Hi there. Long time OpenVPN user here, I have my 50 colleagues connecting daily to my OpenVPN server at work so that they can do remote work as if they were in the office (for the last 5-6 years roughly). However my current server is due for a replacement as we'll move offices in October. I'm installing a new server, but I can't manage for the life of me to make my new server work. Connections are established fine, but nothing flows through the tunnel.
Some key points before I go on with all the details:
- We had a 10/8 network, now we're down to a 10/20.
- I want my coworkers at home to be able to connect to the VPN and have an IP in our 10/20 subnet, so that they can access our NAS and other internal services. I need broadcast too, for service discovery, so I've always gone with a TAP and a bridge. It's been working flawlessly for years.
- I don't want all their traffic routed through the VPN. At any cost. Just the traffic destined to our internal network. Again, it's been working this way since forever.
So, I installed a fresh ESXi on a Mac Mini; put a fresh Debian on it, and just proceeded to clone my "old" configuration. Old as in Debian 9, OpenVPN 2.4.0. My new setup is Debian 10, OpenVPN 2.4.7.
Checklist:
✅ I have enabled promiscuous mode on the ESXi vSwitch
✅ I have enabled ip_forward on the Debian server (/proc/sys/net/ipv4/ip_forward says 1 and stays across reboots)
✅ I have copied over all of my keys/certs/signing infrastructure from the previous setup
Network topology:
- my Debian server is inside my work LAN: 10/20, gateway 10.0.0.1, netmask 255.255.240.0, broadcast 10.0.15.255
- my Debian server has static IP 10.0.0.51 and a (redacted) public IP of say, 22.33.44.55 (handled by the router/gateway)
- I have two other VMs on my ESXi, which have been given 10.0.1.1 and 10.0.1.2 by the gateway's DHCP server
- I'm testing from home, both on Mac OS and Ubuntu, where I have the public IP 66.77.88.99, and a subnet 192.168.21/24 behind my router.
/etc/openvpn/server/bridge-server.conf :
dev tap0
port 1194
proto udp
server-bridge 10.0.0.1 255.255.240.0 10.0.10.1 10.0.10.255
persist-key
persist-tun
ca keys/ca.crt
cert keys/server.crt
key keys/server.key
dh keys/dh2048.pem
duplicate-cn #allow multiple connections from same client, they can have multiple devices at home
cipher AES-256-CBC
auth SHA512
compress lz4-v2
client-to-client
max-clients 255
user nobody
group nogroup
keepalive 10 120
log-append /var/log/openvpn.log
verb 4
/etc/openvpn/bridge/bridge-conf :
#!/bin/bash
eth="ens192"
eth_ip="10.0.0.51"
eth_netmask="255.255.240.0"
eth_broadcast="10.0.15.255"
eth_gateway="10.0.0.1"
eth_mac="0:0c:29:c4:7c:06"
br="br0"
tap="tap0"
/etc/openvpn/bridge/bridge-start :
#!/bin/bash
. /etc/openvpn/bridge/bridge-conf
for t in $tap; do
openvpn --mktun --dev $t
done
brctl addbr $br
brctl stp $br off
brctl setageing $br 0
brctl setfd $br 0
brctl addif $br $eth
for t in $tap; do
brctl addif $br $t
done
for t in $tap; do
ifconfig $t 0.0.0.0 promisc up
iptables -A INPUT -i $t -j ACCEPT
done
iptables -A INPUT -i $br -j ACCEPT
iptables -A FORWARD -i $br -j ACCEPT
ifconfig $eth 0.0.0.0 promisc up
ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast
ip link set $br address $eth_mac
route add default gw $eth_gateway $br
/etc/openvpn/bridge/bridge-stop :
#!/bin/bash
. /etc/openvpn/bridge/bridge-conf
iptables -D INPUT -i $br -j ACCEPT
iptables -D FORWARD -i $br -j ACCEPT
ifconfig $br down
brctl delbr $br
for t in $tap; do
openvpn --rmtun --dev $t
iptables -D INPUT -i $t -j ACCEPT
done
ifconfig $eth $eth_ip netmask $eth_netmask broadcast $eth_broadcast
route add default gw $eth_gateway $eth
/lib/systemd/system/openvpn-server@.service :
[Unit]
Description=OpenVPN server %I
Wants=syslog.target
Requires=network.target
After=network-online.target
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO
[Service]
PrivateTmp=true
Type=forking
PermissionsStartOnly=true
RuntimeDirectory=openvpn
ExecStartPre=/etc/openvpn/bridge/bridge-start
PIDFile=/run/openvpn/%i.pid
ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/server/ --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf --daemon --writepid /run/openvpn/%i.pid
ExecStopPost=/etc/openvpn/bridge/bridge-stop
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_AUDIT_WRITE
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw
ProtectSystem=true
ProtectHome=true
KillMode=process
RestartSec=5s
Restart=on-failure
[Install]
WantedBy=multi-user.target
/etc/network/interfaces :
auto lo
iface lo inet loopback
auto ens192
iface ens192 inet static
address 10.0.0.51/20
gateway 10.0.0.1
dns-nameservers 8.8.8.8 8.8.4.4
post-up route add default gw 10.0.0.1 metric 1000
/proc/sys/net/ipv4/ip_forward :
1
/var/log/openvpn.log (after OpenVPN server has started):
Current Parameter Settings:
config = 'bridge-server.conf'
mode = 1
persist_config = DISABLED
persist_mode = 1
show_ciphers = DISABLED
show_digests = DISABLED
show_engines = DISABLED
genkey = DISABLED
key_pass_file = '[UNDEF]'
show_tls_ciphers = DISABLED
connect_retry_max = 0
Connection profiles [0]:
proto = udp
local = '[UNDEF]'
local_port = '1194'
remote = '[UNDEF]'
remote_port = '1194'
remote_float = DISABLED
bind_defined = DISABLED
bind_local = ENABLED
bind_ipv6_only = DISABLED
connect_retry_seconds = 5
connect_timeout = 120
socks_proxy_server = '[UNDEF]'
socks_proxy_port = '[UNDEF]'
tun_mtu = 1500
tun_mtu_defined = ENABLED
link_mtu = 1500
link_mtu_defined = DISABLED
tun_mtu_extra = 32
tun_mtu_extra_defined = ENABLED
mtu_discover_type = -1
fragment = 0
mssfix = 1450
explicit_exit_notification = 0
Connection profiles END
remote_random = DISABLED
ipchange = '[UNDEF]'
dev = 'tap0'
dev_type = '[UNDEF]'
dev_node = '[UNDEF]'
lladdr = '[UNDEF]'
topology = 1
ifconfig_local = '[UNDEF]'
ifconfig_remote_netmask = '[UNDEF]'
ifconfig_noexec = DISABLED
ifconfig_nowarn = DISABLED
ifconfig_ipv6_local = '[UNDEF]'
ifconfig_ipv6_netbits = 0
ifconfig_ipv6_remote = '[UNDEF]'
shaper = 0
mtu_test = 0
mlock = DISABLED
keepalive_ping = 10
keepalive_timeout = 120
inactivity_timeout = 0
ping_send_timeout = 10
ping_rec_timeout = 240
ping_rec_timeout_action = 2
ping_timer_remote = DISABLED
remap_sigusr1 = 0
persist_tun = ENABLED
persist_local_ip = DISABLED
persist_remote_ip = DISABLED
persist_key = ENABLED
