Hi, i have here a problem with my newly setup ovpn infrastructure and I hope you can help me. I'm pretty sure I just have a stupid error here what is easy to find. First the LAN setups: In Dachau [list] [*] I have two LAN: 192.168.1.0/24 and 192.168.3.0/24 [*] Between these two networks is one server with alpine linux and routing enabled. [*] On this server is also the ovpn server running [*] Addresses of this server: 192.168.1.4, 192.168.3.1 [/list] In Munich [list] [*] One network with 192.168.2.0/24 [*] An ovpn client running on a raspberry pi zero w with raspbian (192.168.2.4) [/list] In Bucharest [list] [*] One network with 192.168.4.0/24 [*] An ovpn client running on a raspberry pi zero w with raspbian (192.168.4.2) [/list] The network for ovpn is 192.168.254.0/24 Atm i have a hardware problem in Munich, so this connection is not used until it is fixed. So I'm speaking atm of the connection Dachau Bucharest only. The final goal would be to have a s2s2s connection to access all clients in all networks. What is working: [list] [*] I can ping and reach interfaces from bucharest everything in dachau (both networks. [*] Pinging the client on the tun0 interface ip [*] Connecting to an interface on the vpn client using the tun0 (client side) ip address [*] Pinging the vpn server on the tun0 interface ip [/list] What is not working: [list] [*] I can not ping from dachau any address in bucharest [*] connecting to any interface in bucharest [/list] My config on the ovpn server: openvpn.conf [code] port 1194 proto udp dev tun ca /etc/openvpn/openvpn_certs/carey-ca.pem cert /etc/openvpn/openvpn_certs/carey-cert.pem key /etc/openvpn/openvpn_certs/carey-key.pem dh /etc/openvpn/openvpn_certs/dh1024.pem server 192.168.254.0 255.255.255.0 route 192.168.2.0 255.255.255.0 route 192.168.4.0 255.255.255.0 push "route 192.168.1.0 255.255.255.0" push "route 192.168.2.0 255.255.255.0" push "route 192.168.3.0 255.255.255.0" ifconfig-pool-persist ipp.txt client-to-client keepalive 10 120 comp-lzo allow-compression yes user nobody group nobody persist-key persist-tun status /var/log/openvpn-status.log log-append /var/log/openvpn.log verb 4 explicit-exit-notify 1 [/code] ccd for client in bucharest: [code] ifconfig-push 192.168.254.11 255.255.255.0 iroute 192.168.1.0 255.255.255.0 iroute 192.168.2.0 255.255.255.0 iroute 192.168.3.0 255.255.255.0 [/code] iptables rules (server): [code] -A POSTROUTING -o eth0 -j MASQUERADE -A POSTROUTING -o eth1 -j MASQUERADE -A POSTROUTING -o tun0 -j MASQUERADE COMMIT -A INPUT -i lo -j ACCEPT -A INPUT -i eth0 -j ACCEPT -A INPUT -i eth1 -j ACCEPT -A INPUT -i tun0 -j ACCEPT COMMIT [/code] ovpn config on client: [code] client dev tun auth-user-pass /etc/openvpn/secrets.conf proto udp remote resolv-retry infinite nobind persist-key persist-tun comp-lzo ca /etc/openvpn/certs/ca.crt cert /etc/openvpn/certs/cert.pem key /etc/openvpn/certs/key.pem verb 3 [/code] iptables rules on client: [code] -A POSTROUTING -o wlan0 -j MASQUERADE -A POSTROUTING -o tun0 -j MASQUERADE COMMIT -A INPUT -i lo -j ACCEPT -A INPUT -i wlan0 -j ACCEPT -A INPUT -i tun0 -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT COMMIT [/code] The routing tables look like this: on server: [code] Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.1.1 0.0.0.0 UG 1 0 0 eth0 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 192.168.2.0 192.168.254.2 255.255.255.0 UG 0 0 0 tun0 192.168.3.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 192.168.4.0 192.168.254.2 255.255.255.0 UG 0 0 0 tun0 192.168.254.0 192.168.254.2 255.255.255.0 UG 0 0 0 tun0 192.168.254.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 [/code] on client: [code] Ziel Router Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.4.1 0.0.0.0 UG 302 0 0 wlan0 192.168.1.0 192.168.254.5 255.255.255.0 UG 0 0 0 tun0 192.168.2.0 192.168.254.5 255.255.255.0 UG 0 0 0 tun0 192.168.3.0 192.168.254.5 255.255.255.0 UG 0 0 0 tun0 192.168.4.0 0.0.0.0 255.255.255.0 U 302 0 0 wlan0 192.168.254.0 192.168.254.5 255.255.255.0 UG 0 0 0 tun0 192.168.254.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 [/code] I'm pretty sure there is a stupid error in my config what I don't see. So please be patient with me. :-D Thank you for your advice.

What is the name of certificate on Bucharest ' client? This name must be the same name as file name on cdd folder. When clien in Bucharest connect to server what is openvpn ip address it ? I see it as you want client have ip 192.168.254.11 but in routing table on server that is not correct so it not work. You need iroute 192.168.4.0 255.255.255.0 too. That is what server need to forward package back to clients. server need to read correctly client certificate name so it will know which client ip address and adding itself on its routing table. The last thing is you need ipforward and nat on client as you do on server. When site to site routing .every point of openvpn become a node so no server and client at all but point of connection.

Thank you the response. I've added 192.168.4.0/24 to the ccd file. What is getting used now also. To reduce the complexity I've removed the ifconfig-push line. The CN in the ther and the file name were correct. what was not set was clien-config-dir in the server config. I've added this line and now the fiel is getting used. and I have another problem now: Now I can connect from server network to client network, but not from client to server. And the routes to the server side networks are not getting pushed to the client. route -n on server [code] Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.1.1 0.0.0.0 UG 1 0 0 eth0 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 192.168.2.0 192.168.254.2 255.255.255.0 UG 0 0 0 tun0 192.168.3.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 192.168.4.0 192.168.254.2 255.255.255.0 UG 0 0 0 tun0 192.168.254.0 192.168.254.2 255.255.255.0 UG 0 0 0 tun0 192.168.254.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 [/code] route -n on client [code] Ziel Router Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.4.1 0.0.0.0 UG 302 0 0 wlan0 192.168.4.0 0.0.0.0 255.255.255.0 U 302 0 0 wlan0 192.168.254.0 192.168.254.5 255.255.255.0 UG 0 0 0 tun0 192.168.254.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 [/code] client config looks now: [code] iroute 192.168.4.0 255.255.255.0 iroute 192.168.1.0 255.255.255.0 iroute 192.168.2.0 255.255.255.0 iroute 192.168.3.0 255.255.255.0 [/code] tun0 on server [code] tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:192.168.254.1 P-t-P:192.168.254.2 Mask:255.255.255.255 inet6 addr: fe80::6b36:e627:8c1c:b042/64 Scope:Link UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:9 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:500 RX bytes:0 (0.0 B) TX bytes:432 (432.0 B) [/code] and on client [code] tun0: flags=4305 mtu 1500 inet 192.168.254.6 netmask 255.255.255.255 destination 192.168.254.5 inet6 fe80::7b42:aa19:d9d:c67 prefixlen 64 scopeid 0x20 unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC) RX packets 8 bytes 384 (384.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 10 bytes 480 (480.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 [/code] iptables rules are in place and ipv4 routing is enabled. So when I'm getting the routes to the client it should work?

You need post full log client to see what is going on . Without log we dont know anything on clients side. Do you know what ip address client get when it connected to server?

You need post log in here. Noone click link on website at all

ok, here is the server log: [code] 2021-08-27 11:31:20 us=834816 WARNING: --topology net30 support for server configs with IPv4 pools will be removed in a future release. Please migrate to --topology subnet as soon as possible. 2021-08-27 11:31:20 us=834858 --cipher is not set. Previous OpenVPN version defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers. 2021-08-27 11:31:20 us=835144 Current Parameter Settings: 2021-08-27 11:31:20 us=835168 config = '/etc/openvpn/openvpn.conf' 2021-08-27 11:31:20 us=835185 mode = 1 2021-08-27 11:31:20 us=835201 persist_config = DISABLED 2021-08-27 11:31:20 us=835216 persist_mode = 1 2021-08-27 11:31:20 us=835230 show_ciphers = DISABLED 2021-08-27 11:31:20 us=835245 show_digests = DISABLED 2021-08-27 11:31:20 us=835260 show_engines = DISABLED 2021-08-27 11:31:20 us=835276 genkey = DISABLED 2021-08-27 11:31:20 us=835290 genkey_filename = '[UNDEF]' 2021-08-27 11:31:20 us=835305 key_pass_file = '[UNDEF]' 2021-08-27 11:31:20 us=835320 show_tls_ciphers = DISABLED 2021-08-27 11:31:20 us=835335 connect_retry_max = 0 2021-08-27 11:31:20 us=835350 Connection profiles [0]: 2021-08-27 11:31:20 us=835365 proto = udp 2021-08-27 11:31:20 us=835379 local = '[UNDEF]' 2021-08-27 11:31:20 us=835393 local_port = '1194' 2021-08-27 11:31:20 us=835407 remote = '[UNDEF]' 2021-08-27 11:31:20 us=835421 remote_port = '1194' 2021-08-27 11:31:20 us=835436 remote_float = DISABLED 2021-08-27 11:31:20 us=835451 bind_defined = DISABLED 2021-08-27 11:31:20 us=835466 bind_local = ENABLED 2021-08-27 11:31:20 us=835482 bind_ipv6_only = DISABLED 2021-08-27 11:31:20 us=835497 connect_retry_seconds = 5 2021-08-27 11:31:20 us=835513 connect_timeout = 120 2021-08-27 11:31:20 us=835528 socks_proxy_server = '[UNDEF]' 2021-08-27 11:31:20 