I am trying to set up a VPN connection between two sites.
- The remote site has a camera running that broadcasts video using TCP, and additionally advertises itself on the network using mDNS/Bonjour.
- The local site has a laptop that should be able to connect to the camera and receive the broadast.
- In the middle there is a Linux server running on a cloud provider, hosting an OpenVPN server
Here's a diagram of the architecture:
My OpenVPN server config:
port 1194
proto udp6
dev tap
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
topology subnet
server-bridge 192.168.100.1 255.255.255.0 192.168.100.128 192.168.100.254
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 94.140.14.14"
push "dhcp-option DNS 94.140.15.15"
push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key
crl-verify crl.pem
ca ca.crt
cert server_rgpYVq742Cz4eLEj.crt
key server_rgpYVq742Cz4eLEj.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
client-config-dir /etc/openvpn/ccd
status /var/log/openvpn/status.log
verb 4
client-to-client
log-append /var/log/openvpn.log
push "route 192.168.100.0 255.255.255.0"
My client config:
client
proto udp
explicit-exit-notify
remote <redacted> 1194
dev tap
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name server_rgpYVq742Cz4eLEj name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
ignore-unknown-option block-outside-dns
setenv opt block-outside-dns # Prevent Windows 10 DNS leak
verb 4
I added the following rules on the server:
iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT
On the server, IPv4 forwarding is enabled.
I start the bridge manually:
# cat bridge_start.sh
#!/bin/bash
openvpn --mktun --dev tap0
brctl addbr br0
brctl addif br0 tap0
ifconfig tap0 0.0.0.0 promisc up
# ./bridge_start.sh
Tue Mar 16 11:00:38 2021 TUN/TAP device tap0 opened
Tue Mar 16 11:00:38 2021 Persist state set to: ON
Then I start OpenVPN:
Tue Mar 16 11:01:37 2021 us=667675 Current Parameter Settings:
Tue Mar 16 11:01:37 2021 us=667745 config = '/etc/openvpn/server.conf'
Tue Mar 16 11:01:37 2021 us=667754 mode = 1
Tue Mar 16 11:01:37 2021 us=667760 persist_config = DISABLED
Tue Mar 16 11:01:37 2021 us=667765 persist_mode = 1
Tue Mar 16 11:01:37 2021 us=667770 show_ciphers = DISABLED
Tue Mar 16 11:01:37 2021 us=667776 show_digests = DISABLED
Tue Mar 16 11:01:37 2021 us=667781 show_engines = DISABLED
Tue Mar 16 11:01:37 2021 us=667786 genkey = DISABLED
Tue Mar 16 11:01:37 2021 us=667791 key_pass_file = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=667796 show_tls_ciphers = DISABLED
Tue Mar 16 11:01:37 2021 us=667801 connect_retry_max = 0
Tue Mar 16 11:01:37 2021 us=667806 Connection profiles [0]:
Tue Mar 16 11:01:37 2021 us=667812 proto = udp6
Tue Mar 16 11:01:37 2021 us=667817 local = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=667822 local_port = '1194'
Tue Mar 16 11:01:37 2021 us=667827 remote = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=667927 remote_port = '1194'
Tue Mar 16 11:01:37 2021 us=667934 remote_float = DISABLED
Tue Mar 16 11:01:37 2021 us=667939 bind_defined = DISABLED
Tue Mar 16 11:01:37 2021 us=667943 bind_local = ENABLED
Tue Mar 16 11:01:37 2021 us=667948 bind_ipv6_only = DISABLED
Tue Mar 16 11:01:37 2021 us=667953 connect_retry_seconds = 5
Tue Mar 16 11:01:37 2021 us=667957 connect_timeout = 120
Tue Mar 16 11:01:37 2021 us=667962 socks_proxy_server = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=667967 socks_proxy_port = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=667972 tun_mtu = 1500
Tue Mar 16 11:01:37 2021 us=667976 tun_mtu_defined = ENABLED
Tue Mar 16 11:01:37 2021 us=667981 link_mtu = 1500
Tue Mar 16 11:01:37 2021 us=667986 link_mtu_defined = DISABLED
Tue Mar 16 11:01:37 2021 us=667991 tun_mtu_extra = 32
Tue Mar 16 11:01:37 2021 us=667995 tun_mtu_extra_defined = ENABLED
Tue Mar 16 11:01:37 2021 us=668000 mtu_discover_type = -1
