tap0 interface not enabled?

sm5gxq

Hi,

I have a Raspberry Pi3B+ running at a remote site. It has not been updatet for a long time so I did a update/upgrade today.

Before that, my openvpn client was running perfectly, connecting to an ASUS RT-AC2900 router. After the update, the VPN does not work.

When looking at the log printouts on the client and server, everyting seems ok. No warnings or errors.

But when doing ifconfig, I can't see the tap0 interface anymore. And when doing infconfig tap0, then it shows. But it has only a MAC address, and no IPv4 adress. If I make "ifconfig tap0 up", then it shows, so my conclusion is that it was down. But it doesn't help.

So what can be wrong after the system upgrade?

I also tried to uninstall openvpn and install it again. But after that, I also noticed that the wlan0 mac address now Changes after every reboot. Perhaps the suggested network-manager package does that.

At the moment I can't reach the computer, but a friend will do a reboot for me :-).

I don't know if this information is enough to tell me whats wrong. But someting happened during the upgrade.

rgds
Peter

TinCanTech

Please see:
https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p68963

sm5gxq

Hi,

I will try my best.

At the server side, there is a ASUS router RT-AC2900. Nothing changed here and I have other clients connecting to this server without any problems.

# Automatically generated configuration

# Tunnel options
proto udp4
multihome
port 1194
dev tap21
sndbuf 0
rcvbuf 0
keepalive 15 60
up '/etc/openvpn/ovpn-up'
down '/etc/openvpn/ovpn-down'
setenv ovpn_type 0
setenv unit 1
script-security 2
daemon vpnserver1
verb 3
status-version 2
status status 10
comp-lzo adaptive
plugin /usr/lib/openvpn-plugin-auth-pam.so openvpn

# Server Mode
server-bridge
client-config-dir ccd
client-to-client
duplicate-cn

# Data Channel Encryption Options
auth SHA1
cipher AES-256-CBC

# TLS Mode Options
ca ca.crt
dh dh.pem
cert server.crt
key server.key
tls-auth static.key

# Custom Configuration

The logfile is from the web ui on the router.

Dec 14 19:01:54 vpnserver1[1397]: sk7rfl/<censored ip>:1194 TLS: new session incoming connection from [AF_INET]<censored ip>:1194 (via [AF_INET]213.65.159.92%eth0)
Dec 14 19:01:54 vpnserver1[1397]: sk7rfl/<censored ip>:1194 VERIFY OK: depth=1, C=TW, ST=TW, L=Taipei, O=ASUS, CN=RT-AC2900, emailAddress=me@myhost.mydomain
Dec 14 19:01:54 vpnserver1[1397]: sk7rfl/<censored ip>:1194 VERIFY OK: depth=0, CN=sk7rfl
Dec 14 19:01:54 vpnserver1[1397]: sk7rfl/<censored ip>:1194 peer info: IV_VER=2.4.7
Dec 14 19:01:54 vpnserver1[1397]: sk7rfl/<censored ip>:1194 peer info: IV_PLAT=linux
Dec 14 19:01:54 vpnserver1[1397]: sk7rfl/<censored ip>:1194 peer info: IV_PROTO=2
Dec 14 19:01:54 vpnserver1[1397]: sk7rfl/<censored ip>:1194 peer info: IV_NCP=2
Dec 14 19:01:54 vpnserver1[1397]: sk7rfl/<censored ip>:1194 peer info: IV_LZ4=1
Dec 14 19:01:54 vpnserver1[1397]: sk7rfl/<censored ip>:1194 peer info: IV_LZ4v2=1
Dec 14 19:01:54 vpnserver1[1397]: sk7rfl/<censored ip>:1194 peer info: IV_LZO=1
Dec 14 19:01:54 vpnserver1[1397]: sk7rfl/<censored ip>:1194 peer info: IV_COMP_STUB=1
Dec 14 19:01:54 vpnserver1[1397]: sk7rfl/<censored ip>:1194 peer info: IV_COMP_STUBv2=1
Dec 14 19:01:54 vpnserver1[1397]: sk7rfl/<censored ip>:1194 peer info: IV_TCPNL=1
Dec 14 19:01:54 vpnserver1[1397]: sk7rfl/<censored ip>:1194 PLUGIN_CALL: POST /usr/lib/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Dec 14 19:01:54 vpnserver1[1397]: sk7rfl/<censored ip>:1194 TLS: Username/Password authentication succeeded for username 'sk7rfl' 
Dec 14 19:01:54 vpnserver1[1397]: sk7rfl/<censored ip>:1194 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Dec 14 19:01:54 vpnserver1[1397]: sk7rfl/<censored ip>:1194 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Dec 14 19:01:54 vpnserver1[1397]: sk7rfl/<censored ip>:1194 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Dec 14 19:01:55 vpnserver1[1397]: sk7rfl/<censored ip>:1194 PUSH: Received control message: 'PUSH_REQUEST'
Dec 14 19:01:55 vpnserver1[1397]: sk7rfl/<censored ip>:1194 SENT CONTROL [sk7rfl]: 'PUSH_REPLY,route-gateway dhcp,ping 15,ping-restart 60,peer-id 0,cipher AES-256-GCM' (status=1)
Dec 14 19:01:55 vpnserver1[1397]: sk7rfl/<censored ip>:1194 Data Channel: using negotiated cipher 'AES-256-GCM'
Dec 14 19:01:55 vpnserver1[1397]: sk7rfl/<censored ip>:1194 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Dec 14 19:01:55 vpnserver1[1397]: sk7rfl/<censored ip>:1194 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key

