Ethernet Bridging - Please Help me

StiStaStokes

I have got serveral Problems with my Ethernet Bridging setup (it doesnt work):

Whats the current Status:

Here are all my configs:

dev tap0
proto udp
script-security 2
up up.sh
down down.sh
ca ca.crt
cert server.crt
key server.key
tls-auth ta.key 0
dh none
ecdh-curve secp521r1
port 1194
server-bridge 192.168.178.24 255.255.255.0 192.168.178.128 192.168.178.254
topology subnet
cipher AES-256-GCM
auth SHA512
tls-version-min 1.2
keepalive 10 120
max-clients 50
client-to-client
duplicate-cn
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 3
mute 10
compress lz4-v2
push "compress lz4-v2"

Client (windows client with only one tap interface, adding the option dev-node doesnt change something):

client
remote mydyndns 1194
dev tap
proto udp
ca ca.crt
cert client1.crt
key client1.key
tls-auth ta.key 1
ecdh-curve secp521r1
cipher AES-256-GCM
auth SHA512
tls-version-min 1.2
remote-cert-tls server
keepalive 10 120
verb 3
mute 10

The scrips "up.sh" contains (down.sh revers the rules):

bridge=br0
iptables -A FORWARD -i br0 -o tap0 -j ACCEPT
iptables -A FORWARD -i tap0 -o br0 -j ACCEPT
iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -p udp -m udp --dport 1194 -j ACCEPT
brctl addif "$bridge" "$1"

And both scrips have chown root:root and chmod 775, so they both run (i checked that in the log)

my settings for /etc/network/interfaces are the following:

 source /etc/network/interfaces.d/*
 auto lo
 iface lo inet loopback
 iface eth0 inet manual
 auto br0
 iface br0 inet static
	address 192.168.178.24 
	netmask 255.255.255.0
	network 192.168.178.0
	gateway 192.168.178.1
	broadcast 192.168.178.255
	dns-nameservers 127.0.0.1
	bridge_ports enp1s0 
	post-up service unbound start

Were unbound is my DNS server (located on the same pc as the openvpn server).
So to sum up:
- My local lan is: 192.168.178.0/24
- My openvpn server has the adress 192.168.178.24 in the local lan
- i use TLS with elliptic curves and thats why i set "dh none"(https://wiki.archlinux.org/index.php/OpenVPN)

Right now i am able to connect to my OpenVPN Server with 1 client.
This client gets the IP 192.168.178.128

brctl show gives me

br0             8000.4ccc6ab3715b       no              enp1s0                                                                                                                  
                                                                        tap0

Were are the problems?

i cannot connect more then one client
- with differnt keys (ofc both function when only one of the clients connect)
- or with the same key (even tho i set the "duplicate-cn" option)

the connected client (ip 192.168.178.128) cannot ping the server (192.168.178.24) and cannot ping any pc in my lan (or use any service in the lan)
- it doesnt work when i turn off EVERY firewall of on client and server and the lan computers i wanna ping
- the client is a windows machine (although error and 2 are the same on Linux pcs i tested that) and i did set the metric to 1 (every other metric is
higher)

Pcs on my lan cannot ping the connected client (192.168.178.24)

When i restart the connection on the client i get the error: TLS out of sync. When i restart the server i can connect again or if i wait approx 1 min
but this feels kinda weird to me

last words
I am realy frustrated at this point couse after two days of non stop searching for a solution i see no light at the end.
I would be rly rly greatfull if someone could help me here / find a solution with me.

TinCanTech

You obviously have not read your log files ..

StiStaStokes

TinCanTech wrote You obviously have not read your log files ..

What point makes you think that i dindt read the logs (i did read them, although i think it is quite normal that i do not understand every point, but there was nothing like "ERROR YOU FUCKED UP" in the logs)

To my first point
There is nothing with a big ERROR in the logs
second clients get stuck in UDP link remote: [AF_INET]
nothing more is written in the logs

The Second Point:
Pings with the the windows command line are not shown in the logs, i get a host unknown nothing more

The third Point:
Same story

The third Point:
i here wrote the error from the logs and there is nothing more how i see it, after some time the client just retries and it works.

