Hello, I have ISP modem NETIS EP8101G which is a back-box for me. It's connected to TP-Link TL-WR1043N/ND v1 with LEDE Reboot 17.01.4 r3560-79f57e422d / LuCI lede-17.01 branch (git-17.290.79498-d3f0685). On router Gateway: 172.16.20.1 LAN: IPv4: 192.168.7.1/24 On router I installed OpenVPN by this guide: https://openwrt.org/docs/guide-user/services/vpn/openvpn/server.setup I'm using http://freedns.afraid.org/. Looks like on server side it's working, but when I'm trying to connect from Android phone via cellular network it stacks at "waiting for server" and than fails after timeout (10 sec). [oconf="server"] config openvpn 'vpnserver' option enabled '1' option dev_type 'tun' option dev 'ovpns0' option port '1194' option topology 'subnet' option tls_server '1' option mode 'server' option server '192.168.200.0 255.255.255.0' option route_gateway 'dhcp' option compress 'lz4' option keepalive '10 120' option persist_key '1' option persist_tun '1' option ca '/etc/openvpn/ca.crt' option cert '/etc/openvpn/my-server.crt' option key '/etc/openvpn/my-server.key' option dh '/etc/openvpn/dh2048.pem' option tls_auth '/etc/openvpn/tls-auth.key 0' option log '/tmp/openvpn.log' list push 'topology subnet' list push 'redirect-gateway def1' list push 'route-gateway dhcp' list push 'route 192.168.200.0 255.255.255.0' list push 'dhcp-option DNS 192.168.7.1' list push 'compress lz4' list push 'persist-key' list push 'persist-tun' option proto 'tcp' [/oconf] [oconf=client] client dev tun proto udp fast-io remote xXx.mooo.com 1194 remote-cert-tls server nobind persist-key persist-tun compress lz4 verb 5 key-direction 1 -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- Certificate: Data: Version: 3 (0x2) Serial Number: 4097 (0x1001) Signature Algorithm: sha256WithRSAEncryption Issuer: C=GB, ST=London, O=WWW Ltd. Validity Not Before: Jul 18 20:08:06 2018 GMT Not After : Jul 15 20:08:06 2028 GMT Subject: CN=my-client Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (4096 bit) Modulus: Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: Digital Signature X509v3 Extended Key Usage: TLS Web Client Authentication Signature Algorithm: sha256WithRSAEncryption -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- -----BEGIN PRIVATE KEY----- -----END PRIVATE KEY----- # # 2048 bit OpenVPN static key # -----BEGIN OpenVPN Static key V1----- -----END OpenVPN Static key V1----- [/oconf] Log from Android: [list]10:24:14.245 -- ----- OpenVPN Start ----- 10:24:14.246 -- EVENT: CORE_THREAD_ACTIVE 10:24:14.253 -- Frame=512/2048/512 mssfix-ctrl=1250 10:24:14.265 -- UNUSED OPTIONS 3 [fast-io] 6 [nobind] 7 [persist-key] 8 [persist-tun] 10 [verb] [7] 10:24:14.266 -- EVENT: RESOLVE 10:24:14.274 -- Contacting @.@.@.@:1194 via TCP 10:24:14.274 -- EVENT: WAIT 10:24:24.278 -- Server poll timeout, trying next remote entry... 