Upgrading OpenVPN 2.4.7 to 2.5.6 results in frequent disconnects

Letalis

Hi, when using OpenVPN 2.4.7 on my server and connecting from a 2.5.6 client, I can connect with no issue. However, when I try to use OpenVPN 2.5.6 on the server, I run into a big problem where at seemingly random intervals I get reconnected and therefore lose network connection in those few seconds it reconnects. This happens when using exactly the same server and client configurations, only difference is the 2.4.7 server doesn't disconnect (I want to upgrade to a 2.5 server in order to utilise its IPv6 functionality).

When this reconnect occurs, I get the following in the server log:

>LOG:1648810578,N,event_wait : Interrupted system call (code=4)
>LOG:1648810578,,SENT CONTROL [UNDEF]: 'RESTART' (status=1)

And on the client I get this message:

2022-04-01 11:56:18 us=284484 Connection reset command was pushed by server ('')
2022-04-01 11:56:18 us=284568 TCP/UDP: Closing socket
2022-04-01 11:56:18 us=284588 SIGUSR1[soft,server-pushed-connection-reset] received, process restarting
2022-04-01 11:56:18 us=284599 Restart pause, 5 second(s)

So for some reason the server is causing a connection reset, but I have no change in my server or client configurations.

My server config on both 2.4.7 and 2.5.6 versions is the following:

local 192.168.0.27
port 69
proto udp
dev tun0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.254.0
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"
push "redirect-gateway def1 bypass-dhcp"
push "route 192.168.0.0 255.255.0.0 net_gateway"
push "route 172.16.0.0 255.240.0.0 net_gateway"
push "explicit-exit-notify 2"
cipher AES-256-CBC
persist-key
persist-tun
ping-exit 150
ping 10
ping-restart 120
push "ping 10"
push "ping-restart 120"
ping-timer-rem
status openvpn-status.log
verb 4
crl-verify crl.pem
explicit-exit-notify
management localhost 7505
script-security 3
max-clients 100
auth-user-pass-verify /etc/openvpn/server/clientCheck.sh via-env
verify-client-cert none

My client config (2.5.6) is the following:

client
dev tun
proto udp
remote 192.168.0.27 69
resolv-retry infinite
ignore-unknown-option block-outside-dns block-ipv6
nobind
persist-key
persist-tun
remote-random
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
explicit-exit-notify 2
verb 4
auth-user-pass
pull
<ca>

</ca>
<cert>

</cert>
<key>

</key>
<tls-crypt>

</tls-crypt>

What can I try to stop this reconnecting? Thanks.

TinCanTech

Try this in your server:

# push "redirect-gateway def1 bypass-dhcp"
push "redirect-gateway def1 bypass-dhcp auto-local"

Letalis

That's not changed anything unfortunately. I still get the same reconnect message.

TinCanTech

Please add full logs at verb 4

Letalis

Full logs on verb 4 from starting the connection to me manually disconnecting with Ctrl-C after the reconnect occurs once:

Server:

>LOG:1648820497,,MULTI: multi_create_instance called
>LOG:1648820497,,192.168.0.23:36994 Re-using SSL/TLS context
>LOG:1648820497,,192.168.0.23:36994 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
>LOG:1648820497,,192.168.0.23:36994 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
>LOG:1648820497,,192.168.0.23:36994 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
>LOG:1648820497,,192.168.0.23:36994 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
>LOG:1648820497,,192.168.0.23:36994 Control Channel MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
>LOG:1648820497,,192.168.0.23:36994 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
>LOG:1648820497,,192.168.0.23:36994 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
>LOG:1648820497,,192.168.0.23:36994 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
>LOG:1648820497,,192.168.0.23:36994 TLS: Initial packet from [AF_INET]192.168.0.23:36994, sid=1d0d32ec 33cc9941
>LOG:1648820497,I,192.168.0.23:36994 peer info: IV_VER=2.5.6
>LOG:1648820497,I,192.168.0.23:36994 peer info: IV_PLAT=linux
>LOG:1648820497,I,192.168.0.23:36994 peer info: IV_PROTO=6
>LOG:1648820497,I,192.168.0.23:36994 peer info: IV_NCP=2
>LOG:1648820497,I,192.168.0.23:36994 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM:AES-256-CBC
>LOG:1648820497,I,192.168.0.23:36994 peer info: IV_LZ4=1
>LOG:1648820497,I,192.168.0.23:36994 peer info: IV_LZ4v2=1
>LOG:1648820497,I,192.168.0.23:36994 peer info: IV_LZO=1
>LOG:1648820497,I,192.168.0.23:36994 peer info: IV_COMP_STUB=1
>LOG:1648820497,I,192.168.0.23:36994 peer info: IV_COMP_STUBv2=1
>LOG:1648820497,I,192.168.0.23:36994 peer info: IV_TCPNL=1
>LOG:1648820498,,192.168.0.23:36994 TLS: Username/Password authentication succeeded for username 'user'
>LOG:1648820498,,192.168.0.23:36994 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384
>LOG:1648820498,I,192.168.0.23:36994 [] Peer Connection Initiated with [AF_INET]192.168.0.23:36994
>LOG:1648820498,I,192.168.0.23:36994 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
>LOG:1648820498,,192.168.0.23:36994 MULTI: Learn: 10.8.0.2 -> 192.168.0.23:36994
>LOG:1648820498,,192.168.0.23:36994 MULTI: primary virtual IP for 192.168.0.23:36994: 10.8.0.2
>LOG:1648820498,,192.168.0.23:36994 Data Channel: using negotiated cipher 'AES-256-GCM'
>LOG:1648820498,,192.168.0.23:36994 Data Channel MTU parms [ L:1549 D:1450 EF:49 EB:406 ET:0 EL:3 ]
>LOG:1648820498,,192.168.0.23:36994 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
>LOG:1648820498,,192.168.0.23:36994 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
>LOG:1648820498,,192.168.0.23:36994 SENT CONTROL [UNDEF]: 'PUSH_REPLY,dhcp-option DNS 1.1.1.1,dhcp-option DNS 1.0.0.1,ifconfig-ipv6 fd15:53b6:dead::2/64 fd15:53b6:dead::1,redirect-gateway def1 ipv6 bypass-dhcp,route 192.168.0.0 255.255.0.0 net_gateway,route 172.16.0.0 255.240.0.0 net_gateway,block-ipv6,explicit-exit-notify 2,ping 10,ping-restart 120,route-gateway 10.8.0.1,topology subnet,ifconfig 10.8.0.2 255.255.254.0,peer-id 0,cipher AES-256-GCM' (status=1)
>CLIENT:ESTABLISHED,0
>CLIENT:ENV,n_clients=1
>CLIENT:ENV,script_type=learn-address
>CLIENT:ENV,time_unix=1648820497
>CLIENT:ENV,time_ascii=2022-04-01 13:41:37
>CLIENT:ENV,ifconfig_pool_netmask=255.255.254.0
>CLIENT:ENV,ifconfig_pool_remote_ip=10.8.0.2
>CLIENT:ENV,trusted_port=36994
>CLIENT:ENV,trusted_ip=192.168.0.23
>CLIENT:ENV,untrusted_port=36994
>CLIENT:ENV,untrusted_ip=192.168.0.23
>CLIENT:ENV,username=user
>CLIENT:ENV,IV_TCPNL=1
>CLIENT:ENV,IV_COMP_STUBv2=1
>CLIENT:ENV,IV_COMP_STUB=1
>CLIENT:ENV,IV_LZO=1
>CLIENT:ENV,IV_LZ4v2=1
>CLIENT:ENV,IV_LZ4=1
>CLIENT:ENV,IV_CIPHERS=AES-256-GCM:AES-128-GCM:AES-256-CBC
>CLIENT:ENV,IV_NCP=2
>CLIENT:ENV,IV_PROTO=6
>CLIENT:ENV,IV_PLAT=linux
>CLIENT:ENV,IV_VER=2.5.6
>CLIENT:ENV,remote_port_1=69
>CLIENT:ENV,local_port_1=69
>CLIENT:ENV,local_1=192.168.0.27
>CLIENT:ENV,proto_1=udp
>CLIENT:ENV,daemon_pid=789
>CLIENT:ENV,daemon_start_time=1648820456
>CLIENT:ENV,daemon_log_redirect=0
>CLIENT:ENV,daemon=0
>CLIENT:ENV,verb=0
>CLIENT:ENV,config=server.conf
>CLIENT:ENV,ifconfig_local=10.8.0.1
>CLIENT:ENV,ifconfig_netmask=255.255.254.0
>CLIENT:ENV,script_context=init
>CLIENT:ENV,tun_mtu=1500
>CLIENT:ENV,link_mtu=1621
>CLIENT:ENV,dev=tun0
>CLIENT:ENV,dev_type=tun
>CLIENT:ENV,redirect_gateway=0
>CLIENT:ENV,END
>LOG:1648820544,N,event_wait : Interrupted system call (code=4)
>LOG:1648820544,,SENT CONTROL [UNDEF]: 'RESTART' (status=1)
>LOG:1648820547,,TCP/UDP: Closing socket
>LOG:1648820547,,Closing TUN/TAP interface
>LOG:1648820547,I,/sbin/ip addr del dev tun0 10.8.0.1/23
>LOG:1648820547,I,SIGTERM[hard,] received, process exiting

Client:

