Can create OpenVPN tunnel within LAN but cannot connect from WAN

UncleFester

Hi all. Been at it for 4 days now and I'm fresh out of ideas.

Basically, I have 2 sites that need a VPN connection. It used to work but suddenly it stopped working. I can create a VPN tunnel within the internal LAN but for some reason I can't hit my public IP address.

Configs as follows:
Server: CentOS 7 (OpenVPN 2.4.9, EasyRSA 3.0.7)

port 1194
proto udp
dev tun
ca ...
cert ...
key ...
dh ...
tls-crypt ...
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.20.0 255.255.255.0"
keepalive 10 120
cipher AES-256-CBC
auth SHA512
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 6
explicit-exit-notify 1

client
dev tun
proto udp
ca ...
crt ...
key ...
tls-crypt ...
remote (public IP Address redacted) 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
tls-client
tls-cipher TLS-ECDHE-RSA-WITH-AES-GCM-SHA256:TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256:TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256
remote-cert-tls server
cipher AES-256-CBC
auth SHA512
auth-nocache
comp-lzo
verb 6

public (active)
target: DROP
icmp-block-inversion: yes
interfaces: enp2s0
sources:
services: openvpn
ports:
protocols:
masquerade: yes
forward-ports:
source-ports:
icmp-blocks:
rich rules:

Client Log Snippet:
Jul 23 14:31:23 localhost ovpn-client[8833]: Re-using SSL/TLS context
Jul 23 14:31:23 localhost ovpn-client[8833]: Control Channel MTU parms [ L:1621 D:1140 EF:110 EB:0 ET:0 EL:3 ]
Jul 23 14:31:23 localhost ovpn-client[8833]: Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
Jul 23 14:31:23 localhost ovpn-client[8833]: Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,tls-auth,key-method 2,tls-client'
Jul 23 14:31:23 localhost ovpn-client[8833]: Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,tls-auth,key-method 2,tls-server'
Jul 23 14:31:23 localhost ovpn-client[8833]: TCP/UDP: Preserving recently used remote address: [AF_INET](public IP address):1194
Jul 23 14:31:23 localhost ovpn-client[8833]: Socket Buffers: R=[212992->212992] S=[212992->212992]
Jul 23 14:31:23 localhost ovpn-client[8833]: UDP link local: (not bound)
Jul 23 14:31:23 localhost ovpn-client[8833]: UDP link remote: [AF_INET](public IP Address):1194
Jul 23 14:31:23 localhost ovpn-client[8833]: UDP WRITE [86] to [AF_INET](public IP Address):1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #1 ] [ ] pid=0 DATA len=0
Jul 23 14:31:25 localhost ovpn-client[8833]: UDP WRITE [86] to [AF_INET](public IP Address):1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #2 ] [ ] pid=0 DATA len=0
Jul 23 14:31:29 localhost ovpn-client[8833]: UDP WRITE [86] to [AF_INET](public IP Address):1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #3 ] [ ] pid=0 DATA len=0
Jul 23 14:31:37 localhost ovpn-client[8833]: UDP WRITE [86] to [AF_INET](public IP Address):1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #4 ] [ ] pid=0 DATA len=0
Jul 23 14:31:53 localhost ovpn-client[8833]: UDP WRITE [86] to [AF_INET](public IP Address):1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #5 ] [ ] pid=0 DATA len=0
Jul 23 14:32:23 localhost ovpn-client[8833]: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Jul 23 14:32:23 localhost ovpn-client[8833]: TLS Error: TLS handshake failed
Jul 23 14:32:23 localhost ovpn-client[8833]: TCP/UDP: Closing socket
Jul 23 14:32:23 localhost ovpn-client[8833]: SIGUSR1[soft,tls-error] received, process restarting
Jul 23 14:32:23 localhost ovpn-client[8833]: Restart pause, 300 second(s)

I've checked with my ISP. They're not filtering OpenVPN traffic. Any help would be greatly appreciated. Thanks in advance.