10:24:24.305 -- EVENT: RECONNECTING 10:24:24.312 -- EVENT: RESOLVE 10:24:24.334 -- EVENT: CONNECTION_TIMEOUT 10:24:24.339 -- EVENT: DISCONNECTED 10:24:24.355 -- EVENT: CORE_THREAD_INACTIVE 10:24:24.357 -- Tunnel bytes per CPU second: 0 10:24:24.359 -- ----- OpenVPN Stop ----- Log from server: Fri Jul 20 11:47:30 2018 daemon.notice openvpn(bap80)[5411]: OpenVPN 2.4.4 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] Fri Jul 20 11:47:30 2018 daemon.notice openvpn(sample_server)[5410]: OpenVPN 2.4.4 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] Fri Jul 20 11:47:30 2018 daemon.notice openvpn(bap80)[5411]: library versions: OpenSSL 1.0.2o 27 Mar 2018, LZO 2.10 Fri Jul 20 11:47:30 2018 daemon.notice openvpn(bap80)[5411]: Diffie-Hellman initialized with 2048 bit key Fri Jul 20 11:47:30 2018 daemon.notice openvpn(sample_server)[5410]: library versions: OpenSSL 1.0.2o 27 Mar 2018, LZO 2.10 Fri Jul 20 11:47:30 2018 daemon.notice openvpn(sample_server)[5410]: Diffie-Hellman initialized with 2048 bit key Fri Jul 20 11:47:30 2018 daemon.err openvpn(bap80)[5411]: OpenSSL: error:02001002:lib(2):func(1):reason(2) Fri Jul 20 11:47:30 2018 daemon.err openvpn(bap80)[5411]: OpenSSL: error:2006D080:lib(32):func(109):reason(128) Fri Jul 20 11:47:30 2018 daemon.err openvpn(bap80)[5411]: OpenSSL: error:140AD002:lib(20):func(173):reason(2) Fri Jul 20 11:47:30 2018 daemon.err openvpn(sample_server)[5410]: OpenSSL: error:02001002:lib(2):func(1):reason(2) Fri Jul 20 11:47:30 2018 daemon.err openvpn(bap80)[5411]: Cannot load certificate file /etc/openvpn/server.crt Fri Jul 20 11:47:30 2018 daemon.notice openvpn(bap80)[5411]: Exiting due to fatal error Fri Jul 20 11:47:30 2018 daemon.err openvpn(sample_server)[5410]: OpenSSL: error:2006D080:lib(32):func(109):reason(128) Fri Jul 20 11:47:30 2018 daemon.err openvpn(sample_server)[5410]: OpenSSL: error:140AD002:lib(20):func(173):reason(2) Fri Jul 20 11:47:30 2018 daemon.err openvpn(sample_server)[5410]: Cannot load certificate file /etc/openvpn/server.crt Fri Jul 20 11:47:30 2018 daemon.notice openvpn(sample_server)[5410]: Exiting due to fatal error Fri Jul 20 11:47:32 2018 daemon.err openvpn(custom_config)[5412]: Options error: In [CMD-LINE]:1: Error opening configuration file: openvpn-custom_config.conf Fri Jul 20 11:47:32 2018 daemon.warn openvpn(custom_config)[5412]: Use --help for more information. Fri Jul 20 11:47:33 2018 daemon.notice openvpn(sample_client)[5413]: OpenVPN 2.4.4 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] Fri Jul 20 11:47:33 2018 daemon.notice openvpn(sample_client)[5413]: library versions: OpenSSL 1.0.2o 27 Mar 2018, LZO 2.10 Fri Jul 20 11:47:33 2018 daemon.warn openvpn(sample_client)[5413]: WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info. Fri Jul 20 11:47:33 2018 daemon.err openvpn(sample_client)[5413]: OpenSSL: error:02001002:lib(2):func(1):reason(2) Fri Jul 20 11:47:33 2018 daemon.err openvpn(sample_client)[5413]: OpenSSL: error:2006D080:lib(32):func(109):reason(128) Fri Jul 20 11:47:33 2018 daemon.err openvpn(sample_client)[5413]: OpenSSL: error:140AD002:lib(20):func(173):reason(2) Fri Jul 20 11:47:33 2018 daemon.err openvpn(sample_client)[5413]: Cannot load certificate file /etc/openvpn/client.crt Fri Jul 20 11:47:33 2018 daemon.notice openvpn(sample_client)[5413]: Exiting due to fatal error[/list]

