sorry for the delay. I've changed my config now to this:
server:
local 192.168.1.4
port 1194
proto udp
dev tun
ca /etc/openvpn/openvpn_certs/carey-ca.pem
cert /etc/openvpn/openvpn_certs/carey-cert.pem
key /etc/openvpn/openvpn_certs/carey-key.pem
dh /etc/openvpn/openvpn_certs/dh1024.pem
server 192.168.254.0 255.255.255.0
route 192.168.2.0 255.255.255.0
route 192.168.4.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"
push "route 192.168.2.0 255.255.255.0"
push "route 192.168.3.0 255.255.255.0"
ifconfig-pool-persist ipp.txt
client-to-client
keepalive 10 120
comp-lzo
allow-compression yes
user nobody
group nobody
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 4
explicit-exit-notify 1
client-config-dir /etc/openvpn/ccd
client config file for bucharest:
iroute 192.168.4.0 255.255.255.0
what results on the server:
ifconfig of tun0:
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.254.1 P-t-P:192.168.254.2 Mask:255.255.255.255
inet6 addr: fe80::ee:d1c3:91c6:3c22/64 Scope:Link
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:0 (0.0 B) TX bytes:288 (288.0 B)
and a routing table:
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.1.1 0.0.0.0 UG 1 0 0 eth0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.2.0 192.168.254.2 255.255.255.0 UG 0 0 0 tun0
192.168.3.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
192.168.4.0 192.168.254.2 255.255.255.0 UG 0 0 0 tun0
192.168.254.0 192.168.254.2 255.255.255.0 UG 0 0 0 tun0
192.168.254.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
iptables -S shows:
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 10050 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 10051 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 10050 -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 10051 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j ACCEPT
-A OUTPUT -j ACCEPT
and the log says:
2021-09-01 10:53:31 us=109928 WARNING: --topology net30 support for server configs with IPv4 pools will be removed in a future release. Please migrate to --topology subnet as soon as possible.
2021-09-01 10:53:31 us=109972 --cipher is not set. Previous OpenVPN version defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers.
2021-09-01 10:53:31 us=110215 Current Parameter Settings:
2021-09-01 10:53:31 us=110241 config = '/etc/openvpn/openvpn.conf'
2021-09-01 10:53:31 us=110257 mode = 1
2021-09-01 10:53:31 us=110273 persist_config = DISABLED
2021-09-01 10:53:31 us=110290 persist_mode = 1
2021-09-01 10:53:31 us=110307 show_ciphers = DISABLED
2021-09-01 10:53:31 us=110323 show_digests = DISABLED
2021-09-01 10:53:31 us=110338 show_engines = DISABLED
2021-09-01 10:53:31 us=110353 genkey = DISABLED
2021-09-01 10:53:31 us=110369 genkey_filename = '[UNDEF]'
2021-09-01 10:53:31 us=110385 key_pass_file = '[UNDEF]'
2021-09-01 10:53:31 us=110401 show_tls_ciphers = DISABLED
2021-09-01 10:53:31 us=110416 connect_retry_max = 0
2021-09-01 10:53:31 us=110433 Connection profiles [0]:
2021-09-01 10:53:31 us=110448 proto = udp
2021-09-01 10:53:31 us=110464 local = '192.168.1.4'
2021-09-01 10:53:31 us=110479 local_port = '1194'
2021-09-01 10:53:31 us=110495 remote = '[UNDEF]'
2021-09-01 10:53:31 us=110510 remote_port = '1194'
2021-09-01 10:53:31 us=110526 remote_float = DISABLED
2021-09-01 10:53:31 us=110541 bind_defined = DISABLED
2021-09-01 10:53:31 us=110557 bind_local = ENABLED
2021-09-01 10:53:31 us=110571 bind_ipv6_only = DISABLED
2021-09-01 10:53:31 us=110587 connect_retry_seconds = 5
2021-09-01 10:53:31 us=110603 connect_timeout = 120
2021-09-01 10:53:31 us=110618 socks_proxy_server = '[UNDEF]'
2021-09-01 10:53:31 us=110634 socks_proxy_port = '[UNDEF]'
2021-09-01 10:53:31 us=110649 tun_mtu = 1500
2021-09-01 10:53:31 us=110666 tun_mtu_defined = ENABLED
2021-09-01 10:53:31 us=110682 link_mtu = 1500
2021-09-01 10:53:31 us=110697 link_mtu_defined = DISABLED
2021-09-01 10:53:31 us=110712 tun_mtu_extra = 0
2021-09-01 10:53:31 us=110727 tun_mtu_extra_defined = DISABLED
2021-09-01 10:53:31 us=110743 mtu_discover_type = -1
2021-09-01 10:53:31 us=110758 fragment = 0
2021-09-01 10:53:31 us=110773 mssfix = 1450
2021-09-01 10:53:31 us=110789 explicit_exit_notification = 1
2021-09-01 10:53:31 us=110803 tls_auth_file = '[UNDEF]'
2021-09-01 10:53:31 us=110819 key_direction = not set
2021-09-01 10:53:31 us=110835 tls_crypt_file = '[UNDEF]'
2021-09-01 10:53:31 us=110851 tls_crypt_v2_file = '[UNDEF]'
2021-09-01 10:53:31 us=110865 Connection profiles END
2021-09-01 10:53:31 us=110881 remote_random = DISABLED
