No IP change and a "CONNECTED SUCCESS" message

youdsmedia

Hi

I have been working on changing my VPN from UDP to TCP (mainly due to dropouts) and it is saying all the right things when connecting, like TCP Auth etc , but when it connects my IP address does not change. With UDP, it does.

So steps I have taken:
- Adjusted server.conf set proto to "tcp-server"
- Switched to "tcp" in router firmware
- Waited 24h

Hopefully someone can help!

youdsmedia

Here is server config file:

port 1194
proto tcp-server
dev tun
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/vpn.gethosted.online.crt
dh /etc/openvpn/server/dh2048.pem
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-to-client
keepalive 10 120
auth sha256
cipher AES-256-CBC
persist-key
persist-tun
status openvpn-status.log
verb 4
explicit-exit-notify 0
fast-io
tun-mtu 1500

With client matching.

300000

you need to add this line on server config and connect again , maybe when you add this you cant go to internet.

push "redirect-gateway def1 bypass-dhcp"

youdsmedia

Ah, I had seen this before but assumed it was client based. Thanks.

What did you mean about the possibility of no internet?

Kind regards

300000

youdsmedia wrote Ah, I had seen this before but assumed it was client based. Thanks.

What did you mean about the possibility of no internet?

Kind regards

yes . it depend on your server set up may be stop internet at client . but if you can do it carefully it should work as you like

youdsmedia

300000 wrote
youdsmedia wrote Ah, I had seen this before but assumed it was client based. Thanks.

What did you mean about the possibility of no internet?

Kind regards
yes . it depend on your server set up may be stop internet at client . but if you can do it carefully it should work as you like

So I tried that as suggested, my config follows:

port 1194
proto tcp-server
push "redirect-gateway def1 bypass-dhcp"
dev tun
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/vpn.gethosted.online.crt
dh /etc/openvpn/server/dh2048.pem
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-to-client
keepalive 10 120
auth sha256
cipher AES-256-CBC
persist-key
persist-tun
status openvpn-status.log
verb 4
explicit-exit-notify 0
fast-io
tun-mtu 1500

However, this did not work. Restarted router and VPN server (shutdown -r now) but no changes. It has been the case where it takes time for the router to start using the vpn, also I'm not sure if push "..." is required or if I can use the contents of push="..." in my server config - trying that now.

Kind regards

edit: basically, I tried adding push to the openvpn command being used and no change, IP address still the one seen by ISP - however to be fair, the UDP protocol exhibited this behaviour as well.

300000

your ip address have been changed but you connection still use dns from your ISP so they block your to access ban website , if you want to access that block website you need change your dns from somewhere and dont use dns server from your ISP , let add this into your server config and it should word

push " block-outside-dns"
push "dhcp-option DNS  1.1.1.1"

youdsmedia

Hi

So I did that, rebooted my VPN server and my router, same symptoms. I can visit websites etc but when I log in via SSH it states last accessed IP was my ISP's or if I check to see my IP address as reported by Google, it shows the ISP's IP - not the VPN IP.

My current setup:
- OpenVPN 2.4.9 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 24 2020
- Router Firmware: DD-WRT v3.0-r44700 std (10/30/20)

300000

if you ve done all config and can connect but not change ip so you should ask do you really using openvpn or direct ?how about dns and client is dd wrt router until now you say it work but nothing change , so let check it yourself

youdsmedia

I took a glance around and couldn’t find anywhere to set dns servers in dd-wrt. Puzzled as only change is udp to tcp. I should probably get UDP back up and running then switch to tcp with minimal steps, to be sure there is no conflict elsewhere.

youdsmedia

OK

I have tried the following steps with no changes:
- Restored VPN Server To Last Working State
- Restored Firmware Backup To Last Working State
- Waited 24h (twice)

There is no change. This leads me to thinking it must be the firmware itself, so I'm going to try and reset that now.

youdsmedia

OK, so I reset my router firmware (2 or 3 times) and then upgraded to the very latest version (20/11/2020) but there is no change.

youdsmedia

Anybody able to shed some light on this?

