Hello all, I'am running an openvpn-server on debian buster [code]>openvpn --version OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019 library versions: OpenSSL 1.1.1d 10 Sep 2019, LZO 2.10 [/code] [oconf=Server config] # Server configuration mode server tls-server # Transport network options port 1188 proto udp dev tap8 # Certificate and key files ca ca.crt cert cert.crt key private.key dh dh2048.pem # Certificate revocation list (for disabled certificates) #crl-verify /etc/openvpn/crl/crl.pem # Client-specific rules and access policies. client-config-dir ccd #OpenVpn server's IP address and IP pool ifconfig 10.0.0.1 255.255.255.0 #ifconfig-pool 10.0.0.X 10.0.0.Y # Allow clients to communicate (see) each other via the VPN connection client-to-client #max-clients 10 # If you have not generated individual certificate/key pairs for each client, each having its own unique "common name", uncomment this line out #duplicate-cn # Add static routes to reach particular networks via the VPN client's IP address #route network [netmask] [gateway] [metric] #route 192.168.178.0 255.255.255.0 10.0.0.178 # Special server's network options # Push routes to the client to allow it to reach other private subnets behind the server # Advertise the subnets to VPN clients as being accessible through the VPN. push "route 192.168.0.0 255.255.255.0 10.0.0.1" push "route 192.168.1.0 255.255.255.0 10.0.0.1" # Security tweaks on Unix systems to drop root priviliges user openvpn group openvpn # Enable compression on the VPN link. Must be enables relevantly on every client comp-lzo # Select a cryptographic cipher. #cipher BF-CBC # Blowfish (default) cipher AES-256-CBC # AES # The persist options will try to avoid accessing certain resources on restart that may no longer be accessible because of the privilege downgrade. persist-key persist-tun # Ping every 10 seconds, assume that remote peer is down if no ping received during a 120 second time period. keepalive 10 120 ping-timer-rem # Set the appropriate level of log file verbosity verb 3 # Log file (default is to the syslog): log-append /var/log/vpn.log # Silence repeating messages in the log. mute 10 # Output a short status file showing current connections, truncated and rewritten every minute. status /var/log/vpn.status [/oconf] and an openvpn-client on a tp-link router tl-wr1043nd ver4.0 with openwrt 19.07.1 (extroot) [code]>openvpn --version OpenVPN 2.4.7 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] library versions: OpenSSL 1.1.1d 10 Sep 2019, LZO 2.10 [/code] [oconf=Client config] #client #pull tls-client remote-cert-tls server #tls-version-min 1.0 auth-nocache proto udp dev tap88 remote my.server.com 1188 nobind ifconfig 10.0.0.2 255.255.255.0 comp-lzo cipher AES-256-CBC # AES persist-key persist-tun keepalive 10 120 ping-timer-rem verb 3 log /var/log/client.log mute 10 # Certificate and key files ca ca.crt cert cert.crt key private.key [/oconf] The main issue is that uncommenting the pull option and restarting openvpn, the whole system on the router is crashing and not responding anymore. By activating the client option only the behavior is the same (client is an alias for tls-client and pull). This is the log according to the upper configuartion: [code]Fri Apr 3 14:42:23 2020 disabling NCP mode (--ncp-disable) because not in P2MP client or server mode Fri Apr 3 14:42:23 2020 OpenVPN 2.4.7 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] Fri Apr 3 14:42:23 2020 library versions: OpenSSL 1.1.1d 10 Sep 2019, LZO 2.10 Fri Apr 3 14:42:23 2020 TUN/TAP device tap88 opened Fri Apr 3 14:42:23 2020 TUN/TAP TX queue length set to 100 Fri Apr 3 14:42:23 2020 /sbin/ifconfig tap88 10.0.0.2 netmask 255.255.255.0 mtu 1500 broadcast 10.0.0.255 Fri Apr 3 14:42:24 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]my.server.com:1188 Fri Apr 3 14:42:24 2020 Socket Buffers: R=[163840->163840] S=[163840->163840] Fri Apr 3 14:42:24 2020 UDP link local: (not bound) Fri Apr 3 14:42:24 2020 UDP link remote: [AF_INET]my.server.com:1188 Fri Apr 3 14:42:24 2020 TLS: Initial packet from [AF_INET]my.server.com:1188, sid=e465d595 a2eb69b2 Fri Apr 3 14:42:24 2020 VERIFY OK: depth=4, C=DE, ST=.., O=PKI, OU=Root Certificate Authority CA, CN=Root CA Fri Apr 3 14:42:24 2020 VERIFY OK: depth=3, C=DE, ST=.., O=PKI, OU=1st Level Certificate Authority CA, CN=Intermediate CA Fri Apr 3 14:42:24 2020 VERIFY OK: depth=2, C=DE, ST=.., L=.., O=PKI, OU=2nd Level Certificate Authority CA, CN=.. Fri Apr 3 14:42:24 2020 VERIFY OK: depth=1, C=DE, ST=.., L=.., O=PKI, OU=3rd Level Certificate Authority CA, CN=.. Fri Apr 3 14:42:24 2020 VERIFY KU OK Fri Apr 3 14:42:24 2020 Validating certificate extended key usage Fri Apr 3 14:42:24 2020 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication Fri Apr 3 14:42:24 2020 VERIFY EKU OK Fri Apr 3 14:42:24 2020 VERIFY OK: depth=0, C=DE, ST=.., L=Berlin, O=PKI, OU=.. Certificate, CN=server.. Fri Apr 3 14:42:24 2020 WARNING: 'ifconfig' is present in local config but missing in remote config, local='ifconfig 10.0.0.0 255.255.255.0' Fri Apr 3 14:42:24 2020 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key Fri Apr 3 14:42:24 2020 Outgoing Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication Fri Apr 3 14:42:24 2020 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key Fri Apr 3 14:42:24 2020 Incoming Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication Fri Apr 3 14:42:24 2020 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA Fri Apr 3 14:42:24 2020 [server] Peer Connection Initiated with [AF_INET]my.server.com:1188 Fri Apr 3 14:42:25 2020 Initialization Sequence Completed [/code] My questions are: Why I cannot use the "pull" option? Is there somthing wrong in the server or client configuration, that cause this? Is there an altenative method to pull the routes? Many thanks for your time and answers in advance .. ..hope i formated the blocks correctly