I could increase the log value, yes, but i got my limits (im a newbie when it comes to networking) and right now i cannot get any more information out of the logs that helps me solve my errors.
If you need anything out of the logs tho to help me solve it, i can give you all the logs you need

TinCanTech

Please add your logs as per this howto:
https://forums.openvpn.net/viewtopic.php?f=30&t=22603

StiStaStokes

TinCanTech wrote Please add your logs as per this howto:
https://forums.openvpn.net/viewtopic.php?f=30&t=22603

Client log (with restarting error and with pinging to the server)

2021-03-12 21:58:48 Consider setting groups/curves preference with tls-groups instead of forcing a specific curve with ecdh-curve.
2021-03-12 21:58:48 us=417362 Current Parameter Settings:
2021-03-12 21:58:48 us=418340   config = 'Client.ovpn'
2021-03-12 21:58:48 us=418340   mode = 0
2021-03-12 21:58:48 us=418340   show_ciphers = DISABLED
2021-03-12 21:58:48 us=418340   show_digests = DISABLED
2021-03-12 21:58:48 us=418340   show_engines = DISABLED
2021-03-12 21:58:48 us=418340   genkey = DISABLED
2021-03-12 21:58:48 us=418340   genkey_filename = '[UNDEF]'
2021-03-12 21:58:48 us=418340   key_pass_file = '[UNDEF]'
2021-03-12 21:58:48 us=418340   show_tls_ciphers = DISABLED
2021-03-12 21:58:48 us=418340 NOTE: --mute triggered...
2021-03-12 21:58:48 us=418340 291 variation(s) on previous 10 message(s) suppressed by --mute
2021-03-12 21:58:48 us=418340 OpenVPN 2.5.1 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Feb 24 2021
2021-03-12 21:58:48 us=418340 Windows version 10.0 (Windows 10 or greater) 64bit
2021-03-12 21:58:48 us=418340 library versions: OpenSSL 1.1.1j  16 Feb 2021, LZO 2.10
Enter Management Password:
2021-03-12 21:58:48 us=421266 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
2021-03-12 21:58:48 us=421266 Need hold release from management interface, waiting...
2021-03-12 21:58:48 us=752644 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
2021-03-12 21:58:48 us=854899 MANAGEMENT: CMD 'state on'
2021-03-12 21:58:48 us=854899 MANAGEMENT: CMD 'log all on'
2021-03-12 21:58:49 us=36234 MANAGEMENT: CMD 'echo all on'
2021-03-12 21:58:49 us=46971 MANAGEMENT: CMD 'bytecount 5'
2021-03-12 21:58:49 us=54779 MANAGEMENT: CMD 'hold off'
2021-03-12 21:58:49 us=63565 MANAGEMENT: CMD 'hold release'
2021-03-12 21:58:49 us=72347 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
2021-03-12 21:58:49 us=72347 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
2021-03-12 21:58:49 us=72347 Control Channel MTU parms [ L:1653 D:1140 EF:110 EB:0 ET:0 EL:3 ]
2021-03-12 21:58:49 us=73322 MANAGEMENT: >STATE:1615582729,RESOLVE,,,,,,
2021-03-12 21:58:49 us=265785 Data Channel MTU parms [ L:1653 D:1450 EF:121 EB:411 ET:32 EL:3 ]
2021-03-12 21:58:49 us=265785 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1581,tun-mtu 1532,proto UDPv4,keydir 1,cipher AES-256-GCM,auth [null-digest],keysize 256,tls-auth,key-method 2,tls-client'
2021-03-12 21:58:49 us=265785 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1581,tun-mtu 1532,proto UDPv4,keydir 0,cipher AES-256-GCM,auth [null-digest],keysize 256,tls-auth,key-method 2,tls-server'
2021-03-12 21:58:49 us=265785 TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:1194
2021-03-12 21:58:49 us=265785 Socket Buffers: R=[65536->65536] S=[65536->65536]
2021-03-12 21:58:49 us=265785 UDP link local (bound): [AF_INET][undef]:1194
2021-03-12 21:58:49 us=265785 UDP link remote: [AF_INET]x.x.x.x:1194
