I have the following setup: - server: openvpn 2.4.7 on Ubuntu 20.04 - client: openvpn 2.5.1 on Ubuntu 21.10 - client: openvpn 2.5.5 community on Windows All traffic is redirected through the server (IPv4+nat and IPv6+nat), everything works with community 2.5 clients. Now, if I try to use a openvpn3 client (17~beta2+hirsute) - it connects to the server, there are no warnings, no errors in client nor server log - but there is no internet on the client. It is possible to ping the server or connect to it with SSH, it is possible to ping other hosts in the internet, when openvpn3 client is connected, but everything else just times out. When I check with tcpdump on the server - for example, when trying to "curl -v google.com" on the PC with openvpn3 client - I can see that the server is getting the reply from the google server, but somehow, the packets never make it to the client. With community openvpn 2.5 client, everything just works. Not sure if that's expected - because there are no warnings nor errors in the log, I'm not sure how to debug this. Perhaps openvpn2 server and openvpn3 client don't work together? For reference - server config: [oconf=server] port 1194 proto udp dev tun ca ca.crt cert issued/server.crt key private/server.key # This file should be kept secret dh dh.pem tls-crypt ta.key topology subnet server 10.121.0.0 255.255.255.0 ifconfig-pool-persist /var/log/openvpn/ipp.txt #push "route 10.11.0.0 255.255.255.0" push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 1.1.1.1" # ipv6 server-ipv6 fd42:feed:feed:feed::/64 push "redirect-gateway ipv6 bypass-dhcp" keepalive 10 120 cipher AES-256-CBC compress lz4 persist-key persist-tun status /var/log/openvpn/openvpn-status.log log-append /var/log/openvpn/openvpn.log verb 3 explicit-exit-notify 1 auth SHA512 # allow the client to connect multiple times (i.e. PC and mobile) duplicate-cn # need to add client name to ccd dir client-config-dir /etc/openvpn/ccd ccd-exclusive [/oconf] And client config: [oconf=client] client dev tun proto udp remote aaa.bbb.ccc.ddd 1194 resolv-retry infinite nobind persist-key persist-tun remote-cert-tls server compress lz4 cipher AES-256-CBC auth SHA512 auth-nocache verb 3 ... ... ... ... [/oconf]

[quote=mangoo post_id=104736 time=1644008561 user_id=40909] if I try to use a [b]openvpn3[/b] client (17~beta2+hirsute) - [/quote]Please see: https://github.com/OpenVPN/openvpn3

[quote=TinCanTech post_id=104737 time=1644012872 user_id=37053] [quote=mangoo post_id=104736 time=1644008561 user_id=40909] if I try to use a [b]openvpn3[/b] client (17~beta2+hirsute) - [/quote]Please see: https://github.com/OpenVPN/openvpn3 [/quote] I can read "OpenVPN 3 is a C++ class library that implements the functionality of an OpenVPN client, and is protocol-compatible with the OpenVPN 2.x branch". Is there any specific paragraph you wanted me to read?

If you simply want help diagnosing a connection issue then please document as described [url=https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p68963https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p68963]here[/url]. Which means, your logs please.

