Hey guys, I did my best the last couple of days and finally was able to connect to the openvpn server I hosted on my remote machine. But going through the log I see really many packages getting dropped all the time. Could someone tell me what these packages are and why do they even get to the remote in the first place?? I guess I still have errors in my configs or routing? :/ My setup: iptables: ($INTERFACE variable is basicly eth0 on the remote machine, PROTOCOL_TYPE is udp) # accept traffic for our chosen protocol and port iptables -A INPUT -i $INTERFACE -p $OPENVPN_PROTOCOL_TYPE -m state \ --state NEW,ESTABLISHED --dport 1194 -j ACCEPT iptables -A OUTPUT -o $INTERFACE -p $OPENVPN_PROTOCOL_TYPE -m state \ --state ESTABLISHED --sport 1194 -j ACCEPT # enable traffic for our tunnel iptables -A INPUT -i tun0 -j ACCEPT iptables -A FORWARD -i tun0 -o $INTERFACE -s 10.8.0.0/24 -j ACCEPT iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -o tun0 -j ACCEPT # enable nat routing all the traffic from 10.8.0.0 which is our openvpn subnet # to route through our interface that is connected to the internet. iptables -t nat -A POSTROUTING -o $INTERFACE -s 10.8.0.0/24 -j MASQUERADE [oconf=server.conf] port 1194 proto udp dev tun ca ca.crt cert server.crt key server.key # This file should be kept secret tls-crypt tls-crypt.key auth SHA512 tls-version-min 1.2 tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256 ncp-ciphers AES-256-GCM:AES-256-CBC dh dh2048.pem topology subnet server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "redirect-gateway" keepalive 10 60 user nobody group nogroup persist-key persist-tun status openvpn-status.log log-append openvpn.log verb 4 explicit-exit-notify 1 [/oconf] [oconf=client.conf] client dev tun proto udp remote remote-server-ip-was-here 1194 resolv-retry infinite nobind user nobody group nogroup persist-key persist-tun ca ca.crt cert client.crt key client.key tls-crypt tls-crypt.key auth SHA512 remote-cert-tls server verb 4 log-append /etc/openvpn/openvpn.log [/oconf] and my server log: (the 10.0.2.15 is my eth0 interface of the host machine! I think somehow, some packages are NOT tunneled and just get sent by the eth0 interface? Do I understand this correctly?); curl icanhazip.com does return the ip of the remote openvpn server, so I am a bit confused. [code] Mon Oct 12 02:41:32 2020 us=792279 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped Mon Oct 12 02:41:46 2020 us=460384 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped Mon Oct 12 02:41:59 2020 us=921390 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped Mon Oct 12 02:42:12 2020 us=754330 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped Mon Oct 12 02:42:26 2020 us=167819 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped Mon Oct 12 02:42:40 2020 us=93626 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped Mon Oct 12 02:42:53 2020 us=57154 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped Mon Oct 12 02:43:06 2020 us=524180 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped Mon Oct 12 02:43:19 2020 us=491688 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped Mon Oct 12 02:43:33 2020 us=233448 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped Mon Oct 12 02:43:47 2020 us=740103 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped Mon Oct 12 02:44:00 2020 us=755721 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped Mon Oct 12 02:44:14 2020 us=292813 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped [/code] any help or tips are appreciated! greetings

package loss after connecting to openvpn server

xddq

Hey guys,

I did my best the last couple of days and finally was able to connect to the openvpn server I hosted on my remote machine. But going through the log I see really many packages getting dropped all the time.

Could someone tell me what these packages are and why do they even get to the remote in the first place?? I guess I still have errors in my configs or routing? :/

My setup:

iptables: ($INTERFACE variable is basicly eth0 on the remote machine, PROTOCOL_TYPE is udp)
# accept traffic for our chosen protocol and port
iptables -A INPUT -i $INTERFACE -p $OPENVPN_PROTOCOL_TYPE -m state \
--state NEW,ESTABLISHED --dport 1194 -j ACCEPT
iptables -A OUTPUT -o $INTERFACE -p $OPENVPN_PROTOCOL_TYPE -m state \
--state ESTABLISHED --sport 1194 -j ACCEPT

# enable traffic for our tunnel
iptables -A INPUT -i tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o $INTERFACE -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o tun0 -j ACCEPT

# enable nat routing all the traffic from 10.8.0.0 which is our openvpn subnet
# to route through our interface that is connected to the internet.
iptables -t nat -A POSTROUTING -o $INTERFACE -s 10.8.0.0/24 -j MASQUERADE

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
tls-crypt tls-crypt.key
auth SHA512
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256
ncp-ciphers AES-256-GCM:AES-256-CBC
dh dh2048.pem
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway"
keepalive 10 60
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 4
explicit-exit-notify 1

client
dev tun
proto udp
remote remote-server-ip-was-here 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
tls-crypt tls-crypt.key
auth SHA512
remote-cert-tls server
verb 4
log-append /etc/openvpn/openvpn.log

and my server log:
(the 10.0.2.15 is my eth0 interface of the host machine! I think somehow, some packages are NOT tunneled and just get sent by the eth0 interface? Do I understand this correctly?); curl icanhazip.com does return the ip of the remote openvpn server, so I am a bit confused.

Mon Oct 12 02:41:32 2020 us=792279 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped
Mon Oct 12 02:41:46 2020 us=460384 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped
Mon Oct 12 02:41:59 2020 us=921390 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped
Mon Oct 12 02:42:12 2020 us=754330 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped
Mon Oct 12 02:42:26 2020 us=167819 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped
Mon Oct 12 02:42:40 2020 us=93626 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped
Mon Oct 12 02:42:53 2020 us=57154 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped
Mon Oct 12 02:43:06 2020 us=524180 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped
Mon Oct 12 02:43:19 2020 us=491688 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped
Mon Oct 12 02:43:33 2020 us=233448 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped
Mon Oct 12 02:43:47 2020 us=740103 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped
Mon Oct 12 02:44:00 2020 us=755721 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped
Mon Oct 12 02:44:14 2020 us=292813 client2/my-public-ip-was-here:58264 MULTI: bad source address from client [10.0.2.15], packet dropped

any help or tips are appreciated!
greetings

TinCanTech

xddq wrote the 10.0.2.15 is my eth0 interface of the host machine

These are packets with source IP address of your client ethernet.

You can ignore them or setup an --iroute for them.

Or you can figure out what application is sending them and configure it correctly.

xddq

Hey Tin!

Thanks for your reply. I did somewhat analyze my traffic using tcpdump. The dropped packages came from some firefox scripts posting GET requests using the default gateway of my interface instead of the tunnel.

The "error" did resolve when start running openvpn AFTER having closed any open browsers.

greetings

Pippin

If you want to prevent that, you possibly could use an up script that flushes established connections.