2021-03-12 21:58:49 us=265785 MANAGEMENT: >STATE:1615582729,WAIT,,,,,,
2021-03-12 21:58:49 us=269689 MANAGEMENT: >STATE:1615582729,AUTH,,,,,,
2021-03-12 21:58:49 us=269689 TLS: Initial packet from [AF_INET]x.x.x.x:1194, sid=c3469cac b22f64a0
2021-03-12 21:58:49 us=297019 VERIFY OK: depth=1, CN=server
2021-03-12 21:58:49 us=297019 VERIFY KU OK
2021-03-12 21:58:49 us=297019 Validating certificate extended key usage
2021-03-12 21:58:49 us=297019 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2021-03-12 21:58:49 us=297019 VERIFY EKU OK
2021-03-12 21:58:49 us=297019 VERIFY OK: depth=0, CN=server
2021-03-12 21:58:49 us=327274 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1581', remote='link-mtu 1582'
2021-03-12 21:58:49 us=327274 WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
2021-03-12 21:58:49 us=327274 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 521 bit EC, curve: secp521r1
2021-03-12 21:58:49 us=328250 [server] Peer Connection Initiated with [AF_INET]x.x.x.x:1194
2021-03-12 21:58:50 us=386557 MANAGEMENT: >STATE:1615582730,GET_CONFIG,,,,,,
2021-03-12 21:58:50 us=386557 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
2021-03-12 21:58:50 us=388473 PUSH: Received control message: 'PUSH_REPLY,compress lz4-v2,route-gateway 192.168.178.24,ping 10,ping-restart 120,ifconfig 192.168.178.128 255.255.255.0,peer-id 0,cipher AES-256-GCM'
2021-03-12 21:58:50 us=388473 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
2021-03-12 21:58:50 us=388473 OPTIONS IMPORT: timers and/or timeouts modified
2021-03-12 21:58:50 us=389448 OPTIONS IMPORT: compression parms modified
2021-03-12 21:58:50 us=389448 LZ4v2 compression initializing
2021-03-12 21:58:50 us=389448 OPTIONS IMPORT: --ifconfig/up options modified
2021-03-12 21:58:50 us=389448 OPTIONS IMPORT: route-related options modified
2021-03-12 21:58:50 us=389448 OPTIONS IMPORT: peer-id set
2021-03-12 21:58:50 us=389448 OPTIONS IMPORT: adjusting link_mtu to 1656
2021-03-12 21:58:50 us=389448 OPTIONS IMPORT: data channel crypto options modified
2021-03-12 21:58:50 us=389448 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2021-03-12 21:58:50 us=389448 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2021-03-12 21:58:50 us=389448 interactive service msg_channel=636
2021-03-12 21:58:50 us=389448 open_tun
2021-03-12 21:58:50 us=402133 tap-windows6 device [civ] opened
2021-03-12 21:58:50 us=402133 TAP-Windows Driver Version 9.24 
2021-03-12 21:58:50 us=402133 TAP-Windows MTU=1500
2021-03-12 21:58:50 us=407013 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.178.128/255.255.255.0 on interface {67D69077-17DA-4C30-A02B-D91268799247} [DHCP-serv: 192.168.178.0, lease-time: 31536000]
2021-03-12 21:58:50 us=411894 Successful ARP Flush on interface [11] {67D69077-17DA-4C30-A02B-D91268799247}
2021-03-12 21:58:50 us=417749 do_ifconfig, ipv4=1, ipv6=0
2021-03-12 21:58:50 us=417749 MANAGEMENT: >STATE:1615582730,ASSIGN_IP,,192.168.178.128,,,,
2021-03-12 21:58:50 us=418725 IPv4 MTU set to 1500 on interface 11 using service
2021-03-12 21:58:55 us=24131 TEST ROUTES: 0/0 succeeded len=0 ret=1 a=0 u/d=up
2021-03-12 21:58:55 us=24131 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2021-03-12 21:58:55 us=24131 Initialization Sequence Completed
2021-03-12 21:58:55 us=24131 MANAGEMENT: >STATE:1615582735,CONNECTED,SUCCESS,192.168.178.128,x.x.x.x,1194,,
2021-03-12 21:59:55 us=433607 MANAGEMENT: CMD 'signal SIGHUP'
2021-03-12 21:59:55 us=434581 TCP/UDP: Closing socket
2021-03-12 21:59:55 us=434581 Closing TUN/TAP interface
