Hi I have been working on changing my VPN from UDP to TCP (mainly due to dropouts) and it is saying all the right things when connecting, like TCP Auth etc , but when it connects my IP address does not change. With UDP, it does. So steps I have taken: - Adjusted server.conf set proto to "tcp-server" - Switched to "tcp" in router firmware - Waited 24h Hopefully someone can help!

Here is server config file: [oconf=Server config] port 1194 proto tcp-server dev tun ca /etc/openvpn/server/ca.crt cert /etc/openvpn/server/vpn.gethosted.online.crt dh /etc/openvpn/server/dh2048.pem topology subnet server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt client-to-client keepalive 10 120 auth sha256 cipher AES-256-CBC persist-key persist-tun status openvpn-status.log verb 4 explicit-exit-notify 0 fast-io tun-mtu 1500 [/oconf] With client matching.

Ah, I had seen this before but assumed it was client based. Thanks. What did you mean about the possibility of no internet? Kind regards

[quote=youdsmedia post_id=95746 time=1605817721 user_id=52092] Ah, I had seen this before but assumed it was client based. Thanks. What did you mean about the possibility of no internet? Kind regards [/quote] yes . it depend on your server set up may be stop internet at client . but if you can do it carefully it should work as you like

[quote=300000 post_id=95755 time=1605824811 user_id=19319] [quote=youdsmedia post_id=95746 time=1605817721 user_id=52092] Ah, I had seen this before but assumed it was client based. Thanks. What did you mean about the possibility of no internet? Kind regards [/quote] yes . it depend on your server set up may be stop internet at client . but if you can do it carefully it should work as you like [/quote] So I tried that as suggested, my config follows: [code]port 1194 proto tcp-server push "redirect-gateway def1 bypass-dhcp" dev tun ca /etc/openvpn/server/ca.crt cert /etc/openvpn/server/vpn.gethosted.online.crt dh /etc/openvpn/server/dh2048.pem topology subnet server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt client-to-client keepalive 10 120 auth sha256 cipher AES-256-CBC persist-key persist-tun status openvpn-status.log verb 4 explicit-exit-notify 0 fast-io tun-mtu 1500[/code] However, this did not work. Restarted router and VPN server (shutdown -r now) but no changes. It has been the case where it takes time for the router to start using the vpn, also I'm not sure if push "..." is required or if I can use the contents of push="..." in my server config - trying that now. Kind regards [b]edit:[/b] basically, I tried adding push to the openvpn command being used and no change, IP address still the one seen by ISP - however to be fair, the UDP protocol exhibited this behaviour as well.

your ip address have been changed but you connection still use dns from your ISP so they block your to access ban website , if you want to access that block website you need change your dns from somewhere and dont use dns server from your ISP , let add this into your server config and it should word [code]push " block-outside-dns" push "dhcp-option DNS 1.1.1.1"[/code]

Hi So I did that, rebooted my VPN server and my router, same symptoms. I can visit websites etc but when I log in via SSH it states last accessed IP was my ISP's or if I check to see my IP address as reported by Google, it shows the ISP's IP - not the VPN IP. My current setup: - OpenVPN 2.4.9 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 24 2020 - Router Firmware: DD-WRT v3.0-r44700 std (10/30/20)

if you ve done all config and can connect but not change ip so you should ask do you really using openvpn or direct ?how about dns and client is dd wrt router until now you say it work but nothing change , so let check it yourself

I took a glance around and couldn’t find anywhere to set dns servers in dd-wrt. Puzzled as only change is udp to tcp. I should probably get UDP back up and running then switch to tcp with minimal steps, to be sure there is no conflict elsewhere.

OK I have tried the following steps with no changes: - Restored VPN Server To Last Working State - Restored Firmware Backup To Last Working State - Waited 24h (twice) There is no change. This leads me to thinking it must be the firmware itself, so I'm going to try and reset that now.

No IP change and a "CONNECTED SUCCESS" message

youdsmedia

OK - done that. I can clearly see "redirect-gateway def1" in the logs - which was filtered before. Unfortunately, the setting did not change my IP address! See logs.