[quote]Are you sure it is crashing and it is not you bricking it by pulling routes which break your login [/quote] Hi mate .. crazy, you are right! :o The config is working very well, pulling routes also .. The misconfiguration is in the push route section .. Ive not seen that the 192.168.1.0/24 is my own network, so pulling the server routes breaks down my network connetion to the router .. such a stupid mistake (seenoevil) Additionally I changed the networks to 192.168.2.0/24 and 192.168.3.0/24 for a better overview: [oconf=custom client config 2] ifconfig-push 10.0.0.2 255.255.255.0 #push "route 192.168.2.0 255.255.255.0 10.0.0.2" push "route 192.168.3.0 255.255.255.0 10.0.0.3" [/oconf] [oconf=custom client config 3] ifconfig-push 10.0.0.3 255.255.255.0 push "route 192.168.2.0 255.255.255.0 10.0.0.2" #push "route 192.168.3.0 255.255.255.0 10.0.0.3" [/oconf] ifconfig-push requires to omit the ifconfig option in the client contiguration. Instead of propagating all possible routes to all clients I'am using now the custom client config, propagating the needed routes exept the own local network. Now its working fine .. (thumbsup) Thanks a lot!

OpenVPN is crashing using "pull" or "client" in client-config

vpn_geek

Hello all,

I'am running an openvpn-server on debian buster

>openvpn --version
OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019
library versions: OpenSSL 1.1.1d  10 Sep 2019, LZO 2.10

# Server configuration
mode server
tls-server
# Transport network options
port 1188
proto udp
dev tap8
# Certificate and key files
ca ca.crt
cert cert.crt
key private.key
dh dh2048.pem
# Certificate revocation list (for disabled certificates)
#crl-verify /etc/openvpn/crl/crl.pem
# Client-specific rules and access policies.
client-config-dir ccd
#OpenVpn server's IP address and IP pool
ifconfig 10.0.0.1 255.255.255.0
#ifconfig-pool 10.0.0.X 10.0.0.Y
# Allow clients to communicate (see) each other via the VPN connection
client-to-client
#max-clients 10
# If you have not generated individual certificate/key pairs for each client, each having its own unique "common name", uncomment this line out
#duplicate-cn
# Add static routes to reach particular networks via the VPN client's IP address
#route network [netmask] [gateway] [metric]
#route 192.168.178.0 255.255.255.0 10.0.0.178
# Special server's network options
# Push routes to the client to allow it to reach other private subnets behind the server
# Advertise the subnets to VPN clients as being accessible through the VPN.
push "route 192.168.0.0 255.255.255.0 10.0.0.1"
push "route 192.168.1.0 255.255.255.0 10.0.0.1"
# Security tweaks on Unix systems to drop root priviliges
user openvpn
group openvpn
# Enable compression on the VPN link. Must be enables relevantly on every client
comp-lzo
# Select a cryptographic cipher.
#cipher BF-CBC # Blowfish (default)
cipher AES-256-CBC # AES
# The persist options will try to avoid accessing certain resources on restart that may no longer be accessible because of the privilege downgrade.
persist-key
persist-tun
# Ping every 10 seconds, assume that remote peer is down if no ping received during a 120 second time period.
keepalive 10 120
ping-timer-rem
# Set the appropriate level of log file verbosity
verb 3
# Log file (default is to the syslog):
log-append /var/log/vpn.log
# Silence repeating messages in the log.
mute 10
# Output a short status file showing current connections, truncated and rewritten every minute.
status /var/log/vpn.status

and an openvpn-client on a tp-link router tl-wr1043nd ver4.0 with openwrt 19.07.1 (extroot)

>openvpn --version
OpenVPN 2.4.7 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
library versions: OpenSSL 1.1.1d  10 Sep 2019, LZO 2.10

#client
#pull
tls-client
remote-cert-tls server
#tls-version-min 1.0
auth-nocache
proto udp
dev tap88
remote my.server.com 1188
nobind
ifconfig 10.0.0.2 255.255.255.0
comp-lzo
cipher AES-256-CBC # AES
persist-key
persist-tun
keepalive 10 120
ping-timer-rem
verb 3
log /var/log/client.log
mute 10
# Certificate and key files
ca ca.crt
cert cert.crt
key private.key

The main issue is that uncommenting the pull option and restarting openvpn, the whole system on the router is crashing and not responding anymore. By activating the client option only the behavior is the same (client is an alias for tls-client and pull).

