SSH connection stalls/hangs after establishing a VPN connection.

shaunluttin

Since the server/client logs are very large, I have broken the post into several messages. Further, I have replaced the log file dates/times with the > character.

* Server *

Server Operating System:

Linux SANITIZED_02-vpn 4.15.0-66-generic #75-Ubuntu SMP Tue Oct 1 05:24:09 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

Server Network Setup:

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet x.x.x.x  netmask 255.255.240.0  broadcast x.x.x.x
        inet6 fe80::a4ad:1ff:fe09:9ab1  prefixlen 64  scopeid 0x20<link>
        ether a6:ad:01:09:9a:b1  txqueuelen 1000  (Ethernet)
        RX packets 494109  bytes 167773428 (167.7 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 435850  bytes 60576591 (60.5 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 320  bytes 32266 (32.2 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 320  bytes 32266 (32.2 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1400
        inet 10.8.0.1  netmask 255.255.255.255  destination 10.8.0.2
        inet6 fe80::e740:c8b8:f277:7b9a  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 3597  bytes 276862 (276.8 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 4073  bytes 2389443 (2.3 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Server Config File:

fragment 1200
mssfix 1200
port 1194
proto udp
dev tun
ca ca.crt
cert SANITIZED_02_vpn_server.crt
key SANITIZED_02_vpn_server.key # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
client-config-dir ccd
client-to-client
keepalive 10 120
tls-auth ta.key 0
cipher AES-256-CBC
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log /var/log/openvpn/openvpn-server.log
verb 4
explicit-exit-notify 1

shaunluttin

Server Log File:

> WARNING: file 'SANITIZED_02_vpn_server.key' is group or others accessible
> WARNING: file 'ta.key' is group or others accessible
> Current Parameter Settings:
>   config = '/etc/openvpn/server.conf'
>   mode = 1
>   persist_config = DISABLED
>   persist_mode = 1
>   show_ciphers = DISABLED
>   show_digests = DISABLED
>   show_engines = DISABLED
>   genkey = DISABLED
>   key_pass_file = '[UNDEF]'
>   show_tls_ciphers = DISABLED
>   connect_retry_max = 0
> Connection profiles [0]:
>   proto = udp
>   local = '[UNDEF]'
>   local_port = '1194'
>   remote = '[UNDEF]'
>   remote_port = '1194'
>   remote_float = DISABLED
>   bind_defined = DISABLED
>   bind_local = ENABLED
>   bind_ipv6_only = DISABLED
>   connect_retry_seconds = 5
>   connect_timeout = 120
>   socks_proxy_server = '[UNDEF]'
>   socks_proxy_port = '[UNDEF]'
>   tun_mtu = 1500
>   tun_mtu_defined = ENABLED
>   link_mtu = 1500
>   link_mtu_defined = DISABLED
>   tun_mtu_extra = 0
>   tun_mtu_extra_defined = DISABLED
>   mtu_discover_type = -1
>   fragment = 1200
>   mssfix = 1200
>   explicit_exit_notification = 1
> Connection profiles END
>   remote_random = DISABLED
>   ipchange = '[UNDEF]'
>   dev = 'tun'
>   dev_type = '[UNDEF]'
>   dev_node = '[UNDEF]'
>   lladdr = '[UNDEF]'
>   topology = 1
>   ifconfig_local = '10.8.0.1'
>   ifconfig_remote_netmask = '10.8.0.2'
>   ifconfig_noexec = DISABLED
>   ifconfig_nowarn = DISABLED
>   ifconfig_ipv6_local = '[UNDEF]'
>   ifconfig_ipv6_netbits = 0
>   ifconfig_ipv6_remote = '[UNDEF]'
>   shaper = 0
>   mtu_test = 0
>   mlock = DISABLED
>   keepalive_ping = 10
>   keepalive_timeout = 120
>   inactivity_timeout = 0
>   ping_send_timeout = 10
>   ping_rec_timeout = 240
>   ping_rec_timeout_action = 2
>   ping_timer_remote = DISABLED
>   remap_sigusr1 = 0
>   persist_tun = ENABLED
>   persist_local_ip = DISABLED
>   persist_remote_ip = DISABLED
>   persist_key = ENABLED
>   passtos = DISABLED
>   resolve_retry_seconds = 1000000000
>   resolve_in_advance = DISABLED
>   username = '[UNDEF]'
>   groupname = '[UNDEF]'
>   chroot_dir = '[UNDEF]'
>   cd_dir = '/etc/openvpn'
>   writepid = '/run/openvpn/server.pid'
>   up_script = '[UNDEF]'
>   down_script = '[UNDEF]'
>   down_pre = DISABLED
>   up_restart = DISABLED
>   up_delay = DISABLED
>   daemon = ENABLED
>   inetd = 0
>   log = ENABLED
>   suppress_timestamps = DISABLED
>   machine_readable_output = DISABLED
>   nice = 0
>   verbosity = 4
>   mute = 0
>   gremlin = 0
>   status_file = '/var/log/openvpn/openvpn-status.log'
>   status_file_version = 1
>   status_file_update_freq = 10
>   occ = ENABLED
>   rcvbuf = 0
>   sndbuf = 0
>   mark = 0
>   sockflags = 0
>   fast_io = DISABLED
>   comp.alg = 0
>   comp.flags = 0
>   route_script = '[UNDEF]'
>   route_default_gateway = '[UNDEF]'
>   route_default_metric = 0
>   route_noexec = DISABLED
>   route_delay = 0
>   route_delay_window = 30
>   route_delay_defined = DISABLED
>   route_nopull = DISABLED
>   route_gateway_via_dhcp = DISABLED
>   allow_pull_fqdn = DISABLED
>   route 10.8.0.0/255.255.255.0/default (not set)/default (not set)
>   management_addr = '[UNDEF]'
>   management_port = '[UNDEF]'
>   management_user_pass = '[UNDEF]'
>   management_log_history_cache = 250
>   management_echo_buffer_size = 100
>   management_write_peer_info_file = '[UNDEF]'
>   management_client_user = '[UNDEF]'
>   management_client_group = '[UNDEF]'
>   management_flags = 0
>   shared_secret_file = '[UNDEF]'
>   key_direction = 1
>   ciphername = 'AES-256-CBC'
>   ncp_enabled = ENABLED
>   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
>   authname = 'SHA1'
>   prng_hash = 'SHA1'
>   prng_nonce_secret_len = 16
>   keysize = 0
>   engine = DISABLED
>   replay = ENABLED
>   mute_replay_warnings = DISABLED
>   replay_window = 64
>   replay_time = 15
>   packet_id_file = '[UNDEF]'
>   use_iv = ENABLED
>   test_crypto = DISABLED
>   tls_server = ENABLED
>   tls_client = DISABLED
>   key_method = 2
>   ca_file = 'ca.crt'
>   ca_path = '[UNDEF]'
>   dh_file = 'dh2048.pem'
>   cert_file = 'SANITIZED_02_vpn_server.crt'
>   extra_certs_file = '[UNDEF]'
>   priv_key_file = 'SANITIZED_02_vpn_server.key'
>   pkcs12_file = '[UNDEF]'
>   cipher_list = '[UNDEF]'
>   tls_verify = '[UNDEF]'
>   tls_export_cert = '[UNDEF]'
>   verify_x509_type = 0
>   verify_x509_name = '[UNDEF]'
>   crl_file = '[UNDEF]'
>   ns_cert_type = 0
>   remote_cert_ku[i] = 0 # repeated 15x