Current Parameter Settings:
  config = 'server.conf'
  mode = 1
  persist_config = DISABLED
  persist_mode = 1
  show_ciphers = DISABLED
  show_digests = DISABLED
  show_engines = DISABLED
  genkey = DISABLED
  key_pass_file = '[UNDEF]'
  show_tls_ciphers = DISABLED
  connect_retry_max = 0
Connection profiles [0]:
  proto = udp
  local = '[UNDEF]'
  local_port = '1194'
  remote = '[UNDEF]'
  remote_port = '1194'
  remote_float = DISABLED
  bind_defined = DISABLED
  bind_local = ENABLED
  bind_ipv6_only = DISABLED
  connect_retry_seconds = 5
  connect_timeout = 120
  socks_proxy_server = '[UNDEF]'
  socks_proxy_port = '[UNDEF]'
  tun_mtu = 1500
  tun_mtu_defined = ENABLED
  link_mtu = 1500
  link_mtu_defined = DISABLED
  tun_mtu_extra = 0
  tun_mtu_extra_defined = DISABLED
  mtu_discover_type = -1
  fragment = 0
  mssfix = 1450
  explicit_exit_notification = 0
Connection profiles END
  remote_random = DISABLED
  ipchange = '[UNDEF]'
  dev = 'tun'
  dev_type = '[UNDEF]'
  dev_node = '[UNDEF]'
  lladdr = '[UNDEF]'
  topology = 3
  ifconfig_local = '10.8.0.1'
  ifconfig_remote_netmask = '255.255.255.0'
  ifconfig_noexec = DISABLED
  ifconfig_nowarn = DISABLED
  ifconfig_ipv6_local = '[UNDEF]'
  ifconfig_ipv6_netbits = 0
  ifconfig_ipv6_remote = '[UNDEF]'
  shaper = 0
  mtu_test = 0
  mlock = DISABLED
  keepalive_ping = 10
  keepalive_timeout = 120
  inactivity_timeout = 0
  ping_send_timeout = 10
  ping_rec_timeout = 240
  ping_rec_timeout_action = 2
  ping_timer_remote = DISABLED
  remap_sigusr1 = 0
  persist_tun = ENABLED
  persist_local_ip = DISABLED
  persist_remote_ip = DISABLED
  persist_key = ENABLED
  passtos = DISABLED
  resolve_retry_seconds = 1000000000
  resolve_in_advance = DISABLED
  username = '[UNDEF]'
  groupname = '[UNDEF]'
  chroot_dir = '[UNDEF]'
  cd_dir = '[UNDEF]'
  selinux_context = '[UNDEF]'
  writepid = '[UNDEF]'
  up_script = '[UNDEF]'
  down_script = '[UNDEF]'
  down_pre = DISABLED
  up_restart = DISABLED
  up_delay = DISABLED
  daemon = DISABLED
  inetd = 0
  log = ENABLED
  suppress_timestamps = ENABLED
  machine_readable_output = DISABLED
  nice = 0
  verbosity = 4
  mute = 0
  gremlin = 0
  status_file = 'openvpn-status.log'
  status_file_version = 2
  status_file_update_freq = 60
  occ = ENABLED
  rcvbuf = 0
  sndbuf = 0
  mark = 0
  sockflags = 0
  fast_io = ENABLED
  comp.alg = 0
  comp.flags = 0
  route_script = '[UNDEF]'
  route_default_gateway = '10.8.0.2'
  route_default_metric = 0
  route_noexec = DISABLED
  route_delay = 0
  route_delay_window = 30
  route_delay_defined = DISABLED
  route_nopull = DISABLED
  route_gateway_via_dhcp = DISABLED
  allow_pull_fqdn = DISABLED
  management_addr = '[UNDEF]'
  management_port = '[UNDEF]'
  management_user_pass = '[UNDEF]'
  management_log_history_cache = 250
  management_echo_buffer_size = 100
  management_write_peer_info_file = '[UNDEF]'
  management_client_user = '[UNDEF]'
  management_client_group = '[UNDEF]'
  management_flags = 0
  shared_secret_file = '[UNDEF]'
  key_direction = 0
  ciphername = 'AES-256-CBC'
  ncp_enabled = ENABLED
  ncp_ciphers = 'AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:BF-CBC'
  authname = 'sha256'
  prng_hash = 'SHA1'
  prng_nonce_secret_len = 16
  keysize = 0
  engine = DISABLED
  replay = ENABLED
  mute_replay_warnings = DISABLED
  replay_window = 64
  replay_time = 15
  packet_id_file = '[UNDEF]'
  use_iv = ENABLED
  test_crypto = DISABLED
  tls_server = ENABLED
  tls_client = DISABLED
  key_method = 2
  ca_file = 'ca.crt'
  ca_path = '[UNDEF]'
  dh_file = 'dh2048.pem'
  cert_file = 'my.server.com.crt'
  extra_certs_file = '[UNDEF]'
  priv_key_file = 'my.server.com.key'
  pkcs12_file = '[UNDEF]'
  cipher_list = '[UNDEF]'
  cipher_list_tls13 = '[UNDEF]'
  tls_cert_profile = '[UNDEF]'
  tls_verify = '[UNDEF]'
  tls_export_cert = '[UNDEF]'
  verify_x509_type = 0
  verify_x509_name = '[UNDEF]'
  crl_file = '[UNDEF]'
  ns_cert_type = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_eku = '[UNDEF]'
  ssl_flags = 0
  tls_timeout = 2
  renegotiate_bytes = -1
  renegotiate_packets = 0
  renegotiate_seconds = 3600
  handshake_window = 60
  transition_window = 3600
  single_session = DISABLED
  push_peer_info = DISABLED
  tls_exit = DISABLED
  tls_auth_file = 'ta.key'
  tls_crypt_file = '[UNDEF]'
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_pin_cache_period = -1
  pkcs11_id = '[UNDEF]'
  pkcs11_id_management = DISABLED
  server_network = 10.8.0.0
  server_netmask = 255.255.255.0
  server_network_ipv6 = ::
  server_netbits_ipv6 = 0
  server_bridge_ip = 0.0.0.0
  server_bridge_netmask = 0.0.0.0
  server_bridge_pool_start = 0.0.0.0
  server_bridge_pool_end = 0.0.0.0
  push_entry = 'block-outside-dns'
  push_entry = 'redirect-gateway def1'
  push_entry = 'route-gateway 10.8.0.1'
  push_entry = 'topology subnet'
  push_entry = 'ping 10'
  push_entry = 'ping-restart 120'
  ifconfig_pool_defined = ENABLED
  ifconfig_pool_start = 10.8.0.2
  ifconfig_pool_end = 10.8.0.253
  ifconfig_pool_netmask = 255.255.255.0
  ifconfig_pool_persist_filename = 'ipp.txt'
  ifconfig_pool_persist_refresh_freq = 600
  ifconfig_ipv6_pool_defined = DISABLED
  ifconfig_ipv6_pool_base = ::
  ifconfig_ipv6_pool_netbits = 0
  n_bcast_buf = 256
  tcp_queue_limit = 64
  real_hash_size = 256
  virtual_hash_size = 256
  client_connect_script = '[UNDEF]'
  learn_address_script = '[UNDEF]'
  client_disconnect_script = '[UNDEF]'
  client_config_dir = '[UNDEF]'
  ccd_exclusive = DISABLED
  tmp_dir = '/tmp'
  push_ifconfig_defined = DISABLED
  push_ifconfig_local = 0.0.0.0
  push_ifconfig_remote_netmask = 0.0.0.0
  push_ifconfig_ipv6_defined = DISABLED
  push_ifconfig_ipv6_local = ::/0
  push_ifconfig_ipv6_remote = ::
  enable_c2c = ENABLED
  duplicate_cn = DISABLED
  cf_max = 0
  cf_per = 0
  max_clients = 1024
  max_routes_per_client = 256
  auth_user_pass_verify_script = '[UNDEF]'
  auth_user_pass_verify_script_via_file = DISABLED
  auth_token_generate = DISABLED
  auth_token_lifetime = 0
  port_share_host = '[UNDEF]'
  port_share_port = '[UNDEF]'
  client = DISABLED
  pull = DISABLED
  auth_user_pass_file = '[UNDEF]'
OpenVPN 2.4.9 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 24 2020
library versions: OpenSSL 1.1.1c FIPS  28 May 2019, LZO 2.08
Diffie-Hellman initialized with 2048 bit key
Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
TLS-Auth MTU parms [ L:1621 D:1172 EF:78 EB:0 ET:0 EL:3 ]
TUN/TAP device tun0 opened
TUN/TAP TX queue length set to 100
do_ifconfig, tt->did_ifconfig_ipv6_setup=0
/sbin/ip link set dev tun0 up mtu 1500
/sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
Could not determine IPv4/IPv6 protocol. Using AF_INET
Socket Buffers: R=[212992->212992] S=[212992->212992]
UDPv4 link local (bound): [AF_INET][undef]:1194
UDPv4 link remote: [AF_UNSPEC]
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
ifconfig_pool_read(), in='wrt-router.net,10.8.0.4', TODO: IPv6
succeeded -> ifconfig_pool_set()
IFCONFIG POOL LIST
wrt-router.net,10.8.0.4
Initialization Sequence Completed

youdsmedia

Tried just now with redirect-gateway local but really I am just firing blanks into the dark.

TinCanTech

youdsmedia wrote I can clearly see "redirect-gateway def1" in the logs

Did you post the wrong log ?

youdsmedia

About 4/5th of the way down I see this entry: " push_entry = 'redirect-gateway def1'"

youdsmedia

Client log follows.

