I try to set up a connection over the internet between two ipfire routers, having OpenVPN installed on both. r3 is the server, r1 the client. It almost works. First, the "server" is started: here are what i think are the most relevant log lines: [code] Jul 5 18:44:24 r3 openvpnserver[23717]: OpenVPN 2.3.18 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Nov 3 2017 Jul 5 18:44:24 r3 openvpnserver[23717]: library versions: OpenSSL 1.0.2m 2 Nov 2017, LZO 2.09 [...] Jul 5 18:44:24 r3 openvpnserver[23718]: TUN/TAP device tun0 opened Jul 5 18:44:24 r3 openvpnserver[23718]: TUN/TAP TX queue length set to 100 [...] Jul 5 18:44:24 r3 openvpnserver[23718]: /sbin/ip link set dev tun0 up mtu 1400 Jul 5 18:44:24 r3 openvpnserver[23718]: /sbin/ip addr add dev tun0 local 10.0.13.1 peer 10.0.13.2 Jul 5 18:44:24 r3 openvpnserver[23718]: /sbin/ip route add 10.0.13.0/24 via 10.0.13.2 [...] Jul 5 18:44:24 r3 openvpnserver[23718]: Listening for incoming TCP connection on [undef] Jul 5 18:44:24 r3 openvpnserver[23718]: TCPv4_SERVER link local (bound): [undef] Jul 5 18:44:24 r3 openvpnserver[23718]: TCPv4_SERVER link remote: [undef] Jul 5 18:44:24 r3 openvpnserver[23718]: MULTI: multi_init called, r=256 v=256 Jul 5 18:44:24 r3 openvpnserver[23718]: IFCONFIG POOL: base=10.0.13.4 size=62, ipv6=0 Jul 5 18:44:24 r3 openvpnserver[23718]: MULTI: TCP INIT maxclients=100 maxevents=104 Jul 5 18:44:24 r3 openvpnserver[23718]: Initialization Sequence Completed [/code] The first problem arises : why IFCONFIG POOL: base=10.0.13.4 ? I did not set that anywhere. Then i start the client on r1 and here the logs on r3 : [code]Jul 5 19:25:50 r3 openvpnserver[23718]: TCP connection established with [AF_INET]:1194 WARNING: 'ifconfig' is present in remote config but missing in local config, remote='ifconfig 10.0.13.1 10.0.13.2' [...] Jul 5 19:25:51 r3 openvpnserver[23718]: r1.FQDN/:1194 MULTI: Learn: 10.0.13.6 -> r1.FQDN/:1194 MULTI: primary virtual IP for r1.FQDN/ dev tun proto tcp port 1194 script-security 3 system ;ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600 client-config-dir /var/ipfire/ovpn/ccd tls-server ca /var/ipfire/ovpn/ca/cacert.pem cert /var/ipfire/ovpn/certs/servercert.pem key /var/ipfire/ovpn/certs/serverkey.pem dh /var/ipfire/ovpn/ca/dh1024.pem server 10.0.13.0 255.255.255.0 tun-mtu 1400 keepalive 10 60 status-version 1 status /var/run/ovpnserver.log 30 cipher AES-256-CBC auth SHA512 comp-lzo push "dhcp-option DOMAIN FQDN" max-clients 100 tls-verify /usr/lib/openvpn/verify crl-verify /var/ipfire/ovpn/crls/cacrl.pem user nobody group nobody persist-key persist-tun verb 3 [/oconf] And the client : [oconf=client] # IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d # # User Security user nobody group nobody persist-tun persist-key script-security 2 # IP/DNS for remote Server Gateway remote

[quote="Denis Valdenaire" post_id=79857 time=1530822540 user_id=44484] Where do the IP 13.4 or 13.6 come from ? [/quote]Please see --[b]topology[/b] here: https://github.com/OpenVPN/openvpn/blob/master/sample/sample-config-files/server.conf

Openvpn server on ipfire routers get wrong IP

Denis Valdenaire

I try to set up a connection over the internet between two ipfire routers, having OpenVPN installed on both. r3 is the server, r1 the client.

It almost works. First, the "server" is started: here are what i think are the most relevant log lines:

Jul  5 18:44:24 r3 openvpnserver[23717]: OpenVPN 2.3.18 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Nov  3 2017
Jul  5 18:44:24 r3 openvpnserver[23717]: library versions: OpenSSL 1.0.2m  2 Nov 2017, LZO 2.09
[...]
Jul  5 18:44:24 r3 openvpnserver[23718]: TUN/TAP device tun0 opened
Jul  5 18:44:24 r3 openvpnserver[23718]: TUN/TAP TX queue length set to 100
[...]
Jul  5 18:44:24 r3 openvpnserver[23718]: /sbin/ip link set dev tun0 up mtu 1400
Jul  5 18:44:24 r3 openvpnserver[23718]: /sbin/ip addr add dev tun0 local 10.0.13.1 peer 10.0.13.2
Jul  5 18:44:24 r3 openvpnserver[23718]: /sbin/ip route add 10.0.13.0/24 via 10.0.13.2
[...]
Jul  5 18:44:24 r3 openvpnserver[23718]: Listening for incoming TCP connection on [undef]
Jul  5 18:44:24 r3 openvpnserver[23718]: TCPv4_SERVER link local (bound): [undef]
Jul  5 18:44:24 r3 openvpnserver[23718]: TCPv4_SERVER link remote: [undef]
Jul  5 18:44:24 r3 openvpnserver[23718]: MULTI: multi_init called, r=256 v=256
Jul  5 18:44:24 r3 openvpnserver[23718]: IFCONFIG POOL: base=10.0.13.4 size=62, ipv6=0
Jul  5 18:44:24 r3 openvpnserver[23718]: MULTI: TCP INIT maxclients=100 maxevents=104
Jul  5 18:44:24 r3 openvpnserver[23718]: Initialization Sequence Completed

The first problem arises : why IFCONFIG POOL: base=10.0.13.4 ? I did not set that anywhere.

