CN invalid

vieri

Hi,

I don't know why this VPN client cannot establish the tunnel.
It's CN is in the ccd directory.

Fri Mar 27 18:49:48 2020 us=837611 ZVPN/CLIENT_IP:61199 VERIFY OK: depth=0, C=US, ST=XX, L=XX, O=http://mydomain.org, OU=IT, CN=ZVPN1029384576, emailAddress=me@mydomain.org
Fri Mar 27 18:49:48 2020 us=843915 ZVPN/CLIENT_IP:61199 UDPv4 WRITE [145] to [AF_INET]CLIENT_IP:61199: P_CONTROL_V1 kid=0 pid=[ #9 ] [ 4 ] pid=5 DATA len=91
Fri Mar 27 18:49:48 2020 us=843956 ZVPN/CLIENT_IP:61199 UDPv4 READ [50] from [AF_INET]CLIENT_IP:61199: P_ACK_V1 kid=0 pid=[ #10 ] [ 4 ]
Fri Mar 27 18:49:48 2020 us=929334 ZVPN/CLIENT_IP:61199 UDPv4 READ [507] from [AF_INET]CLIENT_IP:61199: P_CONTROL_V1 kid=0 pid=[ #11 ] [ 5 ] pid=5 DATA len=453
Fri Mar 27 18:49:48 2020 us=929385 ZVPN/CLIENT_IP:61199 peer info: IV_VER=2.4.2
Fri Mar 27 18:49:48 2020 us=929399 ZVPN/CLIENT_IP:61199 peer info: IV_PLAT=linux
Fri Mar 27 18:49:48 2020 us=929420 ZVPN/CLIENT_IP:61199 peer info: IV_PROTO=2
Fri Mar 27 18:49:48 2020 us=929427 ZVPN/CLIENT_IP:61199 peer info: IV_NCP=2
Fri Mar 27 18:49:48 2020 us=929434 ZVPN/CLIENT_IP:61199 peer info: IV_LZ4=1
Fri Mar 27 18:49:48 2020 us=929441 ZVPN/CLIENT_IP:61199 peer info: IV_LZ4v2=1
Fri Mar 27 18:49:48 2020 us=929448 ZVPN/CLIENT_IP:61199 peer info: IV_LZO=1
Fri Mar 27 18:49:48 2020 us=929459 ZVPN/CLIENT_IP:61199 peer info: IV_COMP_STUB=1
Fri Mar 27 18:49:48 2020 us=929466 ZVPN/CLIENT_IP:61199 peer info: IV_COMP_STUBv2=1
Fri Mar 27 18:49:48 2020 us=929472 ZVPN/CLIENT_IP:61199 peer info: IV_TCPNL=1
Fri Mar 27 18:49:48 2020 us=929483 ZVPN/CLIENT_IP:61199 TLS Auth Error: TLS object CN attempted to change from 'ZVPN' to 'ZVPN1029384576' -- tunnel disabled

Any ideas?

Vieri

Pippin

We need more info, please see:
https://forums.openvpn.net/viewtopic.php?t=22603

vieri

Server configuration file:

# cat /etc/openvpn/HM-zvpn.conf | grep -v ^#

local 172.16.0.1
port 61199
dev tun152
ca /etc/ssl/CA-HM/cacert.pem
dh /etc/ssl/CA-HM/dh2048.pem
cert /etc/ssl/openvpn/openvpnservers_OVPN_cert.pem
key /etc/ssl/openvpn/openvpnservers_OVPN_key_nopassphrase.pem
tls-auth /etc/ssl/openvpn/ta-zvpn.key 0
cipher AES-256-CBC
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA256
mode server
tls-server
topology subnet
push "topology subnet"
ifconfig 192.168.152.1 255.255.254.0
ifconfig-pool 192.168.152.51 192.168.153.254 255.255.254.0
push "route-gateway 192.168.152.1"
route-gateway 192.168.152.2
persist-key
persist-tun
client-config-dir /etc/openvpn/ccd-zvpn
script-security 2
client-connect "/etc/openvpn/client-up.sh zvpn"
client-disconnect "/etc/openvpn/client-down.sh zvpn"
ifconfig-pool-persist /var/log/openvpn/HM-zvpn_ipp.txt
push "route 10.215.0.0 255.255.0.0"
push "dhcp-option DNS 10.2.100.10"
push "dhcp-option DNS 10.2.100.11"
push "dhcp-option DOMAIN mydomain.org"
push "dhcp-option DOMAIN mydomain2.org"
keepalive 10 120
comp-lzo
user openvpn
group openvpn
status /var/log/openvpn/HM-zvpn.status
log /var/log/openvpn/HM-zvpn.log
verb 6

Server log file at --verb 4:

I provided a snippet with --verb 6 in the previous post. Do you need more?