At the client side, there is a RPi3B+ running Raspbian Buster, just upgraded.

remote <censored host name> 1194
float
#nobind
proto udp
dev tap
#sndbuf 0
#rcvbuf 0
keepalive 15 60
comp-lzo adaptive
client
tls-version-min 1.0
#tls-version-max 1.0
auth SHA1
cipher AES-256-CBC
remote-cert-tls server
#user pi
#group pi
persist-key
persist-tun
up-delay
auth-user-pass up
verb 4
ca ca.crt
cert sk7rfl.crt
key sk7rfl.key
tls-auth ta.key
askpass pass
lladdr 96:96:38:f2:77:f4

This config worked just fine with the setup i made in september this year.

Sat Dec 14 19:01:53 2019 us=838359 WARNING: file 'sk7rfl.key' is group or others accessible
Sat Dec 14 19:01:53 2019 us=838644 WARNING: file 'ta.key' is group or others accessible
Sat Dec 14 19:01:53 2019 us=838720 WARNING: file 'pass' is group or others accessible
Sat Dec 14 19:01:53 2019 us=838790 WARNING: file 'up' is group or others accessible
Sat Dec 14 19:01:53 2019 us=838853 Current Parameter Settings:
Sat Dec 14 19:01:53 2019 us=838905   config = 'sm7gxq.conf'
Sat Dec 14 19:01:53 2019 us=838956   mode = 0
Sat Dec 14 19:01:53 2019 us=839006   persist_config = DISABLED
Sat Dec 14 19:01:53 2019 us=839056   persist_mode = 1
Sat Dec 14 19:01:53 2019 us=839104   show_ciphers = DISABLED
Sat Dec 14 19:01:53 2019 us=839152   show_digests = DISABLED
Sat Dec 14 19:01:53 2019 us=839200   show_engines = DISABLED
Sat Dec 14 19:01:53 2019 us=839249   genkey = DISABLED
Sat Dec 14 19:01:53 2019 us=839297   key_pass_file = 'pass'
Sat Dec 14 19:01:53 2019 us=839345   show_tls_ciphers = DISABLED
Sat Dec 14 19:01:53 2019 us=839394   connect_retry_max = 0
Sat Dec 14 19:01:53 2019 us=839443 Connection profiles [0]:
Sat Dec 14 19:01:53 2019 us=839492   proto = udp
Sat Dec 14 19:01:53 2019 us=839541   local = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=839590   local_port = '1194'
Sat Dec 14 19:01:53 2019 us=839638   remote = '<censored host name>'
Sat Dec 14 19:01:53 2019 us=839686   remote_port = '1194'
Sat Dec 14 19:01:53 2019 us=839735   remote_float = ENABLED
Sat Dec 14 19:01:53 2019 us=839783   bind_defined = DISABLED
Sat Dec 14 19:01:53 2019 us=839831   bind_local = ENABLED
Sat Dec 14 19:01:53 2019 us=839879   bind_ipv6_only = DISABLED
Sat Dec 14 19:01:53 2019 us=839927   connect_retry_seconds = 5
Sat Dec 14 19:01:53 2019 us=839975   connect_timeout = 120
Sat Dec 14 19:01:53 2019 us=840022   socks_proxy_server = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=840070   socks_proxy_port = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=840118   tun_mtu = 1500
Sat Dec 14 19:01:53 2019 us=840166   tun_mtu_defined = ENABLED
Sat Dec 14 19:01:53 2019 us=840213   link_mtu = 1500
Sat Dec 14 19:01:53 2019 us=840260   link_mtu_defined = DISABLED
Sat Dec 14 19:01:53 2019 us=840308   tun_mtu_extra = 32
Sat Dec 14 19:01:53 2019 us=840356   tun_mtu_extra_defined = ENABLED
Sat Dec 14 19:01:53 2019 us=840404   mtu_discover_type = -1
Sat Dec 14 19:01:53 2019 us=840452   fragment = 0
Sat Dec 14 19:01:53 2019 us=840500   mssfix = 1450
Sat Dec 14 19:01:53 2019 us=840548   explicit_exit_notification = 0
Sat Dec 14 19:01:53 2019 us=840596 Connection profiles END
Sat Dec 14 19:01:53 2019 us=840645   remote_random = DISABLED
Sat Dec 14 19:01:53 2019 us=840693   ipchange = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=840741   dev = 'tap'
Sat Dec 14 19:01:53 2019 us=840789   dev_type = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=840837   dev_node = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=840884   lladdr = '96:96:38:f2:77:f4'
Sat Dec 14 19:01:53 2019 us=840933   topology = 1
Sat Dec 14 19:01:53 2019 us=840981   ifconfig_local = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=841029   ifconfig_remote_netmask = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=841077   ifconfig_noexec = DISABLED
