SERVER - PROXMOX LXC CONTAINER
dev tun
proto udp
port 5000
server 10.12.0.0 255.255.0.0
topology subnet <-- this is commented with hash
#ifconfig-pool-persist /etc/openvpn/ipp.txt
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh4096.pem
max-clients 240
persist-tun
persist-key
keepalive 10 120
cipher AES-256-CBC
comp-lzo
verb 1
user nobody
group nogroup
#push "route 10.11.1.0 255.255.255.0 10.11.0.1"
#push "route 10.11.0.0 255.255.0.0"
#push "route 10.11.1.0 255.255.0.0"
#push "route 10.11.22.87 255.255.255.255"
client-config-dir /etc/openvpn/client
log /etc/openvpn/openvpn.log
status /etc/openvpn/openvpn-status.log
CLIENT (OPNWRT)
package openvpn
config openvpn sample_client
option enabled 1
option client 1
option dev tun
option proto udp
list remote "10.11.22.104 5000"
option nobind 1
option persist_key 1
option persist_tun 1
option user nobody
option ca /etc/config/ca.crt
option cert /etc/config/client.crt
option key /etc/config/client.key
option ns_cert_type server
option tls_auth "/etc/config/ta.key 1"
option comp_lzo yes
option verb 1
option log /tmp/openvpn.log
option cipher AES-256-CBC
DEFAULT CONFIG
When
topology subnet is commented out like now, there are some errors but overall everything just works.
server service status
root@gateway:/etc/openvpn# service openvpn status
● openvpn.service - OpenVPN service
Loaded: loaded (/lib/systemd/system/openvpn.service; enabled; vendor preset: enabled)
Active: active (exited) since Fri 2018-10-05 07:38:14 UTC; 1s ago
Process: 732 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
Main PID: 732 (code=exited, status=0/SUCCESS)
Tasks: 0 (limit: 4915)
CGroup: /system.slice/openvpn.service
Oct 05 07:38:14 gateway systemd[1]: Stopped OpenVPN service.
Oct 05 07:38:14 gateway systemd[1]: Stopping OpenVPN service...
Oct 05 07:38:14 gateway systemd[1]: openvpn.service: Failed to reset devices.list: Operation not permitted
Oct 05 07:38:14 gateway systemd[1]: Starting OpenVPN service...
Oct 05 07:38:14 gateway systemd[1]: Started OpenVPN service.
Oct 05 07:38:14 gateway systemd[1]: openvpn.service: Failed to reset devices.list: Operation not permitted
server openvpn log
Fri Oct 5 07:38:14 2018 OpenVPN 2.4.0 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO$
Fri Oct 5 07:38:14 2018 library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.08
Fri Oct 5 07:38:14 2018 TUN/TAP device tun0 opened
Fri Oct 5 07:38:14 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Fri Oct 5 07:38:14 2018 /sbin/ip link set dev tun0 up mtu 1500
Fri Oct 5 07:38:14 2018 /sbin/ip addr add dev tun0 local 10.12.0.1 peer 10.12.0.2
Fri Oct 5 07:38:14 2018 Could not determine IPv4/IPv6 protocol. Using AF_INET
Fri Oct 5 07:38:14 2018 UDPv4 link local (bound): [AF_INET][undef]:5000
Fri Oct 5 07:38:14 2018 UDPv4 link remote: [AF_UNSPEC]
Fri Oct 5 07:38:14 2018 GID set to nogroup
Fri Oct 5 07:38:14 2018 UID set to nobody
Fri Oct 5 07:38:14 2018 Initialization Sequence Completed
Fri Oct 5 07:38:16 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Oct 5 07:38:16 2018 TLS Error: incoming packet authentication failed from [AF_INET]10.11.22.104:55004
Fri Oct 5 07:38:21 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Oct 5 07:38:21 2018 TLS Error: incoming packet authentication failed from [AF_INET]10.11.22.104:55004
Fri Oct 5 07:38:29 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Oct 5 07:38:29 2018 TLS Error: incoming packet authentication failed from [AF_INET]10.11.22.104:55004
Fri Oct 5 07:38:46 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Oct 5 07:38:46 2018 TLS Error: incoming packet authentication failed from [AF_INET]10.11.22.104:55004
client log
Fri Oct 5 01:01:25 2018 UID set to nobody
Fri Oct 5 01:01:25 2018 Initialization Sequence Completed
Fri Oct 5 07:40:09 2018 [server] Inactivity timeout (--ping-restart), restarting
Fri Oct 5 07:40:09 2018 SIGUSR1[soft,ping-restart] received, process restarting
Fri Oct 5 07:40:14 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]10.11.22.104:5000
Fri Oct 5 07:40:14 2018 UDP link local: (not bound)
Fri Oct 5 07:40:14 2018 UDP link remote: [AF_INET]10.11.22.104:5000
Fri Oct 5 07:40:17 2018 [server] Peer Connection Initiated with [AF_INET]10.11.22.104:5000
Fri Oct 5 07:40:18 2018 Preserving previous TUN/TAP instance: tun0
Fri Oct 5 07:40:18 2018 Initialization Sequence Completed
SUBNET CONFIG
Uncommented topology subnet, restarted service, restarted client.
