Reconnect problems to OpenVPN 2.4.4 server

phulshof

We've experienced some serious reconnect problems to the OpenVPN(-NL) 2.4.4 server that did not occur with the 2.3.9 server. Before posting a lot of (long) log files, I was wondering if others experience similar issues or whether it's perhaps a configuration problem. Here's what we've seen so far (in a test setup):

port 1111
proto udp
dev tun
ca certs/server1/ca.crt
cert certs/server1/server.crt
key certs/server1/server.key
dh certs/server1/dh2048.pem
server 10.12.0.0 255.255.255.0
push "route 192.168.0.0 255.255.255.0"
client-config-dir ccd
keepalive 1 30
tls-auth certs/server1/ta.key 0
verb 3
reneg-sec 120
log server1.log
status /var/log/server1 10

client
dev tun
proto udp
remote 10.11.11.11 1111
lport 16010
resolv-retry infinite
ca certs/client1/ca.crt
cert certs/client1/client1.crt
key certs/client1/client1.key
remote-cert-tls server
tls-auth certs/client1/ta.key 1
verb 3
log client1.log
status /var/log/client1
script-security 3

Results:

Server: OpenVPN-NL 2.3.9
Client: OpenVPN-NL 2.3.9
Actions: Connect client to server. Kill the client, and restart the client.
Results: Connection re-established after about 19 seconds.

Server: OpenVPN-NL 2.4.4
Client: OpenVPN-NL 2.3.9
Actions: Connect client to server. Kill the client, and restart the client.
Results: Connection not re-established within 15 minutes.

Server: OpenVPN-NL 2.4.4
Client: OpenVPN-NL 2.4.4
Actions: Connect client to server. Kill the client, and restart the client.
Results: Connection re-established after about 86 seconds.
Actions: Rerun the test.
Results: Connection re-established after about 838 seconds.

Server: OpenVPN-NL 2.4.4
Client: OpenVPN-NL 2.3.9
Actions: Connect client to server. Kill the client, wait about 60 seconds, and restart the client.
Results: Connection re-established after about 65 seconds (including the 60 second wait time).

TinCanTech

phulshof wrote OpenVPN(-NL) 2.4.4 server

Could you be more specific .. what is "-NL" ?

phulshof

https://openvpn.fox-it.com/
It's a hardened version of OpenVPN, built in accordance with the guidelines of the Dutch NBV (aka NLNCSA), to allow it to be used in a classified environment. It holds fewer cryptographic options (to improve security), and its hardening patches are offered back to the general OpenVPN development repository. It should function the same as OpenVPN (it's a stripped version of the official development after all); hence my question if people here have experienced similar behaviour with OpenVPN 2.4.4.

TinCanTech

You need to contact fox-it

Also you can post your logs here and maybe we can see what is happening.

phulshof

Of course we already contacted Fox-IT as well. 🙂 As said: I was mostly wondering if people have experienced the same issues with OpenVPN 2.4.4 (or if someone would be willing to give it a quick try).

phulshof

Here's the server log file (verbosity level 3) for the following test:
-----
Server: OpenVPN-NL 2.4.4
Client: OpenVPN-NL 2.3.9
Actions: Connect client to server. Kill the client, and restart the client.
Results: Connection not re-established within 15 minutes.
-----
I've rerun the same test at a later time without the client local port definition to see if that made a difference, but it had no impact.

Looking at the ifconfig information on both machines, the server continues to see its tunnel, while the client never regains a tunnel.

