Hi TinCanTech, thanks for the reply.
So based on the HOWTO post, I've attached all of the required stuff below:
SERVER
Operating System:
host: ~$ uname -a
Linux host 4.4.0 #1 SMP Thu Jun 27 15:10:55 MSK 2019 x86_64 x86_64 x86_64 GNU/Linux
Network Setup
host:~$ ifconfig
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255
inet6 addr: fe80::ee8e:26d8:4ccb:1fc/64 Scope:Link
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:45872 errors:0 dropped:0 overruns:0 frame:0
TX packets:46596 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:34981016 (34.9 MB) TX bytes:45680124 (45.6 MB)
venet0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:127.0.0.1 P-t-P:127.0.0.1 Bcast:0.0.0.0 Mask:255.255.255.255
inet6 addr: ::2/128 Scope:Compat
inet6 addr: 2604:180:2:11c6::d8a3/64 Scope:Global
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
RX packets:129711 errors:0 dropped:0 overruns:0 frame:0
TX packets:139042 errors:0 dropped:21 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:91429717 (91.4 MB) TX bytes:92920042 (92.9 MB)
venet0:0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:x.x.x.x P-t-P:x.x.x.x. Bcast:x.x.x.x. Mask:255.255.255.255
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
Server config file:
#################################################
# Sample OpenVPN 2.0 config file for #
# multi-client server. #
# #
# This file is for the server side #
# of a many-clients <-> one-server #
# OpenVPN configuration. #
# #
# OpenVPN also supports #
# single-machine <-> single-machine #
# configurations (See the Examples page #
# on the web site for more info). #
# #
# This config should work on Windows #
# or Linux/BSD systems. Remember on #
# Windows to quote pathnames and use #
# double backslashes, e.g.: #
# "C:\\Program Files\\OpenVPN\\config\\foo.key" #
# #
# Comments are preceded with '#' or ';' #
#################################################
# Which local IP address should OpenVPN
# listen on? (optional)
;local a.b.c.d
# Which TCP/UDP port should OpenVPN listen on?
# If you want to run multiple OpenVPN instances
# on the same machine, use a different port
# number for each one. You will need to
# open up this port on your firewall.
port 1194
# TCP or UDP server?
;proto tcp
proto udp
# "dev tun" will create a routed IP tunnel,
# "dev tap" will create an ethernet tunnel.
# Use "dev tap0" if you are ethernet bridging
# and have precreated a tap0 virtual interface
# and bridged it with your ethernet interface.
# If you want to control access policies
# over the VPN, you must create firewall
# rules for the the TUN/TAP interface.
# On non-Windows systems, you can give
# an explicit unit number, such as tun0.
# On Windows, use "dev-node" for this.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun
# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel if you
# have more than one. On XP SP2 or higher,
# you may need to selectively disable the
# Windows firewall for the TAP adapter.
# Non-Windows systems usually don't need this.
;dev-node MyTap
# SSL/TLS root certificate (ca), certificate
# (cert), and private key (key). Each client
# and the server must have their own cert and
# key file. The server and all clients will
# use the same ca file.
#
# See the "easy-rsa" directory for a series
# of scripts for generating RSA certificates
# and private keys. Remember to use
# a unique Common Name for the server
# and each of the client certificates.
#
# Any X509 key management system can be used.
# OpenVPN can also use a PKCS #12 formatted key file
# (see "pkcs12" directive in man page).
ca ca.crt
cert Server.crt
key Server.key # This file should be kept secret
# Diffie hellman parameters.
# Generate your own with:
# openssl dhparam -out dh2048.pem 2048
dh dh2048.pem
# Network topology
# Should be subnet (addressing via IP)
# unless Windows clients v2.0.9 and lower have to
# be supported (then net30, i.e. a /30 per client)
# Defaults to net30 (not recommended)
;topology subnet
# Configure server mode and supply a VPN subnet
# for OpenVPN to draw client addresses from.
# The server will take 10.8.0.1 for itself,
# the rest will be made available to clients.
# Each client will be able to reach the server
# on 10.8.0.1. Comment this line out if you are
# ethernet bridging. See the man page for more info.
server 10.8.0.0 255.255.255.0
# Maintain a record of client <-> virtual IP address
# associations in this file. If OpenVPN goes down or
# is restarted, reconnecting clients can be assigned
# the same virtual IP address from the pool that was
# previously assigned.
ifconfig-pool-persist ipp.txt
# Configure server mode for ethernet bridging.
# You must first use your OS's bridging capability
# to bridge the TAP interface with the ethernet
# NIC interface. Then you must manually set the
# IP/netmask on the bridge interface, here we
# assume 10.8.0.4/255.255.255.0. Finally we
# must set aside an IP range in this subnet
# (start=10.8.0.50 end=10.8.0.100) to allocate
# to connecting clients. Leave this line commented
# out unless you are ethernet bridging.
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
# Configure server mode for ethernet bridging
# using a DHCP-proxy, where clients talk
# to the OpenVPN server-side DHCP server
# to receive their IP address allocation
# and DNS server addresses. You must first use
# your OS's bridging capability to bridge the TAP
# interface with the ethernet NIC interface.
# Note: this mode only works on clients (such as
# Windows), where the client-side TAP adapter is
# bound to a DHCP client.
;server-bridge
# Push routes to the client to allow it
# to reach other private subnets behind
# the server. Remember that these
# private subnets will also need
# to know to route the OpenVPN client
# address pool (10.8.0.0/255.255.255.0)
# back to the OpenVPN server.
;push "route 192.168.10.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"