us=835544 socks_proxy_port = '[UNDEF]' 2021-08-27 11:31:20 us=835559 tun_mtu = 1500 2021-08-27 11:31:20 us=835573 tun_mtu_defined = ENABLED 2021-08-27 11:31:20 us=835588 link_mtu = 1500 2021-08-27 11:31:20 us=835602 link_mtu_defined = DISABLED 2021-08-27 11:31:20 us=835618 tun_mtu_extra = 0 2021-08-27 11:31:20 us=835633 tun_mtu_extra_defined = DISABLED 2021-08-27 11:31:20 us=835648 mtu_discover_type = -1 2021-08-27 11:31:20 us=835662 fragment = 0 2021-08-27 11:31:20 us=835675 mssfix = 1450 2021-08-27 11:31:20 us=835689 explicit_exit_notification = 1 2021-08-27 11:31:20 us=835703 tls_auth_file = '[UNDEF]' 2021-08-27 11:31:20 us=835718 key_direction = not set 2021-08-27 11:31:20 us=835734 tls_crypt_file = '[UNDEF]' 2021-08-27 11:31:20 us=835748 tls_crypt_v2_file = '[UNDEF]' 2021-08-27 11:31:20 us=835762 Connection profiles END 2021-08-27 11:31:20 us=835776 remote_random = DISABLED 2021-08-27 11:31:20 us=835790 ipchange = '[UNDEF]' 2021-08-27 11:31:20 us=835805 dev = 'tun' 2021-08-27 11:31:20 us=835818 dev_type = '[UNDEF]' 2021-08-27 11:31:20 us=835832 dev_node = '[UNDEF]' 2021-08-27 11:31:20 us=835847 lladdr = '[UNDEF]' 2021-08-27 11:31:20 us=835878 topology = 1 2021-08-27 11:31:20 us=835894 ifconfig_local = '192.168.254.1' 2021-08-27 11:31:20 us=835909 ifconfig_remote_netmask = '192.168.254.2' 2021-08-27 11:31:20 us=835924 ifconfig_noexec = DISABLED 2021-08-27 11:31:20 us=835938 ifconfig_nowarn = DISABLED 2021-08-27 11:31:20 us=835954 ifconfig_ipv6_local = '[UNDEF]' 2021-08-27 11:31:20 us=835968 ifconfig_ipv6_netbits = 0 2021-08-27 11:31:20 us=835983 ifconfig_ipv6_remote = '[UNDEF]' 2021-08-27 11:31:20 us=835996 shaper = 0 2021-08-27 11:31:20 us=836011 mtu_test = 0 2021-08-27 11:31:20 us=836026 mlock = DISABLED 2021-08-27 11:31:20 us=836041 keepalive_ping = 10 2021-08-27 11:31:20 us=836057 keepalive_timeout = 120 2021-08-27 11:31:20 us=836072 inactivity_timeout = 0 2021-08-27 11:31:20 us=836087 ping_send_timeout = 10 2021-08-27 11:31:20 us=836102 ping_rec_timeout = 240 2021-08-27 11:31:20 us=836117 ping_rec_timeout_action = 2 2021-08-27 11:31:20 us=836131 ping_timer_remote = DISABLED 2021-08-27 11:31:20 us=836159 remap_sigusr1 = 0 2021-08-27 11:31:20 us=836173 persist_tun = ENABLED 2021-08-27 11:31:20 us=836187 persist_local_ip = DISABLED 2021-08-27 11:31:20 us=836200 persist_remote_ip = DISABLED 2021-08-27 11:31:20 us=836214 persist_key = ENABLED 2021-08-27 11:31:20 us=836227 passtos = DISABLED 2021-08-27 11:31:20 us=836242 resolve_retry_seconds = 1000000000 2021-08-27 11:31:20 us=836256 resolve_in_advance = DISABLED 2021-08-27 11:31:20 us=836272 username = 'nobody' 2021-08-27 11:31:20 us=836286 groupname = 'nobody' 2021-08-27 11:31:20 us=836301 chroot_dir = '[UNDEF]' 2021-08-27 11:31:20 us=836316 cd_dir = '[UNDEF]' 2021-08-27 11:31:20 us=836332 writepid = '/run/openvpn.pid' 2021-08-27 11:31:20 us=836347 up_script = '[UNDEF]' 2021-08-27 11:31:20 us=836361 down_script = '[UNDEF]' 2021-08-27 11:31:20 us=836377 down_pre = DISABLED 2021-08-27 11:31:20 us=836392 up_restart = DISABLED 2021-08-27 11:31:20 us=836407 up_delay = DISABLED 2021-08-27 11:31:20 us=836421 daemon = ENABLED 2021-08-27 11:31:20 us=836436 inetd = 0 2021-08-27 11:31:20 us=836450 log = ENABLED 2021-08-27 11:31:20 us=836463 suppress_timestamps = DISABLED 2021-08-27 11:31:20 us=836476 machine_readable_output = DISABLED 2021-08-27 11:31:20 us=836488 nice = 0 2021-08-27 11:31:20 us=836500 verbosity = 4 2021-08-27 11:31:20 us=836512 mute = 0 2021-08-27 11:31:20 us=836525 gremlin = 0 2021-08-27 11:31:20 us=836538 status_file = '/var/log/openvpn-status.log' 2021-08-27 11:31:20 us=836550 status_file_version = 1 2021-08-27 11:31:20 us=836563 status_file_update_freq = 60 2021-08-27 11:31:20 us=836576 occ = ENABLED 2021-08-27 11:31:20 us=836589 rcvbuf = 0 2021-08-27 11:31:20 us=836602 sndbuf = 0 2021-08-27 11:31:20 us=836615 mark = 0 2021-08-27 11:31:20 us=836628 sockflags = 0 2021-08-27 11:31:20 us=836641 fast_io = DISABLED 2021-08-27 11:31:20 us=836653 comp.alg = 2 2021-08-27 11:31:20 us=836666 comp.flags = 3 2021-08-27 11:31:20 us=836680 route_script = '[UNDEF]' 2021-08-27 11:31:20 us=836692 route_default_gateway = '[UNDEF]' 2021-08-27 11:31:20 us=836705 route_default_metric = 0 2021-08-27 11:31:20 us=836718 route_noexec = DISABLED 2021-08-27 11:31:20 us=836730 route_delay = 0 2021-08-27 11:31:20 us=836743 route_delay_window = 30 2021-08-27 11:31:20 us=836756 route_delay_defined = DISABLED 2021-08-27 11:31:20 us=836769 route_nopull = DISABLED 2021-08-27 11:31:20 us=836782 route_gateway_via_dhcp = DISABLED 2021-08-27 11:31:20 us=836795 allow_pull_fqdn = DISABLED 2021-08-27 11:31:20 us=836809 route 192.168.254.0/255.255.255.0/default (not set)/default (not set) 2021-08-27 11:31:20 us=836823 route 192.168.4.0/255.255.255.0/default (not set)/default (not set) 2021-08-27 11:31:20 us=836836 route 192.168.2.0/255.255.255.0/default (not set)/default (not set) 2021-08-27 11:31:20 us=836849 management_addr = '[UNDEF]' 2021-08-27 11:31:20 us=836862 management_port = '[UNDEF]' 2021-08-27 11:31:20 us=836874 management_user_pass = '[UNDEF]' 2021-08-27 11:31:20 us=836887 management_log_history_cache = 250 2021-08-27 11:31:20 us=836900 management_echo_buffer_size = 100 2021-08-27 11:31:20 us=836913 management_write_peer_info_file = '[UNDEF]' 2021-08-27 11:31:20 us=836926 management_client_user = '[UNDEF]' 2021-08-27 11:31:20 us=836939 management_client_group = '[UNDEF]' 2021-08-27 11:31:20 us=836951 management_flags = 0 2021-08-27 11:31:20 us=836964 shared_secret_file = '[UNDEF]' 2021-08-27 11:31:20 us=836977 key_direction = not set 2021-08-27 11:31:20 us=836990 ciphername = 'BF-CBC' 2021-08-27 11:31:20 us=837003 ncp_enabled = ENABLED 2021-08-27 11:31:20 us=837016 ncp_ciphers = 'AES-256-GCM:AES-128-GCM' 2021-08-27 11:31:20 us=837028 authname = 'SHA1' 2021-08-27 11:31:20 us=837041 prng_hash = 'SHA1' 2021-08-27 11:31:20 us=837055 prng_nonce_secret_len = 16 2021-08-27 11:31:20 us=837068 keysize = 0 2021-08-27 11:31:20 us=837082 engine = DISABLED 2021-08-27 11:31:20 us=837096 replay = ENABLED 2021-08-27 11:31:20 us=837110 mute_replay_warnings = DISABLED 2021-08-27 11:31:20 us=837131 replay_window = 64 2021-08-27 11:31:20 us=837144 replay_time = 15 2021-08-27 11:31:20 us=837157 packet_id_file = '[UNDEF]' 2021-08-27 11:31:20 us=837171 test_crypto = DISABLED 2021-08-27 11:31:20 us=837184 tls_server = ENABLED 2021-08-27 11:31:20 us=837197 tls_client = DISABLED 2021-08-27 11:31:20 us=837211 ca_file = '/etc/openvpn/openvpn_certs/carey-ca.pem' 2021-08-27 11:31:20 us=837224 ca_path = '[UNDEF]' 2021-08-27 11:31:20 us=837237 dh_file = '/etc/openvpn/openvpn_certs/dh1024.pem' 2021-08-27 11:31:20 us=837250 cert_file = '/etc/openvpn/openvpn_certs/carey-cert.pem' 2021-08-27 11:31:20 us=837265 extra_certs_file = '[UNDEF]' 2021-08-27 11:31:20 us=837278 priv_key_file = '/etc/openvpn/openvpn_certs/carey-key.pem' 2021-08-27 11:31:20 us=837292 pkcs12_file = '[UNDEF]' 2021-08-27 11:31:20 us=837306 cipher_list = '[UNDEF]' 2021-08-27 11:31:20 us=837319 cipher_list_tls13 = '[UNDEF]' 2021-08-27 11:31:20 us=837333 tls_cert_profile = '[UNDEF]' 2021-08-27 11:31:20 us=837345 tls_verify = '[UNDEF]' 2021-08-27 11:31:20 us=837358 tls_export_cert = '[UNDEF]' 2021-08-27 11:31:20 us=837371 verify_x509_type = 0 2021-08-27 11:31:20 us=837384 verify_x509_name = '[UNDEF]' 2021-08-27 11:31:20 us=837397 crl_file = '[UNDEF]' 2021-08-27 11:31:20 us=837410 ns_cert_type = 0 2021-08-27 11:31:20 us=837423 remote_cert_ku[i] = 0 2021-08-27 11:31:20 us=837436 remote_cert_ku[i] = 0 2021-08-27 11:31:20 us=837448 remote_cert_ku[i] = 0 2021-08-27 11:31:20 us=837461 remote_cert_ku[i] = 0 2021-08-27 11:31:20 us=837474 remote_cert_ku[i] = 0 2021-08-27 11:31:20 us=837487 remote_cert_ku[i] = 0 2021-08-27 11:31:20 us=837499 remote_cert_ku[i] = 0 2021-08-27 11:31:20 us=837512 remote_cert_ku[i] = 0 2021-08-27 11:31:20 us=837525 remote_cert_ku[i] = 0 2021-08-27 11:31:20 us=837537 remote_cert_ku[i] = 0 2021-08-27 11:31:20 us=837550 remote_cert_ku[i] = 0 2021-08-27 11:31:20 us=837563 remote_cert_ku[i] = 0 2021-08-27 11:31:20 us=837575 remote_cert_ku[i] = 0 2021-08-27 11:31:20 us=837588 remote_cert_ku[i] = 0 2021-08-27 11:31:20 us=837601 remote_cert_ku[i] = 0 2021-08-27 11:31:20 us=837614 remote_cert_ku[i] = 0 2021-08-27 11:31:20 us=837627 remote_cert_eku = '[UNDEF]' 2021-08-27 11:31:20 us=837642 ssl_flags = 0 2021-08-27 11:31:20 us=837655 tls_timeout = 2 2021-08-27 11:31:20 us=837669 renegotiate_bytes = -1 2021-08-27 11:31:20 us=837683 renegotiate_packets = 0 2021-08-27 11:31:20 us=837696 renegotiate_seconds = 3600 2021-08-27 11:31:20 us=837709 handshake_window = 60 2021-08-27 11:31:20 us=837723 transition_window = 3600 2021-08-27 11:31:20 us=837737 single_session = DISABLED 2021-08-27 11:31:20 us=837751 push_peer_info = DISABLED 2021-08-27 11:31:20 us=837764 tls_exit = DISABLED 2021-08-27 11:31:20 us=837779 tls_crypt_v2_metadata = '[UNDEF]' 2021-08-27 11:31:20 us=837796 server_network = 192.168.254.0 2021-08-27 11:31:20 us=837812 server_netmask = 255.255.255.0 2021-08-27 11:31:20 us=837830 server_network_ipv6 = :: 2021-08-27 11:31:20 us=837845 server_netbits_ipv6 = 0 2021-08-27 11:31:20 us=837860 server_bridge_ip = 0.0.0.0 2021-08-27 11:31:20 us=837875 server_bridge_netmask = 0.0.0.0 2021-08-27 11:31:20 us=837890 server_bridge_pool_start = 0.0.0.0 2021-08-27 11:31:20 us=837905 