2021-03-12 21:59:55 us=529254 TAP: DHCP address released
2021-03-12 21:59:55 us=531206 SIGHUP[hard,] received, process restarting
2021-03-12 21:59:55 us=532181 MANAGEMENT: >STATE:1615582795,RECONNECTING,SIGHUP,,,,,
2021-03-12 21:59:55 us=532181 Consider setting groups/curves preference with tls-groups instead of forcing a specific curve with ecdh-curve.
2021-03-12 21:59:55 us=534133 Current Parameter Settings:
2021-03-12 21:59:55 us=534133   config = 'Client.ovpn'
2021-03-12 21:59:55 us=534133   mode = 0
2021-03-12 21:59:55 us=534133   show_ciphers = DISABLED
2021-03-12 21:59:55 us=534133   show_digests = DISABLED
2021-03-12 21:59:55 us=534133   show_engines = DISABLED
2021-03-12 21:59:55 us=534133   genkey = DISABLED
2021-03-12 21:59:55 us=534133   genkey_filename = '[UNDEF]'
2021-03-12 21:59:55 us=534133   key_pass_file = '[UNDEF]'
2021-03-12 21:59:55 us=534133   show_tls_ciphers = DISABLED
2021-03-12 21:59:55 us=534133 NOTE: --mute triggered...
2021-03-12 21:59:55 us=534133 291 variation(s) on previous 10 message(s) suppressed by --mute
2021-03-12 21:59:55 us=535109 OpenVPN 2.5.1 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Feb 24 2021
2021-03-12 21:59:55 us=535109 Windows version 10.0 (Windows 10 or greater) 64bit
2021-03-12 21:59:55 us=535109 library versions: OpenSSL 1.1.1j  16 Feb 2021, LZO 2.10
2021-03-12 21:59:55 us=535109 Restart pause, 5 second(s)
2021-03-12 22:00:00 us=538187 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
2021-03-12 22:00:00 us=538187 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
2021-03-12 22:00:00 us=539129 Control Channel MTU parms [ L:1653 D:1140 EF:110 EB:0 ET:0 EL:3 ]
2021-03-12 22:00:00 us=539129 MANAGEMENT: >STATE:1615582800,RESOLVE,,,,,,
2021-03-12 22:00:05 us=740828 Data Channel MTU parms [ L:1653 D:1450 EF:121 EB:411 ET:32 EL:3 ]
2021-03-12 22:00:05 us=740828 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1581,tun-mtu 1532,proto UDPv4,keydir 1,cipher AES-256-GCM,auth [null-digest],keysize 256,tls-auth,key-method 2,tls-client'
2021-03-12 22:00:05 us=740828 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1581,tun-mtu 1532,proto UDPv4,keydir 0,cipher AES-256-GCM,auth [null-digest],keysize 256,tls-auth,key-method 2,tls-server'
2021-03-12 22:00:05 us=740828 TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:1194
2021-03-12 22:00:05 us=740828 Socket Buffers: R=[65536->65536] S=[65536->65536]
2021-03-12 22:00:05 us=740828 UDP link local (bound): [AF_INET][undef]:1194
2021-03-12 22:00:05 us=741801 UDP link remote: [AF_INET]x.x.x.x:1194
2021-03-12 22:00:05 us=741801 MANAGEMENT: >STATE:1615582805,WAIT,,,,,,
2021-03-12 22:00:10 us=922001 TLS Error: local/remote TLS keys are out of sync: [AF_INET]x.x.x.x:1194 [0]
2021-03-12 22:00:21 us=342125 TLS Error: local/remote TLS keys are out of sync: [AF_INET]x.x.x.x:1194 [0]
2021-03-12 22:00:31 us=565468 TLS Error: local/remote TLS keys are out of sync: [AF_INET]x.x.x.x:1194 [0]
2021-03-12 22:00:41 us=662551 TLS Error: local/remote TLS keys are out of sync: [AF_INET]x.x.x.x:1194 [0]
2021-03-12 22:00:51 us=967502 TLS Error: local/remote TLS keys are out of sync: [AF_INET]x.x.x.x:1194 [0]
2021-03-12 22:01:02 us=32580 TLS Error: local/remote TLS keys are out of sync: [AF_INET]x.x.x.x:1194 [0]
2021-03-12 22:01:05 us=748404 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2021-03-12 22:01:05 us=748404 TLS Error: TLS handshake failed
2021-03-12 22:01:05 us=749096 TCP/UDP: Closing socket
2021-03-12 22:01:05 us=749096 SIGUSR1[soft,tls-error] received, process restarting