Client dont have tun interface anymore.
server log
Fri Oct 5 07:43:46 2018 OpenVPN 2.4.0 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO$
Fri Oct 5 07:43:46 2018 library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.08
Fri Oct 5 07:43:46 2018 TUN/TAP device tun0 opened
Fri Oct 5 07:43:46 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Fri Oct 5 07:43:46 2018 /sbin/ip link set dev tun0 up mtu 1500
Fri Oct 5 07:43:46 2018 /sbin/ip addr add dev tun0 10.12.0.1/16 broadcast 10.12.255.255
Fri Oct 5 07:43:46 2018 Could not determine IPv4/IPv6 protocol. Using AF_INET
Fri Oct 5 07:43:46 2018 UDPv4 link local (bound): [AF_INET][undef]:5000
Fri Oct 5 07:43:46 2018 UDPv4 link remote: [AF_UNSPEC]
Fri Oct 5 07:43:46 2018 GID set to nogroup
Fri Oct 5 07:43:46 2018 UID set to nobody
Fri Oct 5 07:43:46 2018 Initialization Sequence Completed
Fri Oct 5 07:43:48 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Oct 5 07:43:48 2018 TLS Error: incoming packet authentication failed from [AF_INET]10.11.22.104:40770
Fri Oct 5 07:43:52 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Oct 5 07:43:52 2018 TLS Error: incoming packet authentication failed from [AF_INET]10.11.22.104:40770
Fri Oct 5 07:44:00 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Oct 5 07:44:00 2018 TLS Error: incoming packet authentication failed from [AF_INET]10.11.22.104:40770
Fri Oct 5 07:44:16 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Oct 5 07:44:16 2018 TLS Error: incoming packet authentication failed from [AF_INET]10.11.22.104:40770
Fri Oct 5 07:44:45 2018 10.11.23.180:49220 peer info: IV_VER=2.4.0
Fri Oct 5 07:44:45 2018 10.11.23.180:49220 peer info: IV_PLAT=linux
Fri Oct 5 07:44:45 2018 10.11.23.180:49220 peer info: IV_PROTO=2
Fri Oct 5 07:44:45 2018 10.11.23.180:49220 peer info: IV_NCP=2
Fri Oct 5 07:44:45 2018 10.11.23.180:49220 peer info: IV_LZ4=1
Fri Oct 5 07:44:45 2018 10.11.23.180:49220 peer info: IV_LZ4v2=1
Fri Oct 5 07:44:45 2018 10.11.23.180:49220 peer info: IV_LZO=1
Fri Oct 5 07:44:45 2018 10.11.23.180:49220 peer info: IV_COMP_STUB=1
Fri Oct 5 07:44:45 2018 10.11.23.180:49220 peer info: IV_COMP_STUBv2=1
Fri Oct 5 07:44:45 2018 10.11.23.180:49220 peer info: IV_TCPNL=1
Fri Oct 5 07:44:45 2018 10.11.23.180:49220 [macblablablabla] Peer Connection Initiated with [AF_INET]10.11.23.180:492$
Fri Oct 5 07:44:51 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Oct 5 07:44:51 2018 TLS Error: incoming packet authentication failed from [AF_INET]10.11.22.104:39263
Fri Oct 5 07:44:54 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Oct 5 07:44:54 2018 TLS Error: incoming packet authentication failed from [AF_INET]10.11.22.104:39263
Fri Oct 5 07:44:55 2018 10.11.23.180:57138 peer info: IV_VER=2.4.0
Fri Oct 5 07:44:55 2018 10.11.23.180:57138 peer info: IV_PLAT=linux
Fri Oct 5 07:44:55 2018 10.11.23.180:57138 peer info: IV_PROTO=2
Fri Oct 5 07:44:55 2018 10.11.23.180:57138 peer info: IV_NCP=2