# To assign specific IP addresses to specific
# clients or if a connecting client has a private
# subnet behind it that should also have VPN access,
# use the subdirectory "ccd" for client-specific
# configuration files (see man page for more info).
# EXAMPLE: Suppose the client
# having the certificate common name "Thelonious"
# also has a small subnet behind his connecting
# machine, such as 192.168.40.128/255.255.255.248.
# First, uncomment out these lines:
;client-config-dir ccd
;route 192.168.40.128 255.255.255.248
# Then create a file ccd/Thelonious with this line:
# iroute 192.168.40.128 255.255.255.248
# This will allow Thelonious' private subnet to
# access the VPN. This example will only work
# if you are routing, not bridging, i.e. you are
# using "dev tun" and "server" directives.
# EXAMPLE: Suppose you want to give
# Thelonious a fixed VPN IP address of 10.9.0.1.
# First uncomment out these lines:
;client-config-dir ccd
;route 10.9.0.0 255.255.255.252
# Then add this line to ccd/Thelonious:
# ifconfig-push 10.9.0.1 10.9.0.2
# Suppose that you want to enable different
# firewall access policies for different groups
# of clients. There are two methods:
# (1) Run multiple OpenVPN daemons, one for each
# group, and firewall the TUN/TAP interface
# for each group/daemon appropriately.
# (2) (Advanced) Create a script to dynamically
# modify the firewall in response to access
# from different clients. See man
# page for more info on learn-address script.
;learn-address ./script
# If enabled, this directive will configure
# all clients to redirect their default
# network gateway through the VPN, causing
# all IP traffic such as web browsing and
# and DNS lookups to go through the VPN
# (The OpenVPN server machine may need to NAT
# or bridge the TUN/TAP interface to the internet
# in order for this to work properly).
push "redirect-gateway def1 bypass-dhcp"
# Certain Windows-specific network settings
# can be pushed to clients, such as DNS
# or WINS server addresses. CAVEAT:
#
http://openvpn.net/faq.html#dhcpcaveats
# The addresses below refer to the public
# DNS servers provided by opendns.com.
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
# Uncomment this directive to allow different
# clients to be able to "see" each other.
# By default, clients will only see the server.
# To force clients to only see the server, you
# will also need to appropriately firewall the
# server's TUN/TAP interface.
;client-to-client
# Uncomment this directive if multiple clients
# might connect with the same certificate/key
# files or common names. This is recommended
# only for testing purposes. For production use,
# each client should have its own certificate/key
# pair.
#
# IF YOU HAVE NOT GENERATED INDIVIDUAL
# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,
# EACH HAVING ITS OWN UNIQUE "COMMON NAME",
# UNCOMMENT THIS LINE OUT.
;duplicate-cn
# The keepalive directive causes ping-like
# messages to be sent back and forth over
# the link so that each side knows when
# the other side has gone down.
# Ping every 10 seconds, assume that remote
# peer is down if no ping received during
# a 120 second time period.
keepalive 10 120
# For extra security beyond that provided
# by SSL/TLS, create an "HMAC firewall"
# to help block DoS attacks and UDP port flooding.
#
# Generate with:
# openvpn --genkey --secret ta.key
#
# The server and each client must have
# a copy of this key.
# The second parameter should be '0'
# on the server and '1' on the clients.
tls-auth ta.key 0 # This file is secret
# Select a cryptographic cipher.
# This config item must be copied to
# the client config file as well.
;cipher BF-CBC # Blowfish (default)
cipher AES-128-CBC # AES
;cipher DES-EDE3-CBC # Triple-DES
auth SHA256
# Enable compression on the VPN link.
# If you enable it here, you must also
# enable it in the client config file.
comp-lzo
# The maximum number of concurrently connected
# clients we want to allow.
;max-clients 100
# It's a good idea to reduce the OpenVPN
# daemon's privileges after initialization.
#
# You can uncomment this out on
# non-Windows systems.
user nobody
group nogroup
# The persist options will try to avoid
# accessing certain resources on restart
# that may no longer be accessible because
# of the privilege downgrade.
persist-key
persist-tun
# Output a short status file showing
# current connections, truncated
# and rewritten every minute.
status openvpn-status.log
# By default, log messages will go to the syslog (or
# on Windows, if running as a service, they will go to
# the "\Program Files\OpenVPN\log" directory).
# Use log or log-append to override this default.
# "log" will truncate the log file on OpenVPN startup,
# while "log-append" will append to it. Use one
# or the other (but not both).
log openvpn.log
;log-append openvpn.log
# Set the appropriate level of log
# file verbosity.
#
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 4
# Silence repeating messages. At most 20
# sequential messages of the same message
# category will be output to the log.
;mute 20
Server log (at --verb 4 and client IP address removed)
Mon Dec 30 19:05:47 2019 us=681231 Current Parameter Settings:
Mon Dec 30 19:05:47 2019 us=681267 config = '/etc/openvpn/server.conf'
Mon Dec 30 19:05:47 2019 us=681274 mode = 1
Mon Dec 30 19:05:47 2019 us=681279 persist_config = DISABLED
