Hi guys, I'm having some trouble with remote login from a remote client, which after connection suddenly disconnects.
SERVER CONFIG:
port 1194
proto tcp
dev tun
client-config-dir ccd
ca "/etc/openvpn/keys/ca.crt"
cert "/etc/openvpn/keys/server.crt"
key "/etc/openvpn/keys/server.key" # This file should be kept secret
dh "/etc/openvpn/keys/dh1024.pem"
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.0.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /etc/openvpn/openvpn-status.log
log-append /var/log/openvpn.log
verb 6
mute 10
crl-verify "/etc/openvpn/keys/crl.pem"
cipher AES-256-CBC
In /etc/openvpn/ccd/myclient.conf, I added this line because myclient generally stays in a network 172.20.230.x behind a NAT.
iroute 172.20.230.0 255.255.255.0
Myclient enstablishes an SSL tunnel vs the server, so that it connects to the server using 127.0.0.1:1195.
CLIENT CONFIG:
machine-readable-output
allow-recursive-routing
ifconfig-nowarn
client
verb 4
connect-retry-max 5
connect-retry 2 300
resolv-retry 60
dev tun
remote 127.0.0.1 1195 tcp-client
comp-lzo
route 0.0.0.0 0.0.0.0 vpn_gateway
nobind
cipher AES-256-CBC
persist-tun
preresolve
management-query-proxy
rcvbuf 0
sndbuf 0
resolv-retry infinite
route myserver.net 255.255.255.255 net_gateway
When it tries to connect, at a certain point client disconnects without an explanation.
SERVER LOG:
Fri Mar 23 12:39:28 2018 us=549073 MULTI: multi_create_instance called
Fri Mar 23 12:39:28 2018 us=549283 Re-using SSL/TLS context
Fri Mar 23 12:39:28 2018 us=549364 LZO compression initialized
Fri Mar 23 12:39:28 2018 us=549719 Control Channel MTU parms [ L:1560 D:140 EF:40 EB:0 ET:0 EL:0 ]
Fri Mar 23 12:39:28 2018 us=549823 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ]
Fri Mar 23 12:39:28 2018 us=549974 Local Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Fri Mar 23 12:39:28 2018 us=550026 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Fri Mar 23 12:39:28 2018 us=550121 Local Options hash (VER=V4): '79ef4284'
Fri Mar 23 12:39:28 2018 us=550200 Expected Remote Options hash (VER=V4): '958c5492'
Fri Mar 23 12:39:28 2018 us=550322 TCP connection established with [AF_INET]127.0.0.1:55586
Fri Mar 23 12:39:28 2018 us=550383 TCPv4_SERVER link local: [undef]
Fri Mar 23 12:39:28 2018 us=550441 TCPv4_SERVER link remote: [AF_INET]127.0.0.1:55586
Fri Mar 23 12:39:28 2018 us=579810 127.0.0.1:55586 TCPv4_SERVER READ [14] from [AF_INET]127.0.0.1:55586: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Fri Mar 23 12:39:28 2018 us=579939 127.0.0.1:55586 TLS: Initial packet from [AF_INET]127.0.0.1:55586, sid=9d91aa41 83f05634
Fri Mar 23 12:39:28 2018 us=580085 127.0.0.1:55586 TCPv4_SERVER WRITE [26] to [AF_INET]127.0.0.1:55586: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ 0 ] pid=0 DATA len=0
Fri Mar 23 12:39:28 2018 us=613523 127.0.0.1:55586 TCPv4_SERVER READ [222] from [AF_INET]127.0.0.1:55586: P_CONTROL_V1 kid=0 [ 0 ] pid=1 DATA len=196