Fri Jan 19 14:58:15 2018 OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (mbed TLS)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Oct 24 2017
Fri Jan 19 14:58:15 2018 library versions: mbed TLS 2.6.0, LZO 2.08
Fri Jan 19 14:58:15 2018 Waiting for platform entropy, this may take a while...
Fri Jan 19 14:58:15 2018 Diffie-Hellman initialized with 2048 bit key
Fri Jan 19 14:58:15 2018 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 14:58:15 2018 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 14:58:15 2018 ROUTE: default_gateway=UNDEF
Fri Jan 19 14:58:15 2018 TUN/TAP device tun0 opened
Fri Jan 19 14:58:15 2018 TUN/TAP TX queue length set to 100
Fri Jan 19 14:58:15 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Fri Jan 19 14:58:15 2018 /sbin/ip link set dev tun0 up mtu 1500
Fri Jan 19 14:58:15 2018 /sbin/ip addr add dev tun0 local 10.12.0.1 peer 10.12.0.2
Fri Jan 19 14:58:15 2018 /sbin/ip route add 10.12.0.0/24 via 10.12.0.2
Fri Jan 19 14:58:15 2018 Could not determine IPv4/IPv6 protocol. Using AF_INET
Fri Jan 19 14:58:15 2018 Socket Buffers: R=[212992->212992] S=[212992->212992]
Fri Jan 19 14:58:15 2018 UDPv4 link local (bound): [AF_INET][undef]:1111
Fri Jan 19 14:58:15 2018 UDPv4 link remote: [AF_UNSPEC]
Fri Jan 19 14:58:15 2018 MULTI: multi_init called, r=256 v=256
Fri Jan 19 14:58:15 2018 IFCONFIG POOL: base=10.12.0.4 size=62, ipv6=0
Fri Jan 19 14:58:15 2018 Initialization Sequence Completed
Fri Jan 19 14:58:20 2018 10.11.11.10:16010 TLS: Initial packet from [AF_INET]10.11.11.10:16010, sid=c31f3e2f 57535102
Fri Jan 19 14:58:21 2018 10.11.11.10:16010 VERIFY OK: depth=1, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=MyCompany CA, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 14:58:21 2018 10.11.11.10:16010 VERIFY OK: depth=0, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=client1, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 14:58:21 2018 10.11.11.10:16010 peer info: IV_VER=2.3.9
Fri Jan 19 14:58:21 2018 10.11.11.10:16010 peer info: IV_PLAT=linux
Fri Jan 19 14:58:21 2018 10.11.11.10:16010 peer info: IV_PROTO=2
Fri Jan 19 14:58:21 2018 10.11.11.10:16010 WARNING: 'min-platform-entropy' is present in remote config but missing in local config, remote='min-platform-entropy 16'
Fri Jan 19 14:58:21 2018 10.11.11.10:16010 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 14:58:21 2018 10.11.11.10:16010 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 14:58:21 2018 10.11.11.10:16010 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 14:58:21 2018 10.11.11.10:16010 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 14:58:21 2018 10.11.11.10:16010 Control Channel: TLSv1.2, cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, 2048 bit key
Fri Jan 19 14:58:21 2018 10.11.11.10:16010 [client1] Peer Connection Initiated with [AF_INET]10.11.11.10:16010
Fri Jan 19 14:58:21 2018 client1/10.11.11.10:16010 MULTI_sva: pool returned IPv4=10.12.0.6, IPv6=(Not enabled)
Fri Jan 19 14:58:21 2018 client1/10.11.11.10:16010 MULTI: Learn: 10.12.0.6 -> client1/10.11.11.10:16010
Fri Jan 19 14:58:21 2018 client1/10.11.11.10:16010 MULTI: primary virtual IP for client1/10.11.11.10:16010: 10.12.0.6
Fri Jan 19 14:58:23 2018 client1/10.11.11.10:16010 PUSH: Received control message: 'PUSH_REQUEST'
Fri Jan 19 14:58:23 2018 client1/10.11.11.10:16010 SENT CONTROL [client1]: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,route 10.12.0.1,topology net30,ping 1,ping-restart 30,ifconfig 10.12.0.6 10.12.0.5,peer-id 0' (status=1)
Fri Jan 19 14:58:59 2018 client1/10.11.11.10:16010 TLS: new session incoming connection from [AF_INET]10.11.11.10:16010
Fri Jan 19 14:58:59 2018 client1/10.11.11.10:16010 VERIFY OK: depth=1, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=MyCompany CA, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 14:58:59 2018 client1/10.11.11.10:16010 VERIFY OK: depth=0, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=client1, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 14:58:59 2018 client1/10.11.11.10:16010 peer info: IV_VER=2.3.9
Fri Jan 19 14:58:59 2018 client1/10.11.11.10:16010 peer info: IV_PLAT=linux
Fri Jan 19 14:58:59 2018 client1/10.11.11.10:16010 peer info: IV_PROTO=2
Fri Jan 19 14:58:59 2018 client1/10.11.11.10:16010 WARNING: 'min-platform-entropy' is present in remote config but missing in local config, remote='min-platform-entropy 16'