TinCanTech

Server log --verb 4 ..

UncleFester

I'll post it tomorrow.

UncleFester

Openvpn.log

I also forgot to mention in my initial post that the OpenVPN server and the edge firewall are the same server.

Fri Jul 24 11:02:23 2020 us=829375 Current Parameter Settings:
Fri Jul 24 11:02:23 2020 us=829683   config = 'server.conf'
Fri Jul 24 11:02:23 2020 us=829708   mode = 1
Fri Jul 24 11:02:23 2020 us=829725   persist_config = DISABLED
Fri Jul 24 11:02:23 2020 us=829741   persist_mode = 1
Fri Jul 24 11:02:23 2020 us=829757   show_ciphers = DISABLED
Fri Jul 24 11:02:23 2020 us=829773   show_digests = DISABLED
Fri Jul 24 11:02:23 2020 us=829788   show_engines = DISABLED
Fri Jul 24 11:02:23 2020 us=829804   genkey = DISABLED
Fri Jul 24 11:02:23 2020 us=829819   key_pass_file = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=829835   show_tls_ciphers = DISABLED
Fri Jul 24 11:02:23 2020 us=829851   connect_retry_max = 0
Fri Jul 24 11:02:23 2020 us=829867 Connection profiles [0]:
Fri Jul 24 11:02:23 2020 us=829883   proto = udp
Fri Jul 24 11:02:23 2020 us=829899   local = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=829915   local_port = '1194'
Fri Jul 24 11:02:23 2020 us=829930   remote = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=829946   remote_port = '1194'
Fri Jul 24 11:02:23 2020 us=829961   remote_float = DISABLED
Fri Jul 24 11:02:23 2020 us=829977   bind_defined = DISABLED
Fri Jul 24 11:02:23 2020 us=829992   bind_local = ENABLED
Fri Jul 24 11:02:23 2020 us=830008   bind_ipv6_only = DISABLED
Fri Jul 24 11:02:23 2020 us=830023   connect_retry_seconds = 5
Fri Jul 24 11:02:23 2020 us=830038   connect_timeout = 120
Fri Jul 24 11:02:23 2020 us=830054   socks_proxy_server = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=830069   socks_proxy_port = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=830085   tun_mtu = 1500
Fri Jul 24 11:02:23 2020 us=830100   tun_mtu_defined = ENABLED
Fri Jul 24 11:02:23 2020 us=830116   link_mtu = 1500
Fri Jul 24 11:02:23 2020 us=830131   link_mtu_defined = DISABLED
Fri Jul 24 11:02:23 2020 us=830147   tun_mtu_extra = 0
Fri Jul 24 11:02:23 2020 us=830162   tun_mtu_extra_defined = DISABLED
Fri Jul 24 11:02:23 2020 us=830178   mtu_discover_type = -1
Fri Jul 24 11:02:23 2020 us=830193   fragment = 0
Fri Jul 24 11:02:23 2020 us=830209   mssfix = 1450
Fri Jul 24 11:02:23 2020 us=830224   explicit_exit_notification = 1
Fri Jul 24 11:02:23 2020 us=830239 Connection profiles END
Fri Jul 24 11:02:23 2020 us=830255   remote_random = DISABLED
Fri Jul 24 11:02:23 2020 us=830270   ipchange = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=830294   dev = 'tun'
Fri Jul 24 11:02:23 2020 us=830314   dev_type = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=830330   dev_node = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=830350   lladdr = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=830368   topology = 3
Fri Jul 24 11:02:23 2020 us=830383   ifconfig_local = '10.8.0.1'
Fri Jul 24 11:02:23 2020 us=830399   ifconfig_remote_netmask = '255.255.255.0'
Fri Jul 24 11:02:23 2020 us=830415   ifconfig_noexec = DISABLED