Here are the logs when openvpn3 client is connecting to openvpn2 server. Let me know if you see any issues there. - openvpn 2.4 server side log: [code]83.11.19.18:51034 TLS: Initial packet from [AF_INET]83.11.19.18:51034, sid=907b4642 f4576962 83.11.19.18:51034 VERIFY OK: depth=1, CN=Easy-RSA CA 83.11.19.18:51034 VERIFY OK: depth=0, CN=tch 83.11.19.18:51034 peer info: IV_VER=3.git:HEAD:7765540e 83.11.19.18:51034 peer info: IV_PLAT=linux 83.11.19.18:51034 peer info: IV_NCP=2 83.11.19.18:51034 peer info: IV_TCPNL=1 83.11.19.18:51034 peer info: IV_PROTO=30 83.11.19.18:51034 peer info: IV_CIPHERS=AES-128-GCM:AES-192-GCM:AES-256-GCM:CHACHA20-POLY1305 83.11.19.18:51034 peer info: IV_LZO_STUB=1 83.11.19.18:51034 peer info: IV_COMP_STUB=1 83.11.19.18:51034 peer info: IV_COMP_STUBv2=1 83.11.19.18:51034 peer info: IV_AUTO_SESS=1 83.11.19.18:51034 peer info: IV_GUI_VER=OpenVPN_3/Linux_v17_beta/3.git:HEAD:7765540e_linux_x86_64_64-bit 83.11.19.18:51034 peer info: IV_SSO=openurl,webauth 83.11.19.18:51034 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 4096 bit RSA 83.11.19.18:51034 [tch] Peer Connection Initiated with [AF_INET]83.11.19.18:51034 tch/83.11.19.18:51034 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/tch tch/83.11.19.18:51034 MULTI_sva: pool returned IPv4=10.121.0.4, IPv6=fd42:feed:feed:feed::1002 tch/83.11.19.18:51034 MULTI: Learn: 10.121.0.4 -> tch/83.11.19.18:51034 tch/83.11.19.18:51034 MULTI: primary virtual IP for tch/83.11.19.18:51034: 10.121.0.4 tch/83.11.19.18:51034 MULTI: Learn: fd42:feed:feed:feed::1002 -> tch/83.11.19.18:51034 tch/83.11.19.18:51034 MULTI: primary virtual IPv6 for tch/83.11.19.18:51034: fd42:feed:feed:feed::1002 tch/83.11.19.18:51034 PUSH: Received control message: 'PUSH_REQUEST' tch/83.11.19.18:51034 SENT CONTROL [tch]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 1.1.1.1,redirect-gateway ipv6 bypass-dhcp,tun-ipv6,route-gateway 10.121.0.1,topology subnet,ping 10,ping-restart 120,ifconfig-ipv6 fd42:feed:feed:feed::1002/64 fd42:feed:feed:feed::1,ifconfig 10.121.0.4 255.255.255.0,peer-id 2,cipher AES-256-GCM' (status=1) tch/83.11.19.18:51034 Data Channel: using negotiated cipher 'AES-256-GCM' tch/83.11.19.18:51034 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key tch/83.11.19.18:51034 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key[/code] - openvpn3 client side log: [code] Feb 5 11:49:41 dell dbus-daemon[1035]: [system] Activating service name='net.openvpn.v3.sessions' requested by ':1.7890' (uid=1000 pid=1081007 comm="openvpn3 session-start --config tch.ov") (using servicehelper) Feb 5 11:49:41 dell net.openvpn.v3.sessions[1081011]: OpenVPN 3/Linux v17_beta (openvpn3-service-sessionmgr) Feb 5 11:49:41 dell net.openvpn.v3.sessions[1081011]: OpenVPN core 3.git:HEAD:7765540e linux x86_64 64-bit Feb 5 11:49:41 dell net.openvpn.v3.sessions[1081011]: Copyright (C) 2012-2020 OpenVPN Inc. All rights reserved. Feb 5 11:49:41 dell dbus-daemon[1035]: [system] Activating service name='net.openvpn.v3.log' requested by ':1.7891' (uid=140 pid=1081011 comm="/usr/lib/x86_64-linux-gnu/openvpn3-linux/openvpn3-") (using servicehelper) Feb 5 11:49:41 dell net.openvpn.v3.log[1081015]: OpenVPN 3/Linux v17_beta (openvpn3-service-logger) Feb 5 11:49:41 dell net.openvpn.v3.log[1081015]: OpenVPN core 3.git:HEAD:7765540e linux x86_64 64-bit Feb 5 11:49:41 dell net.openvpn.v3.log[1081015]: Copyright (C) 2012-2020 OpenVPN Inc. All rights reserved. Feb 5 11:49:41 dell net.openvpn.v3.log[1081015]: Idle exit set to 10 minutes Feb 5 11:49:41 dell dbus-daemon[1035]: [system] Successfully activated service 'net.openvpn.v3.log' Feb 5 11:49:41 dell net.openvpn.v3.log[1081015]: Logger VERB2: Attached: {tag:3157490219064562092} [:1.7891/net.openvpn.v3.sessions] Feb 5 11:49:41 dell dbus-daemon[1035]: [system] Successfully activated service 'net.openvpn.v3.sessions' Feb 5 11:49:42 dell dbus-daemon[1035]: [system] Activating service name='net.openvpn.v3.configuration' requested by ':1.7890' (uid=1000 pid=1081007 comm="openvpn3 session-start --config tch.ov") (using servicehelper) Feb 5 11:49:42 dell net.openvpn.v3.configuration[1081021]: OpenVPN 3/Linux v17_beta (openvpn3-service-configmgr) Feb 5 11:49:42 dell net.openvpn.v3.configuration[1081021]: OpenVPN core 3.git:HEAD:7765540e linux x86_64 64-bit Feb 5 11:49:42 dell net.openvpn.v3.configuration[1081021]: Copyright (C) 2012-2020 OpenVPN Inc. All rights reserved. Feb 5 11:49:42 dell net.openvpn.v3.log[1081015]: Logger VERB2: Attached: {tag:6006032589890898422} [:1.7893/net.openvpn.v3.configuration] Feb 5 11:49:42 dell dbus-daemon[1035]: [system] Successfully activated service 'net.openvpn.v3.configuration' Feb 5 11:49:43 dell net.openvpn.v3.log[1081015]: {tag:6006032589890898422} Config Manager INFO: Parsed single-use configuration 'tch.ovpn', owner: tch Feb 5 11:49:43 dell net.openvpn.v3.log[1081015]: {tag:6006032589890898422} Config Manager INFO: Setting configuration override 'persist-tun' to 'true' by UID 1000 Feb 5 11:49:43 dell dbus-daemon[1035]: [system] Activating service name='net.openvpn.v3.backends' requested by ':1.7891' (uid=140 pid=1081011 comm="/usr/lib/x86_64-linux-gnu/openvpn3-linux/openvpn3-") (using servicehelper) Feb 5 11:49:43 dell net.openvpn.v3.backends[1081029]: OpenVPN 3/Linux v17_beta (openvpn3-service-backendstart) Feb 5 11:49:43 dell net.openvpn.v3.backends[1081029]: OpenVPN core 3.git:HEAD:7765540e linux x86_64 64-bit Feb 5 11:49:43 dell net.openvpn.v3.backends[1081029]: Copyright (C) 2012-2020 OpenVPN Inc. All rights reserved. Feb 5 11:49:43 dell net.openvpn.v3.log[1081015]: Logger VERB2: Attached: {tag:2664736647481760910} [:1.7894/net.openvpn.v3.backends] Feb 5 11:49:43 dell dbus-daemon[1035]: [system] Successfully activated service 'net.openvpn.v3.backends' Feb 5 11:49:43 dell net.openvpn.v3.backends[1081033]: Re-initiated process from pid 1081033 to backend process pid 1081034 Feb 5 11:49:43 dell net.openvpn.v3.backends[1081034]: OpenVPN 3/Linux v17_beta (openvpn3-service-client) Feb 5 11:49:43 dell net.openvpn.v3.backends[1081034]: OpenVPN core 3.git:HEAD:7765540e linux x86_64 64-bit Feb 5 11:49:43 dell net.openvpn.v3.backends[1081034]: Copyright (C) 2012-2020 OpenVPN Inc. All rights reserved. Feb 5 11:49:43 dell net.openvpn.v3.log[1081015]: Logger VERB2: Attached: {tag:1754057063817800157} [:1.7895/net.openvpn.v3.backends] Feb 5 11:49:43 dell net.openvpn.v3.log[1081015]: Logger VERB2: Attached: {tag:7152556800024388631} [:1.7895/net.openvpn.v3.sessions] Feb 5 11:49:43 dell dbus-daemon[1035]: [system] Activating service name='net.openvpn.v3.netcfg' requested by ':1.7895' (uid=140 pid=1081034 comm="/usr/lib/x86_64-linux-gnu/openvpn3-linux/openvpn3-") (using servicehelper) Feb 5 11:49:43 dell net.openvpn.v3.netcfg[1081039]: Loading configuration file: /var/lib/openvpn3/netcfg.json Feb 5 11:49:43 dell net.openvpn.v3.log[1081015]: Logger VERB2: Attached: {tag:16141793784013189646} [:1.7896/net.openvpn.v3.netcfg] Feb 5 11:49:43 dell net.openvpn.v3.log[1081015]: Logger VERB2: Attached: {tag:8214603996853596697} [:1.7896/net.openvpn.v3.netcfg.core] Feb 5 11:49:43 dell net.openvpn.v3.netcfg[1081039]: OpenVPN 3/Linux v17_beta (openvpn3-service-netcfg) Feb 5 11:49:43 dell net.openvpn.v3.netcfg[1081039]: OpenVPN core 3.git:HEAD:7765540e linux x86_64 64-bit Feb 5 11:49:43 dell net.openvpn.v3.netcfg[1081039]: Copyright (C) 2012-2020 OpenVPN Inc. All rights reserved. Feb 5 11:49:43 dell dbus-daemon[1035]: [system] Successfully activated service 'net.openvpn.v3.netcfg' Feb 5 11:49:43 dell net.openvpn.v3.log[1081015]: {tag:16141793784013189646} Network Configuration VERB1: Redirect method: host-route Feb 5 11:49:44 dell net.openvpn.v3.log[1081015]: {tag:16141793784013189646} Network Configuration INFO: Cleaning up resources for PID 1081034. Feb 5 11:49:44 dell net.openvpn.v3.log[1081015]: {tag:1754057063817800157} Client INFO: Starting connection Feb 5 11:49:44 dell net.openvpn.v3.log[1081015]: {tag:16141793784013189646} Network Configuration INFO: Socket protect called for socket 8, remote: 'aaa.bbb.ccc.ddd', tun: '', ipv6: no Feb 5 11:49:44 dell net.openvpn.v3.log[1081015]: {tag:1754057063817800157} Client INFO: Connecting Feb 5 11:49:45 dell net.openvpn.v3.log[1081015]: {tag:16141793784013189646} Network Configuration INFO: Virtual device '177725f5ta0cdt4bb0t9e75t34360f79acce' registered on /net/openvpn/v3/netcfg/1081034_177725f5ta0cdt4bb0t9e75t34360f79acce (owner uid 140, owner pid 1081034) Feb 5 11:49:45 dell net.openvpn.v3.log[1081015]: {tag:16141793784013189646} Network Configuration INFO: Adding IP Adress 10.121.0.4/24 gw 10.121.0.1 ipv6: no Feb 5 11:49:45 dell net.openvpn.v3.log[1081015]: {tag:16141793784013189646} Network Configuration INFO: Adding IP Adress fd42:feed:feed:feed::1002/64 gw fd42:feed:feed:feed::1 ipv6: yes Feb 5 11:49:45 dell net.openvpn.v3.log[1081015]: {tag:16141793784013189646} Network Configuration INFO: Setting remote IP address to 'aaa.bbb.ccc.ddd ipv6: no Feb 5 11:49:45 dell net.openvpn.v3.log[1081015]: {tag:1754057063817800157} Client INFO: Connected: aaa.bbb.ccc.ddd:1194 (aaa.bbb.ccc.ddd) via /UDPv4 on tun/10.121.0.4/fd42:feed:feed:feed::1002 gw=[10.121.0.1/fd42:feed:feed:feed::1][/code] With verb 4, the server also logs plenty of: [code]tch/83.11.19.18:53945 MULTI: bad source address from client [192.168.1.19], packet dropped[/code] Which I suppose it why openvpn3 client does not have connectivity. However, with exactly same config, openvpn2 client works just fine. 192.168.1.19 is a wi-fi address of the client.