server_bridge_pool_end = 0.0.0.0 2021-08-27 11:31:20 us=837918 push_entry = 'route 192.168.1.0 255.255.255.0' 2021-08-27 11:31:20 us=837931 push_entry = 'route 192.168.2.0 255.255.255.0' 2021-08-27 11:31:20 us=837945 push_entry = 'route 192.168.3.0 255.255.255.0' 2021-08-27 11:31:20 us=837958 push_entry = 'route 192.168.254.0 255.255.255.0' 2021-08-27 11:31:20 us=837971 push_entry = 'topology net30' 2021-08-27 11:31:20 us=837983 push_entry = 'ping 10' 2021-08-27 11:31:20 us=837996 push_entry = 'ping-restart 120' 2021-08-27 11:31:20 us=838009 ifconfig_pool_defined = ENABLED 2021-08-27 11:31:20 us=838023 ifconfig_pool_start = 192.168.254.4 2021-08-27 11:31:20 us=838037 ifconfig_pool_end = 192.168.254.251 2021-08-27 11:31:20 us=838061 ifconfig_pool_netmask = 0.0.0.0 2021-08-27 11:31:20 us=838077 ifconfig_pool_persist_filename = 'ipp.txt' 2021-08-27 11:31:20 us=838092 ifconfig_pool_persist_refresh_freq = 600 2021-08-27 11:31:20 us=838106 ifconfig_ipv6_pool_defined = DISABLED 2021-08-27 11:31:20 us=838125 ifconfig_ipv6_pool_base = :: 2021-08-27 11:31:20 us=838139 ifconfig_ipv6_pool_netbits = 0 2021-08-27 11:31:20 us=838154 n_bcast_buf = 256 2021-08-27 11:31:20 us=838168 tcp_queue_limit = 64 2021-08-27 11:31:20 us=838181 real_hash_size = 256 2021-08-27 11:31:20 us=838195 virtual_hash_size = 256 2021-08-27 11:31:20 us=838209 client_connect_script = '[UNDEF]' 2021-08-27 11:31:20 us=838223 learn_address_script = '[UNDEF]' 2021-08-27 11:31:20 us=838237 client_disconnect_script = '[UNDEF]' 2021-08-27 11:31:20 us=838251 client_config_dir = '/etc/openvpn/ccd' 2021-08-27 11:31:20 us=838265 ccd_exclusive = DISABLED 2021-08-27 11:31:20 us=838278 tmp_dir = '/tmp' 2021-08-27 11:31:20 us=838292 push_ifconfig_defined = DISABLED 2021-08-27 11:31:20 us=838308 push_ifconfig_local = 0.0.0.0 2021-08-27 11:31:20 us=838325 push_ifconfig_remote_netmask = 0.0.0.0 2021-08-27 11:31:20 us=838339 push_ifconfig_ipv6_defined = DISABLED 2021-08-27 11:31:20 us=838356 push_ifconfig_ipv6_local = ::/0 2021-08-27 11:31:20 us=838374 push_ifconfig_ipv6_remote = :: 2021-08-27 11:31:20 us=838388 enable_c2c = ENABLED 2021-08-27 11:31:20 us=838402 duplicate_cn = DISABLED 2021-08-27 11:31:20 us=838416 cf_max = 0 2021-08-27 11:31:20 us=838430 cf_per = 0 2021-08-27 11:31:20 us=838444 max_clients = 1024 2021-08-27 11:31:20 us=838458 max_routes_per_client = 256 2021-08-27 11:31:20 us=838472 auth_user_pass_verify_script = '[UNDEF]' 2021-08-27 11:31:20 us=838486 auth_user_pass_verify_script_via_file = DISABLED 2021-08-27 11:31:20 us=838500 auth_token_generate = DISABLED 2021-08-27 11:31:20 us=838515 auth_token_lifetime = 0 2021-08-27 11:31:20 us=838529 auth_token_secret_file = '[UNDEF]' 2021-08-27 11:31:20 us=838543 port_share_host = '[UNDEF]' 2021-08-27 11:31:20 us=838557 port_share_port = '[UNDEF]' 2021-08-27 11:31:20 us=838571 vlan_tagging = DISABLED 2021-08-27 11:31:20 us=838584 vlan_accept = all 2021-08-27 11:31:20 us=838599 vlan_pvid = 1 2021-08-27 11:31:20 us=838612 client = DISABLED 2021-08-27 11:31:20 us=838626 pull = DISABLED 2021-08-27 11:31:20 us=838640 auth_user_pass_file = '[UNDEF]' 2021-08-27 11:31:20 us=838656 OpenVPN 2.5.3 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Jun 19 2021 2021-08-27 11:31:20 us=838712 library versions: OpenSSL 1.1.1k 25 Mar 2021, LZO 2.10 2021-08-27 11:31:20 us=843350 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet. 2021-08-27 11:31:20 us=844486 Diffie-Hellman initialized with 1024 bit key 2021-08-27 11:31:20 us=845341 TLS-Auth MTU parms [ L:1622 D:1212 EF:38 EB:0 ET:0 EL:3 ] 2021-08-27 11:31:20 us=845546 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=eth0 HWADDR=a2:12:3f:31:34:04 2021-08-27 11:31:20 us=846034 TUN/TAP device tun0 opened 2021-08-27 11:31:20 us=846062 do_ifconfig, ipv4=1, ipv6=0 2021-08-27 11:31:20 us=846087 /sbin/ip link set dev tun0 up mtu 1500 2021-08-27 11:31:20 us=848161 /sbin/ip link set dev tun0 up 2021-08-27 11:31:20 us=856820 /sbin/ip addr add dev tun0 local 192.168.254.1 peer 192.168.254.2 2021-08-27 11:31:20 us=857869 /sbin/ip route add 192.168.2.0/24 via 192.168.254.2 2021-08-27 11:31:20 us=861247 /sbin/ip route add 192.168.4.0/24 via 192.168.254.2 2021-08-27 11:31:20 us=862036 /sbin/ip route add 192.168.254.0/24 via 192.168.254.2 2021-08-27 11:31:20 us=862774 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ] 2021-08-27 11:31:20 us=862861 Could not determine IPv4/IPv6 protocol. Using AF_INET 2021-08-27 11:31:20 us=862892 Socket Buffers: R=[212992->212992] S=[212992->212992] 2021-08-27 11:31:20 us=862938 UDPv4 link local (bound): [AF_INET][undef]:1194 2021-08-27 11:31:20 us=862958 UDPv4 link remote: [AF_UNSPEC] 2021-08-27 11:31:20 us=862979 GID set to nobody 2021-08-27 11:31:20 us=863020 UID set to nobody 2021-08-27 11:31:20 us=863039 MULTI: multi_init called, r=256 v=256 2021-08-27 11:31:20 us=863087 IFCONFIG POOL IPv4: base=192.168.254.4 size=62 2021-08-27 11:31:20 us=863128 ifconfig_pool_read(), in='vpn-bucharest,192.168.254.4,' 2021-08-27 11:31:20 us=863152 succeeded -> ifconfig_pool_set(hand=0) 2021-08-27 11:31:20 us=863168 IFCONFIG POOL LIST 2021-08-27 11:31:20 us=863184 vpn-bucharest,192.168.254.4, 2021-08-27 11:31:20 us=863238 Initialization Sequence Completed 2021-08-27 11:31:29 us=854612 MULTI: multi_create_instance called 2021-08-27 11:31:29 us=854717 85.186.3.146:58480 Re-using SSL/TLS context 2021-08-27 11:31:29 us=854752 85.186.3.146:58480 LZO compression initializing 2021-08-27 11:31:29 us=854912 85.186.3.146:58480 Control Channel MTU parms [ L:1622 D:1212 EF:38 EB:0 ET:0 EL:3 ] 2021-08-27 11:31:29 us=854928 85.186.3.146:58480 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ] 2021-08-27 11:31:29 us=854982 85.186.3.146:58480 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,auth SHA1,keysize 128,key-method 2,tls-server' 2021-08-27 11:31:29 us=854994 85.186.3.146:58480 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,auth SHA1,keysize 128,key-method 2,tls-client' 2021-08-27 11:31:29 us=855032 85.186.3.146:58480 TLS: Initial packet from [AF_INET]85.186.3.146:58480, sid=d2c16315 094e9db4 2021-08-27 11:31:30 us=78466 85.186.3.146:58480 VERIFY OK: depth=1, CN=ca.simon.local, L=Dachau, O=MPM-Networks, C=DE, emailAddress=m.simon@mpm-networks.net 2021-08-27 11:31:30 us=78736 85.186.3.146:58480 VERIFY OK: depth=0, O=MPM-Networks, C=RO, CN=vpn-bucharest, emailAddress=m.simon@mpm-networks.net, L=Bucharfest 2021-08-27 11:31:30 us=79114 85.186.3.146:58480 peer info: IV_VER=2.4.7 2021-08-27 11:31:30 us=79131 85.186.3.146:58480 peer info: IV_PLAT=linux 2021-08-27 11:31:30 us=79141 85.186.3.146:58480 peer info: IV_PROTO=2 2021-08-27 11:31:30 us=79148 85.186.3.146:58480 peer info: IV_NCP=2 2021-08-27 11:31:30 us=79156 85.186.3.146:58480 peer info: IV_LZ4=1 2021-08-27 11:31:30 us=79165 85.186.3.146:58480 peer info: IV_LZ4v2=1 2021-08-27 11:31:30 us=79174 85.186.3.146:58480 peer info: IV_LZO=1 2021-08-27 11:31:30 us=79183 85.186.3.146:58480 peer info: IV_COMP_STUB=1 2021-08-27 11:31:30 us=79192 85.186.3.146:58480 peer info: IV_COMP_STUBv2=1 2021-08-27 11:31:30 us=79200 85.186.3.146:58480 peer info: IV_TCPNL=1 2021-08-27 11:31:30 us=136640 85.186.3.146:58480 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA1 2021-08-27 11:31:30 us=136719 85.186.3.146:58480 [vpn-bucharest] Peer Connection Initiated with [AF_INET]85.186.3.146:58480 2021-08-27 11:31:30 us=136768 vpn-bucharest/85.186.3.146:58480 MULTI_sva: pool returned IPv4=192.168.254.6, IPv6=(Not enabled) 2021-08-27 11:31:30 us=136835 vpn-bucharest/85.186.3.146:58480 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/vpn-bucharest 2021-08-27 11:31:30 us=136924 vpn-bucharest/85.186.3.146:58480 MULTI: Learn: 192.168.254.6 -> vpn-bucharest/85.186.3.146:58480 2021-08-27 11:31:30 us=136937 vpn-bucharest/85.186.3.146:58480 MULTI: primary virtual IP for vpn-bucharest/85.186.3.146:58480: 192.168.254.6 2021-08-27 11:31:30 us=136948 vpn-bucharest/85.186.3.146:58480 MULTI: internal route 192.168.3.0/24 -> vpn-bucharest/85.186.3.146:58480 2021-08-27 11:31:30 us=136969 vpn-bucharest/85.186.3.146:58480 MULTI: Learn: 192.168.3.0/24 -> vpn-bucharest/85.186.3.146:58480 2021-08-27 11:31:30 us=136991 vpn-bucharest/85.186.3.146:58480 MULTI: internal route 192.168.2.0/24 -> vpn-bucharest/85.186.3.146:58480 2021-08-27 11:31:30 us=137005 vpn-bucharest/85.186.3.146:58480 MULTI: Learn: 192.168.2.0/24 -> vpn-bucharest/85.186.3.146:58480 2021-08-27 11:31:30 us=137014 vpn-bucharest/85.186.3.146:58480 MULTI: internal route 192.168.1.0/24 -> vpn-bucharest/85.186.3.146:58480 2021-08-27 11:31:30 us=137035 vpn-bucharest/85.186.3.146:58480 MULTI: Learn: 192.168.1.0/24 -> vpn-bucharest/85.186.3.146:58480 2021-08-27 11:31:30 us=137046 vpn-bucharest/85.186.3.146:58480 MULTI: internal route 192.168.4.0/24 -> vpn-bucharest/85.186.3.146:58480 2021-08-27 11:31:30 us=137057 vpn-bucharest/85.186.3.146:58480 MULTI: Learn: 192.168.4.0/24 -> vpn-bucharest/85.186.3.146:58480 2021-08-27 11:31:30 us=137073 vpn-bucharest/85.186.3.146:58480 REMOVE PUSH ROUTE: 'route 192.168.1.0 255.255.255.0' 2021-08-27 11:31:30 us=137082 vpn-bucharest/85.186.3.146:58480 REMOVE PUSH ROUTE: 'route 192.168.2.0 255.255.255.0' 2021-08-27 11:31:30 us=137091 vpn-bucharest/85.186.3.146:58480 REMOVE PUSH ROUTE: 'route 192.168.3.0 255.255.255.0' 2021-08-27 11:31:30 us=137108 vpn-bucharest/85.186.3.146:58480 Data Channel: using negotiated cipher 'AES-256-GCM' 2021-08-27 11:31:30 us=137129 vpn-bucharest/85.186.3.146:58480 Data Channel MTU parms [ L:1550 D:1450 EF:50 EB:406 ET:0 EL:3 ] 2021-08-27 11:31:30 us=137287 vpn-bucharest/85.186.3.146:58480 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 2021-08-27 11:31:30 us=137301 vpn-bucharest/85.186.3.146:58480 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 2021-08-27 11:31:31 us=240603 vpn-bucharest/85.186.3.146:58480 PUSH: Received control message: 'PUSH_REQUEST' 2021-08-27 11:31:31 us=240724 vpn-bucharest/85.186.3.146:58480 SENT CONTROL [vpn-bucharest]: 'PUSH_REPLY,route 192.168.254.