Clientlog: 
19700101 01:00:36 W WARNING: Your certificate is not yet valid! 
19700101 01:00:36 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication 
19700101 01:00:36 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication 
19700101 01:00:36 I TCP/UDP: Preserving recently used remote address: [AF_INET]134.209.190.50:1194 
19700101 01:00:36 Socket Buffers: R=[180224->180224] S=[180224->180224] 
19700101 01:00:36 I UDPv4 link local: (not bound) 
19700101 01:00:36 I UDPv4 link remote: [AF_INET]134.209.190.50:1194 
19700101 01:00:36 TLS: Initial packet from [AF_INET]134.209.190.50:1194 sid=f0885c3c d1f37b9a 
19700101 01:00:36 N VERIFY ERROR: depth=0 error=certificate is not yet valid: CN=my.server.com serial=12552473621937538790693804218004530188 
19700101 01:00:36 N OpenSSL: error:1416F086:lib(20):func(367):reason(134) 
19700101 01:00:36 N TLS_ERROR: BIO read tls_read_plaintext error 
19700101 01:00:36 NOTE: --mute triggered... 
19700101 01:00:36 2 variation(s) on previous 3 message(s) suppressed by --mute 
19700101 01:00:36 I SIGUSR1[soft tls-error] received process restarting 
19700101 01:00:36 Restart pause 5 second(s) 
20201125 00:38:45 W WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info. 
20201125 00:38:45 W NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 
20201125 00:38:45 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication 
20201125 00:38:45 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication 
20201125 00:38:45 I TCP/UDP: Preserving recently used remote address: [AF_INET]134.209.190.50:1194 
20201125 00:38:45 Socket Buffers: R=[180224->180224] S=[180224->180224] 
20201125 00:38:45 I UDPv4 link local: (not bound) 
20201125 00:38:45 I UDPv4 link remote: [AF_INET]134.209.190.50:1194 
20201125 00:38:45 TLS: Initial packet from [AF_INET]134.209.190.50:1194 sid=7028e11c e0f24145 
20201125 00:38:45 VERIFY OK: depth=0 CN=my.server.com 
20201125 00:38:45 W WARNING: 'link-mtu' is used inconsistently local='link-mtu 1534' remote='link-mtu 1569' 
20201125 00:38:45 W WARNING: 'auth' is used inconsistently local='auth [null-digest]' remote='auth SHA256' 
20201125 00:38:45 Control Channel: TLSv1.3 cipher TLSv1.3 TLS_AES_256_GCM_SHA384 2048 bit RSA 
20201125 00:38:45 I [my.server.com] Peer Connection Initiated with [AF_INET]134.209.190.50:1194 
20201125 00:38:46 SENT CONTROL [my.server.com]: 'PUSH_REQUEST' (status=1) 
20201125 00:38:46 PUSH: Received control message: 'PUSH_REPLY block-outside-dns redirect-gateway local route-gateway 10.8.0.1 topology subnet ping 10 ping-restart 120 ifconfig 10.8.0.4 255.255.255.0 peer-id 2 cipher AES-256-GCM' 
20201125 00:38:46 N Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:1: block-outside-dns (2.5.0) 
20201125 00:38:46 Pushed option removed by filter: 'redirect-gateway local' 
20201125 00:38:46 OPTIONS IMPORT: timers and/or timeouts modified 
20201125 00:38:46 OPTIONS IMPORT: --ifconfig/up options modified 
20201125 00:38:46 NOTE: --mute triggered... 
20201125 00:38:46 4 variation(s) on previous 3 message(s) suppressed by --mute 
20201125 00:38:46 Data Channel: using negotiated cipher 'AES-256-GCM' 
20201125 00:38:46 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 
20201125 00:38:46 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 
20201125 00:38:46 net_route_v4_best_gw query: dst 0.0.0.0 
20201125 00:38:46 net_route_v4_best_gw result: via 192.168.2.1 dev eth0 
20201125 00:38:46 I TUN/TAP device tun1 opened 
20201125 00:38:46 I net_iface_mtu_set: mtu 1500 for tun1 
20201125 00:38:46 I net_iface_up: set tun1 up 
20201125 00:38:46 I net_addr_v4_add: 10.8.0.4/24 dev tun1 
20201125 00:38:46 net_route_v4_add: 134.209.190.50/32 via 192.168.2.1 dev [NULL] table 0 metric -1 
20201125 00:38:46 W WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this 
20201125 00:38:46 I Initialization Sequence Completed 
20201125 01:38:45 VERIFY OK: depth=0 CN=my.server.com 
20201125 01:38:45 W WARNING: 'link-mtu' is used inconsistently local='link-mtu 1534' remote='link-mtu 1569' 
20201125 01:38:45 W WARNING: 'auth' is used inconsistently local='auth [null-digest]' remote='auth SHA256' 
20201125 01:38:45 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 
20201125 01:38:45 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 
20201125 01:38:45 Control Channel: TLSv1.3 cipher TLSv1.3 TLS_AES_256_GCM_SHA384 2048 bit RSA 
20201125 02:38:46 NOTE: --mute triggered... 
20201125 02:38:46 1 variation(s) on previous 3 message(s) suppressed by --mute 
20201125 02:38:46 W WARNING: 'link-mtu' is used inconsistently local='link-mtu 1534' remote='link-mtu 1569' 
20201125 02:38:46 W WARNING: 'auth' is used inconsistently local='auth [null-digest]' remote='auth SHA256' 
20201125 02:38:46 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 
20201125 02:38:46 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 
20201125 02:38:46 Control Channel: TLSv1.3 cipher TLSv1.3 TLS_AES_256_GCM_SHA384 2048 bit RSA 
20201125 03:38:46 NOTE: --mute triggered... 
20201125 03:38:46 1 variation(s) on previous 3 message(s) suppressed by --mute 
20201125 03:38:46 W WARNING: 'link-mtu' is used inconsistently local='link-mtu 1534' remote='link-mtu 1569' 
20201125 03:38:46 W WARNING: 'auth' is used inconsistently local='auth [null-digest]' remote='auth SHA256' 
20201125 03:38:46 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 
20201125 03:38:46 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 
20201125 03:38:46 Control Channel: TLSv1.3 cipher TLSv1.3 TLS_AES_256_GCM_SHA384 2048 bit RSA 
20201125 04:38:46 NOTE: --mute triggered... 
20201125 04:38:46 1 variation(s) on previous 3 message(s) suppressed by --mute 
20201125 04:38:46 W WARNING: 'link-mtu' is used inconsistently local='link-mtu 1534' remote='link-mtu 1569' 
20201125 04:38:46 W WARNING: 'auth' is used inconsistently local='auth [null-digest]' remote='auth SHA256' 
20201125 04:38:46 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 
20201125 04:38:46 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 
20201125 04:38:46 Control Channel: TLSv1.3 cipher TLSv1.3 TLS_AES_256_GCM_SHA384 2048 bit RSA 
20201125 05:38:46 NOTE: --mute triggered... 
20201125 05:39:46 1 variation(s) on previous 3 message(s) suppressed by --mute 
20201125 05:39:46 N TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) 
20201125 05:39:46 N TLS Error: TLS handshake failed 
20201125 05:39:46 TLS: move_session: dest=TM_LAME_DUCK src=TM_ACTIVE reinit_src=1 
20201125 05:40:01 TLS: Initial packet from [AF_INET]134.209.190.50:1194 sid=dd191798 7fd96e8d 
20201125 05:40:01 VERIFY OK: depth=0 CN=my.server.com 
20201125 05:40:01 W WARNING: 'link-mtu' is used inconsistently local='link-mtu 1534' remote='link-mtu 1569' 
20201125 05:40:01 W WARNING: 'auth' is used inconsistently local='auth [null-digest]' remote='auth SHA256' 
20201125 05:40:01 Control Channel: TLSv1.3 cipher TLSv1.3 TLS_AES_256_GCM_SHA384 2048 bit RSA 
20201125 05:40:20 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16 
20201125 05:40:20 D MANAGEMENT: CMD 'state' 
20201125 05:40:20 MANAGEMENT: Client disconnected 
20201125 05:40:20 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16 
20201125 05:40:20 D MANAGEMENT: CMD 'state' 
20201125 05:40:20 MANAGEMENT: Client disconnected 
20201125 05:40:20 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16 
20201125 05:40:20 D MANAGEMENT: CMD 'state' 
20201125 05:40:20 MANAGEMENT: Client disconnected 
20201125 05:40:20 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16 
20201125 05:40:20 D MANAGEMENT: CMD 'status 2' 
20201125 05:40:20 MANAGEMENT: Client disconnected 
20201125 05:40:20 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16 
20201125 05:40:20 D MANAGEMENT: CMD 'log 500' 
19700101 01:00:00

youdsmedia

Here is my server log on verb 6 (to diagnose connection problems)