[quote=bap80 post_id=80075 time=1532080381 user_id=44615] option server '192.168.200.0 255.255.255.0' .. option [b]log[/b] '/tmp/openvpn.log' [/quote]Check your server log.

waiting for server

bap80

Hello,

I have ISP modem NETIS EP8101G which is a back-box for me. It's connected to TP-Link TL-WR1043N/ND v1 with LEDE Reboot 17.01.4 r3560-79f57e422d / LuCI lede-17.01 branch (git-17.290.79498-d3f0685).

On router
Gateway: 172.16.20.1
LAN: IPv4: 192.168.7.1/24

On router I installed OpenVPN by this guide: https://openwrt.org/docs/guide-user/services/vpn/openvpn/server.setup

I'm using http://freedns.afraid.org/.

Looks like on server side it's working, but when I'm trying to connect from Android phone via cellular network it stacks at "waiting for server" and than fails after timeout (10 sec).

config openvpn 'vpnserver'
option enabled '1'
option dev_type 'tun'
option dev 'ovpns0'
option port '1194'
option topology 'subnet'
option tls_server '1'
option mode 'server'
option server '192.168.200.0 255.255.255.0'
option route_gateway 'dhcp'
option compress 'lz4'
option keepalive '10 120'
option persist_key '1'
option persist_tun '1'
option ca '/etc/openvpn/ca.crt'
option cert '/etc/openvpn/my-server.crt'
option key '/etc/openvpn/my-server.key'
option dh '/etc/openvpn/dh2048.pem'
option tls_auth '/etc/openvpn/tls-auth.key 0'
option log '/tmp/openvpn.log'
list push 'topology subnet'
list push 'redirect-gateway def1'
list push 'route-gateway dhcp'
list push 'route 192.168.200.0 255.255.255.0'
list push 'dhcp-option DNS 192.168.7.1'
list push 'compress lz4'
list push 'persist-key'
list push 'persist-tun'
option proto 'tcp'

client
dev tun
proto udp
fast-io
remote xXx.mooo.com 1194
remote-cert-tls server
nobind
persist-key
persist-tun
compress lz4
verb 5
key-direction 1
<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>
<cert>
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 4097 (0x1001)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=GB, ST=London, O=WWW Ltd.
Validity
Not Before: Jul 18 20:08:06 2018 GMT
Not After : Jul 15 20:08:06 2028 GMT
Subject: CN=my-client
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (4096 bit)
Modulus:
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Key Usage:
Digital Signature
X509v3 Extended Key Usage:
TLS Web Client Authentication
Signature Algorithm: sha256WithRSAEncryption
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
</key>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
-----END OpenVPN Static key V1-----
</tls-auth>

Log from Android:

10:24:14.245 -- ----- OpenVPN Start -----
10:24:14.246 -- EVENT: CORE_THREAD_ACTIVE
10:24:14.253 -- Frame=512/2048/512 mssfix-ctrl=1250
10:24:14.265 -- UNUSED OPTIONS
3 [fast-io]
6 [nobind]
7 [persist-key]
8 [persist-tun]
10 [verb] [7]
10:24:14.266 -- EVENT: RESOLVE
10:24:14.274 -- Contacting @.@.@.@:1194 via TCP
10:24:14.274 -- EVENT: WAIT
10:24:24.278 -- Server poll timeout, trying next remote entry...
10:24:24.305 -- EVENT: RECONNECTING
10:24:24.312 -- EVENT: RESOLVE
10:24:24.334 -- EVENT: CONNECTION_TIMEOUT
10:24:24.339 -- EVENT: DISCONNECTED
10:24:24.355 -- EVENT: CORE_THREAD_INACTIVE
10:24:24.357 -- Tunnel bytes per CPU second: 0
10:24:24.359 -- ----- OpenVPN Stop -----