Fri Jan 19 14:58:59 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 14:58:59 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 14:58:59 2018 client1/10.11.11.10:16010 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 14:58:59 2018 client1/10.11.11.10:16010 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 14:58:59 2018 client1/10.11.11.10:16010 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Fri Jan 19 14:58:59 2018 client1/10.11.11.10:16010 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Fri Jan 19 14:58:59 2018 client1/10.11.11.10:16010 Control Channel: TLSv1.2, cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, 2048 bit key
Fri Jan 19 15:00:03 2018 client1/10.11.11.10:16010 TLS: new session incoming connection from [AF_INET]10.11.11.10:16010
Fri Jan 19 15:00:04 2018 client1/10.11.11.10:16010 VERIFY OK: depth=1, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=MyCompany CA, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:00:04 2018 client1/10.11.11.10:16010 VERIFY OK: depth=0, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=client1, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:00:04 2018 client1/10.11.11.10:16010 peer info: IV_VER=2.3.9
Fri Jan 19 15:00:04 2018 client1/10.11.11.10:16010 peer info: IV_PLAT=linux
Fri Jan 19 15:00:04 2018 client1/10.11.11.10:16010 peer info: IV_PROTO=2
Fri Jan 19 15:00:04 2018 client1/10.11.11.10:16010 WARNING: 'min-platform-entropy' is present in remote config but missing in local config, remote='min-platform-entropy 16'
Fri Jan 19 15:00:04 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:00:04 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:00:04 2018 client1/10.11.11.10:16010 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:00:04 2018 client1/10.11.11.10:16010 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:00:04 2018 client1/10.11.11.10:16010 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Fri Jan 19 15:00:04 2018 client1/10.11.11.10:16010 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Fri Jan 19 15:00:04 2018 client1/10.11.11.10:16010 Control Channel: TLSv1.2, cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, 2048 bit key
Fri Jan 19 15:01:08 2018 client1/10.11.11.10:16010 TLS: new session incoming connection from [AF_INET]10.11.11.10:16010
Fri Jan 19 15:01:08 2018 client1/10.11.11.10:16010 VERIFY OK: depth=1, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=MyCompany CA, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:01:08 2018 client1/10.11.11.10:16010 VERIFY OK: depth=0, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=client1, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:01:08 2018 client1/10.11.11.10:16010 peer info: IV_VER=2.3.9
Fri Jan 19 15:01:08 2018 client1/10.11.11.10:16010 peer info: IV_PLAT=linux
Fri Jan 19 15:01:08 2018 client1/10.11.11.10:16010 peer info: IV_PROTO=2
Fri Jan 19 15:01:08 2018 client1/10.11.11.10:16010 WARNING: 'min-platform-entropy' is present in remote config but missing in local config, remote='min-platform-entropy 16'
Fri Jan 19 15:01:08 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:01:08 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:01:08 2018 client1/10.11.11.10:16010 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:01:08 2018 client1/10.11.11.10:16010 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:01:08 2018 client1/10.11.11.10:16010 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Fri Jan 19 15:01:08 2018 client1/10.11.11.10:16010 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Fri Jan 19 15:01:08 2018 client1/10.11.11.10:16010 Control Channel: TLSv1.2, cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, 2048 bit key
Fri Jan 19 15:02:13 2018 client1/10.11.11.10:16010 TLS: new session incoming connection from [AF_INET]10.11.11.10:16010
Fri Jan 19 15:02:13 2018 client1/10.11.11.10:16010 VERIFY OK: depth=1, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=MyCompany CA, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:02:13 2018 client1/10.11.11.10:16010 VERIFY OK: depth=0, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=client1, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:02:13 2018 client1/10.11.11.10:16010 peer info: IV_VER=2.3.9
Fri Jan 19 15:02:13 2018 client1/10.11.11.10:16010 peer info: IV_PLAT=linux
Fri Jan 19 15:02:13 2018 client1/10.11.11.10:16010 peer info: IV_PROTO=2
Fri Jan 19 15:02:13 2018 client1/10.11.11.10:16010 WARNING: 'min-platform-entropy' is present in remote config but missing in local config, remote='min-platform-entropy 16'
Fri Jan 19 15:02:13 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:02:13 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:02:13 2018 client1/10.11.11.10:16010 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:02:13 2018 client1/10.11.11.10:16010 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:02:13 2018 client1/10.11.11.10:16010 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Fri Jan 19 15:02:13 2018 client1/10.11.11.10:16010 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Fri Jan 19 15:02:13 2018 client1/10.11.11.10:16010 Control Channel: TLSv1.2, cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, 2048 bit key