2021-09-01 10:53:31 us=110895 ipchange = '[UNDEF]'
2021-09-01 10:53:31 us=110911 dev = 'tun'
2021-09-01 10:53:31 us=110926 dev_type = '[UNDEF]'
2021-09-01 10:53:31 us=110941 dev_node = '[UNDEF]'
2021-09-01 10:53:31 us=110956 lladdr = '[UNDEF]'
2021-09-01 10:53:31 us=110970 topology = 1
2021-09-01 10:53:31 us=110985 ifconfig_local = '192.168.254.1'
2021-09-01 10:53:31 us=111000 ifconfig_remote_netmask = '192.168.254.2'
2021-09-01 10:53:31 us=111015 ifconfig_noexec = DISABLED
2021-09-01 10:53:31 us=111031 ifconfig_nowarn = DISABLED
2021-09-01 10:53:31 us=111045 ifconfig_ipv6_local = '[UNDEF]'
2021-09-01 10:53:31 us=111060 ifconfig_ipv6_netbits = 0
2021-09-01 10:53:31 us=111074 ifconfig_ipv6_remote = '[UNDEF]'
2021-09-01 10:53:31 us=111089 shaper = 0
2021-09-01 10:53:31 us=111104 mtu_test = 0
2021-09-01 10:53:31 us=111117 mlock = DISABLED
2021-09-01 10:53:31 us=111133 keepalive_ping = 10
2021-09-01 10:53:31 us=111148 keepalive_timeout = 120
2021-09-01 10:53:31 us=111164 inactivity_timeout = 0
2021-09-01 10:53:31 us=111180 ping_send_timeout = 10
2021-09-01 10:53:31 us=111196 ping_rec_timeout = 240
2021-09-01 10:53:31 us=111211 ping_rec_timeout_action = 2
2021-09-01 10:53:31 us=111226 ping_timer_remote = DISABLED
2021-09-01 10:53:31 us=111256 remap_sigusr1 = 0
2021-09-01 10:53:31 us=111270 persist_tun = ENABLED
2021-09-01 10:53:31 us=111283 persist_local_ip = DISABLED
2021-09-01 10:53:31 us=111298 persist_remote_ip = DISABLED
2021-09-01 10:53:31 us=111313 persist_key = ENABLED
2021-09-01 10:53:31 us=111327 passtos = DISABLED
2021-09-01 10:53:31 us=111341 resolve_retry_seconds = 1000000000
2021-09-01 10:53:31 us=111356 resolve_in_advance = DISABLED
2021-09-01 10:53:31 us=111369 username = 'nobody'
2021-09-01 10:53:31 us=111384 groupname = 'nobody'
2021-09-01 10:53:31 us=111399 chroot_dir = '[UNDEF]'
2021-09-01 10:53:31 us=111413 cd_dir = '[UNDEF]'
2021-09-01 10:53:31 us=111428 writepid = '/run/openvpn.pid'
2021-09-01 10:53:31 us=111442 up_script = '[UNDEF]'
2021-09-01 10:53:31 us=111457 down_script = '[UNDEF]'
2021-09-01 10:53:31 us=111470 down_pre = DISABLED
2021-09-01 10:53:31 us=111485 up_restart = DISABLED
2021-09-01 10:53:31 us=111498 up_delay = DISABLED
2021-09-01 10:53:31 us=111511 daemon = ENABLED
2021-09-01 10:53:31 us=111525 inetd = 0
2021-09-01 10:53:31 us=111538 log = ENABLED
2021-09-01 10:53:31 us=111552 suppress_timestamps = DISABLED
2021-09-01 10:53:31 us=111566 machine_readable_output = DISABLED
2021-09-01 10:53:31 us=111579 nice = 0
2021-09-01 10:53:31 us=111591 verbosity = 4
2021-09-01 10:53:31 us=111603 mute = 0
2021-09-01 10:53:31 us=111617 gremlin = 0
2021-09-01 10:53:31 us=111633 status_file = '/var/log/openvpn-status.log'
2021-09-01 10:53:31 us=111646 status_file_version = 1
2021-09-01 10:53:31 us=111659 status_file_update_freq = 60
2021-09-01 10:53:31 us=111674 occ = ENABLED
2021-09-01 10:53:31 us=111686 rcvbuf = 0
2021-09-01 10:53:31 us=111699 sndbuf = 0
2021-09-01 10:53:31 us=111713 mark = 0
2021-09-01 10:53:31 us=111725 sockflags = 0
2021-09-01 10:53:31 us=111738 fast_io = DISABLED
2021-09-01 10:53:31 us=111752 comp.alg = 2
2021-09-01 10:53:31 us=111764 comp.flags = 3
2021-09-01 10:53:31 us=111778 route_script = '[UNDEF]'
2021-09-01 10:53:31 us=111790 route_default_gateway = '[UNDEF]'
2021-09-01 10:53:31 us=111802 route_default_metric = 0
2021-09-01 10:53:31 us=111815 route_noexec = DISABLED
2021-09-01 10:53:31 us=111827 route_delay = 0
2021-09-01 10:53:31 us=111840 route_delay_window = 30
2021-09-01 10:53:31 us=111853 route_delay_defined = DISABLED
2021-09-01 10:53:31 us=111865 route_nopull = DISABLED
2021-09-01 10:53:31 us=111878 route_gateway_via_dhcp = DISABLED
2021-09-01 10:53:31 us=111890 allow_pull_fqdn = DISABLED
2021-09-01 10:53:31 us=111904 route 192.168.254.0/255.255.255.0/default (not set)/default (not set)
2021-09-01 10:53:31 us=111917 route 192.168.4.0/255.255.255.0/default (not set)/default (not set)
2021-09-01 10:53:31 us=111930 route 192.168.2.0/255.255.255.0/default (not set)/default (not set)
2021-09-01 10:53:31 us=111943 management_addr = '[UNDEF]'
2021-09-01 10:53:31 us=111957 management_port = '[UNDEF]'
2021-09-01 10:53:31 us=111970 management_user_pass = '[UNDEF]'
2021-09-01 10:53:31 us=111983 management_log_history_cache = 250
2021-09-01 10:53:31 us=111998 management_echo_buffer_size = 100
2021-09-01 10:53:31 us=112011 management_write_peer_info_file = '[UNDEF]'
2021-09-01 10:53:31 us=112025 management_client_user = '[UNDEF]'
2021-09-01 10:53:31 us=112038 management_client_group = '[UNDEF]'