Fri Oct 5 07:44:55 2018 10.11.23.180:57138 peer info: IV_LZ4=1
Fri Oct 5 07:44:55 2018 10.11.23.180:57138 peer info: IV_LZ4v2=1
Fri Oct 5 07:44:55 2018 10.11.23.180:57138 peer info: IV_LZO=1
Fri Oct 5 07:44:55 2018 10.11.23.180:57138 peer info: IV_COMP_STUB=1
Fri Oct 5 07:44:55 2018 10.11.23.180:57138 peer info: IV_COMP_STUBv2=1
Fri Oct 5 07:44:55 2018 10.11.23.180:57138 peer info: IV_TCPNL=1
Fri Oct 5 07:44:55 2018 10.11.23.180:57138 [macblablablabla] Peer Connection Initiated with [AF_INET]10.11.23.180:571$
Fri Oct 5 07:44:59 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Oct 5 07:44:59 2018 TLS Error: incoming packet authentication failed from [AF_INET]10.11.22.104:39263
Fri Oct 5 07:45:03 2018 10.11.23.180:35147 peer info: IV_VER=2.4.0
Fri Oct 5 07:45:03 2018 10.11.23.180:35147 peer info: IV_PLAT=linux
Fri Oct 5 07:45:03 2018 10.11.23.180:35147 peer info: IV_PROTO=2
Fri Oct 5 07:45:03 2018 10.11.23.180:35147 peer info: IV_NCP=2
Fri Oct 5 07:45:03 2018 10.11.23.180:35147 peer info: IV_LZ4=1
Fri Oct 5 07:45:03 2018 10.11.23.180:35147 peer info: IV_LZ4v2=1
Fri Oct 5 07:45:03 2018 10.11.23.180:35147 peer info: IV_LZO=1
Fri Oct 5 07:45:03 2018 10.11.23.180:35147 peer info: IV_COMP_STUB=1
Fri Oct 5 07:45:03 2018 10.11.23.180:35147 peer info: IV_COMP_STUBv2=1
Fri Oct 5 07:45:03 2018 10.11.23.180:35147 peer info: IV_TCPNL=1
Fri Oct 5 07:45:03 2018 10.11.23.180:35147 [macblablablabla] Peer Connection Initiated with [AF_INET]10.11.23.180:351$
Fri Oct 5 07:45:07 2018 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Oct 5 07:45:07 2018 TLS Error: incoming packet authentication failed from [AF_INET]10.11.22.104:39263
client log
Fri Oct 5 07:48:30 2018 OpenVPN 2.4.0 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Fri Oct 5 07:48:30 2018 library versions: OpenSSL 1.0.2g 1 Mar 2016, LZO 2.08
Fri Oct 5 07:48:30 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]10.11.22.104:5000
Fri Oct 5 07:48:30 2018 UDP link local: (not bound)
Fri Oct 5 07:48:30 2018 UDP link remote: [AF_INET]10.11.22.104:5000
Fri Oct 5 07:48:30 2018 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Fri Oct 5 07:48:32 2018 [server] Peer Connection Initiated with [AF_INET]10.11.22.104:5000
Fri Oct 5 07:48:33 2018 TUN/TAP device tun0 opened
Fri Oct 5 07:48:33 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Fri Oct 5 07:48:33 2018 /usr/sbin/ip link set dev tun0 up mtu 1500
Fri Oct 5 07:48:33 2018 /usr/sbin/ip addr add dev tun0 10.12.1.43/-1 broadcast 255.255.255.255
Error: an inet prefix is expected rather than "10.12.1.43/-1".
Fri Oct 5 07:48:33 2018 Linux ip addr add failed: external program exited with error status: 1
Fri Oct 5 07:48:33 2018 Exiting due to fatal error
//EDIT
Ok, i think i solved my problem. In /etc/openvpn/client/clientname i had to change static assigments from ...
ifconfig-push 10.12.1.44 10.12.0.1
... to ...
ifconfig-push 10.12.1.44 255.255.0.0
I'll test it further to be sure and then mark this topic appropriately.