Mon Dec 30 19:05:47 2019 us=681284 persist_mode = 1
Mon Dec 30 19:05:47 2019 us=681288 show_ciphers = DISABLED
Mon Dec 30 19:05:47 2019 us=681292 show_digests = DISABLED
Mon Dec 30 19:05:47 2019 us=681296 show_engines = DISABLED
Mon Dec 30 19:05:47 2019 us=681302 genkey = DISABLED
Mon Dec 30 19:05:47 2019 us=681306 key_pass_file = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681311 show_tls_ciphers = DISABLED
Mon Dec 30 19:05:47 2019 us=681316 Connection profiles [default]:
Mon Dec 30 19:05:47 2019 us=681321 proto = udp
Mon Dec 30 19:05:47 2019 us=681325 local = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681329 local_port = 1194
Mon Dec 30 19:05:47 2019 us=681334 remote = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681338 remote_port = 1194
Mon Dec 30 19:05:47 2019 us=681342 remote_float = DISABLED
Mon Dec 30 19:05:47 2019 us=681346 bind_defined = DISABLED
Mon Dec 30 19:05:47 2019 us=681351 bind_local = ENABLED
Mon Dec 30 19:05:47 2019 us=681355 connect_retry_seconds = 5
Mon Dec 30 19:05:47 2019 us=681359 connect_timeout = 10
Mon Dec 30 19:05:47 2019 us=681364 connect_retry_max = 0
Mon Dec 30 19:05:47 2019 us=681368 socks_proxy_server = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681373 socks_proxy_port = 0
Mon Dec 30 19:05:47 2019 us=681377 socks_proxy_retry = DISABLED
Mon Dec 30 19:05:47 2019 us=681381 tun_mtu = 1500
Mon Dec 30 19:05:47 2019 us=681385 tun_mtu_defined = ENABLED
Mon Dec 30 19:05:47 2019 us=681390 link_mtu = 1500
Mon Dec 30 19:05:47 2019 us=681394 link_mtu_defined = DISABLED
Mon Dec 30 19:05:47 2019 us=681398 tun_mtu_extra = 0
Mon Dec 30 19:05:47 2019 us=681402 tun_mtu_extra_defined = DISABLED
Mon Dec 30 19:05:47 2019 us=681406 mtu_discover_type = -1
Mon Dec 30 19:05:47 2019 us=681411 fragment = 0
Mon Dec 30 19:05:47 2019 us=681415 mssfix = 1450
Mon Dec 30 19:05:47 2019 us=681419 explicit_exit_notification = 0
Mon Dec 30 19:05:47 2019 us=681423 Connection profiles END
Mon Dec 30 19:05:47 2019 us=681428 remote_random = DISABLED
Mon Dec 30 19:05:47 2019 us=681432 ipchange = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681436 dev = 'tun'
Mon Dec 30 19:05:47 2019 us=681440 dev_type = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681444 dev_node = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681449 lladdr = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681453 topology = 1
Mon Dec 30 19:05:47 2019 us=681457 tun_ipv6 = DISABLED
Mon Dec 30 19:05:47 2019 us=681462 ifconfig_local = '10.8.0.1'
Mon Dec 30 19:05:47 2019 us=681466 ifconfig_remote_netmask = '10.8.0.2'
Mon Dec 30 19:05:47 2019 us=681470 ifconfig_noexec = DISABLED
Mon Dec 30 19:05:47 2019 us=681474 ifconfig_nowarn = DISABLED
Mon Dec 30 19:05:47 2019 us=681478 ifconfig_ipv6_local = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681483 ifconfig_ipv6_netbits = 0
Mon Dec 30 19:05:47 2019 us=681487 ifconfig_ipv6_remote = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681491 shaper = 0
Mon Dec 30 19:05:47 2019 us=681496 mtu_test = 0
Mon Dec 30 19:05:47 2019 us=681500 mlock = DISABLED
Mon Dec 30 19:05:47 2019 us=681504 keepalive_ping = 10
Mon Dec 30 19:05:47 2019 us=681508 keepalive_timeout = 120
Mon Dec 30 19:05:47 2019 us=681512 inactivity_timeout = 0
Mon Dec 30 19:05:47 2019 us=681517 ping_send_timeout = 10
Mon Dec 30 19:05:47 2019 us=681521 ping_rec_timeout = 240
Mon Dec 30 19:05:47 2019 us=681525 ping_rec_timeout_action = 2
Mon Dec 30 19:05:47 2019 us=681529 ping_timer_remote = DISABLED
Mon Dec 30 19:05:47 2019 us=681534 remap_sigusr1 = 0
Mon Dec 30 19:05:47 2019 us=681538 persist_tun = ENABLED
Mon Dec 30 19:05:47 2019 us=681542 persist_local_ip = DISABLED
Mon Dec 30 19:05:47 2019 us=681546 persist_remote_ip = DISABLED
Mon Dec 30 19:05:47 2019 us=681550 persist_key = ENABLED
Mon Dec 30 19:05:47 2019 us=681555 passtos = DISABLED
Mon Dec 30 19:05:47 2019 us=681559 resolve_retry_seconds = 1000000000
Mon Dec 30 19:05:47 2019 us=681566 username = 'nobody'
Mon Dec 30 19:05:47 2019 us=681570 groupname = 'nogroup'
Mon Dec 30 19:05:47 2019 us=681574 chroot_dir = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681579 cd_dir = '/etc/openvpn'
Mon Dec 30 19:05:47 2019 us=681583 writepid = '/run/openvpn/server.pid'
Mon Dec 30 19:05:47 2019 us=681587 up_script = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681591 down_script = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681596 down_pre = DISABLED
Mon Dec 30 19:05:47 2019 us=681600 up_restart = DISABLED
Mon Dec 30 19:05:47 2019 us=681604 up_delay = DISABLED
Mon Dec 30 19:05:47 2019 us=681608 daemon = ENABLED
Mon Dec 30 19:05:47 2019 us=681612 inetd = 0
Mon Dec 30 19:05:47 2019 us=681616 log = ENABLED
Mon Dec 30 19:05:47 2019 us=681621 suppress_timestamps = DISABLED
Mon Dec 30 19:05:47 2019 us=681625 nice = 0
Mon Dec 30 19:05:47 2019 us=681629 verbosity = 4
Mon Dec 30 19:05:47 2019 us=681633 mute = 0
Mon Dec 30 19:05:47 2019 us=681638 gremlin = 0
Mon Dec 30 19:05:47 2019 us=681642 status_file = 'openvpn-status.log'
Mon Dec 30 19:05:47 2019 us=681646 status_file_version = 1
Mon Dec 30 19:05:47 2019 us=681650 status_file_update_freq = 10
Mon Dec 30 19:05:47 2019 us=681655 occ = ENABLED
Mon Dec 30 19:05:47 2019 us=681659 rcvbuf = 0
Mon Dec 30 19:05:47 2019 us=681663 sndbuf = 0
Mon Dec 30 19:05:47 2019 us=681667 mark = 0
Mon Dec 30 19:05:47 2019 us=681673 sockflags = 0