Log from server:
Fri Jul 20 11:47:30 2018 daemon.notice openvpn(bap80)[5411]: OpenVPN 2.4.4 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Fri Jul 20 11:47:30 2018 daemon.notice openvpn(sample_server)[5410]: OpenVPN 2.4.4 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Fri Jul 20 11:47:30 2018 daemon.notice openvpn(bap80)[5411]: library versions: OpenSSL 1.0.2o 27 Mar 2018, LZO 2.10
Fri Jul 20 11:47:30 2018 daemon.notice openvpn(bap80)[5411]: Diffie-Hellman initialized with 2048 bit key
Fri Jul 20 11:47:30 2018 daemon.notice openvpn(sample_server)[5410]: library versions: OpenSSL 1.0.2o 27 Mar 2018, LZO 2.10
Fri Jul 20 11:47:30 2018 daemon.notice openvpn(sample_server)[5410]: Diffie-Hellman initialized with 2048 bit key
Fri Jul 20 11:47:30 2018 daemon.err openvpn(bap80)[5411]: OpenSSL: error:02001002:lib(2):func(1):reason(2)
Fri Jul 20 11:47:30 2018 daemon.err openvpn(bap80)[5411]: OpenSSL: error:2006D080:lib(32):func(109):reason(128)
Fri Jul 20 11:47:30 2018 daemon.err openvpn(bap80)[5411]: OpenSSL: error:140AD002:lib(20):func(173):reason(2)
Fri Jul 20 11:47:30 2018 daemon.err openvpn(sample_server)[5410]: OpenSSL: error:02001002:lib(2):func(1):reason(2)
Fri Jul 20 11:47:30 2018 daemon.err openvpn(bap80)[5411]: Cannot load certificate file /etc/openvpn/server.crt
Fri Jul 20 11:47:30 2018 daemon.notice openvpn(bap80)[5411]: Exiting due to fatal error
Fri Jul 20 11:47:30 2018 daemon.err openvpn(sample_server)[5410]: OpenSSL: error:2006D080:lib(32):func(109):reason(128)
Fri Jul 20 11:47:30 2018 daemon.err openvpn(sample_server)[5410]: OpenSSL: error:140AD002:lib(20):func(173):reason(2)
Fri Jul 20 11:47:30 2018 daemon.err openvpn(sample_server)[5410]: Cannot load certificate file /etc/openvpn/server.crt
Fri Jul 20 11:47:30 2018 daemon.notice openvpn(sample_server)[5410]: Exiting due to fatal error

Fri Jul 20 11:47:32 2018 daemon.err openvpn(custom_config)[5412]: Options error: In [CMD-LINE]:1: Error opening configuration file: openvpn-custom_config.conf
Fri Jul 20 11:47:32 2018 daemon.warn openvpn(custom_config)[5412]: Use --help for more information.
Fri Jul 20 11:47:33 2018 daemon.notice openvpn(sample_client)[5413]: OpenVPN 2.4.4 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Fri Jul 20 11:47:33 2018 daemon.notice openvpn(sample_client)[5413]: library versions: OpenSSL 1.0.2o 27 Mar 2018, LZO 2.10
Fri Jul 20 11:47:33 2018 daemon.warn openvpn(sample_client)[5413]: WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Fri Jul 20 11:47:33 2018 daemon.err openvpn(sample_client)[5413]: OpenSSL: error:02001002:lib(2):func(1):reason(2)
Fri Jul 20 11:47:33 2018 daemon.err openvpn(sample_client)[5413]: OpenSSL: error:2006D080:lib(32):func(109):reason(128)
Fri Jul 20 11:47:33 2018 daemon.err openvpn(sample_client)[5413]: OpenSSL: error:140AD002:lib(20):func(173):reason(2)
Fri Jul 20 11:47:33 2018 daemon.err openvpn(sample_client)[5413]: Cannot load certificate file /etc/openvpn/client.crt
Fri Jul 20 11:47:33 2018 daemon.notice openvpn(sample_client)[5413]: Exiting due to fatal error

TinCanTech

bap80 wrote Looks like on server side it's working

Did you even read your server log ?

bap80 wrote Log from server:

<snip>

Fri Jul 20 11:47:30 2018 daemon.err openvpn(sample_server)[5410]: Cannot load certificate file /etc/openvpn/server.crt
Fri Jul 20 11:47:30 2018 daemon.notice openvpn(sample_server)[5410]: Exiting due to fatal error

:roll:

bap80 wrote
<snip>

Fri Jul 20 11:47:33 2018 daemon.err openvpn(sample_client)[5413]: Cannot load certificate file /etc/openvpn/client.crt
Fri Jul 20 11:47:33 2018 daemon.notice openvpn(sample_client)[5413]: Exiting due to fatal error

client.crt ?

bap80

I'm really sorry, when I posted I saw it... but topic was on moderation and I can't change it.