Sat Dec 14 19:01:53 2019 us=841125   ifconfig_nowarn = DISABLED
Sat Dec 14 19:01:53 2019 us=841173   ifconfig_ipv6_local = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=841221   ifconfig_ipv6_netbits = 0
Sat Dec 14 19:01:53 2019 us=841269   ifconfig_ipv6_remote = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=841317   shaper = 0
Sat Dec 14 19:01:53 2019 us=841367   mtu_test = 0
Sat Dec 14 19:01:53 2019 us=841415   mlock = DISABLED
Sat Dec 14 19:01:53 2019 us=841464   keepalive_ping = 15
Sat Dec 14 19:01:53 2019 us=841513   keepalive_timeout = 60
Sat Dec 14 19:01:53 2019 us=841561   inactivity_timeout = 0
Sat Dec 14 19:01:53 2019 us=841609   ping_send_timeout = 15
Sat Dec 14 19:01:53 2019 us=841657   ping_rec_timeout = 60
Sat Dec 14 19:01:53 2019 us=841705   ping_rec_timeout_action = 2
Sat Dec 14 19:01:53 2019 us=841753   ping_timer_remote = DISABLED
Sat Dec 14 19:01:53 2019 us=841802   remap_sigusr1 = 0
Sat Dec 14 19:01:53 2019 us=841849   persist_tun = ENABLED
Sat Dec 14 19:01:53 2019 us=841958   persist_local_ip = DISABLED
Sat Dec 14 19:01:53 2019 us=842009   persist_remote_ip = DISABLED
Sat Dec 14 19:01:53 2019 us=842057   persist_key = ENABLED
Sat Dec 14 19:01:53 2019 us=842106   passtos = DISABLED
Sat Dec 14 19:01:53 2019 us=842155   resolve_retry_seconds = 1000000000
Sat Dec 14 19:01:53 2019 us=842203   resolve_in_advance = DISABLED
Sat Dec 14 19:01:53 2019 us=842251   username = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=842300   groupname = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=842348   chroot_dir = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=842395   cd_dir = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=842443   writepid = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=842592   up_script = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=842643   down_script = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=842691   down_pre = DISABLED
Sat Dec 14 19:01:53 2019 us=842739   up_restart = DISABLED
Sat Dec 14 19:01:53 2019 us=842787   up_delay = ENABLED
Sat Dec 14 19:01:53 2019 us=842835   daemon = DISABLED
Sat Dec 14 19:01:53 2019 us=842884   inetd = 0
Sat Dec 14 19:01:53 2019 us=842932   log = DISABLED
Sat Dec 14 19:01:53 2019 us=842980   suppress_timestamps = DISABLED
Sat Dec 14 19:01:53 2019 us=843028   machine_readable_output = DISABLED
Sat Dec 14 19:01:53 2019 us=843077   nice = 0
Sat Dec 14 19:01:53 2019 us=843124   verbosity = 4
Sat Dec 14 19:01:53 2019 us=843172   mute = 0
Sat Dec 14 19:01:53 2019 us=843220   gremlin = 0
Sat Dec 14 19:01:53 2019 us=843268   status_file = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=843317   status_file_version = 1
Sat Dec 14 19:01:53 2019 us=843364   status_file_update_freq = 60
Sat Dec 14 19:01:53 2019 us=843412   occ = ENABLED
Sat Dec 14 19:01:53 2019 us=843460   rcvbuf = 0
Sat Dec 14 19:01:53 2019 us=843508   sndbuf = 0
Sat Dec 14 19:01:53 2019 us=843555   mark = 0
Sat Dec 14 19:01:53 2019 us=843604   sockflags = 0
Sat Dec 14 19:01:53 2019 us=843652   fast_io = DISABLED
Sat Dec 14 19:01:53 2019 us=843702   comp.alg = 2
Sat Dec 14 19:01:53 2019 us=843751   comp.flags = 1
Sat Dec 14 19:01:53 2019 us=843800   route_script = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=843848   route_default_gateway = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=843897   route_default_metric = 0
Sat Dec 14 19:01:53 2019 us=843946   route_noexec = DISABLED
Sat Dec 14 19:01:53 2019 us=843995   route_delay = 0
Sat Dec 14 19:01:53 2019 us=844045   route_delay_window = 30
Sat Dec 14 19:01:53 2019 us=844093   route_delay_defined = DISABLED
Sat Dec 14 19:01:53 2019 us=844142   route_nopull = DISABLED
Sat Dec 14 19:01:53 2019 us=844190   route_gateway_via_dhcp = DISABLED
Sat Dec 14 19:01:53 2019 us=844239   allow_pull_fqdn = DISABLED