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.254.6 192.168.254.5,peer-id 0,cipher AES-256-GCM' (status=1) [/code] and here is the client log [code] WARNING: file '/etc/openvpn/secrets.conf' is group or others accessible Current Parameter Settings: config = 'vpn.conf' mode = 0 persist_config = DISABLED persist_mode = 1 show_ciphers = DISABLED show_digests = DISABLED show_engines = DISABLED genkey = DISABLED key_pass_file = '[UNDEF]' show_tls_ciphers = DISABLED connect_retry_max = 0 Connection profiles [0]: proto = udp local = '[UNDEF]' local_port = '[UNDEF]' remote = 'dl9vsmyxdc6hdwnu.myfritz.net' remote_port = '1194' remote_float = DISABLED bind_defined = DISABLED bind_local = DISABLED bind_ipv6_only = DISABLED connect_retry_seconds = 5 connect_timeout = 120 socks_proxy_server = '[UNDEF]' socks_proxy_port = '[UNDEF]' tun_mtu = 1500 tun_mtu_defined = ENABLED link_mtu = 1500 link_mtu_defined = DISABLED tun_mtu_extra = 0 tun_mtu_extra_defined = DISABLED mtu_discover_type = -1 fragment = 0 mssfix = 1450 explicit_exit_notification = 0 Connection profiles END remote_random = DISABLED ipchange = '[UNDEF]' dev = 'tun' dev_type = '[UNDEF]' dev_node = '[UNDEF]' lladdr = '[UNDEF]' topology = 1 ifconfig_local = '[UNDEF]' ifconfig_remote_netmask = '[UNDEF]' ifconfig_noexec = DISABLED ifconfig_nowarn = DISABLED ifconfig_ipv6_local = '[UNDEF]' ifconfig_ipv6_netbits = 0 ifconfig_ipv6_remote = '[UNDEF]' shaper = 0 mtu_test = 0 mlock = DISABLED keepalive_ping = 0 keepalive_timeout = 0 inactivity_timeout = 0 ping_send_timeout = 0 ping_rec_timeout = 0 ping_rec_timeout_action = 0 ping_timer_remote = DISABLED remap_sigusr1 = 0 persist_tun = ENABLED persist_local_ip = DISABLED persist_remote_ip = DISABLED persist_key = ENABLED passtos = DISABLED resolve_retry_seconds = 1000000000 resolve_in_advance = DISABLED username = '[UNDEF]' groupname = '[UNDEF]' chroot_dir = '[UNDEF]' cd_dir = '[UNDEF]' writepid = '[UNDEF]' up_script = '[UNDEF]' down_script = '[UNDEF]' down_pre = DISABLED up_restart = DISABLED up_delay = DISABLED daemon = DISABLED inetd = 0 log = ENABLED suppress_timestamps = ENABLED machine_readable_output = DISABLED nice = 0 verbosity = 4 mute = 0 gremlin = 0 status_file = '[UNDEF]' status_file_version = 1 status_file_update_freq = 60 occ = ENABLED rcvbuf = 0 sndbuf = 0 mark = 0 sockflags = 0 fast_io = DISABLED comp.alg = 2 comp.flags = 1 route_script = '[UNDEF]' route_default_gateway = '[UNDEF]' route_default_metric = 0 route_noexec = DISABLED route_delay = 0 route_delay_window = 30 route_delay_defined = DISABLED route_nopull = DISABLED route_gateway_via_dhcp = DISABLED allow_pull_fqdn = DISABLED management_addr = '[UNDEF]' management_port = '[UNDEF]' management_user_pass = '[UNDEF]' management_log_history_cache = 250 management_echo_buffer_size = 100 management_write_peer_info_file = '[UNDEF]' management_client_user = '[UNDEF]' management_client_group = '[UNDEF]' management_flags = 0 shared_secret_file = '[UNDEF]' key_direction = not set ciphername = 'BF-CBC' ncp_enabled = ENABLED ncp_ciphers = 'AES-256-GCM:AES-128-GCM' authname = 'SHA1' prng_hash = 'SHA1' prng_nonce_secret_len = 16 keysize = 0 engine = DISABLED replay = ENABLED mute_replay_warnings = DISABLED replay_window = 64 replay_time = 15 packet_id_file = '[UNDEF]' use_iv = ENABLED test_crypto = DISABLED tls_server = DISABLED tls_client = ENABLED key_method = 2 ca_file = '/etc/openvpn/certs/ca.crt' ca_path = '[UNDEF]' dh_file = '[UNDEF]' cert_file = '/etc/openvpn/certs/cert.pem' extra_certs_file = '[UNDEF]' priv_key_file = '/etc/openvpn/certs/key.pem' pkcs12_file = '[UNDEF]' cipher_list = '[UNDEF]' cipher_list_tls13 = '[UNDEF]' tls_cert_profile = '[UNDEF]' tls_verify = '[UNDEF]' tls_export_cert = '[UNDEF]' verify_x509_type = 0 verify_x509_name = '[UNDEF]' crl_file = '[UNDEF]' ns_cert_type = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_eku = '[UNDEF]' ssl_flags = 0 tls_timeout = 2 renegotiate_bytes = -1 renegotiate_packets = 0 renegotiate_seconds = 3600 handshake_window = 60 transition_window = 3600 single_session = DISABLED push_peer_info = DISABLED tls_exit = DISABLED tls_auth_file = '[UNDEF]' tls_crypt_file = '[UNDEF]' pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_pin_cache_period = -1 pkcs11_id = '[UNDEF]' pkcs11_id_management = DISABLED server_network = 0.0.0.0 server_netmask = 0.0.0.0 server_network_ipv6 = :: server_netbits_ipv6 = 0 server_bridge_ip = 0.0.0.0 server_bridge_netmask = 0.0.0.0 server_bridge_pool_start = 0.0.0.0 server_bridge_pool_end = 0.0.0.0 ifconfig_pool_defined = DISABLED ifconfig_pool_start = 0.0.0.0 ifconfig_pool_end = 0.0.0.0 ifconfig_pool_netmask = 0.0.0.0 ifconfig_pool_persist_filename = '[UNDEF]' ifconfig_pool_persist_refresh_freq = 600 ifconfig_ipv6_pool_defined = DISABLED ifconfig_ipv6_pool_base = :: ifconfig_ipv6_pool_netbits = 0 n_bcast_buf = 256 tcp_queue_limit = 64 real_hash_size = 256 virtual_hash_size = 256 client_connect_script = '[UNDEF]' learn_address_script = '[UNDEF]' client_disconnect_script = '[UNDEF]' client_config_dir = '[UNDEF]' ccd_exclusive = DISABLED tmp_dir = '/tmp' push_ifconfig_defined = DISABLED push_ifconfig_local = 0.0.0.0 push_ifconfig_remote_netmask = 0.0.0.0 push_ifconfig_ipv6_defined = DISABLED push_ifconfig_ipv6_local = ::/0 push_ifconfig_ipv6_remote = :: enable_c2c = DISABLED duplicate_cn = DISABLED cf_max = 0 cf_per = 0 max_clients = 1024 max_routes_per_client = 256 auth_user_pass_verify_script = '[UNDEF]' auth_user_pass_verify_script_via_file = DISABLED auth_token_generate = DISABLED auth_token_lifetime = 0 port_share_host = '[UNDEF]' port_share_port = '[UNDEF]' client = ENABLED pull = ENABLED auth_user_pass_file = '/etc/openvpn/secrets.conf' OpenVPN 2.4.7 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 28 2021 library versions: OpenSSL 1.1.1d 10 Sep 2019, LZO 2.10 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info. LZO compression initializing Control Channel MTU parms [ L:1622 D:1212 EF:38 EB:0 ET:0 EL:3 ] Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ] Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client' Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server' TCP/UDP: Preserving recently used remote address: [AF_INET]79.250.241.7:1194 Socket Buffers: R=[180224->180224] S=[180224->180224] UDP link local: (not bound) UDP link remote: [AF_INET]79.250.241.7:1194 TLS: Initial packet from [AF_INET]79.250.241.7:1194, sid=6864b616 19d4339f WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this VERIFY OK: depth=1, CN=ca.simon.local, L=Dachau, O=MPM-Networks, C=DE, emailAddress=m.simon@mpm-networks.net VERIFY OK: depth=0, O=MPM-Networks, C=DE, CN=carey.simon.local, emailAddress=m.simon@mpm-networks.net, L=Dachau WARNING: 'cipher' is present in local config but missing in remote config, local='cipher BF-CBC' Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA [carey.simon.local] Peer Connection Initiated with [AF_INET]79.250.241.7:1194 SENT CONTROL [carey.simon.local]: 'PUSH_REQUEST' (status=1) PUSH: Received control message: 'PUSH_REPLY,route 192.168.254.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.254.6 192.168.254.5,peer-id 0,cipher AES-256-GCM' OPTIONS IMPORT: timers and/or timeouts modified OPTIONS IMPORT: --ifconfig/up options modified OPTIONS IMPORT: route options modified OPTIONS IMPORT: peer-id set OPTIONS IMPORT: adjusting link_mtu to 1625 OPTIONS IMPORT: data channel crypto options modified Data Channel: using negotiated cipher 'AES-256-GCM' Data Channel MTU parms [ L:1553 D:1450 EF:53 EB:406 ET:0 EL:3 ] Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key ROUTE_GATEWAY 192.168.4.1/255.255.255.0 IFACE=wlan0 HWADDR=b8:27:eb:ae:6e:1d TUN/TAP device tun0 opened TUN/TAP TX queue length set to 100 do_ifconfig, tt->did_ifconfig_ipv6_setup=0 /sbin/ip link set dev tun0 up mtu 1500 /sbin/ip addr add dev tun0 local 192.168.254.6 peer 192.168.254.5 /sbin/ip route add 192.168.254.0/24 via 192.168.254.5 Initialization Sequence Completed [/code]

/sbin/ip addr add dev tun0 local 192.168.254.6 peer 192.168.254.5 /sbin/ip route add 192.168.254.0/24 via 192.168.254.5 2021-08-27 11:31:31 us=240724 vpn-bucharest/85.186.3.146:58480 SENT CONTROL [vpn-bucharest]: 'PUSH_REPLY,route 192.168.254.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.254.6 192.168.254.5,peer-id 0,cipher AES-256-GCM' (status=1) there is no push subnet from server to client so nothing remove all this iroute 192.168.1.0 255.255.255.0 iroute 192.168.2.0 255.255.255.0 iroute 192.168.3.0 255.255.255.0 only leave iroute 192.168.4.0 255.255.255.0 that is subnet of client, server only push 192.168.254.0 virtual ip of openvpn , so you cant ping anything. check push route to see it is correct.