passtos = DISABLED
resolve_retry_seconds = 1000000000
resolve_in_advance = DISABLED
username = 'nobody'
groupname = 'nogroup'
chroot_dir = '[UNDEF]'
cd_dir = '/etc/openvpn/server/'
writepid = '/run/openvpn/bridge-server.pid'
up_script = '[UNDEF]'
down_script = '[UNDEF]'
down_pre = DISABLED
up_restart = DISABLED
up_delay = DISABLED
daemon = ENABLED
inetd = 0
log = ENABLED
suppress_timestamps = ENABLED
machine_readable_output = DISABLED
nice = 0
verbosity = 4
mute = 0
gremlin = 0
status_file = '/run/openvpn-server/status-bridge-server.log'
status_file_version = 2
status_file_update_freq = 60
occ = ENABLED
rcvbuf = 0
sndbuf = 0
mark = 0
sockflags = 0
fast_io = DISABLED
comp.alg = 11
comp.flags = 0
route_script = '[UNDEF]'
route_default_gateway = '[UNDEF]'
route_default_metric = 0
route_noexec = DISABLED
route_delay = 0
route_delay_window = 30
route_delay_defined = DISABLED
route_nopull = DISABLED
route_gateway_via_dhcp = DISABLED
allow_pull_fqdn = DISABLED
management_addr = '[UNDEF]'
management_port = '[UNDEF]'
management_user_pass = '[UNDEF]'
management_log_history_cache = 250
management_echo_buffer_size = 100
management_write_peer_info_file = '[UNDEF]'
management_client_user = '[UNDEF]'
management_client_group = '[UNDEF]'
management_flags = 0
shared_secret_file = '[UNDEF]'
key_direction = not set
ciphername = 'AES-256-CBC'
ncp_enabled = ENABLED
ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
authname = 'SHA512'
prng_hash = 'SHA1'
prng_nonce_secret_len = 16
keysize = 0
engine = DISABLED
replay = ENABLED
mute_replay_warnings = DISABLED
replay_window = 64
replay_time = 15
packet_id_file = '[UNDEF]'
use_iv = ENABLED
test_crypto = DISABLED
tls_server = ENABLED
tls_client = DISABLED
key_method = 2
ca_file = 'keys/ca.crt'
ca_path = '[UNDEF]'
dh_file = 'keys/dh2048.pem'
cert_file = 'keys/server.crt'
extra_certs_file = '[UNDEF]'
priv_key_file = 'keys/server.key'
pkcs12_file = '[UNDEF]'
cipher_list = '[UNDEF]'
cipher_list_tls13 = '[UNDEF]'
tls_cert_profile = '[UNDEF]'
tls_verify = '[UNDEF]'
tls_export_cert = '[UNDEF]'
verify_x509_type = 0
verify_x509_name = '[UNDEF]'
crl_file = '[UNDEF]'
ns_cert_type = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_eku = '[UNDEF]'
ssl_flags = 0
tls_timeout = 2
renegotiate_bytes = -1
renegotiate_packets = 0
renegotiate_seconds = 3600
handshake_window = 60
transition_window = 3600
single_session = DISABLED
push_peer_info = DISABLED
tls_exit = DISABLED
tls_auth_file = '[UNDEF]'
tls_crypt_file = '[UNDEF]'
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_pin_cache_period = -1
pkcs11_id = '[UNDEF]'
pkcs11_id_management = DISABLED
server_network = 0.0.0.0
server_netmask = 0.0.0.0
server_network_ipv6 = ::
server_netbits_ipv6 = 0
server_bridge_ip = 10.0.0.1
server_bridge_netmask = 255.255.240.0
server_bridge_pool_start = 10.0.10.1
server_bridge_pool_end = 10.0.10.255
push_entry = 'route-gateway 10.0.0.1'
push_entry = 'ping 10'
push_entry = 'ping-restart 120'
ifconfig_pool_defined = ENABLED
ifconfig_pool_start = 10.0.10.1
ifconfig_pool_end = 10.0.10.255
ifconfig_pool_netmask = 255.255.240.0
ifconfig_pool_persist_filename = '[UNDEF]'