Fri Jan 19 15:03:17 2018 client1/10.11.11.10:16010 TLS: new session incoming connection from [AF_INET]10.11.11.10:16010
Fri Jan 19 15:03:17 2018 client1/10.11.11.10:16010 VERIFY OK: depth=1, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=MyCompany CA, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:03:17 2018 client1/10.11.11.10:16010 VERIFY OK: depth=0, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=client1, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:03:17 2018 client1/10.11.11.10:16010 peer info: IV_VER=2.3.9
Fri Jan 19 15:03:17 2018 client1/10.11.11.10:16010 peer info: IV_PLAT=linux
Fri Jan 19 15:03:17 2018 client1/10.11.11.10:16010 peer info: IV_PROTO=2
Fri Jan 19 15:03:17 2018 client1/10.11.11.10:16010 WARNING: 'min-platform-entropy' is present in remote config but missing in local config, remote='min-platform-entropy 16'
Fri Jan 19 15:03:17 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:03:17 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:03:17 2018 client1/10.11.11.10:16010 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:03:17 2018 client1/10.11.11.10:16010 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:03:17 2018 client1/10.11.11.10:16010 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Fri Jan 19 15:03:17 2018 client1/10.11.11.10:16010 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Fri Jan 19 15:03:17 2018 client1/10.11.11.10:16010 Control Channel: TLSv1.2, cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, 2048 bit key
Fri Jan 19 15:04:21 2018 client1/10.11.11.10:16010 TLS: new session incoming connection from [AF_INET]10.11.11.10:16010
Fri Jan 19 15:04:21 2018 client1/10.11.11.10:16010 VERIFY OK: depth=1, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=MyCompany CA, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:04:21 2018 client1/10.11.11.10:16010 VERIFY OK: depth=0, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=client1, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:04:21 2018 client1/10.11.11.10:16010 peer info: IV_VER=2.3.9
Fri Jan 19 15:04:21 2018 client1/10.11.11.10:16010 peer info: IV_PLAT=linux
Fri Jan 19 15:04:21 2018 client1/10.11.11.10:16010 peer info: IV_PROTO=2
Fri Jan 19 15:04:21 2018 client1/10.11.11.10:16010 WARNING: 'min-platform-entropy' is present in remote config but missing in local config, remote='min-platform-entropy 16'
Fri Jan 19 15:04:21 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:04:21 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:04:21 2018 client1/10.11.11.10:16010 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:04:21 2018 client1/10.11.11.10:16010 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:04:21 2018 client1/10.11.11.10:16010 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Fri Jan 19 15:04:21 2018 client1/10.11.11.10:16010 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Fri Jan 19 15:04:21 2018 client1/10.11.11.10:16010 Control Channel: TLSv1.2, cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, 2048 bit key
Fri Jan 19 15:05:25 2018 client1/10.11.11.10:16010 TLS: new session incoming connection from [AF_INET]10.11.11.10:16010
Fri Jan 19 15:05:25 2018 client1/10.11.11.10:16010 VERIFY OK: depth=1, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=MyCompany CA, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:05:25 2018 client1/10.11.11.10:16010 VERIFY OK: depth=0, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=client1, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:05:25 2018 client1/10.11.11.10:16010 peer info: IV_VER=2.3.9
Fri Jan 19 15:05:25 2018 client1/10.11.11.10:16010 peer info: IV_PLAT=linux
Fri Jan 19 15:05:25 2018 client1/10.11.11.10:16010 peer info: IV_PROTO=2
Fri Jan 19 15:05:25 2018 client1/10.11.11.10:16010 WARNING: 'min-platform-entropy' is present in remote config but missing in local config, remote='min-platform-entropy 16'
Fri Jan 19 15:05:25 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:05:25 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:05:25 2018 client1/10.11.11.10:16010 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:05:25 2018 client1/10.11.11.10:16010 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:05:25 2018 client1/10.11.11.10:16010 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Fri Jan 19 15:05:25 2018 client1/10.11.11.10:16010 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Fri Jan 19 15:05:25 2018 client1/10.11.11.10:16010 Control Channel: TLSv1.2, cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, 2048 bit key