Client configuration file:
# cat vpn.cnf
dev tun
remote vpn.mydomain.org 61199
port 61199
client
<ca>
xxx
</ca>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
xxx
-----END OpenVPN Static key V1-----
</tls-auth>
<cert>
-----BEGIN CERTIFICATE-----
xxx
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN RSA PRIVATE KEY-----
xxx
-----END RSA PRIVATE KEY-----
</key>
key-direction 1
cipher AES-256-CBC
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA256
ns-cert-type server
auth-nocache
comp-lzo
ping 15
ping-restart 45
ping-timer-rem
persist-tun
persist-key
verb 0

Client log file at --verb 4:

I am unable to provide that at the moment as the client is in a remote location and cannot connect (it is a VoIP device).
I will set up a new client for testing purposes, but maybe the above information is enough for a start?

vieri

I installed the client config on my Linux desktop, and it has successfulyy connected.

Client log file at --verb 4:

Sat Mar 28 00:13:04 2020 us=734213 Current Parameter Settings:
Sat Mar 28 00:13:04 2020 us=734279   config = 'vpn.cnf'
Sat Mar 28 00:13:04 2020 us=734289   mode = 0
Sat Mar 28 00:13:04 2020 us=734414   persist_config = DISABLED
Sat Mar 28 00:13:04 2020 us=734423   persist_mode = 1
Sat Mar 28 00:13:04 2020 us=734430   show_ciphers = DISABLED
Sat Mar 28 00:13:04 2020 us=734482   show_digests = DISABLED
Sat Mar 28 00:13:04 2020 us=734498   show_engines = DISABLED
Sat Mar 28 00:13:04 2020 us=734513   genkey = DISABLED
Sat Mar 28 00:13:04 2020 us=734527   key_pass_file = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=734542   show_tls_ciphers = DISABLED
Sat Mar 28 00:13:04 2020 us=734571   connect_retry_max = 0
Sat Mar 28 00:13:04 2020 us=734585 Connection profiles [0]:
Sat Mar 28 00:13:04 2020 us=734601   proto = udp
Sat Mar 28 00:13:04 2020 us=734615   local = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=734630   local_port = '61199'
Sat Mar 28 00:13:04 2020 us=734645   remote = 'vpn.mydomain.org'
Sat Mar 28 00:13:04 2020 us=734686   remote_port = '61199'
Sat Mar 28 00:13:04 2020 us=734712   remote_float = DISABLED
Sat Mar 28 00:13:04 2020 us=734727   bind_defined = DISABLED
Sat Mar 28 00:13:04 2020 us=734742   bind_local = ENABLED
Sat Mar 28 00:13:04 2020 us=734781   bind_ipv6_only = DISABLED
Sat Mar 28 00:13:04 2020 us=734796   connect_retry_seconds = 5
Sat Mar 28 00:13:04 2020 us=734810   connect_timeout = 120
Sat Mar 28 00:13:04 2020 us=734826   socks_proxy_server = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=734858   socks_proxy_port = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=734881   tun_mtu = 1500
Sat Mar 28 00:13:04 2020 us=734895   tun_mtu_defined = ENABLED
Sat Mar 28 00:13:04 2020 us=734910   link_mtu = 1500
Sat Mar 28 00:13:04 2020 us=734939   link_mtu_defined = DISABLED
Sat Mar 28 00:13:04 2020 us=734961   tun_mtu_extra = 0
Sat Mar 28 00:13:04 2020 us=734973   tun_mtu_extra_defined = DISABLED
Sat Mar 28 00:13:04 2020 us=734985   mtu_discover_type = -1
Sat Mar 28 00:13:04 2020 us=734996   fragment = 0
Sat Mar 28 00:13:04 2020 us=735008   mssfix = 1450
Sat Mar 28 00:13:04 2020 us=735019   explicit_exit_notification = 0
Sat Mar 28 00:13:04 2020 us=735030 Connection profiles END
Sat Mar 28 00:13:04 2020 us=735041   remote_random = DISABLED
Sat Mar 28 00:13:04 2020 us=735052   ipchange = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735063   dev = 'tun'