Current Parameter Settings:
  config = 'server.conf'
  mode = 1
  persist_config = DISABLED
  persist_mode = 1
  show_ciphers = DISABLED
  show_digests = DISABLED
  show_engines = DISABLED
  genkey = DISABLED
  key_pass_file = '[UNDEF]'
  show_tls_ciphers = DISABLED
  connect_retry_max = 0
Connection profiles [0]:
  proto = udp
  local = '[UNDEF]'
  local_port = '1194'
  remote = '[UNDEF]'
  remote_port = '1194'
  remote_float = DISABLED
  bind_defined = DISABLED
  bind_local = ENABLED
  bind_ipv6_only = DISABLED
  connect_retry_seconds = 5
  connect_timeout = 120
  socks_proxy_server = '[UNDEF]'
  socks_proxy_port = '[UNDEF]'
  tun_mtu = 1500
  tun_mtu_defined = ENABLED
  link_mtu = 1500
  link_mtu_defined = DISABLED
  tun_mtu_extra = 0
  tun_mtu_extra_defined = DISABLED
  mtu_discover_type = -1
  fragment = 0
  mssfix = 1450
  explicit_exit_notification = 0
Connection profiles END
  remote_random = DISABLED
  ipchange = '[UNDEF]'
  dev = 'tun'
  dev_type = '[UNDEF]'
  dev_node = '[UNDEF]'
  lladdr = '[UNDEF]'
  topology = 3
  ifconfig_local = '10.8.0.1'
  ifconfig_remote_netmask = '255.255.255.0'
  ifconfig_noexec = DISABLED
  ifconfig_nowarn = DISABLED
  ifconfig_ipv6_local = '[UNDEF]'
  ifconfig_ipv6_netbits = 0
  ifconfig_ipv6_remote = '[UNDEF]'
  shaper = 0
  mtu_test = 0
  mlock = DISABLED
  keepalive_ping = 10
  keepalive_timeout = 120
  inactivity_timeout = 0
  ping_send_timeout = 10
  ping_rec_timeout = 240
  ping_rec_timeout_action = 2
  ping_timer_remote = DISABLED
  remap_sigusr1 = 0
  persist_tun = ENABLED
  persist_local_ip = DISABLED
  persist_remote_ip = DISABLED
  persist_key = ENABLED
  passtos = DISABLED
  resolve_retry_seconds = 1000000000
  resolve_in_advance = DISABLED
  username = '[UNDEF]'
  groupname = '[UNDEF]'
  chroot_dir = '[UNDEF]'
  cd_dir = '[UNDEF]'
  selinux_context = '[UNDEF]'
  writepid = '[UNDEF]'
  up_script = '[UNDEF]'
  down_script = '[UNDEF]'
  down_pre = DISABLED
  up_restart = DISABLED
  up_delay = DISABLED
  daemon = DISABLED
  inetd = 0
  log = ENABLED
  suppress_timestamps = ENABLED
  machine_readable_output = DISABLED
  nice = 0
  verbosity = 6
  mute = 0
  gremlin = 0
  status_file = 'openvpn-status.log'
  status_file_version = 2
  status_file_update_freq = 60
  occ = ENABLED
  rcvbuf = 0
  sndbuf = 0
  mark = 0
  sockflags = 0
  fast_io = ENABLED
  comp.alg = 0
  comp.flags = 0
  route_script = '[UNDEF]'
  route_default_gateway = '10.8.0.2'
  route_default_metric = 0
  route_noexec = DISABLED
  route_delay = 0
  route_delay_window = 30
  route_delay_defined = DISABLED
  route_nopull = DISABLED
  route_gateway_via_dhcp = DISABLED
  allow_pull_fqdn = DISABLED
  management_addr = '[UNDEF]'
  management_port = '[UNDEF]'
  management_user_pass = '[UNDEF]'
  management_log_history_cache = 250
  management_echo_buffer_size = 100
  management_write_peer_info_file = '[UNDEF]'
  management_client_user = '[UNDEF]'
  management_client_group = '[UNDEF]'
  management_flags = 0
  shared_secret_file = '[UNDEF]'
  key_direction = 0
  ciphername = 'AES-256-CBC'
  ncp_enabled = ENABLED
  ncp_ciphers = 'AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:BF-CBC'
  authname = 'sha256'
  prng_hash = 'SHA1'
  prng_nonce_secret_len = 16
  keysize = 0
  engine = DISABLED
  replay = ENABLED
  mute_replay_warnings = DISABLED
  replay_window = 64
  replay_time = 15
  packet_id_file = '[UNDEF]'
  use_iv = ENABLED
  test_crypto = DISABLED
  tls_server = ENABLED
  tls_client = DISABLED
  key_method = 2
  ca_file = '/etc/openvpn/server/ca.crt'
  ca_path = '[UNDEF]'
  dh_file = '/etc/openvpn/server/dh2048.pem'
  cert_file = '/etc/openvpn/server/my.server.com.crt'
  extra_certs_file = '[UNDEF]'
  priv_key_file = '/etc/openvpn/server/my.server.com.key'
  pkcs12_file = '[UNDEF]'
  cipher_list = '[UNDEF]'
  cipher_list_tls13 = '[UNDEF]'
  tls_cert_profile = '[UNDEF]'
  tls_verify = '[UNDEF]'
  tls_export_cert = '[UNDEF]'
  verify_x509_type = 0
  verify_x509_name = '[UNDEF]'
  crl_file = '[UNDEF]'
  ns_cert_type = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_eku = '[UNDEF]'
  ssl_flags = 0
  tls_timeout = 2
  renegotiate_bytes = -1
  renegotiate_packets = 0
  renegotiate_seconds = 3600
  handshake_window = 60
  transition_window = 3600
  single_session = DISABLED
  push_peer_info = DISABLED
  tls_exit = DISABLED
  tls_auth_file = '/etc/openvpn/server/ta.key'
  tls_crypt_file = '[UNDEF]'
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_pin_cache_period = -1
  pkcs11_id = '[UNDEF]'
  pkcs11_id_management = DISABLED
  server_network = 10.8.0.0
  server_netmask = 255.255.255.0
  server_network_ipv6 = ::
  server_netbits_ipv6 = 0
  server_bridge_ip = 0.0.0.0
  server_bridge_netmask = 0.0.0.0
  server_bridge_pool_start = 0.0.0.0
  server_bridge_pool_end = 0.0.0.0
  push_entry = 'block-outside-dns'
  push_entry = 'redirect-gateway def1'
  push_entry = 'route-gateway 10.8.0.1'
  push_entry = 'topology subnet'
  push_entry = 'ping 10'
  push_entry = 'ping-restart 120'
  ifconfig_pool_defined = ENABLED
  ifconfig_pool_start = 10.8.0.2
  ifconfig_pool_end = 10.8.0.253
  ifconfig_pool_netmask = 255.255.255.0
  ifconfig_pool_persist_filename = 'ipp.txt'
  ifconfig_pool_persist_refresh_freq = 600
  ifconfig_ipv6_pool_defined = DISABLED
  ifconfig_ipv6_pool_base = ::
  ifconfig_ipv6_pool_netbits = 0
  n_bcast_buf = 256
  tcp_queue_limit = 64
  real_hash_size = 256
  virtual_hash_size = 256
  client_connect_script = '[UNDEF]'
  learn_address_script = '[UNDEF]'
  client_disconnect_script = '[UNDEF]'
  client_config_dir = '[UNDEF]'
  ccd_exclusive = DISABLED
  tmp_dir = '/tmp'
  push_ifconfig_defined = DISABLED