>   remote_cert_eku = '[UNDEF]'
>   ssl_flags = 0
>   tls_timeout = 2
>   renegotiate_bytes = -1
>   renegotiate_packets = 0
>   renegotiate_seconds = 3600
>   handshake_window = 60
>   transition_window = 3600
>   single_session = DISABLED
>   push_peer_info = DISABLED
>   tls_exit = DISABLED
>   tls_auth_file = 'ta.key'
>   tls_crypt_file = '[UNDEF]'
>   pkcs11_protected_authentication = DISABLED # repeated 15x
>   pkcs11_private_mode = 00000000 # repeated 15x
>   pkcs11_cert_private = DISABLED # repeated 15x
>   pkcs11_pin_cache_period = -1
>   pkcs11_id = '[UNDEF]'
>   pkcs11_id_management = DISABLED
>   server_network = 10.8.0.0
>   server_netmask = 255.255.255.0
>   server_network_ipv6 = ::
>   server_netbits_ipv6 = 0
>   server_bridge_ip = 0.0.0.0
>   server_bridge_netmask = 0.0.0.0
>   server_bridge_pool_start = 0.0.0.0
>   server_bridge_pool_end = 0.0.0.0
>   push_entry = 'route 10.8.0.0 255.255.255.0'
>   push_entry = 'topology net30'
>   push_entry = 'ping 10'
>   push_entry = 'ping-restart 120'
>   ifconfig_pool_defined = ENABLED
>   ifconfig_pool_start = 10.8.0.4
>   ifconfig_pool_end = 10.8.0.251
>   ifconfig_pool_netmask = 0.0.0.0
>   ifconfig_pool_persist_filename = '/var/log/openvpn/ipp.txt'
>   ifconfig_pool_persist_refresh_freq = 600
>   ifconfig_ipv6_pool_defined = DISABLED
>   ifconfig_ipv6_pool_base = ::
>   ifconfig_ipv6_pool_netbits = 0
>   n_bcast_buf = 256
>   tcp_queue_limit = 64
>   real_hash_size = 256
>   virtual_hash_size = 256
>   client_connect_script = '[UNDEF]'
>   learn_address_script = '[UNDEF]'
>   client_disconnect_script = '[UNDEF]'
>   client_config_dir = 'ccd'
>   ccd_exclusive = DISABLED
>   tmp_dir = '/tmp'
>   push_ifconfig_defined = DISABLED
>   push_ifconfig_local = 0.0.0.0
>   push_ifconfig_remote_netmask = 0.0.0.0
>   push_ifconfig_ipv6_defined = DISABLED
>   push_ifconfig_ipv6_local = ::/0
>   push_ifconfig_ipv6_remote = ::
>   enable_c2c = ENABLED
>   duplicate_cn = DISABLED
>   cf_max = 0
>   cf_per = 0
>   max_clients = 1024
>   max_routes_per_client = 256
>   auth_user_pass_verify_script = '[UNDEF]'
>   auth_user_pass_verify_script_via_file = DISABLED
>   auth_token_generate = DISABLED
>   auth_token_lifetime = 0
>   port_share_host = '[UNDEF]'
>   port_share_port = '[UNDEF]'
>   client = DISABLED
>   pull = DISABLED
>   auth_user_pass_file = '[UNDEF]'
> OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2019
> library versions: OpenSSL 1.1.1  11 Sep 2018, LZO 2.08
> Diffie-Hellman initialized with 2048 bit key
> Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
> Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
> TLS-Auth MTU parms [ L:1621 D:1184 EF:66 EB:0 ET:0 EL:3 ]
> ROUTE_GATEWAY x.x.x.x/255.255.240.0 IFACE=eth0 HWADDR=a6:ad:01:09:9a:b1
> TUN/TAP device tun0 opened
> TUN/TAP TX queue length set to 100
> do_ifconfig, tt->did_ifconfig_ipv6_setup=0
> /sbin/ip link set dev tun0 up mtu 1500
> /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
> /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
> Data Channel MTU parms [ L:1621 D:1200 EF:121 EB:406 ET:0 EL:3 ]
> Could not determine IPv4/IPv6 protocol. Using AF_INET
> Socket Buffers: R=[212992->212992] S=[212992->212992]
> UDPv4 link local (bound): [AF_INET][undef]:1194
> UDPv4 link remote: [AF_UNSPEC]
> MULTI: multi_init called, r=256 v=256
> IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
> IFCONFIG POOL LIST
> Initialization Sequence Completed
> MULTI: multi_create_instance called
> x.x.x.x:57323 Re-using SSL/TLS context
> x.x.x.x:57323 Control Channel MTU parms [ L:1625 D:1184 EF:66 EB:0 ET:0 EL:3 ]
> x.x.x.x:57323 Data Channel MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:57323 Fragmentation MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:57323 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
> x.x.x.x:57323 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
> x.x.x.x:57323 TLS: Initial packet from [AF_INET]x.x.x.x:57323, sid=5b3c2bb7 b6564974
> MULTI: multi_create_instance called
> x.x.x.x:45509 Re-using SSL/TLS context
> x.x.x.x:45509 Control Channel MTU parms [ L:1625 D:1184 EF:66 EB:0 ET:0 EL:3 ]
> x.x.x.x:45509 Data Channel MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:45509 Fragmentation MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:45509 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
> x.x.x.x:45509 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
> x.x.x.x:45509 TLS: Initial packet from [AF_INET]x.x.x.x:45509, sid=364d5751 3de78077
> MULTI: multi_create_instance called
> x.x.x.x:46053 Re-using SSL/TLS context
> x.x.x.x:46053 Control Channel MTU parms [ L:1625 D:1184 EF:66 EB:0 ET:0 EL:3 ]
> x.x.x.x:46053 Data Channel MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:46053 Fragmentation MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:46053 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
> x.x.x.x:46053 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
> x.x.x.x:46053 TLS: Initial packet from [AF_INET]x.x.x.x:46053, sid=5a4001ed 131a2500
> MULTI: multi_create_instance called
> x.x.x.x:53708 Re-using SSL/TLS context
> x.x.x.x:53708 Control Channel MTU parms [ L:1625 D:1184 EF:66 EB:0 ET:0 EL:3 ]
> x.x.x.x:53708 Data Channel MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:53708 Fragmentation MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:53708 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
> x.x.x.x:53708 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
> x.x.x.x:53708 TLS: Initial packet from [AF_INET]x.x.x.x:53708, sid=7e2505c0 9781086d
> MULTI: multi_create_instance called
> x.x.x.x:50648 Re-using SSL/TLS context
> x.x.x.x:50648 Control Channel MTU parms [ L:1625 D:1184 EF:66 EB:0 ET:0 EL:3 ]
> x.x.x.x:50648 Data Channel MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:50648 Fragmentation MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:50648 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
> x.x.x.x:50648 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
> x.x.x.x:50648 TLS: Initial packet from [AF_INET]x.x.x.x:50648, sid=39c5b3b8 90570e8d
> MULTI: multi_create_instance called
> x.x.x.x:56069 Re-using SSL/TLS context
> x.x.x.x:56069 Control Channel MTU parms [ L:1625 D:1184 EF:66 EB:0 ET:0 EL:3 ]
> x.x.x.x:56069 Data Channel MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:56069 Fragmentation MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:56069 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
> x.x.x.x:56069 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
> x.x.x.x:56069 TLS: Initial packet from [AF_INET]x.x.x.x:56069, sid=15c36f7b fdf5b77a
> MULTI: multi_create_instance called
> x.x.x.x:41353 Re-using SSL/TLS context
> x.x.x.x:41353 Control Channel MTU parms [ L:1625 D:1184 EF:66 EB:0 ET:0 EL:3 ]
> x.x.x.x:41353 Data Channel MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:41353 Fragmentation MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:41353 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
> x.x.x.x:41353 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
> x.x.x.x:41353 TLS: Initial packet from [AF_INET]x.x.x.x:41353, sid=d22495d8 d592c560
> x.x.x.x:57323 VERIFY OK: depth=1, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_01 CA, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:57323 VERIFY OK: depth=0, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_02_vpn_client_08, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:57323 peer info: IV_VER=2.4.4
> x.x.x.x:57323 peer info: IV_PLAT=linux
> x.x.x.x:57323 peer info: IV_PROTO=2
> x.x.x.x:57323 peer info: IV_NCP=2
> x.x.x.x:57323 peer info: IV_LZ4=1
> x.x.x.x:57323 peer info: IV_LZ4v2=1
> x.x.x.x:57323 peer info: IV_LZO=1
> x.x.x.x:57323 peer info: IV_COMP_STUB=1
> x.x.x.x:57323 peer info: IV_COMP_STUBv2=1
> x.x.x.x:57323 peer info: IV_TCPNL=1
> x.x.x.x:45509 VERIFY OK: depth=1, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_01 CA, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:45509 VERIFY OK: depth=0, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_02_vpn_client_05, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:45509 peer info: IV_VER=2.4.4
> x.x.x.x:45509 peer info: IV_PLAT=linux
> x.x.x.x:45509 peer info: IV_PROTO=2
> x.x.x.x:45509 peer info: IV_NCP=2
> x.x.x.x:45509 peer info: IV_LZ4=1
> x.x.x.x:45509 peer info: IV_LZ4v2=1
> x.x.x.x:45509 peer info: IV_LZO=1
> x.x.x.x:45509 peer info: IV_COMP_STUB=1
> x.x.x.x:45509 peer info: IV_COMP_STUBv2=1
> x.x.x.x:45509 peer info: IV_TCPNL=1