Sat Dec 14 19:01:53 2019 us=844288   management_addr = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=844337   management_port = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=844386   management_user_pass = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=844436   management_log_history_cache = 250
Sat Dec 14 19:01:53 2019 us=844485   management_echo_buffer_size = 100
Sat Dec 14 19:01:53 2019 us=844533   management_write_peer_info_file = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=844582   management_client_user = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=844631   management_client_group = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=844680   management_flags = 0
Sat Dec 14 19:01:53 2019 us=844729   shared_secret_file = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=844778   key_direction = not set
Sat Dec 14 19:01:53 2019 us=844827   ciphername = 'AES-256-CBC'
Sat Dec 14 19:01:53 2019 us=844875   ncp_enabled = ENABLED
Sat Dec 14 19:01:53 2019 us=844924   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
Sat Dec 14 19:01:53 2019 us=844973   authname = 'SHA1'
Sat Dec 14 19:01:53 2019 us=845022   prng_hash = 'SHA1'
Sat Dec 14 19:01:53 2019 us=845071   prng_nonce_secret_len = 16
Sat Dec 14 19:01:53 2019 us=845120   keysize = 0
Sat Dec 14 19:01:53 2019 us=845168   engine = DISABLED
Sat Dec 14 19:01:53 2019 us=845216   replay = ENABLED
Sat Dec 14 19:01:53 2019 us=845264   mute_replay_warnings = DISABLED
Sat Dec 14 19:01:53 2019 us=845313   replay_window = 64
Sat Dec 14 19:01:53 2019 us=845398   replay_time = 15
Sat Dec 14 19:01:53 2019 us=845449   packet_id_file = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=845498   use_iv = ENABLED
Sat Dec 14 19:01:53 2019 us=845548   test_crypto = DISABLED
Sat Dec 14 19:01:53 2019 us=845599   tls_server = DISABLED
Sat Dec 14 19:01:53 2019 us=845649   tls_client = ENABLED
Sat Dec 14 19:01:53 2019 us=845699   key_method = 2
Sat Dec 14 19:01:53 2019 us=845748   ca_file = 'ca.crt'
Sat Dec 14 19:01:53 2019 us=845798   ca_path = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=845847   dh_file = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=845897   cert_file = 'sk7rfl.crt'
Sat Dec 14 19:01:53 2019 us=845948   extra_certs_file = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=845999   priv_key_file = 'sk7rfl.key'
Sat Dec 14 19:01:53 2019 us=846050   pkcs12_file = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=846100   cipher_list = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=846149   cipher_list_tls13 = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=846198   tls_cert_profile = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=846248   tls_verify = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=846297   tls_export_cert = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=846348   verify_x509_type = 0
Sat Dec 14 19:01:53 2019 us=846397   verify_x509_name = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=846448   crl_file = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=846497   ns_cert_type = 0
Sat Dec 14 19:01:53 2019 us=846548   remote_cert_ku[i] = 65535
Sat Dec 14 19:01:53 2019 us=846598   remote_cert_ku[i] = 0
Sat Dec 14 19:01:53 2019 us=846647   remote_cert_ku[i] = 0
Sat Dec 14 19:01:53 2019 us=846696   remote_cert_ku[i] = 0
Sat Dec 14 19:01:53 2019 us=846746   remote_cert_ku[i] = 0
Sat Dec 14 19:01:53 2019 us=846795   remote_cert_ku[i] = 0
Sat Dec 14 19:01:53 2019 us=846845   remote_cert_ku[i] = 0
Sat Dec 14 19:01:53 2019 us=846894   remote_cert_ku[i] = 0
Sat Dec 14 19:01:53 2019 us=846944   remote_cert_ku[i] = 0
Sat Dec 14 19:01:53 2019 us=846993   remote_cert_ku[i] = 0
Sat Dec 14 19:01:53 2019 us=847043   remote_cert_ku[i] = 0
Sat Dec 14 19:01:53 2019 us=847093   remote_cert_ku[i] = 0