2022-04-01 14:41:37 us=328971 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
2022-04-01 14:41:37 us=329059 WARNING: file 'user' is group or others accessible
2022-04-01 14:41:37 us=329066 Current Parameter Settings:
2022-04-01 14:41:37 us=329071   config = 'retrieved.ovpn'
2022-04-01 14:41:37 us=329075   mode = 0
2022-04-01 14:41:37 us=329079   persist_config = DISABLED
2022-04-01 14:41:37 us=329083   persist_mode = 1
2022-04-01 14:41:37 us=329086   show_ciphers = DISABLED
2022-04-01 14:41:37 us=329089   show_digests = DISABLED
2022-04-01 14:41:37 us=329092   show_engines = DISABLED
2022-04-01 14:41:37 us=329097   genkey = DISABLED
2022-04-01 14:41:37 us=329101   genkey_filename = '[UNDEF]'
2022-04-01 14:41:37 us=329104   key_pass_file = '[UNDEF]'
2022-04-01 14:41:37 us=329107   show_tls_ciphers = DISABLED
2022-04-01 14:41:37 us=329110   connect_retry_max = 0
2022-04-01 14:41:37 us=329114 Connection profiles [0]:
2022-04-01 14:41:37 us=329117   proto = udp
2022-04-01 14:41:37 us=329120   local = '[UNDEF]'
2022-04-01 14:41:37 us=329123   local_port = '[UNDEF]'
2022-04-01 14:41:37 us=329126   remote = '192.168.0.27'
2022-04-01 14:41:37 us=329130   remote_port = '69'
2022-04-01 14:41:37 us=329133   remote_float = DISABLED
2022-04-01 14:41:37 us=329136   bind_defined = DISABLED
2022-04-01 14:41:37 us=329139   bind_local = DISABLED
2022-04-01 14:41:37 us=329142   bind_ipv6_only = DISABLED
2022-04-01 14:41:37 us=329145   connect_retry_seconds = 5
2022-04-01 14:41:37 us=329148   connect_timeout = 120
2022-04-01 14:41:37 us=329152   socks_proxy_server = '[UNDEF]'
2022-04-01 14:41:37 us=329155   socks_proxy_port = '[UNDEF]'
2022-04-01 14:41:37 us=329158   tun_mtu = 1500
2022-04-01 14:41:37 us=329161   tun_mtu_defined = ENABLED
2022-04-01 14:41:37 us=329165   link_mtu = 1500
2022-04-01 14:41:37 us=329168   link_mtu_defined = DISABLED
2022-04-01 14:41:37 us=329171   tun_mtu_extra = 0
2022-04-01 14:41:37 us=329174   tun_mtu_extra_defined = DISABLED
2022-04-01 14:41:37 us=329177   mtu_discover_type = -1
2022-04-01 14:41:37 us=329180   fragment = 0
2022-04-01 14:41:37 us=329183   mssfix = 1450
2022-04-01 14:41:37 us=329187   explicit_exit_notification = 2
2022-04-01 14:41:37 us=329190   tls_auth_file = '[UNDEF]'
2022-04-01 14:41:37 us=329193   key_direction = not set
2022-04-01 14:41:37 us=329196   tls_crypt_file = '[INLINE]'
2022-04-01 14:41:37 us=329200   tls_crypt_v2_file = '[UNDEF]'
2022-04-01 14:41:37 us=329203 Connection profiles END
2022-04-01 14:41:37 us=329206   remote_random = ENABLED
2022-04-01 14:41:37 us=329209   ipchange = '[UNDEF]'
2022-04-01 14:41:37 us=329212   dev = 'tun'
2022-04-01 14:41:37 us=329215   dev_type = '[UNDEF]'
2022-04-01 14:41:37 us=329218   dev_node = '[UNDEF]'
2022-04-01 14:41:37 us=329221   lladdr = '[UNDEF]'
2022-04-01 14:41:37 us=329225   topology = 1
2022-04-01 14:41:37 us=329228   ifconfig_local = '[UNDEF]'
2022-04-01 14:41:37 us=329231   ifconfig_remote_netmask = '[UNDEF]'
2022-04-01 14:41:37 us=329234   ifconfig_noexec = DISABLED
2022-04-01 14:41:37 us=329237   ifconfig_nowarn = DISABLED
2022-04-01 14:41:37 us=329240   ifconfig_ipv6_local = '[UNDEF]'
2022-04-01 14:41:37 us=329244   ifconfig_ipv6_netbits = 0
2022-04-01 14:41:37 us=329247   ifconfig_ipv6_remote = '[UNDEF]'
2022-04-01 14:41:37 us=329250   shaper = 0
2022-04-01 14:41:37 us=329253   mtu_test = 0
2022-04-01 14:41:37 us=329256   mlock = DISABLED
2022-04-01 14:41:37 us=329259   keepalive_ping = 0
2022-04-01 14:41:37 us=329262   keepalive_timeout = 0
2022-04-01 14:41:37 us=329266   inactivity_timeout = 0
2022-04-01 14:41:37 us=329269   inactivity_minimum_bytes = 0
2022-04-01 14:41:37 us=329272   ping_send_timeout = 0
2022-04-01 14:41:37 us=329275   ping_rec_timeout = 0
2022-04-01 14:41:37 us=329278   ping_rec_timeout_action = 0
2022-04-01 14:41:37 us=329282   ping_timer_remote = DISABLED
2022-04-01 14:41:37 us=329285   remap_sigusr1 = 0
2022-04-01 14:41:37 us=329288   persist_tun = ENABLED
2022-04-01 14:41:37 us=329291   persist_local_ip = DISABLED
2022-04-01 14:41:37 us=329294   persist_remote_ip = DISABLED
2022-04-01 14:41:37 us=329297   persist_key = ENABLED
2022-04-01 14:41:37 us=329300   passtos = DISABLED
2022-04-01 14:41:37 us=329303   resolve_retry_seconds = 1000000000
2022-04-01 14:41:37 us=329307   resolve_in_advance = DISABLED
2022-04-01 14:41:37 us=329310   username = '[UNDEF]'
2022-04-01 14:41:37 us=329313   groupname = '[UNDEF]'
2022-04-01 14:41:37 us=329328   chroot_dir = '[UNDEF]'
2022-04-01 14:41:37 us=329335   cd_dir = '[UNDEF]'
2022-04-01 14:41:37 us=329338   writepid = '[UNDEF]'
2022-04-01 14:41:37 us=329341   up_script = '[UNDEF]'
2022-04-01 14:41:37 us=329344   down_script = '[UNDEF]'
2022-04-01 14:41:37 us=329347   down_pre = DISABLED
2022-04-01 14:41:37 us=329350   up_restart = DISABLED
2022-04-01 14:41:37 us=329354   up_delay = DISABLED
2022-04-01 14:41:37 us=329357   daemon = DISABLED
2022-04-01 14:41:37 us=329360   inetd = 0
2022-04-01 14:41:37 us=329363   log = DISABLED
2022-04-01 14:41:37 us=329366   suppress_timestamps = DISABLED
2022-04-01 14:41:37 us=329369   machine_readable_output = DISABLED
2022-04-01 14:41:37 us=329372   nice = 0
2022-04-01 14:41:37 us=329375   verbosity = 4
2022-04-01 14:41:37 us=329378   mute = 0
2022-04-01 14:41:37 us=329381   status_file = '[UNDEF]'
2022-04-01 14:41:37 us=329384   status_file_version = 1
2022-04-01 14:41:37 us=329387   status_file_update_freq = 60
2022-04-01 14:41:37 us=329391   occ = ENABLED
2022-04-01 14:41:37 us=329394   rcvbuf = 0
2022-04-01 14:41:37 us=329397   sndbuf = 0
2022-04-01 14:41:37 us=329401   mark = 0
2022-04-01 14:41:37 us=329405   sockflags = 0
2022-04-01 14:41:37 us=329408   fast_io = DISABLED
2022-04-01 14:41:37 us=329411   comp.alg = 0
2022-04-01 14:41:37 us=329415   comp.flags = 0
2022-04-01 14:41:37 us=329418   route_script = '[UNDEF]'
2022-04-01 14:41:37 us=329421   route_default_gateway = '[UNDEF]'
2022-04-01 14:41:37 us=329424   route_default_metric = 0
2022-04-01 14:41:37 us=329427   route_noexec = DISABLED
2022-04-01 14:41:37 us=329431   route_delay = 0
2022-04-01 14:41:37 us=329434   route_delay_window = 30
2022-04-01 14:41:37 us=329437   route_delay_defined = DISABLED
2022-04-01 14:41:37 us=329440   route_nopull = DISABLED
2022-04-01 14:41:37 us=329443   route_gateway_via_dhcp = DISABLED
2022-04-01 14:41:37 us=329447   allow_pull_fqdn = DISABLED
2022-04-01 14:41:37 us=329450   management_addr = '[UNDEF]'
2022-04-01 14:41:37 us=329453   management_port = '[UNDEF]'
2022-04-01 14:41:37 us=329456   management_user_pass = '[UNDEF]'
2022-04-01 14:41:37 us=329460   management_log_history_cache = 250
2022-04-01 14:41:37 us=329463   management_echo_buffer_size = 100
2022-04-01 14:41:37 us=329467   management_write_peer_info_file = '[UNDEF]'
2022-04-01 14:41:37 us=329470   management_client_user = '[UNDEF]'
2022-04-01 14:41:37 us=329474   management_client_group = '[UNDEF]'
2022-04-01 14:41:37 us=329477   management_flags = 0
2022-04-01 14:41:37 us=329480   shared_secret_file = '[UNDEF]'
2022-04-01 14:41:37 us=329483   key_direction = not set
2022-04-01 14:41:37 us=329487   ciphername = 'AES-256-CBC'
2022-04-01 14:41:37 us=329490   ncp_enabled = ENABLED
2022-04-01 14:41:37 us=329493   ncp_ciphers = 'AES-256-GCM:AES-128-GCM:AES-256-CBC'
2022-04-01 14:41:37 us=329496   authname = 'SHA512'
2022-04-01 14:41:37 us=329499   prng_hash = 'SHA1'
2022-04-01 14:41:37 us=329503   prng_nonce_secret_len = 16
2022-04-01 14:41:37 us=329506   keysize = 0
2022-04-01 14:41:37 us=329509   engine = DISABLED
2022-04-01 14:41:37 us=329512   replay = ENABLED
2022-04-01 14:41:37 us=329515   mute_replay_warnings = DISABLED
2022-04-01 14:41:37 us=329519   replay_window = 64
2022-04-01 14:41:37 us=329522   replay_time = 15
2022-04-01 14:41:37 us=329525   packet_id_file = '[UNDEF]'
2022-04-01 14:41:37 us=329528   test_crypto = DISABLED
2022-04-01 14:41:37 us=329531   tls_server = DISABLED
2022-04-01 14:41:37 us=329534   tls_client = ENABLED
2022-04-01 14:41:37 us=329538   ca_file = '[INLINE]'
2022-04-01 14:41:37 us=329541   ca_path = '[UNDEF]'
2022-04-01 14:41:37 us=329544   dh_file = '[UNDEF]'
2022-04-01 14:41:37 us=329547   cert_file = '[INLINE]'
2022-04-01 14:41:37 us=329551   extra_certs_file = '[UNDEF]'
2022-04-01 14:41:37 us=329554   priv_key_file = '[INLINE]'
2022-04-01 14:41:37 us=329557   pkcs12_file = '[UNDEF]'
2022-04-01 14:41:37 us=329560   cipher_list = '[UNDEF]'
2022-04-01 14:41:37 us=329563   cipher_list_tls13 = '[UNDEF]'
2022-04-01 14:41:37 us=329567   tls_cert_profile = '[UNDEF]'
2022-04-01 14:41:37 us=329570   tls_verify = '[UNDEF]'
2022-04-01 14:41:37 us=329573   tls_export_cert = '[UNDEF]'
2022-04-01 14:41:37 us=329576   verify_x509_type = 0
2022-04-01 14:41:37 us=329579   verify_x509_name = '[UNDEF]'
2022-04-01 14:41:37 us=329582   crl_file = '[UNDEF]'
2022-04-01 14:41:37 us=329586   ns_cert_type = 0
2022-04-01 14:41:37 us=329589   remote_cert_ku[i] = 65535
2022-04-01 14:41:37 us=329592   remote_cert_ku[i] = 0
2022-04-01 14:41:37 us=329595   remote_cert_ku[i] = 0
2022-04-01 14:41:37 us=329598   remote_cert_ku[i] = 0
2022-04-01 14:41:37 us=329601   remote_cert_ku[i] = 0
2022-04-01 14:41:37 us=329604   remote_cert_ku[i] = 0
2022-04-01 14:41:37 us=329607   remote_cert_ku[i] = 0
2022-04-01 14:41:37 us=329611   remote_cert_ku[i] = 0
2022-04-01 14:41:37 us=329614   remote_cert_ku[i] = 0
2022-04-01 14:41:37 us=329617   remote_cert_ku[i] = 0
2022-04-01 14:41:37 us=329620   remote_cert_ku[i] = 0
2022-04-01 14:41:37 us=329623   remote_cert_ku[i] = 0
2022-04-01 14:41:37 us=329626   remote_cert_ku[i] = 0
2022-04-01 14:41:37 us=329629   remote_cert_ku[i] = 0
2022-04-01 14:41:37 us=329632   remote_cert_ku[i] = 0
2022-04-01 14:41:37 us=329635   remote_cert_ku[i] = 0
2022-04-01 14:41:37 us=329639   remote_cert_eku = 'TLS Web Server Authentication'
2022-04-01 14:41:37 us=329644   ssl_flags = 0
2022-04-01 14:41:37 us=329647   tls_timeout = 2
2022-04-01 14:41:37 us=329650   renegotiate_bytes = -1
2022-04-01 14:41:37 us=329653   renegotiate_packets = 0
2022-04-01 14:41:37 us=329656   renegotiate_seconds = 3600
2022-04-01 14:41:37 us=329660   handshake_window = 60
2022-04-01 14:41:37 us=329663   transition_window = 3600
2022-04-01 14:41:37 us=329666   single_session = DISABLED
2022-04-01 14:41:37 us=329669   push_peer_info = DISABLED
2022-04-01 14:41:37 us=329672   tls_exit = DISABLED
2022-04-01 14:41:37 us=329675   tls_crypt_v2_metadata = '[UNDEF]'
2022-04-01 14:41:37 us=329680   server_network = 0.0.0.0
2022-04-01 14:41:37 us=329684   server_netmask = 0.0.0.0
2022-04-01 14:41:37 us=329688   server_network_ipv6 = ::
2022-04-01 14:41:37 us=329691   server_netbits_ipv6 = 0
2022-04-01 14:41:37 us=329695   server_bridge_ip = 0.0.0.0
2022-04-01 14:41:37 us=329699   server_bridge_netmask = 0.0.0.0
2022-04-01 14:41:37 us=329703   server_bridge_pool_start = 0.0.0.0
2022-04-01 14:41:37 us=329706   server_bridge_pool_end = 0.0.0.0
2022-04-01 14:41:37 us=329710   ifconfig_pool_defined = DISABLED
2022-04-01 14:41:37 us=329714   ifconfig_pool_start = 0.0.0.0
2022-04-01 14:41:37 us=329717   ifconfig_pool_end = 0.0.0.0
2022-04-01 14:41:37 us=329721   ifconfig_pool_netmask = 0.0.0.0
2022-04-01 14:41:37 us=329724   ifconfig_pool_persist_filename = '[UNDEF]'
2022-04-01 14:41:37 us=329728   ifconfig_pool_persist_refresh_freq = 600
2022-04-01 14:41:37 us=329731   ifconfig_ipv6_pool_defined = DISABLED
2022-04-01 14:41:37 us=329735   ifconfig_ipv6_pool_base = ::
2022-04-01 14:41:37 us=329738   ifconfig_ipv6_pool_netbits = 0
2022-04-01 14:41:37 us=329741   n_bcast_buf = 256
2022-04-01 14:41:37 us=329744   tcp_queue_limit = 64
2022-04-01 14:41:37 us=329747   real_hash_size = 256
2022-04-01 14:41:37 us=329751   virtual_hash_size = 256
2022-04-01 14:41:37 us=329754   client_connect_script = '[UNDEF]'
2022-04-01 14:41:37 us=329757   learn_address_script = '[UNDEF]'
2022-04-01 14:41:37 us=329760   client_disconnect_script = '[UNDEF]'
2022-04-01 14:41:37 us=329763   client_config_dir = '[UNDEF]'
2022-04-01 14:41:37 us=329767   ccd_exclusive = DISABLED
2022-04-01 14:41:37 us=329770   tmp_dir = '/tmp'
2022-04-01 14:41:37 us=329773   push_ifconfig_defined = DISABLED
2022-04-01 14:41:37 us=329776   push_ifconfig_local = 0.0.0.0
2022-04-01 14:41:37 us=329780   push_ifconfig_remote_netmask = 0.0.0.0
2022-04-01 14:41:37 us=329783   push_ifconfig_ipv6_defined = DISABLED
2022-04-01 14:41:37 us=329787   push_ifconfig_ipv6_local = ::/0
2022-04-01 14:41:37 us=329790   push_ifconfig_ipv6_remote = ::
2022-04-01 14:41:37 us=329794   enable_c2c = DISABLED
2022-04-01 14:41:37 us=329797   duplicate_cn = DISABLED
2022-04-01 14:41:37 us=329800   cf_max = 0
2022-04-01 14:41:37 us=329803   cf_per = 0
2022-04-01 14:41:37 us=329806   max_clients = 1024
2022-04-01 14:41:37 us=329809   max_routes_per_client = 256
2022-04-01 14:41:37 us=329813   auth_user_pass_verify_script = '[UNDEF]'
2022-04-01 14:41:37 us=329826   auth_user_pass_verify_script_via_file = DISABLED
2022-04-01 14:41:37 us=329831   auth_token_generate = DISABLED
2022-04-01 14:41:37 us=329834   auth_token_lifetime = 0
2022-04-01 14:41:37 us=329837   auth_token_secret_file = '[UNDEF]'
2022-04-01 14:41:37 us=329840   port_share_host = '[UNDEF]'
2022-04-01 14:41:37 us=329844   port_share_port = '[UNDEF]'
2022-04-01 14:41:37 us=329847   vlan_tagging = DISABLED
2022-04-01 14:41:37 us=329850   vlan_accept = all
2022-04-01 14:41:37 us=329853   vlan_pvid = 1
2022-04-01 14:41:37 us=329856   client = ENABLED
2022-04-01 14:41:37 us=329859   pull = ENABLED
2022-04-01 14:41:37 us=329863   auth_user_pass_file = 'user'
2022-04-01 14:41:37 us=329867 OpenVPN 2.5.6 i686-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Mar 27 2022
2022-04-01 14:41:37 us=329871 library versions: OpenSSL 1.1.1k  25 Mar 2021, LZO 2.10
2022-04-01 14:41:37 us=330306 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2022-04-01 14:41:37 us=330653 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2022-04-01 14:41:37 us=330692 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2022-04-01 14:41:37 us=330725 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2022-04-01 14:41:37 us=330791 Control Channel MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
2022-04-01 14:41:37 us=330907 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
2022-04-01 14:41:37 us=331207 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
2022-04-01 14:41:37 us=331239 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
2022-04-01 14:41:37 us=331271 TCP/UDP: Preserving recently used remote address: [AF_INET]192.168.0.27:69
2022-04-01 14:41:37 us=331309 Socket Buffers: R=[212992->212992] S=[212992->212992]
2022-04-01 14:41:37 us=331377 UDP link local: (not bound)
2022-04-01 14:41:37 us=331409 UDP link remote: [AF_INET]192.168.0.27:69
2022-04-01 14:41:37 us=332546 TLS: Initial packet from [AF_INET]192.168.0.27:69, sid=bc6df6e5 035e6777
2022-04-01 14:41:37 us=339659 VERIFY OK: depth=1, CN=ChangeMe
2022-04-01 14:41:37 us=340019 VERIFY KU OK
2022-04-01 14:41:37 us=340071 Validating certificate extended key usage
2022-04-01 14:41:37 us=340109 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2022-04-01 14:41:37 us=340147 VERIFY EKU OK
2022-04-01 14:41:37 us=340184 VERIFY OK: depth=0, CN=server
2022-04-01 14:41:38 us=592175 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA256
2022-04-01 14:41:38 us=592238 [server] Peer Connection Initiated with [AF_INET]192.168.0.27:69
2022-04-01 14:41:38 us=657088 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 1.1.1.1,dhcp-option DNS 1.0.0.1,ifconfig-ipv6 fd15:53b6:dead::2/64 fd15:53b6:dead::1,redirect-gateway def1 ipv6 bypass-dhcp,route 192.168.0.0 255.255.0.0 net_gateway,route 172.16.0.0 255.240.0.0 net_gateway,block-ipv6,explicit-exit-notify 2,ping 10,ping-restart 120,route-gateway 10.8.0.1,topology subnet,ifconfig 10.8.0.2 255.255.254.0,peer-id 0,cipher AES-256-GCM'
2022-04-01 14:41:38 us=657173 OPTIONS IMPORT: timers and/or timeouts modified
2022-04-01 14:41:38 us=657178 OPTIONS IMPORT: explicit notify parm(s) modified
2022-04-01 14:41:38 us=657182 OPTIONS IMPORT: --ifconfig/up options modified
2022-04-01 14:41:38 us=657185 OPTIONS IMPORT: route options modified
2022-04-01 14:41:38 us=657188 OPTIONS IMPORT: route-related options modified
2022-04-01 14:41:38 us=657191 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2022-04-01 14:41:38 us=657194 OPTIONS IMPORT: peer-id set
2022-04-01 14:41:38 us=657197 OPTIONS IMPORT: adjusting link_mtu to 1624
2022-04-01 14:41:38 us=657200 OPTIONS IMPORT: data channel crypto options modified
2022-04-01 14:41:38 us=657204 Data Channel: using negotiated cipher 'AES-256-GCM'
2022-04-01 14:41:38 us=657213 Data Channel MTU parms [ L:1552 D:1450 EF:52 EB:406 ET:0 EL:3 ]
2022-04-01 14:41:38 us=657271 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2022-04-01 14:41:38 us=657277 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2022-04-01 14:41:38 us=657371 GDG6: remote_host_ipv6=n/a
2022-04-01 14:41:38 us=657377 net_route_v6_best_gw query: dst ::
2022-04-01 14:41:38 us=657409 sitnl_send: rtnl: generic error (-101): Network is unreachable
2022-04-01 14:41:38 us=657599 TUN/TAP device tun0 opened
2022-04-01 14:41:38 us=657609 do_ifconfig, ipv4=1, ipv6=1
2022-04-01 14:41:38 us=657617 /sbin/ip link set dev tun0 up mtu 1500
2022-04-01 14:41:38 us=668272 /sbin/ip link set dev tun0 up
2022-04-01 14:41:38 us=670403 /sbin/ip addr add dev tun0 10.8.0.2/23
2022-04-01 14:41:38 us=675819 /sbin/ip link set dev tun0 up mtu 1500
2022-04-01 14:41:38 us=678441 /sbin/ip link set dev tun0 up
2022-04-01 14:41:38 us=682731 /sbin/ip -6 addr add fd15:53b6:dead::2/64 dev tun0
2022-04-01 14:41:38 us=687931 /sbin/ip route add 192.168.0.27/32 dev enp0s3 via 192.168.0.1
2022-04-01 14:41:38 us=691565 /sbin/ip route add 0.0.0.0/1 via 10.8.0.1
2022-04-01 14:41:38 us=696089 /sbin/ip route add 128.0.0.0/1 via 10.8.0.1
2022-04-01 14:41:38 us=715583 /sbin/ip route add 192.168.0.0/16 via 192.168.0.1
2022-04-01 14:41:38 us=716459 /sbin/ip route add 172.16.0.0/12 via 192.168.0.1
2022-04-01 14:41:38 us=726729 add_route_ipv6(::/3 -> fd15:53b6:dead::1 metric -1) dev tun0
2022-04-01 14:41:38 us=726806 /sbin/ip -6 route add ::/3 dev tun0
2022-04-01 14:41:38 us=728565 add_route_ipv6(2000::/4 -> fd15:53b6:dead::1 metric -1) dev tun0
2022-04-01 14:41:38 us=728635 /sbin/ip -6 route add 2000::/4 dev tun0
2022-04-01 14:41:38 us=733016 add_route_ipv6(3000::/4 -> fd15:53b6:dead::1 metric -1) dev tun0
2022-04-01 14:41:38 us=733123 /sbin/ip -6 route add 3000::/4 dev tun0
2022-04-01 14:41:38 us=738492 add_route_ipv6(fc00::/7 -> fd15:53b6:dead::1 metric -1) dev tun0
2022-04-01 14:41:38 us=738570 /sbin/ip -6 route add fc00::/7 dev tun0
2022-04-01 14:41:38 us=742631 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2022-04-01 14:41:38 us=742695 Initialization Sequence Completed
2022-04-01 14:42:24 us=580858 Connection reset command was pushed by server ('')
2022-04-01 14:42:24 us=580942 TCP/UDP: Closing socket
2022-04-01 14:42:24 us=580964 SIGUSR1[soft,server-pushed-connection-reset] received, process restarting
2022-04-01 14:42:24 us=580974 Restart pause, 5 second(s)
2022-04-01 14:42:29 us=581240 Re-using SSL/TLS context
2022-04-01 14:42:29 us=581307 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2022-04-01 14:42:29 us=581318 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2022-04-01 14:42:29 us=581324 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2022-04-01 14:42:29 us=581330 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2022-04-01 14:42:29 us=581375 Control Channel MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
2022-04-01 14:42:29 us=581385 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
2022-04-01 14:42:29 us=581399 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
2022-04-01 14:42:29 us=581403 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
2022-04-01 14:42:29 us=581412 TCP/UDP: Preserving recently used remote address: [AF_INET]192.168.0.27:69
2022-04-01 14:42:29 us=581431 Socket Buffers: R=[212992->212992] S=[212992->212992]
2022-04-01 14:42:29 us=581436 UDP link local: (not bound)
2022-04-01 14:42:29 us=581440 UDP link remote: [AF_INET]192.168.0.27:69
2022-04-01 14:42:29 us=587051 read UDP [ECONNREFUSED]: Connection refused (code=111)
2022-04-01 14:42:31 us=212072 read UDP [ECONNREFUSED]: Connection refused (code=111)
2022-04-01 14:42:35 us=307920 TLS: Initial packet from [AF_INET]192.168.0.27:69, sid=e4237ce7 0287bc59
2022-04-01 14:42:35 us=319326 VERIFY OK: depth=1, CN=ChangeMe
2022-04-01 14:42:35 us=319583 VERIFY KU OK
2022-04-01 14:42:35 us=319589 Validating certificate extended key usage
2022-04-01 14:42:35 us=319594 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2022-04-01 14:42:35 us=319597 VERIFY EKU OK
2022-04-01 14:42:35 us=319601 VERIFY OK: depth=0, CN=server
2022-04-01 14:42:36 us=512720 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA256
2022-04-01 14:42:36 us=512758 [server] Peer Connection Initiated with [AF_INET]192.168.0.27:69
2022-04-01 14:42:36 us=532130 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 1.1.1.1,dhcp-option DNS 1.0.0.1,ifconfig-ipv6 fd15:53b6:dead::2/64 fd15:53b6:dead::1,redirect-gateway def1 ipv6 bypass-dhcp,route 192.168.0.0 255.255.0.0 net_gateway,route 172.16.0.0 255.240.0.0 net_gateway,block-ipv6,explicit-exit-notify 2,ping 10,ping-restart 120,route-gateway 10.8.0.1,topology subnet,ifconfig 10.8.0.2 255.255.254.0,peer-id 0,cipher AES-256-GCM'
2022-04-01 14:42:36 us=532227 OPTIONS IMPORT: timers and/or timeouts modified
2022-04-01 14:42:36 us=532234 OPTIONS IMPORT: explicit notify parm(s) modified
2022-04-01 14:42:36 us=532238 OPTIONS IMPORT: --ifconfig/up options modified
2022-04-01 14:42:36 us=532241 OPTIONS IMPORT: route options modified
2022-04-01 14:42:36 us=532244 OPTIONS IMPORT: route-related options modified
2022-04-01 14:42:36 us=532247 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2022-04-01 14:42:36 us=532250 OPTIONS IMPORT: peer-id set
2022-04-01 14:42:36 us=532253 OPTIONS IMPORT: adjusting link_mtu to 1624
2022-04-01 14:42:36 us=532257 OPTIONS IMPORT: data channel crypto options modified
2022-04-01 14:42:36 us=532260 Data Channel: using negotiated cipher 'AES-256-GCM'
2022-04-01 14:42:36 us=532269 Data Channel MTU parms [ L:1552 D:1450 EF:52 EB:406 ET:0 EL:3 ]
2022-04-01 14:42:36 us=532328 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2022-04-01 14:42:36 us=532333 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2022-04-01 14:42:36 us=532338 Preserving previous TUN/TAP instance: tun0
2022-04-01 14:42:36 us=532352 Initialization Sequence Completed
^C2022-04-01 14:42:43 us=808555 event_wait : Interrupted system call (code=4)
2022-04-01 14:42:43 us=808573 SIGTERM received, sending exit notification to peer
2022-04-01 14:42:45 us=30710 TCP/UDP: Closing socket
2022-04-01 14:42:45 us=30761 /sbin/ip route del 192.168.0.0/16
2022-04-01 14:42:45 us=34281 /sbin/ip route del 172.16.0.0/12
2022-04-01 14:42:45 us=36727 /sbin/ip route del 192.168.0.27/32
2022-04-01 14:42:45 us=38965 /sbin/ip route del 0.0.0.0/1
2022-04-01 14:42:45 us=45736 /sbin/ip route del 128.0.0.0/1
2022-04-01 14:42:45 us=50648 delete_route_ipv6(::/3)
2022-04-01 14:42:45 us=50761 /sbin/ip -6 route del ::/3 dev tun0
2022-04-01 14:42:45 us=54478 delete_route_ipv6(2000::/4)
2022-04-01 14:42:45 us=54542 /sbin/ip -6 route del 2000::/4 dev tun0
2022-04-01 14:42:45 us=57840 delete_route_ipv6(3000::/4)
2022-04-01 14:42:45 us=57910 /sbin/ip -6 route del 3000::/4 dev tun0
2022-04-01 14:42:45 us=60824 delete_route_ipv6(fc00::/7)
2022-04-01 14:42:45 us=63732 /sbin/ip -6 route del fc00::/7 dev tun0
2022-04-01 14:42:45 us=68882 Closing TUN/TAP interface
2022-04-01 14:42:45 us=68958 /sbin/ip addr del dev tun0 10.8.0.2/23
2022-04-01 14:42:45 us=73890 /sbin/ip -6 addr del fd15:53b6:dead::2/64 dev tun0
2022-04-01 14:42:45 us=87740 SIGTERM[soft,exit-with-notification] received, process exiting