TinCanTech

See your logs, please see:
https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p68963

youdsmedia

OS Information (server)

Linux my.server.com 4.18.0-147.3.1.el8_1.x86_64 #1 SMP Fri Jan 3 23:55:26 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

Server Conf:

port 1194
proto udp
push "redirect-gateway def1 bypass-dhcp"
push "block-outside-dns"
push "dhcp-option DNS 1.1.1.1"
verb 4
dev tun
ca ca.crt
cert my.server.com.crt
dh dh2048.pem
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-to-client
keepalive 10 120
auth sha256
cipher AES-256-CBC
persist-key
persist-tun
status openvpn-status.log
verb 4
explicit-exit-notify 1
fast-io
tun-mtu 1500

Server Log:

TITLE,OpenVPN 2.4.9 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 24 2020
TIME,Mon Nov 23 04:34:59 2020,1606106099
HEADER,CLIENT_LIST,Common Name,Real Address,Virtual Address,Virtual IPv6 Address,Bytes Received,Bytes Sent,Connected Since,Connected Since (time_t),Username,Client ID,Peer ID
HEADER,ROUTING_TABLE,Virtual Address,Common Name,Real Address,Last Ref,Last Ref (time_t)
GLOBAL_STATS,Max bcast/mcast queue length,0
END

Client Config:

ca /tmp/openvpncl/ca.crt
cert /tmp/openvpncl/client.crt
key /tmp/openvpncl/client.key
management 127.0.0.1 16
management-log-cache 100
verb 3
mute 3
syslog
writepid /var/run/openvpncl.pid
client
resolv-retry infinite
nobind
persist-key
persist-tun
script-security 2
dev tun1
proto udp4
cipher CHACHA20-POLY1305
auth sha256
data-ciphers AES-128-GCM:AES-256-GCM:AES-128-CBC
remote my.server.com 1194
redirect-private def1
pull-filter ignore "redirect-gateway"
tls-client
tun-mtu 1500
mtu-disc yes
fast-io
tls-auth /tmp/openvpncl/ta.key 1
tls-cipher TLS-RSA-WITH-AES-256-CBC-SHA256
route-up /tmp/openvpncl/route-up.sh
route-pre-down /tmp/openvpncl/route-down.sh
verb 4

Client Log:

20201123 05:34:39 N Connection reset command was pushed by server ('') 
20201123 05:34:39 TCP/UDP: Closing socket 
20201123 05:34:39 I SIGUSR1[soft server-pushed-connection-reset] received process restarting 
20201123 05:34:39 Restart pause 5 second(s) 
20201123 05:34:44 W WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info. 
20201123 05:34:44 W NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 
20201123 05:34:44 Re-using SSL/TLS context 
20201123 05:34:44 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication 
20201123 05:34:44 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication 
20201123 05:34:44 Control Channel MTU parms [ L:1621 D:1172 EF:78 EB:0 ET:0 EL:3 ] 
20201123 05:34:44 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ] 
20201123 05:34:44 Local Options String (VER=V4): 'V4 dev-type tun link-mtu 1534 tun-mtu 1500 proto UDPv4 keydir 1 cipher CHACHA20-POLY1305 auth [null-digest] keysize 256 tls-auth key-method 2 tls-client' 
20201123 05:34:44 Expected Remote Options String (VER=V4): 'V4 dev-type tun link-mtu 1534 tun-mtu 1500 proto UDPv4 keydir 0 cipher CHACHA20-POLY1305 auth [null-digest] keysize 256 tls-auth key-method 2 tls-server' 
20201123 05:34:44 I TCP/UDP: Preserving recently used remote address: [AF_INET]XX.XX.XX.XX:1194 
20201123 05:34:44 Socket Buffers: R=[180224->180224] S=[180224->180224] 
20201123 05:34:44 I UDPv4 link local: (not bound) 
20201123 05:34:44 I UDPv4 link remote: [AF_INET]XX.XX.XX.XX:1194 
20201123 05:35:15 TLS: Initial packet from [AF_INET]XX.XX.XX.XX:1194 sid=b70e2534 775d4022 
20201123 05:35:15 VERIFY OK: depth=0 CN=my.server.com 
20201123 05:35:15 W WARNING: 'link-mtu' is used inconsistently local='link-mtu 1534' remote='link-mtu 1569' 
20201123 05:35:15 W WARNING: 'auth' is used inconsistently local='auth [null-digest]' remote='auth SHA256' 
20201123 05:35:15 Control Channel: TLSv1.3 cipher TLSv1.3 TLS_AES_256_GCM_SHA384 2048 bit RSA 
20201123 05:35:15 I [my.server.com] Peer Connection Initiated with [AF_INET]XX.XX.XX.XX:1194 
20201123 05:35:16 SENT CONTROL [my.server.com]: 'PUSH_REQUEST' (status=1) 
20201123 05:35:16 PUSH: Received control message: 'PUSH_REPLY redirect-gateway def1 bypass-dhcp block-outside-dns dhcp-option DNS 1.1.1.1 route-gateway 10.8.0.1 topology subnet ping 10 ping-restart 120 ifconfig 10.8.0.4 255.255.255.0 peer-id 0 cipher AES-256-GCM' 
20201123 05:35:16 Pushed option removed by filter: 'redirect-gateway def1 bypass-dhcp' 
20201123 05:35:16 N Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:2: block-outside-dns (2.5.0) 
20201123 05:35:16 OPTIONS IMPORT: timers and/or timeouts modified 
20201123 05:35:16 OPTIONS IMPORT: --ifconfig/up options modified 
20201123 05:35:16 OPTIONS IMPORT: route-related options modified 
20201123 05:35:16 NOTE: --mute triggered... 
20201123 05:35:16 4 variation(s) on previous 3 message(s) suppressed by --mute 
20201123 05:35:16 Data Channel: using negotiated cipher 'AES-256-GCM' 
20201123 05:35:16 Data Channel MTU parms [ L:1552 D:1450 EF:52 EB:406 ET:0 EL:3 ] 
20201123 05:35:16 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 
20201123 05:35:16 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 
20201123 05:35:16 I Preserving previous TUN/TAP instance: tun1 
20201123 05:35:16 I Initialization Sequence Completed

youdsmedia

Appears to be directly connected as my VPN causes failure with a backup script using rclone when using the 1.1.1.1 DNS config.

youdsmedia

So - agh. I am stuck. Tried on irc://irc.freenode.net/openvpn but the standard stuff (such as def1) is being used.

Here is where I'm at:
- VPN is working as it breaks rclone locally when run with a specified dns server
- My VPN server IP is not visible to the public

I found a neat tool for logging, see below.