  push_ifconfig_local = 0.0.0.0
  push_ifconfig_remote_netmask = 0.0.0.0
  push_ifconfig_ipv6_defined = DISABLED
  push_ifconfig_ipv6_local = ::/0
  push_ifconfig_ipv6_remote = ::
  enable_c2c = ENABLED
  duplicate_cn = DISABLED
  cf_max = 0
  cf_per = 0
  max_clients = 1024
  max_routes_per_client = 256
  auth_user_pass_verify_script = '[UNDEF]'
  auth_user_pass_verify_script_via_file = DISABLED
  auth_token_generate = DISABLED
  auth_token_lifetime = 0
  port_share_host = '[UNDEF]'
  port_share_port = '[UNDEF]'
  client = DISABLED
  pull = DISABLED
  auth_user_pass_file = '[UNDEF]'
OpenVPN 2.4.9 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 24 2020
library versions: OpenSSL 1.1.1c FIPS  28 May 2019, LZO 2.08
Diffie-Hellman initialized with 2048 bit key
Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
TLS-Auth MTU parms [ L:1621 D:1172 EF:78 EB:0 ET:0 EL:3 ]
TUN/TAP device tun0 opened
TUN/TAP TX queue length set to 100
do_ifconfig, tt->did_ifconfig_ipv6_setup=0
/sbin/ip link set dev tun0 up mtu 1500
/sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
Could not determine IPv4/IPv6 protocol. Using AF_INET
Socket Buffers: R=[212992->212992] S=[212992->212992]
UDPv4 link local (bound): [AF_INET][undef]:1194
UDPv4 link remote: [AF_UNSPEC]
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
ifconfig_pool_read(), in='wrt-router.net,10.8.0.4', TODO: IPv6
succeeded -> ifconfig_pool_set()
IFCONFIG POOL LIST
wrt-router.net,10.8.0.4
Initialization Sequence Completed
MULTI: multi_create_instance called
84.65.183.175:52311 Re-using SSL/TLS context
84.65.183.175:52311 Control Channel MTU parms [ L:1621 D:1172 EF:78 EB:0 ET:0 EL:3 ]
84.65.183.175:52311 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
84.65.183.175:52311 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1569,tun-mtu 1500,proto UDPv4,keydir 0,cipher AES-256-CBC,auth SHA256,keysize 256,tls-auth,key-method 2,tls-server'
84.65.183.175:52311 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1569,tun-mtu 1500,proto UDPv4,keydir 1,cipher AES-256-CBC,auth SHA256,keysize 256,tls-auth,key-method 2,tls-client'
84.65.183.175:52311 UDPv4 READ [54] from [AF_INET]84.65.183.175:52311: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #1 ] [ ] pid=0 DATA len=0
84.65.183.175:52311 TLS: Initial packet from [AF_INET]84.65.183.175:52311, sid=e0a72157 97e8003b
84.65.183.175:52311 UDPv4 WRITE [66] to [AF_INET]84.65.183.175:52311: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 pid=[ #1 ] [ 0 ] pid=0 DATA len=0
84.65.183.175:52311 UDPv4 READ [62] from [AF_INET]84.65.183.175:52311: P_ACK_V1 kid=0 pid=[ #2 ] [ 0 ]
84.65.183.175:52311 UDPv4 READ [291] from [AF_INET]84.65.183.175:52311: P_CONTROL_V1 kid=0 pid=[ #3 ] [ ] pid=1 DATA len=237
84.65.183.175:52311 UDPv4 WRITE [1160] to [AF_INET]84.65.183.175:52311: P_CONTROL_V1 kid=0 pid=[ #2 ] [ 1 ] pid=1 DATA len=1094
84.65.183.175:52311 UDPv4 WRITE [1148] to [AF_INET]84.65.183.175:52311: P_CONTROL_V1 kid=0 pid=[ #3 ] [ ] pid=2 DATA len=1094
84.65.183.175:52311 UDPv4 WRITE [334] to [AF_INET]84.65.183.175:52311: P_CONTROL_V1 kid=0 pid=[ #4 ] [ ] pid=3 DATA len=280
84.65.183.175:52311 UDPv4 READ [62] from [AF_INET]84.65.183.175:52311: P_ACK_V1 kid=0 pid=[ #4 ] [ 1 ]
84.65.183.175:52311 UDPv4 READ [62] from [AF_INET]84.65.183.175:52311: P_ACK_V1 kid=0 pid=[ #5 ] [ 2 ]
84.65.183.175:52311 UDPv4 READ [1160] from [AF_INET]84.65.183.175:52311: P_CONTROL_V1 kid=0 pid=[ #6 ] [ 3 ] pid=2 DATA len=1094
84.65.183.175:52311 UDPv4 WRITE [62] to [AF_INET]84.65.183.175:52311: P_ACK_V1 kid=0 pid=[ #5 ] [ 2 ]
84.65.183.175:52311 UDPv4 READ [1148] from [AF_INET]84.65.183.175:52311: P_CONTROL_V1 kid=0 pid=[ #7 ] [ ] pid=3 DATA len=1094
84.65.183.175:52311 VERIFY OK: depth=1, CN=my.server.com
84.65.183.175:52311 VERIFY OK: depth=0, CN=wrt-router.net
84.65.183.175:52311 UDPv4 WRITE [224] to [AF_INET]84.65.183.175:52311: P_CONTROL_V1 kid=0 pid=[ #6 ] [ 3 ] pid=4 DATA len=158
84.65.183.175:52311 UDPv4 READ [513] from [AF_INET]84.65.183.175:52311: P_CONTROL_V1 kid=0 pid=[ #8 ] [ ] pid=4 DATA len=459
84.65.183.175:52311 peer info: IV_VER=2.5.0
84.65.183.175:52311 peer info: IV_PLAT=linux
84.65.183.175:52311 peer info: IV_PROTO=6
84.65.183.175:52311 peer info: IV_NCP=2
84.65.183.175:52311 peer info: IV_CIPHERS=AES-128-GCM:AES-256-GCM:AES-128-CBC:CHACHA20-POLY1305
84.65.183.175:52311 peer info: IV_LZ4=1
84.65.183.175:52311 peer info: IV_LZ4v2=1
84.65.183.175:52311 peer info: IV_LZO=1
84.65.183.175:52311 peer info: IV_COMP_STUB=1
84.65.183.175:52311 peer info: IV_COMP_STUBv2=1
84.65.183.175:52311 peer info: IV_TCPNL=1
84.65.183.175:52311 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1569', remote='link-mtu 1534'
84.65.183.175:52311 WARNING: 'cipher' is used inconsistently, local='cipher AES-256-CBC', remote='cipher CHACHA20-POLY1305'
84.65.183.175:52311 WARNING: 'auth' is used inconsistently, local='auth SHA256', remote='auth [null-digest]'
84.65.183.175:52311 UDPv4 WRITE [305] to [AF_INET]84.65.183.175:52311: P_CONTROL_V1 kid=0 pid=[ #7 ] [ 4 ] pid=5 DATA len=239
84.65.183.175:52311 UDPv4 READ [62] from [AF_INET]84.65.183.175:52311: P_ACK_V1 kid=0 pid=[ #9 ] [ 4 ]
84.65.183.175:52311 UDPv4 READ [62] from [AF_INET]84.65.183.175:52311: P_ACK_V1 kid=0 pid=[ #10 ] [ 5 ]
84.65.183.175:52311 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
84.65.183.175:52311 [wrt-router.net] Peer Connection Initiated with [AF_INET]84.65.183.175:52311
wrt-router.net/84.65.183.175:52311 MULTI_sva: pool returned IPv4=10.8.0.4, IPv6=(Not enabled)
wrt-router.net/84.65.183.175:52311 MULTI: Learn: 10.8.0.4 -> wrt-router.net/84.65.183.175:52311