Sat Dec 14 19:01:53 2019 us=847142   remote_cert_ku[i] = 0
Sat Dec 14 19:01:53 2019 us=847191   remote_cert_ku[i] = 0
Sat Dec 14 19:01:53 2019 us=847240   remote_cert_ku[i] = 0
Sat Dec 14 19:01:53 2019 us=847289   remote_cert_ku[i] = 0
Sat Dec 14 19:01:53 2019 us=847340   remote_cert_eku = 'TLS Web Server Authentication'
Sat Dec 14 19:01:53 2019 us=847390   ssl_flags = 64
Sat Dec 14 19:01:53 2019 us=847441   tls_timeout = 2
Sat Dec 14 19:01:53 2019 us=847490   renegotiate_bytes = -1
Sat Dec 14 19:01:53 2019 us=847539   renegotiate_packets = 0
Sat Dec 14 19:01:53 2019 us=847589   renegotiate_seconds = 3600
Sat Dec 14 19:01:53 2019 us=847638   handshake_window = 60
Sat Dec 14 19:01:53 2019 us=847688   transition_window = 3600
Sat Dec 14 19:01:53 2019 us=847736   single_session = DISABLED
Sat Dec 14 19:01:53 2019 us=847786   push_peer_info = DISABLED
Sat Dec 14 19:01:53 2019 us=847835   tls_exit = DISABLED
Sat Dec 14 19:01:53 2019 us=847885   tls_auth_file = 'ta.key'
Sat Dec 14 19:01:53 2019 us=847934   tls_crypt_file = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=847984   pkcs11_protected_authentication = DISABLED
Sat Dec 14 19:01:53 2019 us=848036   pkcs11_protected_authentication = DISABLED
Sat Dec 14 19:01:53 2019 us=848085   pkcs11_protected_authentication = DISABLED
Sat Dec 14 19:01:53 2019 us=848135   pkcs11_protected_authentication = DISABLED
Sat Dec 14 19:01:53 2019 us=848185   pkcs11_protected_authentication = DISABLED
Sat Dec 14 19:01:53 2019 us=848235   pkcs11_protected_authentication = DISABLED
Sat Dec 14 19:01:53 2019 us=848284   pkcs11_protected_authentication = DISABLED
Sat Dec 14 19:01:53 2019 us=848334   pkcs11_protected_authentication = DISABLED
Sat Dec 14 19:01:53 2019 us=848384   pkcs11_protected_authentication = DISABLED
Sat Dec 14 19:01:53 2019 us=848433   pkcs11_protected_authentication = DISABLED
Sat Dec 14 19:01:53 2019 us=848483   pkcs11_protected_authentication = DISABLED
Sat Dec 14 19:01:53 2019 us=848532   pkcs11_protected_authentication = DISABLED
Sat Dec 14 19:01:53 2019 us=848614   pkcs11_protected_authentication = DISABLED
Sat Dec 14 19:01:53 2019 us=848664   pkcs11_protected_authentication = DISABLED
Sat Dec 14 19:01:53 2019 us=848713   pkcs11_protected_authentication = DISABLED
Sat Dec 14 19:01:53 2019 us=848762   pkcs11_protected_authentication = DISABLED
Sat Dec 14 19:01:53 2019 us=848811   pkcs11_private_mode = 00000000
Sat Dec 14 19:01:53 2019 us=848861   pkcs11_private_mode = 00000000
Sat Dec 14 19:01:53 2019 us=848911   pkcs11_private_mode = 00000000
Sat Dec 14 19:01:53 2019 us=848960   pkcs11_private_mode = 00000000
Sat Dec 14 19:01:53 2019 us=849010   pkcs11_private_mode = 00000000
Sat Dec 14 19:01:53 2019 us=849059   pkcs11_private_mode = 00000000
Sat Dec 14 19:01:53 2019 us=849109   pkcs11_private_mode = 00000000
Sat Dec 14 19:01:53 2019 us=849157   pkcs11_private_mode = 00000000
Sat Dec 14 19:01:53 2019 us=849206   pkcs11_private_mode = 00000000
Sat Dec 14 19:01:53 2019 us=849255   pkcs11_private_mode = 00000000
Sat Dec 14 19:01:53 2019 us=849304   pkcs11_private_mode = 00000000
Sat Dec 14 19:01:53 2019 us=849352   pkcs11_private_mode = 00000000
Sat Dec 14 19:01:53 2019 us=849401   pkcs11_private_mode = 00000000
Sat Dec 14 19:01:53 2019 us=849450   pkcs11_private_mode = 00000000
Sat Dec 14 19:01:53 2019 us=849499   pkcs11_private_mode = 00000000
Sat Dec 14 19:01:53 2019 us=849548   pkcs11_private_mode = 00000000
Sat Dec 14 19:01:53 2019 us=849596   pkcs11_cert_private = DISABLED
Sat Dec 14 19:01:53 2019 us=849644   pkcs11_cert_private = DISABLED
Sat Dec 14 19:01:53 2019 us=849693   pkcs11_cert_private = DISABLED
Sat Dec 14 19:01:53 2019 us=849741   pkcs11_cert_private = DISABLED
Sat Dec 14 19:01:53 2019 us=849790   pkcs11_cert_private = DISABLED
Sat Dec 14 19:01:53 2019 us=849838   pkcs11_cert_private = DISABLED