Current Parameter Settings:
  config = 'server.conf'
  mode = 1
  persist_config = DISABLED
  persist_mode = 1
  show_ciphers = DISABLED
  show_digests = DISABLED
  show_engines = DISABLED
  genkey = DISABLED
  key_pass_file = '[UNDEF]'
  show_tls_ciphers = DISABLED
  connect_retry_max = 0
Connection profiles [0]:
  proto = tcp-server
  local = '[UNDEF]'
  local_port = '1194'
  remote = '[UNDEF]'
  remote_port = '1194'
  remote_float = DISABLED
  bind_defined = DISABLED
  bind_local = ENABLED
  bind_ipv6_only = DISABLED
  connect_retry_seconds = 5
  connect_timeout = 120
  socks_proxy_server = '[UNDEF]'
  socks_proxy_port = '[UNDEF]'
  tun_mtu = 1500
  tun_mtu_defined = ENABLED
  link_mtu = 1500
  link_mtu_defined = DISABLED
  tun_mtu_extra = 0
  tun_mtu_extra_defined = DISABLED
  mtu_discover_type = -1
  fragment = 0
  mssfix = 1450
  explicit_exit_notification = 0
Connection profiles END
  remote_random = DISABLED
  ipchange = '[UNDEF]'
  dev = 'tun'
  dev_type = '[UNDEF]'
  dev_node = '[UNDEF]'
  lladdr = '[UNDEF]'
  topology = 3
  ifconfig_local = '10.8.0.1'
  ifconfig_remote_netmask = '255.255.255.0'
  ifconfig_noexec = DISABLED
  ifconfig_nowarn = DISABLED
  ifconfig_ipv6_local = '[UNDEF]'
  ifconfig_ipv6_netbits = 0
  ifconfig_ipv6_remote = '[UNDEF]'
  shaper = 0
  mtu_test = 0
  mlock = DISABLED
  keepalive_ping = 10
  keepalive_timeout = 120
  inactivity_timeout = 0
  ping_send_timeout = 10
  ping_rec_timeout = 240
  ping_rec_timeout_action = 2
  ping_timer_remote = DISABLED
  remap_sigusr1 = 0
  persist_tun = ENABLED
  persist_local_ip = DISABLED
  persist_remote_ip = DISABLED
  persist_key = ENABLED
  passtos = DISABLED
  resolve_retry_seconds = 1000000000
  resolve_in_advance = DISABLED
  username = '[UNDEF]'
  groupname = '[UNDEF]'
  chroot_dir = '[UNDEF]'
  cd_dir = '[UNDEF]'
  selinux_context = '[UNDEF]'
  writepid = '[UNDEF]'
  up_script = '[UNDEF]'
  down_script = '[UNDEF]'
  down_pre = DISABLED
  up_restart = DISABLED
  up_delay = DISABLED
  daemon = DISABLED
  inetd = 0
  log = ENABLED
  suppress_timestamps = ENABLED
  machine_readable_output = DISABLED
  nice = 0
  verbosity = 4
  mute = 0
  gremlin = 0
  status_file = 'openvpn-status.log'
  status_file_version = 2
  status_file_update_freq = 60
  occ = ENABLED
  rcvbuf = 0
  sndbuf = 0
  mark = 0
  sockflags = 0
  fast_io = ENABLED
  comp.alg = 0
  comp.flags = 0
  route_script = '[UNDEF]'
  route_default_gateway = '10.8.0.2'
  route_default_metric = 0
  route_noexec = DISABLED
  route_delay = 0
  route_delay_window = 30
  route_delay_defined = DISABLED
  route_nopull = DISABLED
  route_gateway_via_dhcp = DISABLED
  allow_pull_fqdn = DISABLED
  management_addr = '[UNDEF]'
  management_port = '[UNDEF]'
  management_user_pass = '[UNDEF]'
  management_log_history_cache = 250
  management_echo_buffer_size = 100
  management_write_peer_info_file = '[UNDEF]'
  management_client_user = '[UNDEF]'
  management_client_group = '[UNDEF]'
  management_flags = 0
  shared_secret_file = '[UNDEF]'
  key_direction = 0
  ciphername = 'AES-256-CBC'
  ncp_enabled = ENABLED
  ncp_ciphers = 'AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:BF-CBC'
  authname = 'sha256'
  prng_hash = 'SHA1'
  prng_nonce_secret_len = 16
  keysize = 0
  engine = DISABLED
  replay = ENABLED
  mute_replay_warnings = DISABLED
  replay_window = 64
  replay_time = 15
  packet_id_file = '[UNDEF]'
  use_iv = ENABLED
  test_crypto = DISABLED
  tls_server = ENABLED
  tls_client = DISABLED
  key_method = 2
  ca_file = 'ca.crt'