TinCanTech

A log which does not capture the problem is of little use.

Letalis

Apologies, that was the wrong log. Here's the full server one:

DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
WARNING: Using --management on a TCP port WITHOUT passwords is STRONGLY discouraged and considered insecure
WARNING: POTENTIALLY DANGEROUS OPTION --verify-client-cert none|optional may accept clients which do not present a certificate
Current Parameter Settings:
  config = 'server.conf'
  mode = 1
  persist_config = DISABLED
  persist_mode = 1
  show_ciphers = DISABLED
  show_digests = DISABLED
  show_engines = DISABLED
  genkey = DISABLED
  genkey_filename = '[UNDEF]'
  key_pass_file = '[UNDEF]'
  show_tls_ciphers = DISABLED
  connect_retry_max = 0
Connection profiles [0]:
  proto = udp
  local = '192.168.0.27'
  local_port = '69'
  remote = '[UNDEF]'
  remote_port = '69'
  remote_float = DISABLED
  bind_defined = DISABLED
  bind_local = ENABLED
  bind_ipv6_only = DISABLED
  connect_retry_seconds = 5
  connect_timeout = 120
  socks_proxy_server = '[UNDEF]'
  socks_proxy_port = '[UNDEF]'
  tun_mtu = 1500
  tun_mtu_defined = ENABLED
  link_mtu = 1500
  link_mtu_defined = DISABLED
  tun_mtu_extra = 0
  tun_mtu_extra_defined = DISABLED
  mtu_discover_type = -1
  fragment = 0
  mssfix = 1450
  explicit_exit_notification = 1
  tls_auth_file = '[UNDEF]'
  key_direction = not set
  tls_crypt_file = '[INLINE]'
  tls_crypt_v2_file = '[UNDEF]'
Connection profiles END
  remote_random = DISABLED
  ipchange = '[UNDEF]'
  dev = 'tun0'
  dev_type = '[UNDEF]'
  dev_node = '[UNDEF]'
  lladdr = '[UNDEF]'
  topology = 3
  ifconfig_local = '10.8.0.1'
  ifconfig_remote_netmask = '255.255.254.0'
  ifconfig_noexec = DISABLED
  ifconfig_nowarn = DISABLED
  ifconfig_ipv6_local = '[UNDEF]'
  ifconfig_ipv6_netbits = 0
  ifconfig_ipv6_remote = '[UNDEF]'
  shaper = 0
  mtu_test = 0
  mlock = DISABLED
  keepalive_ping = 0
  keepalive_timeout = 0
  inactivity_timeout = 0
  inactivity_minimum_bytes = 0
  ping_send_timeout = 10
  ping_rec_timeout = 120
  ping_rec_timeout_action = 2
  ping_timer_remote = ENABLED
  remap_sigusr1 = 0
  persist_tun = ENABLED
  persist_local_ip = DISABLED
  persist_remote_ip = DISABLED
  persist_key = ENABLED
  passtos = DISABLED
  resolve_retry_seconds = 1000000000
  resolve_in_advance = DISABLED
  username = '[UNDEF]'
  groupname = '[UNDEF]'
  chroot_dir = '[UNDEF]'
  cd_dir = '[UNDEF]'
  writepid = '[UNDEF]'
  up_script = '[UNDEF]'
  down_script = '[UNDEF]'
  down_pre = DISABLED
  up_restart = DISABLED
  up_delay = DISABLED
  daemon = DISABLED
  inetd = 0
  log = ENABLED
  suppress_timestamps = ENABLED
  machine_readable_output = DISABLED
  nice = 0
  verbosity = 4
  mute = 0
  status_file = 'openvpn-status.log'
  status_file_version = 2
  status_file_update_freq = 60
  occ = ENABLED
  rcvbuf = 0
  sndbuf = 0
  mark = 0
  sockflags = 0
  fast_io = DISABLED
  comp.alg = 0
  comp.flags = 0
  route_script = '[UNDEF]'
  route_default_gateway = '10.8.0.2'
  route_default_metric = 0
  route_noexec = DISABLED
  route_delay = 0
  route_delay_window = 30
  route_delay_defined = DISABLED
  route_nopull = DISABLED
  route_gateway_via_dhcp = DISABLED
  allow_pull_fqdn = DISABLED
  management_addr = 'localhost'
  management_port = '7505'
  management_user_pass = '[UNDEF]'
  management_log_history_cache = 250
  management_echo_buffer_size = 100
  management_write_peer_info_file = '[UNDEF]'
  management_client_user = '[UNDEF]'
  management_client_group = '[UNDEF]'
  management_flags = 0
  shared_secret_file = '[UNDEF]'
  key_direction = not set
  ciphername = 'AES-256-CBC'
  ncp_enabled = ENABLED
  ncp_ciphers = 'AES-256-GCM:AES-128-GCM:AES-256-CBC'
  authname = 'SHA512'
  prng_hash = 'SHA1'
  prng_nonce_secret_len = 16
  keysize = 0
  engine = DISABLED
  replay = ENABLED
  mute_replay_warnings = DISABLED
  replay_window = 64
  replay_time = 15
  packet_id_file = '[UNDEF]'
  test_crypto = DISABLED
  tls_server = ENABLED
  tls_client = DISABLED
  ca_file = 'ca.crt'
  ca_path = '[UNDEF]'
  dh_file = 'dh.pem'
  cert_file = 'server.crt'
  extra_certs_file = '[UNDEF]'
  priv_key_file = 'server.key'
  pkcs12_file = '[UNDEF]'
  cipher_list = '[UNDEF]'
  cipher_list_tls13 = '[UNDEF]'
  tls_cert_profile = '[UNDEF]'
  tls_verify = '[UNDEF]'
  tls_export_cert = '[UNDEF]'
  verify_x509_type = 0
  verify_x509_name = '[UNDEF]'
  crl_file = 'crl.pem'
  ns_cert_type = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_eku = '[UNDEF]'
  ssl_flags = 1
  tls_timeout = 2
  renegotiate_bytes = -1
  renegotiate_packets = 0
  renegotiate_seconds = 3600
  handshake_window = 60
  transition_window = 3600
  single_session = DISABLED
  push_peer_info = DISABLED
  tls_exit = DISABLED
  tls_crypt_v2_metadata = '[UNDEF]'
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_pin_cache_period = -1
  pkcs11_id = '[UNDEF]'
  pkcs11_id_management = DISABLED
  server_network = 10.8.0.0
  server_netmask = 255.255.254.0
  server_network_ipv6 = ::
  server_netbits_ipv6 = 0
  server_bridge_ip = 0.0.0.0
  server_bridge_netmask = 0.0.0.0
  server_bridge_pool_start = 0.0.0.0
  server_bridge_pool_end = 0.0.0.0
  push_entry = 'dhcp-option DNS 1.1.1.1'
  push_entry = 'dhcp-option DNS 1.0.0.1'
  push_entry = 'redirect-gateway def1 bypass-dhcp'
  push_entry = 'route 192.168.0.0 255.255.0.0 net_gateway'
  push_entry = 'route 172.16.0.0 255.240.0.0 net_gateway'
  push_entry = 'explicit-exit-notify 2'
  push_entry = 'ping 10'
  push_entry = 'ping-restart 120'
  push_entry = 'route-gateway 10.8.0.1'
  push_entry = 'topology subnet'
  ifconfig_pool_defined = ENABLED
  ifconfig_pool_start = 10.8.0.2
  ifconfig_pool_end = 10.8.1.254
  ifconfig_pool_netmask = 255.255.254.0
  ifconfig_pool_persist_filename = '[UNDEF]'
  ifconfig_pool_persist_refresh_freq = 600
  ifconfig_ipv6_pool_defined = DISABLED
  ifconfig_ipv6_pool_base = ::
  ifconfig_ipv6_pool_netbits = 0
  n_bcast_buf = 256
  tcp_queue_limit = 64
  real_hash_size = 256
  virtual_hash_size = 256
  client_connect_script = '[UNDEF]'
  learn_address_script = '[UNDEF]'
  client_disconnect_script = '[UNDEF]'
  client_config_dir = '[UNDEF]'
  ccd_exclusive = DISABLED
  tmp_dir = '/tmp'
  push_ifconfig_defined = DISABLED
  push_ifconfig_local = 0.0.0.0
  push_ifconfig_remote_netmask = 0.0.0.0
  push_ifconfig_ipv6_defined = DISABLED
  push_ifconfig_ipv6_local = ::/0
  push_ifconfig_ipv6_remote = ::
  enable_c2c = DISABLED
  duplicate_cn = DISABLED
  cf_max = 0
  cf_per = 0
  max_clients = 100
  max_routes_per_client = 256
  auth_user_pass_verify_script = '/etc/openvpn/server/clientCheck.sh'
  auth_user_pass_verify_script_via_file = DISABLED
  auth_token_generate = DISABLED
  auth_token_lifetime = 0
  auth_token_secret_file = '[UNDEF]'
  port_share_host = '[UNDEF]'
  port_share_port = '[UNDEF]'
  vlan_tagging = DISABLED
  vlan_accept = all
  vlan_pvid = 1
  client = DISABLED
  pull = DISABLED
  auth_user_pass_file = '[UNDEF]'
OpenVPN 2.5.6 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr  1 2022
library versions: OpenSSL 1.1.1k  25 Mar 2021, LZO 2.10
MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:7505
WARNING: --keepalive option is missing from server config
NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Diffie-Hellman initialized with 2048 bit key
CRL: loaded 1 CRLs from file crl.pem
Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
TLS-Auth MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
TUN/TAP device tun0 opened
do_ifconfig, ipv4=1, ipv6=0
/sbin/ip link set dev tun0 up mtu 1500
/sbin/ip link set dev tun0 up
/sbin/ip addr add dev tun0 10.8.0.1/23
Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
Could not determine IPv4/IPv6 protocol. Using AF_INET
Socket Buffers: R=[212992->212992] S=[212992->212992]
UDPv4 link local (bound): [AF_INET]192.168.0.27:69
UDPv4 link remote: [AF_UNSPEC]
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL IPv4: base=10.8.0.2 size=509
Initialization Sequence Completed
MULTI: multi_create_instance called
192.168.0.23:56016 Re-using SSL/TLS context
192.168.0.23:56016 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
192.168.0.23:56016 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
192.168.0.23:56016 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
192.168.0.23:56016 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
192.168.0.23:56016 Control Channel MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
192.168.0.23:56016 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
192.168.0.23:56016 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
192.168.0.23:56016 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
192.168.0.23:56016 TLS: Initial packet from [AF_INET]192.168.0.23:56016, sid=81872461 c9bcdda5
192.168.0.23:56016 peer info: IV_VER=2.5.6
192.168.0.23:56016 peer info: IV_PLAT=linux
192.168.0.23:56016 peer info: IV_PROTO=6
192.168.0.23:56016 peer info: IV_NCP=2
192.168.0.23:56016 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM:AES-256-CBC
192.168.0.23:56016 peer info: IV_LZ4=1
192.168.0.23:56016 peer info: IV_LZ4v2=1
192.168.0.23:56016 peer info: IV_LZO=1
192.168.0.23:56016 peer info: IV_COMP_STUB=1
192.168.0.23:56016 peer info: IV_COMP_STUBv2=1
192.168.0.23:56016 peer info: IV_TCPNL=1
192.168.0.23:56016 TLS: Username/Password authentication succeeded for username 'user'
192.168.0.23:56016 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384
192.168.0.23:56016 [] Peer Connection Initiated with [AF_INET]192.168.0.23:56016
192.168.0.23:56016 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
192.168.0.23:56016 MULTI: Learn: 10.8.0.2 -> 192.168.0.23:56016
192.168.0.23:56016 MULTI: primary virtual IP for 192.168.0.23:56016: 10.8.0.2
192.168.0.23:56016 Data Channel: using negotiated cipher 'AES-256-GCM'
192.168.0.23:56016 Data Channel MTU parms [ L:1549 D:1450 EF:49 EB:406 ET:0 EL:3 ]
192.168.0.23:56016 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
192.168.0.23:56016 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
192.168.0.23:56016 SENT CONTROL [UNDEF]: 'PUSH_REPLY,dhcp-option DNS 1.1.1.1,dhcp-option DNS 1.0.0.1,redirect-gateway def1 bypass-dhcp,route 192.168.0.0 255.255.0.0 net_gateway,route 172.16.0.0 255.240.0.0 net_gateway,explicit-exit-notify 2,ping 10,ping-restart 120,route-gateway 10.8.0.1,topology subnet,ifconfig 10.8.0.2 255.255.254.0,peer-id 0,cipher AES-256-GCM' (status=1)
192.168.0.23:56016 SIGTERM[soft,remote-exit] received, client-instance exiting