Fri Jan 19 15:06:29 2018 client1/10.11.11.10:16010 TLS: new session incoming connection from [AF_INET]10.11.11.10:16010
Fri Jan 19 15:06:29 2018 client1/10.11.11.10:16010 VERIFY OK: depth=1, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=MyCompany CA, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:06:29 2018 client1/10.11.11.10:16010 VERIFY OK: depth=0, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=client1, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:06:29 2018 client1/10.11.11.10:16010 peer info: IV_VER=2.3.9
Fri Jan 19 15:06:29 2018 client1/10.11.11.10:16010 peer info: IV_PLAT=linux
Fri Jan 19 15:06:29 2018 client1/10.11.11.10:16010 peer info: IV_PROTO=2
Fri Jan 19 15:06:29 2018 client1/10.11.11.10:16010 WARNING: 'min-platform-entropy' is present in remote config but missing in local config, remote='min-platform-entropy 16'
Fri Jan 19 15:06:29 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:06:29 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:06:29 2018 client1/10.11.11.10:16010 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:06:29 2018 client1/10.11.11.10:16010 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:06:29 2018 client1/10.11.11.10:16010 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Fri Jan 19 15:06:29 2018 client1/10.11.11.10:16010 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Fri Jan 19 15:06:29 2018 client1/10.11.11.10:16010 Control Channel: TLSv1.2, cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, 2048 bit key
Fri Jan 19 15:07:33 2018 client1/10.11.11.10:16010 TLS: new session incoming connection from [AF_INET]10.11.11.10:16010
Fri Jan 19 15:07:33 2018 client1/10.11.11.10:16010 VERIFY OK: depth=1, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=MyCompany CA, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:07:33 2018 client1/10.11.11.10:16010 VERIFY OK: depth=0, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=client1, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:07:33 2018 client1/10.11.11.10:16010 peer info: IV_VER=2.3.9
Fri Jan 19 15:07:33 2018 client1/10.11.11.10:16010 peer info: IV_PLAT=linux
Fri Jan 19 15:07:33 2018 client1/10.11.11.10:16010 peer info: IV_PROTO=2
Fri Jan 19 15:07:33 2018 client1/10.11.11.10:16010 WARNING: 'min-platform-entropy' is present in remote config but missing in local config, remote='min-platform-entropy 16'
Fri Jan 19 15:07:33 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:07:33 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:07:33 2018 client1/10.11.11.10:16010 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:07:33 2018 client1/10.11.11.10:16010 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:07:33 2018 client1/10.11.11.10:16010 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Fri Jan 19 15:07:33 2018 client1/10.11.11.10:16010 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Fri Jan 19 15:07:33 2018 client1/10.11.11.10:16010 Control Channel: TLSv1.2, cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, 2048 bit key
Fri Jan 19 15:08:37 2018 client1/10.11.11.10:16010 TLS: new session incoming connection from [AF_INET]10.11.11.10:16010
Fri Jan 19 15:08:37 2018 client1/10.11.11.10:16010 VERIFY OK: depth=1, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=MyCompany CA, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:08:37 2018 client1/10.11.11.10:16010 VERIFY OK: depth=0, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=client1, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:08:37 2018 client1/10.11.11.10:16010 peer info: IV_VER=2.3.9
Fri Jan 19 15:08:37 2018 client1/10.11.11.10:16010 peer info: IV_PLAT=linux
Fri Jan 19 15:08:37 2018 client1/10.11.11.10:16010 peer info: IV_PROTO=2
Fri Jan 19 15:08:37 2018 client1/10.11.11.10:16010 WARNING: 'min-platform-entropy' is present in remote config but missing in local config, remote='min-platform-entropy 16'
Fri Jan 19 15:08:37 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:08:37 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:08:37 2018 client1/10.11.11.10:16010 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:08:37 2018 client1/10.11.11.10:16010 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:08:37 2018 client1/10.11.11.10:16010 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Fri Jan 19 15:08:37 2018 client1/10.11.11.10:16010 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Fri Jan 19 15:08:37 2018 client1/10.11.11.10:16010 Control Channel: TLSv1.2, cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, 2048 bit key
Fri Jan 19 15:09:41 2018 client1/10.11.11.10:16010 TLS: new session incoming connection from [AF_INET]10.11.11.10:16010