Actually I saw that it was few instances of server running. Now I restarted router and currently the is no single entry about OpenVPN in log during client trying to connect.

bap80

update: today I tried to connect from Windows 7 laptop outside of my home network and here is the log (I hope this give more information):

Mon Jul 23 09:16:21 2018 pkcs11_protected_authentication = DISABLED
Mon Jul 23 09:16:21 2018 pkcs11_private_mode = 00000000
Mon Jul 23 09:16:21 2018 pkcs11_private_mode = 00000000
Mon Jul 23 09:16:21 2018 pkcs11_private_mode = 00000000
Mon Jul 23 09:16:21 2018 pkcs11_private_mode = 00000000
Mon Jul 23 09:16:21 2018 pkcs11_private_mode = 00000000
Mon Jul 23 09:16:21 2018 pkcs11_private_mode = 00000000
Mon Jul 23 09:16:21 2018 pkcs11_private_mode = 00000000
Mon Jul 23 09:16:21 2018 pkcs11_private_mode = 00000000
Mon Jul 23 09:16:21 2018 pkcs11_private_mode = 00000000
Mon Jul 23 09:16:21 2018 pkcs11_private_mode = 00000000
Mon Jul 23 09:16:21 2018 pkcs11_private_mode = 00000000
Mon Jul 23 09:16:21 2018 pkcs11_private_mode = 00000000
Mon Jul 23 09:16:21 2018 pkcs11_private_mode = 00000000
Mon Jul 23 09:16:21 2018 pkcs11_private_mode = 00000000
Mon Jul 23 09:16:21 2018 pkcs11_private_mode = 00000000
Mon Jul 23 09:16:21 2018 pkcs11_private_mode = 00000000
Mon Jul 23 09:16:21 2018 pkcs11_cert_private = DISABLED
Mon Jul 23 09:16:21 2018 pkcs11_cert_private = DISABLED
Mon Jul 23 09:16:21 2018 pkcs11_cert_private = DISABLED
Mon Jul 23 09:16:21 2018 pkcs11_cert_private = DISABLED
Mon Jul 23 09:16:21 2018 pkcs11_cert_private = DISABLED
Mon Jul 23 09:16:21 2018 pkcs11_cert_private = DISABLED
Mon Jul 23 09:16:21 2018 pkcs11_cert_private = DISABLED
Mon Jul 23 09:16:21 2018 pkcs11_cert_private = DISABLED
Mon Jul 23 09:16:21 2018 pkcs11_cert_private = DISABLED
Mon Jul 23 09:16:21 2018 pkcs11_cert_private = DISABLED
Mon Jul 23 09:16:21 2018 pkcs11_cert_private = DISABLED
Mon Jul 23 09:16:21 2018 pkcs11_cert_private = DISABLED
Mon Jul 23 09:16:21 2018 pkcs11_cert_private = DISABLED
Mon Jul 23 09:16:21 2018 pkcs11_cert_private = DISABLED
Mon Jul 23 09:16:21 2018 pkcs11_cert_private = DISABLED
Mon Jul 23 09:16:21 2018 pkcs11_cert_private = DISABLED
Mon Jul 23 09:16:21 2018 pkcs11_pin_cache_period = -1
Mon Jul 23 09:16:21 2018 pkcs11_id = '[UNDEF]'
Mon Jul 23 09:16:21 2018 pkcs11_id_management = DISABLED
Mon Jul 23 09:16:21 2018 server_network = 0.0.0.0
Mon Jul 23 09:16:21 2018 server_netmask = 0.0.0.0
Mon Jul 23 09:16:21 2018 server_network_ipv6 = ::
Mon Jul 23 09:16:21 2018 server_netbits_ipv6 = 0
Mon Jul 23 09:16:21 2018 server_bridge_ip = 0.0.0.0
Mon Jul 23 09:16:21 2018 server_bridge_netmask = 0.0.0.0
Mon Jul 23 09:16:21 2018 server_bridge_pool_start = 0.0.0.0
Mon Jul 23 09:16:21 2018 server_bridge_pool_end = 0.0.0.0
Mon Jul 23 09:16:21 2018 ifconfig_pool_defined = DISABLED
Mon Jul 23 09:16:21 2018 ifconfig_pool_start = 0.0.0.0
Mon Jul 23 09:16:21 2018 ifconfig_pool_end = 0.0.0.0
Mon Jul 23 09:16:21 2018 ifconfig_pool_netmask = 0.0.0.0
Mon Jul 23 09:16:21 2018 ifconfig_pool_persist_filename = '[UNDEF]'
Mon Jul 23 09:16:21 2018 ifconfig_pool_persist_refresh_freq = 600
Mon Jul 23 09:16:21 2018 ifconfig_ipv6_pool_defined = DISABLED