The disconnect shown at the end is due to my manual Ctrl-C, nothing to do with the reconnections.

Letalis

I have something that might be meaningful, the reconnects never happen on 2.5.1, but they do happen on 2.5.2+. I've been looking through the change logs but I can't find anything that suggests a large change resulting in this between the two versions. Any ideas?

TinCanTech

Letalis wroteAny ideas?

Post the correct log .........

Letalis

I have done. The one I just posted above is the full server one on verb 4 as the previous one wasn't complete, and the other client log was correct.

In case the several different versions of logs have got confusing I will post them again in full.

Server:

DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
WARNING: Using --management on a TCP port WITHOUT passwords is STRONGLY discouraged and considered insecure
WARNING: POTENTIALLY DANGEROUS OPTION --verify-client-cert none|optional may accept clients which do not present a certificate
Current Parameter Settings:
  config = 'server.conf'
  mode = 1
  persist_config = DISABLED
  persist_mode = 1
  show_ciphers = DISABLED
  show_digests = DISABLED
  show_engines = DISABLED
  genkey = DISABLED
  genkey_filename = '[UNDEF]'
  key_pass_file = '[UNDEF]'
  show_tls_ciphers = DISABLED
  connect_retry_max = 0
Connection profiles [0]:
  proto = udp
  local = '192.168.0.27'
  local_port = '69'
  remote = '[UNDEF]'
  remote_port = '69'
  remote_float = DISABLED
  bind_defined = DISABLED
  bind_local = ENABLED
  bind_ipv6_only = DISABLED
  connect_retry_seconds = 5
  connect_timeout = 120
  socks_proxy_server = '[UNDEF]'
  socks_proxy_port = '[UNDEF]'
  tun_mtu = 1500
  tun_mtu_defined = ENABLED
  link_mtu = 1500
  link_mtu_defined = DISABLED
  tun_mtu_extra = 0
  tun_mtu_extra_defined = DISABLED
  mtu_discover_type = -1
  fragment = 0
  mssfix = 1450
  explicit_exit_notification = 1
  tls_auth_file = '[UNDEF]'
  key_direction = not set
  tls_crypt_file = '[INLINE]'
  tls_crypt_v2_file = '[UNDEF]'
Connection profiles END
  remote_random = DISABLED
  ipchange = '[UNDEF]'
  dev = 'tun0'
  dev_type = '[UNDEF]'
  dev_node = '[UNDEF]'
  lladdr = '[UNDEF]'
  topology = 3
  ifconfig_local = '10.8.0.1'
  ifconfig_remote_netmask = '255.255.254.0'
  ifconfig_noexec = DISABLED
  ifconfig_nowarn = DISABLED
  ifconfig_ipv6_local = '[UNDEF]'
  ifconfig_ipv6_netbits = 0
  ifconfig_ipv6_remote = '[UNDEF]'
  shaper = 0
  mtu_test = 0
  mlock = DISABLED
  keepalive_ping = 0
  keepalive_timeout = 0
  inactivity_timeout = 0
  inactivity_minimum_bytes = 0
  ping_send_timeout = 10
  ping_rec_timeout = 120
  ping_rec_timeout_action = 2
  ping_timer_remote = ENABLED
  remap_sigusr1 = 0
  persist_tun = ENABLED
  persist_local_ip = DISABLED
  persist_remote_ip = DISABLED
  persist_key = ENABLED
  passtos = DISABLED
  resolve_retry_seconds = 1000000000
  resolve_in_advance = DISABLED
  username = '[UNDEF]'
  groupname = '[UNDEF]'
  chroot_dir = '[UNDEF]'
  cd_dir = '[UNDEF]'
  writepid = '[UNDEF]'
  up_script = '[UNDEF]'
  down_script = '[UNDEF]'
  down_pre = DISABLED
  up_restart = DISABLED
  up_delay = DISABLED
  daemon = DISABLED
  inetd = 0
  log = ENABLED
  suppress_timestamps = ENABLED
  machine_readable_output = DISABLED
  nice = 0
  verbosity = 4
  mute = 0
  status_file = 'openvpn-status.log'
  status_file_version = 2
  status_file_update_freq = 60
  occ = ENABLED
  rcvbuf = 0
  sndbuf = 0
  mark = 0
  sockflags = 0
  fast_io = DISABLED
  comp.alg = 0
  comp.flags = 0
  route_script = '[UNDEF]'
  route_default_gateway = '10.8.0.2'
  route_default_metric = 0
  route_noexec = DISABLED
  route_delay = 0
  route_delay_window = 30
  route_delay_defined = DISABLED
  route_nopull = DISABLED
  route_gateway_via_dhcp = DISABLED
  allow_pull_fqdn = DISABLED
  management_addr = 'localhost'
  management_port = '7505'
  management_user_pass = '[UNDEF]'
  management_log_history_cache = 250
  management_echo_buffer_size = 100
  management_write_peer_info_file = '[UNDEF]'
  management_client_user = '[UNDEF]'
  management_client_group = '[UNDEF]'
  management_flags = 0
  shared_secret_file = '[UNDEF]'
  key_direction = not set
  ciphername = 'AES-256-CBC'
  ncp_enabled = ENABLED
  ncp_ciphers = 'AES-256-GCM:AES-128-GCM:AES-256-CBC'
  authname = 'SHA512'
  prng_hash = 'SHA1'
  prng_nonce_secret_len = 16
  keysize = 0
  engine = DISABLED
  replay = ENABLED
  mute_replay_warnings = DISABLED
  replay_window = 64
  replay_time = 15
  packet_id_file = '[UNDEF]'
  test_crypto = DISABLED
  tls_server = ENABLED
  tls_client = DISABLED
  ca_file = 'ca.crt'
  ca_path = '[UNDEF]'
  dh_file = 'dh.pem'
  cert_file = 'server.crt'
  extra_certs_file = '[UNDEF]'
  priv_key_file = 'server.key'
  pkcs12_file = '[UNDEF]'
  cipher_list = '[UNDEF]'
  cipher_list_tls13 = '[UNDEF]'
  tls_cert_profile = '[UNDEF]'
  tls_verify = '[UNDEF]'
  tls_export_cert = '[UNDEF]'
  verify_x509_type = 0
  verify_x509_name = '[UNDEF]'
  crl_file = 'crl.pem'
  ns_cert_type = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_eku = '[UNDEF]'
  ssl_flags = 1
  tls_timeout = 2
  renegotiate_bytes = -1
  renegotiate_packets = 0
  renegotiate_seconds = 3600
  handshake_window = 60
  transition_window = 3600
  single_session = DISABLED
  push_peer_info = DISABLED
  tls_exit = DISABLED
  tls_crypt_v2_metadata = '[UNDEF]'
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_pin_cache_period = -1
  pkcs11_id = '[UNDEF]'
  pkcs11_id_management = DISABLED
  server_network = 10.8.0.0
  server_netmask = 255.255.254.0
  server_network_ipv6 = ::
  server_netbits_ipv6 = 0
  server_bridge_ip = 0.0.0.0
  server_bridge_netmask = 0.0.0.0
  server_bridge_pool_start = 0.0.0.0
  server_bridge_pool_end = 0.0.0.0
  push_entry = 'dhcp-option DNS 1.1.1.1'
  push_entry = 'dhcp-option DNS 1.0.0.1'
  push_entry = 'redirect-gateway def1 bypass-dhcp'
  push_entry = 'route 192.168.0.0 255.255.0.0 net_gateway'
  push_entry = 'route 172.16.0.0 255.240.0.0 net_gateway'
  push_entry = 'explicit-exit-notify 2'
  push_entry = 'ping 10'
  push_entry = 'ping-restart 120'
  push_entry = 'route-gateway 10.8.0.1'
  push_entry = 'topology subnet'
  ifconfig_pool_defined = ENABLED
  ifconfig_pool_start = 10.8.0.2
  ifconfig_pool_end = 10.8.1.254
  ifconfig_pool_netmask = 255.255.254.0
  ifconfig_pool_persist_filename = '[UNDEF]'
  ifconfig_pool_persist_refresh_freq = 600
  ifconfig_ipv6_pool_defined = DISABLED
  ifconfig_ipv6_pool_base = ::
  ifconfig_ipv6_pool_netbits = 0
  n_bcast_buf = 256
  tcp_queue_limit = 64
  real_hash_size = 256
  virtual_hash_size = 256
  client_connect_script = '[UNDEF]'
  learn_address_script = '[UNDEF]'
  client_disconnect_script = '[UNDEF]'
  client_config_dir = '[UNDEF]'
  ccd_exclusive = DISABLED
  tmp_dir = '/tmp'
  push_ifconfig_defined = DISABLED
  push_ifconfig_local = 0.0.0.0
  push_ifconfig_remote_netmask = 0.0.0.0
  push_ifconfig_ipv6_defined = DISABLED
  push_ifconfig_ipv6_local = ::/0
  push_ifconfig_ipv6_remote = ::
  enable_c2c = DISABLED
  duplicate_cn = DISABLED
  cf_max = 0
  cf_per = 0
  max_clients = 100
  max_routes_per_client = 256
  auth_user_pass_verify_script = '/etc/openvpn/server/clientCheck.sh'
  auth_user_pass_verify_script_via_file = DISABLED
  auth_token_generate = DISABLED
  auth_token_lifetime = 0
  auth_token_secret_file = '[UNDEF]'
  port_share_host = '[UNDEF]'
  port_share_port = '[UNDEF]'
  vlan_tagging = DISABLED
  vlan_accept = all
  vlan_pvid = 1
  client = DISABLED
  pull = DISABLED
  auth_user_pass_file = '[UNDEF]'
OpenVPN 2.5.6 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr  1 2022
library versions: OpenSSL 1.1.1k  25 Mar 2021, LZO 2.10
MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:7505
WARNING: --keepalive option is missing from server config
NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Diffie-Hellman initialized with 2048 bit key
CRL: loaded 1 CRLs from file crl.pem
Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
TLS-Auth MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
TUN/TAP device tun0 opened
do_ifconfig, ipv4=1, ipv6=0
/sbin/ip link set dev tun0 up mtu 1500
/sbin/ip link set dev tun0 up
/sbin/ip addr add dev tun0 10.8.0.1/23
Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
Could not determine IPv4/IPv6 protocol. Using AF_INET
Socket Buffers: R=[212992->212992] S=[212992->212992]
UDPv4 link local (bound): [AF_INET]192.168.0.27:69
UDPv4 link remote: [AF_UNSPEC]
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL IPv4: base=10.8.0.2 size=509
Initialization Sequence Completed
MULTI: multi_create_instance called
192.168.0.23:32861 Re-using SSL/TLS context
192.168.0.23:32861 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
192.168.0.23:32861 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
192.168.0.23:32861 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
192.168.0.23:32861 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
192.168.0.23:32861 Control Channel MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
192.168.0.23:32861 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
192.168.0.23:32861 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
192.168.0.23:32861 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
192.168.0.23:32861 TLS: Initial packet from [AF_INET]192.168.0.23:32861, sid=94e4f6f1 519c9e93
192.168.0.23:32861 peer info: IV_VER=2.5.6
192.168.0.23:32861 peer info: IV_PLAT=linux
192.168.0.23:32861 peer info: IV_PROTO=6
192.168.0.23:32861 peer info: IV_NCP=2
192.168.0.23:32861 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM:AES-128-CBC
192.168.0.23:32861 peer info: IV_LZ4=1
192.168.0.23:32861 peer info: IV_LZ4v2=1
192.168.0.23:32861 peer info: IV_LZO=1
192.168.0.23:32861 peer info: IV_COMP_STUB=1
192.168.0.23:32861 peer info: IV_COMP_STUBv2=1
192.168.0.23:32861 peer info: IV_TCPNL=1
192.168.0.23:32861 TLS: Username/Password authentication succeeded for username 'user'
192.168.0.23:32861 WARNING: 'keysize' is used inconsistently, local='keysize 256', remote='keysize 128'
192.168.0.23:32861 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384
192.168.0.23:32861 [] Peer Connection Initiated with [AF_INET]192.168.0.23:32861
192.168.0.23:32861 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
192.168.0.23:32861 MULTI: Learn: 10.8.0.2 -> 192.168.0.23:32861
192.168.0.23:32861 MULTI: primary virtual IP for 192.168.0.23:32861: 10.8.0.2
192.168.0.23:32861 Data Channel: using negotiated cipher 'AES-256-GCM'
192.168.0.23:32861 Data Channel MTU parms [ L:1549 D:1450 EF:49 EB:406 ET:0 EL:3 ]
192.168.0.23:32861 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
192.168.0.23:32861 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
192.168.0.23:32861 SENT CONTROL [UNDEF]: 'PUSH_REPLY,dhcp-option DNS 1.1.1.1,dhcp-option DNS 1.0.0.1,redirect-gateway def1 bypass-dhcp,route 192.168.0.0 255.255.0.0 net_gateway,route 172.16.0.0 255.240.0.0 net_gateway,explicit-exit-notify 2,ping 10,ping-restart 120,route-gateway 10.8.0.1,topology subnet,ifconfig 10.8.0.2 255.255.254.0,peer-id 0,cipher AES-256-GCM' (status=1)
192.168.0.23:32861 SIGTERM[soft,remote-exit] received, client-instance exiting