Your client looks to be successfully connected. I can only presume that you have not setup your server correctly.

I've attached the server config at the beginning of the thread. OpenVPN clients version 2 connect just fine and have internet access. OpenVPN clients version 3 connect using the same config, but don't have internet access. I'd appreciate if you could point me into the ideas on "you have not setup your server correctly".

https://www.ircpimps.org/redirect.png

Thanks for the hints, but it doesn't explain why the setup works with openvpn2 clients, but not with openvpn3 clients. For now, I'm assuming that version 3 clients are just that - beta.

Can the Version 3 client ping the server VPN IP, at least ?

Hi mangoo, Yes, you're right, it does not explain the issue. Are you trying the openvpn3 client on the same machine as openvpn 2.x? You're also right, it's beta. Not a dirty word. It means the basic functionality is done, but some quirks exist. You can help with testing. My guess is that something is wrong with the client's route table. Show us from the client: [code]ip addr ; ip route[/code] Looks like you are using [b]--redirect-gateway[/b]. [url=https://forums.openvpn.net/viewtopic.php?f=6&t=10923]This post[/url] might help with that. regards, rob0

openvpn3 client with openvpn2.4 server - possible?

dazo

mangoo wrote

dazo wrote

   $ openvpn2 --config CONFIG_FILE --verb 6

Did you mean openvpn3 client above? openvpn 2.x client works just fine with a 2.x server.