server log

Fri Mar 12 21:58:18 2021 us=381779 Current Parameter Settings:
Fri Mar 12 21:58:18 2021 us=381808   config = 'server.conf'
Fri Mar 12 21:58:18 2021 us=381814   mode = 1
Fri Mar 12 21:58:18 2021 us=381817   persist_config = DISABLED
Fri Mar 12 21:58:18 2021 us=381821   persist_mode = 1
Fri Mar 12 21:58:18 2021 us=381824   show_ciphers = DISABLED
Fri Mar 12 21:58:18 2021 us=381827   show_digests = DISABLED
Fri Mar 12 21:58:18 2021 us=381830   show_engines = DISABLED
Fri Mar 12 21:58:18 2021 us=381834   genkey = DISABLED
Fri Mar 12 21:58:18 2021 us=381837   key_pass_file = '[UNDEF]'
Fri Mar 12 21:58:18 2021 us=381840 NOTE: --mute triggered...
Fri Mar 12 21:58:18 2021 us=381848 276 variation(s) on previous 10 message(s) suppressed by --mute
Fri Mar 12 21:58:18 2021 us=381852 OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019
Fri Mar 12 21:58:18 2021 us=381858 library versions: OpenSSL 1.1.1d  10 Sep 2019, LZO 2.10
Fri Mar 12 21:58:18 2021 us=381903 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Fri Mar 12 21:58:18 2021 us=381958 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Fri Mar 12 21:58:18 2021 us=382322 ECDH curve secp521r1 added
Fri Mar 12 21:58:18 2021 us=382369 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Fri Mar 12 21:58:18 2021 us=382377 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Fri Mar 12 21:58:18 2021 us=382383 TLS-Auth MTU parms [ L:1654 D:1140 EF:110 EB:0 ET:0 EL:3 ]
Fri Mar 12 21:58:18 2021 us=382578 TUN/TAP device tap0 opened
Fri Mar 12 21:58:18 2021 us=382595 TUN/TAP TX queue length set to 100
Fri Mar 12 21:58:18 2021 us=382615 ./ethernet_bridging/up.sh tap0 1500 1654   init
Fri Mar 12 21:58:18 2021 us=390090 Data Channel MTU parms [ L:1654 D:1450 EF:122 EB:411 ET:32 EL:3 ]
Fri Mar 12 21:58:18 2021 us=390306 Could not determine IPv4/IPv6 protocol. Using AF_INET
Fri Mar 12 21:58:18 2021 us=390326 Socket Buffers: R=[212992->212992] S=[212992->212992]
Fri Mar 12 21:58:18 2021 us=390341 UDPv4 link local (bound): [AF_INET][undef]:1194
Fri Mar 12 21:58:18 2021 us=390361 UDPv4 link remote: [AF_UNSPEC]
Fri Mar 12 21:58:18 2021 us=390372 GID set to nogroup
Fri Mar 12 21:58:18 2021 us=390401 UID set to nobody
Fri Mar 12 21:58:18 2021 us=390415 MULTI: multi_init called, r=256 v=256
Fri Mar 12 21:58:18 2021 us=390444 IFCONFIG POOL: base=192.168.178.128 size=127, ipv6=0
Fri Mar 12 21:58:18 2021 us=390467 Initialization Sequence Completed
Fri Mar 12 21:58:49 2021 us=613983 MULTI: multi_create_instance called
Fri Mar 12 21:58:49 2021 us=614086 x.x.x.x:61822 Re-using SSL/TLS context
Fri Mar 12 21:58:49 2021 us=614117 x.x.x.x:61822 LZ4v2 compression initializing
Fri Mar 12 21:58:49 2021 us=614318 x.x.x.x:61822 Control Channel MTU parms [ L:1654 D:1140 EF:110 EB:0 ET:0 EL:3 ]
Fri Mar 12 21:58:49 2021 us=614344 x.x.x.x:61822 Data Channel MTU parms [ L:1654 D:1450 EF:122 EB:411 ET:32 EL:3 ]
Fri Mar 12 21:58:49 2021 us=614403 x.x.x.x:61822 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1582,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-GCM,auth [null-digest],keysize 256,tls-auth,key-method 2,tls-server'
Fri Mar 12 21:58:49 2021 us=614420 x.x.x.x:61822 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1582,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-GCM,auth [null-digest],keysize 256,tls-auth,key-method 2,tls-client'