Mon Dec 30 19:05:47 2019 us=681677 fast_io = DISABLED
Mon Dec 30 19:05:47 2019 us=681682 lzo = 7
Mon Dec 30 19:05:47 2019 us=681686 route_script = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681690 route_default_gateway = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681695 route_default_metric = 0
Mon Dec 30 19:05:47 2019 us=681699 route_noexec = DISABLED
Mon Dec 30 19:05:47 2019 us=681703 route_delay = 0
Mon Dec 30 19:05:47 2019 us=681708 route_delay_window = 30
Mon Dec 30 19:05:47 2019 us=681712 route_delay_defined = DISABLED
Mon Dec 30 19:05:47 2019 us=681716 route_nopull = DISABLED
Mon Dec 30 19:05:47 2019 us=681721 route_gateway_via_dhcp = DISABLED
Mon Dec 30 19:05:47 2019 us=681725 max_routes = 100
Mon Dec 30 19:05:47 2019 us=681729 allow_pull_fqdn = DISABLED
Mon Dec 30 19:05:47 2019 us=681735 route 10.8.0.0/255.255.255.0/nil/nil
Mon Dec 30 19:05:47 2019 us=681739 management_addr = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681744 management_port = 0
Mon Dec 30 19:05:47 2019 us=681748 management_user_pass = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681752 management_log_history_cache = 250
Mon Dec 30 19:05:47 2019 us=681757 management_echo_buffer_size = 100
Mon Dec 30 19:05:47 2019 us=681761 management_write_peer_info_file = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681766 management_client_user = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681770 management_client_group = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681774 management_flags = 0
Mon Dec 30 19:05:47 2019 us=681778 shared_secret_file = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681783 key_direction = 1
Mon Dec 30 19:05:47 2019 us=681787 ciphername_defined = ENABLED
Mon Dec 30 19:05:47 2019 us=681791 ciphername = 'AES-128-CBC'
Mon Dec 30 19:05:47 2019 us=681796 authname_defined = ENABLED
Mon Dec 30 19:05:47 2019 us=681800 authname = 'SHA256'
Mon Dec 30 19:05:47 2019 us=681804 prng_hash = 'SHA1'
Mon Dec 30 19:05:47 2019 us=681808 prng_nonce_secret_len = 16
Mon Dec 30 19:05:47 2019 us=681813 keysize = 0
Mon Dec 30 19:05:47 2019 us=681817 engine = DISABLED
Mon Dec 30 19:05:47 2019 us=681821 replay = ENABLED
Mon Dec 30 19:05:47 2019 us=681841 mute_replay_warnings = DISABLED
Mon Dec 30 19:05:47 2019 us=681846 replay_window = 64
Mon Dec 30 19:05:47 2019 us=681850 replay_time = 15
Mon Dec 30 19:05:47 2019 us=681864 packet_id_file = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681868 use_iv = ENABLED
Mon Dec 30 19:05:47 2019 us=681872 test_crypto = DISABLED
Mon Dec 30 19:05:47 2019 us=681876 tls_server = ENABLED
Mon Dec 30 19:05:47 2019 us=681881 tls_client = DISABLED
Mon Dec 30 19:05:47 2019 us=681887 key_method = 2
Mon Dec 30 19:05:47 2019 us=681892 ca_file = 'ca.crt'
Mon Dec 30 19:05:47 2019 us=681896 ca_path = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681900 dh_file = 'dh2048.pem'
Mon Dec 30 19:05:47 2019 us=681905 cert_file = 'Server.crt'
Mon Dec 30 19:05:47 2019 us=681909 extra_certs_file = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681913 priv_key_file = 'Server.key'
Mon Dec 30 19:05:47 2019 us=681918 pkcs12_file = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681922 cipher_list = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681926 tls_verify = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681930 tls_export_cert = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681935 verify_x509_type = 0
Mon Dec 30 19:05:47 2019 us=681939 verify_x509_name = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681943 crl_file = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=681947 ns_cert_type = 0
Mon Dec 30 19:05:47 2019 us=681952 remote_cert_ku[i] = 0
Mon Dec 30 19:05:47 2019 us=681956 remote_cert_ku[i] = 0
Mon Dec 30 19:05:47 2019 us=681960 remote_cert_ku[i] = 0
Mon Dec 30 19:05:47 2019 us=681964 remote_cert_ku[i] = 0
Mon Dec 30 19:05:47 2019 us=681968 remote_cert_ku[i] = 0
Mon Dec 30 19:05:47 2019 us=681973 remote_cert_ku[i] = 0
Mon Dec 30 19:05:47 2019 us=681977 remote_cert_ku[i] = 0
Mon Dec 30 19:05:47 2019 us=681981 remote_cert_ku[i] = 0
Mon Dec 30 19:05:47 2019 us=681985 remote_cert_ku[i] = 0
Mon Dec 30 19:05:47 2019 us=681989 remote_cert_ku[i] = 0
Mon Dec 30 19:05:47 2019 us=681993 remote_cert_ku[i] = 0
Mon Dec 30 19:05:47 2019 us=681997 remote_cert_ku[i] = 0
Mon Dec 30 19:05:47 2019 us=682002 remote_cert_ku[i] = 0
Mon Dec 30 19:05:47 2019 us=682006 remote_cert_ku[i] = 0
Mon Dec 30 19:05:47 2019 us=682010 remote_cert_ku[i] = 0
Mon Dec 30 19:05:47 2019 us=682014 remote_cert_ku[i] = 0
Mon Dec 30 19:05:47 2019 us=682018 remote_cert_eku = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=682022 ssl_flags = 0
Mon Dec 30 19:05:47 2019 us=682027 tls_timeout = 2
Mon Dec 30 19:05:47 2019 us=682031 renegotiate_bytes = 0
Mon Dec 30 19:05:47 2019 us=682035 renegotiate_packets = 0
Mon Dec 30 19:05:47 2019 us=682039 renegotiate_seconds = 3600
Mon Dec 30 19:05:47 2019 us=682043 handshake_window = 60
Mon Dec 30 19:05:47 2019 us=682048 transition_window = 3600
Mon Dec 30 19:05:47 2019 us=682052 single_session = DISABLED
Mon Dec 30 19:05:47 2019 us=682056 push_peer_info = DISABLED
Mon Dec 30 19:05:47 2019 us=682060 tls_exit = DISABLED
Mon Dec 30 19:05:47 2019 us=682065 tls_auth_file = 'ta.key'
Mon Dec 30 19:05:47 2019 us=682069 pkcs11_protected_authentication = DISABLED
