Hi
I'm new to this forum. And I have a question regarding an error on the OpenVPN Connect app for Android. I will be as clear as possible.
I have on me PFSense an OpenVPN-server running. (Peer To Peer - SSL/TLS). The server is connected to a client (= site-to-site).
-Tunnel IP client = 192.168.3.2/24
-Tunnel IP server = 192.168.3.1/24
Next I want to connect via my Android phone to the server. This connection is good. But the server gives me an IP of 192.168.3.2. This is the same as my client tunnel 192.168.3.2 as stated above. Apparently the client for the phone thinks I have a /30 subnet.
I then installed a Client Specific Override on the PFSense to give the client on the phone an IP of 192.168.3.3/24. But then I get an "tun_pro_error".
Log file of OpenVPN connect:
16:45:39.063 -- ----- OpenVPN Start -----
16:45:39.064 -- EVENT: CORE_THREAD_ACTIVE
16:45:39.068 -- OpenVPN core 3.git::f225fcd0:Release android arm64 64-bit PT_PROXY built on Mar 3 2020 21:07:24
16:45:39.075 -- Frame=512/2048/512 mssfix-ctrl=1250
16:45:39.080 -- UNUSED OPTIONS
0 [persist-tun]
1 [persist-key]
3 [ncp-ciphers] [AES-256-CBC]
5 [tls-client]
8 [lport] [0]
9 [verify-x509-name] [Server] [name]
12 [topology] [subnet]
16:45:39.081 -- EVENT: RESOLVE
16:45:39.085 -- Contacting ... via UDP
16:45:39.086 -- EVENT: WAIT
16:45:39.098 -- Connecting to [....]:1194 (....) via UDPv4
16:45:39.167 -- EVENT: CONNECTING
16:45:39.182 -- Tunnel Options:V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client
16:45:39.184 -- Creds: UsernameEmpty/PasswordEmpty
16:45:39.185 -- Peer Info:
IV_GUI_VER=OC30Android
IV_VER=3.git::f225fcd0:Release
IV_PLAT=android
IV_NCP=2
IV_TCPNL=1
IV_PROTO=2
IV_LZO_STUB=1
IV_COMP_STUB=1
IV_COMP_STUBv2=1
IV_AUTO_SESS=1
16:45:39.265 -- VERIFY OK : depth=1
cert. version : 3
serial number : 00
issuer name : CN=internal-ca, C=BE, ST=Antwerpen, L=Gierle, O=TowerEye
subject name : CN=internal-ca, C=BE, ST=Antwerpen, L=Gierle, O=TowerEye
issued on : 2020-03-01 10:13:44
expires on : 2030-02-27 10:13:44
signed using : RSA with SHA-256
RSA key size : 2048 bits
basic constraints : CA=true
key usage : Key Cert Sign, CRL Sign
16:45:39.271 -- VERIFY OK : depth=0
cert. version : 3
serial number : 01
issuer name : CN=internal-ca, C=BE, ST=Antwerpen, L=Gierle, O=TowerEye
subject name : CN=Server, C=BE, ST=Antwerpen, L=Gierle, O=TowerEye
issued on : 2020-03-01 10:18:08
expires on : 2030-02-27 10:18:08
signed using : RSA with SHA-256
RSA key size : 2048 bits
basic constraints : CA=false
subject alt name : Server
cert. type : SSL Server
key usage : Digital Signature, Key Encipherment
ext key usage : TLS Web Server Authentication, ???
16:45:39.494 -- SSL Handshake: TLSv1.2/TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
16:45:39.495 -- Session is ACTIVE
16:45:39.496 -- EVENT: GET_CONFIG
16:45:39.503 -- Sending PUSH_REQUEST to server...
16:45:39.562 -- OPTIONS:
0 [route] [192.168.1.0] [255.255.255.0]
1 [ifconfig] [192.168.3.3] [255.255.255.0]
2 [peer-id] [1]
3 [cipher] [AES-256-CBC]
16:45:39.563 -- PROTOCOL OPTIONS:
cipher: AES-256-CBC
digest: SHA1
compress: COMP_STUB
peer ID: 1
16:45:39.566 -- EVENT: ASSIGN_IP
16:45:39.652 -- TUN Error: tun_prop_error: ifconfig addresses are not in the same /30 subnet (topology net30)
16:45:39.653 -- EVENT: TUN_SETUP_FAILED info='tun_prop_error: ifconfig addresses are not in the same /30 subnet (topology net30)'
16:45:39.677 -- EVENT: DISCONNECTED
16:45:39.678 -- Tunnel bytes per CPU second: 0
16:45:39.679 -- ----- OpenVPN Stop -----
16:45:39.681 -- Client exception in transport_recv: tun_exception: not connected
dev ovpns1
verb 1
dev-type tun
dev-node /dev/tun1
writepid /var/run/openvpn_server1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp4
cipher AES-256-CBC
auth SHA1
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local 84.x.x.x
tls-server
server 192.168.3.0 255.255.255.0
client-config-dir /var/etc/openvpn-csc/server1
ifconfig 192.168.3.1 192.168.3.2
persist-tun
persist-key
cipher AES-256-CBC
ncp-ciphers AES-256-CBC
auth SHA1
tls-client
client
remote 84.196.37.110 1194 udp4
lport 0
verify-x509-name "Server" name
remote-cert-tls server
compress lzo
topology subnet
<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
</key>
key-direction 1
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
-----END OpenVPN Static key V1-----
</tls-auth>
So does anyone have some suggestions of how to get my subnetmask of /24 get through?
Thanks!