Client:

2022-04-01 17:31:44 us=54917 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
2022-04-01 17:31:44 us=55009 WARNING: file 'user' is group or others accessible
2022-04-01 17:31:44 us=55016 Current Parameter Settings:
2022-04-01 17:31:44 us=55021   config = 'retrieved.ovpn'
2022-04-01 17:31:44 us=55025   mode = 0
2022-04-01 17:31:44 us=55029   persist_config = DISABLED
2022-04-01 17:31:44 us=55033   persist_mode = 1
2022-04-01 17:31:44 us=55036   show_ciphers = DISABLED
2022-04-01 17:31:44 us=55039   show_digests = DISABLED
2022-04-01 17:31:44 us=55043   show_engines = DISABLED
2022-04-01 17:31:44 us=55046   genkey = DISABLED
2022-04-01 17:31:44 us=55049   genkey_filename = '[UNDEF]'
2022-04-01 17:31:44 us=55052   key_pass_file = '[UNDEF]'
2022-04-01 17:31:44 us=55055   show_tls_ciphers = DISABLED
2022-04-01 17:31:44 us=55058   connect_retry_max = 0
2022-04-01 17:31:44 us=55061 Connection profiles [0]:
2022-04-01 17:31:44 us=55065   proto = udp
2022-04-01 17:31:44 us=55068   local = '[UNDEF]'
2022-04-01 17:31:44 us=55071   local_port = '[UNDEF]'
2022-04-01 17:31:44 us=55074   remote = '192.168.0.27'
2022-04-01 17:31:44 us=55077   remote_port = '69'
2022-04-01 17:31:44 us=55081   remote_float = DISABLED
2022-04-01 17:31:44 us=55084   bind_defined = DISABLED
2022-04-01 17:31:44 us=55087   bind_local = DISABLED
2022-04-01 17:31:44 us=55090   bind_ipv6_only = DISABLED
2022-04-01 17:31:44 us=55093   connect_retry_seconds = 5
2022-04-01 17:31:44 us=55096   connect_timeout = 120
2022-04-01 17:31:44 us=55100   socks_proxy_server = '[UNDEF]'
2022-04-01 17:31:44 us=55103   socks_proxy_port = '[UNDEF]'
2022-04-01 17:31:44 us=55106   tun_mtu = 1500
2022-04-01 17:31:44 us=55109   tun_mtu_defined = ENABLED
2022-04-01 17:31:44 us=55112   link_mtu = 1500
2022-04-01 17:31:44 us=55115   link_mtu_defined = DISABLED
2022-04-01 17:31:44 us=55118   tun_mtu_extra = 0
2022-04-01 17:31:44 us=55121   tun_mtu_extra_defined = DISABLED
2022-04-01 17:31:44 us=55125   mtu_discover_type = -1
2022-04-01 17:31:44 us=55128   fragment = 0
2022-04-01 17:31:44 us=55131   mssfix = 1450
2022-04-01 17:31:44 us=55134   explicit_exit_notification = 0
2022-04-01 17:31:44 us=55137   tls_auth_file = '[UNDEF]'
2022-04-01 17:31:44 us=55140   key_direction = not set
2022-04-01 17:31:44 us=55144   tls_crypt_file = '[INLINE]'
2022-04-01 17:31:44 us=55147   tls_crypt_v2_file = '[UNDEF]'
2022-04-01 17:31:44 us=55150 Connection profiles END
2022-04-01 17:31:44 us=55153   remote_random = ENABLED
2022-04-01 17:31:44 us=55156   ipchange = '[UNDEF]'
2022-04-01 17:31:44 us=55159   dev = 'tun'
2022-04-01 17:31:44 us=55162   dev_type = '[UNDEF]'
2022-04-01 17:31:44 us=55165   dev_node = '[UNDEF]'
2022-04-01 17:31:44 us=55168   lladdr = '[UNDEF]'
2022-04-01 17:31:44 us=55171   topology = 1
2022-04-01 17:31:44 us=55174   ifconfig_local = '[UNDEF]'
2022-04-01 17:31:44 us=55178   ifconfig_remote_netmask = '[UNDEF]'
2022-04-01 17:31:44 us=55181   ifconfig_noexec = DISABLED
2022-04-01 17:31:44 us=55184   ifconfig_nowarn = DISABLED
2022-04-01 17:31:44 us=55187   ifconfig_ipv6_local = '[UNDEF]'
2022-04-01 17:31:44 us=55190   ifconfig_ipv6_netbits = 0
2022-04-01 17:31:44 us=55193   ifconfig_ipv6_remote = '[UNDEF]'
2022-04-01 17:31:44 us=55196   shaper = 0
2022-04-01 17:31:44 us=55199   mtu_test = 0
2022-04-01 17:31:44 us=55202   mlock = DISABLED
2022-04-01 17:31:44 us=55206   keepalive_ping = 0
2022-04-01 17:31:44 us=55209   keepalive_timeout = 0
2022-04-01 17:31:44 us=55212   inactivity_timeout = 0
2022-04-01 17:31:44 us=55215   inactivity_minimum_bytes = 0
2022-04-01 17:31:44 us=55218   ping_send_timeout = 0
2022-04-01 17:31:44 us=55221   ping_rec_timeout = 0
2022-04-01 17:31:44 us=55224   ping_rec_timeout_action = 0
2022-04-01 17:31:44 us=55228   ping_timer_remote = DISABLED
2022-04-01 17:31:44 us=55231   remap_sigusr1 = 0
2022-04-01 17:31:44 us=55234   persist_tun = ENABLED
2022-04-01 17:31:44 us=55237   persist_local_ip = DISABLED
2022-04-01 17:31:44 us=55240   persist_remote_ip = DISABLED
2022-04-01 17:31:44 us=55243   persist_key = ENABLED
2022-04-01 17:31:44 us=55246   passtos = DISABLED
2022-04-01 17:31:44 us=55250   resolve_retry_seconds = 1000000000
2022-04-01 17:31:44 us=55253   resolve_in_advance = DISABLED
2022-04-01 17:31:44 us=55256   username = '[UNDEF]'
2022-04-01 17:31:44 us=55259   groupname = '[UNDEF]'
2022-04-01 17:31:44 us=55262   chroot_dir = '[UNDEF]'
2022-04-01 17:31:44 us=55265   cd_dir = '[UNDEF]'
2022-04-01 17:31:44 us=55268   writepid = '[UNDEF]'
2022-04-01 17:31:44 us=55272   up_script = '[UNDEF]'
2022-04-01 17:31:44 us=55275   down_script = '[UNDEF]'
2022-04-01 17:31:44 us=55278   down_pre = DISABLED
2022-04-01 17:31:44 us=55281   up_restart = DISABLED
2022-04-01 17:31:44 us=55285   up_delay = DISABLED
2022-04-01 17:31:44 us=55288   daemon = DISABLED
2022-04-01 17:31:44 us=55291   inetd = 0
2022-04-01 17:31:44 us=55294   log = DISABLED
2022-04-01 17:31:44 us=55297   suppress_timestamps = DISABLED
2022-04-01 17:31:44 us=55300   machine_readable_output = DISABLED
2022-04-01 17:31:44 us=55303   nice = 0
2022-04-01 17:31:44 us=55306   verbosity = 4
2022-04-01 17:31:44 us=55309   mute = 0
2022-04-01 17:31:44 us=55312   status_file = '[UNDEF]'
2022-04-01 17:31:44 us=55315   status_file_version = 1
2022-04-01 17:31:44 us=55318   status_file_update_freq = 60
2022-04-01 17:31:44 us=55321   occ = ENABLED
2022-04-01 17:31:44 us=55324   rcvbuf = 0
2022-04-01 17:31:44 us=55328   sndbuf = 0
2022-04-01 17:31:44 us=55331   mark = 0
2022-04-01 17:31:44 us=55334   sockflags = 0
2022-04-01 17:31:44 us=55338   fast_io = DISABLED
2022-04-01 17:31:44 us=55341   comp.alg = 0
2022-04-01 17:31:44 us=55344   comp.flags = 0
2022-04-01 17:31:44 us=55347   route_script = '[UNDEF]'
2022-04-01 17:31:44 us=55350   route_default_gateway = '[UNDEF]'
2022-04-01 17:31:44 us=55354   route_default_metric = 0
2022-04-01 17:31:44 us=55357   route_noexec = DISABLED
2022-04-01 17:31:44 us=55360   route_delay = 0
2022-04-01 17:31:44 us=55363   route_delay_window = 30
2022-04-01 17:31:44 us=55366   route_delay_defined = DISABLED
2022-04-01 17:31:44 us=55369   route_nopull = DISABLED
2022-04-01 17:31:44 us=55373   route_gateway_via_dhcp = DISABLED
2022-04-01 17:31:44 us=55376   allow_pull_fqdn = DISABLED
2022-04-01 17:31:44 us=55379   management_addr = '[UNDEF]'
2022-04-01 17:31:44 us=55383   management_port = '[UNDEF]'
2022-04-01 17:31:44 us=55386   management_user_pass = '[UNDEF]'
2022-04-01 17:31:44 us=55389   management_log_history_cache = 250
2022-04-01 17:31:44 us=55392   management_echo_buffer_size = 100
2022-04-01 17:31:44 us=55396   management_write_peer_info_file = '[UNDEF]'
2022-04-01 17:31:44 us=55399   management_client_user = '[UNDEF]'
2022-04-01 17:31:44 us=55402   management_client_group = '[UNDEF]'
2022-04-01 17:31:44 us=55581   management_flags = 0
2022-04-01 17:31:44 us=55617   shared_secret_file = '[UNDEF]'
2022-04-01 17:31:44 us=55647   key_direction = not set
2022-04-01 17:31:44 us=55676   ciphername = 'AES-256-CBC'
2022-04-01 17:31:44 us=55705   ncp_enabled = ENABLED
2022-04-01 17:31:44 us=55733   ncp_ciphers = 'AES-256-GCM:AES-128-GCM:AES-256-CBC'
2022-04-01 17:31:44 us=55762   authname = 'SHA512'
2022-04-01 17:31:44 us=55790   prng_hash = 'SHA1'
2022-04-01 17:31:44 us=55819   prng_nonce_secret_len = 16
2022-04-01 17:31:44 us=55847   keysize = 0
2022-04-01 17:31:44 us=55875   engine = DISABLED
2022-04-01 17:31:44 us=55903   replay = ENABLED
2022-04-01 17:31:44 us=55949   mute_replay_warnings = DISABLED
2022-04-01 17:31:44 us=55979   replay_window = 64
2022-04-01 17:31:44 us=56008   replay_time = 15
2022-04-01 17:31:44 us=56036   packet_id_file = '[UNDEF]'
2022-04-01 17:31:44 us=56064   test_crypto = DISABLED
2022-04-01 17:31:44 us=56093   tls_server = DISABLED
2022-04-01 17:31:44 us=56121   tls_client = ENABLED
2022-04-01 17:31:44 us=56149   ca_file = '[INLINE]'
2022-04-01 17:31:44 us=56177   ca_path = '[UNDEF]'
2022-04-01 17:31:44 us=56205   dh_file = '[UNDEF]'
2022-04-01 17:31:44 us=56233   cert_file = '[INLINE]'
2022-04-01 17:31:44 us=56262   extra_certs_file = '[UNDEF]'
2022-04-01 17:31:44 us=56290   priv_key_file = '[INLINE]'
2022-04-01 17:31:44 us=56319   pkcs12_file = '[UNDEF]'
2022-04-01 17:31:44 us=56347   cipher_list = '[UNDEF]'
2022-04-01 17:31:44 us=56377   cipher_list_tls13 = '[UNDEF]'
2022-04-01 17:31:44 us=56406   tls_cert_profile = '[UNDEF]'
2022-04-01 17:31:44 us=56452   tls_verify = '[UNDEF]'
2022-04-01 17:31:44 us=56480   tls_export_cert = '[UNDEF]'
2022-04-01 17:31:44 us=56509   verify_x509_type = 0
2022-04-01 17:31:44 us=56537   verify_x509_name = '[UNDEF]'
2022-04-01 17:31:44 us=56567   crl_file = '[UNDEF]'
2022-04-01 17:31:44 us=56596   ns_cert_type = 0
2022-04-01 17:31:44 us=56624   remote_cert_ku[i] = 65535
2022-04-01 17:31:44 us=56652   remote_cert_ku[i] = 0
2022-04-01 17:31:44 us=56680   remote_cert_ku[i] = 0
2022-04-01 17:31:44 us=56708   remote_cert_ku[i] = 0
2022-04-01 17:31:44 us=56737   remote_cert_ku[i] = 0
2022-04-01 17:31:44 us=56765   remote_cert_ku[i] = 0
2022-04-01 17:31:44 us=56793   remote_cert_ku[i] = 0
2022-04-01 17:31:44 us=56822   remote_cert_ku[i] = 0
2022-04-01 17:31:44 us=56850   remote_cert_ku[i] = 0
2022-04-01 17:31:44 us=56878   remote_cert_ku[i] = 0
2022-04-01 17:31:44 us=56906   remote_cert_ku[i] = 0
2022-04-01 17:31:44 us=56951   remote_cert_ku[i] = 0
2022-04-01 17:31:44 us=56980   remote_cert_ku[i] = 0
2022-04-01 17:31:44 us=57008   remote_cert_ku[i] = 0
2022-04-01 17:31:44 us=57036   remote_cert_ku[i] = 0
2022-04-01 17:31:44 us=57064   remote_cert_ku[i] = 0
2022-04-01 17:31:44 us=57092   remote_cert_eku = 'TLS Web Server Authentication'
2022-04-01 17:31:44 us=57120   ssl_flags = 0
2022-04-01 17:31:44 us=57148   tls_timeout = 2
2022-04-01 17:31:44 us=57176   renegotiate_bytes = -1
2022-04-01 17:31:44 us=57204   renegotiate_packets = 0
2022-04-01 17:31:44 us=57232   renegotiate_seconds = 3600
2022-04-01 17:31:44 us=57261   handshake_window = 60
2022-04-01 17:31:44 us=57289   transition_window = 3600
2022-04-01 17:31:44 us=57317   single_session = DISABLED
2022-04-01 17:31:44 us=57345   push_peer_info = DISABLED
2022-04-01 17:31:44 us=57373   tls_exit = DISABLED
2022-04-01 17:31:44 us=57401   tls_crypt_v2_metadata = '[UNDEF]'
2022-04-01 17:31:44 us=57447   server_network = 0.0.0.0
2022-04-01 17:31:44 us=57478   server_netmask = 0.0.0.0
2022-04-01 17:31:44 us=57507   server_network_ipv6 = ::
2022-04-01 17:31:44 us=57535   server_netbits_ipv6 = 0
2022-04-01 17:31:44 us=57566   server_bridge_ip = 0.0.0.0
2022-04-01 17:31:44 us=57596   server_bridge_netmask = 0.0.0.0
2022-04-01 17:31:44 us=57624   server_bridge_pool_start = 0.0.0.0
2022-04-01 17:31:44 us=57653   server_bridge_pool_end = 0.0.0.0
2022-04-01 17:31:44 us=57681   ifconfig_pool_defined = DISABLED
2022-04-01 17:31:44 us=57710   ifconfig_pool_start = 0.0.0.0
2022-04-01 17:31:44 us=57739   ifconfig_pool_end = 0.0.0.0
2022-04-01 17:31:44 us=57767   ifconfig_pool_netmask = 0.0.0.0
2022-04-01 17:31:44 us=57796   ifconfig_pool_persist_filename = '[UNDEF]'
2022-04-01 17:31:44 us=57825   ifconfig_pool_persist_refresh_freq = 600
2022-04-01 17:31:44 us=57853   ifconfig_ipv6_pool_defined = DISABLED
2022-04-01 17:31:44 us=57882   ifconfig_ipv6_pool_base = ::
2022-04-01 17:31:44 us=57921   ifconfig_ipv6_pool_netbits = 0
2022-04-01 17:31:44 us=57956   n_bcast_buf = 256
2022-04-01 17:31:44 us=57984   tcp_queue_limit = 64
2022-04-01 17:31:44 us=58012   real_hash_size = 256
2022-04-01 17:31:44 us=58041   virtual_hash_size = 256
2022-04-01 17:31:44 us=58069   client_connect_script = '[UNDEF]'
2022-04-01 17:31:44 us=58097   learn_address_script = '[UNDEF]'
2022-04-01 17:31:44 us=58125   client_disconnect_script = '[UNDEF]'
2022-04-01 17:31:44 us=58153   client_config_dir = '[UNDEF]'
2022-04-01 17:31:44 us=58182   ccd_exclusive = DISABLED
2022-04-01 17:31:44 us=58210   tmp_dir = '/tmp'
2022-04-01 17:31:44 us=58308   push_ifconfig_defined = DISABLED
2022-04-01 17:31:44 us=58339   push_ifconfig_local = 0.0.0.0
2022-04-01 17:31:44 us=58368   push_ifconfig_remote_netmask = 0.0.0.0
2022-04-01 17:31:44 us=58396   push_ifconfig_ipv6_defined = DISABLED
2022-04-01 17:31:44 us=58443   push_ifconfig_ipv6_local = ::/0
2022-04-01 17:31:44 us=58473   push_ifconfig_ipv6_remote = ::
2022-04-01 17:31:44 us=58534   enable_c2c = DISABLED
2022-04-01 17:31:44 us=58566   duplicate_cn = DISABLED
2022-04-01 17:31:44 us=58610   cf_max = 0
2022-04-01 17:31:44 us=58699   cf_per = 0
2022-04-01 17:31:44 us=58729   max_clients = 1024
2022-04-01 17:31:44 us=58758   max_routes_per_client = 256
2022-04-01 17:31:44 us=58786   auth_user_pass_verify_script = '[UNDEF]'
2022-04-01 17:31:44 us=58815   auth_user_pass_verify_script_via_file = DISABLED
2022-04-01 17:31:44 us=58871   auth_token_generate = DISABLED
2022-04-01 17:31:44 us=58900   auth_token_lifetime = 0
2022-04-01 17:31:44 us=58947   auth_token_secret_file = '[UNDEF]'
2022-04-01 17:31:44 us=58977   port_share_host = '[UNDEF]'
2022-04-01 17:31:44 us=59006   port_share_port = '[UNDEF]'
2022-04-01 17:31:44 us=59034   vlan_tagging = DISABLED
2022-04-01 17:31:44 us=59062   vlan_accept = all
2022-04-01 17:31:44 us=59090   vlan_pvid = 1
2022-04-01 17:31:44 us=59118   client = ENABLED
2022-04-01 17:31:44 us=59146   pull = ENABLED
2022-04-01 17:31:44 us=59174   auth_user_pass_file = 'user'
2022-04-01 17:31:44 us=59204 OpenVPN 2.5.6 i686-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Mar 27 2022
2022-04-01 17:31:44 us=59233 library versions: OpenSSL 1.1.1k  25 Mar 2021, LZO 2.10
2022-04-01 17:31:44 us=59730 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2022-04-01 17:31:44 us=59777 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2022-04-01 17:31:44 us=59809 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2022-04-01 17:31:44 us=59841 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2022-04-01 17:31:44 us=59908 Control Channel MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
2022-04-01 17:31:44 us=59969 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
2022-04-01 17:31:44 us=60010 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
2022-04-01 17:31:44 us=60040 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
2022-04-01 17:31:44 us=60071 TCP/UDP: Preserving recently used remote address: [AF_INET]192.168.0.27:69
2022-04-01 17:31:44 us=60108 Socket Buffers: R=[212992->212992] S=[212992->212992]
2022-04-01 17:31:44 us=60139 UDP link local: (not bound)
2022-04-01 17:31:44 us=60168 UDP link remote: [AF_INET]192.168.0.27:69
2022-04-01 17:31:44 us=60895 TLS: Initial packet from [AF_INET]192.168.0.27:69, sid=d949eb04 7a739664
2022-04-01 17:31:44 us=68504 VERIFY OK: depth=1, CN=ChangeMe
2022-04-01 17:31:44 us=68823 VERIFY KU OK
2022-04-01 17:31:44 us=68861 Validating certificate extended key usage
2022-04-01 17:31:44 us=68891 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2022-04-01 17:31:44 us=68932 VERIFY EKU OK
2022-04-01 17:31:44 us=68966 VERIFY OK: depth=0, CN=server
2022-04-01 17:31:46 us=603742 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA256
2022-04-01 17:31:46 us=603804 [server] Peer Connection Initiated with [AF_INET]192.168.0.27:69
2022-04-01 17:31:46 us=604092 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 1.1.1.1,dhcp-option DNS 1.0.0.1,redirect-gateway def1 bypass-dhcp,route 192.168.0.0 255.255.0.0 net_gateway,route 172.16.0.0 255.240.0.0 net_gateway,explicit-exit-notify 2,ping 10,ping-restart 120,route-gateway 10.8.0.1,topology subnet,ifconfig 10.8.0.2 255.255.254.0,peer-id 0,cipher AES-256-GCM'
2022-04-01 17:31:46 us=604165 OPTIONS IMPORT: timers and/or timeouts modified
2022-04-01 17:31:46 us=604171 OPTIONS IMPORT: explicit notify parm(s) modified
2022-04-01 17:31:46 us=604175 OPTIONS IMPORT: --ifconfig/up options modified
2022-04-01 17:31:46 us=604178 OPTIONS IMPORT: route options modified
2022-04-01 17:31:46 us=604181 OPTIONS IMPORT: route-related options modified
2022-04-01 17:31:46 us=604184 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2022-04-01 17:31:46 us=604187 OPTIONS IMPORT: peer-id set
2022-04-01 17:31:46 us=604190 OPTIONS IMPORT: adjusting link_mtu to 1624
2022-04-01 17:31:46 us=604193 OPTIONS IMPORT: data channel crypto options modified
2022-04-01 17:31:46 us=604197 Data Channel: using negotiated cipher 'AES-256-GCM'
2022-04-01 17:31:46 us=604206 Data Channel MTU parms [ L:1552 D:1450 EF:52 EB:406 ET:0 EL:3 ]
2022-04-01 17:31:46 us=604265 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2022-04-01 17:31:46 us=604270 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2022-04-01 17:31:46 us=604488 TUN/TAP device tun0 opened
2022-04-01 17:31:46 us=604496 do_ifconfig, ipv4=1, ipv6=0
2022-04-01 17:31:46 us=604503 /sbin/ip link set dev tun0 up mtu 1500
2022-04-01 17:31:46 us=615243 /sbin/ip link set dev tun0 up
2022-04-01 17:31:46 us=617570 /sbin/ip addr add dev tun0 10.8.0.2/23
2022-04-01 17:31:46 us=621552 /sbin/ip route add 192.168.0.27/32 dev enp0s3 via 192.168.0.1
2022-04-01 17:31:46 us=627806 /sbin/ip route add 0.0.0.0/1 via 10.8.0.1
2022-04-01 17:31:46 us=630915 /sbin/ip route add 128.0.0.0/1 via 10.8.0.1
2022-04-01 17:31:46 us=633543 /sbin/ip route add 192.168.0.0/16 via 192.168.0.1
2022-04-01 17:31:46 us=636308 /sbin/ip route add 172.16.0.0/12 via 192.168.0.1
2022-04-01 17:31:46 us=641091 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2022-04-01 17:31:46 us=641174 Initialization Sequence Completed
2022-04-01 17:33:03 us=871284 Connection reset command was pushed by server ('')
2022-04-01 17:33:03 us=871363 TCP/UDP: Closing socket
2022-04-01 17:33:03 us=871383 SIGUSR1[soft,server-pushed-connection-reset] received, process restarting
2022-04-01 17:33:03 us=871393 Restart pause, 5 second(s)
2022-04-01 17:33:08 us=871539 Re-using SSL/TLS context
2022-04-01 17:33:08 us=871604 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2022-04-01 17:33:08 us=871616 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2022-04-01 17:33:08 us=871621 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2022-04-01 17:33:08 us=871628 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2022-04-01 17:33:08 us=871672 Control Channel MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
2022-04-01 17:33:08 us=871681 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
2022-04-01 17:33:08 us=871695 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
2022-04-01 17:33:08 us=871699 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
2022-04-01 17:33:08 us=871707 TCP/UDP: Preserving recently used remote address: [AF_INET]192.168.0.27:69
2022-04-01 17:33:08 us=871725 Socket Buffers: R=[212992->212992] S=[212992->212992]
2022-04-01 17:33:08 us=871730 UDP link local: (not bound)
2022-04-01 17:33:08 us=871735 UDP link remote: [AF_INET]192.168.0.27:69
2022-04-01 17:33:08 us=876873 read UDP [ECONNREFUSED]: Connection refused (code=111)
2022-04-01 17:33:10 us=145973 read UDP [ECONNREFUSED]: Connection refused (code=111)
2022-04-01 17:33:14 us=125330 TLS: Initial packet from [AF_INET]192.168.0.27:69, sid=32ac2e8e 9d18691a
2022-04-01 17:33:14 us=138656 VERIFY OK: depth=1, CN=ChangeMe
2022-04-01 17:33:14 us=138915 VERIFY KU OK
2022-04-01 17:33:14 us=138922 Validating certificate extended key usage
2022-04-01 17:33:14 us=138926 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2022-04-01 17:33:14 us=138930 VERIFY EKU OK
2022-04-01 17:33:14 us=138933 VERIFY OK: depth=0, CN=server
2022-04-01 17:33:15 us=445466 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA256
2022-04-01 17:33:15 us=445527 [server] Peer Connection Initiated with [AF_INET]192.168.0.27:69
2022-04-01 17:33:15 us=451150 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 1.1.1.1,dhcp-option DNS 1.0.0.1,redirect-gateway def1 bypass-dhcp,route 192.168.0.0 255.255.0.0 net_gateway,route 172.16.0.0 255.240.0.0 net_gateway,explicit-exit-notify 2,ping 10,ping-restart 120,route-gateway 10.8.0.1,topology subnet,ifconfig 10.8.0.2 255.255.254.0,peer-id 0,cipher AES-256-GCM'
2022-04-01 17:33:15 us=451254 OPTIONS IMPORT: timers and/or timeouts modified
2022-04-01 17:33:15 us=451261 OPTIONS IMPORT: explicit notify parm(s) modified
2022-04-01 17:33:15 us=451265 OPTIONS IMPORT: --ifconfig/up options modified
2022-04-01 17:33:15 us=451268 OPTIONS IMPORT: route options modified
2022-04-01 17:33:15 us=451272 OPTIONS IMPORT: route-related options modified
2022-04-01 17:33:15 us=451275 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2022-04-01 17:33:15 us=451278 OPTIONS IMPORT: peer-id set
2022-04-01 17:33:15 us=451281 OPTIONS IMPORT: adjusting link_mtu to 1624
2022-04-01 17:33:15 us=451284 OPTIONS IMPORT: data channel crypto options modified
2022-04-01 17:33:15 us=451288 Data Channel: using negotiated cipher 'AES-256-GCM'
2022-04-01 17:33:15 us=451298 Data Channel MTU parms [ L:1552 D:1450 EF:52 EB:406 ET:0 EL:3 ]
2022-04-01 17:33:15 us=451357 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2022-04-01 17:33:15 us=451362 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2022-04-01 17:33:15 us=451367 Preserving previous TUN/TAP instance: tun0
2022-04-01 17:33:15 us=451376 Initialization Sequence Completed
^C2022-04-01 17:33:16 us=786560 event_wait : Interrupted system call (code=4)
2022-04-01 17:33:16 us=786580 SIGTERM received, sending exit notification to peer
2022-04-01 17:33:18 us=28038 TCP/UDP: Closing socket
2022-04-01 17:33:18 us=28083 /sbin/ip route del 192.168.0.0/16
2022-04-01 17:33:18 us=31213 /sbin/ip route del 172.16.0.0/12
2022-04-01 17:33:18 us=33974 /sbin/ip route del 192.168.0.27/32
2022-04-01 17:33:18 us=36321 /sbin/ip route del 0.0.0.0/1
2022-04-01 17:33:18 us=42519 /sbin/ip route del 128.0.0.0/1
2022-04-01 17:33:18 us=46070 Closing TUN/TAP interface
2022-04-01 17:33:18 us=46137 /sbin/ip addr del dev tun0 10.8.0.2/23
2022-04-01 17:33:18 us=63589 SIGTERM[soft,exit-with-notification] received, process exiting