Mon Jul 23 09:16:21 2018 ifconfig_ipv6_pool_base = ::
Mon Jul 23 09:16:21 2018 ifconfig_ipv6_pool_netbits = 0
Mon Jul 23 09:16:21 2018 n_bcast_buf = 256
Mon Jul 23 09:16:21 2018 tcp_queue_limit = 64
Mon Jul 23 09:16:21 2018 real_hash_size = 256
Mon Jul 23 09:16:21 2018 virtual_hash_size = 256
Mon Jul 23 09:16:21 2018 client_connect_script = '[UNDEF]'
Mon Jul 23 09:16:21 2018 learn_address_script = '[UNDEF]'
Mon Jul 23 09:16:21 2018 client_disconnect_script = '[UNDEF]'
Mon Jul 23 09:16:21 2018 client_config_dir = '[UNDEF]'
Mon Jul 23 09:16:21 2018 ccd_exclusive = DISABLED
Mon Jul 23 09:16:21 2018 tmp_dir = 'C:\Users\~~~\AppData\Local\Temp\'
Mon Jul 23 09:16:21 2018 push_ifconfig_defined = DISABLED
Mon Jul 23 09:16:21 2018 push_ifconfig_local = 0.0.0.0
Mon Jul 23 09:16:21 2018 push_ifconfig_remote_netmask = 0.0.0.0
Mon Jul 23 09:16:21 2018 push_ifconfig_ipv6_defined = DISABLED
Mon Jul 23 09:16:21 2018 push_ifconfig_ipv6_local = ::/0
Mon Jul 23 09:16:21 2018 push_ifconfig_ipv6_remote = ::
Mon Jul 23 09:16:21 2018 enable_c2c = DISABLED
Mon Jul 23 09:16:21 2018 duplicate_cn = DISABLED
Mon Jul 23 09:16:21 2018 cf_max = 0
Mon Jul 23 09:16:21 2018 cf_per = 0
Mon Jul 23 09:16:21 2018 max_clients = 1024
Mon Jul 23 09:16:21 2018 max_routes_per_client = 256
Mon Jul 23 09:16:21 2018 auth_user_pass_verify_script = '[UNDEF]'
Mon Jul 23 09:16:21 2018 auth_user_pass_verify_script_via_file = DISABLED
Mon Jul 23 09:16:21 2018 auth_token_generate = DISABLED
Mon Jul 23 09:16:21 2018 auth_token_lifetime = 0
Mon Jul 23 09:16:21 2018 client = ENABLED
Mon Jul 23 09:16:21 2018 pull = ENABLED
Mon Jul 23 09:16:21 2018 auth_user_pass_file = '[UNDEF]'
Mon Jul 23 09:16:21 2018 show_net_up = DISABLED
Mon Jul 23 09:16:21 2018 route_method = 3
Mon Jul 23 09:16:21 2018 block_outside_dns = DISABLED
Mon Jul 23 09:16:21 2018 ip_win32_defined = DISABLED
Mon Jul 23 09:16:21 2018 ip_win32_type = 3
Mon Jul 23 09:16:21 2018 dhcp_masq_offset = 0
Mon Jul 23 09:16:21 2018 dhcp_lease_time = 31536000
Mon Jul 23 09:16:21 2018 tap_sleep = 0
Mon Jul 23 09:16:21 2018 dhcp_options = DISABLED
Mon Jul 23 09:16:21 2018 dhcp_renew = DISABLED
Mon Jul 23 09:16:21 2018 dhcp_pre_release = DISABLED
Mon Jul 23 09:16:21 2018 domain = '[UNDEF]'
Mon Jul 23 09:16:21 2018 netbios_scope = '[UNDEF]'
Mon Jul 23 09:16:21 2018 netbios_node_type = 0
Mon Jul 23 09:16:21 2018 disable_nbt = DISABLED
Mon Jul 23 09:16:21 2018 OpenVPN 2.4.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 26 2018
Mon Jul 23 09:16:21 2018 Windows version 6.1 (Windows 7) 64bit
Mon Jul 23 09:16:21 2018 library versions: OpenSSL 1.1.0h 27 Mar 2018, LZO 2.10
Mon Jul 23 09:16:21 2018 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Mon Jul 23 09:16:21 2018 Need hold release from management interface, waiting...
Mon Jul 23 09:16:21 2018 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Mon Jul 23 09:16:21 2018 MANAGEMENT: CMD 'state on'
Mon Jul 23 09:16:21 2018 MANAGEMENT: CMD 'log all on'
Mon Jul 23 09:16:21 2018 MANAGEMENT: CMD 'echo all on'
Mon Jul 23 09:16:21 2018 MANAGEMENT: CMD 'bytecount 5'
Mon Jul 23 09:16:21 2018 MANAGEMENT: CMD 'hold off'
Mon Jul 23 09:16:21 2018 MANAGEMENT: CMD 'hold release'
Mon Jul 23 09:16:21 2018 NOTE: --fast-io is disabled since we are running on Windows