> x.x.x.x:46053 VERIFY OK: depth=1, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_01 CA, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:46053 VERIFY OK: depth=0, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_02_vpn_client_02, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:46053 peer info: IV_VER=2.4.4
> x.x.x.x:46053 peer info: IV_PLAT=linux
> x.x.x.x:46053 peer info: IV_PROTO=2
> x.x.x.x:46053 peer info: IV_NCP=2
> x.x.x.x:46053 peer info: IV_LZ4=1
> x.x.x.x:46053 peer info: IV_LZ4v2=1
> x.x.x.x:46053 peer info: IV_LZO=1
> x.x.x.x:46053 peer info: IV_COMP_STUB=1
> x.x.x.x:46053 peer info: IV_COMP_STUBv2=1
> x.x.x.x:46053 peer info: IV_TCPNL=1
> x.x.x.x:53708 VERIFY OK: depth=1, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_01 CA, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:53708 VERIFY OK: depth=0, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_02_vpn_client_04, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:53708 peer info: IV_VER=2.4.4
> x.x.x.x:53708 peer info: IV_PLAT=linux
> x.x.x.x:53708 peer info: IV_PROTO=2
> x.x.x.x:53708 peer info: IV_NCP=2
> x.x.x.x:53708 peer info: IV_LZ4=1
> x.x.x.x:53708 peer info: IV_LZ4v2=1
> x.x.x.x:53708 peer info: IV_LZO=1
> x.x.x.x:53708 peer info: IV_COMP_STUB=1
> x.x.x.x:53708 peer info: IV_COMP_STUBv2=1
> x.x.x.x:53708 peer info: IV_TCPNL=1
> x.x.x.x:57323 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
> x.x.x.x:57323 [SANITIZED_02_vpn_client_08] Peer Connection Initiated with [AF_INET]x.x.x.x:57323
> SANITIZED_02_vpn_client_08/x.x.x.x:57323 OPTIONS IMPORT: reading client specific options from: ccd/SANITIZED_02_vpn_client_08
> SANITIZED_02_vpn_client_08/x.x.x.x:57323 MULTI: Learn: 10.8.0.33 -> SANITIZED_02_vpn_client_08/x.x.x.x:57323
> SANITIZED_02_vpn_client_08/x.x.x.x:57323 MULTI: primary virtual IP for SANITIZED_02_vpn_client_08/x.x.x.x:57323: 10.8.0.33
> x.x.x.x:50648 VERIFY OK: depth=1, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_01 CA, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:50648 VERIFY OK: depth=0, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_02_vpn_client_07, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:50648 peer info: IV_VER=2.4.4
> x.x.x.x:50648 peer info: IV_PLAT=linux
> x.x.x.x:50648 peer info: IV_PROTO=2
> x.x.x.x:50648 peer info: IV_NCP=2
> x.x.x.x:50648 peer info: IV_LZ4=1
> x.x.x.x:50648 peer info: IV_LZ4v2=1
> x.x.x.x:50648 peer info: IV_LZO=1
> x.x.x.x:50648 peer info: IV_COMP_STUB=1
> x.x.x.x:50648 peer info: IV_COMP_STUBv2=1
> x.x.x.x:50648 peer info: IV_TCPNL=1
> x.x.x.x:56069 VERIFY OK: depth=1, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_01 CA, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:56069 VERIFY OK: depth=0, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_02_vpn_client_03, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:56069 peer info: IV_VER=2.4.4
> x.x.x.x:56069 peer info: IV_PLAT=linux
> x.x.x.x:56069 peer info: IV_PROTO=2
> x.x.x.x:56069 peer info: IV_NCP=2
> x.x.x.x:56069 peer info: IV_LZ4=1
> x.x.x.x:56069 peer info: IV_LZ4v2=1
> x.x.x.x:56069 peer info: IV_LZO=1
> x.x.x.x:56069 peer info: IV_COMP_STUB=1
> x.x.x.x:56069 peer info: IV_COMP_STUBv2=1
> x.x.x.x:56069 peer info: IV_TCPNL=1
> x.x.x.x:45509 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
> x.x.x.x:45509 [SANITIZED_02_vpn_client_05] Peer Connection Initiated with [AF_INET]x.x.x.x:45509
> SANITIZED_02_vpn_client_05/x.x.x.x:45509 OPTIONS IMPORT: reading client specific options from: ccd/SANITIZED_02_vpn_client_05
> SANITIZED_02_vpn_client_05/x.x.x.x:45509 MULTI: Learn: 10.8.0.21 -> SANITIZED_02_vpn_client_05/x.x.x.x:45509
> SANITIZED_02_vpn_client_05/x.x.x.x:45509 MULTI: primary virtual IP for SANITIZED_02_vpn_client_05/x.x.x.x:45509: 10.8.0.21
> x.x.x.x:46053 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
> x.x.x.x:46053 [SANITIZED_02_vpn_client_02] Peer Connection Initiated with [AF_INET]x.x.x.x:46053
> SANITIZED_02_vpn_client_02/x.x.x.x:46053 OPTIONS IMPORT: reading client specific options from: ccd/SANITIZED_02_vpn_client_02
> SANITIZED_02_vpn_client_02/x.x.x.x:46053 MULTI: Learn: 10.8.0.9 -> SANITIZED_02_vpn_client_02/x.x.x.x:46053
> SANITIZED_02_vpn_client_02/x.x.x.x:46053 MULTI: primary virtual IP for SANITIZED_02_vpn_client_02/x.x.x.x:46053: 10.8.0.9
> x.x.x.x:53708 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
> x.x.x.x:53708 [SANITIZED_02_vpn_client_04] Peer Connection Initiated with [AF_INET]x.x.x.x:53708
> SANITIZED_02_vpn_client_04/x.x.x.x:53708 OPTIONS IMPORT: reading client specific options from: ccd/SANITIZED_02_vpn_client_04
> SANITIZED_02_vpn_client_04/x.x.x.x:53708 MULTI: Learn: 10.8.0.17 -> SANITIZED_02_vpn_client_04/x.x.x.x:53708
> SANITIZED_02_vpn_client_04/x.x.x.x:53708 MULTI: primary virtual IP for SANITIZED_02_vpn_client_04/x.x.x.x:53708: 10.8.0.17
> x.x.x.x:41353 VERIFY OK: depth=1, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_01 CA, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:41353 VERIFY OK: depth=0, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_02_vpn_client_06, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:41353 peer info: IV_VER=2.4.4
> x.x.x.x:41353 peer info: IV_PLAT=linux
> x.x.x.x:41353 peer info: IV_PROTO=2
> x.x.x.x:41353 peer info: IV_NCP=2
> x.x.x.x:41353 peer info: IV_LZ4=1
> x.x.x.x:41353 peer info: IV_LZ4v2=1
> x.x.x.x:41353 peer info: IV_LZO=1
> x.x.x.x:41353 peer info: IV_COMP_STUB=1
> x.x.x.x:41353 peer info: IV_COMP_STUBv2=1
> x.x.x.x:41353 peer info: IV_TCPNL=1
> x.x.x.x:50648 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
> x.x.x.x:50648 [SANITIZED_02_vpn_client_07] Peer Connection Initiated with [AF_INET]x.x.x.x:50648
> SANITIZED_02_vpn_client_07/x.x.x.x:50648 OPTIONS IMPORT: reading client specific options from: ccd/SANITIZED_02_vpn_client_07
> SANITIZED_02_vpn_client_07/x.x.x.x:50648 MULTI: Learn: 10.8.0.29 -> SANITIZED_02_vpn_client_07/x.x.x.x:50648
> SANITIZED_02_vpn_client_07/x.x.x.x:50648 MULTI: primary virtual IP for SANITIZED_02_vpn_client_07/x.x.x.x:50648: 10.8.0.29
> x.x.x.x:56069 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
> x.x.x.x:56069 [SANITIZED_02_vpn_client_03] Peer Connection Initiated with [AF_INET]x.x.x.x:56069
> SANITIZED_02_vpn_client_03/x.x.x.x:56069 OPTIONS IMPORT: reading client specific options from: ccd/SANITIZED_02_vpn_client_03
> SANITIZED_02_vpn_client_03/x.x.x.x:56069 MULTI: Learn: 10.8.0.13 -> SANITIZED_02_vpn_client_03/x.x.x.x:56069
> SANITIZED_02_vpn_client_03/x.x.x.x:56069 MULTI: primary virtual IP for SANITIZED_02_vpn_client_03/x.x.x.x:56069: 10.8.0.13
> x.x.x.x:41353 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
> x.x.x.x:41353 [SANITIZED_02_vpn_client_06] Peer Connection Initiated with [AF_INET]x.x.x.x:41353
> SANITIZED_02_vpn_client_06/x.x.x.x:41353 OPTIONS IMPORT: reading client specific options from: ccd/SANITIZED_02_vpn_client_06
> SANITIZED_02_vpn_client_06/x.x.x.x:41353 MULTI: Learn: 10.8.0.25 -> SANITIZED_02_vpn_client_06/x.x.x.x:41353
> SANITIZED_02_vpn_client_06/x.x.x.x:41353 MULTI: primary virtual IP for SANITIZED_02_vpn_client_06/x.x.x.x:41353: 10.8.0.25
> MULTI: multi_create_instance called
> x.x.x.x:53983 Re-using SSL/TLS context
> x.x.x.x:53983 Control Channel MTU parms [ L:1625 D:1184 EF:66 EB:0 ET:0 EL:3 ]
> x.x.x.x:53983 Data Channel MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:53983 Fragmentation MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:53983 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
> x.x.x.x:53983 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
> x.x.x.x:53983 TLS: Initial packet from [AF_INET]x.x.x.x:53983, sid=93fd1073 6c0891c1
> x.x.x.x:53983 VERIFY OK: depth=1, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_01 CA, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:53983 VERIFY OK: depth=0, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_02_vpn_client_01, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:53983 peer info: IV_VER=2.4.7
> x.x.x.x:53983 peer info: IV_PLAT=linux
> x.x.x.x:53983 peer info: IV_PROTO=2
> x.x.x.x:53983 peer info: IV_NCP=2
> x.x.x.x:53983 peer info: IV_LZ4=1
> x.x.x.x:53983 peer info: IV_LZ4v2=1
> x.x.x.x:53983 peer info: IV_LZO=1
> x.x.x.x:53983 peer info: IV_COMP_STUB=1
> x.x.x.x:53983 peer info: IV_COMP_STUBv2=1
> x.x.x.x:53983 peer info: IV_TCPNL=1
> x.x.x.x:53983 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1561', remote='link-mtu 1557'
> x.x.x.x:53983 WARNING: 'mtu-dynamic' is present in local config but missing in remote config, local='mtu-dynamic'
> x.x.x.x:53983 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