  ca_path = '[UNDEF]'
  dh_file = 'dh2048.pem'
  cert_file = 'my.server.com.crt'
  extra_certs_file = '[UNDEF]'
  priv_key_file = 'my.server.com.key'
  pkcs12_file = '[UNDEF]'
  cipher_list = '[UNDEF]'
  cipher_list_tls13 = '[UNDEF]'
  tls_cert_profile = '[UNDEF]'
  tls_verify = '[UNDEF]'
  tls_export_cert = '[UNDEF]'
  verify_x509_type = 0
  verify_x509_name = '[UNDEF]'
  crl_file = '[UNDEF]'
  ns_cert_type = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_eku = '[UNDEF]'
  ssl_flags = 0
  tls_timeout = 2
  renegotiate_bytes = -1
  renegotiate_packets = 0
  renegotiate_seconds = 3600
  handshake_window = 60
  transition_window = 3600
  single_session = DISABLED
  push_peer_info = DISABLED
  tls_exit = DISABLED
  tls_auth_file = 'ta.key'
  tls_crypt_file = '[UNDEF]'
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_pin_cache_period = -1
  pkcs11_id = '[UNDEF]'
  pkcs11_id_management = DISABLED
  server_network = 10.8.0.0
  server_netmask = 255.255.255.0
  server_network_ipv6 = ::
  server_netbits_ipv6 = 0
  server_bridge_ip = 0.0.0.0
  server_bridge_netmask = 0.0.0.0
  server_bridge_pool_start = 0.0.0.0
  server_bridge_pool_end = 0.0.0.0
  push_entry = 'block-outside-dns'
  push_entry = 'redirect-gateway def1'
  push_entry = 'route-gateway 10.8.0.1'
  push_entry = 'topology subnet'
  push_entry = 'ping 10'
  push_entry = 'ping-restart 120'
  ifconfig_pool_defined = ENABLED
  ifconfig_pool_start = 10.8.0.2
  ifconfig_pool_end = 10.8.0.253
  ifconfig_pool_netmask = 255.255.255.0
  ifconfig_pool_persist_filename = 'ipp.txt'
  ifconfig_pool_persist_refresh_freq = 600
  ifconfig_ipv6_pool_defined = DISABLED
  ifconfig_ipv6_pool_base = ::
  ifconfig_ipv6_pool_netbits = 0
  n_bcast_buf = 256
  tcp_queue_limit = 64
  real_hash_size = 256
  virtual_hash_size = 256
  client_connect_script = '[UNDEF]'
  learn_address_script = '[UNDEF]'
  client_disconnect_script = '[UNDEF]'
  client_config_dir = '[UNDEF]'
  ccd_exclusive = DISABLED
  tmp_dir = '/tmp'
  push_ifconfig_defined = DISABLED
  push_ifconfig_local = 0.0.0.0
  push_ifconfig_remote_netmask = 0.0.0.0
  push_ifconfig_ipv6_defined = DISABLED
  push_ifconfig_ipv6_local = ::/0
  push_ifconfig_ipv6_remote = ::
  enable_c2c = ENABLED
  duplicate_cn = DISABLED
  cf_max = 0
  cf_per = 0
  max_clients = 1024
  max_routes_per_client = 256
  auth_user_pass_verify_script = '[UNDEF]'
  auth_user_pass_verify_script_via_file = DISABLED
  auth_token_generate = DISABLED
  auth_token_lifetime = 0
  port_share_host = '[UNDEF]'
  port_share_port = '[UNDEF]'
  client = DISABLED
  pull = DISABLED
  auth_user_pass_file = '[UNDEF]'
OpenVPN 2.4.9 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 24 2020
library versions: OpenSSL 1.1.1c FIPS  28 May 2019, LZO 2.08
NOTE: --fast-io is disabled since we are not using UDP
Diffie-Hellman initialized with 2048 bit key
Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
TLS-Auth MTU parms [ L:1623 D:1170 EF:80 EB:0 ET:0 EL:3 ]
TUN/TAP device tun0 opened
TUN/TAP TX queue length set to 100
do_ifconfig, tt->did_ifconfig_ipv6_setup=0
/sbin/ip link set dev tun0 up mtu 1500
/sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
Data Channel MTU parms [ L:1623 D:1450 EF:123 EB:406 ET:0 EL:3 ]
Could not determine IPv4/IPv6 protocol. Using AF_INET
Socket Buffers: R=[87380->87380] S=[16384->16384]
Listening for incoming TCP connection on [AF_INET][undef]:1194
TCPv4_SERVER link local (bound): [AF_INET][undef]:1194
TCPv4_SERVER link remote: [AF_UNSPEC]