TinCanTech

The problem appears to be you, pressing control C.

Letalis

No, I press Ctrl-C once the error has already happened. As you can see in the client log it thinks a reset command has been pushed by the server:

2022-04-01 17:31:46 us=641174 Initialization Sequence Completed
2022-04-01 17:33:03 us=871284 Connection reset command was pushed by server ('')
2022-04-01 17:33:03 us=871363 TCP/UDP: Closing socket
2022-04-01 17:33:03 us=871383 SIGUSR1[soft,server-pushed-connection-reset] received, process restarting
2022-04-01 17:33:03 us=871393 Restart pause, 5 second(s)

After the reconnection occurs and it reconnects successfully I disconnected manually before sending this log, which is then what you see in this part of the log:

2022-04-01 17:33:15 us=451376 Initialization Sequence Completed
^C2022-04-01 17:33:16 us=786560 event_wait : Interrupted system call (code=4)
2022-04-01 17:33:16 us=786580 SIGTERM received, sending exit notification to peer
2022-04-01 17:33:18 us=28038 TCP/UDP: Closing socket
2022-04-01 17:33:18 us=28083 /sbin/ip route del 192.168.0.0/16
2022-04-01 17:33:18 us=31213 /sbin/ip route del 172.16.0.0/12
2022-04-01 17:33:18 us=33974 /sbin/ip route del 192.168.0.27/32
2022-04-01 17:33:18 us=36321 /sbin/ip route del 0.0.0.0/1
2022-04-01 17:33:18 us=42519 /sbin/ip route del 128.0.0.0/1
2022-04-01 17:33:18 us=46070 Closing TUN/TAP interface
2022-04-01 17:33:18 us=46137 /sbin/ip addr del dev tun0 10.8.0.2/23
2022-04-01 17:33:18 us=63589 SIGTERM[soft,exit-with-notification] received, process exiting

The two are separate instances, pressing Ctrl-C does not result in the first series of messages, but it does the second. One causes a restart, initiated by the server, and one is a SIGTERM from Ctrl-C. Trust me, I know when I'm disconnecting from the server and when I'm not.

TinCanTech

Letalis wrote 2022-04-01 17:33:03 us=871284 Connection reset command was pushed by server ('')

The question: Why does the server push a reset ?

I could be some weird, over-looked corner case between 2.4 and 2.5 ..

I guess you need to get the server log when it happens .. as pointed out before.

Try verb 7

TinCanTech

Letalis wrote WARNING: --keepalive option is missing from server config

This is what happens when you piss the daemons off.

Letalis

I didn't include keepalive because I explicitly set the options it expands to in my server config so I can also use ping-exit. If I take away all my ping options and replace it with a keepalive I get the same result.