Then i start the client on r1 and here the logs on r3 :

Jul  5 19:25:50 r3 openvpnserver[23718]: TCP connection established with [AF_INET]<r1'IP>:1194
[...]
Jul  5 19:25:51 r3 openvpnserver[23718]: <r1'IP>:1194 WARNING: 'ifconfig' is present in remote config but missing in local config, remote='ifconfig 10.0.13.1 10.0.13.2'
[...]
Jul  5 19:25:51 r3 openvpnserver[23718]: r1.FQDN/<r1'IP>:1194 MULTI_sva: pool returned IPv4=10.0.13.6, IPv6=(Not enabled)
Jul  5 19:25:51 r3 openvpnserver[23718]: r1.FQDN/<r1'IP>:1194 MULTI: Learn: 10.0.13.6 -> r1.FQDN/<r1'IP>:1194
Jul  5 19:25:51 r3 openvpnserver[23718]: r1.FQDN/<r1'IP>:1194 MULTI: primary virtual IP for r1.FQDN/<r1'IP>:1194: 10.0.13.6

So i don't get it: base IP is 10.0.13.4 (don't know where it comes from) and now the peer IP is...

MULTI_sva: pool returned IPv4=10.0.13.6

?

At the same the link on tun0 is between 10.0.13.1 and 10.0.13.2.

So routes are broken and despite the fact the connexion is established and authenticated, I can't route the traffic between the two internals subnets (192.168.1.0/24 and .2.0/24 for that matters).

What is wrong ? Shouldn't the IP on both sides of the VPN be 10.0.13.1 and 10.0.13.2 ?

Where do the IP 13.4 or 13.6 come from ?

Here is the server config:

#OpenVPN Server conf

daemon openvpnserver
writepid /var/run/openvpn.pid
#DAN prepare OpenVPN for listening on blue and orange
;local <r3's IP addr>
dev tun
proto tcp
port 1194
script-security 3 system
;ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600
client-config-dir /var/ipfire/ovpn/ccd
tls-server
ca /var/ipfire/ovpn/ca/cacert.pem
cert /var/ipfire/ovpn/certs/servercert.pem
key /var/ipfire/ovpn/certs/serverkey.pem
dh /var/ipfire/ovpn/ca/dh1024.pem
server 10.0.13.0 255.255.255.0
tun-mtu 1400
keepalive 10 60
status-version 1
status /var/run/ovpnserver.log 30
cipher AES-256-CBC
auth SHA512
comp-lzo
push "dhcp-option DOMAIN FQDN"
max-clients 100
tls-verify /usr/lib/openvpn/verify
crl-verify /var/ipfire/ovpn/crls/cacrl.pem
user nobody
group nobody
persist-key
persist-tun
verb 3

And the client :

# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d
#
# User Security
user nobody
group nobody
persist-tun
persist-key
script-security 2
# IP/DNS for remote Server Gateway
remote <r3's IP addr>
float
# IP adresses of the VPN Subnet
ifconfig 10.0.13.2 10.0.13.1
# Server Gateway Network
route 192.168.2.0 255.255.255.0
up "/etc/init.d/static-routes start"
# tun Device
dev tun
#Logfile for statistics
status-version 1
status /var/run/openvpn/confname-n2n 10
# Port and Protokol
port 1194
proto tcp-client
# Packet size
tun-mtu 1400
remote-cert-tls server
# Auth. Client
tls-client
# Cipher
cipher AES-256-CBC
pkcs12 /var/ipfire/ovpn/certs/confname.p12
# HMAC algorithm
auth SHA512
# Enable Compression
comp-lzo
# Debug Level
verb 3
# Tunnel check
keepalive 10 60
# Start as daemon
daemon confnamen2n
writepid /var/run/confnamen2n.pid
# Activate Management Interface and Port
management localhost 1194

Thanks in advance for any help

TinCanTech

Denis Valdenaire wrote Where do the IP 13.4 or 13.6 come from ?

Please see --topology here:
https://github.com/OpenVPN/openvpn/blob/master/sample/sample-config-files/server.conf

Denis Valdenaire

Thanks, it works - but the fact is i still don't get why it didn't. The comments in the sample config file did not help me at first.

On the other hand, ipfire openvpn does not have this option to be enabled or disabled.

TinCanTech

What is IPFire ?

Denis Valdenaire

Sorry, i mentionned it but didn't explain that i use IPFire, a linux firewall distribution, that has OpenVPN installed. It has nothing to do with OpenVPN, but i has an web interface to configure it. What i said (it was really a side note for me, i was tired) is that this interface doesn't have like a checkbox or something about this topology option. Never mind, i'll report it to the IPFire devs.

Back to the subject, now the two peers are connected. I can't ping the client from the server but that's a firewall problem, packets are seen on client but don't come back.

Thanks again for your help, configuration problem is solved.