Tue Mar 16 11:01:37 2021 us=668005 fragment = 0
Tue Mar 16 11:01:37 2021 us=668010 mssfix = 1450
Tue Mar 16 11:01:37 2021 us=668014 explicit_exit_notification = 0
Tue Mar 16 11:01:37 2021 us=668022 Connection profiles END
Tue Mar 16 11:01:37 2021 us=668027 remote_random = DISABLED
Tue Mar 16 11:01:37 2021 us=668032 ipchange = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668037 dev = 'tap'
Tue Mar 16 11:01:37 2021 us=668041 dev_type = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668046 dev_node = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668050 lladdr = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668055 topology = 3
Tue Mar 16 11:01:37 2021 us=668060 ifconfig_local = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668064 ifconfig_remote_netmask = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668069 ifconfig_noexec = DISABLED
Tue Mar 16 11:01:37 2021 us=668074 ifconfig_nowarn = DISABLED
Tue Mar 16 11:01:37 2021 us=668078 ifconfig_ipv6_local = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668083 ifconfig_ipv6_netbits = 0
Tue Mar 16 11:01:37 2021 us=668087 ifconfig_ipv6_remote = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668092 shaper = 0
Tue Mar 16 11:01:37 2021 us=668097 mtu_test = 0
Tue Mar 16 11:01:37 2021 us=668101 mlock = DISABLED
Tue Mar 16 11:01:37 2021 us=668106 keepalive_ping = 10
Tue Mar 16 11:01:37 2021 us=668111 keepalive_timeout = 120
Tue Mar 16 11:01:37 2021 us=668116 inactivity_timeout = 0
Tue Mar 16 11:01:37 2021 us=668120 ping_send_timeout = 10
Tue Mar 16 11:01:37 2021 us=668125 ping_rec_timeout = 240
Tue Mar 16 11:01:37 2021 us=668129 ping_rec_timeout_action = 2
Tue Mar 16 11:01:37 2021 us=668134 ping_timer_remote = DISABLED
Tue Mar 16 11:01:37 2021 us=668139 remap_sigusr1 = 0
Tue Mar 16 11:01:37 2021 us=668143 persist_tun = ENABLED
Tue Mar 16 11:01:37 2021 us=668148 persist_local_ip = DISABLED
Tue Mar 16 11:01:37 2021 us=668152 persist_remote_ip = DISABLED
Tue Mar 16 11:01:37 2021 us=668157 persist_key = ENABLED
Tue Mar 16 11:01:37 2021 us=668162 passtos = DISABLED
Tue Mar 16 11:01:37 2021 us=668166 resolve_retry_seconds = 1000000000
Tue Mar 16 11:01:37 2021 us=668171 resolve_in_advance = DISABLED
Tue Mar 16 11:01:37 2021 us=668176 username = 'nobody'
Tue Mar 16 11:01:37 2021 us=668180 groupname = 'nogroup'
Tue Mar 16 11:01:37 2021 us=668185 chroot_dir = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668190 cd_dir = '/etc/openvpn'
Tue Mar 16 11:01:37 2021 us=668194 writepid = '/run/openvpn/server.pid'
Tue Mar 16 11:01:37 2021 us=668199 up_script = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668218 down_script = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668223 down_pre = DISABLED
Tue Mar 16 11:01:37 2021 us=668228 up_restart = DISABLED
Tue Mar 16 11:01:37 2021 us=668232 up_delay = DISABLED
Tue Mar 16 11:01:37 2021 us=668237 daemon = ENABLED
Tue Mar 16 11:01:37 2021 us=668242 inetd = 0
Tue Mar 16 11:01:37 2021 us=668246 log = ENABLED
Tue Mar 16 11:01:37 2021 us=668251 suppress_timestamps = DISABLED
Tue Mar 16 11:01:37 2021 us=668255 machine_readable_output = DISABLED
Tue Mar 16 11:01:37 2021 us=668260 nice = 0
Tue Mar 16 11:01:37 2021 us=668273 verbosity = 4
Tue Mar 16 11:01:37 2021 us=668278 mute = 0
Tue Mar 16 11:01:37 2021 us=668283 gremlin = 0
Tue Mar 16 11:01:37 2021 us=668287 status_file = '/var/log/openvpn/status.log'
Tue Mar 16 11:01:37 2021 us=668292 status_file_version = 1
Tue Mar 16 11:01:37 2021 us=668297 status_file_update_freq = 10
Tue Mar 16 11:01:37 2021 us=668302 occ = ENABLED
Tue Mar 16 11:01:37 2021 us=668306 rcvbuf = 0
Tue Mar 16 11:01:37 2021 us=668311 sndbuf = 0
Tue Mar 16 11:01:37 2021 us=668316 mark = 0
Tue Mar 16 11:01:37 2021 us=668320 sockflags = 0
Tue Mar 16 11:01:37 2021 us=668325 fast_io = DISABLED
Tue Mar 16 11:01:37 2021 us=668329 comp.alg = 0
Tue Mar 16 11:01:37 2021 us=668334 comp.flags = 0