Fri Mar 23 12:39:28 2018 us=832641 127.0.0.1:55586 TCPv4_SERVER WRITE [22] to [AF_INET]127.0.0.1:55586: P_ACK_V1 kid=0 [ 1 ]
Fri Mar 23 12:39:28 2018 us=832996 127.0.0.1:55586 TCPv4_SERVER WRITE [114] to [AF_INET]127.0.0.1:55586: P_CONTROL_V1 kid=0 [ ] pid=1 DATA len=100
Fri Mar 23 12:39:28 2018 us=833170 127.0.0.1:55586 TCPv4_SERVER WRITE [114] to [AF_INET]127.0.0.1:55586: P_CONTROL_V1 kid=0 [ ] pid=2 DATA len=100
Fri Mar 23 12:39:28 2018 us=833307 127.0.0.1:55586 TCPv4_SERVER WRITE [114] to [AF_INET]127.0.0.1:55586: P_CONTROL_V1 kid=0 [ ] pid=3 DATA len=100
Fri Mar 23 12:39:28 2018 us=833429 127.0.0.1:55586 TCPv4_SERVER WRITE [114] to [AF_INET]127.0.0.1:55586: P_CONTROL_V1 kid=0 [ ] pid=4 DATA len=100
Fri Mar 23 12:39:28 2018 us=915196 127.0.0.1:55586 TCPv4_SERVER READ [22] from [AF_INET]127.0.0.1:55586: P_ACK_V1 kid=0 [ 1 ]
Fri Mar 23 12:39:28 2018 us=915392 127.0.0.1:55586 TCPv4_SERVER WRITE [114] to [AF_INET]127.0.0.1:55586: P_CONTROL_V1 kid=0 [ ] pid=5 DATA len=100
Fri Mar 23 12:39:28 2018 us=915622 127.0.0.1:55586 TCPv4_SERVER READ [22] from [AF_INET]127.0.0.1:55586: P_ACK_V1 kid=0 [ 2 ]
Fri Mar 23 12:39:28 2018 us=915742 127.0.0.1:55586 NOTE: --mute triggered...
Fri Mar 23 12:39:29 2018 us=613546 127.0.0.1:55586 45 variation(s) on previous 10 message(s) suppressed by --mute
Fri Mar 23 12:39:29 2018 us=613669 127.0.0.1:55586 CRL: CRL /etc/openvpn/keys/crl.pem is from a different issuer than the issuer of certificate CN=ChangeMe
Fri Mar 23 12:39:29 2018 us=613871 127.0.0.1:55586 VERIFY OK: depth=1, CN=ChangeMe
Fri Mar 23 12:39:29 2018 us=617453 127.0.0.1:55586 CRL: CRL /etc/openvpn/keys/crl.pem is from a different issuer than the issuer of certificate CN=myclient
Fri Mar 23 12:39:29 2018 us=617656 127.0.0.1:55586 VERIFY OK: depth=0, CN=myclient
Fri Mar 23 12:39:29 2018 us=872969 127.0.0.1:55586 TCPv4_SERVER WRITE [22] to [AF_INET]127.0.0.1:55586: P_ACK_V1 kid=0 [ 2 ]
Fri Mar 23 12:39:29 2018 us=873390 127.0.0.1:55586 TCPv4_SERVER READ [192] from [AF_INET]127.0.0.1:55586: P_CONTROL_V1 kid=0 [ ] pid=3 DATA len=178
Fri Mar 23 12:39:29 2018 us=878445 127.0.0.1:55586 TCPv4_SERVER WRITE [77] to [AF_INET]127.0.0.1:55586: P_CONTROL_V1 kid=0 [ 3 ] pid=27 DATA len=51
Fri Mar 23 12:39:29 2018 us=970005 127.0.0.1:55586 TCPv4_SERVER READ [423] from [AF_INET]127.0.0.1:55586: P_CONTROL_V1 kid=0 [ 27 ] pid=4 DATA len=397
Fri Mar 23 12:39:29 2018 us=971302 127.0.0.1:55586 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Mar 23 12:39:29 2018 us=971406 127.0.0.1:55586 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Mar 23 12:39:29 2018 us=971487 127.0.0.1:55586 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Mar 23 12:39:29 2018 us=971568 127.0.0.1:55586 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Mar 23 12:39:29 2018 us=971908 127.0.0.1:55586 TCPv4_SERVER WRITE [126] to [AF_INET]127.0.0.1:55586: P_CONTROL_V1 kid=0 [ 4 ] pid=28 DATA len=100