2021-09-01 10:53:31 us=112051 management_flags = 0
2021-09-01 10:53:31 us=112065 shared_secret_file = '[UNDEF]'
2021-09-01 10:53:31 us=112077 key_direction = not set
2021-09-01 10:53:31 us=112089 ciphername = 'BF-CBC'
2021-09-01 10:53:31 us=112102 ncp_enabled = ENABLED
2021-09-01 10:53:31 us=112114 ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
2021-09-01 10:53:31 us=112127 authname = 'SHA1'
2021-09-01 10:53:31 us=112139 prng_hash = 'SHA1'
2021-09-01 10:53:31 us=112152 prng_nonce_secret_len = 16
2021-09-01 10:53:31 us=112164 keysize = 0
2021-09-01 10:53:31 us=112177 engine = DISABLED
2021-09-01 10:53:31 us=112190 replay = ENABLED
2021-09-01 10:53:31 us=112203 mute_replay_warnings = DISABLED
2021-09-01 10:53:31 us=112223 replay_window = 64
2021-09-01 10:53:31 us=112236 replay_time = 15
2021-09-01 10:53:31 us=112249 packet_id_file = '[UNDEF]'
2021-09-01 10:53:31 us=112262 test_crypto = DISABLED
2021-09-01 10:53:31 us=112275 tls_server = ENABLED
2021-09-01 10:53:31 us=112288 tls_client = DISABLED
2021-09-01 10:53:31 us=112301 ca_file = '/etc/openvpn/openvpn_certs/carey-ca.pem'
2021-09-01 10:53:31 us=112314 ca_path = '[UNDEF]'
2021-09-01 10:53:31 us=112326 dh_file = '/etc/openvpn/openvpn_certs/dh1024.pem'
2021-09-01 10:53:31 us=112339 cert_file = '/etc/openvpn/openvpn_certs/carey-cert.pem'
2021-09-01 10:53:31 us=112353 extra_certs_file = '[UNDEF]'
2021-09-01 10:53:31 us=112366 priv_key_file = '/etc/openvpn/openvpn_certs/carey-key.pem'
2021-09-01 10:53:31 us=112380 pkcs12_file = '[UNDEF]'
2021-09-01 10:53:31 us=112394 cipher_list = '[UNDEF]'
2021-09-01 10:53:31 us=112407 cipher_list_tls13 = '[UNDEF]'
2021-09-01 10:53:31 us=112420 tls_cert_profile = '[UNDEF]'
2021-09-01 10:53:31 us=112433 tls_verify = '[UNDEF]'
2021-09-01 10:53:31 us=112447 tls_export_cert = '[UNDEF]'
2021-09-01 10:53:31 us=112460 verify_x509_type = 0
2021-09-01 10:53:31 us=112473 verify_x509_name = '[UNDEF]'
2021-09-01 10:53:31 us=112796 crl_file = '[UNDEF]'
2021-09-01 10:53:31 us=112810 ns_cert_type = 0
2021-09-01 10:53:31 us=112824 remote_cert_ku[i] = 0
2021-09-01 10:53:31 us=112838 remote_cert_ku[i] = 0
2021-09-01 10:53:31 us=112850 remote_cert_ku[i] = 0
2021-09-01 10:53:31 us=112864 remote_cert_ku[i] = 0
2021-09-01 10:53:31 us=112877 remote_cert_ku[i] = 0
2021-09-01 10:53:31 us=112890 remote_cert_ku[i] = 0
2021-09-01 10:53:31 us=112903 remote_cert_ku[i] = 0
2021-09-01 10:53:31 us=112917 remote_cert_ku[i] = 0
2021-09-01 10:53:31 us=112930 remote_cert_ku[i] = 0
2021-09-01 10:53:31 us=112943 remote_cert_ku[i] = 0
2021-09-01 10:53:31 us=112958 remote_cert_ku[i] = 0
2021-09-01 10:53:31 us=112972 remote_cert_ku[i] = 0
2021-09-01 10:53:31 us=112985 remote_cert_ku[i] = 0
2021-09-01 10:53:31 us=112998 remote_cert_ku[i] = 0
2021-09-01 10:53:31 us=113011 remote_cert_ku[i] = 0
2021-09-01 10:53:31 us=113025 remote_cert_ku[i] = 0
2021-09-01 10:53:31 us=113039 remote_cert_eku = '[UNDEF]'
2021-09-01 10:53:31 us=113054 ssl_flags = 0
2021-09-01 10:53:31 us=113069 tls_timeout = 2
2021-09-01 10:53:31 us=113085 renegotiate_bytes = -1
2021-09-01 10:53:31 us=113100 renegotiate_packets = 0
2021-09-01 10:53:31 us=113115 renegotiate_seconds = 3600
2021-09-01 10:53:31 us=113130 handshake_window = 60
2021-09-01 10:53:31 us=113146 transition_window = 3600
2021-09-01 10:53:31 us=113162 single_session = DISABLED
2021-09-01 10:53:31 us=113176 push_peer_info = DISABLED
2021-09-01 10:53:31 us=113193 tls_exit = DISABLED
2021-09-01 10:53:31 us=113208 tls_crypt_v2_metadata = '[UNDEF]'
2021-09-01 10:53:31 us=113226 server_network = 192.168.254.0
2021-09-01 10:53:31 us=113243 server_netmask = 255.255.255.0
2021-09-01 10:53:31 us=113261 server_network_ipv6 = ::
2021-09-01 10:53:31 us=113274 server_netbits_ipv6 = 0
2021-09-01 10:53:31 us=113290 server_bridge_ip = 0.0.0.0
2021-09-01 10:53:31 us=113307 server_bridge_netmask = 0.0.0.0
2021-09-01 10:53:31 us=113323 server_bridge_pool_start = 0.0.0.0
2021-09-01 10:53:31 us=113339 server_bridge_pool_end = 0.0.0.0
2021-09-01 10:53:31 us=113353 push_entry = 'route 192.168.1.0 255.255.255.0'
2021-09-01 10:53:31 us=113368 push_entry = 'route 192.168.2.0 255.255.255.0'
2021-09-01 10:53:31 us=113382 push_entry = 'route 192.168.3.0 255.255.255.0'
2021-09-01 10:53:31 us=113396 push_entry = 'route 192.168.254.0 255.255.255.0'
2021-09-01 10:53:31 us=113410 push_entry = 'topology net30'
2021-09-01 10:53:31 us=113425 push_entry = 'ping 10'
2021-09-01 10:53:31 us=113440 push_entry = 'ping-restart 120'
2021-09-01 10:53:31 us=113454 ifconfig_pool_defined = ENABLED