Mon Jul 23 09:16:21 2018 PRNG init md=SHA1 size=36
Mon Jul 23 09:16:21 2018 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jul 23 09:16:21 2018 Outgoing Control Channel Authentication: HMAC KEY: e77d5018 95eb9cd4 1f26a20e c2e611a5 a763ad0d
Mon Jul 23 09:16:21 2018 Outgoing Control Channel Authentication: HMAC size=20 block_size=20
Mon Jul 23 09:16:21 2018 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jul 23 09:16:21 2018 Incoming Control Channel Authentication: HMAC KEY: 1199aa15 7ab347bc 1250ae6b 044b9d21 8bfb4a34
Mon Jul 23 09:16:21 2018 Incoming Control Channel Authentication: HMAC size=20 block_size=20
Mon Jul 23 09:16:21 2018 crypto_adjust_frame_parameters: Adjusting frame parameters for crypto by 28 bytes
Mon Jul 23 09:16:21 2018 LZ4 compression initializing
Mon Jul 23 09:16:21 2018 PID packet_id_init seq_backtrack=64 time_backtrack=15
Mon Jul 23 09:16:21 2018 PID packet_id_init seq_backtrack=64 time_backtrack=15
Mon Jul 23 09:16:21 2018 PID packet_id_init seq_backtrack=64 time_backtrack=15
Mon Jul 23 09:16:21 2018 PID packet_id_init seq_backtrack=64 time_backtrack=15
Mon Jul 23 09:16:21 2018 Control Channel MTU parms [ L:1624 D:1182 EF:68 EB:0 ET:0 EL:3 ]
Mon Jul 23 09:16:21 2018 MTU DYNAMIC mtu=1450, flags=2, 1624 -> 1450
Mon Jul 23 09:16:21 2018 MANAGEMENT: >STATE:1532330181,RESOLVE,,,,,,
Mon Jul 23 09:16:21 2018 GETADDRINFO flags=0x0101 ai_family=0 ai_socktype=1
Mon Jul 23 09:16:21 2018 RESOLVE_REMOTE flags=0x0101 phase=1 rrs=0 sig=-1 status=0
Mon Jul 23 09:16:21 2018 Data Channel MTU parms [ L:1624 D:1450 EF:124 EB:406 ET:0 EL:3 ]
Mon Jul 23 09:16:21 2018 crypto_adjust_frame_parameters: Adjusting frame parameters for crypto by 40 bytes
Mon Jul 23 09:16:21 2018 calc_options_string_link_mtu: link-mtu 1624 -> 1544
Mon Jul 23 09:16:21 2018 crypto_adjust_frame_parameters: Adjusting frame parameters for crypto by 40 bytes
Mon Jul 23 09:16:21 2018 calc_options_string_link_mtu: link-mtu 1624 -> 1544
Mon Jul 23 09:16:21 2018 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Mon Jul 23 09:16:21 2018 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Mon Jul 23 09:16:21 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]@.@.@.@:1194
Mon Jul 23 09:16:21 2018 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Jul 23 09:16:21 2018 Attempting to establish TCP connection with [AF_INET]@.@.@.@:1194 [nonblock]
Mon Jul 23 09:16:21 2018 MANAGEMENT: >STATE:1532330181,TCP_CONNECT,,,,,,
Mon Jul 23 09:18:21 2018 TCP: connect to [AF_INET]@.@.@.@:1194 failed: Unknown error
Mon Jul 23 09:18:21 2018 PID packet_id_free
Mon Jul 23 09:18:21 2018 PID packet_id_free
Mon Jul 23 09:18:21 2018 PID packet_id_free
Mon Jul 23 09:18:21 2018 PID packet_id_free
Mon Jul 23 09:18:21 2018 PID packet_id_free
Mon Jul 23 09:18:21 2018 PID packet_id_free
Mon Jul 23 09:18:21 2018 PID packet_id_free
Mon Jul 23 09:18:21 2018 PID packet_id_free
Mon Jul 23 09:18:21 2018 PID packet_id_free
Mon Jul 23 09:18:21 2018 SIGUSR1[connection failed(soft),init_instance] received, process restarting
Mon Jul 23 09:18:22 2018 MANAGEMENT: >STATE:1532330302,RECONNECTING,init_instance,,,,,
Mon Jul 23 09:18:22 2018 Restart pause, 5 second(s)