Mon Dec 30 19:05:47 2019 us=682073 pkcs11_protected_authentication = DISABLED
Mon Dec 30 19:05:47 2019 us=682078 pkcs11_protected_authentication = DISABLED
Mon Dec 30 19:05:47 2019 us=682082 pkcs11_protected_authentication = DISABLED
Mon Dec 30 19:05:47 2019 us=682086 pkcs11_protected_authentication = DISABLED
Mon Dec 30 19:05:47 2019 us=682090 pkcs11_protected_authentication = DISABLED
Mon Dec 30 19:05:47 2019 us=682094 pkcs11_protected_authentication = DISABLED
Mon Dec 30 19:05:47 2019 us=682099 pkcs11_protected_authentication = DISABLED
Mon Dec 30 19:05:47 2019 us=682103 pkcs11_protected_authentication = DISABLED
Mon Dec 30 19:05:47 2019 us=682107 pkcs11_protected_authentication = DISABLED
Mon Dec 30 19:05:47 2019 us=682111 pkcs11_protected_authentication = DISABLED
Mon Dec 30 19:05:47 2019 us=682116 pkcs11_protected_authentication = DISABLED
Mon Dec 30 19:05:47 2019 us=682120 pkcs11_protected_authentication = DISABLED
Mon Dec 30 19:05:47 2019 us=682124 pkcs11_protected_authentication = DISABLED
Mon Dec 30 19:05:47 2019 us=682128 pkcs11_protected_authentication = DISABLED
Mon Dec 30 19:05:47 2019 us=682133 pkcs11_protected_authentication = DISABLED
Mon Dec 30 19:05:47 2019 us=682137 pkcs11_private_mode = 00000000
Mon Dec 30 19:05:47 2019 us=682141 pkcs11_private_mode = 00000000
Mon Dec 30 19:05:47 2019 us=682146 pkcs11_private_mode = 00000000
Mon Dec 30 19:05:47 2019 us=682150 pkcs11_private_mode = 00000000
Mon Dec 30 19:05:47 2019 us=682156 pkcs11_private_mode = 00000000
Mon Dec 30 19:05:47 2019 us=682160 pkcs11_private_mode = 00000000
Mon Dec 30 19:05:47 2019 us=682165 pkcs11_private_mode = 00000000
Mon Dec 30 19:05:47 2019 us=682169 pkcs11_private_mode = 00000000
Mon Dec 30 19:05:47 2019 us=682173 pkcs11_private_mode = 00000000
Mon Dec 30 19:05:47 2019 us=682177 pkcs11_private_mode = 00000000
Mon Dec 30 19:05:47 2019 us=682181 pkcs11_private_mode = 00000000
Mon Dec 30 19:05:47 2019 us=682186 pkcs11_private_mode = 00000000
Mon Dec 30 19:05:47 2019 us=682190 pkcs11_private_mode = 00000000
Mon Dec 30 19:05:47 2019 us=682194 pkcs11_private_mode = 00000000
Mon Dec 30 19:05:47 2019 us=682198 pkcs11_private_mode = 00000000
Mon Dec 30 19:05:47 2019 us=682202 pkcs11_private_mode = 00000000
Mon Dec 30 19:05:47 2019 us=682207 pkcs11_cert_private = DISABLED
Mon Dec 30 19:05:47 2019 us=682211 pkcs11_cert_private = DISABLED
Mon Dec 30 19:05:47 2019 us=682215 pkcs11_cert_private = DISABLED
Mon Dec 30 19:05:47 2019 us=682219 pkcs11_cert_private = DISABLED
Mon Dec 30 19:05:47 2019 us=682223 pkcs11_cert_private = DISABLED
Mon Dec 30 19:05:47 2019 us=682228 pkcs11_cert_private = DISABLED
Mon Dec 30 19:05:47 2019 us=682232 pkcs11_cert_private = DISABLED
Mon Dec 30 19:05:47 2019 us=682236 pkcs11_cert_private = DISABLED
Mon Dec 30 19:05:47 2019 us=682240 pkcs11_cert_private = DISABLED
Mon Dec 30 19:05:47 2019 us=682244 pkcs11_cert_private = DISABLED
Mon Dec 30 19:05:47 2019 us=682268 pkcs11_cert_private = DISABLED
Mon Dec 30 19:05:47 2019 us=682273 pkcs11_cert_private = DISABLED
Mon Dec 30 19:05:47 2019 us=682277 pkcs11_cert_private = DISABLED
Mon Dec 30 19:05:47 2019 us=682282 pkcs11_cert_private = DISABLED
Mon Dec 30 19:05:47 2019 us=682286 pkcs11_cert_private = DISABLED
Mon Dec 30 19:05:47 2019 us=682290 pkcs11_cert_private = DISABLED
Mon Dec 30 19:05:47 2019 us=682294 pkcs11_pin_cache_period = -1
Mon Dec 30 19:05:47 2019 us=682299 pkcs11_id = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=682303 pkcs11_id_management = DISABLED
Mon Dec 30 19:05:47 2019 us=682321 server_network = 10.8.0.0
Mon Dec 30 19:05:47 2019 us=682327 server_netmask = 255.255.255.0
Mon Dec 30 19:05:47 2019 us=682346 server_network_ipv6 = ::
Mon Dec 30 19:05:47 2019 us=682350 server_netbits_ipv6 = 0
Mon Dec 30 19:05:47 2019 us=682355 server_bridge_ip = 0.0.0.0
Mon Dec 30 19:05:47 2019 us=682360 server_bridge_netmask = 0.0.0.0
Mon Dec 30 19:05:47 2019 us=682374 server_bridge_pool_start = 0.0.0.0
Mon Dec 30 19:05:47 2019 us=682378 server_bridge_pool_end = 0.0.0.0
Mon Dec 30 19:05:47 2019 us=682383 push_entry = 'redirect-gateway def1 bypass-dhcp'
Mon Dec 30 19:05:47 2019 us=682389 push_entry = 'dhcp-option DNS 208.67.222.222'
Mon Dec 30 19:05:47 2019 us=682394 push_entry = 'dhcp-option DNS 208.67.220.220'
Mon Dec 30 19:05:47 2019 us=682398 push_entry = 'route 10.8.0.1'
Mon Dec 30 19:05:47 2019 us=682403 push_entry = 'topology net30'
Mon Dec 30 19:05:47 2019 us=682407 push_entry = 'ping 10'
Mon Dec 30 19:05:47 2019 us=682411 push_entry = 'ping-restart 120'
Mon Dec 30 19:05:47 2019 us=682415 ifconfig_pool_defined = ENABLED
Mon Dec 30 19:05:47 2019 us=682420 ifconfig_pool_start = 10.8.0.4
Mon Dec 30 19:05:47 2019 us=682425 ifconfig_pool_end = 10.8.0.251
Mon Dec 30 19:05:47 2019 us=682429 ifconfig_pool_netmask = 0.0.0.0
Mon Dec 30 19:05:47 2019 us=682434 ifconfig_pool_persist_filename = 'ipp.txt'
Mon Dec 30 19:05:47 2019 us=682439 ifconfig_pool_persist_refresh_freq = 600
Mon Dec 30 19:05:47 2019 us=682443 ifconfig_ipv6_pool_defined = DISABLED
Mon Dec 30 19:05:47 2019 us=682448 ifconfig_ipv6_pool_base = ::
Mon Dec 30 19:05:47 2019 us=682452 ifconfig_ipv6_pool_netbits = 0
Mon Dec 30 19:05:47 2019 us=682457 n_bcast_buf = 256
Mon Dec 30 19:05:47 2019 us=682461 tcp_queue_limit = 64
Mon Dec 30 19:05:47 2019 us=682465 real_hash_size = 256
Mon Dec 30 19:05:47 2019 us=682470 virtual_hash_size = 256