Sat Mar 28 00:13:04 2020 us=735074   dev_type = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735085   dev_node = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735097   lladdr = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735108   topology = 1
Sat Mar 28 00:13:04 2020 us=735119   ifconfig_local = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735130   ifconfig_remote_netmask = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735142   ifconfig_noexec = DISABLED
Sat Mar 28 00:13:04 2020 us=735153   ifconfig_nowarn = DISABLED
Sat Mar 28 00:13:04 2020 us=735164   ifconfig_ipv6_local = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735175   ifconfig_ipv6_netbits = 0
Sat Mar 28 00:13:04 2020 us=735186   ifconfig_ipv6_remote = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735198   shaper = 0
Sat Mar 28 00:13:04 2020 us=735209   mtu_test = 0
Sat Mar 28 00:13:04 2020 us=735221   mlock = DISABLED
Sat Mar 28 00:13:04 2020 us=735232   keepalive_ping = 0
Sat Mar 28 00:13:04 2020 us=735243   keepalive_timeout = 0
Sat Mar 28 00:13:04 2020 us=735255   inactivity_timeout = 0
Sat Mar 28 00:13:04 2020 us=735266   ping_send_timeout = 15
Sat Mar 28 00:13:04 2020 us=735277   ping_rec_timeout = 45
Sat Mar 28 00:13:04 2020 us=735288   ping_rec_timeout_action = 2
Sat Mar 28 00:13:04 2020 us=735299   ping_timer_remote = ENABLED
Sat Mar 28 00:13:04 2020 us=735311   remap_sigusr1 = 0
Sat Mar 28 00:13:04 2020 us=735322   persist_tun = ENABLED
Sat Mar 28 00:13:04 2020 us=735333   persist_local_ip = DISABLED
Sat Mar 28 00:13:04 2020 us=735344   persist_remote_ip = DISABLED
Sat Mar 28 00:13:04 2020 us=735355   persist_key = ENABLED
Sat Mar 28 00:13:04 2020 us=735366   passtos = DISABLED
Sat Mar 28 00:13:04 2020 us=735377   resolve_retry_seconds = 1000000000
Sat Mar 28 00:13:04 2020 us=735388   resolve_in_advance = DISABLED
Sat Mar 28 00:13:04 2020 us=735400   username = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735411   groupname = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735422   chroot_dir = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735433   cd_dir = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735444   writepid = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735455   up_script = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735466   down_script = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735477   down_pre = DISABLED
Sat Mar 28 00:13:04 2020 us=735488   up_restart = DISABLED
Sat Mar 28 00:13:04 2020 us=735499   up_delay = DISABLED
Sat Mar 28 00:13:04 2020 us=735511   daemon = DISABLED
Sat Mar 28 00:13:04 2020 us=735522   inetd = 0
Sat Mar 28 00:13:04 2020 us=735533   log = DISABLED
Sat Mar 28 00:13:04 2020 us=735544   suppress_timestamps = DISABLED
Sat Mar 28 00:13:04 2020 us=735571   machine_readable_output = DISABLED
Sat Mar 28 00:13:04 2020 us=735579   nice = 0
Sat Mar 28 00:13:04 2020 us=735589   verbosity = 4
Sat Mar 28 00:13:04 2020 us=735601   mute = 0
Sat Mar 28 00:13:04 2020 us=735611   gremlin = 0
Sat Mar 28 00:13:04 2020 us=735623   status_file = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735634   status_file_version = 1
Sat Mar 28 00:13:04 2020 us=735645   status_file_update_freq = 60
Sat Mar 28 00:13:04 2020 us=735656   occ = ENABLED
Sat Mar 28 00:13:04 2020 us=735667   rcvbuf = 0
Sat Mar 28 00:13:04 2020 us=735678   sndbuf = 0