sorry for the delay. I've changed my config now to this: server: [code] local 192.168.1.4 port 1194 proto udp dev tun ca /etc/openvpn/openvpn_certs/carey-ca.pem cert /etc/openvpn/openvpn_certs/carey-cert.pem key /etc/openvpn/openvpn_certs/carey-key.pem dh /etc/openvpn/openvpn_certs/dh1024.pem server 192.168.254.0 255.255.255.0 route 192.168.2.0 255.255.255.0 route 192.168.4.0 255.255.255.0 push "route 192.168.1.0 255.255.255.0" push "route 192.168.2.0 255.255.255.0" push "route 192.168.3.0 255.255.255.0" ifconfig-pool-persist ipp.txt client-to-client keepalive 10 120 comp-lzo allow-compression yes user nobody group nobody persist-key persist-tun status /var/log/openvpn-status.log log-append /var/log/openvpn.log verb 4 explicit-exit-notify 1 client-config-dir /etc/openvpn/ccd [/code] client config file for bucharest: [code] iroute 192.168.4.0 255.255.255.0 [/code] what results on the server: ifconfig of tun0: [code] tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:192.168.254.1 P-t-P:192.168.254.2 Mask:255.255.255.255 inet6 addr: fe80::ee:d1c3:91c6:3c22/64 Scope:Link UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:6 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:500 RX bytes:0 (0.0 B) TX bytes:288 (288.0 B) [/code] and a routing table: [code] Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.1.1 0.0.0.0 UG 1 0 0 eth0 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 192.168.2.0 192.168.254.2 255.255.255.0 UG 0 0 0 tun0 192.168.3.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 192.168.4.0 192.168.254.2 255.255.255.0 UG 0 0 0 tun0 192.168.254.0 192.168.254.2 255.255.255.0 UG 0 0 0 tun0 192.168.254.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 [/code] iptables -S shows: [code] -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -A INPUT -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 10050 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 10051 -j ACCEPT -A INPUT -i eth1 -p tcp -m tcp --dport 10050 -j ACCEPT -A INPUT -i eth1 -p tcp -m tcp --dport 10051 -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -j ACCEPT -A OUTPUT -j ACCEPT [/code] and the log says: [code] 2021-09-01 10:53:31 us=109928 WARNING: --topology net30 support for server configs with IPv4 pools will be removed in a future release. Please migrate to --topology subnet as soon as possible. 2021-09-01 10:53:31 us=109972 --cipher is not set. Previous OpenVPN version defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers. 2021-09-01 10:53:31 us=110215 Current Parameter Settings: 2021-09-01 10:53:31 us=110241 config = '/etc/openvpn/openvpn.conf' 2021-09-01 10:53:31 us=110257 mode = 1 2021-09-01 10:53:31 us=110273 persist_config = DISABLED 2021-09-01 10:53:31 us=110290 persist_mode = 1 2021-09-01 10:53:31 us=110307 show_ciphers = DISABLED 2021-09-01 10:53:31 us=110323 show_digests = DISABLED 2021-09-01 10:53:31 us=110338 show_engines = DISABLED 2021-09-01 10:53:31 us=110353 genkey = DISABLED 2021-09-01 10:53:31 us=110369 genkey_filename = '[UNDEF]' 2021-09-01 10:53:31 us=110385 key_pass_file = '[UNDEF]' 2021-09-01 10:53:31 us=110401 show_tls_ciphers = DISABLED 2021-09-01 10:53:31 us=110416 connect_retry_max = 0 2021-09-01 10:53:31 us=110433 Connection profiles [0]: 2021-09-01 10:53:31 us=110448 proto = udp 2021-09-01 10:53:31 us=110464 local = '192.168.1.4' 2021-09-01 10:53:31 us=110479 local_port = '1194' 2021-09-01 10:53:31 us=110495 remote = '[UNDEF]' 2021-09-01 10:53:31 us=110510 remote_port = '1194' 2021-09-01 10:53:31 us=110526 remote_float = DISABLED 2021-09-01 10:53:31 us=110541 bind_defined = DISABLED 2021-09-01 10:53:31 us=110557 bind_local = ENABLED 2021-09-01 10:53:31 us=110571 bind_ipv6_only = DISABLED 2021-09-01 10:53:31 us=110587 connect_retry_seconds = 5 2021-09-01 10:53:31 us=110603 connect_timeout = 120 2021-09-01 10:53:31 us=110618 socks_proxy_server = '[UNDEF]' 2021-09-01 10:53:31 us=110634 socks_proxy_port = '[UNDEF]' 2021-09-01 10:53:31 us=110649 tun_mtu = 1500 2021-09-01 10:53:31 us=110666 tun_mtu_defined = ENABLED 2021-09-01 10:53:31 us=110682 link_mtu = 1500 2021-09-01 10:53:31 us=110697 link_mtu_defined = DISABLED 2021-09-01 10:53:31 us=110712 tun_mtu_extra = 0 2021-09-01 10:53:31 us=110727 tun_mtu_extra_defined = DISABLED 2021-09-01 10:53:31 us=110743 mtu_discover_type = -1 2021-09-01 10:53:31 us=110758 fragment = 0 2021-09-01 10:53:31 us=110773 mssfix = 1450 2021-09-01 10:53:31 us=110789 explicit_exit_notification = 1 2021-09-01 10:53:31 us=110803 tls_auth_file = '[UNDEF]' 2021-09-01 10:53:31 us=110819 key_direction = not set 2021-09-01 10:53:31 us=110835 tls_crypt_file = '[UNDEF]' 2021-09-01 10:53:31 us=110851 tls_crypt_v2_file = '[UNDEF]' 2021-09-01 10:53:31 us=110865 Connection profiles END 2021-09-01 10:53:31 us=110881 remote_random = DISABLED 2021-09-01 10:53:31 us=110895 ipchange = '[UNDEF]' 2021-09-01 10:53:31 us=110911 dev = 'tun' 2021-09-01 10:53:31 us=110926 dev_type = '[UNDEF]' 2021-09-01 10:53:31 us=110941 dev_node = '[UNDEF]' 2021-09-01 10:53:31 us=110956 lladdr = '[UNDEF]' 2021-09-01 10:53:31 us=110970 topology = 1 2021-09-01 10:53:31 us=110985 ifconfig_local = '192.168.254.1' 2021-09-01 10:53:31 us=111000 ifconfig_remote_netmask = '192.168.254.2' 2021-09-01 10:53:31 us=111015 ifconfig_noexec = DISABLED 2021-09-01 10:53:31 us=111031 ifconfig_nowarn = DISABLED 2021-09-01 10:53:31 us=111045 ifconfig_ipv6_local = '[UNDEF]' 2021-09-01 10:53:31 us=111060 ifconfig_ipv6_netbits = 0 2021-09-01 10:53:31 us=111074 ifconfig_ipv6_remote = '[UNDEF]' 2021-09-01 10:53:31 us=111089 shaper = 0 2021-09-01 10:53:31 us=111104 mtu_test = 0 2021-09-01 10:53:31 us=111117 mlock = DISABLED 2021-09-01 10:53:31 us=111133 keepalive_ping = 10 2021-09-01 10:53:31 us=111148 keepalive_timeout = 120 2021-09-01 10:53:31 us=111164 inactivity_timeout = 0 2021-09-01 10:53:31 us=111180 ping_send_timeout = 10 2021-09-01 10:53:31 us=111196 ping_rec_timeout = 240 2021-09-01 10:53:31 us=111211 ping_rec_timeout_action = 2 2021-09-01 10:53:31 us=111226 ping_timer_remote = DISABLED 2021-09-01 10:53:31 us=111256 remap_sigusr1 = 0 2021-09-01 10:53:31 us=111270 persist_tun = ENABLED 2021-09-01 10:53:31 us=111283 persist_local_ip = DISABLED 2021-09-01 10:53:31 us=111298 persist_remote_ip = DISABLED 2021-09-01 10:53:31 us=111313 persist_key = ENABLED 2021-09-01 10:53:31 us=111327 passtos = DISABLED 2021-09-01 10:53:31 us=111341 resolve_retry_seconds = 1000000000 2021-09-01 10:53:31 us=111356 resolve_in_advance = DISABLED 2021-09-01 10:53:31 us=111369 username = 'nobody' 2021-09-01 10:53:31 us=111384 groupname = 'nobody' 2021-09-01 10:53:31 us=111399 chroot_dir = '[UNDEF]' 2021-09-01 10:53:31 us=111413 cd_dir = '[UNDEF]' 2021-09-01 10:53:31 us=111428 writepid = '/run/openvpn.pid' 2021-09-01 10:53:31 us=111442 up_script = '[UNDEF]' 2021-09-01 10:53:31 us=111457 down_script = '[UNDEF]' 2021-09-01 10:53:31 us=111470 down_pre = DISABLED 2021-09-01 10:53:31 us=111485 up_restart = DISABLED 2021-09-01 10:53:31 us=111498 up_delay = DISABLED 2021-09-01 10:53:31 us=111511 daemon = ENABLED 2021-09-01 10:53:31 us=111525 inetd = 0 2021-09-01 10:53:31 us=111538 log = ENABLED 2021-09-01 10:53:31 us=111552 suppress_timestamps = DISABLED 2021-09-01 10:53:31 us=111566 machine_readable_output = DISABLED 2021-09-01 10:53:31 us=111579 nice = 0 2021-09-01 10:53:31 us=111591 verbosity = 4 2021-09-01 10:53:31 us=111603 mute = 0 2021-09-01 10:53:31 us=111617 gremlin = 0 2021-09-01 10:53:31 us=111633 status_file = '/var/log/openvpn-status.log' 2021-09-01 10:53:31 us=111646 status_file_version = 1 2021-09-01 10:53:31 us=111659 status_file_update_freq = 60 2021-09-01 10:53:31 us=111674 occ = ENABLED 2021-09-01 10:53:31 us=111686 rcvbuf = 0 2021-09-01 10:53:31 us=111699 sndbuf = 0 2021-09-01 10:53:31 us=111713 mark = 0 2021-09-01 10:53:31 us=111725 sockflags = 0 2021-09-01 10:53:31 us=111738 fast_io = DISABLED 2021-09-01 10:53:31 us=111752 comp.alg = 2 2021-09-01 10:53:31 us=111764 comp.flags = 3 2021-09-01 10:53:31 us=111778 route_script = '[UNDEF]' 2021-09-01 10:53:31 us=111790 route_default_gateway = '[UNDEF]' 2021-09-01 10:53:31 us=111802 route_default_metric = 0 2021-09-01 10:53:31 us=111815 route_noexec = DISABLED 2021-09-01 10:53:31 us=111827 route_delay = 0 2021-09-01 10:53:31 us=111840 route_delay_window = 30 2021-09-01 10:53:31 us=111853 route_delay_defined = DISABLED 2021-09-01 10:53:31 us=111865 route_nopull = DISABLED 2021-09-01 10:53:31 us=111878 route_gateway_via_dhcp = DISABLED 2021-09-01 10:53:31 us=111890 allow_pull_fqdn = DISABLED 2021-09-01 10:53:31 us=111904 route 192.168.254.0/255.255.255.0/default (not set)/default (not set) 2021-09-01 10:53:31 us=111917 route 192.168.4.0/255.255.255.0/default (not set)/default (not set) 2021-09-01 10:53:31 us=111930 route 192.168.2.0/255.255.255.0/default (not set)/default (not set) 2021-09-01 10:53:31 us=111943 management_addr = '[UNDEF]' 2021-09-01 10:53:31 us=111957 management_port = '[UNDEF]' 2021-09-01 10:53:31 us=111970 management_user_pass = '[UNDEF]' 2021-09-01 10:53:31 us=111983 management_log_history_cache = 250 2021-09-01 10:53:31 us=111998 management_echo_buffer_size = 100 2021-09-01 10:53:31 us=112011 management_write_peer_info_file = '[UNDEF]' 2021-09-01 10:53:31 us=112025 management_client_user = '[UNDEF]' 2021-09-01 10:53:31 us=112038 management_client_group = '[UNDEF]' 2021-09-01 10:53:31 us=112051 management_flags = 0 2021-09-01 10:53:31 us=112065 shared_secret_file = '[UNDEF]' 2021-09-01 10:53:31 us=112077 key_direction = not set 2021-09-01 10:53:31 us=112089 ciphername = 'BF-CBC' 2021-09-01 10:53:31 us=112102 ncp_enabled = ENABLED 2021-09-01 10:53:31 us=112114 ncp_ciphers = 'AES-256-GCM:AES-128-GCM' 2021-09-01 10:53:31 us=112127 authname = 'SHA1' 2021-09-01 10:53:31 us=112139 prng_hash = 'SHA1' 2021-09-01 10:53:31 us=112152 prng_nonce_secret_len = 16 2021-09-01 10:53:31 us=112164 keysize = 0 2021-09-01 10:53:31 us=112177 engine = DISABLED 2021-09-01 10:53:31 us=112190 replay = ENABLED 2021-09-01 10:53:31 us=112203 mute_replay_warnings = DISABLED 2021-09-01 10:53:31 us=112223 replay_window = 64 2021-09-01 10:53:31 us=112236 replay_time = 15 2021-09-01 10:53:31 us=112249 packet_id_file = '[UNDEF]' 2021-09-01 10:53:31 us=112262 test_crypto = DISABLED 2021-09-01 10:53:31 us=112275 tls_server = ENABLED 2021-09-01 10:53:31 us=112288 tls_client = DISABLED 2021-09-01 10:53:31 us=112301 ca_file = '/etc/openvpn/openvpn_certs/carey-ca.pem' 2021-09-01 10:53:31 us=112314 ca_path = '[UNDEF]' 2021-09-01 10:53:31 us=112326 dh_file = '/etc/openvpn/openvpn_certs/dh1024.pem' 2021-09-01 10:53:31 us=112339 cert_file = '/etc/openvpn/openvpn_certs/carey-cert.pem' 2021-09-01 10:53:31 us=112353 extra_certs_file = '[UNDEF]' 2021-09-01 10:53:31 us=112366 priv_key_file = '/etc/openvpn/openvpn_certs/carey-key.pem' 2021-09-01 10:53:31 us=112380 pkcs12_file = '[UNDEF]' 2021-09-01 10:53:31 us=112394 cipher_list = '[UNDEF]' 2021-09-01 10:53:31 us=112407 cipher_list_tls13 = '[UNDEF]' 2021-09-01 10:53:31 us=112420 tls_cert_profile = '[UNDEF]' 2021-09-01 10:53:31 us=112433 tls_verify = '[UNDEF]' 2021-09-01 10:53:31 us=112447 tls_export_cert = '[UNDEF]' 2021-09-01 10:53:31 us=112460 verify_x509_type = 0 2021-09-01 10:53:31 us=112473 verify_x509_name = '[UNDEF]' 2021-09-01 10:53:31 us=112796 crl_file = '[UNDEF]' 2021-09-01 10:53:31 us=112810 ns_cert_type = 0 2021-09-01 10:53:31 us=112824 remote_cert_ku[i] = 0 2021-09-01 10:53:31 us=112838 remote_cert_ku[i] = 0 2021-09-01 10:53:31 us=112850 remote_cert_ku[i] = 0 2021-09-01 10:53:31 us=112864 remote_cert_ku[i] = 0 2021-09-01 10:53:31 us=112877 remote_cert_ku[i] = 0 2021-09-01 10:53:31 us=112890 remote_cert_ku[i] = 0 2021-09-01 10:53:31 us=112903 remote_cert_ku[i] = 0 2021-09-01 10:53:31 us=112917 remote_cert_ku[i] = 0 2021-09-01 10:53:31 us=112930 remote_cert_ku[i] = 0 2021-09-01 10:53:31 us=112943 remote_cert_ku[i] = 0 2021-09-01 10:53:31 us=112958 remote_cert_ku[i] = 0 2021-09-01 10:53:31 us=112972 remote_cert_ku[i] = 0 2021-09-01 10:53:31 us=112985 remote_cert_ku[i] = 0 2021-09-01 10:53:31 us=112998 remote_cert_ku[i] = 0 2021-09-01 10:53:31 us=113011 remote_cert_ku[i] = 0 2021-09-01 10:53:31 us=113025 remote_cert_ku[i] = 0 2021-09-01 10:53:31 us=113039 remote_cert_eku = '[UNDEF]' 2021-09-01 10:53:31 us=113054 ssl_flags = 0 2021-09-01 10:53:31 us=113069 tls_timeout = 2 2021-09-01 10:53:31 us=113085 renegotiate_bytes = -1 2021-09-01 10:53:31 us=113100 renegotiate_packets = 0 2021-09-01 10:53:31 us=113115 renegotiate_seconds = 3600 2021-09-01 10:53:31 us=113130 handshake_window = 60 2021-09-01 10:53:31 us=113146 transition_window = 3600 2021-09-01 10:53:31 us=113162 single_session = DISABLED 2021-09-01 10:53:31 us=113176 push_peer_info = DISABLED 2021-09-01 10:53:31 us=113193 tls_exit = DISABLED 2021-09-01 10:53:31 us=113208 tls_crypt_v2_metadata = '[UNDEF]' 2021-09-01 10:53:31 us=113226 server_network = 192.168.254.0 2021-09-01 10:53:31 us=113243 server_netmask = 255.255.255.0 2021-09-01 10:53:31 us=113261 server_network_ipv6 = :: 2021-09-01 10:53:31 us=113274 server_netbits_ipv6 = 0 2021-09-01 10:53:31 us=113290 server_bridge_ip = 0.0.0.0 2021-09-01 10:53:31 us=113307 server_bridge_netmask = 0.0.0.0 2021-09-01 10:53:31 us=113323 server_bridge_pool_start = 0.0.0.0 2021-09-01 10:53:31 us=113339 server_bridge_pool_end = 0.0.0.0 2021-09-01 10:53:31 us=113353 push_entry = 'route 192.168.1.0 255.255.255.0' 2021-09-01 10:53:31 us=113368 push_entry = 'route 192.168.2.0 255.255.255.0' 2021-09-01 10:53:31 us=113382 push_entry = 'route 192.168.3.0 255.255.255.0' 2021-09-01 10:53:31 us=113396 push_entry = 'route 192.168.254.0 255.255.255.0' 2021-09-01 10:53:31 us=113410 push_entry = 'topology net30' 2021-09-01 10:53:31 us=113425 push_entry = 'ping 10' 2021-09-01 10:53:31 us=113440 push_entry = 'ping-restart 120' 2021-09-01 10:53:31 us=113454 ifconfig_pool_defined = ENABLED 2021-09-01 10:53:31 us=113470 ifconfig_pool_start = 192.168.254.4 2021-09-01 10:53:31 us=113486 ifconfig_pool_end = 192.168.254.251 2021-09-01 10:53:31 us=113516 ifconfig_pool_netmask = 0.0.0.0 2021-09-01 10:53:31 us=113534 ifconfig_pool_persist_filename = 'ipp.txt' 2021-09-01 10:53:31 us=113549 ifconfig_pool_persist_refresh_freq = 600 2021-09-01 10:53:31 us=113565 ifconfig_ipv6_pool_defined = DISABLED 2021-09-01 10:53:31 us=113585 ifconfig_ipv6_pool_base = :: 2021-09-01 10:53:31 us=113601 ifconfig_ipv6_pool_netbits = 0 2021-09-01 10:53:31 us=113618 n_bcast_buf = 256 2021-09-01 10:53:31 us=113634 tcp_queue_limit = 64 2021-09-01 10:53:31 us=113650 real_hash_size = 256 2021-09-01 10:53:31 us=113666 virtual_hash_size = 256 2021-09-01 10:53:31 us=113681 client_connect_script = '[UNDEF]' 2021-09-01 10:53:31 us=113699 learn_address_script = '[UNDEF]' 2021-09-01 10:53:31 us=113718 client_disconnect_script = '[UNDEF]' 2021-09-01 10:53:31 us=113736 client_config_dir = '/etc/openvpn/ccd' 2021-09-01 10:53:31 us=113755 ccd_exclusive = DISABLED 2021-09-01 10:53:31 us=113773 tmp_dir = '/tmp' 2021-09-01 10:53:31 us=113790 push_ifconfig_defined = DISABLED 2021-09-01 10:53:31 us=113808 push_ifconfig_local = 0.0.0.0 2021-09-01 10:53:31 us=113826 push_ifconfig_remote_netmask = 0.0.0.0 2021-09-01 10:53:31 us=113843 push_ifconfig_ipv6_defined = DISABLED 2021-09-01 10:53:31 us=113864 push_ifconfig_ipv6_local = ::/0 2021-09-01 10:53:31 us=113882 push_ifconfig_ipv6_remote = :: 2021-09-01 10:53:31 us=113899 enable_c2c = ENABLED 2021-09-01 10:53:31 us=113915 duplicate_cn = DISABLED 2021-09-01 10:53:31 us=113930 cf_max = 0 2021-09-01 10:53:31 us=113946 cf_per = 0 2021-09-01 10:53:31 us=113961 max_clients = 1024 2021-09-01 10:53:31 us=113977 max_routes_per_client = 256 2021-09-01 10:53:31 us=113994 auth_user_pass_verify_script = '[UNDEF]' 2021-09-01 10:53:31 us=114011 auth_user_pass_verify_script_via_file = DISABLED 2021-09-01 10:53:31 us=114031 auth_token_generate = DISABLED 2021-09-01 10:53:31 us=114047 auth_token_lifetime = 0 2021-09-01 10:53:31 us=114063 auth_token_secret_file = '[UNDEF]' 2021-09-01 10:53:31 us=114078 port_share_host = '[UNDEF]' 2021-09-01 10:53:31 us=114112 port_share_port = '[UNDEF]' 2021-09-01 10:53:31 us=114129 vlan_tagging = DISABLED 2021-09-01 10:53:31 us=114144 vlan_accept = all 2021-09-01 10:53:31 us=114158 vlan_pvid = 1 2021-09-01 10:53:31 us=114172 client = DISABLED 2021-09-01 10:53:31 us=114186 pull = DISABLED 2021-09-01 10:53:31 us=114199 auth_user_pass_file = '[UNDEF]' 2021-09-01 10:53:31 us=114216 OpenVPN 2.5.3 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Jun 19 2021 2021-09-01 10:53:31 us=114233 library versions: OpenSSL 1.1.1k 25 Mar 2021, LZO 2.10 2021-09-01 10:53:31 us=118830 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet. 2021-09-01 10:53:31 us=119807 Diffie-Hellman initialized with 1024 bit key 2021-09-01 10:53:31 us=120543 TLS-Auth MTU parms [ L:1622 D:1212 EF:38 EB:0 ET:0 EL:3 ] 2021-09-01 10:53:31 us=120698 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=eth0 HWADDR=a2:12:3f:31:34:04 2021-09-01 10:53:31 us=121121 TUN/TAP device tun0 opened 2021-09-01 10:53:31 us=121151 do_ifconfig, ipv4=1, ipv6=0 2021-09-01 10:53:31 us=121178 /sbin/ip link set dev tun0 up mtu 1500 2021-09-01 10:53:31 us=123054 /sbin/ip link set dev tun0 up 2021-09-01 10:53:31 us=132657 /sbin/ip addr add dev tun0 local 192.168.254.1 peer 192.168.254.2 2021-09-01 10:53:31 us=136194 /sbin/ip route add 192.168.2.0/24 via 192.168.254.2 2021-09-01 10:53:31 us=137003 /sbin/ip route add 192.168.4.0/24 via 192.168.254.2 2021-09-01 10:53:31 us=137645 /sbin/ip route add 192.168.254.0/24 via 192.168.254.2 2021-09-01 10:53:31 us=138325 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ] 2021-09-01 10:53:31 us=138410 Could not determine IPv4/IPv6 protocol. Using AF_INET 2021-09-01 10:53:31 us=138440 Socket Buffers: R=[212992->212992] S=[212992->212992] 2021-09-01 10:53:31 us=138482 UDPv4 link local (bound): [AF_INET]192.168.1.4:1194 2021-09-01 10:53:31 us=138500 UDPv4 link remote: [AF_UNSPEC] 2021-09-01 10:53:31 us=138520 GID set to nobody 2021-09-01 10:53:31 us=138542 UID set to nobody 2021-09-01 10:53:31 us=138563 MULTI: multi_init called, r=256 v=256 2021-09-01 10:53:31 us=138610 IFCONFIG POOL IPv4: base=192.168.254.4 size=62 2021-09-01 10:53:31 us=138645 ifconfig_pool_read(), in='vpn-bucharest,192.168.254.4,' 2021-09-01 10:53:31 us=138666 succeeded -> ifconfig_pool_set(hand=0) 2021-09-01 10:53:31 us=138683 ifconfig_pool_read(), in='falballa,192.168.254.8,' 2021-09-01 10:53:31 us=138700 succeeded -> ifconfig_pool_set(hand=1) 2021-09-01 10:53:31 us=138717 IFCONFIG POOL LIST 2021-09-01 10:53:31 us=138736 vpn-bucharest,192.168.254.4, 2021-09-01 10:53:31 us=138753 falballa,192.168.254.8, 2021-09-01 10:53:31 us=138811 Initialization Sequence Completed 2021-09-01 10:53:40 us=441282 MULTI: multi_create_instance called 2021-09-01 10:53:40 us=441387 85.186.3.146:41510 Re-using SSL/TLS context 2021-09-01 10:53:40 