Tue Mar 16 11:01:37 2021 us=668339 route_script = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668344 route_default_gateway = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668352 route_default_metric = 0
Tue Mar 16 11:01:37 2021 us=668359 route_noexec = DISABLED
Tue Mar 16 11:01:37 2021 us=668367 route_delay = 0
Tue Mar 16 11:01:37 2021 us=668374 route_delay_window = 30
Tue Mar 16 11:01:37 2021 us=668382 route_delay_defined = DISABLED
Tue Mar 16 11:01:37 2021 us=668390 route_nopull = DISABLED
Tue Mar 16 11:01:37 2021 us=668396 route_gateway_via_dhcp = DISABLED
Tue Mar 16 11:01:37 2021 us=668400 allow_pull_fqdn = DISABLED
Tue Mar 16 11:01:37 2021 us=668405 management_addr = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668410 management_port = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668415 management_user_pass = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668419 management_log_history_cache = 250
Tue Mar 16 11:01:37 2021 us=668424 management_echo_buffer_size = 100
Tue Mar 16 11:01:37 2021 us=668429 management_write_peer_info_file = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668433 management_client_user = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668439 management_client_group = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668447 management_flags = 0
Tue Mar 16 11:01:37 2021 us=668456 shared_secret_file = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668464 key_direction = not set
Tue Mar 16 11:01:37 2021 us=668473 ciphername = 'AES-128-GCM'
Tue Mar 16 11:01:37 2021 us=668481 ncp_enabled = ENABLED
Tue Mar 16 11:01:37 2021 us=668486 ncp_ciphers = 'AES-128-GCM'
Tue Mar 16 11:01:37 2021 us=668491 authname = 'SHA256'
Tue Mar 16 11:01:37 2021 us=668496 prng_hash = 'SHA1'
Tue Mar 16 11:01:37 2021 us=668500 prng_nonce_secret_len = 16
Tue Mar 16 11:01:37 2021 us=668505 keysize = 0
Tue Mar 16 11:01:37 2021 us=668510 engine = DISABLED
Tue Mar 16 11:01:37 2021 us=668515 replay = ENABLED
Tue Mar 16 11:01:37 2021 us=668519 mute_replay_warnings = DISABLED
Tue Mar 16 11:01:37 2021 us=668524 replay_window = 64
Tue Mar 16 11:01:37 2021 us=668531 replay_time = 15
Tue Mar 16 11:01:37 2021 us=668540 packet_id_file = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668548 use_iv = ENABLED
Tue Mar 16 11:01:37 2021 us=668557 test_crypto = DISABLED
Tue Mar 16 11:01:37 2021 us=668565 tls_server = ENABLED
Tue Mar 16 11:01:37 2021 us=668573 tls_client = DISABLED
Tue Mar 16 11:01:37 2021 us=668579 key_method = 2
Tue Mar 16 11:01:37 2021 us=668584 ca_file = 'ca.crt'
Tue Mar 16 11:01:37 2021 us=668589 ca_path = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668594 dh_file = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668598 cert_file = 'server_rgpYVq742Cz4eLEj.crt'
Tue Mar 16 11:01:37 2021 us=668603 extra_certs_file = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668608 priv_key_file = 'server_rgpYVq742Cz4eLEj.key'
Tue Mar 16 11:01:37 2021 us=668614 pkcs12_file = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668623 cipher_list = 'TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256'
Tue Mar 16 11:01:37 2021 us=668631 cipher_list_tls13 = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668640 tls_cert_profile = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668648 tls_verify = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668656 tls_export_cert = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668664 verify_x509_type = 0
Tue Mar 16 11:01:37 2021 us=668672 verify_x509_name = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668683 crl_file = 'crl.pem'
Tue Mar 16 11:01:37 2021 us=668688 ns_cert_type = 0
Tue Mar 16 11:01:37 2021 us=668693 remote_cert_ku[i] = 0
Tue Mar 16 11:01:37 2021 us=668699 remote_cert_ku[i] = 0
Tue Mar 16 11:01:37 2021 us=668708 remote_cert_ku[i] = 0
Tue Mar 16 11:01:37 2021 us=668716 remote_cert_ku[i] = 0