Sat Mar 28 00:13:04 2020 us=735690   mark = 0
Sat Mar 28 00:13:04 2020 us=735700   sockflags = 0
Sat Mar 28 00:13:04 2020 us=735712   fast_io = DISABLED
Sat Mar 28 00:13:04 2020 us=735723   comp.alg = 2
Sat Mar 28 00:13:04 2020 us=735734   comp.flags = 1
Sat Mar 28 00:13:04 2020 us=735745   route_script = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735756   route_default_gateway = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735768   route_default_metric = 0
Sat Mar 28 00:13:04 2020 us=735779   route_noexec = DISABLED
Sat Mar 28 00:13:04 2020 us=735790   route_delay = 0
Sat Mar 28 00:13:04 2020 us=735801   route_delay_window = 30
Sat Mar 28 00:13:04 2020 us=735812   route_delay_defined = DISABLED
Sat Mar 28 00:13:04 2020 us=735823   route_nopull = DISABLED
Sat Mar 28 00:13:04 2020 us=735835   route_gateway_via_dhcp = DISABLED
Sat Mar 28 00:13:04 2020 us=735846   allow_pull_fqdn = DISABLED
Sat Mar 28 00:13:04 2020 us=735857   management_addr = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735868   management_port = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735879   management_user_pass = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735891   management_log_history_cache = 250
Sat Mar 28 00:13:04 2020 us=735902   management_echo_buffer_size = 100
Sat Mar 28 00:13:04 2020 us=735913   management_write_peer_info_file = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735924   management_client_user = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735938   management_client_group = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735949   management_flags = 0
Sat Mar 28 00:13:04 2020 us=735967   shared_secret_file = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=735977   key_direction = 2
Sat Mar 28 00:13:04 2020 us=735988   ciphername = 'AES-256-CBC'
Sat Mar 28 00:13:04 2020 us=735998   ncp_enabled = ENABLED
Sat Mar 28 00:13:04 2020 us=736008   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
Sat Mar 28 00:13:04 2020 us=736019   authname = 'SHA1'
Sat Mar 28 00:13:04 2020 us=736029   prng_hash = 'SHA1'
Sat Mar 28 00:13:04 2020 us=736040   prng_nonce_secret_len = 16
Sat Mar 28 00:13:04 2020 us=736050   keysize = 0
Sat Mar 28 00:13:04 2020 us=736060   engine = DISABLED
Sat Mar 28 00:13:04 2020 us=736070   replay = ENABLED
Sat Mar 28 00:13:04 2020 us=736081   mute_replay_warnings = DISABLED
Sat Mar 28 00:13:04 2020 us=736091   replay_window = 64
Sat Mar 28 00:13:04 2020 us=736101   replay_time = 15
Sat Mar 28 00:13:04 2020 us=736112   packet_id_file = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=736122   use_iv = ENABLED
Sat Mar 28 00:13:04 2020 us=736132   test_crypto = DISABLED
Sat Mar 28 00:13:04 2020 us=736143   tls_server = DISABLED
Sat Mar 28 00:13:04 2020 us=736153   tls_client = ENABLED
Sat Mar 28 00:13:04 2020 us=736163   key_method = 2
Sat Mar 28 00:13:04 2020 us=736173   ca_file = '[[INLINE]]'
Sat Mar 28 00:13:04 2020 us=736183   ca_path = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=736194   dh_file = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=736205   cert_file = '[[INLINE]]'
Sat Mar 28 00:13:04 2020 us=736215   extra_certs_file = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=736226   priv_key_file = '[[INLINE]]'
Sat Mar 28 00:13:04 2020 us=736237   pkcs12_file = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=736247   cipher_list = 'TLS-DHE-RSA-WITH-AES-256-CBC-SHA256'