2021-09-01 10:53:31 us=113470 ifconfig_pool_start = 192.168.254.4
2021-09-01 10:53:31 us=113486 ifconfig_pool_end = 192.168.254.251
2021-09-01 10:53:31 us=113516 ifconfig_pool_netmask = 0.0.0.0
2021-09-01 10:53:31 us=113534 ifconfig_pool_persist_filename = 'ipp.txt'
2021-09-01 10:53:31 us=113549 ifconfig_pool_persist_refresh_freq = 600
2021-09-01 10:53:31 us=113565 ifconfig_ipv6_pool_defined = DISABLED
2021-09-01 10:53:31 us=113585 ifconfig_ipv6_pool_base = ::
2021-09-01 10:53:31 us=113601 ifconfig_ipv6_pool_netbits = 0
2021-09-01 10:53:31 us=113618 n_bcast_buf = 256
2021-09-01 10:53:31 us=113634 tcp_queue_limit = 64
2021-09-01 10:53:31 us=113650 real_hash_size = 256
2021-09-01 10:53:31 us=113666 virtual_hash_size = 256
2021-09-01 10:53:31 us=113681 client_connect_script = '[UNDEF]'
2021-09-01 10:53:31 us=113699 learn_address_script = '[UNDEF]'
2021-09-01 10:53:31 us=113718 client_disconnect_script = '[UNDEF]'
2021-09-01 10:53:31 us=113736 client_config_dir = '/etc/openvpn/ccd'
2021-09-01 10:53:31 us=113755 ccd_exclusive = DISABLED
2021-09-01 10:53:31 us=113773 tmp_dir = '/tmp'
2021-09-01 10:53:31 us=113790 push_ifconfig_defined = DISABLED
2021-09-01 10:53:31 us=113808 push_ifconfig_local = 0.0.0.0
2021-09-01 10:53:31 us=113826 push_ifconfig_remote_netmask = 0.0.0.0
2021-09-01 10:53:31 us=113843 push_ifconfig_ipv6_defined = DISABLED
2021-09-01 10:53:31 us=113864 push_ifconfig_ipv6_local = ::/0
2021-09-01 10:53:31 us=113882 push_ifconfig_ipv6_remote = ::
2021-09-01 10:53:31 us=113899 enable_c2c = ENABLED
2021-09-01 10:53:31 us=113915 duplicate_cn = DISABLED
2021-09-01 10:53:31 us=113930 cf_max = 0
2021-09-01 10:53:31 us=113946 cf_per = 0
2021-09-01 10:53:31 us=113961 max_clients = 1024
2021-09-01 10:53:31 us=113977 max_routes_per_client = 256
2021-09-01 10:53:31 us=113994 auth_user_pass_verify_script = '[UNDEF]'
2021-09-01 10:53:31 us=114011 auth_user_pass_verify_script_via_file = DISABLED
2021-09-01 10:53:31 us=114031 auth_token_generate = DISABLED
2021-09-01 10:53:31 us=114047 auth_token_lifetime = 0
2021-09-01 10:53:31 us=114063 auth_token_secret_file = '[UNDEF]'
2021-09-01 10:53:31 us=114078 port_share_host = '[UNDEF]'
2021-09-01 10:53:31 us=114112 port_share_port = '[UNDEF]'
2021-09-01 10:53:31 us=114129 vlan_tagging = DISABLED
2021-09-01 10:53:31 us=114144 vlan_accept = all
2021-09-01 10:53:31 us=114158 vlan_pvid = 1
2021-09-01 10:53:31 us=114172 client = DISABLED
2021-09-01 10:53:31 us=114186 pull = DISABLED
2021-09-01 10:53:31 us=114199 auth_user_pass_file = '[UNDEF]'
2021-09-01 10:53:31 us=114216 OpenVPN 2.5.3 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Jun 19 2021
2021-09-01 10:53:31 us=114233 library versions: OpenSSL 1.1.1k 25 Mar 2021, LZO 2.10
2021-09-01 10:53:31 us=118830 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
2021-09-01 10:53:31 us=119807 Diffie-Hellman initialized with 1024 bit key
2021-09-01 10:53:31 us=120543 TLS-Auth MTU parms [ L:1622 D:1212 EF:38 EB:0 ET:0 EL:3 ]
2021-09-01 10:53:31 us=120698 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=eth0 HWADDR=a2:12:3f:31:34:04
2021-09-01 10:53:31 us=121121 TUN/TAP device tun0 opened
2021-09-01 10:53:31 us=121151 do_ifconfig, ipv4=1, ipv6=0
2021-09-01 10:53:31 us=121178 /sbin/ip link set dev tun0 up mtu 1500
2021-09-01 10:53:31 us=123054 /sbin/ip link set dev tun0 up
2021-09-01 10:53:31 us=132657 /sbin/ip addr add dev tun0 local 192.168.254.1 peer 192.168.254.2
2021-09-01 10:53:31 us=136194 /sbin/ip route add 192.168.2.0/24 via 192.168.254.2
2021-09-01 10:53:31 us=137003 /sbin/ip route add 192.168.4.0/24 via 192.168.254.2
2021-09-01 10:53:31 us=137645 /sbin/ip route add 192.168.254.0/24 via 192.168.254.2
2021-09-01 10:53:31 us=138325 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
2021-09-01 10:53:31 us=138410 Could not determine IPv4/IPv6 protocol. Using AF_INET
2021-09-01 10:53:31 us=138440 Socket Buffers: R=[212992->212992] S=[212992->212992]
2021-09-01 10:53:31 us=138482 UDPv4 link local (bound): [AF_INET]192.168.1.4:1194
2021-09-01 10:53:31 us=138500 UDPv4 link remote: [AF_UNSPEC]
2021-09-01 10:53:31 us=138520 GID set to nobody
2021-09-01 10:53:31 us=138542 UID set to nobody
2021-09-01 10:53:31 us=138563 MULTI: multi_init called, r=256 v=256
2021-09-01 10:53:31 us=138610 IFCONFIG POOL IPv4: base=192.168.254.4 size=62
2021-09-01 10:53:31 us=138645 ifconfig_pool_read(), in='vpn-bucharest,192.168.254.4,'
2021-09-01 10:53:31 us=138666 succeeded -> ifconfig_pool_set(hand=0)
2021-09-01 10:53:31 us=138683 ifconfig_pool_read(), in='falballa,192.168.254.8,'