Fri Jan 19 15:09:41 2018 client1/10.11.11.10:16010 VERIFY OK: depth=1, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=MyCompany CA, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:09:41 2018 client1/10.11.11.10:16010 VERIFY OK: depth=0, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=client1, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:09:41 2018 client1/10.11.11.10:16010 peer info: IV_VER=2.3.9
Fri Jan 19 15:09:41 2018 client1/10.11.11.10:16010 peer info: IV_PLAT=linux
Fri Jan 19 15:09:41 2018 client1/10.11.11.10:16010 peer info: IV_PROTO=2
Fri Jan 19 15:09:41 2018 client1/10.11.11.10:16010 WARNING: 'min-platform-entropy' is present in remote config but missing in local config, remote='min-platform-entropy 16'
Fri Jan 19 15:09:41 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:09:41 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:09:41 2018 client1/10.11.11.10:16010 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:09:41 2018 client1/10.11.11.10:16010 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:09:41 2018 client1/10.11.11.10:16010 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Fri Jan 19 15:09:41 2018 client1/10.11.11.10:16010 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Fri Jan 19 15:09:41 2018 client1/10.11.11.10:16010 Control Channel: TLSv1.2, cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, 2048 bit key
Fri Jan 19 15:10:45 2018 client1/10.11.11.10:16010 TLS: new session incoming connection from [AF_INET]10.11.11.10:16010
Fri Jan 19 15:10:45 2018 client1/10.11.11.10:16010 VERIFY OK: depth=1, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=MyCompany CA, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:10:45 2018 client1/10.11.11.10:16010 VERIFY OK: depth=0, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=client1, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:10:45 2018 client1/10.11.11.10:16010 peer info: IV_VER=2.3.9
Fri Jan 19 15:10:45 2018 client1/10.11.11.10:16010 peer info: IV_PLAT=linux
Fri Jan 19 15:10:45 2018 client1/10.11.11.10:16010 peer info: IV_PROTO=2
Fri Jan 19 15:10:45 2018 client1/10.11.11.10:16010 WARNING: 'min-platform-entropy' is present in remote config but missing in local config, remote='min-platform-entropy 16'
Fri Jan 19 15:10:45 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:10:45 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:10:45 2018 client1/10.11.11.10:16010 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:10:45 2018 client1/10.11.11.10:16010 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:10:45 2018 client1/10.11.11.10:16010 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Fri Jan 19 15:10:45 2018 client1/10.11.11.10:16010 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Fri Jan 19 15:10:45 2018 client1/10.11.11.10:16010 Control Channel: TLSv1.2, cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, 2048 bit key
Fri Jan 19 15:11:49 2018 client1/10.11.11.10:16010 TLS: new session incoming connection from [AF_INET]10.11.11.10:16010
Fri Jan 19 15:11:49 2018 client1/10.11.11.10:16010 VERIFY OK: depth=1, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=MyCompany CA, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:11:49 2018 client1/10.11.11.10:16010 VERIFY OK: depth=0, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=client1, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:11:49 2018 client1/10.11.11.10:16010 peer info: IV_VER=2.3.9
Fri Jan 19 15:11:49 2018 client1/10.11.11.10:16010 peer info: IV_PLAT=linux
Fri Jan 19 15:11:49 2018 client1/10.11.11.10:16010 peer info: IV_PROTO=2
Fri Jan 19 15:11:49 2018 client1/10.11.11.10:16010 WARNING: 'min-platform-entropy' is present in remote config but missing in local config, remote='min-platform-entropy 16'
Fri Jan 19 15:11:49 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:11:49 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:11:49 2018 client1/10.11.11.10:16010 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:11:49 2018 client1/10.11.11.10:16010 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:11:49 2018 client1/10.11.11.10:16010 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Fri Jan 19 15:11:49 2018 client1/10.11.11.10:16010 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Fri Jan 19 15:11:49 2018 client1/10.11.11.10:16010 Control Channel: TLSv1.2, cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, 2048 bit key
Fri Jan 19 15:12:53 2018 client1/10.11.11.10:16010 TLS: new session incoming connection from [AF_INET]10.11.11.10:16010