> x.x.x.x:53983 [SANITIZED_02_vpn_client_01] Peer Connection Initiated with [AF_INET]x.x.x.x:53983
> SANITIZED_02_vpn_client_01/x.x.x.x:53983 OPTIONS IMPORT: reading client specific options from: ccd/SANITIZED_02_vpn_client_01
> SANITIZED_02_vpn_client_01/x.x.x.x:53983 MULTI: Learn: 10.8.0.5 -> SANITIZED_02_vpn_client_01/x.x.x.x:53983
> SANITIZED_02_vpn_client_01/x.x.x.x:53983 MULTI: primary virtual IP for SANITIZED_02_vpn_client_01/x.x.x.x:53983: 10.8.0.5
> SANITIZED_02_vpn_client_07/x.x.x.x:50648 PUSH: Received control message: 'PUSH_REQUEST'
> SANITIZED_02_vpn_client_07/x.x.x.x:50648 SENT CONTROL [SANITIZED_02_vpn_client_07]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.29 10.8.0.30,peer-id 4,cipher AES-256-GCM' (status=1)
> SANITIZED_02_vpn_client_07/x.x.x.x:50648 Data Channel: using negotiated cipher 'AES-256-GCM'
> SANITIZED_02_vpn_client_07/x.x.x.x:50648 Data Channel MTU parms [ L:1553 D:1200 EF:53 EB:406 ET:0 EL:3 ]
> SANITIZED_02_vpn_client_07/x.x.x.x:50648 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_07/x.x.x.x:50648 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_06/x.x.x.x:41353 PUSH: Received control message: 'PUSH_REQUEST'
> SANITIZED_02_vpn_client_06/x.x.x.x:41353 SENT CONTROL [SANITIZED_02_vpn_client_06]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.25 10.8.0.26,peer-id 6,cipher AES-256-GCM' (status=1)
> SANITIZED_02_vpn_client_06/x.x.x.x:41353 Data Channel: using negotiated cipher 'AES-256-GCM'
> SANITIZED_02_vpn_client_06/x.x.x.x:41353 Data Channel MTU parms [ L:1553 D:1200 EF:53 EB:406 ET:0 EL:3 ]
> SANITIZED_02_vpn_client_06/x.x.x.x:41353 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_06/x.x.x.x:41353 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_02/x.x.x.x:46053 PUSH: Received control message: 'PUSH_REQUEST'
> SANITIZED_02_vpn_client_02/x.x.x.x:46053 SENT CONTROL [SANITIZED_02_vpn_client_02]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.9 10.8.0.10,peer-id 2,cipher AES-256-GCM' (status=1)
> SANITIZED_02_vpn_client_02/x.x.x.x:46053 Data Channel: using negotiated cipher 'AES-256-GCM'
> SANITIZED_02_vpn_client_02/x.x.x.x:46053 Data Channel MTU parms [ L:1553 D:1200 EF:53 EB:406 ET:0 EL:3 ]
> SANITIZED_02_vpn_client_02/x.x.x.x:46053 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_02/x.x.x.x:46053 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_05/x.x.x.x:45509 PUSH: Received control message: 'PUSH_REQUEST'
> SANITIZED_02_vpn_client_05/x.x.x.x:45509 SENT CONTROL [SANITIZED_02_vpn_client_05]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.21 10.8.0.22,peer-id 1,cipher AES-256-GCM' (status=1)
> SANITIZED_02_vpn_client_05/x.x.x.x:45509 Data Channel: using negotiated cipher 'AES-256-GCM'
> SANITIZED_02_vpn_client_05/x.x.x.x:45509 Data Channel MTU parms [ L:1553 D:1200 EF:53 EB:406 ET:0 EL:3 ]
> SANITIZED_02_vpn_client_05/x.x.x.x:45509 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_05/x.x.x.x:45509 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_08/x.x.x.x:57323 PUSH: Received control message: 'PUSH_REQUEST'
> SANITIZED_02_vpn_client_08/x.x.x.x:57323 SENT CONTROL [SANITIZED_02_vpn_client_08]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.33 10.8.0.34,peer-id 0,cipher AES-256-GCM' (status=1)
> SANITIZED_02_vpn_client_08/x.x.x.x:57323 Data Channel: using negotiated cipher 'AES-256-GCM'
> SANITIZED_02_vpn_client_08/x.x.x.x:57323 Data Channel MTU parms [ L:1553 D:1200 EF:53 EB:406 ET:0 EL:3 ]
> SANITIZED_02_vpn_client_08/x.x.x.x:57323 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_08/x.x.x.x:57323 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_04/x.x.x.x:53708 PUSH: Received control message: 'PUSH_REQUEST'
> SANITIZED_02_vpn_client_04/x.x.x.x:53708 SENT CONTROL [SANITIZED_02_vpn_client_04]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.17 10.8.0.18,peer-id 3,cipher AES-256-GCM' (status=1)
> SANITIZED_02_vpn_client_04/x.x.x.x:53708 Data Channel: using negotiated cipher 'AES-256-GCM'
> SANITIZED_02_vpn_client_04/x.x.x.x:53708 Data Channel MTU parms [ L:1553 D:1200 EF:53 EB:406 ET:0 EL:3 ]
> SANITIZED_02_vpn_client_04/x.x.x.x:53708 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_04/x.x.x.x:53708 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_03/x.x.x.x:56069 PUSH: Received control message: 'PUSH_REQUEST'
> SANITIZED_02_vpn_client_03/x.x.x.x:56069 SENT CONTROL [SANITIZED_02_vpn_client_03]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.13 10.8.0.14,peer-id 5,cipher AES-256-GCM' (status=1)
> SANITIZED_02_vpn_client_03/x.x.x.x:56069 Data Channel: using negotiated cipher 'AES-256-GCM'
> SANITIZED_02_vpn_client_03/x.x.x.x:56069 Data Channel MTU parms [ L:1553 D:1200 EF:53 EB:406 ET:0 EL:3 ]
> SANITIZED_02_vpn_client_03/x.x.x.x:56069 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_03/x.x.x.x:56069 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_01/x.x.x.x:53983 PUSH: Received control message: 'PUSH_REQUEST'
> SANITIZED_02_vpn_client_01/x.x.x.x:53983 SENT CONTROL [SANITIZED_02_vpn_client_01]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.5 10.8.0.6,peer-id 7,cipher AES-256-GCM' (status=1)
> SANITIZED_02_vpn_client_01/x.x.x.x:53983 Data Channel: using negotiated cipher 'AES-256-GCM'
> SANITIZED_02_vpn_client_01/x.x.x.x:53983 Data Channel MTU parms [ L:1553 D:1200 EF:53 EB:406 ET:0 EL:3 ]
> SANITIZED_02_vpn_client_01/x.x.x.x:53983 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_01/x.x.x.x:53983 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_01/x.x.x.x:53983 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> SANITIZED_02_vpn_client_01/x.x.x.x:53983 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> SANITIZED_02_vpn_client_01/x.x.x.x:53983 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> MULTI: multi_create_instance called
> x.x.x.x:51211 Re-using SSL/TLS context
> x.x.x.x:51211 Control Channel MTU parms [ L:1625 D:1184 EF:66 EB:0 ET:0 EL:3 ]
> x.x.x.x:51211 Data Channel MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:51211 Fragmentation MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:51211 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
> x.x.x.x:51211 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
> x.x.x.x:51211 TLS: Initial packet from [AF_INET]x.x.x.x:51211, sid=741e4ce2 2ea001ff
> x.x.x.x:51211 VERIFY OK: depth=1, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_01 CA, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:51211 VERIFY OK: depth=0, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_02_vpn_client_01, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:51211 peer info: IV_VER=2.4.4
> x.x.x.x:51211 peer info: IV_PLAT=linux
> x.x.x.x:51211 peer info: IV_PROTO=2
> x.x.x.x:51211 peer info: IV_NCP=2
> x.x.x.x:51211 peer info: IV_LZ4=1
> x.x.x.x:51211 peer info: IV_LZ4v2=1
> x.x.x.x:51211 peer info: IV_LZO=1
> x.x.x.x:51211 peer info: IV_COMP_STUB=1
> x.x.x.x:51211 peer info: IV_COMP_STUBv2=1
> x.x.x.x:51211 peer info: IV_TCPNL=1
> x.x.x.x:51211 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
> x.x.x.x:51211 [SANITIZED_02_vpn_client_01] Peer Connection Initiated with [AF_INET]x.x.x.x:51211
> MULTI: new connection by client 'SANITIZED_02_vpn_client_01' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
> OPTIONS IMPORT: reading client specific options from: ccd/SANITIZED_02_vpn_client_01
> MULTI: Learn: 10.8.0.5 -> SANITIZED_02_vpn_client_01/x.x.x.x:51211
> MULTI: primary virtual IP for SANITIZED_02_vpn_client_01/x.x.x.x:51211: 10.8.0.5
> SANITIZED_02_vpn_client_01/x.x.x.x:51211 PUSH: Received control message: 'PUSH_REQUEST'
> SANITIZED_02_vpn_client_01/x.x.x.x:51211 SENT CONTROL [SANITIZED_02_vpn_client_01]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.5 10.8.0.6,peer-id 8,cipher AES-256-GCM' (status=1)
> SANITIZED_02_vpn_client_01/x.x.x.x:51211 Data Channel: using negotiated cipher 'AES-256-GCM'
> SANITIZED_02_vpn_client_01/x.x.x.x:51211 Data Channel MTU parms [ L:1553 D:1200 EF:53 EB:406 ET:0 EL:3 ]
> SANITIZED_02_vpn_client_01/x.x.x.x:51211 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_01/x.x.x.x:51211 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> MULTI: multi_create_instance called
> x.x.x.x:46694 Re-using SSL/TLS context
> x.x.x.x:46694 Control Channel MTU parms [ L:1625 D:1184 EF:66 EB:0 ET:0 EL:3 ]
> x.x.x.x:46694 Data Channel MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:46694 Fragmentation MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:46694 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
> x.x.x.x:46694 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
> x.x.x.x:46694 TLS: Initial packet from [AF_INET]x.x.x.x:46694, sid=4ce4272a 740f52d4