Tue Mar 16 11:01:37 2021 us=668724 remote_cert_ku[i] = 0
Tue Mar 16 11:01:37 2021 us=668731 remote_cert_ku[i] = 0
Tue Mar 16 11:01:37 2021 us=668739 remote_cert_ku[i] = 0
Tue Mar 16 11:01:37 2021 us=668748 remote_cert_ku[i] = 0
Tue Mar 16 11:01:37 2021 us=668756 remote_cert_ku[i] = 0
Tue Mar 16 11:01:37 2021 us=668764 remote_cert_ku[i] = 0
Tue Mar 16 11:01:37 2021 us=668772 remote_cert_ku[i] = 0
Tue Mar 16 11:01:37 2021 us=668780 remote_cert_ku[i] = 0
Tue Mar 16 11:01:37 2021 us=668788 remote_cert_ku[i] = 0
Tue Mar 16 11:01:37 2021 us=668796 remote_cert_ku[i] = 0
Tue Mar 16 11:01:37 2021 us=668804 remote_cert_ku[i] = 0
Tue Mar 16 11:01:37 2021 us=668812 remote_cert_ku[i] = 0
Tue Mar 16 11:01:37 2021 us=668820 remote_cert_eku = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668827 ssl_flags = 192
Tue Mar 16 11:01:37 2021 us=668832 tls_timeout = 2
Tue Mar 16 11:01:37 2021 us=668836 renegotiate_bytes = -1
Tue Mar 16 11:01:37 2021 us=668841 renegotiate_packets = 0
Tue Mar 16 11:01:37 2021 us=668846 renegotiate_seconds = 3600
Tue Mar 16 11:01:37 2021 us=668851 handshake_window = 60
Tue Mar 16 11:01:37 2021 us=668855 transition_window = 3600
Tue Mar 16 11:01:37 2021 us=668860 single_session = DISABLED
Tue Mar 16 11:01:37 2021 us=668865 push_peer_info = DISABLED
Tue Mar 16 11:01:37 2021 us=668869 tls_exit = DISABLED
Tue Mar 16 11:01:37 2021 us=668874 tls_auth_file = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=668879 tls_crypt_file = 'tls-crypt.key'
Tue Mar 16 11:01:37 2021 us=668887 pkcs11_protected_authentication = DISABLED
Tue Mar 16 11:01:37 2021 us=668892 pkcs11_protected_authentication = DISABLED
Tue Mar 16 11:01:37 2021 us=668897 pkcs11_protected_authentication = DISABLED
Tue Mar 16 11:01:37 2021 us=668902 pkcs11_protected_authentication = DISABLED
Tue Mar 16 11:01:37 2021 us=668907 pkcs11_protected_authentication = DISABLED
Tue Mar 16 11:01:37 2021 us=668911 pkcs11_protected_authentication = DISABLED
Tue Mar 16 11:01:37 2021 us=668916 pkcs11_protected_authentication = DISABLED
Tue Mar 16 11:01:37 2021 us=668921 pkcs11_protected_authentication = DISABLED
Tue Mar 16 11:01:37 2021 us=668925 pkcs11_protected_authentication = DISABLED
Tue Mar 16 11:01:37 2021 us=668930 pkcs11_protected_authentication = DISABLED
Tue Mar 16 11:01:37 2021 us=668934 pkcs11_protected_authentication = DISABLED
Tue Mar 16 11:01:37 2021 us=668939 pkcs11_protected_authentication = DISABLED
Tue Mar 16 11:01:37 2021 us=668944 pkcs11_protected_authentication = DISABLED
Tue Mar 16 11:01:37 2021 us=668948 pkcs11_protected_authentication = DISABLED
Tue Mar 16 11:01:37 2021 us=668953 pkcs11_protected_authentication = DISABLED
Tue Mar 16 11:01:37 2021 us=668957 pkcs11_protected_authentication = DISABLED
Tue Mar 16 11:01:37 2021 us=668963 pkcs11_private_mode = 00000000
Tue Mar 16 11:01:37 2021 us=668967 pkcs11_private_mode = 00000000
Tue Mar 16 11:01:37 2021 us=668972 pkcs11_private_mode = 00000000
Tue Mar 16 11:01:37 2021 us=668977 pkcs11_private_mode = 00000000
Tue Mar 16 11:01:37 2021 us=668981 pkcs11_private_mode = 00000000
Tue Mar 16 11:01:37 2021 us=668986 pkcs11_private_mode = 00000000
Tue Mar 16 11:01:37 2021 us=668990 pkcs11_private_mode = 00000000
Tue Mar 16 11:01:37 2021 us=668995 pkcs11_private_mode = 00000000
Tue Mar 16 11:01:37 2021 us=669000 pkcs11_private_mode = 00000000
Tue Mar 16 11:01:37 2021 us=669004 pkcs11_private_mode = 00000000
Tue Mar 16 11:01:37 2021 us=669009 pkcs11_private_mode = 00000000
Tue Mar 16 11:01:37 2021 us=669013 pkcs11_private_mode = 00000000
Tue Mar 16 11:01:37 2021 us=669018 pkcs11_private_mode = 00000000
Tue Mar 16 11:01:37 2021 us=669023 pkcs11_private_mode = 00000000
Tue Mar 16 11:01:37 2021 us=670752 pkcs11_private_mode = 00000000
Tue Mar 16 11:01:37 2021 us=670805 pkcs11_private_mode = 00000000
Tue Mar 16 11:01:37 2021 us=670850 pkcs11_cert_private = DISABLED