wrt-router.net/84.65.183.175:52311 MULTI: primary virtual IP for wrt-router.net/84.65.183.175:52311: 10.8.0.4
MULTI: multi_create_instance called
84.65.183.175:53420 Re-using SSL/TLS context
84.65.183.175:53420 Control Channel MTU parms [ L:1621 D:1172 EF:78 EB:0 ET:0 EL:3 ]
84.65.183.175:53420 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
84.65.183.175:53420 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1569,tun-mtu 1500,proto UDPv4,keydir 0,cipher AES-256-CBC,auth SHA256,keysize 256,tls-auth,key-method 2,tls-server'
84.65.183.175:53420 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1569,tun-mtu 1500,proto UDPv4,keydir 1,cipher AES-256-CBC,auth SHA256,keysize 256,tls-auth,key-method 2,tls-client'
84.65.183.175:53420 UDPv4 READ [54] from [AF_INET]84.65.183.175:53420: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #1 ] [ ] pid=0 DATA len=0
84.65.183.175:53420 TLS: Initial packet from [AF_INET]84.65.183.175:53420, sid=8fc356f0 39e2051b
84.65.183.175:53420 UDPv4 WRITE [66] to [AF_INET]84.65.183.175:53420: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 pid=[ #1 ] [ 0 ] pid=0 DATA len=0
84.65.183.175:53420 UDPv4 READ [62] from [AF_INET]84.65.183.175:53420: P_ACK_V1 kid=0 pid=[ #2 ] [ 0 ]
84.65.183.175:53420 UDPv4 READ [291] from [AF_INET]84.65.183.175:53420: P_CONTROL_V1 kid=0 pid=[ #3 ] [ ] pid=1 DATA len=237
84.65.183.175:53420 UDPv4 WRITE [1160] to [AF_INET]84.65.183.175:53420: P_CONTROL_V1 kid=0 pid=[ #2 ] [ 1 ] pid=1 DATA len=1094
84.65.183.175:53420 UDPv4 WRITE [1148] to [AF_INET]84.65.183.175:53420: P_CONTROL_V1 kid=0 pid=[ #3 ] [ ] pid=2 DATA len=1094
84.65.183.175:53420 UDPv4 WRITE [334] to [AF_INET]84.65.183.175:53420: P_CONTROL_V1 kid=0 pid=[ #4 ] [ ] pid=3 DATA len=280
84.65.183.175:53420 UDPv4 READ [62] from [AF_INET]84.65.183.175:53420: P_ACK_V1 kid=0 pid=[ #4 ] [ 1 ]
84.65.183.175:53420 UDPv4 READ [62] from [AF_INET]84.65.183.175:53420: P_ACK_V1 kid=0 pid=[ #5 ] [ 2 ]
84.65.183.175:53420 UDPv4 READ [1160] from [AF_INET]84.65.183.175:53420: P_CONTROL_V1 kid=0 pid=[ #6 ] [ 3 ] pid=2 DATA len=1094
84.65.183.175:53420 UDPv4 WRITE [62] to [AF_INET]84.65.183.175:53420: P_ACK_V1 kid=0 pid=[ #5 ] [ 2 ]
84.65.183.175:53420 UDPv4 READ [1148] from [AF_INET]84.65.183.175:53420: P_CONTROL_V1 kid=0 pid=[ #7 ] [ ] pid=3 DATA len=1094
84.65.183.175:53420 VERIFY OK: depth=1, CN=my.server.com
84.65.183.175:53420 VERIFY OK: depth=0, CN=wrt-router.net
84.65.183.175:53420 UDPv4 WRITE [224] to [AF_INET]84.65.183.175:53420: P_CONTROL_V1 kid=0 pid=[ #6 ] [ 3 ] pid=4 DATA len=158
84.65.183.175:53420 UDPv4 READ [513] from [AF_INET]84.65.183.175:53420: P_CONTROL_V1 kid=0 pid=[ #8 ] [ ] pid=4 DATA len=459
84.65.183.175:53420 peer info: IV_VER=2.5.0
84.65.183.175:53420 peer info: IV_PLAT=linux
84.65.183.175:53420 peer info: IV_PROTO=6
84.65.183.175:53420 peer info: IV_NCP=2
84.65.183.175:53420 peer info: IV_CIPHERS=AES-128-GCM:AES-256-GCM:AES-128-CBC:CHACHA20-POLY1305
84.65.183.175:53420 peer info: IV_LZ4=1
84.65.183.175:53420 peer info: IV_LZ4v2=1
84.65.183.175:53420 peer info: IV_LZO=1
84.65.183.175:53420 peer info: IV_COMP_STUB=1
84.65.183.175:53420 peer info: IV_COMP_STUBv2=1
84.65.183.175:53420 peer info: IV_TCPNL=1
84.65.183.175:53420 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1569', remote='link-mtu 1534'
84.65.183.175:53420 WARNING: 'cipher' is used inconsistently, local='cipher AES-256-CBC', remote='cipher CHACHA20-POLY1305'
84.65.183.175:53420 WARNING: 'auth' is used inconsistently, local='auth SHA256', remote='auth [null-digest]'
84.65.183.175:53420 UDPv4 WRITE [305] to [AF_INET]84.65.183.175:53420: P_CONTROL_V1 kid=0 pid=[ #7 ] [ 4 ] pid=5 DATA len=239
84.65.183.175:53420 UDPv4 READ [62] from [AF_INET]84.65.183.175:53420: P_ACK_V1 kid=0 pid=[ #9 ] [ 4 ]
84.65.183.175:53420 UDPv4 READ [62] from [AF_INET]84.65.183.175:53420: P_ACK_V1 kid=0 pid=[ #10 ] [ 5 ]
84.65.183.175:53420 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
84.65.183.175:53420 [wrt-router.net] Peer Connection Initiated with [AF_INET]84.65.183.175:53420
MULTI: new connection by client 'wrt-router.net' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
MULTI_sva: pool returned IPv4=10.8.0.4, IPv6=(Not enabled)
MULTI: Learn: 10.8.0.4 -> wrt-router.net/84.65.183.175:53420
MULTI: primary virtual IP for wrt-router.net/84.65.183.175:53420: 10.8.0.4
wrt-router.net/84.65.183.175:53420 UDPv4 READ [89] from [AF_INET]84.65.183.175:53420: P_CONTROL_V1 kid=0 pid=[ #11 ] [ ] pid=5 DATA len=35
wrt-router.net/84.65.183.175:53420 PUSH: Received control message: 'PUSH_REQUEST'
wrt-router.net/84.65.183.175:53420 SENT CONTROL [wrt-router.net]: 'PUSH_REPLY,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.4 255.255.255.0,peer-id 1,cipher AES-256-GCM' (status=1)
wrt-router.net/84.65.183.175:53420 Data Channel: using negotiated cipher 'AES-256-GCM'
wrt-router.net/84.65.183.175:53420 Data Channel MTU parms [ L:1549 D:1450 EF:49 EB:406 ET:0 EL:3 ]
wrt-router.net/84.65.183.175:53420 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
wrt-router.net/84.65.183.175:53420 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [62] to [AF_INET]84.65.183.175:53420: P_ACK_V1 kid=0 pid=[ #8 ] [ 5 ]
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [252] to [AF_INET]84.65.183.175:53420: P_CONTROL_V1 kid=0 pid=[ #9 ] [ ] pid=6 DATA len=198
wrt-router.net/84.65.183.175:53420 UDPv4 READ [62] from [AF_INET]84.65.183.175:53420: P_ACK_V1 kid=0 pid=[ #12 ] [ 6 ]
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 READ [40] from [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39
wrt-router.net/84.65.183.175:53420 UDPv4 WRITE [40] to [AF_INET]84.65.183.175:53420: P_DATA_V2 kid=0 DATA len=39