Sat Dec 14 19:01:53 2019 us=849887   pkcs11_cert_private = DISABLED
Sat Dec 14 19:01:53 2019 us=849935   pkcs11_cert_private = DISABLED
Sat Dec 14 19:01:53 2019 us=849984   pkcs11_cert_private = DISABLED
Sat Dec 14 19:01:53 2019 us=850033   pkcs11_cert_private = DISABLED
Sat Dec 14 19:01:53 2019 us=850081   pkcs11_cert_private = DISABLED
Sat Dec 14 19:01:53 2019 us=850129   pkcs11_cert_private = DISABLED
Sat Dec 14 19:01:53 2019 us=850177   pkcs11_cert_private = DISABLED
Sat Dec 14 19:01:53 2019 us=850226   pkcs11_cert_private = DISABLED
Sat Dec 14 19:01:53 2019 us=850274   pkcs11_cert_private = DISABLED
Sat Dec 14 19:01:53 2019 us=850323   pkcs11_cert_private = DISABLED
Sat Dec 14 19:01:53 2019 us=850372   pkcs11_pin_cache_period = -1
Sat Dec 14 19:01:53 2019 us=850421   pkcs11_id = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=850470   pkcs11_id_management = DISABLED
Sat Dec 14 19:01:53 2019 us=850523   server_network = 0.0.0.0
Sat Dec 14 19:01:53 2019 us=850575   server_netmask = 0.0.0.0
Sat Dec 14 19:01:53 2019 us=850686   server_network_ipv6 = ::
Sat Dec 14 19:01:53 2019 us=850741   server_netbits_ipv6 = 0
Sat Dec 14 19:01:53 2019 us=850795   server_bridge_ip = 0.0.0.0
Sat Dec 14 19:01:53 2019 us=850848   server_bridge_netmask = 0.0.0.0
Sat Dec 14 19:01:53 2019 us=850902   server_bridge_pool_start = 0.0.0.0
Sat Dec 14 19:01:53 2019 us=850955   server_bridge_pool_end = 0.0.0.0
Sat Dec 14 19:01:53 2019 us=851004   ifconfig_pool_defined = DISABLED
Sat Dec 14 19:01:53 2019 us=851056   ifconfig_pool_start = 0.0.0.0
Sat Dec 14 19:01:53 2019 us=851110   ifconfig_pool_end = 0.0.0.0
Sat Dec 14 19:01:53 2019 us=851162   ifconfig_pool_netmask = 0.0.0.0
Sat Dec 14 19:01:53 2019 us=851212   ifconfig_pool_persist_filename = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=851261   ifconfig_pool_persist_refresh_freq = 600
Sat Dec 14 19:01:53 2019 us=851311   ifconfig_ipv6_pool_defined = DISABLED
Sat Dec 14 19:01:53 2019 us=851362   ifconfig_ipv6_pool_base = ::
Sat Dec 14 19:01:53 2019 us=851413   ifconfig_ipv6_pool_netbits = 0
Sat Dec 14 19:01:53 2019 us=851462   n_bcast_buf = 256
Sat Dec 14 19:01:53 2019 us=851511   tcp_queue_limit = 64
Sat Dec 14 19:01:53 2019 us=851560   real_hash_size = 256
Sat Dec 14 19:01:53 2019 us=851609   virtual_hash_size = 256
Sat Dec 14 19:01:53 2019 us=851657   client_connect_script = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=851738   learn_address_script = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=851787   client_disconnect_script = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=851837   client_config_dir = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=851885   ccd_exclusive = DISABLED
Sat Dec 14 19:01:53 2019 us=851934   tmp_dir = '/tmp'
Sat Dec 14 19:01:53 2019 us=851982   push_ifconfig_defined = DISABLED
Sat Dec 14 19:01:53 2019 us=852034   push_ifconfig_local = 0.0.0.0
Sat Dec 14 19:01:53 2019 us=852086   push_ifconfig_remote_netmask = 0.0.0.0
Sat Dec 14 19:01:53 2019 us=852135   push_ifconfig_ipv6_defined = DISABLED
Sat Dec 14 19:01:53 2019 us=852187   push_ifconfig_ipv6_local = ::/0
Sat Dec 14 19:01:53 2019 us=852239   push_ifconfig_ipv6_remote = ::
Sat Dec 14 19:01:53 2019 us=852288   enable_c2c = DISABLED
Sat Dec 14 19:01:53 2019 us=852337   duplicate_cn = DISABLED
Sat Dec 14 19:01:53 2019 us=852386   cf_max = 0
Sat Dec 14 19:01:53 2019 us=852435   cf_per = 0
Sat Dec 14 19:01:53 2019 us=852546   max_clients = 1024
Sat Dec 14 19:01:53 2019 us=852605   max_routes_per_client = 256
Sat Dec 14 19:01:53 2019 us=852654   auth_user_pass_verify_script = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=852703   auth_user_pass_verify_script_via_file = DISABLED
Sat Dec 14 19:01:53 2019 us=852752   auth_token_generate = DISABLED
Sat Dec 14 19:01:53 2019 us=852801   auth_token_lifetime = 0