> x.x.x.x:46694 VERIFY OK: depth=1, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_01 CA, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:46694 VERIFY OK: depth=0, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_02_vpn_client_01, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:46694 peer info: IV_VER=2.4.7
> x.x.x.x:46694 peer info: IV_PLAT=linux
> x.x.x.x:46694 peer info: IV_PROTO=2
> x.x.x.x:46694 peer info: IV_NCP=2
> x.x.x.x:46694 peer info: IV_LZ4=1
> x.x.x.x:46694 peer info: IV_LZ4v2=1
> x.x.x.x:46694 peer info: IV_LZO=1
> x.x.x.x:46694 peer info: IV_COMP_STUB=1
> x.x.x.x:46694 peer info: IV_COMP_STUBv2=1
> x.x.x.x:46694 peer info: IV_TCPNL=1
> x.x.x.x:46694 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1561', remote='link-mtu 1557'
> x.x.x.x:46694 WARNING: 'mtu-dynamic' is present in local config but missing in remote config, local='mtu-dynamic'
> x.x.x.x:46694 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
> x.x.x.x:46694 [SANITIZED_02_vpn_client_01] Peer Connection Initiated with [AF_INET]x.x.x.x:46694
> MULTI: new connection by client 'SANITIZED_02_vpn_client_01' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
> OPTIONS IMPORT: reading client specific options from: ccd/SANITIZED_02_vpn_client_01
> MULTI: Learn: 10.8.0.5 -> SANITIZED_02_vpn_client_01/x.x.x.x:46694
> MULTI: primary virtual IP for SANITIZED_02_vpn_client_01/x.x.x.x:46694: 10.8.0.5
> SANITIZED_02_vpn_client_01/x.x.x.x:46694 PUSH: Received control message: 'PUSH_REQUEST'
> SANITIZED_02_vpn_client_01/x.x.x.x:46694 SENT CONTROL [SANITIZED_02_vpn_client_01]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.5 10.8.0.6,peer-id 7,cipher AES-256-GCM' (status=1)
> SANITIZED_02_vpn_client_01/x.x.x.x:46694 Data Channel: using negotiated cipher 'AES-256-GCM'
> SANITIZED_02_vpn_client_01/x.x.x.x:46694 Data Channel MTU parms [ L:1553 D:1200 EF:53 EB:406 ET:0 EL:3 ]
> SANITIZED_02_vpn_client_01/x.x.x.x:46694 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_01/x.x.x.x:46694 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> MULTI: multi_create_instance called
> x.x.x.x:51177 Re-using SSL/TLS context
> x.x.x.x:51177 Control Channel MTU parms [ L:1625 D:1184 EF:66 EB:0 ET:0 EL:3 ]
> x.x.x.x:51177 Data Channel MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:51177 Fragmentation MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:51177 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
> x.x.x.x:51177 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
> x.x.x.x:51177 TLS: Initial packet from [AF_INET]x.x.x.x:51177, sid=8b90c0f5 9fe9c8c8
> x.x.x.x:51177 VERIFY OK: depth=1, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_01 CA, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:51177 VERIFY OK: depth=0, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_02_vpn_client_01, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:51177 peer info: IV_VER=2.4.4
> x.x.x.x:51177 peer info: IV_PLAT=linux
> x.x.x.x:51177 peer info: IV_PROTO=2
> x.x.x.x:51177 peer info: IV_NCP=2
> x.x.x.x:51177 peer info: IV_LZ4=1
> x.x.x.x:51177 peer info: IV_LZ4v2=1
> x.x.x.x:51177 peer info: IV_LZO=1
> x.x.x.x:51177 peer info: IV_COMP_STUB=1
> x.x.x.x:51177 peer info: IV_COMP_STUBv2=1
> x.x.x.x:51177 peer info: IV_TCPNL=1
> x.x.x.x:51177 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
> x.x.x.x:51177 [SANITIZED_02_vpn_client_01] Peer Connection Initiated with [AF_INET]x.x.x.x:51177
> MULTI: new connection by client 'SANITIZED_02_vpn_client_01' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
> OPTIONS IMPORT: reading client specific options from: ccd/SANITIZED_02_vpn_client_01
> MULTI: Learn: 10.8.0.5 -> SANITIZED_02_vpn_client_01/x.x.x.x:51177
> MULTI: primary virtual IP for SANITIZED_02_vpn_client_01/x.x.x.x:51177: 10.8.0.5
> SANITIZED_02_vpn_client_01/x.x.x.x:51177 PUSH: Received control message: 'PUSH_REQUEST'
> SANITIZED_02_vpn_client_01/x.x.x.x:51177 SENT CONTROL [SANITIZED_02_vpn_client_01]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.5 10.8.0.6,peer-id 8,cipher AES-256-GCM' (status=1)
> SANITIZED_02_vpn_client_01/x.x.x.x:51177 Data Channel: using negotiated cipher 'AES-256-GCM'
> SANITIZED_02_vpn_client_01/x.x.x.x:51177 Data Channel MTU parms [ L:1553 D:1200 EF:53 EB:406 ET:0 EL:3 ]
> SANITIZED_02_vpn_client_01/x.x.x.x:51177 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_01/x.x.x.x:51177 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> MULTI: multi_create_instance called
> x.x.x.x:52058 Re-using SSL/TLS context
> x.x.x.x:52058 Control Channel MTU parms [ L:1625 D:1184 EF:66 EB:0 ET:0 EL:3 ]
> x.x.x.x:52058 Data Channel MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:52058 Fragmentation MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:52058 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
> x.x.x.x:52058 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
> x.x.x.x:52058 TLS: Initial packet from [AF_INET]x.x.x.x:52058, sid=08e4300b c7e00f02
> x.x.x.x:52058 VERIFY OK: depth=1, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_01 CA, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:52058 VERIFY OK: depth=0, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_02_vpn_client_01, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:52058 peer info: IV_VER=2.4.7
> x.x.x.x:52058 peer info: IV_PLAT=linux
> x.x.x.x:52058 peer info: IV_PROTO=2
> x.x.x.x:52058 peer info: IV_NCP=2
> x.x.x.x:52058 peer info: IV_LZ4=1
> x.x.x.x:52058 peer info: IV_LZ4v2=1
> x.x.x.x:52058 peer info: IV_LZO=1
> x.x.x.x:52058 peer info: IV_COMP_STUB=1
> x.x.x.x:52058 peer info: IV_COMP_STUBv2=1
> x.x.x.x:52058 peer info: IV_TCPNL=1
> x.x.x.x:52058 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1561', remote='link-mtu 1557'
> x.x.x.x:52058 WARNING: 'mtu-dynamic' is present in local config but missing in remote config, local='mtu-dynamic'
> x.x.x.x:52058 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
> x.x.x.x:52058 [SANITIZED_02_vpn_client_01] Peer Connection Initiated with [AF_INET]x.x.x.x:52058
> MULTI: new connection by client 'SANITIZED_02_vpn_client_01' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
> OPTIONS IMPORT: reading client specific options from: ccd/SANITIZED_02_vpn_client_01
> MULTI: Learn: 10.8.0.5 -> SANITIZED_02_vpn_client_01/x.x.x.x:52058
> MULTI: primary virtual IP for SANITIZED_02_vpn_client_01/x.x.x.x:52058: 10.8.0.5
> SANITIZED_02_vpn_client_01/x.x.x.x:52058 PUSH: Received control message: 'PUSH_REQUEST'
> SANITIZED_02_vpn_client_01/x.x.x.x:52058 SENT CONTROL [SANITIZED_02_vpn_client_01]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.5 10.8.0.6,peer-id 7,cipher AES-256-GCM' (status=1)
> SANITIZED_02_vpn_client_01/x.x.x.x:52058 Data Channel: using negotiated cipher 'AES-256-GCM'
> SANITIZED_02_vpn_client_01/x.x.x.x:52058 Data Channel MTU parms [ L:1553 D:1200 EF:53 EB:406 ET:0 EL:3 ]
> SANITIZED_02_vpn_client_01/x.x.x.x:52058 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_01/x.x.x.x:52058 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_01/x.x.x.x:52058 FRAG_IN error flags=0x4500003c: spurrious FRAG_WHOLE flags
> SANITIZED_02_vpn_client_01/x.x.x.x:52058 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> SANITIZED_02_vpn_client_01/x.x.x.x:52058 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> SANITIZED_02_vpn_client_01/x.x.x.x:52058 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> SANITIZED_02_vpn_client_01/x.x.x.x:52058 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> SANITIZED_02_vpn_client_01/x.x.x.x:52058 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> SANITIZED_02_vpn_client_01/x.x.x.x:52058 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> SANITIZED_02_vpn_client_01/x.x.x.x:52058 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> SANITIZED_02_vpn_client_01/x.x.x.x:52058 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> SANITIZED_02_vpn_client_01/x.x.x.x:52058 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> SANITIZED_02_vpn_client_01/x.x.x.x:52058 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> SANITIZED_02_vpn_client_01/x.x.x.x:52058 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> MULTI: multi_create_instance called
> x.x.x.x:51246 Re-using SSL/TLS context
> x.x.x.x:51246 Control Channel MTU parms [ L:1625 D:1184 EF:66 EB:0 ET:0 EL:3 ]
> x.x.x.x:51246 Data Channel MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:51246 Fragmentation MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:51246 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