bap80

one more update - I tried command telnet @@@.@@@.com 1194
and got
Connecting To @@@.@@@..com...Could not open connection to the host, on port 1194: Connect failed

This means that connections are blocked, right? Is any way to get know where connections are blocked - on my router or by my ISP?

TinCanTech

bap80 wrote I tried command telnet @@@.@@@.com 1194
and got
Connecting To @@@.@@@..com...Could not open connection to the host, on port 1194: Connect failed

This means that connections are blocked, right?

No .. Openvpn will not respond to telnet so your test will not work anyway.

bap80 wrote Is any way to get know where connections are blocked - on my router or by my ISP?

Open the correct port(s) on your router (only one is needed by default: UDP 1194) and ask your ISP if they block any ports. You are using TCP 1194 .. which is a reasonable choice for the time being.

Then check your server log at verb 4 for connection attempts and any subsequent failure reasons.

I presume you have resolved your certificate file issues ..

bap80

TinCanTech wrote Open the correct port(s) on your router...

Just to clarify - if OpenVPN is running on router does it necessary to "open" any ports on it?

/etc/config/firewall is looking like this now:

[oconf=/etc/config/firewall][/oconf]
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'

config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'

config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'

config forwarding
option src 'lan'
option dest 'wan'

config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'

config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'

config include
option path '/etc/firewall.user'

config rule
option name 'Allow-OpenVPN-Inbound'
option target 'ACCEPT'
option src '*'
option proto 'tcpudp'
option dest_port '1194'

config zone
option name 'vpnserver'
option input 'ACCEPT'
option forward 'REJECT'
option output 'ACCEPT'
option masq '1'
option network 'vpnserver'

config forwarding
option src 'vpnserver'
option dest 'wan'

config forwarding
option src 'vpnserver'
option dest 'lan'

TinCanTech

bap80 wrote option server '192.168.200.0 255.255.255.0'
..
option log '/tmp/openvpn.log'

Check your server log.

bap80

log is only has entries about service startup (I just restarted it).

/tmp/openvpn.log
Thu Jul 26 14:25:10 2018 OpenVPN 2.4.4 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Thu Jul 26 14:25:10 2018 library versions: OpenSSL 1.0.2o 27 Mar 2018, LZO 2.10
Thu Jul 26 14:25:10 2018 TUN/TAP device ovpns0 opened
Thu Jul 26 14:25:10 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Thu Jul 26 14:25:10 2018 /sbin/ifconfig ovpns0 192.168.200.1 netmask 255.255.255.0 mtu 1500 broadcast 192.168.200.255
Thu Jul 26 14:25:10 2018 Could not determine IPv4/IPv6 protocol. Using AF_INET
Thu Jul 26 14:25:10 2018 Listening for incoming TCP connection on [AF_INET][undef]:1194
Thu Jul 26 14:25:10 2018 TCPv4_SERVER link local (bound): [AF_INET][undef]:1194
Thu Jul 26 14:25:10 2018 TCPv4_SERVER link remote: [AF_UNSPEC]
Thu Jul 26 14:25:10 2018 Initialization Sequence Completed

TinCanTech

Your server is up and running ..

Try connecting and check the log again ..

bap80

I restarted OpenVPN and tried to connect, in system log and OpenVPN log only information about service startup. Nothing about connection attempt.

TinCanTech

Then you have something blocking you like a firewall.

bap80

Most probably...