Fri Jul 24 11:02:23 2020 us=830430   ifconfig_nowarn = DISABLED
Fri Jul 24 11:02:23 2020 us=830446   ifconfig_ipv6_local = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=830461   ifconfig_ipv6_netbits = 0
Fri Jul 24 11:02:23 2020 us=830476   ifconfig_ipv6_remote = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=830492   shaper = 0
Fri Jul 24 11:02:23 2020 us=830507   mtu_test = 0
Fri Jul 24 11:02:23 2020 us=830522   mlock = DISABLED
Fri Jul 24 11:02:23 2020 us=830538   keepalive_ping = 10
Fri Jul 24 11:02:23 2020 us=830553   keepalive_timeout = 120
Fri Jul 24 11:02:23 2020 us=830568   inactivity_timeout = 0
Fri Jul 24 11:02:23 2020 us=830584   ping_send_timeout = 10
Fri Jul 24 11:02:23 2020 us=830599   ping_rec_timeout = 240
Fri Jul 24 11:02:23 2020 us=830614   ping_rec_timeout_action = 2
Fri Jul 24 11:02:23 2020 us=830630   ping_timer_remote = DISABLED
Fri Jul 24 11:02:23 2020 us=830645   remap_sigusr1 = 0
Fri Jul 24 11:02:23 2020 us=830660   persist_tun = ENABLED
Fri Jul 24 11:02:23 2020 us=830676   persist_local_ip = DISABLED
Fri Jul 24 11:02:23 2020 us=830691   persist_remote_ip = DISABLED
Fri Jul 24 11:02:23 2020 us=830707   persist_key = ENABLED
Fri Jul 24 11:02:23 2020 us=830722   passtos = DISABLED
Fri Jul 24 11:02:23 2020 us=830738   resolve_retry_seconds = 1000000000
Fri Jul 24 11:02:23 2020 us=830754   resolve_in_advance = DISABLED
Fri Jul 24 11:02:23 2020 us=830776   username = 'nobody'
Fri Jul 24 11:02:23 2020 us=830793   groupname = 'nobody'
Fri Jul 24 11:02:23 2020 us=830809   chroot_dir = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=830824   cd_dir = '/etc/openvpn/'
Fri Jul 24 11:02:23 2020 us=830839   selinux_context = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=830855   writepid = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=830870   up_script = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=830886   down_script = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=830901   down_pre = DISABLED
Fri Jul 24 11:02:23 2020 us=830916   up_restart = DISABLED
Fri Jul 24 11:02:23 2020 us=830931   up_delay = DISABLED
Fri Jul 24 11:02:23 2020 us=830947   daemon = DISABLED
Fri Jul 24 11:02:23 2020 us=830962   inetd = 0
Fri Jul 24 11:02:23 2020 us=830977   log = ENABLED
Fri Jul 24 11:02:23 2020 us=830992   suppress_timestamps = DISABLED
Fri Jul 24 11:02:23 2020 us=831008   machine_readable_output = DISABLED
Fri Jul 24 11:02:23 2020 us=831023   nice = 0
Fri Jul 24 11:02:23 2020 us=831038   verbosity = 4
Fri Jul 24 11:02:23 2020 us=831053   mute = 0
Fri Jul 24 11:02:23 2020 us=831068   gremlin = 0
Fri Jul 24 11:02:23 2020 us=831083   status_file = 'openvpn-status.log'
Fri Jul 24 11:02:23 2020 us=831099   status_file_version = 1
Fri Jul 24 11:02:23 2020 us=831114   status_file_update_freq = 60
Fri Jul 24 11:02:23 2020 us=831130   occ = ENABLED
Fri Jul 24 11:02:23 2020 us=831146   rcvbuf = 0
Fri Jul 24 11:02:23 2020 us=831161   sndbuf = 0
Fri Jul 24 11:02:23 2020 us=831176   mark = 0
Fri Jul 24 11:02:23 2020 us=831191   sockflags = 0
Fri Jul 24 11:02:23 2020 us=831207   fast_io = DISABLED
Fri Jul 24 11:02:23 2020 us=831222   comp.alg = 0