Fri Mar 23 12:39:29 2018 us=972244 127.0.0.1:55586 TCPv4_SERVER WRITE [114] to [AF_INET]127.0.0.1:55586: P_CONTROL_V1 kid=0 [ ] pid=29 DATA len=100
Fri Mar 23 12:39:29 2018 us=972552 127.0.0.1:55586 TCPv4_SERVER WRITE [88] to [AF_INET]127.0.0.1:55586: P_CONTROL_V1 kid=0 [ ] pid=30 DATA len=74
Fri Mar 23 12:39:30 2018 us=15455 127.0.0.1:55586 TCPv4_SERVER READ [22] from [AF_INET]127.0.0.1:55586: P_ACK_V1 kid=0 [ 28 ]
Fri Mar 23 12:39:30 2018 us=90237 127.0.0.1:55586 TCPv4_SERVER READ [22] from [AF_INET]127.0.0.1:55586: P_ACK_V1 kid=0 [ 29 ]
Fri Mar 23 12:39:30 2018 us=90399 127.0.0.1:55586 TCPv4_SERVER READ [22] from [AF_INET]127.0.0.1:55586: P_ACK_V1 kid=0 [ 30 ]
Fri Mar 23 12:39:30 2018 us=90483 127.0.0.1:55586 Control Channel: TLSv1, cipher TLSv1/SSLv3 EDH-RSA-DES-CBC3-SHA, 2048 bit RSA
Fri Mar 23 12:39:30 2018 us=90579 127.0.0.1:55586 [myclient] Peer Connection Initiated with [AF_INET]127.0.0.1:55586
Fri Mar 23 12:39:30 2018 us=90748 myclient/127.0.0.1:55586 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Fri Mar 23 12:39:30 2018 us=90942 myclient/127.0.0.1:55586 MULTI: Learn: 10.8.0.6 -> myclient/127.0.0.1:55586
Fri Mar 23 12:39:30 2018 us=91003 myclient/127.0.0.1:55586 MULTI: primary virtual IP for myclient/127.0.0.1:55586: 10.8.0.6
Fri Mar 23 12:39:30 2018 us=91099 myclient/127.0.0.1:55586 TCPv4_SERVER READ [59] from [AF_INET]127.0.0.1:55586: P_CONTROL_V1 kid=0 [ ] pid=5 DATA len=45
Fri Mar 23 12:39:30 2018 us=91302 myclient/127.0.0.1:55586 PUSH: Received control message: 'PUSH_REQUEST'
Fri Mar 23 12:39:30 2018 us=91359 myclient/127.0.0.1:55586 send_push_reply(): safe_cap=940
Fri Mar 23 12:39:30 2018 us=91579 myclient/127.0.0.1:55586 SENT CONTROL [myclient]: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Fri Mar 23 12:39:30 2018 us=91671 myclient/127.0.0.1:55586 TCPv4_SERVER WRITE [22] to [AF_INET]127.0.0.1:55586: P_ACK_V1 kid=0 [ 5 ]
Fri Mar 23 12:39:30 2018 us=91904 myclient/127.0.0.1:55586 TCPv4_SERVER WRITE [114] to [AF_INET]127.0.0.1:55586: P_CONTROL_V1 kid=0 [ ] pid=31 DATA len=100
Fri Mar 23 12:39:30 2018 us=92166 myclient/127.0.0.1:55586 TCPv4_SERVER WRITE [114] to [AF_INET]127.0.0.1:55586: P_CONTROL_V1 kid=0 [ ] pid=32 DATA len=100
Fri Mar 23 12:39:30 2018 us=92373 myclient/127.0.0.1:55586 TCPv4_SERVER WRITE [96] to [AF_INET]127.0.0.1:55586: P_CONTROL_V1 kid=0 [ ] pid=33 DATA len=82
Fri Mar 23 12:39:30 2018 us=175596 myclient/127.0.0.1:55586 TCPv4_SERVER READ [22] from [AF_INET]127.0.0.1:55586: P_ACK_V1 kid=0 [ 31 ]
Fri Mar 23 12:39:30 2018 us=223537 127.0.0.1:55582 Connection reset, restarting [0]
Fri Mar 23 12:39:30 2018 us=223632 127.0.0.1:55582 SIGUSR1[soft,connection-reset] received, client-instance restarting
CLIENT LOG:
2018-03-23 14:57:56 OpenVPN 2.5-icsopenvpn [git:icsopenvpn-d51333c645c12713+] android-21-arm64-v8a [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Jun 26 2017