Sat Dec 14 19:01:53 2019 us=852849   port_share_host = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=852898   port_share_port = '[UNDEF]'
Sat Dec 14 19:01:53 2019 us=852946   client = ENABLED
Sat Dec 14 19:01:53 2019 us=852994   pull = ENABLED
Sat Dec 14 19:01:53 2019 us=853043   auth_user_pass_file = 'up'
Sat Dec 14 19:01:53 2019 us=853097 OpenVPN 2.4.7 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019
Sat Dec 14 19:01:53 2019 us=853189 library versions: OpenSSL 1.1.1d  10 Sep 2019, LZO 2.10
Sat Dec 14 19:01:53 2019 us=855842 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sat Dec 14 19:01:53 2019 us=865938 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Dec 14 19:01:53 2019 us=866027 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Dec 14 19:01:53 2019 us=866082 LZO compression initializing
Sat Dec 14 19:01:53 2019 us=866527 Control Channel MTU parms [ L:1654 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Sat Dec 14 19:01:54 2019 us=183811 Data Channel MTU parms [ L:1654 D:1450 EF:122 EB:411 ET:32 EL:3 ]
Sat Dec 14 19:01:54 2019 us=183996 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Sat Dec 14 19:01:54 2019 us=184049 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Sat Dec 14 19:01:54 2019 us=184116 TCP/UDP: Preserving recently used remote address: [AF_INET]<censored ip>:1194
Sat Dec 14 19:01:54 2019 us=184193 Socket Buffers: R=[163840->163840] S=[163840->163840]
Sat Dec 14 19:01:54 2019 us=184265 UDP link local (bound): [AF_INET][undef]:1194
Sat Dec 14 19:01:54 2019 us=184321 UDP link remote: [AF_INET]<censored ip>:1194
Sat Dec 14 19:01:54 2019 us=208969 TLS: Initial packet from [AF_INET]<censored ip>:1194, sid=1c7d43d8 2ebe0f19
Sat Dec 14 19:01:54 2019 us=306339 VERIFY OK: depth=1, C=TW, ST=TW, L=Taipei, O=ASUS, CN=RT-AC2900, emailAddress=me@myhost.mydomain
Sat Dec 14 19:01:54 2019 us=307968 VERIFY KU OK
Sat Dec 14 19:01:54 2019 us=308038 Validating certificate extended key usage
Sat Dec 14 19:01:54 2019 us=308092 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sat Dec 14 19:01:54 2019 us=308140 VERIFY EKU OK
Sat Dec 14 19:01:54 2019 us=308187 VERIFY OK: depth=0, C=TW, ST=TW, L=Taipei, O=ASUS, CN=RT-AC2900, emailAddress=me@myhost.mydomain
Sat Dec 14 19:01:54 2019 us=574494 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Sat Dec 14 19:01:54 2019 us=574643 [RT-AC2900] Peer Connection Initiated with [AF_INET]<censored ip>:1194
Sat Dec 14 19:01:55 2019 us=758007 SENT CONTROL [RT-AC2900]: 'PUSH_REQUEST' (status=1)
Sat Dec 14 19:01:55 2019 us=798109 PUSH: Received control message: 'PUSH_REPLY,route-gateway dhcp,ping 15,ping-restart 60,peer-id 0,cipher AES-256-GCM'
Sat Dec 14 19:01:55 2019 us=798316 OPTIONS IMPORT: timers and/or timeouts modified
Sat Dec 14 19:01:55 2019 us=798370 OPTIONS IMPORT: route-related options modified
Sat Dec 14 19:01:55 2019 us=798417 OPTIONS IMPORT: peer-id set
Sat Dec 14 19:01:55 2019 us=798463 OPTIONS IMPORT: adjusting link_mtu to 1657
Sat Dec 14 19:01:55 2019 us=798507 OPTIONS IMPORT: data channel crypto options modified
Sat Dec 14 19:01:55 2019 us=798558 Data Channel: using negotiated cipher 'AES-256-GCM'
Sat Dec 14 19:01:55 2019 us=798630 Data Channel MTU parms [ L:1585 D:1450 EF:53 EB:411 ET:32 EL:3 ]
Sat Dec 14 19:01:55 2019 us=799013 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sat Dec 14 19:01:55 2019 us=799081 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sat Dec 14 19:01:55 2019 us=799880 TUN/TAP device tap0 opened
Sat Dec 14 19:01:55 2019 us=800037 TUN/TAP TX queue length set to 100
Sat Dec 14 19:01:55 2019 us=800149 /sbin/ip link set addr 96:96:38:f2:77:f4 dev tap0
Sat Dec 14 19:01:55 2019 us=810844 TUN/TAP link layer address set to 96:96:38:f2:77:f4
Sat Dec 14 19:01:55 2019 us=811118 Initialization Sequence Completed