Fri Jan 19 15:12:53 2018 client1/10.11.11.10:16010 VERIFY OK: depth=1, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=MyCompany CA, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:12:53 2018 client1/10.11.11.10:16010 VERIFY OK: depth=0, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=client1, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:12:53 2018 client1/10.11.11.10:16010 peer info: IV_VER=2.3.9
Fri Jan 19 15:12:53 2018 client1/10.11.11.10:16010 peer info: IV_PLAT=linux
Fri Jan 19 15:12:53 2018 client1/10.11.11.10:16010 peer info: IV_PROTO=2
Fri Jan 19 15:12:53 2018 client1/10.11.11.10:16010 WARNING: 'min-platform-entropy' is present in remote config but missing in local config, remote='min-platform-entropy 16'
Fri Jan 19 15:12:53 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:12:53 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:12:53 2018 client1/10.11.11.10:16010 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:12:53 2018 client1/10.11.11.10:16010 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:12:53 2018 client1/10.11.11.10:16010 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Fri Jan 19 15:12:53 2018 client1/10.11.11.10:16010 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Fri Jan 19 15:12:53 2018 client1/10.11.11.10:16010 Control Channel: TLSv1.2, cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, 2048 bit key
Fri Jan 19 15:13:57 2018 client1/10.11.11.10:16010 TLS: new session incoming connection from [AF_INET]10.11.11.10:16010
Fri Jan 19 15:13:57 2018 client1/10.11.11.10:16010 VERIFY OK: depth=1, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=MyCompany CA, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:13:57 2018 client1/10.11.11.10:16010 VERIFY OK: depth=0, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=client1, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:13:57 2018 client1/10.11.11.10:16010 peer info: IV_VER=2.3.9
Fri Jan 19 15:13:57 2018 client1/10.11.11.10:16010 peer info: IV_PLAT=linux
Fri Jan 19 15:13:57 2018 client1/10.11.11.10:16010 peer info: IV_PROTO=2
Fri Jan 19 15:13:57 2018 client1/10.11.11.10:16010 WARNING: 'min-platform-entropy' is present in remote config but missing in local config, remote='min-platform-entropy 16'
Fri Jan 19 15:13:57 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:13:57 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:13:57 2018 client1/10.11.11.10:16010 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:13:57 2018 client1/10.11.11.10:16010 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:13:57 2018 client1/10.11.11.10:16010 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Fri Jan 19 15:13:57 2018 client1/10.11.11.10:16010 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Fri Jan 19 15:13:57 2018 client1/10.11.11.10:16010 Control Channel: TLSv1.2, cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, 2048 bit key
Fri Jan 19 15:15:01 2018 client1/10.11.11.10:16010 TLS: new session incoming connection from [AF_INET]10.11.11.10:16010
Fri Jan 19 15:15:01 2018 client1/10.11.11.10:16010 VERIFY OK: depth=1, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=MyCompany CA, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:15:01 2018 client1/10.11.11.10:16010 VERIFY OK: depth=0, C=NL, ST=ZH, L=MyTown, O=MyCompany, OU=TechnoOvpnl, CN=client1, ??=EasyRSA, emailAddress=my_email@my_email_server.nl
Fri Jan 19 15:15:01 2018 client1/10.11.11.10:16010 peer info: IV_VER=2.3.9
Fri Jan 19 15:15:01 2018 client1/10.11.11.10:16010 peer info: IV_PLAT=linux
Fri Jan 19 15:15:01 2018 client1/10.11.11.10:16010 peer info: IV_PROTO=2
Fri Jan 19 15:15:01 2018 client1/10.11.11.10:16010 WARNING: 'min-platform-entropy' is present in remote config but missing in local config, remote='min-platform-entropy 16'
Fri Jan 19 15:15:01 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:15:01 2018 client1/10.11.11.10:16010 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:15:01 2018 client1/10.11.11.10:16010 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jan 19 15:15:01 2018 client1/10.11.11.10:16010 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jan 19 15:15:01 2018 client1/10.11.11.10:16010 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Fri Jan 19 15:15:01 2018 client1/10.11.11.10:16010 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Fri Jan 19 15:15:01 2018 client1/10.11.11.10:16010 Control Channel: TLSv1.2, cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384, 2048 bit key
Fri Jan 19 15:15:25 2018 event_wait : Interrupted system call (code=4)
Fri Jan 19 15:15:25 2018 /sbin/ip route del 10.12.0.0/24
Fri Jan 19 15:15:25 2018 Closing TUN/TAP interface
Fri Jan 19 15:15:25 2018 /sbin/ip addr del dev tun0 local 10.12.0.1 peer 10.12.0.2
Fri Jan 19 15:15:25 2018 SIGINT[hard,] received, process exiting