2021-09-01 10:53:31 us=138700 succeeded -> ifconfig_pool_set(hand=1)
2021-09-01 10:53:31 us=138717 IFCONFIG POOL LIST
2021-09-01 10:53:31 us=138736 vpn-bucharest,192.168.254.4,
2021-09-01 10:53:31 us=138753 falballa,192.168.254.8,
2021-09-01 10:53:31 us=138811 Initialization Sequence Completed
2021-09-01 10:53:40 us=441282 MULTI: multi_create_instance called
2021-09-01 10:53:40 us=441387 85.186.3.146:41510 Re-using SSL/TLS context
2021-09-01 10:53:40 us=441423 85.186.3.146:41510 LZO compression initializing
2021-09-01 10:53:40 us=441576 85.186.3.146:41510 Control Channel MTU parms [ L:1622 D:1212 EF:38 EB:0 ET:0 EL:3 ]
2021-09-01 10:53:40 us=441591 85.186.3.146:41510 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
2021-09-01 10:53:40 us=441641 85.186.3.146:41510 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,auth SHA1,keysize 128,key-method 2,tls-server'
2021-09-01 10:53:40 us=441650 85.186.3.146:41510 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,auth SHA1,keysize 128,key-method 2,tls-client'
2021-09-01 10:53:40 us=441678 85.186.3.146:41510 TLS: Initial packet from [AF_INET]85.186.3.146:41510, sid=7d7d5852 7d361c6d
2021-09-01 10:53:40 us=663553 85.186.3.146:41510 VERIFY OK: depth=1, CN=ca.simon.local, L=Dachau, O=MPM-Networks, C=DE, emailAddress=m.simon@mpm-networks.net
2021-09-01 10:53:40 us=663854 85.186.3.146:41510 VERIFY OK: depth=0, O=MPM-Networks, C=RO, CN=vpn-bucharest, emailAddress=m.simon@mpm-networks.net, L=Bucharfest
2021-09-01 10:53:40 us=664265 85.186.3.146:41510 peer info: IV_VER=2.4.7
2021-09-01 10:53:40 us=664279 85.186.3.146:41510 peer info: IV_PLAT=linux
2021-09-01 10:53:40 us=664287 85.186.3.146:41510 peer info: IV_PROTO=2
2021-09-01 10:53:40 us=664294 85.186.3.146:41510 peer info: IV_NCP=2
2021-09-01 10:53:40 us=664302 85.186.3.146:41510 peer info: IV_LZ4=1
2021-09-01 10:53:40 us=664308 85.186.3.146:41510 peer info: IV_LZ4v2=1
2021-09-01 10:53:40 us=664320 85.186.3.146:41510 peer info: IV_LZO=1
2021-09-01 10:53:40 us=664327 85.186.3.146:41510 peer info: IV_COMP_STUB=1
2021-09-01 10:53:40 us=664333 85.186.3.146:41510 peer info: IV_COMP_STUBv2=1
2021-09-01 10:53:40 us=664340 85.186.3.146:41510 peer info: IV_TCPNL=1
2021-09-01 10:53:40 us=735460 85.186.3.146:41510 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA1
2021-09-01 10:53:40 us=735556 85.186.3.146:41510 [vpn-bucharest] Peer Connection Initiated with [AF_INET]85.186.3.146:41510
2021-09-01 10:53:40 us=735630 vpn-bucharest/85.186.3.146:41510 MULTI_sva: pool returned IPv4=192.168.254.6, IPv6=(Not enabled)
2021-09-01 10:53:40 us=735707 vpn-bucharest/85.186.3.146:41510 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/vpn-bucharest
2021-09-01 10:53:40 us=735793 vpn-bucharest/85.186.3.146:41510 MULTI: Learn: 192.168.254.6 -> vpn-bucharest/85.186.3.146:41510
2021-09-01 10:53:40 us=735807 vpn-bucharest/85.186.3.146:41510 MULTI: primary virtual IP for vpn-bucharest/85.186.3.146:41510: 192.168.254.6
2021-09-01 10:53:40 us=735818 vpn-bucharest/85.186.3.146:41510 MULTI: internal route 192.168.4.0/24 -> vpn-bucharest/85.186.3.146:41510
2021-09-01 10:53:40 us=735830 vpn-bucharest/85.186.3.146:41510 MULTI: Learn: 192.168.4.0/24 -> vpn-bucharest/85.186.3.146:41510
2021-09-01 10:53:40 us=735857 vpn-bucharest/85.186.3.146:41510 Data Channel: using negotiated cipher 'AES-256-GCM'
2021-09-01 10:53:40 us=735891 vpn-bucharest/85.186.3.146:41510 Data Channel MTU parms [ L:1550 D:1450 EF:50 EB:406 ET:0 EL:3 ]
2021-09-01 10:53:40 us=736010 vpn-bucharest/85.186.3.146:41510 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2021-09-01 10:53:40 us=736021 vpn-bucharest/85.186.3.146:41510 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2021-09-01 10:53:41 us=983919 vpn-bucharest/85.186.3.146:41510 PUSH: Received control message: 'PUSH_REQUEST'
2021-09-01 10:53:41 us=984014 vpn-bucharest/85.186.3.146:41510 SENT CONTROL [vpn-bucharest]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 192.168.2.0 255.255.255.0,route 192.168.3.0 255.255.255.0,route 192.168.254.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.254.6 192.168.254.5,peer-id 0,cipher AES-256-GCM' (status=1)
2021-09-01 10:53:45 us=239486 MULTI: multi_create_instance called
2021-09-01 10:53:45 us=239592 95.118.58.103:50762 Re-using SSL/TLS context
2021-09-01 10:53:45 us=239620 95.118.58.103:50762 LZO compression initializing
2021-09-01 10:53:45 us=239803 95.118.58.103:50762 Control Channel MTU parms [ L:1622 D:1212 EF:38 EB:0 ET:0 EL:3 ]
2021-09-01 10:53:45 us=239835 95.118.58.103:50762 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