> x.x.x.x:51246 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
> x.x.x.x:51246 TLS: Initial packet from [AF_INET]x.x.x.x:51246, sid=53157347 aa7c69b2
> x.x.x.x:51246 VERIFY OK: depth=1, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_01 CA, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:51246 VERIFY OK: depth=0, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_02_vpn_client_01, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:51246 peer info: IV_VER=2.4.4
> x.x.x.x:51246 peer info: IV_PLAT=linux
> x.x.x.x:51246 peer info: IV_PROTO=2
> x.x.x.x:51246 peer info: IV_NCP=2
> x.x.x.x:51246 peer info: IV_LZ4=1
> x.x.x.x:51246 peer info: IV_LZ4v2=1
> x.x.x.x:51246 peer info: IV_LZO=1
> x.x.x.x:51246 peer info: IV_COMP_STUB=1
> x.x.x.x:51246 peer info: IV_COMP_STUBv2=1
> x.x.x.x:51246 peer info: IV_TCPNL=1
> SANITIZED_02_vpn_client_01/x.x.x.x:52058 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> x.x.x.x:51246 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
> x.x.x.x:51246 [SANITIZED_02_vpn_client_01] Peer Connection Initiated with [AF_INET]x.x.x.x:51246
> MULTI: new connection by client 'SANITIZED_02_vpn_client_01' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
> OPTIONS IMPORT: reading client specific options from: ccd/SANITIZED_02_vpn_client_01
> MULTI: Learn: 10.8.0.5 -> SANITIZED_02_vpn_client_01/x.x.x.x:51246
> MULTI: primary virtual IP for SANITIZED_02_vpn_client_01/x.x.x.x:51246: 10.8.0.5
> SANITIZED_02_vpn_client_01/x.x.x.x:51246 PUSH: Received control message: 'PUSH_REQUEST'
> SANITIZED_02_vpn_client_01/x.x.x.x:51246 SENT CONTROL [SANITIZED_02_vpn_client_01]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.5 10.8.0.6,peer-id 8,cipher AES-256-GCM' (status=1)
> SANITIZED_02_vpn_client_01/x.x.x.x:51246 Data Channel: using negotiated cipher 'AES-256-GCM'
> SANITIZED_02_vpn_client_01/x.x.x.x:51246 Data Channel MTU parms [ L:1553 D:1200 EF:53 EB:406 ET:0 EL:3 ]
> SANITIZED_02_vpn_client_01/x.x.x.x:51246 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_01/x.x.x.x:51246 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> MULTI: multi_create_instance called
> x.x.x.x:36410 Re-using SSL/TLS context
> x.x.x.x:36410 Control Channel MTU parms [ L:1625 D:1184 EF:66 EB:0 ET:0 EL:3 ]
> x.x.x.x:36410 Data Channel MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:36410 Fragmentation MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:36410 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
> x.x.x.x:36410 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
> x.x.x.x:36410 TLS: Initial packet from [AF_INET]x.x.x.x:36410, sid=11275bb8 b18a6251
> x.x.x.x:36410 VERIFY OK: depth=1, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_01 CA, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:36410 VERIFY OK: depth=0, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_02_vpn_client_01, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:36410 peer info: IV_VER=2.4.7
> x.x.x.x:36410 peer info: IV_PLAT=linux
> x.x.x.x:36410 peer info: IV_PROTO=2
> x.x.x.x:36410 peer info: IV_NCP=2
> x.x.x.x:36410 peer info: IV_LZ4=1
> x.x.x.x:36410 peer info: IV_LZ4v2=1
> x.x.x.x:36410 peer info: IV_LZO=1
> x.x.x.x:36410 peer info: IV_COMP_STUB=1
> x.x.x.x:36410 peer info: IV_COMP_STUBv2=1
> x.x.x.x:36410 peer info: IV_TCPNL=1
> x.x.x.x:36410 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1561', remote='link-mtu 1557'
> x.x.x.x:36410 WARNING: 'mtu-dynamic' is present in local config but missing in remote config, local='mtu-dynamic'
> x.x.x.x:36410 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
> x.x.x.x:36410 [SANITIZED_02_vpn_client_01] Peer Connection Initiated with [AF_INET]x.x.x.x:36410
> MULTI: new connection by client 'SANITIZED_02_vpn_client_01' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
> OPTIONS IMPORT: reading client specific options from: ccd/SANITIZED_02_vpn_client_01
> MULTI: Learn: 10.8.0.5 -> SANITIZED_02_vpn_client_01/x.x.x.x:36410
> MULTI: primary virtual IP for SANITIZED_02_vpn_client_01/x.x.x.x:36410: 10.8.0.5
> SANITIZED_02_vpn_client_01/x.x.x.x:36410 PUSH: Received control message: 'PUSH_REQUEST'
> SANITIZED_02_vpn_client_01/x.x.x.x:36410 SENT CONTROL [SANITIZED_02_vpn_client_01]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.5 10.8.0.6,peer-id 7,cipher AES-256-GCM' (status=1)
> SANITIZED_02_vpn_client_01/x.x.x.x:36410 Data Channel: using negotiated cipher 'AES-256-GCM'
> SANITIZED_02_vpn_client_01/x.x.x.x:36410 Data Channel MTU parms [ L:1553 D:1200 EF:53 EB:406 ET:0 EL:3 ]
> SANITIZED_02_vpn_client_01/x.x.x.x:36410 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_01/x.x.x.x:36410 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_01/x.x.x.x:36410 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> SANITIZED_02_vpn_client_01/x.x.x.x:36410 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> SANITIZED_02_vpn_client_01/x.x.x.x:36410 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> SANITIZED_02_vpn_client_01/x.x.x.x:36410 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> SANITIZED_02_vpn_client_01/x.x.x.x:36410 FRAG_IN error flags=0x4500003c: spurrious FRAG_WHOLE flags
> SANITIZED_02_vpn_client_01/x.x.x.x:36410 FRAG_IN error flags=0x4500003c: spurrious FRAG_WHOLE flags
> SANITIZED_02_vpn_client_01/x.x.x.x:36410 FRAG_IN error flags=0x4500003c: spurrious FRAG_WHOLE flags
> SANITIZED_02_vpn_client_01/x.x.x.x:36410 FRAG_IN error flags=0x4500003c: spurrious FRAG_WHOLE flags
> SANITIZED_02_vpn_client_01/x.x.x.x:36410 FRAG_IN error flags=0x4500003c: spurrious FRAG_WHOLE flags
> SANITIZED_02_vpn_client_01/x.x.x.x:36410 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> SANITIZED_02_vpn_client_01/x.x.x.x:36410 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> SANITIZED_02_vpn_client_01/x.x.x.x:36410 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> SANITIZED_02_vpn_client_01/x.x.x.x:36410 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> SANITIZED_02_vpn_client_01/x.x.x.x:36410 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> SANITIZED_02_vpn_client_01/x.x.x.x:36410 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented
> MULTI: multi_create_instance called
> x.x.x.x:51167 Re-using SSL/TLS context
> x.x.x.x:51167 Control Channel MTU parms [ L:1625 D:1184 EF:66 EB:0 ET:0 EL:3 ]
> x.x.x.x:51167 Data Channel MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:51167 Fragmentation MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> x.x.x.x:51167 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
> x.x.x.x:51167 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
> x.x.x.x:51167 TLS: Initial packet from [AF_INET]x.x.x.x:51167, sid=09796137 d753e15f
> x.x.x.x:51167 VERIFY OK: depth=1, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_01 CA, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:51167 VERIFY OK: depth=0, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_02_vpn_client_01, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> x.x.x.x:51167 peer info: IV_VER=2.4.4
> x.x.x.x:51167 peer info: IV_PLAT=linux
> x.x.x.x:51167 peer info: IV_PROTO=2
> x.x.x.x:51167 peer info: IV_NCP=2
> x.x.x.x:51167 peer info: IV_LZ4=1
> x.x.x.x:51167 peer info: IV_LZ4v2=1
> x.x.x.x:51167 peer info: IV_LZO=1
> x.x.x.x:51167 peer info: IV_COMP_STUB=1
> x.x.x.x:51167 peer info: IV_COMP_STUBv2=1
> x.x.x.x:51167 peer info: IV_TCPNL=1
> x.x.x.x:51167 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
> x.x.x.x:51167 [SANITIZED_02_vpn_client_01] Peer Connection Initiated with [AF_INET]x.x.x.x:51167
> MULTI: new connection by client 'SANITIZED_02_vpn_client_01' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
> OPTIONS IMPORT: reading client specific options from: ccd/SANITIZED_02_vpn_client_01
> MULTI: Learn: 10.8.0.5 -> SANITIZED_02_vpn_client_01/x.x.x.x:51167
> MULTI: primary virtual IP for SANITIZED_02_vpn_client_01/x.x.x.x:51167: 10.8.0.5
> SANITIZED_02_vpn_client_01/x.x.x.x:51167 PUSH: Received control message: 'PUSH_REQUEST'
> SANITIZED_02_vpn_client_01/x.x.x.x:51167 SENT CONTROL [SANITIZED_02_vpn_client_01]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.5 10.8.0.6,peer-id 8,cipher AES-256-GCM' (status=1)
> SANITIZED_02_vpn_client_01/x.x.x.x:51167 Data Channel: using negotiated cipher 'AES-256-GCM'
> SANITIZED_02_vpn_client_01/x.x.x.x:51167 Data Channel MTU parms [ L:1553 D:1200 EF:53 EB:406 ET:0 EL:3 ]
> SANITIZED_02_vpn_client_01/x.x.x.x:51167 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> SANITIZED_02_vpn_client_01/x.x.x.x:51167 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key