ifconfig_pool_persist_refresh_freq = 600
ifconfig_ipv6_pool_defined = DISABLED
ifconfig_ipv6_pool_base = ::
ifconfig_ipv6_pool_netbits = 0
n_bcast_buf = 256
tcp_queue_limit = 64
real_hash_size = 256
virtual_hash_size = 256
client_connect_script = '[UNDEF]'
learn_address_script = '[UNDEF]'
client_disconnect_script = '[UNDEF]'
client_config_dir = '[UNDEF]'
ccd_exclusive = DISABLED
tmp_dir = '/tmp'
push_ifconfig_defined = DISABLED
push_ifconfig_local = 0.0.0.0
push_ifconfig_remote_netmask = 0.0.0.0
push_ifconfig_ipv6_defined = DISABLED
push_ifconfig_ipv6_local = ::/0
push_ifconfig_ipv6_remote = ::
enable_c2c = ENABLED
duplicate_cn = ENABLED
cf_max = 0
cf_per = 0
max_clients = 255
max_routes_per_client = 256
auth_user_pass_verify_script = '[UNDEF]'
auth_user_pass_verify_script_via_file = DISABLED
auth_token_generate = DISABLED
auth_token_lifetime = 0
port_share_host = '[UNDEF]'
port_share_port = '[UNDEF]'
client = DISABLED
pull = DISABLED
auth_user_pass_file = '[UNDEF]'
OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019
library versions: OpenSSL 1.1.1d 10 Sep 2019, LZO 2.10
NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Diffie-Hellman initialized with 2048 bit key
TLS-Auth MTU parms [ L:1654 D:1212 EF:38 EB:0 ET:0 EL:3 ]
TUN/TAP device tap0 opened
TUN/TAP TX queue length set to 100
Data Channel MTU parms [ L:1654 D:1450 EF:122 EB:411 ET:32 EL:3 ]
Could not determine IPv4/IPv6 protocol. Using AF_INET
Socket Buffers: R=[212992->212992] S=[212992->212992]
UDPv4 link local (bound): [AF_INET][undef]:1194
UDPv4 link remote: [AF_UNSPEC]
GID set to nogroup
UID set to nobody
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL: base=10.0.10.1 size=255, ipv6=0
Initialization Sequence Completed
ifconfig :
br0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.0.0.51 netmask 255.255.240.0 broadcast 10.0.15.255
inet6 fe80::20c:29ff:fec4:7c06 prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:c4:7c:06 txqueuelen 1000 (Ethernet)
RX packets 349 bytes 32826 (32.0 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 334 bytes 78912 (77.0 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
ens192: flags=4419<UP,BROADCAST,RUNNING,PROMISC,MULTICAST> mtu 1500
inet6 fe80::20c:29ff:fec4:7c06 prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:c4:7c:06 txqueuelen 1000 (Ethernet)
RX packets 59372 bytes 11927917 (11.3 MiB)
RX errors 0 dropped 116 overruns 0 frame 0
TX packets 18263 bytes 8078781 (7.7 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
tap0: flags=4419<UP,BROADCAST,RUNNING,PROMISC,MULTICAST> mtu 1500
inet6 fe80::c0a8:d6ff:fe12:97b1 prefixlen 64 scopeid 0x20<link>
ether c2:a8:d6:12:97:b1 txqueuelen 100 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 2005 bytes 461771 (450.9 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
brctl show :
bridge name bridge id STP enabled interfaces
br0 8000.000c29c47c06 no ens192
tap0
routing tables :
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 10.0.0.1 0.0.0.0 UG 0 0 0 br0
10.0.0.0 0.0.0.0 255.255.240.0 U 0 0 0 br0
iptables -L :
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
So far so good, everything seems fine to me here.