Mon Dec 30 19:05:47 2019 us=682474 client_connect_script = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=682481 learn_address_script = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=682486 client_disconnect_script = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=682502 client_config_dir = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=682506 ccd_exclusive = DISABLED
Mon Dec 30 19:05:47 2019 us=682511 tmp_dir = '/tmp'
Mon Dec 30 19:05:47 2019 us=682515 push_ifconfig_defined = DISABLED
Mon Dec 30 19:05:47 2019 us=682520 push_ifconfig_local = 0.0.0.0
Mon Dec 30 19:05:47 2019 us=682525 push_ifconfig_remote_netmask = 0.0.0.0
Mon Dec 30 19:05:47 2019 us=682529 push_ifconfig_ipv6_defined = DISABLED
Mon Dec 30 19:05:47 2019 us=682534 push_ifconfig_ipv6_local = ::/0
Mon Dec 30 19:05:47 2019 us=682538 push_ifconfig_ipv6_remote = ::
Mon Dec 30 19:05:47 2019 us=682543 enable_c2c = DISABLED
Mon Dec 30 19:05:47 2019 us=682558 duplicate_cn = DISABLED
Mon Dec 30 19:05:47 2019 us=682563 cf_max = 0
Mon Dec 30 19:05:47 2019 us=682567 cf_per = 0
Mon Dec 30 19:05:47 2019 us=682572 max_clients = 1024
Mon Dec 30 19:05:47 2019 us=682576 max_routes_per_client = 256
Mon Dec 30 19:05:47 2019 us=682581 auth_user_pass_verify_script = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=682585 auth_user_pass_verify_script_via_file = DISABLED
Mon Dec 30 19:05:47 2019 us=682589 port_share_host = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=682595 port_share_port = 0
Mon Dec 30 19:05:47 2019 us=682600 client = DISABLED
Mon Dec 30 19:05:47 2019 us=682604 pull = DISABLED
Mon Dec 30 19:05:47 2019 us=682609 auth_user_pass_file = '[UNDEF]'
Mon Dec 30 19:05:47 2019 us=682614 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jan 9 2019
Mon Dec 30 19:05:47 2019 us=682624 library versions: OpenSSL 1.0.2g 1 Mar 2016, LZO 2.08
Mon Dec 30 19:05:47 2019 us=697232 Diffie-Hellman initialized with 2048 bit key
Mon Dec 30 19:05:47 2019 us=702292 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Mon Dec 30 19:05:47 2019 us=702317 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Dec 30 19:05:47 2019 us=702324 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Dec 30 19:05:47 2019 us=702341 TLS-Auth MTU parms [ L:1570 D:1172 EF:78 EB:0 ET:0 EL:3 ]
Mon Dec 30 19:05:47 2019 us=702357 Socket Buffers: R=[30000000->30000000] S=[30000000->30000000]
Mon Dec 30 19:05:47 2019 us=702442 ROUTE_GATEWAY ON_LINK IFACE=venet0 HWADDR=00:00:00:00:00:00
Mon Dec 30 19:05:47 2019 us=703189 TUN/TAP device tun0 opened
Mon Dec 30 19:05:47 2019 us=703218 Note: Cannot set tx queue length on tun0: Operation not permitted (errno=1)
Mon Dec 30 19:05:47 2019 us=703233 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Dec 30 19:05:47 2019 us=703248 /sbin/ip link set dev tun0 up mtu 1500
Mon Dec 30 19:05:47 2019 us=712146 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Mon Dec 30 19:05:47 2019 us=718274 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Mon Dec 30 19:05:47 2019 us=726041 Data Channel MTU parms [ L:1570 D:1450 EF:70 EB:143 ET:0 EL:3 AF:3/1 ]
Mon Dec 30 19:05:47 2019 us=726428 GID set to nogroup
Mon Dec 30 19:05:47 2019 us=726444 UID set to nobody
Mon Dec 30 19:05:47 2019 us=726458 UDPv4 link local (bound): [undef]
Mon Dec 30 19:05:47 2019 us=726465 UDPv4 link remote: [undef]
Mon Dec 30 19:05:47 2019 us=726476 MULTI: multi_init called, r=256 v=256
Mon Dec 30 19:05:47 2019 us=726498 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Mon Dec 30 19:05:47 2019 us=726585 ifconfig_pool_read(), in='client1,10.8.0.4', TODO: IPv6
Mon Dec 30 19:05:47 2019 us=726596 succeeded -> ifconfig_pool_set()
Mon Dec 30 19:05:47 2019 us=726603 IFCONFIG POOL LIST
Mon Dec 30 19:05:47 2019 us=726609 client1,10.8.0.4
Mon Dec 30 19:05:47 2019 us=726631 Initialization Sequence Completed
Mon Dec 30 19:07:13 2019 us=124562 MULTI: multi_create_instance called
Mon Dec 30 19:07:13 2019 us=124629 x.x.x.x:55371 Re-using SSL/TLS context
Mon Dec 30 19:07:13 2019 us=124660 x.x.x.x:55371 LZO compression initialized
Mon Dec 30 19:07:13 2019 us=124765 x.x.x.x:55371 Control Channel MTU parms [ L:1570 D:1172 EF:78 EB:0 ET:0 EL:3 ]
Mon Dec 30 19:07:13 2019 us=124778 x.x.x.x:55371 Data Channel MTU parms [ L:1570 D:1450 EF:70 EB:143 ET:0 EL:3 AF:3/1 ]
Mon Dec 30 19:07:13 2019 us=124798 x.x.x.x:55371 Local Options String: 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-128-CBC,auth SHA256,keysize 128,tls-auth,key-method 2,tls-server'
Mon Dec 30 19:07:13 2019 us=124806 x.x.x.x:55371 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-128-CBC,auth SHA256,keysize 128,tls-auth,key-method 2,tls-client'
Mon Dec 30 19:07:13 2019 us=124845 x.x.x.x:55371 Local Options hash (VER=V4): '040e8560'
Mon Dec 30 19:07:13 2019 us=124874 x.x.x.x:55371 Expected Remote Options hash (VER=V4): 'af454ff6'
Mon Dec 30 19:07:13 2019 us=124909 x.x.x.x:55371 TLS: Initial packet from [AF_INET]x.x.x.x:55371, sid=ed2efccc dc3d897e
Mon Dec 30 19:07:13 2019 us=242662 x.x.x.x:55371 VERIFY OK: depth=1, C=CA, ST=ON, L=x, O=x, OU=Community, CN=x CA, name=Server, emailAddress=x
Mon Dec 30 19:07:13 2019 us=242778 x.x.x.x:55371 VERIFY OK: depth=0, C=CA, ST=ON, L=x, O=x, OU=Community, CN=client1, name=Server, emailAddress=x