Tue Mar 16 11:01:37 2021 us=670860 pkcs11_cert_private = DISABLED
Tue Mar 16 11:01:37 2021 us=670865 pkcs11_cert_private = DISABLED
Tue Mar 16 11:01:37 2021 us=670870 pkcs11_cert_private = DISABLED
Tue Mar 16 11:01:37 2021 us=670874 pkcs11_cert_private = DISABLED
Tue Mar 16 11:01:37 2021 us=670879 pkcs11_cert_private = DISABLED
Tue Mar 16 11:01:37 2021 us=670884 pkcs11_cert_private = DISABLED
Tue Mar 16 11:01:37 2021 us=670888 pkcs11_cert_private = DISABLED
Tue Mar 16 11:01:37 2021 us=670893 pkcs11_cert_private = DISABLED
Tue Mar 16 11:01:37 2021 us=670897 pkcs11_cert_private = DISABLED
Tue Mar 16 11:01:37 2021 us=670902 pkcs11_cert_private = DISABLED
Tue Mar 16 11:01:37 2021 us=670907 pkcs11_cert_private = DISABLED
Tue Mar 16 11:01:37 2021 us=670911 pkcs11_cert_private = DISABLED
Tue Mar 16 11:01:37 2021 us=670916 pkcs11_cert_private = DISABLED
Tue Mar 16 11:01:37 2021 us=670921 pkcs11_cert_private = DISABLED
Tue Mar 16 11:01:37 2021 us=670925 pkcs11_cert_private = DISABLED
Tue Mar 16 11:01:37 2021 us=670930 pkcs11_pin_cache_period = -1
Tue Mar 16 11:01:37 2021 us=670935 pkcs11_id = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=670940 pkcs11_id_management = DISABLED
Tue Mar 16 11:01:37 2021 us=670946 server_network = 0.0.0.0
Tue Mar 16 11:01:37 2021 us=670951 server_netmask = 0.0.0.0
Tue Mar 16 11:01:37 2021 us=670957 server_network_ipv6 = ::
Tue Mar 16 11:01:37 2021 us=670962 server_netbits_ipv6 = 0
Tue Mar 16 11:01:37 2021 us=670968 server_bridge_ip = 192.168.100.1
Tue Mar 16 11:01:37 2021 us=670973 server_bridge_netmask = 255.255.255.0
Tue Mar 16 11:01:37 2021 us=670978 server_bridge_pool_start = 192.168.100.128
Tue Mar 16 11:01:37 2021 us=670984 server_bridge_pool_end = 192.168.100.254
Tue Mar 16 11:01:37 2021 us=670989 push_entry = 'dhcp-option DNS 94.140.14.14'
Tue Mar 16 11:01:37 2021 us=670994 push_entry = 'dhcp-option DNS 94.140.15.15'
Tue Mar 16 11:01:37 2021 us=670998 push_entry = 'redirect-gateway def1 bypass-dhcp'
Tue Mar 16 11:01:37 2021 us=671003 push_entry = 'route 192.168.100.0 255.255.255.0'
Tue Mar 16 11:01:37 2021 us=671008 push_entry = 'route-gateway 192.168.100.1'
Tue Mar 16 11:01:37 2021 us=671013 push_entry = 'ping 10'
Tue Mar 16 11:01:37 2021 us=671017 push_entry = 'ping-restart 120'
Tue Mar 16 11:01:37 2021 us=671022 ifconfig_pool_defined = ENABLED
Tue Mar 16 11:01:37 2021 us=671027 ifconfig_pool_start = 192.168.100.128
Tue Mar 16 11:01:37 2021 us=671033 ifconfig_pool_end = 192.168.100.254
Tue Mar 16 11:01:37 2021 us=671038 ifconfig_pool_netmask = 255.255.255.0
Tue Mar 16 11:01:37 2021 us=671043 ifconfig_pool_persist_filename = 'ipp.txt'
Tue Mar 16 11:01:37 2021 us=671048 ifconfig_pool_persist_refresh_freq = 600
Tue Mar 16 11:01:37 2021 us=671052 ifconfig_ipv6_pool_defined = DISABLED
Tue Mar 16 11:01:37 2021 us=671057 ifconfig_ipv6_pool_base = ::
Tue Mar 16 11:01:37 2021 us=671062 ifconfig_ipv6_pool_netbits = 0
Tue Mar 16 11:01:37 2021 us=671067 n_bcast_buf = 256
Tue Mar 16 11:01:37 2021 us=671072 tcp_queue_limit = 64
Tue Mar 16 11:01:37 2021 us=671077 real_hash_size = 256
Tue Mar 16 11:01:37 2021 us=671082 virtual_hash_size = 256
Tue Mar 16 11:01:37 2021 us=671087 client_connect_script = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=671092 learn_address_script = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=671096 client_disconnect_script = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=671569 client_config_dir = '/etc/openvpn/ccd'
Tue Mar 16 11:01:37 2021 us=671583 ccd_exclusive = DISABLED
Tue Mar 16 11:01:37 2021 us=671590 tmp_dir = '/tmp'
Tue Mar 16 11:01:37 2021 us=671597 push_ifconfig_defined = DISABLED
Tue Mar 16 11:01:37 2021 us=671605 push_ifconfig_local = 0.0.0.0
Tue Mar 16 11:01:37 2021 us=671613 push_ifconfig_remote_netmask = 0.0.0.0
Tue Mar 16 11:01:37 2021 us=671620 push_ifconfig_ipv6_defined = DISABLED
Tue Mar 16 11:01:37 2021 us=671637 push_ifconfig_ipv6_local = ::/0