No, I meant openvpn2 - https://github.com/OpenVPN/openvpn3-linux/blob/master/docs/man/openvpn2.1.rst

It's important to distinguish between the openvpn executable which is the "classical" OpenVPN 2.x generation and openvpn2 and openvpn3 executables which are part of the OpenVPN 3 Linux project.

$ file /usr/bin/openvpn[23] /usr/sbin/openvpn | cut -d, -f1
/usr/bin/openvpn2: Python script
/usr/bin/openvpn3: ELF 64-bit LSB executable
/usr/sbin/openvpn: ELF 64-bit LSB shared object

mangoo wrote It seems to use different syntax:
openvpn3 session-start --config CONFIG_FILE
As openvpn3 doesn't accept "--verb 6" argument, I've added "verb 6" to the config file.

However, the amount of data logged to /var/log/syslog does not seem to change and is minimal.

Correct, because openvpn3 session-start does not support --verb (maybe I should add support for --log-level, though - but that's a different topic). While the openvpn2 front-end will support --verb because it tries to simulate the classical OpenVPN 2.x command line interface.

openvpn_inc

Hey mangoo,

Are you still getting the logged errors about bad source address? If so, select one of those destination addresses and show:

ip route get that.ip.add.ress

Also, you did not show the iptables/nft output I requested.

regards, rob0

mangoo

openvpn_inc wrote Also, you did not show the iptables/nft output I requested.

Traffic is not blocked by iptables in any way. Please remember - it behaves the same on Windows (openvpn 2.x client works; openvpn 3 client - no internet).

# iptables -L
# Warning: iptables-legacy tables present, use iptables-legacy to see them
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  10.1.0.0/16          anywhere             /* generated for MicroK8s pods */
ACCEPT     all  --  anywhere             10.1.0.0/16          /* generated for MicroK8s pods */

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

mangoo

dazo wrote No, I meant openvpn2 - https://github.com/OpenVPN/openvpn3-linux/blob/master/docs/man/openvpn2.1.rst

Well:

# openvpn2 --config CONFIG_FILE --verb 6

** ERROR ** /usr/bin/openvpn2: error: unrecognized arguments: --auth-nocache

#

After commenting out the "auth-nocache" option from the config file - it connects, but there is no internet:

$ sudo openvpn2 --config CONFIG_FILE --verb 6
Press CTRL-C to stop the connection