2018-03-23 14:57:56 library versions: OpenSSL 1.1.0f 25 May 2017, LZO 2.10
2018-03-23 14:57:56 MANAGEMENT: Connected to management server at /data/user/0/de.blinkt.openvpn/cache/mgmtsocket
2018-03-23 14:57:56 MANAGEMENT: CMD 'hold release'
2018-03-23 14:57:56 MANAGEMENT: CMD 'proxy NONE'
2018-03-23 14:57:56 MANAGEMENT: CMD 'bytecount 2'
2018-03-23 14:57:56 MANAGEMENT: CMD 'state on'
2018-03-23 14:57:57 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
2018-03-23 14:57:57 LZO compression initializing
2018-03-23 14:57:57 New OpenVPN Status (TCP_CONNECT->LEVEL_CONNECTING_NO_SERVER_REPLY_YET): ,,,,,
2018-03-23 14:57:57 New OpenVPN Status (TCP_CONNECT->LEVEL_CONNECTING_NO_SERVER_REPLY_YET): ,,,,,
2018-03-23 14:57:57 Control Channel MTU parms [ L:1624 D:1210 EF:40 EB:0 ET:0 EL:3 ]
2018-03-23 14:57:57 New OpenVPN Status (WAIT->LEVEL_CONNECTING_NO_SERVER_REPLY_YET): ,,,,,
2018-03-23 14:57:57 New OpenVPN Status (WAIT->LEVEL_CONNECTING_NO_SERVER_REPLY_YET): ,,,,,
2018-03-23 14:57:57 Data Channel MTU parms [ L:1624 D:1450 EF:124 EB:406 ET:0 EL:3 ]
2018-03-23 14:57:57 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
2018-03-23 14:57:57 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
2018-03-23 14:57:57 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:1195
2018-03-23 14:57:57 Socket Buffers: R=[1048576->1048576] S=[524288->524288]
2018-03-23 14:57:57 Attempting to establish TCP connection with [AF_INET]127.0.0.1:1195 [nonblock]
2018-03-23 14:57:57 MANAGEMENT: >STATE:1521813477,TCP_CONNECT,,,,,,
2018-03-23 14:57:57 TCP connection established with [AF_INET]127.0.0.1:1195
2018-03-23 14:57:57 TCP_CLIENT link local: (not bound)
2018-03-23 14:57:57 TCP_CLIENT link remote: [AF_INET]127.0.0.1:1195
2018-03-23 14:57:57 MANAGEMENT: >STATE:1521813477,WAIT,,,,,,
2018-03-23 14:57:58 New OpenVPN Status (AUTH->LEVEL_CONNECTING_SERVER_REPLIED): ,,,,,
2018-03-23 14:57:58 New OpenVPN Status (AUTH->LEVEL_CONNECTING_SERVER_REPLIED): ,,,,,
2018-03-23 14:57:58 MANAGEMENT: >STATE:1521813478,AUTH,,,,,,
2018-03-23 14:57:58 TLS: Initial packet from [AF_INET]127.0.0.1:1195, sid=f3d97d73 dc8d00c4
2018-03-23 14:57:58 GDG: SIOCGIFHWADDR(lo) failed
2018-03-23 14:57:58 VERIFY OK: depth=1, CN=ChangeMe
2018-03-23 14:57:58 VERIFY OK: depth=0, CN=server
2018-03-23 14:57:59 Control Channel: TLSv1, cipher SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
2018-03-23 14:57:59 [server] Peer Connection Initiated with [AF_INET]127.0.0.1:1195
2018-03-23 14:58:00 New OpenVPN Status (GET_CONFIG->LEVEL_CONNECTING_SERVER_REPLIED): ,,,,,
2018-03-23 14:58:00 New OpenVPN Status (GET_CONFIG->LEVEL_CONNECTING_SERVER_REPLIED): ,,,,,
2018-03-23 14:58:00 MANAGEMENT: >STATE:1521813480,GET_CONFIG,,,,,,
2018-03-23 14:58:00 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
2018-03-23 14:58:00 New OpenVPN Status (ASSIGN_IP->LEVEL_CONNECTING_SERVER_REPLIED): ,10.8.0.6,,,,