2021-09-01 10:53:45 us=239909 95.118.58.103:50762 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,auth SHA1,keysize 128,key-method 2,tls-server'
2021-09-01 10:53:45 us=239930 95.118.58.103:50762 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,auth SHA1,keysize 128,key-method 2,tls-client'
2021-09-01 10:53:45 us=239972 95.118.58.103:50762 TLS: Initial packet from [AF_INET]95.118.58.103:50762, sid=0c3c7868 0fdef9d5
2021-09-01 10:53:45 us=461394 95.118.58.103:50762 VERIFY OK: depth=1, CN=ca.simon.local, L=Dachau, O=MPM-Networks, C=DE, emailAddress=m.simon@mpm-networks.net
2021-09-01 10:53:45 us=461799 95.118.58.103:50762 VERIFY OK: depth=0, O=MPM-Networks, C=DE, CN=falballa, emailAddress=m.simon@mpm-networks.net, L=Munich
2021-09-01 10:53:45 us=464831 95.118.58.103:50762 peer info: IV_VER=2.4.7
2021-09-01 10:53:45 us=464876 95.118.58.103:50762 peer info: IV_PLAT=linux
2021-09-01 10:53:45 us=464893 95.118.58.103:50762 peer info: IV_PROTO=2
2021-09-01 10:53:45 us=464910 95.118.58.103:50762 peer info: IV_NCP=2
2021-09-01 10:53:45 us=464926 95.118.58.103:50762 peer info: IV_LZ4=1
2021-09-01 10:53:45 us=464942 95.118.58.103:50762 peer info: IV_LZ4v2=1
2021-09-01 10:53:45 us=464958 95.118.58.103:50762 peer info: IV_LZO=1
2021-09-01 10:53:45 us=464974 95.118.58.103:50762 peer info: IV_COMP_STUB=1
2021-09-01 10:53:45 us=464989 95.118.58.103:50762 peer info: IV_COMP_STUBv2=1
2021-09-01 10:53:45 us=465005 95.118.58.103:50762 peer info: IV_TCPNL=1
2021-09-01 10:53:45 us=523718 95.118.58.103:50762 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA1
2021-09-01 10:53:45 us=523801 95.118.58.103:50762 [falballa] Peer Connection Initiated with [AF_INET]95.118.58.103:50762
2021-09-01 10:53:45 us=523862 falballa/95.118.58.103:50762 MULTI_sva: pool returned IPv4=192.168.254.10, IPv6=(Not enabled)
2021-09-01 10:53:45 us=523940 falballa/95.118.58.103:50762 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/falballa
2021-09-01 10:53:45 us=524039 falballa/95.118.58.103:50762 MULTI: Learn: 192.168.254.10 -> falballa/95.118.58.103:50762
2021-09-01 10:53:45 us=524068 falballa/95.118.58.103:50762 MULTI: primary virtual IP for falballa/95.118.58.103:50762: 192.168.254.10
2021-09-01 10:53:45 us=524093 falballa/95.118.58.103:50762 MULTI: internal route 192.168.2.0/24 -> falballa/95.118.58.103:50762
2021-09-01 10:53:45 us=524114 falballa/95.118.58.103:50762 MULTI: Learn: 192.168.2.0/24 -> falballa/95.118.58.103:50762
2021-09-01 10:53:45 us=524141 falballa/95.118.58.103:50762 REMOVE PUSH ROUTE: 'route 192.168.2.0 255.255.255.0'
2021-09-01 10:53:45 us=524188 falballa/95.118.58.103:50762 Data Channel: using negotiated cipher 'AES-256-GCM'
2021-09-01 10:53:45 us=524224 falballa/95.118.58.103:50762 Data Channel MTU parms [ L:1550 D:1450 EF:50 EB:406 ET:0 EL:3 ]
2021-09-01 10:53:45 us=524397 falballa/95.118.58.103:50762 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2021-09-01 10:53:45 us=524423 falballa/95.118.58.103:50762 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2021-09-01 10:53:46 us=611940 falballa/95.118.58.103:50762 PUSH: Received control message: 'PUSH_REQUEST'
2021-09-01 10:53:46 us=612038 falballa/95.118.58.103:50762 SENT CONTROL [falballa]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 192.168.3.0 255.255.255.0,route 192.168.254.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.254.10 192.168.254.9,peer-id 1,cipher AES-256-GCM' (status=1
on client side:
ovpn config:
client
dev tun
auth-user-pass /etc/openvpn/secrets.conf
proto udp
remote dl9vsmyxdc6hdwnu.myfritz.net
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/cert.pem
key /etc/openvpn/certs/key.pem
verb 4
log-append /var/log/openvpn.log
route -n:
Ziel Router Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.4.1 0.0.0.0 UG 302 0 0 wlan0
192.168.1.0 192.168.254.5 255.255.255.0 UG 0 0 0 tun0
192.168.2.0 192.168.254.5 255.255.255.0 UG 0 0 0 tun0
192.168.3.0 192.168.254.5 255.255.255.0 UG 0 0 0 tun0
192.168.4.0 0.0.0.0 255.255.255.0 U 302 0 0 wlan0
192.168.254.0 192.168.254.5 255.255.255.0 UG 0 0 0 tun0
192.168.254.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
iptables -S:
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd
-A INPUT -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i wlan0 -j ACCEPT
-A INPUT -i tun0 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j ACCEPT
and the log here says:
WARNING: file '/etc/openvpn/secrets.conf' is group or others accessible
Current Parameter Settings:
config = 'vpn.conf'
mode = 0
persist_config = DISABLED
persist_mode = 1
show_ciphers = DISABLED
show_digests = DISABLED
show_engines = DISABLED
genkey = DISABLED
key_pass_file = '[UNDEF]'
show_tls_ciphers = DISABLED
connect_retry_max = 0
Connection profiles [0]:
proto = udp
local = '[UNDEF]'
local_port = '[UNDEF]'
remote = 'dl9vsmyxdc6hdwnu.myfritz.net'
remote_port = '1194'
remote_float = DISABLED
bind_defined = DISABLED
bind_local = DISABLED
bind_ipv6_only = DISABLED
connect_retry_seconds = 5
connect_timeout = 120
socks_proxy_server = '[UNDEF]'
socks_proxy_port = '[UNDEF]'
tun_mtu = 1500
tun_mtu_defined = ENABLED
link_mtu = 1500
link_mtu_defined = DISABLED
tun_mtu_extra = 0
tun_mtu_extra_defined = DISABLED
mtu_discover_type = -1
fragment = 0
mssfix = 1450
explicit_exit_notification = 0
Connection profiles END
remote_random = DISABLED
ipchange = '[UNDEF]'
dev = 'tun'
dev_type = '[UNDEF]'
dev_node = '[UNDEF]'
lladdr = '[UNDEF]'
topology = 1
ifconfig_local = '[UNDEF]'
ifconfig_remote_netmask = '[UNDEF]'
ifconfig_noexec = DISABLED
ifconfig_nowarn = DISABLED
ifconfig_ipv6_local = '[UNDEF]'
ifconfig_ipv6_netbits = 0
ifconfig_ipv6_remote = '[UNDEF]'
shaper = 0
mtu_test = 0
mlock = DISABLED
keepalive_ping = 0
keepalive_timeout = 0
inactivity_timeout = 0
ping_send_timeout = 0
ping_rec_timeout = 0
ping_rec_timeout_action = 0
ping_timer_remote = DISABLED
remap_sigusr1 = 0
persist_tun = ENABLED
persist_local_ip = DISABLED
persist_remote_ip = DISABLED
persist_key = ENABLED
passtos = DISABLED
resolve_retry_seconds = 1000000000
resolve_in_advance = DISABLED
username = '[UNDEF]'
groupname = '[UNDEF]'
chroot_dir = '[UNDEF]'
cd_dir = '[UNDEF]'
writepid = '[UNDEF]'
up_script = '[UNDEF]'
down_script = '[UNDEF]'
down_pre = DISABLED
up_restart = DISABLED
up_delay = DISABLED
daemon = DISABLED
inetd = 0
log = ENABLED
suppress_timestamps = ENABLED
machine_readable_output = DISABLED
nice = 0
verbosity = 4
mute = 0
gremlin = 0
status_file = '[UNDEF]'
status_file_version = 1
status_file_update_freq = 60
occ = ENABLED
rcvbuf = 0
sndbuf = 0
mark = 0
sockflags = 0
fast_io = DISABLED
comp.alg = 2
comp.flags = 1
route_script = '[UNDEF]'
route_default_gateway = '[UNDEF]'
route_default_metric = 0
route_noexec = DISABLED
route_delay = 0
route_delay_window = 30
route_delay_defined = DISABLED
route_nopull = DISABLED
route_gateway_via_dhcp = DISABLED
allow_pull_fqdn = DISABLED
management_addr = '[UNDEF]'
management_port = '[UNDEF]'
management_user_pass = '[UNDEF]'
management_log_history_cache = 250
management_echo_buffer_size = 100
management_write_peer_info_file = '[UNDEF]'
management_client_user = '[UNDEF]'
management_client_group = '[UNDEF]'
management_flags = 0
shared_secret_file = '[UNDEF]'
key_direction = not set
ciphername = 'BF-CBC'
ncp_enabled = ENABLED
ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
authname = 'SHA1'
prng_hash = 'SHA1'
prng_nonce_secret_len = 16
keysize = 0
engine = DISABLED
replay = ENABLED
mute_replay_warnings = DISABLED
replay_window = 64
replay_time = 15
packet_id_file = '[UNDEF]'
use_iv = ENABLED
test_crypto = DISABLED
tls_server = DISABLED
tls_client = ENABLED
key_method = 2
ca_file = '/etc/openvpn/certs/ca.crt'
ca_path = '[UNDEF]'
dh_file = '[UNDEF]'
cert_file = '/etc/openvpn/certs/cert.pem'
extra_certs_file = '[UNDEF]'
priv_key_file = '/etc/openvpn/certs/key.pem'
pkcs12_file = '[UNDEF]'
cipher_list = '[UNDEF]'
cipher_list_tls13 = '[UNDEF]'
tls_cert_profile = '[UNDEF]'
tls_verify = '[UNDEF]'
tls_export_cert = '[UNDEF]'
verify_x509_type = 0
verify_x509_name = '[UNDEF]'
crl_file = '[UNDEF]'
ns_cert_type = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_ku[i] = 0
remote_cert_eku = '[UNDEF]'
ssl_flags = 0
tls_timeout = 2
renegotiate_bytes = -1
renegotiate_packets = 0
renegotiate_seconds = 3600
handshake_window = 60
transition_window = 3600
single_session = DISABLED
push_peer_info = DISABLED
tls_exit = DISABLED
tls_auth_file = '[UNDEF]'
tls_crypt_file = '[UNDEF]'
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_protected_authentication = DISABLED
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_private_mode = 00000000
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_cert_private = DISABLED
pkcs11_pin_cache_period = -1
pkcs11_id = '[UNDEF]'
pkcs11_id_management = DISABLED
server_network = 0.0.0.0
server_netmask = 0.0.0.0
server_network_ipv6 = ::
server_netbits_ipv6 = 0
server_bridge_ip = 0.0.0.0
server_bridge_netmask = 0.0.0.0
server_bridge_pool_start = 0.0.0.0
server_bridge_pool_end = 0.0.0.0
ifconfig_pool_defined = DISABLED