Sat Mar 28 00:13:04 2020 us=736258   tls_verify = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=736268   tls_export_cert = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=736279   verify_x509_type = 0
Sat Mar 28 00:13:04 2020 us=736289   verify_x509_name = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=736300   crl_file = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=736310   ns_cert_type = 1
Sat Mar 28 00:13:04 2020 us=736320   remote_cert_ku[i] = 0
Sat Mar 28 00:13:04 2020 us=736330   remote_cert_ku[i] = 0
Sat Mar 28 00:13:04 2020 us=736341   remote_cert_ku[i] = 0
Sat Mar 28 00:13:04 2020 us=736351   remote_cert_ku[i] = 0
Sat Mar 28 00:13:04 2020 us=736361   remote_cert_ku[i] = 0
Sat Mar 28 00:13:04 2020 us=736371   remote_cert_ku[i] = 0
Sat Mar 28 00:13:04 2020 us=736378   remote_cert_ku[i] = 0
Sat Mar 28 00:13:04 2020 us=736390   remote_cert_ku[i] = 0
Sat Mar 28 00:13:04 2020 us=736397   remote_cert_ku[i] = 0
Sat Mar 28 00:13:04 2020 us=736404   remote_cert_ku[i] = 0
Sat Mar 28 00:13:04 2020 us=736411   remote_cert_ku[i] = 0
Sat Mar 28 00:13:04 2020 us=736418   remote_cert_ku[i] = 0
Sat Mar 28 00:13:04 2020 us=736428   remote_cert_ku[i] = 0
Sat Mar 28 00:13:04 2020 us=736434   remote_cert_ku[i] = 0
Sat Mar 28 00:13:04 2020 us=736441   remote_cert_ku[i] = 0
Sat Mar 28 00:13:04 2020 us=736448   remote_cert_ku[i] = 0
Sat Mar 28 00:13:04 2020 us=736455   remote_cert_eku = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=736465   ssl_flags = 0
Sat Mar 28 00:13:04 2020 us=736477   tls_timeout = 2
Sat Mar 28 00:13:04 2020 us=736498   renegotiate_bytes = -1
Sat Mar 28 00:13:04 2020 us=736511   renegotiate_packets = 0
Sat Mar 28 00:13:04 2020 us=736522   renegotiate_seconds = 3600
Sat Mar 28 00:13:04 2020 us=736532   handshake_window = 60
Sat Mar 28 00:13:04 2020 us=736543   transition_window = 3600
Sat Mar 28 00:13:04 2020 us=736553   single_session = DISABLED
Sat Mar 28 00:13:04 2020 us=736595   push_peer_info = DISABLED
Sat Mar 28 00:13:04 2020 us=736606   tls_exit = DISABLED
Sat Mar 28 00:13:04 2020 us=736617   tls_auth_file = '[[INLINE]]'
Sat Mar 28 00:13:04 2020 us=736627   tls_crypt_file = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=736637   pkcs11_protected_authentication = DISABLED
Sat Mar 28 00:13:04 2020 us=736647   pkcs11_protected_authentication = DISABLED
Sat Mar 28 00:13:04 2020 us=736657   pkcs11_protected_authentication = DISABLED
Sat Mar 28 00:13:04 2020 us=736667   pkcs11_protected_authentication = DISABLED
Sat Mar 28 00:13:04 2020 us=736678   pkcs11_protected_authentication = DISABLED
Sat Mar 28 00:13:04 2020 us=736688   pkcs11_protected_authentication = DISABLED
Sat Mar 28 00:13:04 2020 us=736698   pkcs11_protected_authentication = DISABLED
Sat Mar 28 00:13:04 2020 us=736708   pkcs11_protected_authentication = DISABLED
Sat Mar 28 00:13:04 2020 us=736718   pkcs11_protected_authentication = DISABLED
Sat Mar 28 00:13:04 2020 us=736728   pkcs11_protected_authentication = DISABLED
Sat Mar 28 00:13:04 2020 us=736739   pkcs11_protected_authentication = DISABLED
Sat Mar 28 00:13:04 2020 us=736749   pkcs11_protected_authentication = DISABLED
Sat Mar 28 00:13:04 2020 us=736759   pkcs11_protected_authentication = DISABLED
Sat Mar 28 00:13:04 2020 us=736769   pkcs11_protected_authentication = DISABLED
