748449   push_ifconfig_remote_netmask = 0.0.0.0
Mon Jan 22 22:50:25 2018 us=749087   push_ifconfig_ipv6_defined = DISABLED
Mon Jan 22 22:50:25 2018 us=749504   push_ifconfig_ipv6_local = ::/0
Mon Jan 22 22:50:25 2018 us=750025   push_ifconfig_ipv6_remote = ::
Mon Jan 22 22:50:25 2018 us=750401   enable_c2c = DISABLED
Mon Jan 22 22:50:25 2018 us=750947   duplicate_cn = DISABLED
Mon Jan 22 22:50:25 2018 us=752160   cf_max = 0
Mon Jan 22 22:50:25 2018 us=752528   cf_per = 0
Mon Jan 22 22:50:25 2018 us=753191   max_clients = 1024
Mon Jan 22 22:50:25 2018 us=753542   max_routes_per_client = 256
Mon Jan 22 22:50:25 2018 us=753969   auth_user_pass_verify_script = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=754293   auth_user_pass_verify_script_via_file = DISABLED
Mon Jan 22 22:50:25 2018 us=754592   port_share_host = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=755090   port_share_port = 0
Mon Jan 22 22:50:25 2018 us=755409   client = ENABLED
Mon Jan 22 22:50:25 2018 us=755702   pull = ENABLED
Mon Jan 22 22:50:25 2018 us=756175   auth_user_pass_file = '[UNDEF]'
Mon Jan 22 22:50:25 2018 us=758235 OpenVPN 2.3.4 mipsel-oe-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on May 11 2016
Mon Jan 22 22:50:25 2018 us=758956 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.09
Mon Jan 22 22:50:25 2018 us=775929 WARNING: file '/etc/openvpn/client.key' is group or others accessible
Mon Jan 22 22:50:25 2018 us=789507 LZO compression initialized
Mon Jan 22 22:50:25 2018 us=793581 Control Channel MTU parms [ L:1590 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Jan 22 22:50:25 2018 us=794689 Socket Buffers: R=[163840->131072] S=[163840->131072]
Mon Jan 22 22:50:25 2018 us=840064 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Mon Jan 22 22:50:25 2018 us=840901 Local Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Jan 22 22:50:25 2018 us=841279 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Jan 22 22:50:25 2018 us=842914 Local Options hash (VER=V4): 'b498be7c'
Mon Jan 22 22:50:25 2018 us=843448 Expected Remote Options hash (VER=V4): '26e19fc0'
Mon Jan 22 22:50:25 2018 us=849654 UDPv4 link local (bound): [undef]
Mon Jan 22 22:50:25 2018 us=866213 UDPv4 link remote: [AF_INET]79.169.162.55:1194
Mon Jan 22 22:51:25 2018 us=889265 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Jan 22 22:51:25 2018 us=889983 TLS Error: TLS handshake failed
Mon Jan 22 22:51:25 2018 us=895443 TCP/UDP: Closing socket
Mon Jan 22 22:51:25 2018 us=896216 SIGUSR1[soft,tls-error] received, process restarting
Mon Jan 22 22:51:25 2018 us=901332 Restart pause, 2 second(s)
Mon Jan 22 22:51:27 2018 us=905332 Re-using SSL/TLS context
Mon Jan 22 22:51:27 2018 us=909021 LZO compression initialized
Mon Jan 22 22:51:27 2018 us=910955 Control Channel MTU parms [ L:1590 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Jan 22 22:51:27 2018 us=911718 Socket Buffers: R=[163840->131072] S=[163840->131072]
Mon Jan 22 22:51:27 2018 us=958962 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Mon Jan 22 22:51:27 2018 us=960095 Local Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Jan 22 22:51:27 2018 us=960514 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Jan 22 22:51:27 2018 us=961158 Local Options hash (VER=V4): 'b498be7c'
Mon Jan 22 22:51:27 2018 us=961651 Expected Remote Options hash (VER=V4): '26e19fc0'
Mon Jan 22 22:51:27 2018 us=962909 UDPv4 link local (bound): [undef]
Mon Jan 22 22:51:27 2018 us=963345 UDPv4 link remote: [AF_INET]79.169.162.55:1194

Sent from my SM-G920F using Tapatalk

javalin

The iptables, may be this is usefull:

Chain INPUT (policy DROP 431 packets, 41059 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  tap22  any     anywhere             anywhere
   19   798 ACCEPT     udp  --  any    any     anywhere             anywhere            udp dpt:1194
    0     0 ACCEPT     all  --  tap21  any     anywhere             anywhere
    0     0 ACCEPT     udp  --  any    any     anywhere             anywhere            udp dpt:1194
   10   937 DROP       all  --  any    any     anywhere             anywhere            state INVALID
  200 22649 ACCEPT     all  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED
    0     0 shlimit    tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh state NEW
    8   584 ACCEPT     all  --  lo     any     anywhere             anywhere
  129 12950 ACCEPT     all  --  br0    any     anywhere             anywhere
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere            limit: avg 1/sec burst 5
    0     0 ACCEPT     udp  --  any    any     anywhere             anywhere            udp dpts:33434:33534 limit: avg 5/sec burst 5
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:webcache

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  tap22  any     anywhere             anywhere
    0     0 ACCEPT     all  --  tap21  any     anywhere             anywhere
33999   30M            all  --  any    any     anywhere             anywhere            account: network/netmask: 192.168.130.0/255.255.255.0 name: lan
    0     0 ACCEPT     all  --  br0    br0     anywhere             anywhere
    0     0 DROP       all  --  any    any     anywhere             anywhere            state INVALID
33241   30M ACCEPT     all  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED
    4   240 wanin      all  --  vlan2  any     anywhere             anywhere
  754 47514 wanout     all  --  any    vlan2   anywhere             anywhere
  754 47514 ACCEPT     all  --  br0    any     anywhere             anywhere

javalin

Ok, now is working 🙂
The problem was in the client side, I learn a new thing today: it is not the same REBOOT/RESTART than REBOOT GUI.

With ifconfig command I checked that, when I execute Reboot GUI or Reboot Interface in the client, the network settings (eth0, tap1, tap2) remains the same and I had a 2 tap devices opened that I think was the confusion on the server.

After reboot or restart the box and execute openvpn, only one tap device was created and now the server recognized and link with the client.

Sorry for my English. I hope help more people.

Kind regards.

TinCanTech

Do you use "Network-Manager" (for Linux) ?

javalin

No, I dont use any Network Manager.

I have some freezes using streaming services over VPN and I have some dropps packets on client side. It is possible to fix?


eth0      Link encap:Ethernet  HWaddr 00:51:C0:39:90:0B
          inet addr:192.168.1.52  Bcast:0.0.0.0  Mask:255.255.255.0
          inet6 addr: fe80::215:c0ff:fe39:900b%4933648/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:197293 errors:0 dropped:3 overruns:0 frame:0
          TX packets:609740 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:28130777 (26.8 MiB)  TX bytes:851973943 (812.5 MiB)

tap0      Link encap:Ethernet  HWaddr 1E:27:8A:73:95:FF
          inet addr:192.168.130.225  Bcast:192.168.130.255  Mask:255.255.255.0
          inet6 addr: fe80::1c27:8aff:fe73:95ff%4933072/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:137484 errors:0 dropped:0 overruns:0 frame:0
          TX packets:258512 errors:0 dropped:582 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:9904336 (9.4 MiB)  TX bytes:338173156 (322.5 MiB)