Tue Mar 16 11:01:37 2021 us=671644 push_ifconfig_ipv6_remote = ::
Tue Mar 16 11:01:37 2021 us=671652 enable_c2c = ENABLED
Tue Mar 16 11:01:37 2021 us=671660 duplicate_cn = DISABLED
Tue Mar 16 11:01:37 2021 us=671668 cf_max = 0
Tue Mar 16 11:01:37 2021 us=671674 cf_per = 0
Tue Mar 16 11:01:37 2021 us=671679 max_clients = 1024
Tue Mar 16 11:01:37 2021 us=671684 max_routes_per_client = 256
Tue Mar 16 11:01:37 2021 us=671689 auth_user_pass_verify_script = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=671694 auth_user_pass_verify_script_via_file = DISABLED
Tue Mar 16 11:01:37 2021 us=671699 auth_token_generate = DISABLED
Tue Mar 16 11:01:37 2021 us=671703 auth_token_lifetime = 0
Tue Mar 16 11:01:37 2021 us=671708 port_share_host = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=671713 port_share_port = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=671718 client = DISABLED
Tue Mar 16 11:01:37 2021 us=671723 pull = DISABLED
Tue Mar 16 11:01:37 2021 us=671728 auth_user_pass_file = '[UNDEF]'
Tue Mar 16 11:01:37 2021 us=671734 OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019
Tue Mar 16 11:01:37 2021 us=671757 library versions: OpenSSL 1.1.1d 10 Sep 2019, LZO 2.10
Tue Mar 16 11:01:37 2021 us=673534 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Tue Mar 16 11:01:37 2021 us=674863 ECDH curve prime256v1 added
Tue Mar 16 11:01:37 2021 us=675076 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Tue Mar 16 11:01:37 2021 us=675228 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Mar 16 11:01:37 2021 us=675299 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Tue Mar 16 11:01:37 2021 us=675364 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Mar 16 11:01:37 2021 us=675442 TLS-Auth MTU parms [ L:1653 D:1156 EF:94 EB:0 ET:0 EL:3 ]
Tue Mar 16 11:01:37 2021 us=678976 TUN/TAP device tap1 opened
Tue Mar 16 11:01:37 2021 us=679218 TUN/TAP TX queue length set to 100
Tue Mar 16 11:01:37 2021 us=679275 Data Channel MTU parms [ L:1653 D:1450 EF:121 EB:411 ET:32 EL:3 ]
Tue Mar 16 11:01:37 2021 us=679647 Socket Buffers: R=[212992->212992] S=[212992->212992]
Tue Mar 16 11:01:37 2021 us=679678 setsockopt(IPV6_V6ONLY=0)
Tue Mar 16 11:01:37 2021 us=679715 UDPv6 link local (bound): [AF_INET6][undef]:1194
Tue Mar 16 11:01:37 2021 us=679734 UDPv6 link remote: [AF_UNSPEC]
Tue Mar 16 11:01:37 2021 us=679752 GID set to nogroup
Tue Mar 16 11:01:37 2021 us=679781 UID set to nobody
Tue Mar 16 11:01:37 2021 us=679808 MULTI: multi_init called, r=256 v=256
Tue Mar 16 11:01:37 2021 us=679845 IFCONFIG POOL: base=192.168.100.128 size=127, ipv6=0
Tue Mar 16 11:01:37 2021 us=679875 ifconfig_pool_read(), in='werner,192.168.100.128', TODO: IPv6
Tue Mar 16 11:01:37 2021 us=679893 succeeded -> ifconfig_pool_set()
Tue Mar 16 11:01:37 2021 us=679908 ifconfig_pool_read(), in='router,192.168.100.129', TODO: IPv6
Tue Mar 16 11:01:37 2021 us=679923 succeeded -> ifconfig_pool_set()
Tue Mar 16 11:01:37 2021 us=679939 IFCONFIG POOL LIST
Tue Mar 16 11:01:37 2021 us=679954 werner,192.168.100.128
Tue Mar 16 11:01:37 2021 us=679969 router,192.168.100.129
Tue Mar 16 11:01:37 2021 us=680482 Initialization Sequence Completed
Tue Mar 16 11:01:39 2021 us=356381 MULTI: multi_create_instance called
Tue Mar 16 11:01:39 2021 us=356604 xx.xx.xx.xx:50048 Re-using SSL/TLS context
Tue Mar 16 11:01:39 2021 us=356819 xx.xx.xx.xx:50048 Control Channel MTU parms [ L:1653 D:1156 EF:94 EB:0 ET:0 EL:3 ]
Tue Mar 16 11:01:39 2021 us=356894 xx.xx.xx.xx:50048 Data Channel MTU parms [ L:1653 D:1450 EF:121 EB:411 ET:32 EL:3 ]
Tue Mar 16 11:01:39 2021 us=356981 xx.xx.xx.xx:50048 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1581,tun-mtu 1532,proto UDPv4,cipher AES-128-GCM,auth [null-digest],keysize 128,key-method 2,tls-server'
Tue Mar 16 11:01:39 2021 us=357080 xx.xx.xx.xx:50048 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1581,tun-mtu 1532,proto UDPv4,cipher AES-128-GCM,auth [null-digest],keysize 128,key-method 2,tls-client'