us=441423 85.186.3.146:41510 LZO compression initializing 2021-09-01 10:53:40 us=441576 85.186.3.146:41510 Control Channel MTU parms [ L:1622 D:1212 EF:38 EB:0 ET:0 EL:3 ] 2021-09-01 10:53:40 us=441591 85.186.3.146:41510 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ] 2021-09-01 10:53:40 us=441641 85.186.3.146:41510 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,auth SHA1,keysize 128,key-method 2,tls-server' 2021-09-01 10:53:40 us=441650 85.186.3.146:41510 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,auth SHA1,keysize 128,key-method 2,tls-client' 2021-09-01 10:53:40 us=441678 85.186.3.146:41510 TLS: Initial packet from [AF_INET]85.186.3.146:41510, sid=7d7d5852 7d361c6d 2021-09-01 10:53:40 us=663553 85.186.3.146:41510 VERIFY OK: depth=1, CN=ca.simon.local, L=Dachau, O=MPM-Networks, C=DE, emailAddress=m.simon@mpm-networks.net 2021-09-01 10:53:40 us=663854 85.186.3.146:41510 VERIFY OK: depth=0, O=MPM-Networks, C=RO, CN=vpn-bucharest, emailAddress=m.simon@mpm-networks.net, L=Bucharfest 2021-09-01 10:53:40 us=664265 85.186.3.146:41510 peer info: IV_VER=2.4.7 2021-09-01 10:53:40 us=664279 85.186.3.146:41510 peer info: IV_PLAT=linux 2021-09-01 10:53:40 us=664287 85.186.3.146:41510 peer info: IV_PROTO=2 2021-09-01 10:53:40 us=664294 85.186.3.146:41510 peer info: IV_NCP=2 2021-09-01 10:53:40 us=664302 85.186.3.146:41510 peer info: IV_LZ4=1 2021-09-01 10:53:40 us=664308 85.186.3.146:41510 peer info: IV_LZ4v2=1 2021-09-01 10:53:40 us=664320 85.186.3.146:41510 peer info: IV_LZO=1 2021-09-01 10:53:40 us=664327 85.186.3.146:41510 peer info: IV_COMP_STUB=1 2021-09-01 10:53:40 us=664333 85.186.3.146:41510 peer info: IV_COMP_STUBv2=1 2021-09-01 10:53:40 us=664340 85.186.3.146:41510 peer info: IV_TCPNL=1 2021-09-01 10:53:40 us=735460 85.186.3.146:41510 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA1 2021-09-01 10:53:40 us=735556 85.186.3.146:41510 [vpn-bucharest] Peer Connection Initiated with [AF_INET]85.186.3.146:41510 2021-09-01 10:53:40 us=735630 vpn-bucharest/85.186.3.146:41510 MULTI_sva: pool returned IPv4=192.168.254.6, IPv6=(Not enabled) 2021-09-01 10:53:40 us=735707 vpn-bucharest/85.186.3.146:41510 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/vpn-bucharest 2021-09-01 10:53:40 us=735793 vpn-bucharest/85.186.3.146:41510 MULTI: Learn: 192.168.254.6 -> vpn-bucharest/85.186.3.146:41510 2021-09-01 10:53:40 us=735807 vpn-bucharest/85.186.3.146:41510 MULTI: primary virtual IP for vpn-bucharest/85.186.3.146:41510: 192.168.254.6 2021-09-01 10:53:40 us=735818 vpn-bucharest/85.186.3.146:41510 MULTI: internal route 192.168.4.0/24 -> vpn-bucharest/85.186.3.146:41510 2021-09-01 10:53:40 us=735830 vpn-bucharest/85.186.3.146:41510 MULTI: Learn: 192.168.4.0/24 -> vpn-bucharest/85.186.3.146:41510 2021-09-01 10:53:40 us=735857 vpn-bucharest/85.186.3.146:41510 Data Channel: using negotiated cipher 'AES-256-GCM' 2021-09-01 10:53:40 us=735891 vpn-bucharest/85.186.3.146:41510 Data Channel MTU parms [ L:1550 D:1450 EF:50 EB:406 ET:0 EL:3 ] 2021-09-01 10:53:40 us=736010 vpn-bucharest/85.186.3.146:41510 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 2021-09-01 10:53:40 us=736021 vpn-bucharest/85.186.3.146:41510 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 2021-09-01 10:53:41 us=983919 vpn-bucharest/85.186.3.146:41510 PUSH: Received control message: 'PUSH_REQUEST' 2021-09-01 10:53:41 us=984014 vpn-bucharest/85.186.3.146:41510 SENT CONTROL [vpn-bucharest]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 192.168.2.0 255.255.255.0,route 192.168.3.0 255.255.255.0,route 192.168.254.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.254.6 192.168.254.5,peer-id 0,cipher AES-256-GCM' (status=1) 2021-09-01 10:53:45 us=239486 MULTI: multi_create_instance called 2021-09-01 10:53:45 us=239592 95.118.58.103:50762 Re-using SSL/TLS context 2021-09-01 10:53:45 us=239620 95.118.58.103:50762 LZO compression initializing 2021-09-01 10:53:45 us=239803 95.118.58.103:50762 Control Channel MTU parms [ L:1622 D:1212 EF:38 EB:0 ET:0 EL:3 ] 2021-09-01 10:53:45 us=239835 95.118.58.103:50762 Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ] 2021-09-01 10:53:45 us=239909 95.118.58.103:50762 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,auth SHA1,keysize 128,key-method 2,tls-server' 2021-09-01 10:53:45 us=239930 95.118.58.103:50762 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,auth SHA1,keysize 128,key-method 2,tls-client' 2021-09-01 10:53:45 us=239972 95.118.58.103:50762 TLS: Initial packet from [AF_INET]95.118.58.103:50762, sid=0c3c7868 0fdef9d5 2021-09-01 10:53:45 us=461394 95.118.58.103:50762 VERIFY OK: depth=1, CN=ca.simon.local, L=Dachau, O=MPM-Networks, C=DE, emailAddress=m.simon@mpm-networks.net 2021-09-01 10:53:45 us=461799 95.118.58.103:50762 VERIFY OK: depth=0, O=MPM-Networks, C=DE, CN=falballa, emailAddress=m.simon@mpm-networks.net, L=Munich 2021-09-01 10:53:45 us=464831 95.118.58.103:50762 peer info: IV_VER=2.4.7 2021-09-01 10:53:45 us=464876 95.118.58.103:50762 peer info: IV_PLAT=linux 2021-09-01 10:53:45 us=464893 95.118.58.103:50762 peer info: IV_PROTO=2 2021-09-01 10:53:45 us=464910 95.118.58.103:50762 peer info: IV_NCP=2 2021-09-01 10:53:45 us=464926 95.118.58.103:50762 peer info: IV_LZ4=1 2021-09-01 10:53:45 us=464942 95.118.58.103:50762 peer info: IV_LZ4v2=1 2021-09-01 10:53:45 us=464958 95.118.58.103:50762 peer info: IV_LZO=1 2021-09-01 10:53:45 us=464974 95.118.58.103:50762 peer info: IV_COMP_STUB=1 2021-09-01 10:53:45 us=464989 95.118.58.103:50762 peer info: IV_COMP_STUBv2=1 2021-09-01 10:53:45 us=465005 95.118.58.103:50762 peer info: IV_TCPNL=1 2021-09-01 10:53:45 us=523718 95.118.58.103:50762 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA1 2021-09-01 10:53:45 us=523801 95.118.58.103:50762 [falballa] Peer Connection Initiated with [AF_INET]95.118.58.103:50762 2021-09-01 10:53:45 us=523862 falballa/95.118.58.103:50762 MULTI_sva: pool returned IPv4=192.168.254.10, IPv6=(Not enabled) 2021-09-01 10:53:45 us=523940 falballa/95.118.58.103:50762 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/falballa 2021-09-01 10:53:45 us=524039 falballa/95.118.58.103:50762 MULTI: Learn: 192.168.254.10 -> falballa/95.118.58.103:50762 2021-09-01 10:53:45 us=524068 falballa/95.118.58.103:50762 MULTI: primary virtual IP for falballa/95.118.58.103:50762: 192.168.254.10 2021-09-01 10:53:45 us=524093 falballa/95.118.58.103:50762 MULTI: internal route 192.168.2.0/24 -> falballa/95.118.58.103:50762 2021-09-01 10:53:45 us=524114 falballa/95.118.58.103:50762 MULTI: Learn: 192.168.2.0/24 -> falballa/95.118.58.103:50762 2021-09-01 10:53:45 us=524141 falballa/95.118.58.103:50762 REMOVE PUSH ROUTE: 'route 192.168.2.0 255.255.255.0' 2021-09-01 10:53:45 us=524188 falballa/95.118.58.103:50762 Data Channel: using negotiated cipher 'AES-256-GCM' 2021-09-01 10:53:45 us=524224 falballa/95.118.58.103:50762 Data Channel MTU parms [ L:1550 D:1450 EF:50 EB:406 ET:0 EL:3 ] 2021-09-01 10:53:45 us=524397 falballa/95.118.58.103:50762 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 2021-09-01 10:53:45 us=524423 falballa/95.118.58.103:50762 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 2021-09-01 10:53:46 us=611940 falballa/95.118.58.103:50762 PUSH: Received control message: 'PUSH_REQUEST' 2021-09-01 10:53:46 us=612038 falballa/95.118.58.103:50762 SENT CONTROL [falballa]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 192.168.3.0 255.255.255.0,route 192.168.254.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.254.10 192.168.254.9,peer-id 1,cipher AES-256-GCM' (status=1 [/code] on client side: ovpn config: [code] client dev tun auth-user-pass /etc/openvpn/secrets.conf proto udp remote dl9vsmyxdc6hdwnu.myfritz.net resolv-retry infinite nobind persist-key persist-tun comp-lzo ca /etc/openvpn/certs/ca.crt cert /etc/openvpn/certs/cert.pem key /etc/openvpn/certs/key.pem verb 4 log-append /var/log/openvpn.log [/code] route -n: [code] Ziel Router Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.4.1 0.0.0.0 UG 302 0 0 wlan0 192.168.1.0 192.168.254.5 255.255.255.0 UG 0 0 0 tun0 192.168.2.0 192.168.254.5 255.255.255.0 UG 0 0 0 tun0 192.168.3.0 192.168.254.5 255.255.255.0 UG 0 0 0 tun0 192.168.4.0 0.0.0.0 255.255.255.0 U 302 0 0 wlan0 192.168.254.0 192.168.254.5 255.255.255.0 UG 0 0 0 tun0 192.168.254.