Fri Mar 12 21:58:49 2021 us=614466 x.x.x.x:61822 TLS: Initial packet from [AF_INET]x.x.x.x:61822, sid=210d046e f4827126
Fri Mar 12 21:58:49 2021 us=670296 x.x.x.x:61822 VERIFY OK: depth=1, CN=server
Fri Mar 12 21:58:49 2021 us=670652 x.x.x.x:61822 VERIFY OK: depth=0, CN=client
Fri Mar 12 21:58:49 2021 us=671243 x.x.x.x:61822 peer info: IV_VER=2.5.1
Fri Mar 12 21:58:49 2021 us=671345 x.x.x.x:61822 peer info: IV_PLAT=win
Fri Mar 12 21:58:49 2021 us=671368 x.x.x.x:61822 peer info: IV_PROTO=6
Fri Mar 12 21:58:49 2021 us=671384 x.x.x.x:61822 peer info: IV_NCP=2
Fri Mar 12 21:58:49 2021 us=671401 x.x.x.x:61822 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM
Fri Mar 12 21:58:49 2021 us=671417 x.x.x.x:61822 peer info: IV_LZ4=1
Fri Mar 12 21:58:49 2021 us=671433 x.x.x.x:61822 peer info: IV_LZ4v2=1
Fri Mar 12 21:58:49 2021 us=671448 x.x.x.x:61822 peer info: IV_LZO=1
Fri Mar 12 21:58:49 2021 us=671465 x.x.x.x:61822 peer info: IV_COMP_STUB=1
Fri Mar 12 21:58:49 2021 us=671482 x.x.x.x:61822 peer info: IV_COMP_STUBv2=1
Fri Mar 12 21:58:49 2021 us=671498 x.x.x.x:61822 peer info: IV_TCPNL=1
Fri Mar 12 21:58:49 2021 us=671514 x.x.x.x:61822 peer info: IV_GUI_VER=OpenVPN_GUI_11
Fri Mar 12 21:58:49 2021 us=671561 x.x.x.x:61822 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1582', remote='link-mtu 1581'
Fri Mar 12 21:58:49 2021 us=671595 x.x.x.x:61822 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Fri Mar 12 21:58:49 2021 us=674847 x.x.x.x:61822 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
Fri Mar 12 21:58:49 2021 us=674921 x.x.x.x:61822 [client] Peer Connection Initiated with [AF_INET]x.x.x.x:61822
Fri Mar 12 21:58:49 2021 us=674971 client/x.x.x.x:61822 MULTI_sva: pool returned IPv4=192.168.178.128, IPv6=(Not enabled)
Fri Mar 12 21:58:50 2021 us=733745 client/x.x.x.x:61822 PUSH: Received control message: 'PUSH_REQUEST'
Fri Mar 12 21:58:50 2021 us=733847 client/x.x.x.x:61822 SENT CONTROL [client]: 'PUSH_REPLY,compress lz4-v2,route-gateway 192.168.178.24,ping 10,ping-restart 120,ifconfig 192.168.178.128 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Fri Mar 12 21:58:50 2021 us=733892 client/x.x.x.x:61822 Data Channel MTU parms [ L:1582 D:1450 EF:50 EB:411 ET:32 EL:3 ]
Fri Mar 12 21:58:50 2021 us=734094 client/x.x.x.x:61822 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Fri Mar 12 21:58:50 2021 us=734120 client/x.x.x.x:61822 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Fri Mar 12 21:58:50 2021 us=898991 client/x.x.x.x:61822 MULTI: Learn: 00:ff:67:d6:90:77 -> client/x.x.x.x:61822
Fri Mar 12 22:01:55 2021 us=803470 event_wait : Interrupted system call (code=4)
Fri Mar 12 22:01:55 2021 us=803857 TCP/UDP: Closing socket
Fri Mar 12 22:01:55 2021 us=803934 Closing TUN/TAP interface
Fri Mar 12 22:01:55 2021 us=840688 ./ethernet_bridging/down.sh tap0 1500 1654   init
iptables: Permission denied (you must be root).
iptables: Permission denied (you must be root).
iptables: Permission denied (you must be root).
iptables v1.8.2 (nf_tables): Couldn't load match `udp':No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
interface tap0 does not exist!
Fri Mar 12 22:01:55 2021 us=855964 WARNING: Failed running command (--up/--down): external program exited with error status: 1
Fri Mar 12 22:01:55 2021 us=856038 Exiting due to fatal error