Mon Dec 30 19:07:13 2019 us=282625 x.x.x.x:55371 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Mon Dec 30 19:07:13 2019 us=282662 x.x.x.x:55371 Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Dec 30 19:07:13 2019 us=282668 x.x.x.x:55371 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Mon Dec 30 19:07:13 2019 us=282675 x.x.x.x:55371 Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Dec 30 19:07:13 2019 us=326128 x.x.x.x:55371 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Mon Dec 30 19:07:13 2019 us=326169 x.x.x.x:55371 [client1] Peer Connection Initiated with [AF_INET]x.x.x.x:55371
Mon Dec 30 19:07:13 2019 us=326193 client1/x.x.x.x:55371 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Mon Dec 30 19:07:13 2019 us=326218 client1/x.x.x.x:55371 MULTI: Learn: 10.8.0.6 -> client1/x.x.x.x:55371
Mon Dec 30 19:07:13 2019 us=326225 client1/x.x.x.x:55371 MULTI: primary virtual IP for client1/x.x.x.x:55371: 10.8.0.6
Mon Dec 30 19:07:13 2019 us=326249 client1/x.x.x.x:55371 PUSH: Received control message: 'PUSH_REQUEST'
Mon Dec 30 19:07:13 2019 us=326256 client1/x.x.x.x:55371 send_push_reply(): safe_cap=940
Mon Dec 30 19:07:13 2019 us=326269 client1/x.x.x.x:55371 SENT CONTROL [client1]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Mon Dec 30 19:07:44 2019 us=316102 MULTI: multi_create_instance called
Mon Dec 30 19:07:44 2019 us=316163 x.x.x.x:57657 Re-using SSL/TLS context
Mon Dec 30 19:07:44 2019 us=316191 x.x.x.x:57657 LZO compression initialized
Mon Dec 30 19:07:44 2019 us=316240 x.x.x.x:57657 Control Channel MTU parms [ L:1570 D:1172 EF:78 EB:0 ET:0 EL:3 ]
Mon Dec 30 19:07:44 2019 us=316248 x.x.x.x:57657 Data Channel MTU parms [ L:1570 D:1450 EF:70 EB:143 ET:0 EL:3 AF:3/1 ]
Mon Dec 30 19:07:44 2019 us=316267 x.x.x.x:57657 Local Options String: 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-128-CBC,auth SHA256,keysize 128,tls-auth,key-method 2,tls-server'
Mon Dec 30 19:07:44 2019 us=316274 x.x.x.x:57657 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-128-CBC,auth SHA256,keysize 128,tls-auth,key-method 2,tls-client'
Mon Dec 30 19:07:44 2019 us=316287 x.x.x.x:57657 Local Options hash (VER=V4): '040e8560'
Mon Dec 30 19:07:44 2019 us=316303 x.x.x.x:57657 Expected Remote Options hash (VER=V4): 'af454ff6'
Mon Dec 30 19:07:44 2019 us=316320 x.x.x.x:57657 TLS: Initial packet from [AF_INET]x.x.x.x:57657, sid=5ce5be46 00c89e84
Mon Dec 30 19:07:44 2019 us=507172 x.x.x.x:57657 VERIFY OK: depth=1, C=CA, ST=ON, L=x, O=x, OU=Community, CN=x CA, name=Server, emailAddress=x
Mon Dec 30 19:07:44 2019 us=507280 x.x.x.x:57657 VERIFY OK: depth=0, C=CA, ST=ON, L=x, O=x, OU=Community, CN=client1, name=Server, emailAddress=x
Mon Dec 30 19:07:44 2019 us=539150 x.x.x.x:57657 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Mon Dec 30 19:07:44 2019 us=539181 x.x.x.x:57657 Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Dec 30 19:07:44 2019 us=539188 x.x.x.x:57657 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Mon Dec 30 19:07:44 2019 us=539194 x.x.x.x:57657 Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Dec 30 19:07:44 2019 us=566195 x.x.x.x:57657 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Mon Dec 30 19:07:44 2019 us=566255 x.x.x.x:57657 [client1] Peer Connection Initiated with [AF_INET]x.x.x.x:57657
Mon Dec 30 19:07:44 2019 us=566403 MULTI: new connection by client 'client1' will cause previous active sessions by this client to be dropped. Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Mon Dec 30 19:07:44 2019 us=566415 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Mon Dec 30 19:07:44 2019 us=566437 MULTI: Learn: 10.8.0.6 -> client1/x.x.x.x:57657
Mon Dec 30 19:07:44 2019 us=566443 MULTI: primary virtual IP for client1/x.x.x.x:57657: 10.8.0.6
Mon Dec 30 19:07:45 2019 us=568777 client1/x.x.x.x:57657 PUSH: Received control message: 'PUSH_REQUEST'
Mon Dec 30 19:07:45 2019 us=568810 client1/x.x.x.x:57657 send_push_reply(): safe_cap=940
Mon Dec 30 19:07:45 2019 us=568832 client1/x.x.x.x:57657 SENT CONTROL [client1]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
SERVER
Operating System:
host:~ $ uname -a
Linux raspberrypi 4.19.75-v7l+ #1270 SMP Tue Sep 24 18:51:41 BST 2019 armv7l GNU/Linux
Network Setup
br-14150c78a835: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
inet x.x.x.x netmask 255.255.0.0 broadcast x.x.x.x
ether 02:42:10:45:28:c9 txqueuelen 0 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
br-34bd458b4b42: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
inet x.x.x.x netmask 255.255.0.0 broadcast x.x.x.x
inet6 fe80::42:9aff:fe51:da55 prefixlen 64 scopeid 0x20<link>
ether 02:42:9a:51:da:55 txqueuelen 0 (Ethernet)
RX packets 7 bytes 998 (998.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 29 bytes 3909 (3.8 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
br-48d16afc3f3f: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
inet x.x.x.x netmask 255.255.0.0 broadcast x.x.x.x
ether 02:42:f5:71:f2:cf txqueuelen 0 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
br-8595b0234ead: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
inet x.x.x.x netmask 255.255.0.0 broadcast x.x.x.x
ether 02:42:20:79:08:31 txqueuelen 0 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
br-8dbd2e80eb0e: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet x.x.x.x netmask 255.255.0.0 broadcast x.x.x.x
inet6 fe80::42:6aff:feb7:198 prefixlen 64 scopeid 0x20<link>
ether 02:42:6a:b7:01:98 txqueuelen 0 (Ethernet)