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 [/code] iptables -S: [code] -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd -A INPUT -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -i wlan0 -j ACCEPT -A INPUT -i tun0 -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -j ACCEPT [/code] and the log here says: [code] WARNING: file '/etc/openvpn/secrets.conf' is group or others accessible Current Parameter Settings: config = 'vpn.conf' mode = 0 persist_config = DISABLED persist_mode = 1 show_ciphers = DISABLED show_digests = DISABLED show_engines = DISABLED genkey = DISABLED key_pass_file = '[UNDEF]' show_tls_ciphers = DISABLED connect_retry_max = 0 Connection profiles [0]: proto = udp local = '[UNDEF]' local_port = '[UNDEF]' remote = 'dl9vsmyxdc6hdwnu.myfritz.net' remote_port = '1194' remote_float = DISABLED bind_defined = DISABLED bind_local = DISABLED bind_ipv6_only = DISABLED connect_retry_seconds = 5 connect_timeout = 120 socks_proxy_server = '[UNDEF]' socks_proxy_port = '[UNDEF]' tun_mtu = 1500 tun_mtu_defined = ENABLED link_mtu = 1500 link_mtu_defined = DISABLED tun_mtu_extra = 0 tun_mtu_extra_defined = DISABLED mtu_discover_type = -1 fragment = 0 mssfix = 1450 explicit_exit_notification = 0 Connection profiles END remote_random = DISABLED ipchange = '[UNDEF]' dev = 'tun' dev_type = '[UNDEF]' dev_node = '[UNDEF]' lladdr = '[UNDEF]' topology = 1 ifconfig_local = '[UNDEF]' ifconfig_remote_netmask = '[UNDEF]' ifconfig_noexec = DISABLED ifconfig_nowarn = DISABLED ifconfig_ipv6_local = '[UNDEF]' ifconfig_ipv6_netbits = 0 ifconfig_ipv6_remote = '[UNDEF]' shaper = 0 mtu_test = 0 mlock = DISABLED keepalive_ping = 0 keepalive_timeout = 0 inactivity_timeout = 0 ping_send_timeout = 0 ping_rec_timeout = 0 ping_rec_timeout_action = 0 ping_timer_remote = DISABLED remap_sigusr1 = 0 persist_tun = ENABLED persist_local_ip = DISABLED persist_remote_ip = DISABLED persist_key = ENABLED passtos = DISABLED resolve_retry_seconds = 1000000000 resolve_in_advance = DISABLED username = '[UNDEF]' groupname = '[UNDEF]' chroot_dir = '[UNDEF]' cd_dir = '[UNDEF]' writepid = '[UNDEF]' up_script = '[UNDEF]' down_script = '[UNDEF]' down_pre = DISABLED up_restart = DISABLED up_delay = DISABLED daemon = DISABLED inetd = 0 log = ENABLED suppress_timestamps = ENABLED machine_readable_output = DISABLED nice = 0 verbosity = 4 mute = 0 gremlin = 0 status_file = '[UNDEF]' status_file_version = 1 status_file_update_freq = 60 occ = ENABLED rcvbuf = 0 sndbuf = 0 mark = 0 sockflags = 0 fast_io = DISABLED comp.alg = 2 comp.flags = 1 route_script = '[UNDEF]' route_default_gateway = '[UNDEF]' route_default_metric = 0 route_noexec = DISABLED route_delay = 0 route_delay_window = 30 route_delay_defined = DISABLED route_nopull = DISABLED route_gateway_via_dhcp = DISABLED allow_pull_fqdn = DISABLED management_addr = '[UNDEF]' management_port = '[UNDEF]' management_user_pass = '[UNDEF]' management_log_history_cache = 250 management_echo_buffer_size = 100 management_write_peer_info_file = '[UNDEF]' management_client_user = '[UNDEF]' management_client_group = '[UNDEF]' management_flags = 0 shared_secret_file = '[UNDEF]' key_direction = not set ciphername = 'BF-CBC' ncp_enabled = ENABLED ncp_ciphers = 'AES-256-GCM:AES-128-GCM' authname = 'SHA1' prng_hash = 'SHA1' prng_nonce_secret_len = 16 keysize = 0 engine = DISABLED replay = ENABLED mute_replay_warnings = DISABLED replay_window = 64 replay_time = 15 packet_id_file = '[UNDEF]' use_iv = ENABLED test_crypto = DISABLED tls_server = DISABLED tls_client = ENABLED key_method = 2 ca_file = '/etc/openvpn/certs/ca.crt' ca_path = '[UNDEF]' dh_file = '[UNDEF]' cert_file = '/etc/openvpn/certs/cert.pem' extra_certs_file = '[UNDEF]' priv_key_file = '/etc/openvpn/certs/key.pem' pkcs12_file = '[UNDEF]' cipher_list = '[UNDEF]' cipher_list_tls13 = '[UNDEF]' tls_cert_profile = '[UNDEF]' tls_verify = '[UNDEF]' tls_export_cert = '[UNDEF]' verify_x509_type = 0 verify_x509_name = '[UNDEF]' crl_file = '[UNDEF]' ns_cert_type = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_eku = '[UNDEF]' ssl_flags = 0 tls_timeout = 2 renegotiate_bytes = -1 renegotiate_packets = 0 renegotiate_seconds = 3600 handshake_window = 60 transition_window = 3600 single_session = DISABLED push_peer_info = DISABLED tls_exit = DISABLED tls_auth_file = '[UNDEF]' tls_crypt_file = '[UNDEF]' pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_pin_cache_period = -1 pkcs11_id = '[UNDEF]' pkcs11_id_management = DISABLED server_network = 0.0.0.0 server_netmask = 0.0.0.0 server_network_ipv6 = :: server_netbits_ipv6 = 0 server_bridge_ip = 0.0.0.0 server_bridge_netmask = 0.0.0.0 server_bridge_pool_start = 0.0.0.0 server_bridge_pool_end = 0.0.0.0 ifconfig_pool_defined = DISABLED ifconfig_pool_start = 0.0.0.0 ifconfig_pool_end = 0.0.0.0 ifconfig_pool_netmask = 0.0.0.0 ifconfig_pool_persist_filename = '[UNDEF]' ifconfig_pool_persist_refresh_freq = 600 ifconfig_ipv6_pool_defined = DISABLED ifconfig_ipv6_pool_base = :: ifconfig_ipv6_pool_netbits = 0 n_bcast_buf = 256 tcp_queue_limit = 64 real_hash_size = 256 virtual_hash_size = 256 client_connect_script = '[UNDEF]' learn_address_script = '[UNDEF]' client_disconnect_script = '[UNDEF]' client_config_dir = '[UNDEF]' ccd_exclusive = DISABLED tmp_dir = '/tmp' push_ifconfig_defined = DISABLED push_ifconfig_local = 0.0.0.0 push_ifconfig_remote_netmask = 0.0.0.0 push_ifconfig_ipv6_defined = DISABLED push_ifconfig_ipv6_local = ::/0 push_ifconfig_ipv6_remote = :: enable_c2c = DISABLED duplicate_cn = DISABLED cf_max = 0 cf_per = 0 max_clients = 1024 max_routes_per_client = 256 auth_user_pass_verify_script = '[UNDEF]' auth_user_pass_verify_script_via_file = DISABLED auth_token_generate = DISABLED auth_token_lifetime = 0 port_share_host = '[UNDEF]' port_share_port = '[UNDEF]' client = ENABLED pull = ENABLED auth_user_pass_file = '/etc/openvpn/secrets.conf' OpenVPN 2.4.7 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 28 2021 library versions: OpenSSL 1.1.1d 10 Sep 2019, LZO 2.10 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info. LZO compression initializing Control Channel MTU parms [ L:1622 D:1212 EF:38 EB:0 ET:0 EL:3 ] Data Channel MTU parms [ L:1622 D:1450 EF:122 EB:406 ET:0 EL:3 ] Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client' Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server' TCP/UDP: Preserving recently used remote address: [AF_INET]91.5.26.41:1194 Socket Buffers: R=[180224->180224] S=[180224->180224] UDP link local: (not bound) UDP link remote: [AF_INET]91.5.26.41:1194 TLS: Initial packet from [AF_INET]91.5.26.41:1194, sid=5cc9d187 896628d7 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this VERIFY OK: depth=1, CN=ca.simon.local, L=Dachau, O=MPM-Networks, C=DE, emailAddress=m.simon@mpm-networks.net VERIFY OK: depth=0, O=MPM-Networks, C=DE, CN=carey.simon.local, emailAddress=m.simon@mpm-networks.net, L=Dachau WARNING: 'cipher' is present in local config but missing in remote config, local='cipher BF-CBC' Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA [carey.simon.local] Peer Connection Initiated with [AF_INET]91.5.26.41:1194 SENT CONTROL [carey.simon.local]: 'PUSH_REQUEST' (status=1) PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 192.168.2.0 255.255.255.0,route 192.168.3.0 255.255.255.0,route 192.168.254.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.254.6 192.168.254.5,peer-id 0,cipher AES-256-GCM' OPTIONS IMPORT: timers and/or timeouts modified OPTIONS IMPORT: --ifconfig/up options modified OPTIONS IMPORT: route options modified OPTIONS IMPORT: peer-id set OPTIONS IMPORT: adjusting link_mtu to 1625 OPTIONS IMPORT: data channel crypto options modified Data Channel: using negotiated cipher 'AES-256-GCM' Data Channel MTU parms [ L:1553 D:1450 EF:53 EB:406 ET:0 EL:3 ] Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key ROUTE_GATEWAY 192.168.4.1/255.255.255.0 IFACE=wlan0 HWADDR=b8:27:eb:ae:6e:1d TUN/TAP device tun0 opened TUN/TAP TX queue length set to 100 do_ifconfig, tt->did_ifconfig_ipv6_setup=0 /sbin/ip link set dev tun0 up mtu 1500 /sbin/ip addr add dev tun0 local 192.168.254.6 peer 192.168.254.5 /sbin/ip route add 192.168.1.0/24 via 192.168.254.5 /sbin/ip route add 192.168.2.0/24 via 192.168.254.5 /sbin/ip route add 192.168.3.0/24 via 192.168.254.5 /sbin/ip route add 192.168.254.0/24 via 192.168.254.5 Initialization Sequence Completed [/code] The result is this: From client: [code] root@vpnclient:/home/pi# ping 192.168.1.11 -c2 PING 192.168.1.11 (192.168.1.11) 56(84) bytes of data. --- 192.168.1.11 ping statistics --- 2 packets transmitted, 0 received, 100% packet loss, time 8ms root@vpnclient:/home/pi# ping 192.168.1.4 -c2 PING 192.168.1.4 (192.168.1.4) 56(84) bytes of data. 64 bytes from 192.168.1.4: icmp_seq=1 ttl=64 time=55.8 ms 64 bytes from 192.168.1.4: icmp_seq=2 ttl=64 time=58.4 ms --- 192.168.1.4 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 3ms rtt min/avg/max/mdev = 55.830/57.121/58.413/1.313 ms [/code] From Server: [code] carey:~# ping 192.168.4.1 -c2 PING 192.168.4.1 (192.168.4.1): 56 data bytes --- 192.168.4.1 ping statistics --- 2 packets transmitted, 0 packets received, 100% packet loss carey:~# ping 192.168.4.2 -c2 PING 192.168.4.2 (192.168.4.2): 56 data bytes 64 bytes from 192.168.4.2: seq=0 ttl=64 time=57.468 ms 64 bytes from 192.168.4.2: seq=1 ttl=64 time=52.491 ms --- 192.168.4.2 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 52.491/54.979/57.468 ms [/code]

192.168.4.2 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 52.491/54.979/57.468 ms now what is working and what is not working. Server can ping subnet 192.168.4.0 what are you looking for? That is what openvpn can do and the rest is your firewall do the job. vpnclient:/home/pi# ping 192.168.1.4 -c2 PING 192.168.1.4 (192.168.1.4) 56(84) bytes of data. 64 bytes from 192.168.1.4: icmp_seq=1 ttl=64 time=55.8 ms 64 bytes from 192.168.1.4: icmp_seq=2 ttl=64 time Your client can ping subnet 192.168.1.0 that is all work as expected .

Not completely. What is working is pinging the interfaces on the client and the server, but not the other hosts in the networks. So you think it is a problem with routing or iptables?

s2s connection only on one direction

Callya

I found it out and could solve the issue:
On the clients were a route missing: 192.168.254.0/24 via 192.168.2.4 dev eth0

So the ICMP echo was sent to the correct destination, but the reply was sent over the default gateway what does not have the route back and so the ping failed.

« Previous Page