I cant simulate the 2 clients connecting right now im sorry for that i will submit that if needed later

And yes i am an idiot, i dindt check the last messages in the server log, i need 2 run the down.sh script manually for example or find a different solution if i wanna keep the option user nobody, sorry for that!

TinCanTech

Have a look here:
https://github.com/OpenVPN/openvpn/tree/master/src/plugins/down-root

BTW, using --mute is going to drop information from your log.
Information which you probably need while debugging ..

StiStaStokes

TinCanTech wrote Have a look here:
https://github.com/OpenVPN/openvpn/tree/master/src/plugins/down-root

BTW, using --mute is going to drop information from your log.
Information which you probably need while debugging ..

Thanks for the tip i will directly change that tomorrow

https://github.com/OpenVPN/openvpn/tree/master/src/plugins/down-root
Thats realy helpful thank you

StiStaStokes

And just to be 100% sure i should be able to do this:

the connected client (ip 192.168.178.128) cannot ping the server (192.168.178.24) and cannot ping any pc in my lan (or use any service in the lan)

For example with (on client)

ping 192.168.178.24
ping 192.168.178.22

Or via an PC in the LAN (192.168.178.22)

ping 192.168.178.128

OR did i understand something wrong?

TinCanTech

You probably did something wrong.

We use these:
https://github.com/OpenVPN/openvpn/tree/master/sample/sample-scripts

StiStaStokes

TinCanTech wrote You probably did something wrong.

We use these:
https://github.com/OpenVPN/openvpn/tree/master/sample/sample-scripts

You here reffering to the following scrips i assume?
bridge-start
bridge-stop