2022-02-10 22:39:18.638264 [STATUS] (StatusMajor.CONNECTION, StatusMinor.CFG_OK) config_path=/net/openvpn/v3/configuration/80d80d90x07b4x4c9ax91c1xf898214ae44d
2022-02-10 22:39:18.638324 [LOG] Starting connection
2022-02-10 22:39:18.638350 [LOG] Using DNS resolver scope: global
2022-02-10 22:39:18.638371 [LOG] [Connect] DCO flag: disabled
2022-02-10 22:39:18.638391 [STATUS] (StatusMajor.CONNECTION, StatusMinor.CONN_CONNECTING) 
2022-02-10 22:39:18.638413 [LOG] OpenVPN core 3.git:HEAD:7765540e linux x86_64 64-bit OVPN-DCO
2022-02-10 22:39:18.638431 [LOG] Frame=512/2048/512 mssfix-ctrl=1250
2022-02-10 22:39:18.638449 [LOG] UNUSED OPTIONS
                                 8 [persist-tun]
                                 14 [verb] [6]
2022-02-10 22:39:18.638471 [LOG] Resolving
2022-02-10 22:39:18.638942 [LOG] Contacting aaa.bbb.ccc.ddd:1194 via UDP
2022-02-10 22:39:18.639113 [LOG] Waiting for server response
2022-02-10 22:39:18.643586 [LOG] Connecting to [aaa.bbb.ccc.ddd]:1194 (aaa.bbb.ccc.ddd) via UDPv4
2022-02-10 22:39:18.728414 [LOG] Connecting
2022-02-10 22:39:18.728631 [STATUS] (StatusMajor.CONNECTION, StatusMinor.CONN_CONNECTING) 
2022-02-10 22:39:18.728802 [LOG] Tunnel Options:V4,dev-type tun,link-mtu 1542,tun-mtu 1440,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client
2022-02-10 22:39:18.728933 [LOG] Creds: UsernameEmpty/PasswordEmpty
2022-02-10 22:39:18.729295 [LOG] Peer Info:
                                 IV_VER=3.git:HEAD:7765540e
                                 IV_PLAT=linux
                                 IV_NCP=2
                                 IV_TCPNL=1
                                 IV_PROTO=30
                                 IV_CIPHERS=AES-128-GCM:AES-192-GCM:AES-256-GCM:CHACHA20-POLY1305
                                 IV_LZO_STUB=1
                                 IV_COMP_STUB=1
                                 IV_COMP_STUBv2=1
                                 IV_AUTO_SESS=1
                                 IV_GUI_VER=OpenVPN 3/Linux v17_beta/3.git:HEAD:7765540e linux x86_64 64-bit
                                 IV_SSO=openurl,webauth
2022-02-10 22:39:18.789667 [LOG] VERIFY OK: depth=1, /CN=Easy-RSA CA, signature: RSA-SHA256
2022-02-10 22:39:18.790338 [LOG] VERIFY OK: depth=0, /CN=server, signature: RSA-SHA256
2022-02-10 22:39:18.861722 [LOG] SSL Handshake: peer certificate: CN=server, 4096 bit RSA, cipher: TLS_AES_256_GCM_SHA384  TLSv1.3 Kx=any      Au=any  Enc=AESGCM(256) Mac=AEAD
2022-02-10 22:39:18.861921 [LOG] Session is ACTIVE
2022-02-10 22:39:18.862308 [LOG] Retrieving configuration from server
2022-02-10 22:39:18.862489 [LOG] Sending PUSH_REQUEST to server...
2022-02-10 22:39:18.948344 [LOG] OPTIONS:
                                 0 [redirect-gateway] [def1] [bypass-dhcp]
                                 1 [dhcp-option] [DNS] [8.8.8.8]
                                 2 [dhcp-option] [DNS] [1.1.1.1]
                                 3 [redirect-gateway] [ipv6] [bypass-dhcp]
                                 4 [tun-ipv6]
                                 5 [route-gateway] [10.121.0.1]
                                 6 [topology] [subnet]
                                 7 [ping] [10]
                                 8 [ping-restart] [120]
                                 9 [ifconfig-ipv6] [fd42:feed:feed:feed::1003/64] [fd42:feed:feed:feed::1]
                                 10 [ifconfig] [10.121.0.5] [255.255.255.0]
                                 11 [peer-id] [3]
                                 12 [cipher] [AES-256-GCM]
2022-02-10 22:39:18.948694 [LOG] PROTOCOL OPTIONS:
                                   cipher: AES-256-GCM
                                   digest: NONE
                                   key-derivation: OpenVPN PRF
                                   compress: COMP_STUB
                                   peer ID: 3
                                   control channel: tls-crypt enabled
2022-02-10 22:39:18.976565 [LOG] Session name: 'aaa.bbb.ccc.ddd'
2022-02-10 22:39:19.038839 [LOG] TunPersist: saving tun context:
                                 Session Name: aaa.bbb.ccc.ddd
                                 Layer: OSI_LAYER_3
                                 MTU: 1440
                                 Remote Address: aaa.bbb.ccc.ddd
                                 Tunnel Addresses:
                                   10.121.0.5/24 -> 10.121.0.1
                                   fd42:feed:feed:feed::1003/64 -> fd42:feed:feed:feed::1 [IPv6]
                                 Reroute Gateway: IPv4=1 IPv6=1 flags=[ ENABLE REROUTE_GW DEF1 BYPASS_DHCP IPv4 IPv6 ]
                                 Block IPv4: no
                                 Block IPv6: no
                                 Add Routes:
                                 Exclude Routes:
                                 DNS Servers:
                                   8.8.8.8
                                   1.1.1.1
                                 Search Domains:
2022-02-10 22:39:19.038969 [LOG] Connected via tun
2022-02-10 22:39:19.039463 [LOG] LZO-ASYM init swap=0 asym=1
2022-02-10 22:39:19.039634 [LOG] Comp-stub init swap=1
2022-02-10 22:39:19.039710 [LOG] Connected: aaa.bbb.ccc.ddd:1194 (aaa.bbb.ccc.ddd) via /UDPv4 on tun/10.121.0.5/fd42:feed:feed:feed::1003 gw=[10.121.0.1/fd42:feed:feed:feed::1]
2022-02-10 22:39:19.039782 [STATUS] (StatusMajor.CONNECTION, StatusMinor.CONN_CONNECTED) 