shaunluttin

* Client *

Client Operating System:

Linux DESKTOP-5T629JB 4.19.84-microsoft-standard #1 SMP Wed Nov 13 11:44:37 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

Client Network Setup:

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet x.x.x.x  netmask 255.255.240.0  broadcast x.x.x.x
        inet6 fe80::215:5dff:fe6d:5d87  prefixlen 64  scopeid 0x20<link>
        ether 00:15:5d:6d:5d:87  txqueuelen 1000  (Ethernet)
        RX packets 677  bytes 134902 (134.9 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 837  bytes 146833 (146.8 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.8.0.5  netmask 255.255.255.255  destination 10.8.0.6
        inet6 fe80::fbba:6ad5:5a27:cd75  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 331  bytes 43814 (43.8 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 683  bytes 61570 (61.5 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Client Config File:

fragment 1200
mssfix 1200
client
dev tun
proto udp
remote vpn.SANITIZED_02.ca 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert SANITIZED_02_vpn_client_01.crt
key SANITIZED_02_vpn_client_01.key
remote-cert-tls server
tls-auth ta.key 1
cipher AES-256-CBC
status /var/log/openvpn/openvpn-status.log
log /var/log/openvpn/openvpn-client.log
verb 4

Client Log File:

> WARNING: file 'SANITIZED_02_vpn_client_01.key' is group or others accessible
> WARNING: file 'ta.key' is group or others accessible
> Current Parameter Settings:
>   config = 'client.conf'
>   mode = 0
>   persist_config = DISABLED
>   persist_mode = 1
>   show_ciphers = DISABLED
>   show_digests = DISABLED
>   show_engines = DISABLED
>   genkey = DISABLED
>   key_pass_file = '[UNDEF]'
>   show_tls_ciphers = DISABLED
>   connect_retry_max = 0
> Connection profiles [0]:
>   proto = udp
>   local = '[UNDEF]'
>   local_port = '[UNDEF]'
>   remote = 'vpn.SANITIZED_02.ca'
>   remote_port = '1194'
>   remote_float = DISABLED
>   bind_defined = DISABLED
>   bind_local = DISABLED
>   bind_ipv6_only = DISABLED
>   connect_retry_seconds = 5
>   connect_timeout = 120
>   socks_proxy_server = '[UNDEF]'
>   socks_proxy_port = '[UNDEF]'
>   tun_mtu = 1500
>   tun_mtu_defined = ENABLED
>   link_mtu = 1500
>   link_mtu_defined = DISABLED
>   tun_mtu_extra = 0
>   tun_mtu_extra_defined = DISABLED
>   mtu_discover_type = -1
>   fragment = 1200
>   mssfix = 1200
>   explicit_exit_notification = 0
> Connection profiles END
>   remote_random = DISABLED
>   ipchange = '[UNDEF]'
>   dev = 'tun'
>   dev_type = '[UNDEF]'
>   dev_node = '[UNDEF]'
>   lladdr = '[UNDEF]'
>   topology = 1
>   ifconfig_local = '[UNDEF]'
>   ifconfig_remote_netmask = '[UNDEF]'
>   ifconfig_noexec = DISABLED
>   ifconfig_nowarn = DISABLED
>   ifconfig_ipv6_local = '[UNDEF]'
>   ifconfig_ipv6_netbits = 0
>   ifconfig_ipv6_remote = '[UNDEF]'
>   shaper = 0
>   mtu_test = 0
>   mlock = DISABLED
>   keepalive_ping = 0
>   keepalive_timeout = 0
>   inactivity_timeout = 0
>   ping_send_timeout = 0
>   ping_rec_timeout = 0
>   ping_rec_timeout_action = 0
>   ping_timer_remote = DISABLED
>   remap_sigusr1 = 0
>   persist_tun = ENABLED
>   persist_local_ip = DISABLED
>   persist_remote_ip = DISABLED
>   persist_key = ENABLED
>   passtos = DISABLED
>   resolve_retry_seconds = 1000000000
>   resolve_in_advance = DISABLED
>   username = '[UNDEF]'
>   groupname = '[UNDEF]'
>   chroot_dir = '[UNDEF]'
>   cd_dir = '[UNDEF]'
>   writepid = '[UNDEF]'
>   up_script = '[UNDEF]'
>   down_script = '[UNDEF]'
>   down_pre = DISABLED
>   up_restart = DISABLED
>   up_delay = DISABLED
>   daemon = DISABLED
>   inetd = 0
>   log = ENABLED
>   suppress_timestamps = DISABLED
>   machine_readable_output = DISABLED
>   nice = 0
>   verbosity = 4
>   mute = 0
>   gremlin = 0
>   status_file = '[UNDEF]'
>   status_file_version = 1
>   status_file_update_freq = 60
>   occ = ENABLED
>   rcvbuf = 0
>   sndbuf = 0
>   mark = 0
>   sockflags = 0
>   fast_io = DISABLED
>   comp.alg = 0
>   comp.flags = 0
>   route_script = '[UNDEF]'
>   route_default_gateway = '[UNDEF]'
>   route_default_metric = 0
>   route_noexec = DISABLED
>   route_delay = 0
>   route_delay_window = 30
>   route_delay_defined = DISABLED
>   route_nopull = DISABLED
>   route_gateway_via_dhcp = DISABLED
>   allow_pull_fqdn = DISABLED
>   management_addr = '[UNDEF]'
>   management_port = '[UNDEF]'
>   management_user_pass = '[UNDEF]'
>   management_log_history_cache = 250
>   management_echo_buffer_size = 100
>   management_write_peer_info_file = '[UNDEF]'
>   management_client_user = '[UNDEF]'
>   management_client_group = '[UNDEF]'
>   management_flags = 0
>   shared_secret_file = '[UNDEF]'
>   key_direction = 2
>   ciphername = 'AES-256-CBC'
>   ncp_enabled = ENABLED
>   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
>   authname = 'SHA1'
>   prng_hash = 'SHA1'
>   prng_nonce_secret_len = 16
>   keysize = 0
>   engine = DISABLED
>   replay = ENABLED
>   mute_replay_warnings = DISABLED
>   replay_window = 64
>   replay_time = 15
>   packet_id_file = '[UNDEF]'
>   use_iv = ENABLED
>   test_crypto = DISABLED
>   tls_server = DISABLED
>   tls_client = ENABLED
>   key_method = 2
>   ca_file = 'ca.crt'
>   ca_path = '[UNDEF]'
>   dh_file = '[UNDEF]'
>   cert_file = 'SANITIZED_02_vpn_client_01.crt'
>   extra_certs_file = '[UNDEF]'
>   priv_key_file = 'SANITIZED_02_vpn_client_01.key'
>   pkcs12_file = '[UNDEF]'
>   cipher_list = '[UNDEF]'
>   tls_verify = '[UNDEF]'
>   tls_export_cert = '[UNDEF]'
>   verify_x509_type = 0
>   verify_x509_name = '[UNDEF]'
>   crl_file = '[UNDEF]'
>   ns_cert_type = 0
>   remote_cert_ku[i] = 65535
>   remote_cert_ku[i] = 0 # repeated 15x
>   remote_cert_eku = 'TLS Web Server Authentication'
>   ssl_flags = 0
>   tls_timeout = 2
>   renegotiate_bytes = -1
>   renegotiate_packets = 0
>   renegotiate_seconds = 3600
>   handshake_window = 60
>   transition_window = 3600
>   single_session = DISABLED
>   push_peer_info = DISABLED
>   tls_exit = DISABLED
>   tls_auth_file = 'ta.key'
>   tls_crypt_file = '[UNDEF]'
>   pkcs11_protected_authentication = DISABLED # repeated 15x
>   pkcs11_private_mode = 00000000 # repeated 15x
>   pkcs11_cert_private = DISABLED # repeated 15x
>   pkcs11_pin_cache_period = -1
>   pkcs11_id = '[UNDEF]'
>   pkcs11_id_management = DISABLED
>   server_network = 0.0.0.0
>   server_netmask = 0.0.0.0
>   server_network_ipv6 = ::
>   server_netbits_ipv6 = 0
>   server_bridge_ip = 0.0.0.0
>   server_bridge_netmask = 0.0.0.0
>   server_bridge_pool_start = 0.0.0.0
>   server_bridge_pool_end = 0.0.0.0
>   ifconfig_pool_defined = DISABLED
>   ifconfig_pool_start = 0.0.0.0
>   ifconfig_pool_end = 0.0.0.0
>   ifconfig_pool_netmask = 0.0.0.0
>   ifconfig_pool_persist_filename = '[UNDEF]'
>   ifconfig_pool_persist_refresh_freq = 600
>   ifconfig_ipv6_pool_defined = DISABLED
>   ifconfig_ipv6_pool_base = ::
>   ifconfig_ipv6_pool_netbits = 0
>   n_bcast_buf = 256
>   tcp_queue_limit = 64
>   real_hash_size = 256
>   virtual_hash_size = 256
>   client_connect_script = '[UNDEF]'
>   learn_address_script = '[UNDEF]'
>   client_disconnect_script = '[UNDEF]'
>   client_config_dir = '[UNDEF]'
>   ccd_exclusive = DISABLED
>   tmp_dir = '/tmp'
>   push_ifconfig_defined = DISABLED
>   push_ifconfig_local = 0.0.0.0
>   push_ifconfig_remote_netmask = 0.0.0.0
>   push_ifconfig_ipv6_defined = DISABLED
>   push_ifconfig_ipv6_local = ::/0
>   push_ifconfig_ipv6_remote = ::
>   enable_c2c = DISABLED
>   duplicate_cn = DISABLED
>   cf_max = 0
>   cf_per = 0
>   max_clients = 1024
>   max_routes_per_client = 256
>   auth_user_pass_verify_script = '[UNDEF]'
>   auth_user_pass_verify_script_via_file = DISABLED
>   auth_token_generate = DISABLED
>   auth_token_lifetime = 0
>   port_share_host = '[UNDEF]'
>   port_share_port = '[UNDEF]'
>   client = ENABLED
>   pull = ENABLED
>   auth_user_pass_file = '[UNDEF]'
> OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2019
> library versions: OpenSSL 1.1.1  11 Sep 2018, LZO 2.08
> Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
> Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
> Control Channel MTU parms [ L:1625 D:1184 EF:66 EB:0 ET:0 EL:3 ]
> Data Channel MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> Fragmentation MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
> Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
> TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:1194
> Socket Buffers: R=[212992->212992] S=[212992->212992]
> UDP link local: (not bound)
> UDP link remote: [AF_INET]x.x.x.x:1194
> TLS: Initial packet from [AF_INET]x.x.x.x:1194, sid=d3269756 669a124a
> VERIFY OK: depth=1, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_01 CA, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> VERIFY KU OK
> Validating certificate extended key usage
> ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
> VERIFY EKU OK
> VERIFY OK: depth=0, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_02_vpn_server, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
> [SANITIZED_02_vpn_server] Peer Connection Initiated with [AF_INET]x.x.x.x:1194
> SENT CONTROL [SANITIZED_02_vpn_server]: 'PUSH_REQUEST' (status=1)
> PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.5 10.8.0.6,peer-id 8,cipher AES-256-GCM'
> OPTIONS IMPORT: timers and/or timeouts modified
> OPTIONS IMPORT: --ifconfig/up options modified
> OPTIONS IMPORT: route options modified
> OPTIONS IMPORT: peer-id set
> OPTIONS IMPORT: adjusting link_mtu to 1628
> OPTIONS IMPORT: data channel crypto options modified
> Data Channel: using negotiated cipher 'AES-256-GCM'
> Data Channel MTU parms [ L:1556 D:1200 EF:56 EB:406 ET:0 EL:3 ]
> Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> ROUTE_GATEWAY x.x.x.x/255.255.240.0 IFACE=eth0 HWADDR=00:15:5d:6d:5d:87
> TUN/TAP device tun0 opened
> TUN/TAP TX queue length set to 100
> do_ifconfig, tt->did_ifconfig_ipv6_setup=0
> /sbin/ip link set dev tun0 up mtu 1500
> /sbin/ip addr add dev tun0 local 10.8.0.5 peer 10.8.0.6
> /sbin/ip route add 10.8.0.0/24 via 10.8.0.6
> WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
> Initialization Sequence Completed
> [SANITIZED_02_vpn_server] Inactivity timeout (--ping-restart), restarting
> TCP/UDP: Closing socket
> SIGUSR1[soft,ping-restart] received, process restarting
> Restart pause, 5 second(s)
> Re-using SSL/TLS context
> Control Channel MTU parms [ L:1625 D:1184 EF:66 EB:0 ET:0 EL:3 ]
> Data Channel MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> Fragmentation MTU parms [ L:1625 D:1200 EF:125 EB:406 ET:0 EL:3 ]
> Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
> Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1561,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
> TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:1194
> Socket Buffers: R=[212992->212992] S=[212992->212992]
> UDP link local: (not bound)
> UDP link remote: [AF_INET]x.x.x.x:1194
> TLS: Initial packet from [AF_INET]x.x.x.x:1194, sid=c4413d9b 6004791b
> VERIFY OK: depth=1, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_01 CA, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> VERIFY KU OK
> Validating certificate extended key usage
> ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
> VERIFY EKU OK
> VERIFY OK: depth=0, C=CA, ST=BC, L=SANITIZED_04, O=SANITIZED_01, OU=SoftwareDevelopment, CN=SANITIZED_02_vpn_server, name=EasyRSA, emailAddress=SANITIZED_03@SANITIZED_02.ca
> Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
> [SANITIZED_02_vpn_server] Peer Connection Initiated with [AF_INET]x.x.x.x:1194
> SENT CONTROL [SANITIZED_02_vpn_server]: 'PUSH_REQUEST' (status=1)
> PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.5 10.8.0.6,peer-id 8,cipher AES-256-GCM'
> OPTIONS IMPORT: timers and/or timeouts modified
> OPTIONS IMPORT: --ifconfig/up options modified
> OPTIONS IMPORT: route options modified
> OPTIONS IMPORT: peer-id set
> OPTIONS IMPORT: adjusting link_mtu to 1628
> OPTIONS IMPORT: data channel crypto options modified
> Data Channel: using negotiated cipher 'AES-256-GCM'
> Data Channel MTU parms [ L:1556 D:1200 EF:56 EB:406 ET:0 EL:3 ]
> Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
> Preserving previous TUN/TAP instance: tun0
> Initialization Sequence Completed