Sat Mar 28 00:13:04 2020 us=736779   pkcs11_protected_authentication = DISABLED
Sat Mar 28 00:13:04 2020 us=736790   pkcs11_protected_authentication = DISABLED
Sat Mar 28 00:13:04 2020 us=736801   pkcs11_private_mode = 00000000
Sat Mar 28 00:13:04 2020 us=736811   pkcs11_private_mode = 00000000
Sat Mar 28 00:13:04 2020 us=736822   pkcs11_private_mode = 00000000
Sat Mar 28 00:13:04 2020 us=736832   pkcs11_private_mode = 00000000
Sat Mar 28 00:13:04 2020 us=736842   pkcs11_private_mode = 00000000
Sat Mar 28 00:13:04 2020 us=736852   pkcs11_private_mode = 00000000
Sat Mar 28 00:13:04 2020 us=736862   pkcs11_private_mode = 00000000
Sat Mar 28 00:13:04 2020 us=736872   pkcs11_private_mode = 00000000
Sat Mar 28 00:13:04 2020 us=736882   pkcs11_private_mode = 00000000
Sat Mar 28 00:13:04 2020 us=736892   pkcs11_private_mode = 00000000
Sat Mar 28 00:13:04 2020 us=736902   pkcs11_private_mode = 00000000
Sat Mar 28 00:13:04 2020 us=736912   pkcs11_private_mode = 00000000
Sat Mar 28 00:13:04 2020 us=736922   pkcs11_private_mode = 00000000
Sat Mar 28 00:13:04 2020 us=736932   pkcs11_private_mode = 00000000
Sat Mar 28 00:13:04 2020 us=736942   pkcs11_private_mode = 00000000
Sat Mar 28 00:13:04 2020 us=736952   pkcs11_private_mode = 00000000
Sat Mar 28 00:13:04 2020 us=736962   pkcs11_cert_private = DISABLED
Sat Mar 28 00:13:04 2020 us=736972   pkcs11_cert_private = DISABLED
Sat Mar 28 00:13:04 2020 us=736982   pkcs11_cert_private = DISABLED
Sat Mar 28 00:13:04 2020 us=736991   pkcs11_cert_private = DISABLED
Sat Mar 28 00:13:04 2020 us=737001   pkcs11_cert_private = DISABLED
Sat Mar 28 00:13:04 2020 us=737011   pkcs11_cert_private = DISABLED
Sat Mar 28 00:13:04 2020 us=737022   pkcs11_cert_private = DISABLED
Sat Mar 28 00:13:04 2020 us=737032   pkcs11_cert_private = DISABLED
Sat Mar 28 00:13:04 2020 us=737042   pkcs11_cert_private = DISABLED
Sat Mar 28 00:13:04 2020 us=737052   pkcs11_cert_private = DISABLED
Sat Mar 28 00:13:04 2020 us=737062   pkcs11_cert_private = DISABLED
Sat Mar 28 00:13:04 2020 us=737072   pkcs11_cert_private = DISABLED
Sat Mar 28 00:13:04 2020 us=737082   pkcs11_cert_private = DISABLED
Sat Mar 28 00:13:04 2020 us=737092   pkcs11_cert_private = DISABLED
Sat Mar 28 00:13:04 2020 us=737102   pkcs11_cert_private = DISABLED
Sat Mar 28 00:13:04 2020 us=737112   pkcs11_cert_private = DISABLED
Sat Mar 28 00:13:04 2020 us=737122   pkcs11_pin_cache_period = -1
Sat Mar 28 00:13:04 2020 us=737132   pkcs11_id = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=737142   pkcs11_id_management = DISABLED
Sat Mar 28 00:13:04 2020 us=737154   server_network = 0.0.0.0
Sat Mar 28 00:13:04 2020 us=737165   server_netmask = 0.0.0.0
Sat Mar 28 00:13:04 2020 us=737184   server_network_ipv6 = ::
Sat Mar 28 00:13:04 2020 us=737195   server_netbits_ipv6 = 0
Sat Mar 28 00:13:04 2020 us=737206   server_bridge_ip = 0.0.0.0
Sat Mar 28 00:13:04 2020 us=737216   server_bridge_netmask = 0.0.0.0
Sat Mar 28 00:13:04 2020 us=737227   server_bridge_pool_start = 0.0.0.0
Sat Mar 28 00:13:04 2020 us=737238   server_bridge_pool_end = 0.0.0.0
Sat Mar 28 00:13:04 2020 us=737248   ifconfig_pool_defined = DISABLED
Sat Mar 28 00:13:04 2020 us=737259   ifconfig_pool_start = 0.0.0.0
Sat Mar 28 00:13:04 2020 us=737270   ifconfig_pool_end = 0.0.0.0
Sat Mar 28 00:13:04 2020 us=737281   ifconfig_pool_netmask = 0.0.0.0