^C
Disconnecting...
Connection statistics:
                     BYTES_IN: 196285
                    BYTES_OUT: 245803
                   PACKETS_IN: 740
                  PACKETS_OUT: 1167
                 TUN_BYTES_IN: 211891
                TUN_BYTES_OUT: 55460
               TUN_PACKETS_IN: 1154
              TUN_PACKETS_OUT: 350
               COMPRESS_ERROR: 378

^C
** ERROR ** local variable 'connected' referenced before assignment

#

mangoo

openvpn_inc wrote Hey mangoo,

Are you still getting the logged errors about bad source address? If so, select one of those destination addresses and show:

ip route get that.ip.add.ress

Yes - with openvpn2 and openvpn3 AND openvpn 2.5.1 client (I previously did not check the server with verb 6 and openvpn 2.5.1 client). However, with openvpn 2.5.1 client, internet just works.

On the server (aaa.bbb.ccc.ddd - public IP of the server):

# ip route get 192.168.1.19
192.168.1.19 via aaa.bbb.ccc.ddd dev enp35s0 src aaa.bbb.ccc.ddd uid 0 
    cache

On the client:

# ip route get 192.168.1.19
local 192.168.1.19 dev lo table local src 192.168.1.19 uid 1000 
    cache <local>

Interesting is, while the server keeps showing "MULTI: bad source address from client [192.168.1.19], packet dropped" - tcpdump run on the server does not show anything at all:

# tcpdump -i any -v -n host 192.168.1.19
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes

^C
0 packets captured
3 packets received by filter
0 packets dropped by kernel

Either way - that's some other minor issue probably, and maybe not related to my original issue (no internet with openvpn3 clients).

mangoo

dazo wrote
I see you're using AES-256-CBC here. This is actually considered a legacy cipher these days. Please use AES-256-GCM instead. Using that also removes the need to use "auth SHA512" (SHA512 is also not advisable, it adds an additional 32 bytes overhead with no security gain over SHA256 - Using SHA512 eats your tunnel performance). IIRC, using AES-256-GCM, the authentication overhead which is built into AES-GCM is just 12 bytes per packet all in all while SHA512 spends 64 bytes per packet.

"auth SHA512" was the problem here! Without it, all connectivity with openvpn3 client works just fine! Not sure if it's a bug or a feature though!

I've modified other parameters according to your suggestions - thanks for your help!

openvpn_inc

Hi mangoo,

Thanks for the update. That will give dazo and ordex something to puzzle over tomorrow. 🙂

regards, rob0

dazo

mangoo wrote
dazo wrote No, I meant openvpn2 - https://github.com/OpenVPN/openvpn3-linux/blob/master/docs/man/openvpn2.1.rst
Well:
# openvpn2 --config CONFIG_FILE --verb 6

** ERROR ** /usr/bin/openvpn2: error: unrecognized arguments: --auth-nocache

#
After commenting out the "auth-nocache" option from the config file - it connects, but there is no internet:

Good catch. I'll add that option to the "option ignore list" in the openvpn2 option parser. This option makes isn't really useful in OpenVPN 3 context.

mangoo wrote

$ sudo openvpn2 --config CONFIG_FILE --verb 6
Press CTRL-C to stop the connection

With OpenVPN 3 Linux, you don't need to run the openvpn2 and openvpn3 commands as root (like via sudo). OpenVPN 3 Linux is designed to allow unprivileged users start and manage their own VPN configuration profiles and sessions. Only the openvpn3-admin management tool requires root privileges on several of the operations.

mangoo wrote

** ERROR ** local variable 'connected' referenced before assignment

This is an interesting error. I'll try to get that fixed as well. This shouldn't appear.

dazo

mangoo wrote "auth SHA512" was the problem here! Without it, all connectivity with openvpn3 client works just fine! Not sure if it's a bug or a feature though!

I've modified other parameters according to your suggestions - thanks for your help!

Okay, it's good that this fixed it. It is however a bit surprising though. We will see if this is an issue in the OpenVPN 3 Core library. Thanks for the report.

« Previous Page