But then, I try to connect my client. Same config on macOS or on Linux, same results :
client
dev tap
proto udp
remote 22.33.44.55 1194
resolv-retry infinite
nobind
persist-key
persist-tun
cipher AES-256-CBC
auth SHA512
compress
verb 3
pull
<ca>
[redacted]
</ca>
<cert>
[redacted]
</cert>
<key>
[redacted]
</key>
Here's the log on the CLIENT:
2020-08-22 00:07:59 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
2020-08-22 00:07:59 OpenVPN 2.5_beta1 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Aug 18 2020
2020-08-22 00:07:59 library versions: OpenSSL 1.1.1g 21 Apr 2020, LZO 2.10
2020-08-22 00:07:59 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
2020-08-22 00:07:59 TCP/UDP: Preserving recently used remote address: [AF_INET]22.33.44.55:1194
2020-08-22 00:07:59 Socket Buffers: R=[786896->786896] S=[9216->9216]
2020-08-22 00:07:59 UDP link local: (not bound)
2020-08-22 00:07:59 UDP link remote: [AF_INET]22.33.44.55:1194
2020-08-22 00:07:59 TLS: Initial packet from [AF_INET]22.33.44.55, sid=09d7426e 16c68911
2020-08-22 00:07:59 VERIFY OK: depth=1, C=FR, ST=FR, L=Paris, O=redacted, OU=redacted, CN=redacted, name=redacted, emailAddress=redacted
2020-08-22 00:07:59 VERIFY OK: depth=0, C=FR, ST=FR, L=Paris, O= redacted, OU= redacted, CN= redacted, name= redacted, emailAddress= redacted
2020-08-22 00:07:59 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
2020-08-22 00:07:59 [redacted] Peer Connection Initiated with [AF_INET]22.33.44.55:1194
2020-08-22 00:08:00 SENT CONTROL [redacted]: 'PUSH_REQUEST' (status=1)
2020-08-22 00:08:00 PUSH: Received control message: 'PUSH_REPLY,route-gateway 10.0.0.1,ping 10,ping-restart 120,ifconfig 10.0.10.1 255.255.240.0,peer-id 0,cipher AES-256-GCM'
2020-08-22 00:08:00 OPTIONS IMPORT: timers and/or timeouts modified
2020-08-22 00:08:00 OPTIONS IMPORT: --ifconfig/up options modified
2020-08-22 00:08:00 OPTIONS IMPORT: route-related options modified
2020-08-22 00:08:00 OPTIONS IMPORT: peer-id set
2020-08-22 00:08:00 OPTIONS IMPORT: adjusting link_mtu to 1657
2020-08-22 00:08:00 OPTIONS IMPORT: data channel crypto options modified
2020-08-22 00:08:00 Data Channel: using negotiated cipher 'AES-256-GCM'
2020-08-22 00:08:00 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2020-08-22 00:08:00 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2020-08-22 00:08:00 TUN/TAP device /dev/tap0 opened
2020-08-22 00:08:00 /sbin/ifconfig tap0 delete
ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2020-08-22 00:08:00 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2020-08-22 00:08:00 /sbin/ifconfig tap0 10.0.10.1 netmask 255.255.240.0 mtu 1500 up
2020-08-22 00:08:00 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2020-08-22 00:08:00 Initialization Sequence Completed
and on the SERVER :
MULTI: multi_create_instance called
66.77.88.99:58565 Re-using SSL/TLS context
66.77.88.99:58565 LZ4v2 compression initializing
66.77.88.99:58565 Control Channel MTU parms [ L:1654 D:1212 EF:38 EB:0 ET:0 EL:3 ]
66.77.88.99:58565 Data Channel MTU parms [ L:1654 D:1450 EF:122 EB:411 ET:32 EL:3 ]
66.77.88.99:58565 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1634,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
66.77.88.99:58565 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1634,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
66.77.88.99:58565 TLS: Initial packet from [AF_INET]66.77.88.99:58565, sid=5347f74c 4cc797f1
66.77.88.99:58565 VERIFY OK: depth=1, C=FR, ST=FR, L=Paris, O=redacted, OU= redacted, CN= redacted, name= redacted, emailAddress= redacted
66.77.88.99:58565 VERIFY OK: depth=0, C=FR, ST=FR, L=Paris, O= redacted, OU= redacted, CN= redacted, name= redacted, emailAddress= redacted
66.77.88.99:58565 peer info: IV_VER=2.5_beta1
66.77.88.99:58565 peer info: IV_PLAT=mac
66.77.88.99:58565 peer info: IV_PROTO=6