Fri Jul 24 11:02:23 2020 us=831237   comp.flags = 0
Fri Jul 24 11:02:23 2020 us=831253   route_script = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=831268   route_default_gateway = '10.8.0.2'
Fri Jul 24 11:02:23 2020 us=831298   route_default_metric = 0
Fri Jul 24 11:02:23 2020 us=831319   route_noexec = DISABLED
Fri Jul 24 11:02:23 2020 us=831335   route_delay = 0
Fri Jul 24 11:02:23 2020 us=831350   route_delay_window = 30
Fri Jul 24 11:02:23 2020 us=831366   route_delay_defined = DISABLED
Fri Jul 24 11:02:23 2020 us=831381   route_nopull = DISABLED
Fri Jul 24 11:02:23 2020 us=831396   route_gateway_via_dhcp = DISABLED
Fri Jul 24 11:02:23 2020 us=831412   allow_pull_fqdn = DISABLED
Fri Jul 24 11:02:23 2020 us=831427   management_addr = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=831443   management_port = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=831458   management_user_pass = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=831474   management_log_history_cache = 250
Fri Jul 24 11:02:23 2020 us=831489   management_echo_buffer_size = 100
Fri Jul 24 11:02:23 2020 us=831505   management_write_peer_info_file = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=831521   management_client_user = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=831536   management_client_group = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=831552   management_flags = 0
Fri Jul 24 11:02:23 2020 us=831567   shared_secret_file = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=831583   key_direction = not set
Fri Jul 24 11:02:23 2020 us=831599   ciphername = 'AES-256-CBC'
Fri Jul 24 11:02:23 2020 us=831614   ncp_enabled = ENABLED
Fri Jul 24 11:02:23 2020 us=831629   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
Fri Jul 24 11:02:23 2020 us=831645   authname = 'SHA512'
Fri Jul 24 11:02:23 2020 us=831660   prng_hash = 'SHA1'
Fri Jul 24 11:02:23 2020 us=831676   prng_nonce_secret_len = 16
Fri Jul 24 11:02:23 2020 us=831691   keysize = 0
Fri Jul 24 11:02:23 2020 us=831706   engine = DISABLED
Fri Jul 24 11:02:23 2020 us=831721   replay = ENABLED
Fri Jul 24 11:02:23 2020 us=831737   mute_replay_warnings = DISABLED
Fri Jul 24 11:02:23 2020 us=831752   replay_window = 64
Fri Jul 24 11:02:23 2020 us=831768   replay_time = 15
Fri Jul 24 11:02:23 2020 us=831783   packet_id_file = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=831799   use_iv = ENABLED
Fri Jul 24 11:02:23 2020 us=831814   test_crypto = DISABLED
Fri Jul 24 11:02:23 2020 us=831830   tls_server = ENABLED
Fri Jul 24 11:02:23 2020 us=831852   tls_client = DISABLED
Fri Jul 24 11:02:23 2020 us=831868   key_method = 2
Fri Jul 24 11:02:23 2020 us=831884   ca_file = 'easyrsa/pki/ca.crt'
Fri Jul 24 11:02:23 2020 us=831899   ca_path = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=831914   dh_file = 'easyrsa/pki/dh.pem'
Fri Jul 24 11:02:23 2020 us=831930   cert_file = 'easyrsa/pki/issued/server.crt'
Fri Jul 24 11:02:23 2020 us=831946   extra_certs_file = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=831962   priv_key_file = 'easyrsa/pki/private/server.key'