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
ifconfig_pool_read(), in='wrt-router.net,10.8.0.4', TODO: IPv6
succeeded -> ifconfig_pool_set()
IFCONFIG POOL LIST
wrt-router.net,10.8.0.4
MULTI: TCP INIT maxclients=1024 maxevents=1028
Initialization Sequence Completed
MULTI: multi_create_instance called
Re-using SSL/TLS context
Control Channel MTU parms [ L:1623 D:1170 EF:80 EB:0 ET:0 EL:3 ]
Data Channel MTU parms [ L:1623 D:1450 EF:123 EB:406 ET:0 EL:3 ]
Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1571,tun-mtu 1500,proto TCPv4_SERVER,keydir 0,cipher AES-256-CBC,auth SHA256,keysize 256,tls-auth,key-method 2,tls-server'
Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1571,tun-mtu 1500,proto TCPv4_CLIENT,keydir 1,cipher AES-256-CBC,auth SHA256,keysize 256,tls-auth,key-method 2,tls-client'
TCP connection established with [AF_INET]84.65.183.175:51866
TCPv4_SERVER link local: (not bound)
TCPv4_SERVER link remote: [AF_INET]84.65.183.175:51866
84.65.183.175:51866 TLS: Initial packet from [AF_INET]84.65.183.175:51866, sid=c033c1b0 73a66ba7
84.65.183.175:51866 VERIFY OK: depth=1, CN=my.server.com
84.65.183.175:51866 VERIFY OK: depth=0, CN=wrt-router.net
84.65.183.175:51866 peer info: IV_VER=2.5.0
84.65.183.175:51866 peer info: IV_PLAT=linux
84.65.183.175:51866 peer info: IV_PROTO=6
84.65.183.175:51866 peer info: IV_NCP=2
84.65.183.175:51866 peer info: IV_CIPHERS=AES-128-GCM:AES-256-GCM:AES-128-CBC:CHACHA20-POLY1305
84.65.183.175:51866 peer info: IV_LZ4=1
84.65.183.175:51866 peer info: IV_LZ4v2=1
84.65.183.175:51866 peer info: IV_LZO=1
84.65.183.175:51866 peer info: IV_COMP_STUB=1
84.65.183.175:51866 peer info: IV_COMP_STUBv2=1
84.65.183.175:51866 peer info: IV_TCPNL=1
84.65.183.175:51866 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1571', remote='link-mtu 1536'
84.65.183.175:51866 WARNING: 'cipher' is used inconsistently, local='cipher AES-256-CBC', remote='cipher CHACHA20-POLY1305'
84.65.183.175:51866 WARNING: 'auth' is used inconsistently, local='auth SHA256', remote='auth [null-digest]'
84.65.183.175:51866 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
84.65.183.175:51866 [wrt-router.net] Peer Connection Initiated with [AF_INET]84.65.183.175:51866
wrt-router.net/84.65.183.175:51866 MULTI_sva: pool returned IPv4=10.8.0.4, IPv6=(Not enabled)
wrt-router.net/84.65.183.175:51866 MULTI: Learn: 10.8.0.4 -> wrt-router.net/84.65.183.175:51866
wrt-router.net/84.65.183.175:51866 MULTI: primary virtual IP for wrt-router.net/84.65.183.175:51866: 10.8.0.4
wrt-router.net/84.65.183.175:51866 PUSH: Received control message: 'PUSH_REQUEST'
wrt-router.net/84.65.183.175:51866 SENT CONTROL [wrt-router.net]: 'PUSH_REPLY,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.4 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
wrt-router.net/84.65.183.175:51866 Data Channel: using negotiated cipher 'AES-256-GCM'
wrt-router.net/84.65.183.175:51866 Data Channel MTU parms [ L:1551 D:1450 EF:51 EB:406 ET:0 EL:3 ]
wrt-router.net/84.65.183.175:51866 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
wrt-router.net/84.65.183.175:51866 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key

Hopefully someone can decipher.

TinCanTech

Did you even read your log ?

youdsmedia wrote 20201123 05:35:16 Pushed option removed by filter: 'redirect-gateway def1 bypass-dhcp'

youdsmedia

Yes, I know that. Found out on irc. I switched to OpenWrt since and am trying to get it working correctly.

If you know how to remove the filter?

Pippin

See your client config.