phulshof

I think I may be hitting this issue:
https://community.openvpn.net/openvpn/ticket/880
It doesn't appear to have been confirmed or considered active though. How should I go about discussing this?

TinCanTech

I have been advised that the problem probably stems from your use of --lport in the client.

Can you try with --nobind instead, for testing ?

phulshof

Removing the local port had no impact; adding nobind resolves it.

Question remains if this is wanted behavior; nobind may not be an option for everyone. I have updated issue 880 accordingly though; thanks for your input. 🙂

TinCanTech

phulshof wrote nobind may not be an option for everyone

Can you give an example .. ?

In future release --nobind will probably become mandatory for TLS client.

phulshof

TinCanTech wrote
phulshof wrote nobind may not be an option for everyone
Can you give an example .. ?

In future release --nobind will probably become mandatory for TLS client.

I was thinking of firewalled situations in which only certain ports were allowed for connections.

TinCanTech

The vast majority of clients use an ephemeral client port .. eg: --nobind

phulshof

TinCanTech wrote The vast majority of clients use an ephemeral client port .. eg: --nobind

I'm familiar with the concept, but how would this work in a network environment where that port range is blocked for communication?

TinCanTech

phulshof wrote how would this work in a network environment where that port range is blocked for communication?

In such a network there is not much you can do ..

For example, if ephemeral UPD ports were blocked then most likely all UDP ports are blocked.

Then you would have to use TCP and as such ephemeral ports would be a given. eg: http
Otherwise, no network activity would be allowed outside the network ..