My other server log was during the reconnection too but unfortunately didn't display anything useful, so this is the server log on verb 7 when the reconnect occurs- this time retrieved before I disconnect manually:

DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
WARNING: Using --management on a TCP port WITHOUT passwords is STRONGLY discouraged and considered insecure
WARNING: POTENTIALLY DANGEROUS OPTION --verify-client-cert none|optional may accept clients which do not present a certificate
Current Parameter Settings:
  config = 'server.conf'
  mode = 1
  persist_config = DISABLED
  persist_mode = 1
  show_ciphers = DISABLED
  show_digests = DISABLED
  show_engines = DISABLED
  genkey = DISABLED
  genkey_filename = '[UNDEF]'
  key_pass_file = '[UNDEF]'
  show_tls_ciphers = DISABLED
  connect_retry_max = 0
Connection profiles [0]:
  proto = udp
  local = '192.168.0.27'
  local_port = '69'
  remote = '[UNDEF]'
  remote_port = '69'
  remote_float = DISABLED
  bind_defined = DISABLED
  bind_local = ENABLED
  bind_ipv6_only = DISABLED
  connect_retry_seconds = 5
  connect_timeout = 120
  socks_proxy_server = '[UNDEF]'
  socks_proxy_port = '[UNDEF]'
  tun_mtu = 1500
  tun_mtu_defined = ENABLED
  link_mtu = 1500
  link_mtu_defined = DISABLED
  tun_mtu_extra = 0
  tun_mtu_extra_defined = DISABLED
  mtu_discover_type = -1
  fragment = 0
  mssfix = 1450
  explicit_exit_notification = 1
  tls_auth_file = '[UNDEF]'
  key_direction = not set
  tls_crypt_file = '[INLINE]'
  tls_crypt_v2_file = '[UNDEF]'
Connection profiles END
  remote_random = DISABLED
  ipchange = '[UNDEF]'
  dev = 'tun0'
  dev_type = '[UNDEF]'
  dev_node = '[UNDEF]'
  lladdr = '[UNDEF]'
  topology = 3
  ifconfig_local = '10.8.0.1'
  ifconfig_remote_netmask = '255.255.254.0'
  ifconfig_noexec = DISABLED
  ifconfig_nowarn = DISABLED
  ifconfig_ipv6_local = '[UNDEF]'
  ifconfig_ipv6_netbits = 0
  ifconfig_ipv6_remote = '[UNDEF]'
  shaper = 0
  mtu_test = 0
  mlock = DISABLED
  keepalive_ping = 10
  keepalive_timeout = 120
  inactivity_timeout = 0
  inactivity_minimum_bytes = 0
  ping_send_timeout = 10
  ping_rec_timeout = 240
  ping_rec_timeout_action = 2
  ping_timer_remote = ENABLED
  remap_sigusr1 = 0
  persist_tun = ENABLED
  persist_local_ip = DISABLED
  persist_remote_ip = DISABLED
  persist_key = ENABLED
  passtos = DISABLED
  resolve_retry_seconds = 1000000000
  resolve_in_advance = DISABLED
  username = '[UNDEF]'
  groupname = '[UNDEF]'
  chroot_dir = '[UNDEF]'
  cd_dir = '[UNDEF]'
  writepid = '[UNDEF]'
  up_script = '[UNDEF]'
  down_script = '[UNDEF]'
  down_pre = DISABLED
  up_restart = DISABLED
  up_delay = DISABLED
  daemon = DISABLED
  inetd = 0
  log = ENABLED
  suppress_timestamps = ENABLED
  machine_readable_output = DISABLED
  nice = 0
  verbosity = 7
  mute = 0
  gremlin = 0
  status_file = 'openvpn-status.log'
  status_file_version = 2
  status_file_update_freq = 60
  occ = ENABLED
  rcvbuf = 0
  sndbuf = 0
  mark = 0
  sockflags = 0
  fast_io = DISABLED
  comp.alg = 0
  comp.flags = 0
  route_script = '[UNDEF]'
  route_default_gateway = '10.8.0.2'
  route_default_metric = 0
  route_noexec = DISABLED
  route_delay = 0
  route_delay_window = 30
  route_delay_defined = DISABLED
  route_nopull = DISABLED
  route_gateway_via_dhcp = DISABLED
  allow_pull_fqdn = DISABLED
  management_addr = 'localhost'
  management_port = '7505'
  management_user_pass = '[UNDEF]'
  management_log_history_cache = 250
  management_echo_buffer_size = 100
  management_write_peer_info_file = '[UNDEF]'
  management_client_user = '[UNDEF]'
  management_client_group = '[UNDEF]'
  management_flags = 0
  shared_secret_file = '[UNDEF]'
  key_direction = not set
  ciphername = 'AES-256-CBC'
  ncp_enabled = ENABLED
  ncp_ciphers = 'AES-256-GCM:AES-128-GCM:AES-256-CBC'
  authname = 'SHA512'
  prng_hash = 'SHA1'
  prng_nonce_secret_len = 16
  keysize = 0
  engine = DISABLED
  replay = ENABLED
  mute_replay_warnings = DISABLED
  replay_window = 64
  replay_time = 15
  packet_id_file = '[UNDEF]'
  test_crypto = DISABLED
  tls_server = ENABLED
  tls_client = DISABLED
  ca_file = 'ca.crt'
  ca_path = '[UNDEF]'
  dh_file = 'dh.pem'
  cert_file = 'server.crt'
  extra_certs_file = '[UNDEF]'
  priv_key_file = 'server.key'
  pkcs12_file = '[UNDEF]'
  cipher_list = '[UNDEF]'
  cipher_list_tls13 = '[UNDEF]'
  tls_cert_profile = '[UNDEF]'
  tls_verify = '[UNDEF]'
  tls_export_cert = '[UNDEF]'
  verify_x509_type = 0
  verify_x509_name = '[UNDEF]'
  crl_file = 'crl.pem'
  ns_cert_type = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_ku[i] = 0
  remote_cert_eku = '[UNDEF]'
  ssl_flags = 1
  tls_timeout = 2
  renegotiate_bytes = -1
  renegotiate_packets = 0
  renegotiate_seconds = 3600
  handshake_window = 60
  transition_window = 3600
  single_session = DISABLED
  push_peer_info = DISABLED
  tls_exit = DISABLED
  tls_crypt_v2_metadata = '[UNDEF]'
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_protected_authentication = DISABLED
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_private_mode = 00000000
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_cert_private = DISABLED
  pkcs11_pin_cache_period = -1
  pkcs11_id = '[UNDEF]'
  pkcs11_id_management = DISABLED
  server_network = 10.8.0.0
  server_netmask = 255.255.254.0
  server_network_ipv6 = ::
  server_netbits_ipv6 = 0
  server_bridge_ip = 0.0.0.0
  server_bridge_netmask = 0.0.0.0
  server_bridge_pool_start = 0.0.0.0
  server_bridge_pool_end = 0.0.0.0
  push_entry = 'dhcp-option DNS 1.1.1.1'
  push_entry = 'dhcp-option DNS 1.0.0.1'
  push_entry = 'redirect-gateway def1 bypass-dhcp'
  push_entry = 'route 192.168.0.0 255.255.0.0 net_gateway'
  push_entry = 'route 172.16.0.0 255.240.0.0 net_gateway'
  push_entry = 'explicit-exit-notify 2'
  push_entry = 'route-gateway 10.8.0.1'
  push_entry = 'topology subnet'
  push_entry = 'ping 10'
  push_entry = 'ping-restart 120'
  ifconfig_pool_defined = ENABLED
  ifconfig_pool_start = 10.8.0.2
  ifconfig_pool_end = 10.8.1.254
  ifconfig_pool_netmask = 255.255.254.0
  ifconfig_pool_persist_filename = '[UNDEF]'
  ifconfig_pool_persist_refresh_freq = 600
  ifconfig_ipv6_pool_defined = DISABLED
  ifconfig_ipv6_pool_base = ::
  ifconfig_ipv6_pool_netbits = 0
  n_bcast_buf = 256
  tcp_queue_limit = 64
  real_hash_size = 256
  virtual_hash_size = 256
  client_connect_script = '[UNDEF]'
  learn_address_script = '[UNDEF]'
  client_disconnect_script = '[UNDEF]'
  client_config_dir = '[UNDEF]'
  ccd_exclusive = DISABLED
  tmp_dir = '/tmp'
  push_ifconfig_defined = DISABLED
  push_ifconfig_local = 0.0.0.0
  push_ifconfig_remote_netmask = 0.0.0.0
  push_ifconfig_ipv6_defined = DISABLED
  push_ifconfig_ipv6_local = ::/0
  push_ifconfig_ipv6_remote = ::
  enable_c2c = DISABLED
  duplicate_cn = DISABLED
  cf_max = 0
  cf_per = 0
  max_clients = 100
  max_routes_per_client = 256
  auth_user_pass_verify_script = '/etc/openvpn/server/clientCheck.sh'
  auth_user_pass_verify_script_via_file = DISABLED
  auth_token_generate = DISABLED
  auth_token_lifetime = 0
  auth_token_secret_file = '[UNDEF]'
  port_share_host = '[UNDEF]'
  port_share_port = '[UNDEF]'
  vlan_tagging = DISABLED
  vlan_accept = all
  vlan_pvid = 1
  client = DISABLED
  pull = DISABLED
  auth_user_pass_file = '[UNDEF]'
OpenVPN 2.5.6 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr  2 2022
library versions: OpenSSL 1.1.1k  25 Mar 2021, LZO 2.10
GETADDRINFO flags=0x0423 ai_family=0 ai_socktype=1
MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:7505
NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Diffie-Hellman initialized with 2048 bit key
CRL: loaded 1 CRLs from file crl.pem
PRNG init md=SHA1 size=36
CRYPTO INFO: n_DES_cblocks=0
CRYPTO INFO: n_DES_cblocks=0
CRYPTO INFO: n_DES_cblocks=0
CRYPTO INFO: n_DES_cblocks=0
Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Outgoing Control Channel Encryption: CIPHER KEY: 551668ad 798a4756 71aae103 e0bed6c4 3debb5da ff67979a 6bc3dbc0 649913eb
Outgoing Control Channel Encryption: CIPHER block_size=16 iv_size=16
Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Outgoing Control Channel Encryption: HMAC KEY: f8c34de5 3d336921 4d4f3de6 219e7df9 69d06c2b c18a907a 8ad9836f 9433dae7
Outgoing Control Channel Encryption: HMAC size=32 block_size=32
Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Incoming Control Channel Encryption: CIPHER KEY: e1b41379 4e433564 c5262939 2dce3f9d 1a8888dc e4c36133 d7a4996e 4df44ab9
Incoming Control Channel Encryption: CIPHER block_size=16 iv_size=16
Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Incoming Control Channel Encryption: HMAC KEY: 81999073 ef5967b0 33cee47b 00a6b76f d3527cd5 dc185249 57178d2f 2240ec57
Incoming Control Channel Encryption: HMAC size=32 block_size=32
tls_crypt_adjust_frame_parameters: Adjusting frame parameters for tls-crypt by 56 bytes
TLS-Auth MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
MTU DYNAMIC mtu=1450, flags=2, 1621 -> 1450
TUN/TAP device tun0 opened
do_ifconfig, ipv4=1, ipv6=0
/sbin/ip link set dev tun0 up mtu 1500
/sbin/ip link set dev tun0 up
/sbin/ip addr add dev tun0 10.8.0.1/23
Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
Could not determine IPv4/IPv6 protocol. Using AF_INET
Socket Buffers: R=[212992->212992] S=[212992->212992]
UDPv4 link local (bound): [AF_INET]192.168.0.27:69
UDPv4 link remote: [AF_UNSPEC]
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL IPv4: base=10.8.0.2 size=509
Initialization Sequence Completed
MULTI: REAP range 0 -> 16
MULTI: multi_create_instance called
192.168.0.23:42121 Re-using SSL/TLS context
192.168.0.23:42121 CRYPTO INFO: n_DES_cblocks=0
192.168.0.23:42121 CRYPTO INFO: n_DES_cblocks=0
192.168.0.23:42121 CRYPTO INFO: n_DES_cblocks=0
192.168.0.23:42121 CRYPTO INFO: n_DES_cblocks=0
192.168.0.23:42121 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
192.168.0.23:42121 Outgoing Control Channel Encryption: CIPHER KEY: 551668ad 798a4756 71aae103 e0bed6c4 3debb5da ff67979a 6bc3dbc0 649913eb
192.168.0.23:42121 Outgoing Control Channel Encryption: CIPHER block_size=16 iv_size=16
192.168.0.23:42121 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
192.168.0.23:42121 Outgoing Control Channel Encryption: HMAC KEY: f8c34de5 3d336921 4d4f3de6 219e7df9 69d06c2b c18a907a 8ad9836f 9433dae7
192.168.0.23:42121 Outgoing Control Channel Encryption: HMAC size=32 block_size=32
192.168.0.23:42121 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
192.168.0.23:42121 Incoming Control Channel Encryption: CIPHER KEY: e1b41379 4e433564 c5262939 2dce3f9d 1a8888dc e4c36133 d7a4996e 4df44ab9
192.168.0.23:42121 Incoming Control Channel Encryption: CIPHER block_size=16 iv_size=16
192.168.0.23:42121 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
192.168.0.23:42121 Incoming Control Channel Encryption: HMAC KEY: 81999073 ef5967b0 33cee47b 00a6b76f d3527cd5 dc185249 57178d2f 2240ec57
192.168.0.23:42121 Incoming Control Channel Encryption: HMAC size=32 block_size=32
192.168.0.23:42121 tls_crypt_adjust_frame_parameters: Adjusting frame parameters for tls-crypt by 56 bytes
192.168.0.23:42121 PID packet_id_init seq_backtrack=64 time_backtrack=15
192.168.0.23:42121 PID packet_id_init seq_backtrack=64 time_backtrack=15
192.168.0.23:42121 PID packet_id_init seq_backtrack=64 time_backtrack=15
192.168.0.23:42121 PID packet_id_init seq_backtrack=64 time_backtrack=15
192.168.0.23:42121 Control Channel MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
192.168.0.23:42121 MTU DYNAMIC mtu=1450, flags=2, 1621 -> 1450
192.168.0.23:42121 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
192.168.0.23:42121 crypto_adjust_frame_parameters: Adjusting frame parameters for crypto by 100 bytes
192.168.0.23:42121 calc_options_string_link_mtu: link-mtu 1621 -> 1601
192.168.0.23:42121 crypto_adjust_frame_parameters: Adjusting frame parameters for crypto by 100 bytes
192.168.0.23:42121 calc_options_string_link_mtu: link-mtu 1621 -> 1601
192.168.0.23:42121 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-server'
192.168.0.23:42121 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,cipher AES-256-CBC,auth SHA512,keysize 256,key-method 2,tls-client'
192.168.0.23:42121 SENT PING
192.168.0.23:42121 GET INST BY REAL: 192.168.0.23:42121 [ok]
192.168.0.23:42121 UDPv4 READ [54] from [AF_INET]192.168.0.23:42121: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=866 DATA len=40
192.168.0.23:42121 TLS: Initial packet from [AF_INET]192.168.0.23:42121, sid=c6fda952 ef814d3f
192.168.0.23:42121 PID_TEST [0] [TLS_WRAP-0] [] 0:0 1648898174:3 t=1648898181[0] r=[0,64,15,0,1] sl=[0,0,64,528]
192.168.0.23:42121 UDPv4 WRITE [66] to [AF_INET]192.168.0.23:42121: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ ] pid=354 DATA len=52
GET INST BY REAL: 192.168.0.23:42121 [ok]
192.168.0.23:42121 UDPv4 READ [62] from [AF_INET]192.168.0.23:42121: P_ACK_V1 kid=0 [ ]
192.168.0.23:42121 PID_TEST [0] [TLS_WRAP-0] [0__] 1648898174:3 1648898174:4 t=1648898181[0] r=[0,64,15,0,1] sl=[61,3,64,528]
GET INST BY REAL: 192.168.0.23:42121 [ok]
192.168.0.23:42121 UDPv4 READ [331] from [AF_INET]192.168.0.23:42121: P_CONTROL_V1 kid=0 [ ] pid=1378 DATA len=317
192.168.0.23:42121 PID_TEST [0] [TLS_WRAP-0] [00__] 1648898174:4 1648898174:5 t=1648898181[0] r=[0,64,15,0,1] sl=[60,4,64,528]
192.168.0.23:42121 UDPv4 WRITE [1128] to [AF_INET]192.168.0.23:42121: P_CONTROL_V1 kid=0 [ ] pid=610 DATA len=1114
192.168.0.23:42121 UDPv4 WRITE [1116] to [AF_INET]192.168.0.23:42121: P_CONTROL_V1 kid=0 [ ] pid=866 DATA len=1102
192.168.0.23:42121 UDPv4 WRITE [199] to [AF_INET]192.168.0.23:42121: P_CONTROL_V1 kid=0 [ ] pid=1122 DATA len=185
GET INST BY REAL: 192.168.0.23:42121 [ok]
192.168.0.23:42121 UDPv4 READ [62] from [AF_INET]192.168.0.23:42121: P_ACK_V1 kid=0 [ ]
192.168.0.23:42121 PID_TEST [0] [TLS_WRAP-0] [000__] 1648898174:5 1648898174:6 t=1648898181[0] r=[0,64,15,0,1] sl=[59,5,64,528]
GET INST BY REAL: 192.168.0.23:42121 [ok]
192.168.0.23:42121 UDPv4 READ [62] from [AF_INET]192.168.0.23:42121: P_ACK_V1 kid=0 [ ]
192.168.0.23:42121 PID_TEST [0] [TLS_WRAP-0] [0000__] 1648898174:6 1648898174:7 t=1648898181[0] r=[0,64,15,0,1] sl=[58,6,64,528]
192.168.0.23:42121 MULTI: C2C/MCAST/BCAST
GET INST BY REAL: 192.168.0.23:42121 [ok]
192.168.0.23:42121 UDPv4 READ [657] from [AF_INET]192.168.0.23:42121: P_CONTROL_V1 kid=0 [ ] pid=2146 DATA len=643
192.168.0.23:42121 PID_TEST [0] [TLS_WRAP-0] [00000__] 1648898174:7 1648898174:8 t=1648898181[0] r=[0,64,15,0,1] sl=[57,7,64,528]
192.168.0.23:42121 peer info: IV_VER=2.5.6
192.168.0.23:42121 peer info: IV_PLAT=linux
192.168.0.23:42121 peer info: IV_PROTO=6
192.168.0.23:42121 peer info: IV_NCP=2
192.168.0.23:42121 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM:AES-256-CBC
192.168.0.23:42121 peer info: IV_LZ4=1
192.168.0.23:42121 peer info: IV_LZ4v2=1
192.168.0.23:42121 peer info: IV_LZO=1
192.168.0.23:42121 peer info: IV_COMP_STUB=1
192.168.0.23:42121 peer info: IV_COMP_STUBv2=1
192.168.0.23:42121 peer info: IV_TCPNL=1
192.168.0.23:42121 TLS: Username/Password authentication succeeded for username 'user'
MULTI: REAP range 16 -> 32
192.168.0.23:42121 UDPv4 WRITE [224] to [AF_INET]192.168.0.23:42121: P_CONTROL_V1 kid=0 [ ] pid=1378 DATA len=210
192.168.0.23:42121 UDPv4 WRITE [275] to [AF_INET]192.168.0.23:42121: P_CONTROL_V1 kid=0 [ ] pid=1634 DATA len=261
GET INST BY REAL: 192.168.0.23:42121 [ok]
192.168.0.23:42121 UDPv4 READ [62] from [AF_INET]192.168.0.23:42121: P_ACK_V1 kid=0 [ ]
192.168.0.23:42121 PID_TEST [0] [TLS_WRAP-0] [222222__] 1648898174:8 1648898174:9 t=1648898183[0] r=[-2,64,15,0,1] sl=[56,8,64,528]
GET INST BY REAL: 192.168.0.23:42121 [ok]
192.168.0.23:42121 UDPv4 READ [62] from [AF_INET]192.168.0.23:42121: P_ACK_V1 kid=0 [ ]
192.168.0.23:42121 PID_TEST [0] [TLS_WRAP-0] [0222222__] 1648898174:9 1648898174:10 t=1648898183[0] r=[-2,64,15,0,1] sl=[55,9,64,528]
192.168.0.23:42121 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384
192.168.0.23:42121 [] Peer Connection Initiated with [AF_INET]192.168.0.23:42121
192.168.0.23:42121 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
192.168.0.23:42121 MULTI: Learn: 10.8.0.2 -> 192.168.0.23:42121
192.168.0.23:42121 MULTI: primary virtual IP for 192.168.0.23:42121: 10.8.0.2
192.168.0.23:42121 Data Channel: using negotiated cipher 'AES-256-GCM'
192.168.0.23:42121 crypto_adjust_frame_parameters: Adjusting frame parameters for crypto by 48 bytes
192.168.0.23:42121 MTU DYNAMIC mtu=1450, flags=2, 1549 -> 1450
192.168.0.23:42121 Data Channel MTU parms [ L:1549 D:1450 EF:49 EB:406 ET:0 EL:3 ]
192.168.0.23:42121 Client pre_master: 2199497b 98eb57c1 4c33d48c defce59b 2a7caa07 8c614f4c 1ae87766 b360c7e5 59ed40fd 180bb0ca f68ce457 1d9ef10c
192.168.0.23:42121 Client random1: 8cea7b67 be5c36da bf873675 8f932616 0039a6c5 c0bb1046 9185a28d 32aa9aee
192.168.0.23:42121 Client random2: fcddcaf2 3100b6f6 38e0bd0a 745ba5d8 f72ebcfd bd2db039 b23975e9 e0c090fa
192.168.0.23:42121 Server pre_master: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
192.168.0.23:42121 Server random1: d7e139af d4ee1b7d 8a303c78 9b480b40 87eef6c3 d9b0830f c977e0dc 3fc91e21
192.168.0.23:42121 Server random2: cae3b50f b31da66a ba392d5b e2377915 584bfaa1 57be766e f407f768 3d431876
192.168.0.23:42121 tls1_P_hash sec: 2199497b 98eb57c1 4c33d48c defce59b 2a7caa07 8c614f4c
192.168.0.23:42121 tls1_P_hash seed: 4f70656e 56504e20 6d617374 65722073 65637265 748cea7b 67be5c36 dabf8736 758f9326 160039a6 c5c0bb10 469185a2 8d32aa9a eed7e139 afd4ee1b 7d8a303c 789b480b 4087eef6 c3d9b083 0fc977e0 dc3fc91e 21
192.168.0.23:42121 tls1_P_hash out: 9413f49f 346f2fb4 20f90e0c 6efb58b0 0b1b7a22 ae704bd5 126a57eb 734e7a2b 8c1203ab fef2ae7b c81fb075 21652b50
192.168.0.23:42121 tls1_P_hash sec: 1ae87766 b360c7e5 59ed40fd 180bb0ca f68ce457 1d9ef10c
192.168.0.23:42121 tls1_P_hash seed: 4f70656e 56504e20 6d617374 65722073 65637265 748cea7b 67be5c36 dabf8736 758f9326 160039a6 c5c0bb10 469185a2 8d32aa9a eed7e139 afd4ee1b 7d8a303c 789b480b 4087eef6 c3d9b083 0fc977e0 dc3fc91e 21
192.168.0.23:42121 tls1_P_hash out: 2afbcf81 4eaaccff bb577ec1 2c96af0c e0c2651d 4cf9dedf cfce9e19 cb767f3b d19826f6 d575ca85 0afaa68c e90608aa
192.168.0.23:42121 tls1_PRF out[48]: bee83b1e 7ac5e34b 9bae70cd 426df7bc ebd91f3f e289950a dda4c9f2 b8380510 5d8a255d 2b8764fe c2e516f9 c86323fa
192.168.0.23:42121 tls1_P_hash sec: bee83b1e 7ac5e34b 9bae70cd 426df7bc ebd91f3f e289950a
192.168.0.23:42121 tls1_P_hash seed: 4f70656e 56504e20 6b657920 65787061 6e73696f 6efcddca f23100b6 f638e0bd 0a745ba5 d8f72ebc fdbd2db0 39b23975 e9e0c090 facae3b5 0fb31da6 6aba392d 5be23779 15584bfa a157be76 6ef407f7 683d4318 76c6fda9 52ef814d 3f1b63bd 9e64a4f4 8b
192.168.0.23:42121 tls1_P_hash out: a051fac5 ee798d31 540423b6 a5193db1 9a80fae9 ca21c889 ca303e69 b1496443 1e7bf409 ff834a97 00f95368 be9acf9b bd410978 0c90ea97 bc670969 c07ac3d1 9061925a f7e28962 a09ab845 de6675a5 6c48f369 12c1053a 3fa79b1d 8c9efa3c d1cdf640 465a4d2f bfbd8340 935f38a5 1d362372 4adfc28d 0b8ec73e ead1534e ac96146d b361fa8b 13ce6b1b 1229dd9d 3b9215a1 437eecad 8906474f d252d2f9 835c4fe1 a5dc3bc1 70549970 718382ce aa2fa429 85fb3a80 c30a1d2c b8b6476c 7539d2fb 831eef34 6770909d 08e8dd49 1f5a0a88 54c6e29a cd0e21d4 a2aea20e 0921e40e 4718aee7 5c828f4b 8c717a32 e9f8e49e 34d0eab7 2eeb9674 eb7e9b30
192.168.0.23:42121 tls1_P_hash sec: dda4c9f2 b8380510 5d8a255d 2b8764fe c2e516f9 c86323fa
192.168.0.23:42121 tls1_P_hash seed: 4f70656e 56504e20 6b657920 65787061 6e73696f 6efcddca f23100b6 f638e0bd 0a745ba5 d8f72ebc fdbd2db0 39b23975 e9e0c090 facae3b5 0fb31da6 6aba392d 5be23779 15584bfa a157be76 6ef407f7 683d4318 76c6fda9 52ef814d 3f1b63bd 9e64a4f4 8b
192.168.0.23:42121 tls1_P_hash out: 6a7afe73 6b549709 197d578f 3b1a038f 93671a20 78355b04 723268ef 787ed89a 073f8040 f69e7402 5274292d f3fb8d69 a9f1cfce e62fa881 3e4b8904 dc95d2de ee1a0566 2249f7ae f7479d07 9d1bf666 e6f7d17b c80971d4 2fecf7db d453d6a3 884f83b2 3fd17211 02af33ca bba88404 79e770e0 8ab887c2 b6e6c723 19ce81a4 be5fab68 cf008eab ee1f8b82 f4b55ff7 13de602f 32eb8a78 459e31f9 1c05c423 632b4f5c fb750a1e 01b568d2 4a028466 9ced8f86 ae6f8f27 4580abc7 f0284c64 da399642 f5b20939 f5010b68 e37d858b e89a4597 a41f5cfe 74f805fa 5cbf2ae7 b56d77f2 c8393606 326745b4 8d3d462b 4afe48df 06603b58 0e86fe14 cabfd6f9
192.168.0.23:42121 tls1_PRF out[256]: ca2b04b6 852d1a38 4d797439 9e033e3e 09e7e0c9 b214938d b8025686 c937bcd9 19447449 091d3e95 528d7a45 4d6142f2 14b0c6b6 eabf4216 822c806d 1cef110f 7e7b973c d5ab7ecc 57dd2542 437d83c3 8abf2212 dac874ee 104b6cc6 58cd2c9f 598275f2 798b3f3e bd12b08a 28f7bca1 64d15392 c067454f bd68001d f31fd2ea 12c9bf05 7c617420 fdd1e099 e69c826a 284c758e 719566d5 cc9876b6 ce5716da e07700bd 5ea931df 71e1f1a2 3b8106a8 36c22baf 2b94b5a7 868ab6eb 489e0b08 af0044b9 76ace60d 92719bf5 eb9558c2 f7c04f1f f0d9be64 b9f6242e fe1188e9 bc4c93fc 8f2198e1 6ee5caff 014c3c19 a306ac41 32b0d1ef 206d6860 21c14dc9
192.168.0.23:42121 Master Encrypt (cipher): ca2b04b6 852d1a38 4d797439 9e033e3e 09e7e0c9 b214938d b8025686 c937bcd9
192.168.0.23:42121 Master Encrypt (hmac):
192.168.0.23:42121 Master Decrypt (cipher): 12c9bf05 7c617420 fdd1e099 e69c826a 284c758e 719566d5 cc9876b6 ce5716da
192.168.0.23:42121 Master Decrypt (hmac):
192.168.0.23:42121 CRYPTO INFO: n_DES_cblocks=0
192.168.0.23:42121 CRYPTO INFO: n_DES_cblocks=0
192.168.0.23:42121 CRYPTO INFO: n_DES_cblocks=0
192.168.0.23:42121 CRYPTO INFO: n_DES_cblocks=0
192.168.0.23:42121 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
192.168.0.23:42121 Outgoing Data Channel: CIPHER KEY: 12c9bf05 7c617420 fdd1e099 e69c826a 284c758e 719566d5 cc9876b6 ce5716da
192.168.0.23:42121 Outgoing Data Channel: CIPHER block_size=16 iv_size=12
192.168.0.23:42121 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
192.168.0.23:42121 Incoming Data Channel: CIPHER KEY: ca2b04b6 852d1a38 4d797439 9e033e3e 09e7e0c9 b214938d b8025686 c937bcd9
192.168.0.23:42121 Incoming Data Channel: CIPHER block_size=16 iv_size=12
192.168.0.23:42121 SENT CONTROL [UNDEF]: 'PUSH_REPLY,dhcp-option DNS 1.1.1.1,dhcp-option DNS 1.0.0.1,redirect-gateway def1 bypass-dhcp,route 192.168.0.0 255.255.0.0 net_gateway,route 172.16.0.0 255.240.0.0 net_gateway,explicit-exit-notify 2,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.254.0,peer-id 0,cipher AES-256-GCM' (status=1)
192.168.0.23:42121 UDPv4 WRITE [400] to [AF_INET]192.168.0.23:42121: P_CONTROL_V1 kid=0 [ ] pid=1890 DATA len=386
GET INST BY REAL: 192.168.0.23:42121 [ok]
192.168.0.23:42121 UDPv4 READ [62] from [AF_INET]192.168.0.23:42121: P_ACK_V1 kid=0 [ ]
192.168.0.23:42121 PID_TEST [0] [TLS_WRAP-0] [00222222__] 1648898174:10 1648898174:11 t=1648898183[0] r=[-2,64,15,0,1] sl=[54,10,64,528]
MULTI: REAP range 32 -> 48
MULTI: REAP range 48 -> 64