RX packets 34529 bytes 44191534 (42.1 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 16332 bytes 3592915 (3.4 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
docker0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
inet x.x.x.x netmask 255.255.0.0 broadcast x.x.x.x
ether 02:42:c5:4f:95:b7 txqueuelen 0 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
eth0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
ether dc:a6:32:4b:5a:cc txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500
inet 10.8.0.6 netmask 255.255.255.255 destination 10.8.0.5
inet6 fe80::a747:eb7e:9dbf:da60 prefixlen 64 scopeid 0x20<link>
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC)
RX packets 45815 bytes 45550508 (43.4 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 46596 bytes 35131126 (33.5 MiB)
TX errors 0 dropped 1373 overruns 0 carrier 0 collisions 0
veth492e6d1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet x.x.x.x netmask 255.255.0.0 broadcast x.x.x.x
inet6 fe80::2ffd:7b50:8118:3eaf prefixlen 64 scopeid 0x20<link>
ether ee:8a:fc:7c:2c:eb txqueuelen 0 (Ethernet)
RX packets 5910 bytes 33538046 (31.9 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 22955 bytes 4384347 (4.1 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
veth6c58839: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet x.x.x.x netmask 255.255.0.0 broadcast x.x.x.x
inet6 fe80::2450:33ff:fe9f:a7ba prefixlen 64 scopeid 0x20<link>
ether 26:50:33:9f:a7:ba txqueuelen 0 (Ethernet)
RX packets 19940 bytes 29010661 (27.6 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 31771 bytes 35250802 (33.6 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
veth9b82da6: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet x.x.x.x netmask 255.255.0.0 broadcast x.x.x.x
inet6 fe80::8f1:53ff:fe77:1fd9 prefixlen 64 scopeid 0x20<link>
ether 0a:f1:53:77:1f:d9 txqueuelen 0 (Ethernet)
RX packets 8 bytes 1099 (1.0 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 16744 bytes 2698575 (2.5 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
vethd89b229: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet x.x.x.x netmask 255.255.0.0 broadcast x.x.x.x
inet6 fe80::e050:f0ff:fe20:fc09 prefixlen 64 scopeid 0x20<link>
ether e2:50:f0:20:fc:09 txqueuelen 0 (Ethernet)
RX packets 13012 bytes 13448431 (12.8 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 14763 bytes 3152385 (3.0 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.0.0.41 netmask 255.255.255.0 broadcast 10.0.0.255
inet6 fe80::79b9:5d7f:1cff:330a prefixlen 64 scopeid 0x20<link>
inet6 2607:fea8:2aa0:18d0:4ef1:bd0c:6f14:a6d4 prefixlen 64 scopeid 0x0<global>
inet6 2607:fea8:2aa0:18d0::b760 prefixlen 128 scopeid 0x0<global>
ether dc:a6:32:4b:5a:ce txqueuelen 1000 (Ethernet)
RX packets 201414 bytes 79176567 (75.5 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 208629 bytes 77484717 (73.8 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
Client Config
##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server. #
# #
# This configuration can be used by multiple #
# clients, however each client should have #
# its own cert and key files. #
# #
# On Windows, you might want to rename this #
# file so it has a .ovpn extension #
##############################################
# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client
# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun
# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one. On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap
# Are we connecting to a TCP or
# UDP server? Use the same setting as
# on the server.
;proto tcp
proto udp
# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote x.x.x.x. 1194
;remote my-server-2 1194
# Choose a random host from the remote
# list for load-balancing. Otherwise
# try hosts in the order specified.
;remote-random
# Keep trying indefinitely to resolve the
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite
# Most clients don't need to bind to
# a specific local port number.
nobind
# Downgrade privileges after initialization (non-Windows only)
user nobody
group nogroup
# Try to preserve some state across restarts.
persist-key
persist-tun
# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here. See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
# Wireless networks often produce a lot
# of duplicate packets. Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings
# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.
#ca ca.crt
#cert client.crt
#key client.key
# Verify server certificate by checking that the
# certicate has the correct key usage set.
# This is an important precaution to protect against
# a potential attack discussed here:
#
http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the keyUsage set to
# digitalSignature, keyEncipherment
# and the extendedKeyUsage to
# serverAuth
# EasyRSA can do this for you.
remote-cert-tls server
# If a tls-auth key is used on the server
# then every client must also have the key.
;tls-auth ta.key 1
# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x
cipher AES-128-CBC
auth SHA256
key-direction 1
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf
keepalive 10 60
# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo
# Set log file verbosity.
verb 4
# Silence repeating messages
;mute 20
ca ca.crt
cert client1.crt
key client1.key
tls-auth ta.key
Client logs with verbose 4 on the next post.