Tue Mar 16 11:01:39 2021 us=357201 xx.xx.xx.xx:50048 TLS: Initial packet from [AF_INET6]::ffff:xx.xx.xx.xx:50048, sid=4b3d8bff 66ccccd3
Tue Mar 16 11:01:39 2021 us=430396 xx.xx.xx.xx:50048 VERIFY OK: depth=1, CN=cn_B6Qv59lajdyL4wIz
Tue Mar 16 11:01:39 2021 us=430760 xx.xx.xx.xx:50048 VERIFY OK: depth=0, CN=router
Tue Mar 16 11:01:39 2021 us=457077 xx.xx.xx.xx:50048 peer info: IV_VER=2.4.7
Tue Mar 16 11:01:39 2021 us=457444 xx.xx.xx.xx:50048 peer info: IV_PLAT=linux
Tue Mar 16 11:01:39 2021 us=457709 xx.xx.xx.xx:50048 peer info: IV_PROTO=2
Tue Mar 16 11:01:39 2021 us=457924 xx.xx.xx.xx:50048 peer info: IV_NCP=2
Tue Mar 16 11:01:39 2021 us=458084 xx.xx.xx.xx:50048 peer info: IV_LZ4=1
Tue Mar 16 11:01:39 2021 us=458234 xx.xx.xx.xx:50048 peer info: IV_LZ4v2=1
Tue Mar 16 11:01:39 2021 us=458593 xx.xx.xx.xx:50048 peer info: IV_LZO=1
Tue Mar 16 11:01:39 2021 us=458772 xx.xx.xx.xx:50048 peer info: IV_COMP_STUB=1
Tue Mar 16 11:01:39 2021 us=459008 xx.xx.xx.xx:50048 peer info: IV_COMP_STUBv2=1
Tue Mar 16 11:01:39 2021 us=459242 xx.xx.xx.xx:50048 peer info: IV_TCPNL=1
Tue Mar 16 11:01:39 2021 us=484135 xx.xx.xx.xx:50048 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256, 256 bit EC, curve: prime256v1
Tue Mar 16 11:01:39 2021 us=484615 xx.xx.xx.xx:50048 [router] Peer Connection Initiated with [AF_INET6]::ffff:xx.xx.xx.xx:50048
Tue Mar 16 11:01:39 2021 us=484879 router/xx.xx.xx.xx:50048 MULTI_sva: pool returned IPv4=192.168.100.129, IPv6=(Not enabled)
Tue Mar 16 11:01:40 2021 us=542445 router/xx.xx.xx.xx:50048 PUSH: Received control message: 'PUSH_REQUEST'
Tue Mar 16 11:01:40 2021 us=542790 router/xx.xx.xx.xx:50048 SENT CONTROL [router]: 'PUSH_REPLY,dhcp-option DNS 94.140.14.14,dhcp-option DNS 94.140.15.15,redirect-gateway def1 bypass-dhcp,route 192.168.100.0 255.255.255.0,route-gateway 192.168.100.1,ping 10,ping-restart 120,ifconfig 192.168.100.129 255.255.255.0,peer-id 0,cipher AES-128-GCM' (status=1)
Tue Mar 16 11:01:40 2021 us=542920 router/xx.xx.xx.xx:50048 Data Channel MTU parms [ L:1581 D:1450 EF:49 EB:411 ET:32 EL:3 ]
Tue Mar 16 11:01:40 2021 us=543091 router/xx.xx.xx.xx:50048 Outgoing Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Tue Mar 16 11:01:40 2021 us=543266 router/xx.xx.xx.xx:50048 Incoming Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Tue Mar 16 11:01:41 2021 us=256415 router/xx.xx.xx.xx:50048 MULTI: Learn: 36:24:16:80:3c:74 -> router/xx.xx.xx.xx:50048
In my network/interfaces I have:
# cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5)
# Include files from /etc/network/interfaces.d:
source /etc/network/interfaces.d/*
# The loopback network interface
auto lo
iface lo inet loopback
auto br0
iface br0 inet static
address 192.168.100.127/24
gateway 192.168.100.1
bridge_ports eth0
bridge_stp off
bridge_fd 0
bridge_maxwait 0
On the client, my connection is like this:
Tue Mar 16 11:06:32 2021 us=88504 OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Sep 5 2019
Tue Mar 16 11:06:32 2021 us=88511 library versions: OpenSSL 1.1.1f 31 Mar 2020, LZO 2.10
Tue Mar 16 11:06:32 2021 us=88779 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Tue Mar 16 11:06:32 2021 us=88789 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Mar 16 11:06:32 2021 us=88809 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Tue Mar 16 11:06:32 2021 us=88814 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Mar 16 11:06:32 2021 us=88858 Control Channel MTU parms [ L:1653 D:1156 EF:94 EB:0 ET:0 EL:3 ]
Tue Mar 16 11:06:32 2021 us=88886 Data Channel MTU parms [ L:1653 D:1450 EF:121 EB:411 ET:32 EL:3 ]
Tue Mar 16 11:06:32 2021 us=88895 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1581,tun-mtu 1532,proto UDPv4,cipher AES-128-GCM,auth [null-digest],keysize 128,key-method 2,tls-client'