2018-03-23 14:58:00 New OpenVPN Status (ASSIGN_IP->LEVEL_CONNECTING_SERVER_REPLIED): ,10.8.0.6,,,,
2018-03-23 14:58:00 PUSH: Received control message: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
2018-03-23 14:58:00 OPTIONS IMPORT: timers and/or timeouts modified
2018-03-23 14:58:00 OPTIONS IMPORT: --ifconfig/up options modified
2018-03-23 14:58:00 OPTIONS IMPORT: route options modified
2018-03-23 14:58:00 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2018-03-23 14:58:00 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:406 ET:0 EL:3 ]
2018-03-23 14:58:00 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
2018-03-23 14:58:00 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2018-03-23 14:58:00 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
2018-03-23 14:58:00 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2018-03-23 14:58:00 GDG: SIOCGIFHWADDR(lo) failed
2018-03-23 14:58:00 ROUTE_GATEWAY 127.100.103.119/255.0.0.0 IFACE=lo
2018-03-23 14:58:00 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
2018-03-23 14:58:00 MANAGEMENT: >STATE:1521813480,ASSIGN_IP,,10.8.0.6,,,,
2018-03-23 14:58:00 MANAGEMENT: CMD 'needok 'IFCONFIG' ok'
2018-03-23 14:58:00 MANAGEMENT: CMD 'needok 'ROUTE' ok'
2018-03-23 14:58:00 MANAGEMENT: >STATE:1521813480,ADD_ROUTES,,,,,,
2018-03-23 14:58:00 New OpenVPN Status (ADD_ROUTES->LEVEL_CONNECTING_SERVER_REPLIED): ,,,,,
2018-03-23 14:58:00 New OpenVPN Status (ADD_ROUTES->LEVEL_CONNECTING_SERVER_REPLIED): ,,,,,
2018-03-23 14:58:00 MANAGEMENT: CMD 'needok 'ROUTE' ok'
2018-03-23 14:58:00 MANAGEMENT: CMD 'needok 'ROUTE' ok'
2018-03-23 14:58:00 MANAGEMENT: CMD 'needok 'ROUTE' ok'
2018-03-23 14:58:00 MANAGEMENT: CMD 'needok 'DNSSERVER' ok'
2018-03-23 14:58:00 MANAGEMENT: CMD 'needok 'DNSSERVER' ok'
2018-03-23 14:58:00 MANAGEMENT: CMD 'needok 'PERSIST_TUN_ACTION' OPEN_BEFORE_CLOSE'
2018-03-23 14:58:00 Apertura interfaccia tun in corso:
2018-03-23 14:58:00 Indirizzi locali - IPv4: 10.8.0.6/30 IPv6: null MTU: 1500
2018-03-23 14:58:00 DNS Server: 208.67.222.222, 208.67.220.220, Dominio: null
2018-03-23 14:58:00 Instradamenti: 0.0.0.0/0, 10.8.0.1/32, 10.8.0.4/30, 192.168.0.0/24
2018-03-23 14:58:00 Instradamenti esclusi:
2018-03-23 14:58:00 Instradamenti VpnService installati: 0.0.0.0/0
2018-03-23 14:58:00 Applicazioni VPN non consentite:
2018-03-23 14:58:00 MANAGEMENT: CMD 'needok 'OPENTUN' ok'
2018-03-23 14:58:00 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2018-03-23 14:58:00 Initialization Sequence Completed
2018-03-23 14:58:00 MANAGEMENT: >STATE:1521813480,CONNECTED,SUCCESS,10.8.0.6,127.0.0.1,1195,127.0.0.1,46689
2018-03-23 14:58:00 Connection reset, restarting [-1]
2018-03-23 14:58:00 TCP/UDP: Closing socket
2018-03-23 14:58:00 SIGUSR1[soft,connection-reset] received, process restarting
2018-03-23 14:58:00 MANAGEMENT: >STATE:1521813480,RECONNECTING,connection-reset,,,,,
Can you help me understanding what's wrong with my config?