Fri Jul 24 11:02:23 2020 us=831977   pkcs12_file = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=831993   cipher_list = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=832008   cipher_list_tls13 = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=832023   tls_cert_profile = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=832039   tls_verify = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=832054   tls_export_cert = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=832069   verify_x509_type = 0
Fri Jul 24 11:02:23 2020 us=832084   verify_x509_name = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=832100   crl_file = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=832115   ns_cert_type = 0
Fri Jul 24 11:02:23 2020 us=832130   remote_cert_ku[i] = 0
Fri Jul 24 11:02:23 2020 us=832146   remote_cert_ku[i] = 0
Fri Jul 24 11:02:23 2020 us=832161   remote_cert_ku[i] = 0
Fri Jul 24 11:02:23 2020 us=832176   remote_cert_ku[i] = 0
Fri Jul 24 11:02:23 2020 us=832192   remote_cert_ku[i] = 0
Fri Jul 24 11:02:23 2020 us=832207   remote_cert_ku[i] = 0
Fri Jul 24 11:02:23 2020 us=832222   remote_cert_ku[i] = 0
Fri Jul 24 11:02:23 2020 us=832238   remote_cert_ku[i] = 0
Fri Jul 24 11:02:23 2020 us=832253   remote_cert_ku[i] = 0
Fri Jul 24 11:02:23 2020 us=832268   remote_cert_ku[i] = 0
Fri Jul 24 11:02:23 2020 us=832298   remote_cert_ku[i] = 0
Fri Jul 24 11:02:23 2020 us=832318   remote_cert_ku[i] = 0
Fri Jul 24 11:02:23 2020 us=832334   remote_cert_ku[i] = 0
Fri Jul 24 11:02:23 2020 us=832349   remote_cert_ku[i] = 0
Fri Jul 24 11:02:23 2020 us=832364   remote_cert_ku[i] = 0
Fri Jul 24 11:02:23 2020 us=832379   remote_cert_ku[i] = 0
Fri Jul 24 11:02:23 2020 us=832395   remote_cert_eku = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=832410   ssl_flags = 0
Fri Jul 24 11:02:23 2020 us=832425   tls_timeout = 2
Fri Jul 24 11:02:23 2020 us=832440   renegotiate_bytes = -1
Fri Jul 24 11:02:23 2020 us=832456   renegotiate_packets = 0
Fri Jul 24 11:02:23 2020 us=832471   renegotiate_seconds = 3600
Fri Jul 24 11:02:23 2020 us=832486   handshake_window = 60
Fri Jul 24 11:02:23 2020 us=832501   transition_window = 3600
Fri Jul 24 11:02:23 2020 us=832517   single_session = DISABLED
Fri Jul 24 11:02:23 2020 us=832532   push_peer_info = DISABLED
Fri Jul 24 11:02:23 2020 us=832547   tls_exit = DISABLED
Fri Jul 24 11:02:23 2020 us=832563   tls_auth_file = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=832578   tls_crypt_file = 'server/keys/(redacted).tlsauth'
Fri Jul 24 11:02:23 2020 us=832594   pkcs11_protected_authentication = DISABLED
Fri Jul 24 11:02:23 2020 us=832609   pkcs11_protected_authentication = DISABLED
Fri Jul 24 11:02:23 2020 us=832624   pkcs11_protected_authentication = DISABLED
Fri Jul 24 11:02:23 2020 us=832639   pkcs11_protected_authentication = DISABLED
Fri Jul 24 11:02:23 2020 us=832654   pkcs11_protected_authentication = DISABLED
Fri Jul 24 11:02:23 2020 us=832670   pkcs11_protected_authentication = DISABLED
Fri Jul 24 11:02:23 2020 us=832685   pkcs11_protected_authentication = DISABLED
Fri Jul 24 11:02:23 2020 us=832700   pkcs11_protected_authentication = DISABLED