Tue Mar 16 11:06:32 2021 us=88899 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1581,tun-mtu 1532,proto UDPv4,cipher AES-128-GCM,auth [null-digest],keysize 128,key-method 2,tls-server'
Tue Mar 16 11:06:32 2021 us=88904 TCP/UDP: Preserving recently used remote address: [AF_INET]<redacted>:1194
Tue Mar 16 11:06:32 2021 us=88918 Socket Buffers: R=[212992->212992] S=[212992->212992]
Tue Mar 16 11:06:32 2021 us=88922 UDP link local: (not bound)
Tue Mar 16 11:06:32 2021 us=88925 UDP link remote: [AF_INET]<redacted>:1194
Tue Mar 16 11:06:32 2021 us=210304 TLS: Initial packet from [AF_INET]<redacted>:1194, sid=7ef50834 d775cede
Tue Mar 16 11:06:32 2021 us=289808 VERIFY OK: depth=1, CN=cn_B6Qv59lajdyL4wIz
Tue Mar 16 11:06:32 2021 us=290373 VERIFY KU OK
Tue Mar 16 11:06:32 2021 us=290412 Validating certificate extended key usage
Tue Mar 16 11:06:32 2021 us=290430 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Mar 16 11:06:32 2021 us=290450 VERIFY EKU OK
Tue Mar 16 11:06:32 2021 us=290467 VERIFY X509NAME OK: CN=server_rgpYVq742Cz4eLEj
Tue Mar 16 11:06:32 2021 us=290503 VERIFY OK: depth=0, CN=server_rgpYVq742Cz4eLEj
Tue Mar 16 11:06:32 2021 us=321868 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 256 bit EC, curve: prime256v1
Tue Mar 16 11:06:32 2021 us=321944 [server_rgpYVq742Cz4eLEj] Peer Connection Initiated with [AF_INET]<redacted>:1194
Tue Mar 16 11:06:33 2021 us=358130 SENT CONTROL [server_rgpYVq742Cz4eLEj]: 'PUSH_REQUEST' (status=1)
Tue Mar 16 11:06:33 2021 us=380075 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 94.140.14.14,dhcp-option DNS 94.140.15.15,redirect-gateway def1 bypass-dhcp,route 192.168.100.0 255.255.255.0,route-gateway 192.168.100.1,ping 10,ping-restart 120,ifconfig 192.168.100.128 255.255.255.0,peer-id 1,cipher AES-128-GCM'
Tue Mar 16 11:06:33 2021 us=380318 OPTIONS IMPORT: timers and/or timeouts modified
Tue Mar 16 11:06:33 2021 us=380352 OPTIONS IMPORT: --ifconfig/up options modified
Tue Mar 16 11:06:33 2021 us=380371 OPTIONS IMPORT: route options modified
Tue Mar 16 11:06:33 2021 us=380387 OPTIONS IMPORT: route-related options modified
Tue Mar 16 11:06:33 2021 us=380407 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Mar 16 11:06:33 2021 us=380426 OPTIONS IMPORT: peer-id set
Tue Mar 16 11:06:33 2021 us=380441 OPTIONS IMPORT: adjusting link_mtu to 1656
Tue Mar 16 11:06:33 2021 us=380459 OPTIONS IMPORT: data channel crypto options modified
Tue Mar 16 11:06:33 2021 us=380493 Data Channel MTU parms [ L:1584 D:1450 EF:52 EB:411 ET:32 EL:3 ]
Tue Mar 16 11:06:33 2021 us=380704 Outgoing Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Tue Mar 16 11:06:33 2021 us=380733 Incoming Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Tue Mar 16 11:06:33 2021 us=381144 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=eno1 HWADDR=00:d8:61:0c:c5:2c
Tue Mar 16 11:06:33 2021 us=381765 TUN/TAP device tap0 opened
Tue Mar 16 11:06:33 2021 us=381864 TUN/TAP TX queue length set to 100
Tue Mar 16 11:06:33 2021 us=381910 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Tue Mar 16 11:06:33 2021 us=381945 /sbin/ip link set dev tap0 up mtu 1500
Tue Mar 16 11:06:33 2021 us=387298 /sbin/ip addr add dev tap0 192.168.100.128/24 broadcast 192.168.100.255
Tue Mar 16 11:06:33 2021 us=389031 /sbin/ip route add <redacted>/32 via 192.168.0.1
Tue Mar 16 11:06:33 2021 us=390480 /sbin/ip route add 0.0.0.0/1 via 192.168.100.1
Tue Mar 16 11:06:33 2021 us=391283 /sbin/ip route add 128.0.0.0/1 via 192.168.100.1
Tue Mar 16 11:06:33 2021 us=391985 /sbin/ip route add 192.168.100.0/24 via 192.168.100.1
RTNETLINK answers: File exists
Tue Mar 16 11:06:33 2021 us=392607 ERROR: Linux route add command failed: external program exited with error status: 2
Tue Mar 16 11:06:33 2021 us=392635 Initialization Sequence Completed
Now the problem is: From my client (werner), I cannot ping the camera, the router ??? what am I doing wrong?