Sat Mar 28 00:13:04 2020 us=737291   ifconfig_pool_persist_filename = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=737301   ifconfig_pool_persist_refresh_freq = 600
Sat Mar 28 00:13:04 2020 us=737311   ifconfig_ipv6_pool_defined = DISABLED
Sat Mar 28 00:13:04 2020 us=737322   ifconfig_ipv6_pool_base = ::
Sat Mar 28 00:13:04 2020 us=737332   ifconfig_ipv6_pool_netbits = 0
Sat Mar 28 00:13:04 2020 us=737343   n_bcast_buf = 256
Sat Mar 28 00:13:04 2020 us=737352   tcp_queue_limit = 64
Sat Mar 28 00:13:04 2020 us=737362   real_hash_size = 256
Sat Mar 28 00:13:04 2020 us=737372   virtual_hash_size = 256
Sat Mar 28 00:13:04 2020 us=737382   client_connect_script = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=737393   learn_address_script = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=737404   client_disconnect_script = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=737414   client_config_dir = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=737424   ccd_exclusive = DISABLED
Sat Mar 28 00:13:04 2020 us=737434   tmp_dir = '/tmp'
Sat Mar 28 00:13:04 2020 us=737444   push_ifconfig_defined = DISABLED
Sat Mar 28 00:13:04 2020 us=737455   push_ifconfig_local = 0.0.0.0
Sat Mar 28 00:13:04 2020 us=737466   push_ifconfig_remote_netmask = 0.0.0.0
Sat Mar 28 00:13:04 2020 us=737476   push_ifconfig_ipv6_defined = DISABLED
Sat Mar 28 00:13:04 2020 us=737487   push_ifconfig_ipv6_local = ::/0
Sat Mar 28 00:13:04 2020 us=737497   push_ifconfig_ipv6_remote = ::
Sat Mar 28 00:13:04 2020 us=737508   enable_c2c = DISABLED
Sat Mar 28 00:13:04 2020 us=737518   duplicate_cn = DISABLED
Sat Mar 28 00:13:04 2020 us=737528   cf_max = 0
Sat Mar 28 00:13:04 2020 us=737538   cf_per = 0
Sat Mar 28 00:13:04 2020 us=737548   max_clients = 1024
Sat Mar 28 00:13:04 2020 us=737558   max_routes_per_client = 256
Sat Mar 28 00:13:04 2020 us=737568   auth_user_pass_verify_script = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=737578   auth_user_pass_verify_script_via_file = DISABLED
Sat Mar 28 00:13:04 2020 us=737590   auth_token_generate = DISABLED
Sat Mar 28 00:13:04 2020 us=737597   auth_token_lifetime = 0
Sat Mar 28 00:13:04 2020 us=737604   port_share_host = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=737611   port_share_port = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=737626   client = ENABLED
Sat Mar 28 00:13:04 2020 us=737636   pull = ENABLED
Sat Mar 28 00:13:04 2020 us=737643   auth_user_pass_file = '[UNDEF]'
Sat Mar 28 00:13:04 2020 us=737651 OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2019
Sat Mar 28 00:13:04 2020 us=737666 library versions: OpenSSL 1.1.1  11 Sep 2018, LZO 2.08
Sat Mar 28 00:13:04 2020 us=737905 WARNING: --ns-cert-type is DEPRECATED.  Use --remote-cert-tls instead.
Sat Mar 28 00:13:04 2020 us=738627 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Mar 28 00:13:04 2020 us=738657 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Mar 28 00:13:04 2020 us=738674 LZO compression initializing
Sat Mar 28 00:13:04 2020 us=738800 Control Channel MTU parms [ L:1622 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Sat Mar 28 00:13:04 2020 us=743741 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Sat Mar 28 00:13:04 2020 us=743850 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Sat Mar 28 00:13:04 2020 us=743871 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Sat Mar 28 00:13:04 2020 us=743900 TCP/UDP: Preserving recently used remote address: [AF_INET]server_IP:61199