Fri Jul 24 11:02:23 2020 us=832715   pkcs11_protected_authentication = DISABLED
Fri Jul 24 11:02:23 2020 us=832730   pkcs11_protected_authentication = DISABLED
Fri Jul 24 11:02:23 2020 us=832745   pkcs11_protected_authentication = DISABLED
Fri Jul 24 11:02:23 2020 us=832760   pkcs11_protected_authentication = DISABLED
Fri Jul 24 11:02:23 2020 us=832775   pkcs11_protected_authentication = DISABLED
Fri Jul 24 11:02:23 2020 us=832790   pkcs11_protected_authentication = DISABLED
Fri Jul 24 11:02:23 2020 us=832805   pkcs11_protected_authentication = DISABLED
Fri Jul 24 11:02:23 2020 us=832826   pkcs11_protected_authentication = DISABLED
Fri Jul 24 11:02:23 2020 us=832843   pkcs11_private_mode = 00000000
Fri Jul 24 11:02:23 2020 us=832859   pkcs11_private_mode = 00000000
Fri Jul 24 11:02:23 2020 us=832874   pkcs11_private_mode = 00000000
Fri Jul 24 11:02:23 2020 us=832889   pkcs11_private_mode = 00000000
Fri Jul 24 11:02:23 2020 us=832904   pkcs11_private_mode = 00000000
Fri Jul 24 11:02:23 2020 us=832919   pkcs11_private_mode = 00000000
Fri Jul 24 11:02:23 2020 us=832934   pkcs11_private_mode = 00000000
Fri Jul 24 11:02:23 2020 us=832949   pkcs11_private_mode = 00000000
Fri Jul 24 11:02:23 2020 us=832964   pkcs11_private_mode = 00000000
Fri Jul 24 11:02:23 2020 us=832979   pkcs11_private_mode = 00000000
Fri Jul 24 11:02:23 2020 us=832994   pkcs11_private_mode = 00000000
Fri Jul 24 11:02:23 2020 us=833009   pkcs11_private_mode = 00000000
Fri Jul 24 11:02:23 2020 us=833024   pkcs11_private_mode = 00000000
Fri Jul 24 11:02:23 2020 us=833039   pkcs11_private_mode = 00000000
Fri Jul 24 11:02:23 2020 us=833054   pkcs11_private_mode = 00000000
Fri Jul 24 11:02:23 2020 us=833069   pkcs11_private_mode = 00000000
Fri Jul 24 11:02:23 2020 us=833084   pkcs11_cert_private = DISABLED
Fri Jul 24 11:02:23 2020 us=833099   pkcs11_cert_private = DISABLED
Fri Jul 24 11:02:23 2020 us=833114   pkcs11_cert_private = DISABLED
Fri Jul 24 11:02:23 2020 us=833130   pkcs11_cert_private = DISABLED
Fri Jul 24 11:02:23 2020 us=833145   pkcs11_cert_private = DISABLED
Fri Jul 24 11:02:23 2020 us=833159   pkcs11_cert_private = DISABLED
Fri Jul 24 11:02:23 2020 us=833174   pkcs11_cert_private = DISABLED
Fri Jul 24 11:02:23 2020 us=833189   pkcs11_cert_private = DISABLED
Fri Jul 24 11:02:23 2020 us=833204   pkcs11_cert_private = DISABLED
Fri Jul 24 11:02:23 2020 us=833219   pkcs11_cert_private = DISABLED
Fri Jul 24 11:02:23 2020 us=833234   pkcs11_cert_private = DISABLED
Fri Jul 24 11:02:23 2020 us=833249   pkcs11_cert_private = DISABLED
Fri Jul 24 11:02:23 2020 us=833263   pkcs11_cert_private = DISABLED
Fri Jul 24 11:02:23 2020 us=833278   pkcs11_cert_private = DISABLED
Fri Jul 24 11:02:23 2020 us=833304   pkcs11_cert_private = DISABLED
Fri Jul 24 11:02:23 2020 us=833320   pkcs11_cert_private = DISABLED
Fri Jul 24 11:02:23 2020 us=833336   pkcs11_pin_cache_period = -1
Fri Jul 24 11:02:23 2020 us=833351   pkcs11_id = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=833367   pkcs11_id_management = DISABLED
Fri Jul 24 11:02:23 2020 us=833384   server_network = 10.8.0.0
Fri Jul 24 11:02:23 2020 us=833401   server_netmask = 255.255.255.0