TinCanTech

--verb 4 please.

300000

Pushed option removed by filter: 'redirect-gateway local'

N Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:1: block-outside-dns (2.5.0)

So something wrong on client config

Remove this line from config

"redirect-private def1 "

"pull-filter ignore "redirect-gateway""

youdsmedia

To be clear, where exactly should redirect-gateway appear? In client config, or server config?

When I remove the filter from local config I loose connectivity, this is reproduced immediately and I have to uncomment the line to get internet back. It is satisfyingly consistent.

Also, how to make changes between reboots? My openvpn config file is in /tmp/openvpncl and when I reboot settings are reverted back.

youdsmedia

Server log follows.

Current Parameter Settings:
  config = 'server.conf'
  mode = 1
  persist_config = DISABLED
  persist_mode = 1
  show_ciphers = DISABLED
  show_digests = DISABLED
  show_engines = DISABLED
  genkey = DISABLED
  key_pass_file = '[UNDEF]'
  show_tls_ciphers = DISABLED
  connect_retry_max = 0
Connection profiles [0]:
  proto = udp
  local = '[UNDEF]'
  local_port = '1194'
  remote = '[UNDEF]'
  remote_port = '1194'
  remote_float = DISABLED
  bind_defined = DISABLED
  bind_local = ENABLED
  bind_ipv6_only = DISABLED
  connect_retry_seconds = 5
  connect_timeout = 120
  socks_proxy_server = '[UNDEF]'
  socks_proxy_port = '[UNDEF]'
  tun_mtu = 1500
  tun_mtu_defined = ENABLED
  link_mtu = 1500
  link_mtu_defined = DISABLED
  tun_mtu_extra = 0
  tun_mtu_extra_defined = DISABLED
  mtu_discover_type = -1
  fragment = 0
  mssfix = 1450
  explicit_exit_notification = 1
Connection profiles END
  remote_random = DISABLED
  ipchange = '[UNDEF]'
  dev = 'tun'
  dev_type = '[UNDEF]'
  dev_node = '[UNDEF]'
  lladdr = '[UNDEF]'
  topology = 3
  ifconfig_local = '10.8.0.1'
  ifconfig_remote_netmask = '255.255.255.0'
  ifconfig_noexec = DISABLED
  ifconfig_nowarn = DISABLED
  ifconfig_ipv6_local = '[UNDEF]'
  ifconfig_ipv6_netbits = 0
  ifconfig_ipv6_remote = '[UNDEF]'
  shaper = 0
  mtu_test = 0
  mlock = DISABLED
  keepalive_ping = 10
  keepalive_timeout = 120
  inactivity_timeout = 0
  ping_send_timeout = 10
  ping_rec_timeout = 240
  ping_rec_timeout_action = 2
  ping_timer_remote = DISABLED
  remap_sigusr1 = 0
  persist_tun = ENABLED
  persist_local_ip = DISABLED
  persist_remote_ip = DISABLED
  persist_key = ENABLED
  passtos = DISABLED
  resolve_retry_seconds = 1000000000
  resolve_in_advance = DISABLED
  username = '[UNDEF]'
  groupname = '[UNDEF]'
  chroot_dir = '[UNDEF]'
  cd_dir = '[UNDEF]'
  selinux_context = '[UNDEF]'
  writepid = '[UNDEF]'
  up_script = '[UNDEF]'
  down_script = '[UNDEF]'
  down_pre = DISABLED
  up_restart = DISABLED
  up_delay = DISABLED
  daemon = DISABLED
  inetd = 0
  log = ENABLED
  suppress_timestamps = ENABLED
  machine_readable_output = DISABLED
  nice = 0
  verbosity = 4
  mute = 0
  gremlin = 0
  status_file = 'openvpn-status.log'
  status_file_version = 2
  status_file_update_freq = 60
  occ = ENABLED
  rcvbuf = 0
  sndbuf = 0
  mark = 0
  sockflags = 0
  fast_io = ENABLED
  comp.alg = 0
  comp.flags = 0
  route_script = '[UNDEF]'
  route_default_gateway = '10.8.0.2'
  route_default_metric = 0
  route_noexec = DISABLED
  route_delay = 0
  route_delay_window = 30
  route_delay_defined = DISABLED
  route_nopull = DISABLED
  route_gateway_via_dhcp = DISABLED
  allow_pull_fqdn = DISABLED
  management_addr = '[UNDEF]'
  management_port = '[UNDEF]'
  management_user_pass = '[UNDEF]'
  management_log_history_cache = 250
  management_echo_buffer_size = 100
  management_write_peer_info_file = '[UNDEF]'
  management_client_user = '[UNDEF]'
  management_client_group = '[UNDEF]'
  management_flags = 0
  shared_secret_file = '[UNDEF]'
  key_direction = 0
  ciphername = 'AES-256-CBC'
  ncp_enabled = ENABLED
  ncp_ciphers = 'AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:BF-CBC'
  authname = 'sha256'
  prng_hash = 'SHA1'
  prng_nonce_secret_len = 16
  keysize = 0
  engine = DISABLED
  replay = ENABLED
  mute_replay_warnings = DISABLED
  replay_window = 64
  replay_time = 15
  packet_id_file = '[UNDEF]'
  use_iv = ENABLED
  test_crypto = DISABLED
  tls_server = ENABLED
  tls_client = DISABLED
  key_method = 2
  ca_file = 'ca.crt'
  ca_path = '[UNDEF]'
  dh_file = 'dh2048.pem'
  cert_file = 'vpn.gethosted.online.crt'
  extra_certs_file = '[UNDEF]'
  priv_key_file = 'vpn.gethosted.online.key'
  pkcs12_file = '[UNDEF]'
  cipher_list = '[UNDEF]'
  cipher_list_tls13 = '[UNDEF]'
  tls_cert_profile = '[UNDEF]'
  tls_verify = '[UNDEF]'
  tls_export_cert = '[UNDEF]'
  verify_x509_type = 0
  verify_x509_name = '[UNDEF]'
  crl_file = '[UNDEF]'
  ns_cert_type = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_eku = '[UNDEF]'
  ssl_flags = 0
  tls_timeout = 2
  renegotiate_bytes = -1
  renegotiate_packets = 0
  renegotiate_seconds = 3600
  handshake_window = 60
  transition_window = 3600
  single_session = DISABLED
  push_peer_info = DISABLED
  tls_exit = DISABLED
  tls_auth_file = 'ta.key'
  tls_crypt_file = '[UNDEF]'
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_pin_cache_period = -1
  pkcs11_id = '[UNDEF]'
  pkcs11_id_management = DISABLED
  server_network = 10.8.0.0
  server_netmask = 255.255.255.0
  server_network_ipv6 = ::
  server_netbits_ipv6 = 0
  server_bridge_ip = 0.0.0.0
  server_bridge_netmask = 0.0.0.0
  server_bridge_pool_start = 0.0.0.0
  server_bridge_pool_end = 0.0.0.0
  push_entry = 'redirect-gateway def1'
  push_entry = 'route-gateway 10.8.0.1'
  push_entry = 'topology subnet'
  push_entry = 'ping 10'
  push_entry = 'ping-restart 120'
  ifconfig_pool_defined = ENABLED
  ifconfig_pool_start = 10.8.0.2
  ifconfig_pool_end = 10.8.0.253
  ifconfig_pool_netmask = 255.255.255.0
  ifconfig_pool_persist_filename = 'ipp.txt'
  ifconfig_pool_persist_refresh_freq = 600
  ifconfig_ipv6_pool_defined = DISABLED
  ifconfig_ipv6_pool_base = ::
  ifconfig_ipv6_pool_netbits = 0
  n_bcast_buf = 256
  tcp_queue_limit = 64
  real_hash_size = 256
  virtual_hash_size = 256
  client_connect_script = '[UNDEF]'
  learn_address_script = '[UNDEF]'
  client_disconnect_script = '[UNDEF]'
  client_config_dir = '[UNDEF]'
  ccd_exclusive = DISABLED
  tmp_dir = '/tmp'
  push_ifconfig_defined = DISABLED
  push_ifconfig_local = 0.0.0.0
  push_ifconfig_remote_netmask = 0.0.0.0
  push_ifconfig_ipv6_defined = DISABLED
  push_ifconfig_ipv6_local = ::/0
  push_ifconfig_ipv6_remote = ::
  enable_c2c = ENABLED
  duplicate_cn = DISABLED
  cf_max = 0
  cf_per = 0
  max_clients = 1024
  max_routes_per_client = 256
  auth_user_pass_verify_script = '[UNDEF]'
  auth_user_pass_verify_script_via_file = DISABLED
  auth_token_generate = DISABLED
  auth_token_lifetime = 0
  port_share_host = '[UNDEF]'
  port_share_port = '[UNDEF]'
  client = DISABLED
  pull = DISABLED
  auth_user_pass_file = '[UNDEF]'
OpenVPN 2.4.9 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 24 2020
library versions: OpenSSL 1.1.1c FIPS  28 May 2019, LZO 2.08
Diffie-Hellman initialized with 2048 bit key
Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
TLS-Auth MTU parms [ L:1621 D:1172 EF:78 EB:0 ET:0 EL:3 ]
TUN/TAP device tun0 opened
TUN/TAP TX queue length set to 100
do_ifconfig, tt->did_ifconfig_ipv6_setup=0
/sbin/ip link set dev tun0 up mtu 1500
/sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
Could not determine IPv4/IPv6 protocol. Using AF_INET
Socket Buffers: R=[212992->212992] S=[212992->212992]
UDPv4 link local (bound): [AF_INET][undef]:1194
UDPv4 link remote: [AF_UNSPEC]
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
ifconfig_pool_read(), in='wrt-router.net,10.8.0.4', TODO: IPv6
succeeded -> ifconfig_pool_set()
IFCONFIG POOL LIST
wrt-router.net,10.8.0.4
Initialization Sequence Completed
MULTI: multi_create_instance called
84.65.183.175:33868 Re-using SSL/TLS context
84.65.183.175:33868 Control Channel MTU parms [ L:1621 D:1172 EF:78 EB:0 ET:0 EL:3 ]
84.65.183.175:33868 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
84.65.183.175:33868 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1569,tun-mtu 1500,proto UDPv4,keydir 0,cipher AES-256-CBC,auth SHA256,keysize 256,tls-auth,key-method 2,tls-server'
84.65.183.175:33868 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1569,tun-mtu 1500,proto UDPv4,keydir 1,cipher AES-256-CBC,auth SHA256,keysize 256,tls-auth,key-method 2,tls-client'
84.65.183.175:33868 TLS: Initial packet from [AF_INET]84.65.183.175:33868, sid=7d2fda36 a5f9c09c
84.65.183.175:33868 VERIFY OK: depth=1, CN=vpn.gethosted.online
84.65.183.175:33868 VERIFY OK: depth=0, CN=wrt-router.net
84.65.183.175:33868 peer info: IV_VER=2.5.0
84.65.183.175:33868 peer info: IV_PLAT=linux
84.65.183.175:33868 peer info: IV_PROTO=6
84.65.183.175:33868 peer info: IV_NCP=2
84.65.183.175:33868 peer info: IV_CIPHERS=AES-128-GCM:AES-256-GCM:AES-128-CBC:AES-256-CBC
84.65.183.175:33868 peer info: IV_LZ4=1
84.65.183.175:33868 peer info: IV_LZ4v2=1
84.65.183.175:33868 peer info: IV_LZO=1
84.65.183.175:33868 peer info: IV_COMP_STUB=1
84.65.183.175:33868 peer info: IV_COMP_STUBv2=1
84.65.183.175:33868 peer info: IV_TCPNL=1
84.65.183.175:33868 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
84.65.183.175:33868 [wrt-router.net] Peer Connection Initiated with [AF_INET]84.65.183.175:33868
wrt-router.net/84.65.183.175:33868 MULTI_sva: pool returned IPv4=10.8.0.4, IPv6=(Not enabled)
wrt-router.net/84.65.183.175:33868 MULTI: Learn: 10.8.0.4 -> wrt-router.net/84.65.183.175:33868
wrt-router.net/84.65.183.175:33868 MULTI: primary virtual IP for wrt-router.net/84.65.183.175:33868: 10.8.0.4
wrt-router.net/84.65.183.175:33868 PUSH: Received control message: 'PUSH_REQUEST'
wrt-router.net/84.65.183.175:33868 SENT CONTROL [wrt-router.net]: 'PUSH_REPLY,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.4 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
wrt-router.net/84.65.183.175:33868 Data Channel: using negotiated cipher 'AES-256-GCM'
wrt-router.net/84.65.183.175:33868 Data Channel MTU parms [ L:1549 D:1450 EF:49 EB:406 ET:0 EL:3 ]
wrt-router.net/84.65.183.175:33868 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
wrt-router.net/84.65.183.175:33868 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key