Sat Mar 28 00:13:04 2020 us=743945 Socket Buffers: R=[212992->212992] S=[212992->212992]
Sat Mar 28 00:13:04 2020 us=743973 UDP link local (bound): [AF_INET][undef]:61199
Sat Mar 28 00:13:04 2020 us=743991 UDP link remote: [AF_INET]server_IP:61199
Sat Mar 28 00:13:04 2020 us=772743 TLS: Initial packet from [AF_INET]server_IP:61199, sid=cc7b6bb2 b9f940fb
Sat Mar 28 00:13:04 2020 us=821135 VERIFY OK: depth=1, C=xx, ST=xx, O=xx, OU=xx, CN=HM, emailAddress=me@mydomain.org
Sat Mar 28 00:13:04 2020 us=821633 VERIFY OK: nsCertType=SERVER
Sat Mar 28 00:13:04 2020 us=821663 VERIFY OK: depth=0, C=xx, ST=xx, L=xx, O=xx, OU=xx, CN=xx, emailAddress=me@mydomain.org
Sat Mar 28 00:13:04 2020 us=922366 Control Channel: TLSv1.2, cipher TLSv1.2 DHE-RSA-AES256-SHA256, 4096 bit RSA
Sat Mar 28 00:13:04 2020 us=922493 [INF-FW_ovpn] Peer Connection Initiated with [AF_INET]server_IP:61199
Sat Mar 28 00:13:06 2020 us=138968 SENT CONTROL [INF-FW_ovpn]: 'PUSH_REQUEST' (status=1)
Sat Mar 28 00:13:06 2020 us=166962 PUSH: Received control message: 'PUSH_REPLY,topology subnet,route-gateway 192.168.152.1,route 10.215.0.0 255.255.0.0,dhcp-option DNS 10.2.100.10,dhcp-option DNS 10.2.100.11,dhcp-option DOMAIN mydomain.org,dhcp-option DOMAIN mydomain2.org,ping 10,ping-restart 120,ifconfig 192.168.152.10 255.255.254.0,peer-id 0,cipher AES-256-GCM'
Sat Mar 28 00:13:06 2020 us=167185 OPTIONS IMPORT: timers and/or timeouts modified
Sat Mar 28 00:13:06 2020 us=167205 OPTIONS IMPORT: --ifconfig/up options modified
Sat Mar 28 00:13:06 2020 us=167225 OPTIONS IMPORT: route options modified
Sat Mar 28 00:13:06 2020 us=167241 OPTIONS IMPORT: route-related options modified
Sat Mar 28 00:13:06 2020 us=167256 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sat Mar 28 00:13:06 2020 us=167271 OPTIONS IMPORT: peer-id set
Sat Mar 28 00:13:06 2020 us=167287 OPTIONS IMPORT: adjusting link_mtu to 1625
Sat Mar 28 00:13:06 2020 us=167302 OPTIONS IMPORT: data channel crypto options modified
Sat Mar 28 00:13:06 2020 us=167320 Data Channel: using negotiated cipher 'AES-256-GCM'
Sat Mar 28 00:13:06 2020 us=167351 Data Channel MTU parms [ L:1553 D:1450 EF:53 EB:406 ET:0 EL:3 ]
Sat Mar 28 00:13:06 2020 us=167494 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sat Mar 28 00:13:06 2020 us=167517 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sat Mar 28 00:13:06 2020 us=167741 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=enp4s0 HWADDR=00:25:22:d1:98:02
Sat Mar 28 00:13:06 2020 us=168138 TUN/TAP device tun0 opened
Sat Mar 28 00:13:06 2020 us=168198 TUN/TAP TX queue length set to 100
Sat Mar 28 00:13:06 2020 us=168228 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Sat Mar 28 00:13:06 2020 us=168253 /sbin/ip link set dev tun0 up mtu 1500
Sat Mar 28 00:13:06 2020 us=183800 /sbin/ip addr add dev tun0 192.168.152.10/23 broadcast 192.168.153.255
Sat Mar 28 00:13:06 2020 us=186421 /sbin/ip route add 10.215.0.0/16 via 192.168.152.1
Sat Mar 28 00:13:06 2020 us=188642 Initialization Sequence Completed

The other client is a SIP hardphone, and I have no idea why it's failing as i my first post.
The client is openvpn there too, but I don't know yet which version.
I will try to set up another one and enable --verb 4.

Thanks,

Vieri

Pippin

Looks ok to me, server config could be simplified though.

We need to see the client (dis)connect scripts.