The "funny" thing is that I can't see the "tap0" listing in ifconfig. But I can call it by issuing "ifconfig tap0", which gives the following:

pi@sm5gxq-pi03:/etc/openvpn $ sudo ifconfig tap0
tap0: flags=4098<BROADCAST,MULTICAST>  mtu 1500
        ether 96:96:38:f2:77:f4  txqueuelen 100  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

So openvpn client has not activated the interface. At least there is no IP address. Normally I get IP from the route's DHCP. I set the mac address on the client so I get the same IP every time.

The quotes above are from Another machine (PI4) but with the same config.

regards
Peter

sm5gxq

Hi,

the difference between the client that works and this one, is the last line, that says it got an IP address from the DHCP server. For some reason this doesn't work now.

I tried setting a static IP on the tap0 interface, and that makes it work. So now we know that DHCP is the cause.

But why doesn't it work now, it worked Before. The dhcpcd.conf files are identical.

rgds
Peter

TinCanTech

You got your client IP wrong

sm5gxq

Hi,

Please explain further, because I don't understand.

The client's VPN IP is normally given out by the DHCP server at the vpn server. This didn't happen after the update, so I entered a fallback IP config for tap0 in dhcpcd.conf .

The client's LAN IP is given out by that network's router, but it's locked on its mac address, so the router there is Always giving out the same (local) ip.

Please advise on any additions or Changes to be made in the client's config file.

rgds
Peter