300000

do you want to change ip address when connect to openvpn if that case this is correct connection

When I remove the filter from local config I loose connectivity,

when connect ok but you lose internet and only can ping 10.8.0.1 that is what you are looking for and in order to make it work you need making openvpn server NAT and IPforward so your client computer can going to internet.

so I tell you in advace

you need to add this line on server config and connect again , maybe when you add this you cant go to internet."

how do you setup server and what did you do , your server not perform NAT and IPforward so when you connect it stop at server that is why you only can ping ip server 10.8.0.1 only.

youdsmedia

I'm not sure, another technician did it. Can you help? I would need to know steps to reproduce it. I'm happy to work on the command line.

Kind regards

300000

you need come back from start and follow the way setup you like . nobody know how your server setup and now you ask help for what ? how do you perform NAT your server ? you didnot say anything abou that only server config is not enouth

TinCanTech

300000 wrote how do you setup server and what did you do

youdsmedia wrote I'm not sure, another technician did it

If you need professional support then I am available for hire.

youdsmedia

TinCanTech wrote
300000 wrote how do you setup server and what did you do

youdsmedia wrote I'm not sure, another technician did it
If you need professional support then I am available for hire.

Yeah that would be cool, email addy is craig dot fairhurst at youds dot com

TinCanTech

email: tincanteksup <at> gmail dot com

youdsmedia

Thanks, I’ll email from my private account as I’m locked out of my server that runs work addy.

Email coming now.

« Previous Page