Fri Jul 24 11:02:23 2020 us=833428   server_network_ipv6 = ::
Fri Jul 24 11:02:23 2020 us=833444   server_netbits_ipv6 = 0
Fri Jul 24 11:02:23 2020 us=833461   server_bridge_ip = 0.0.0.0
Fri Jul 24 11:02:23 2020 us=833477   server_bridge_netmask = 0.0.0.0
Fri Jul 24 11:02:23 2020 us=833498   server_bridge_pool_start = 0.0.0.0
Fri Jul 24 11:02:23 2020 us=833516   server_bridge_pool_end = 0.0.0.0
Fri Jul 24 11:02:23 2020 us=833532   push_entry = 'route 192.168.20.0 255.255.255.0'
Fri Jul 24 11:02:23 2020 us=833547   push_entry = 'route-gateway 10.8.0.1'
Fri Jul 24 11:02:23 2020 us=833563   push_entry = 'topology subnet'
Fri Jul 24 11:02:23 2020 us=833578   push_entry = 'ping 10'
Fri Jul 24 11:02:23 2020 us=833593   push_entry = 'ping-restart 120'
Fri Jul 24 11:02:23 2020 us=833608   ifconfig_pool_defined = ENABLED
Fri Jul 24 11:02:23 2020 us=833625   ifconfig_pool_start = 10.8.0.2
Fri Jul 24 11:02:23 2020 us=833641   ifconfig_pool_end = 10.8.0.253
Fri Jul 24 11:02:23 2020 us=833658   ifconfig_pool_netmask = 255.255.255.0
Fri Jul 24 11:02:23 2020 us=833674   ifconfig_pool_persist_filename = 'ipp.txt'
Fri Jul 24 11:02:23 2020 us=833690   ifconfig_pool_persist_refresh_freq = 600
Fri Jul 24 11:02:23 2020 us=833705   ifconfig_ipv6_pool_defined = DISABLED
Fri Jul 24 11:02:23 2020 us=833722   ifconfig_ipv6_pool_base = ::
Fri Jul 24 11:02:23 2020 us=833737   ifconfig_ipv6_pool_netbits = 0
Fri Jul 24 11:02:23 2020 us=833753   n_bcast_buf = 256
Fri Jul 24 11:02:23 2020 us=833768   tcp_queue_limit = 64
Fri Jul 24 11:02:23 2020 us=833789   real_hash_size = 256
Fri Jul 24 11:02:23 2020 us=833806   virtual_hash_size = 256
Fri Jul 24 11:02:23 2020 us=833822   client_connect_script = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=833837   learn_address_script = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=833853   client_disconnect_script = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=833869   client_config_dir = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=833884   ccd_exclusive = DISABLED
Fri Jul 24 11:02:23 2020 us=833900   tmp_dir = '/tmp'
Fri Jul 24 11:02:23 2020 us=833915   push_ifconfig_defined = DISABLED
Fri Jul 24 11:02:23 2020 us=833932   push_ifconfig_local = 0.0.0.0
Fri Jul 24 11:02:23 2020 us=833948   push_ifconfig_remote_netmask = 0.0.0.0
Fri Jul 24 11:02:23 2020 us=833964   push_ifconfig_ipv6_defined = DISABLED
Fri Jul 24 11:02:23 2020 us=833981   push_ifconfig_ipv6_local = ::/0
Fri Jul 24 11:02:23 2020 us=833997   push_ifconfig_ipv6_remote = ::
Fri Jul 24 11:02:23 2020 us=834012   enable_c2c = DISABLED
Fri Jul 24 11:02:23 2020 us=834028   duplicate_cn = DISABLED
Fri Jul 24 11:02:23 2020 us=834043   cf_max = 0
Fri Jul 24 11:02:23 2020 us=834059   cf_per = 0
Fri Jul 24 11:02:23 2020 us=834074   max_clients = 1024
Fri Jul 24 11:02:23 2020 us=834089   max_routes_per_client = 256
Fri Jul 24 11:02:23 2020 us=834105   auth_user_pass_verify_script = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=834120   auth_user_pass_verify_script_via_file = DISABLED
Fri Jul 24 11:02:23 2020 us=834136   auth_token_generate = DISABLED