This is the log according to the upper configuartion:

Fri Apr  3 14:42:23 2020 disabling NCP mode (--ncp-disable) because not in P2MP client or server mode
Fri Apr  3 14:42:23 2020 OpenVPN 2.4.7 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Fri Apr  3 14:42:23 2020 library versions: OpenSSL 1.1.1d  10 Sep 2019, LZO 2.10
Fri Apr  3 14:42:23 2020 TUN/TAP device tap88 opened
Fri Apr  3 14:42:23 2020 TUN/TAP TX queue length set to 100
Fri Apr  3 14:42:23 2020 /sbin/ifconfig tap88 10.0.0.2 netmask 255.255.255.0 mtu 1500 broadcast 10.0.0.255
Fri Apr  3 14:42:24 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]my.server.com:1188
Fri Apr  3 14:42:24 2020 Socket Buffers: R=[163840->163840] S=[163840->163840]
Fri Apr  3 14:42:24 2020 UDP link local: (not bound)
Fri Apr  3 14:42:24 2020 UDP link remote: [AF_INET]my.server.com:1188
Fri Apr  3 14:42:24 2020 TLS: Initial packet from [AF_INET]my.server.com:1188, sid=e465d595 a2eb69b2
Fri Apr  3 14:42:24 2020 VERIFY OK: depth=4, C=DE, ST=.., O=PKI, OU=Root Certificate Authority CA, CN=Root CA
Fri Apr  3 14:42:24 2020 VERIFY OK: depth=3, C=DE, ST=.., O=PKI, OU=1st Level Certificate Authority CA, CN=Intermediate CA
Fri Apr  3 14:42:24 2020 VERIFY OK: depth=2, C=DE, ST=.., L=.., O=PKI, OU=2nd Level Certificate Authority CA, CN=..
Fri Apr  3 14:42:24 2020 VERIFY OK: depth=1, C=DE, ST=.., L=.., O=PKI, OU=3rd Level Certificate Authority CA, CN=..
Fri Apr  3 14:42:24 2020 VERIFY KU OK
Fri Apr  3 14:42:24 2020 Validating certificate extended key usage
Fri Apr  3 14:42:24 2020 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Fri Apr  3 14:42:24 2020 VERIFY EKU OK
Fri Apr  3 14:42:24 2020 VERIFY OK: depth=0, C=DE, ST=.., L=Berlin, O=PKI, OU=.. Certificate, CN=server..
Fri Apr  3 14:42:24 2020 WARNING: 'ifconfig' is present in local config but missing in remote config, local='ifconfig 10.0.0.0 255.255.255.0'
Fri Apr  3 14:42:24 2020 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Apr  3 14:42:24 2020 Outgoing Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Apr  3 14:42:24 2020 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Apr  3 14:42:24 2020 Incoming Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Apr  3 14:42:24 2020 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
Fri Apr  3 14:42:24 2020 [server] Peer Connection Initiated with [AF_INET]my.server.com:1188
Fri Apr  3 14:42:25 2020 Initialization Sequence Completed

My questions are:
Why I cannot use the "pull" option?
Is there somthing wrong in the server or client configuration, that cause this?
Is there an altenative method to pull the routes?

Many thanks for your time and answers in advance ..
..hope i formated the blocks correctly

TinCanTech

Are you sure it is crashing and it is not you bricking it by pulling routes which break your login ..

Post the full log with errors, please.

Glemar199219

Can you teach me how to used openvpn for PC

vpn_geek

Are you sure it is crashing and it is not you bricking it by pulling routes which break your login

Hi mate .. crazy, you are right! :o The config is working very well, pulling routes also .. The misconfiguration is in the push route section .. Ive not seen that the 192.168.1.0/24 is my own network, so pulling the server routes breaks down my network connetion to the router .. such a stupid mistake (seenoevil)

Additionally I changed the networks to 192.168.2.0/24 and 192.168.3.0/24 for a better overview:

ifconfig-push 10.0.0.2 255.255.255.0
#push "route 192.168.2.0 255.255.255.0 10.0.0.2"
push "route 192.168.3.0 255.255.255.0 10.0.0.3"

ifconfig-push 10.0.0.3 255.255.255.0
push "route 192.168.2.0 255.255.255.0 10.0.0.2"
#push "route 192.168.3.0 255.255.255.0 10.0.0.3"

ifconfig-push requires to omit the ifconfig option in the client contiguration.

Instead of propagating all possible routes to all clients I'am using now the custom client config, propagating the needed routes exept the own local network. Now its working fine .. (thumbsup)

Thanks a lot!