66.77.88.99:58565 peer info: IV_NCP=2
66.77.88.99:58565 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM:AES-256-CBC
66.77.88.99:58565 peer info: IV_LZ4=1
66.77.88.99:58565 peer info: IV_LZ4v2=1
66.77.88.99:58565 peer info: IV_LZO=1
66.77.88.99:58565 peer info: IV_COMP_STUB=1
66.77.88.99:58565 peer info: IV_COMP_STUBv2=1
66.77.88.99:58565 peer info: IV_TCPNL=1
66.77.88.99:58565 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
66.77.88.99:58565 [clegrand] Peer Connection Initiated with [AF_INET]66.77.88.99:58565
clegrand/66.77.88.99:58565 MULTI_sva: pool returned IPv4=10.0.10.1, IPv6=(Not enabled)
clegrand/66.77.88.99:58565 PUSH: Received control message: 'PUSH_REQUEST'
clegrand/66.77.88.99:58565 SENT CONTROL [clegrand]: 'PUSH_REPLY,route-gateway 10.0.0.1,ping 10,ping-restart 120,ifconfig 10.0.10.1 255.255.240.0,peer-id 0,cipher AES-256-GCM' (status=1)
clegrand/66.77.88.99:58565 Data Channel: using negotiated cipher 'AES-256-GCM'
clegrand/66.77.88.99:58565 Data Channel MTU parms [ L:1582 D:1450 EF:50 EB:411 ET:32 EL:3 ]
clegrand/66.77.88.99:58565 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
clegrand/66.77.88.99:58565 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
clegrand/66.77.88.99:58565 MULTI: Learn: 1e:3e:39:77:fe:97 -> clegrand/66.77.88.99:58565
My client's ifconfig:
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=400<CHANNEL_IO>
ether 14:7d:da:28:ed:a5
inet 192.168.21.172 netmask 0xffffff00 broadcast 192.168.21.255
media: autoselect
status: active
tap0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
ether 2a:d9:5f:eb:bf:a4
inet 10.0.10.3 netmask 0xfffff000 broadcast 10.0.15.255
media: autoselect
status: active
open (pid 14521)
My client's routing tables:
Destination Gateway Flags Netif Expire
default 192.168.21.254 UGSc en0
10/20 link#23 UC tap0 !
127 127.0.0.1 UCS lo0
127.0.0.1 127.0.0.1 UH lo0
169.254 link#10 UCS en0 !
169.254.11.195 link#10 UHRLSW en0 !
192.168.21 link#10 UCS en0 !
192.168.21.20 a4:e9:75:37:a6:60 UHLWI en0 !
192.168.21.254 0:24:d4:a3:b7:7b UHLWIir en0 1172
224.0.0/4 link#10 UmCS en0 !
224.0.0.251 1:0:5e:0:0:fb UHmLWI en0
255.255.255.255/32 link#10 UCS en0 !
The bridge (on the server) says it's forwarding fine:
br0
bridge id 8000.000c29c47c06
designated root 8000.000c29c47c06
root port 0 path cost 0
max age 20.00 bridge max age 20.00
hello time 2.00 bridge hello time 2.00
forward delay 0.00 bridge forward delay 0.00
ageing time 0.00
hello timer 0.00 tcn timer 0.00
topology change timer 0.00 gc timer 0.00
flags
ens192 (1)
port id 8001 state forwarding
designated root 8000.000c29c47c06 path cost 2
designated bridge 8000.000c29c47c06 message age timer 0.00
designated port 8001 forward delay timer 0.00
designated cost 0 hold timer 0.00
flags
tap0 (2)
port id 8002 state forwarding
designated root 8000.000c29c47c06 path cost 100
designated bridge 8000.000c29c47c06 message age timer 0.00
designated port 8002 forward delay timer 0.00
designated cost 0 hold timer 0.00
flags
Again, everything seems perfectly fine here.
Except that… I can't ping anything through tap0.
Client to server? `ping 10.0.0.51`… nope.
Server to client? `ping 10.0.10.1`… nope.
Client to server's gateway? `ping 10.0.0.1`… nope.
Client to any other machine on the server's lan? don't even dream about it.
Routing tables seem fine to me, but nothing goes through the pipe. The connection is made perfectly, everything falls in its place, no hiccups, but I tried all kind of variations of the server.conf I could imagine… to no avail.
What bugs me is that I have the same setup working on our "old" server. Only difference is that this time, my OpenVPN server is a VM, but as I said first, ESXi has promiscuous mode enabled.
It's been three days I'm on this, I've read countless pages of documentation and as many discussions here. It's driving me nuts.
