Hi everybody,
this happens when I'm connecting.
I have this group of messages which loops in server's logs:
Mon Nov 12 22:25:43 2018 us=172371 client/999.222.222.222:45132 peer info: IV_PROTO=2
Mon Nov 12 22:25:43 2018 us=172383 client/999.222.222.222:45132 peer info: IV_LZ4=1
Mon Nov 12 22:25:43 2018 us=172395 client/999.222.222.222:45132 peer info: IV_LZ4v2=1
Mon Nov 12 22:25:43 2018 us=172407 client/999.222.222.222:45132 peer info: IV_LZO=1
Mon Nov 12 22:25:43 2018 us=172420 client/999.222.222.222:45132 peer info: IV_COMP_STUB=1
Mon Nov 12 22:25:43 2018 us=172433 client/999.222.222.222:45132 peer info: IV_COMP_STUBv2=1
Mon Nov 12 22:25:43 2018 us=172446 client/999.222.222.222:45132 peer info: IV_TCPNL=1
Mon Nov 12 22:25:43 2018 us=172670 client/999.222.222.222:45132 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Mon Nov 12 22:25:43 2018 us=172700 client/999.222.222.222:45132 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
WRMon Nov 12 22:25:43 2018 us=240926 client/999.222.222.222:45132 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-ECDSA-AES256-GCM-SHA384
RWRWRRWRRWWRRWRMon Nov 12 22:26:42 2018 us=920339 client/999.222.222.222:45132 VERIFY OK: depth=1, CN=VPN CA
Mon Nov 12 22:26:42 2018 us=921892 client/999.222.222.222:45132 Validating certificate key usage
Mon Nov 12 22:26:42 2018 us=922063 client/999.222.222.222:45132 ++ Certificate has key usage 0080, expects 0080
Mon Nov 12 22:26:42 2018 us=922163 client/999.222.222.222:45132 VERIFY KU OK
Mon Nov 12 22:26:42 2018 us=922258 client/999.222.222.222:45132 Validating certificate extended key usage
Mon Nov 12 22:26:42 2018 us=922384 client/999.222.222.222:45132 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Mon Nov 12 22:26:42 2018 us=922504 client/999.222.222.222:45132 VERIFY EKU OK
Mon Nov 12 22:26:42 2018 us=922600 client/999.222.222.222:45132 VERIFY OK: depth=0, CN=client
WRMon Nov 12 22:26:43 2018 us=924 client/999.222.222.222:45132 peer info: IV_VER=2.4.6
Mon Nov 12 22:26:43 2018 us=1054 client/999.222.222.222:45132 peer info: IV_PLAT=linux
Mon Nov 12 22:26:43 2018 us=1145 client/999.222.222.222:45132 peer info: IV_PROTO=2
Mon Nov 12 22:26:43 2018 us=1243 client/999.222.222.222:45132 peer info: IV_LZ4=1
Mon Nov 12 22:26:43 2018 us=1335 client/999.222.222.222:45132 peer info: IV_LZ4v2=1
Mon Nov 12 22:26:43 2018 us=1418 client/999.222.222.222:45132 peer info: IV_LZO=1
Mon Nov 12 22:26:43 2018 us=1502 client/999.222.222.222:45132 peer info: IV_COMP_STUB=1
Mon Nov 12 22:26:43 2018 us=1585 client/999.222.222.222:45132 peer info: IV_COMP_STUBv2=1
Mon Nov 12 22:26:43 2018 us=1669 client/999.222.222.222:45132 peer info: IV_TCPNL=1
Mon Nov 12 22:26:43 2018 us=2026 client/999.222.222.222:45132 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Mon Nov 12 22:26:43 2018 us=2123 client/999.222.222.222:45132 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
WRMon Nov 12 22:26:43 2018 us=79784 client/999.222.222.222:45132 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-ECDSA-AES256-GCM-SHA384
Client side my public ip hasn't changed and i'm still able to browse the internet while the openvpn client is still running in background.
that's my client configuration:
client
dev tun0
remote 111.222.222.777 4343
proto udp
persist-key
persist-tun
nobind
compress lz4
explicit-exit-notify 1
#allow-recursive-routing
#route-delay 2
resolv-retry infinite
#float
remote-cert-tls server
#user myuser1
#group myusef1
auth SHA512
cipher AES-256-GCM
ncp-ciphers AES-256-GCM
ecdh-curve secp521r1
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384:TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
auth-nocache
reneg-sec 60
verify-x509-name vpn.mydomain name
remote-cert-eku "TLS Web Server Authentication"
verb 4
log /var/log/openvpn/openvpn.log
<ca>
-----BEGIN CERTIFICATE-----
MIIC ... g=
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
MIICVTCCAb....=
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
MIHuAgEA.....d5q
dQ==
-----END PRIVATE KEY-----
</key>
key-direction 1
<tls-crypt>
-----BEGIN OpenVPN Static key V1-----
0a65ef23091ab......0bfa
6.................4d7f7c9
-----END OpenVPN Static key V1-----
</tls-crypt>
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf
This for server side:
server 10.0.1.0 255.255.255.0
port 4343
proto udp
dev tun
mode server
topology subnet
max-clients 60
compress lz4
keepalive 20 120
persist-tun
persist-key
explicit-exit-notify 1
push "dhcp-option DNS 127.0.0.1"
push "topology subnet"
tls-server
tls-version-min 1.2
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/server.crt
key /etc/openvpn/server/server.key
dh none
key-direction 0
tls-crypt /etc/openvpn/server/ta.key
remote-cert-tls client
remote-cert-eku "TLS Web Client Authentication"
auth SHA512
cipher AES-256-GCM
ncp-ciphers AES-256-GCM
ecdh-curve secp521r1
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384:TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384:TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256:TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256
client-config-dir /etc/openvpn/ccd
#route 192.168.0.0 255.255.255.0
client-to-client
#push "route 192.168.0.0 255.255.255.0 10.0.1.1"
user nobody
group nogroup
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 5
script-security 2
dhcp-option DNS 85.214.20.141 # (FoeBub)
dhcp-option DNS 204.152.184.76 #(CCC)
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf
NOTE: clients and servers certificates were generated using EC.
My VPS has a public ip on its main network interface.
Configurations look good to me and i still haven't figured out if i better use netfilter for MASQUERADING or Destination Nat to my public ip.
I run debian stable.
Best regards