Fri Jul 24 11:02:23 2020 us=834151   auth_token_lifetime = 0
Fri Jul 24 11:02:23 2020 us=834167   port_share_host = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=834182   port_share_port = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=834197   client = DISABLED
Fri Jul 24 11:02:23 2020 us=834213   pull = DISABLED
Fri Jul 24 11:02:23 2020 us=834228   auth_user_pass_file = '[UNDEF]'
Fri Jul 24 11:02:23 2020 us=834249 OpenVPN 2.4.9 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 24 2020
Fri Jul 24 11:02:23 2020 us=834276 library versions: OpenSSL 1.0.2k-fips  26 Jan 2017, LZO 2.06
Fri Jul 24 11:02:23 2020 us=839580 Diffie-Hellman initialized with 2048 bit key
Fri Jul 24 11:02:23 2020 us=882512 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Fri Jul 24 11:02:23 2020 us=882598 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jul 24 11:02:23 2020 us=882624 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Fri Jul 24 11:02:23 2020 us=882645 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Jul 24 11:02:23 2020 us=882681 TLS-Auth MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
Fri Jul 24 11:02:23 2020 us=884755 TUN/TAP device tun0 opened
Fri Jul 24 11:02:23 2020 us=884825 TUN/TAP TX queue length set to 100
Fri Jul 24 11:02:23 2020 us=884858 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Fri Jul 24 11:02:23 2020 us=884888 /sbin/ip link set dev tun0 up mtu 1500
Fri Jul 24 11:02:23 2020 us=889807 /sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
Fri Jul 24 11:02:23 2020 us=898764 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
Fri Jul 24 11:02:23 2020 us=899715 Could not determine IPv4/IPv6 protocol. Using AF_INET
Fri Jul 24 11:02:23 2020 us=899951 Socket Buffers: R=[212992->212992] S=[212992->212992]
Fri Jul 24 11:02:23 2020 us=900107 UDPv4 link local (bound): [AF_INET][undef]:1194
Fri Jul 24 11:02:23 2020 us=900129 UDPv4 link remote: [AF_UNSPEC]
Fri Jul 24 11:02:23 2020 us=900156 GID set to nobody
Fri Jul 24 11:02:23 2020 us=900184 UID set to nobody
Fri Jul 24 11:02:23 2020 us=900217 MULTI: multi_init called, r=256 v=256
Fri Jul 24 11:02:23 2020 us=900268 IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
Fri Jul 24 11:02:23 2020 us=900320 IFCONFIG POOL LIST
Fri Jul 24 11:02:23 2020 us=900447 Initialization Sequence Completed

TinCanTech

Your server log shows no connection attempts.

UncleFester

I'm suspecting the problem is with some setting in my edge firewall. But not sure how to troubleshoot it. I've done a tcpdump (tcpdump -vni eth0 port 1194 and udp). But nothing seems to be hitting the interface. I've re-created the firewall settings within my virtual LAN but the connections always go through.

Totally newbie question -- my internet setup at work is essentially: (outside) --> modem (IP x.x.x.66) --> edge firewall (IP x.x.x.65) --> LAN. The remote setting on the client is supposed to be the IP address of the public facing interface of the OpenVPN box (65) or the modem (66)?

TinCanTech

Sorry, we don't support your network here.

If you need professional help you can contact me privately: tincanteksup <at> gmail dot com

Fees will apply.