TinCanTech

shaunluttin wrote I have replaces the log file dates/times with the > character.

Because date and time are such security sensitive details .. what ever .. :mrgreen:

Not having timestamps, we can make some general assumptions to point you in the right direction.

From your server log:

OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2019

See https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos

> MULTI: new connection by client 'SANITIZED_02_vpn_client_01' will cause previous active sessions by this client to be dropped. Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.

See --duplicate-cn in the manual.

> x.x.x.x:52058 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1561', remote='link-mtu 1557'

This is usually safe to ignore.

> x.x.x.x:52058 WARNING: 'mtu-dynamic' is present in local config but missing in remote config, local='mtu-dynamic'

This is probably safe to ignore.

These to warnings may even be removed if you install the latest stable from the openvpn repos ..

> SANITIZED_02_vpn_client_01/x.x.x.x:52058 SENT CONTROL [SANITIZED_02_vpn_client_01]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.5 10.8.0.6,peer-id 7,cipher AES-256-GCM' (status=1)

This is all good but you may like to see --topology in the manual.

> SANITIZED_02_vpn_client_01/x.x.x.x:36410 FRAG_IN error flags=0x2a187bf3: FRAG_TEST not implemented

Personally, I would get latest stable from the openvpn repo ..

You probably do not require --fragment or --mssfix if you address all the points above.

From your client details:

Linux DESKTOP-5T629JB 4.19.84-microsoft-standard #1 SMP Wed Nov 13 11:44:37 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

That is a dull rusty blade in the gut, twisted to vent blood. I'll just assume that it runs openvpn without it's own particular M$ idiosyncrasies ..

> Initialization Sequence Completed
> [SANITIZED_02_vpn_server] Inactivity timeout (--ping-restart), restarting
> TCP/UDP: Closing socket
> SIGUSR1[soft,ping-restart] received, process restarting
> Restart pause, 5 second(s)

No timestamp ... probably some network issue.

persist-key
persist-tun

This can be a little unpredictable for a client .. remove it for now.

And the 64 thousand dollar question:

(i) SSH connection stalls/hangs after establishing a VPN connection
(ii) the SSH connection hangs/stalls, usually after about 2-minutes

Timeout above.

For your own sanity, --verb 11 is very unlikely to help unless you are trying to debug some openvpn code.

shaunluttin

Thank you so very much. I appreciate the guidance.

shaunluttin

I have followed your suggestions and will reply further after completing more testing.

Get latest stable from the openvpn repo. Done. This is now on the clients and the server. The version is 2.4.8.
See --duplicate-cn in the manual. Done. All of our clients have different certificates. I am surprised that we see this warning.
See --topology in the manual. Done. I need to do more research to understand how to use this setting.
Remove --fragment and --mssfix after addressing all the points above. Done.
Remove persist-key and persist-tun from client configurations. Done.
Stop using verb 11. Done. Sanity is important.
Restart client; restart server. Done.

TinCanTech

shaunluttin wrote See --duplicate-cn in the manual. Done. All of our clients have different certificates. I am surprised that we see this warning

The warning I highlighted is possibly a false positive, again due to timeouts instead of duplicate certificates. Take note then of how --keepalive works and that it is asymmetrical. (Manual again) (and probably the source of your issue)

shaunluttin

I am both grateful to report that the VPN connection works without hangs/stalls when tested on pure Linux (not on WSL).

Later, I will follow up with a test on WSL to see whether it was the culprit.

Server Config File:

# Network Related
dev tun
proto udp
port 1194
server 10.8.0.0 255.255.255.0

# Crypto Related
ca ca.crt
cert evidently_vpn_server.crt
key evidently_vpn_server.key
dh dh2048.pem
tls-auth ta.key 0
cipher AES-256-CBC

# Connection Management

# Specifically, with these keepalive settings...
# The server will...
# - every 10 seconds: ping remote client(s),
# - every 120 seconds: if client has been quiet, delete the client connection.
# The clients will...
# - every 10 seconds: ping remote server,
# - every 60 seconds: if server has been quiet, then restart the connection.
keepalive 10 60

persist-key
persist-tun
explicit-exit-notify 1

# Client-to-Client
client-config-dir ccd
client-to-client

# Logging Related
log /var/log/openvpn/openvpn.log
status /var/log/openvpn/openvpn-status.log
verb 4
mute 2

Client Config File:

# Network Related
dev tun
proto udp
client
remote vpn.evidently.ca 1194
nobind

# Connection Management
explicit-exit-notify 1

# Crypto Related
ca ca.crt
cert evidently_vpn_client_XX.crt
key evidently_vpn_client_XX.key
remote-cert-tls server
tls-auth ta.key 1
cipher AES-256-CBC

# Logging Related
log /var/log/openvpn/openvpn.log
status /var/log/openvpn/openvpn-status.log
verb 4
mute 2

shaunluttin

Unfortunately, the hangs are still occurring. The above configuration does not resolve the issue. Later, I will chime in with more details. Currently, I am trying

duplicate-cn

to see whether that changes anything. This is probably not what we want, but we are going to try it to see whether it resolves the issue. If it does, that will give us more information.

300000

you need to try tcp and may be it will not hang . udp not as good as tcp over internet , udp only good if you have cable internet connection and revy close between client and server , udp is faster than tcp but on the long run over internet tcp is more useable

[SANITIZED_02_vpn_server] Inactivity timeout (--ping-restart), restarting
> TCP/UDP: Closing socket

on client log it said inactive time out connection so you need something like that keepalive that keep your server active and push ping to client so every 190 minisecond it ping the server so the connection will keep alive . that design openvpn will turn off after some time , if you can connec to server but after 1 or 2 minus its lose connection so this command will help to hold connection for your client.

just add this into your server config anf try again.

keepalive 90 190
push "ping 190"

TinCanTech

The server config already has --keepalive.

300000 wrote keepalive 90 190
push "ping 190"

This is a terrible idea and would cause time outs.

300000

TinCanTech wrote The server config already has --keepalive.

300000 wrote keepalive 90 190
push "ping 190"
This is a terrible idea and would cause time outs.

but server config dont have push "ping 190" so client do nothing and then connection stop that is the point of drop connection . push ping to client keep client connecting all the time.

TinCanTech

300000 wrote but server config dont have push "ping 190" so client do nothing and then connection stop that is the point of drop connection . push ping to client keep client connecting all the time.

You do not understand how --keepalive works .. please read the manual.