ifconfig_pool_start = 0.0.0.0
ifconfig_pool_end = 0.0.0.0
ifconfig_pool_netmask = 0.0.0.0
ifconfig_pool_persist_filename = '[UNDEF]'
ifconfig_pool_persist_refresh_freq = 600
ifconfig_ipv6_pool_defined = DISABLED
ifconfig_ipv6_pool_base = ::
ifconfig_ipv6_pool_netbits = 0
n_bcast_buf = 256
tcp_queue_limit = 64
real_hash_size = 256
virtual_hash_size = 256
client_connect_script = '[UNDEF]'
learn_address_script = '[UNDEF]'
client_disconnect_script = '[UNDEF]'
client_config_dir = '[UNDEF]'
ccd_exclusive = DISABLED
tmp_dir = '/tmp'
push_ifconfig_defined = DISABLED
push_ifconfig_local = 0.0.0.0
push_ifconfig_remote_netmask = 0.0.0.0
push_ifconfig_ipv6_defined = DISABLED
push_ifconfig_ipv6_local = ::/0
push_ifconfig_ipv6_remote = ::
enable_c2c = DISABLED
duplicate_cn = DISABLED
cf_max = 0
cf_per = 0
max_clients = 1024
max_routes_per_client = 256
auth_user_pass_verify_script = '[UNDEF]'
auth_user_pass_verify_script_via_file = DISABLED
auth_token_generate = DISABLED
auth_token_lifetime = 0
port_share_host = '[UNDEF]'
port_share_port = '[UNDEF]'
client = ENABLED
pull = ENABLED
auth_user_pass_file = '/etc/openvpn/secrets.conf'
OpenVPN 2.4.7 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 28 2021
library versions: OpenSSL 1.1.1d 10 Sep 2019, LZO 2.10
WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
LZO compression initializing
Control Channel MTU parms [ L:1622 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ]
Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
TCP/UDP: Preserving recently used remote address: [AF_INET]91.5.26.41:1194
Socket Buffers: R=[180224->180224] S=[180224->180224]
UDP link local: (not bound)
UDP link remote: [AF_INET]91.5.26.41:1194
TLS: Initial packet from [AF_INET]91.5.26.41:1194, sid=5cc9d187 896628d7
WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
VERIFY OK: depth=1, CN=ca.simon.local, L=Dachau, O=MPM-Networks, C=DE, emailAddress=m.simon@mpm-networks.net
VERIFY OK: depth=0, O=MPM-Networks, C=DE, CN=carey.simon.local, emailAddress=m.simon@mpm-networks.net, L=Dachau
WARNING: 'cipher' is present in local config but missing in remote config, local='cipher BF-CBC'
Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
[carey.simon.local] Peer Connection Initiated with [AF_INET]91.5.26.41:1194
SENT CONTROL [carey.simon.local]: 'PUSH_REQUEST' (status=1)
PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 192.168.2.0 255.255.255.0,route 192.168.3.0 255.255.255.0,route 192.168.254.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.254.6 192.168.254.5,peer-id 0,cipher AES-256-GCM'
OPTIONS IMPORT: timers and/or timeouts modified
OPTIONS IMPORT: --ifconfig/up options modified
OPTIONS IMPORT: route options modified
OPTIONS IMPORT: peer-id set
OPTIONS IMPORT: adjusting link_mtu to 1625
OPTIONS IMPORT: data channel crypto options modified
Data Channel: using negotiated cipher 'AES-256-GCM'
Data Channel MTU parms [ L:1553 D:1450 EF:53 EB:406 ET:0 EL:3 ]
Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
ROUTE_GATEWAY 192.168.4.1/255.255.255.0 IFACE=wlan0 HWADDR=b8:27:eb:ae:6e:1d
TUN/TAP device tun0 opened
TUN/TAP TX queue length set to 100
do_ifconfig, tt->did_ifconfig_ipv6_setup=0
/sbin/ip link set dev tun0 up mtu 1500
/sbin/ip addr add dev tun0 local 192.168.254.6 peer 192.168.254.5
/sbin/ip route add 192.168.1.0/24 via 192.168.254.5
/sbin/ip route add 192.168.2.0/24 via 192.168.254.5
/sbin/ip route add 192.168.3.0/24 via 192.168.254.5
/sbin/ip route add 192.168.254.0/24 via 192.168.254.5
Initialization Sequence Completed
The result is this:
From client:
root@vpnclient:/home/pi# ping 192.168.1.11 -c2
PING 192.168.1.11 (192.168.1.11) 56(84) bytes of data.
--- 192.168.1.11 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 8ms
root@vpnclient:/home/pi# ping 192.168.1.4 -c2
PING 192.168.1.4 (192.168.1.4) 56(84) bytes of data.
64 bytes from 192.168.1.4: icmp_seq=1 ttl=64 time=55.8 ms
64 bytes from 192.168.1.4: icmp_seq=2 ttl=64 time=58.4 ms
--- 192.168.1.4 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 3ms
rtt min/avg/max/mdev = 55.830/57.121/58.413/1.313 ms
From Server:
carey:~# ping 192.168.4.1 -c2
PING 192.168.4.1 (192.168.4.1): 56 data bytes
--- 192.168.4.1 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss
carey:~# ping 192.168.4.2 -c2
PING 192.168.4.2 (192.168.4.2): 56 data bytes
64 bytes from 192.168.4.2: seq=0 ttl=64 time=57.468 ms
64 bytes from 192.168.4.2: seq=1 ttl=64 time=52.491 ms
--- 192.168.4.2 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 52.491/54.979/57.468 ms