If it is some weird case between OpenVPN versions, it would have to be between 2.5.1 and 2.5.2, as 2.5.1 is the only 2.5 version I can get to work without reconnecting.

TinCanTech

This log does not show the server sending a reset ..

At first I wanted to help to determine if there is some inconsistency between the versions, as you claim.
But now I think you simply have some local issue, which is on you.

Try a "default" setup and see what happens.

Letalis

As I showed in my original post, the only way I can get it to display something about the reset is by going into the management console, then I get this (even though it comes under a "LOG" it never actually gets saved to the server log):

>LOG:1648909763,N,event_wait : Interrupted system call (code=4)
>LOG:1648909763,,SENT CONTROL [client]: 'RESTART' (status=1)
>LOG:1648909765,,TCP/UDP: Closing socket
>LOG:1648909765,,Closing TUN/TAP interface

Is this the server saying it's received a 'RESTART' message or sent one?

I have tried a "default" setup as you suggest with this config:

local 192.168.0.40
port 69
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
verb 4
crl-verify crl.pem
explicit-exit-notify
management localhost 7505

The only thing I changed in the config is adding a management line so I can get the message about the disconnect again.
If I change the server version to 2.5.1, it works without an issue.

Just for the record, I'm aware this could well be a local issue, but something must be different with the two versions for this to be happening.

cron2

2.5.1 to 2.5.2 has quite a bit of changes on TLS auth handling in there, so any of these could be relevant.

There is also a fix related to CRL files, but that also *should* not be relevant.

Can you try without the CRL line in your config? If it still happens, can you try to do a "git bisect" to find out exactly which commit caused the behavioural change you see?

Then we need to understand why this is only affecting your setup...

(btw, you can also leave out the "cipher AES-256-CBC" and "auth SHA512" - they are not used anyway if a 2.4+ client connects, and negotiates AES-256-GCM)

openvpn_inc

Hi Let,

See the discussion of SIGUSR1 in the manual. There are no timestamps in the server log, why? It would be interesting to see what is logged at that precise moment. Synchronize your times! Also, what operating systems are these?

regards, rob0

TinCanTech

openvpn_inc wrote There are no timestamps in the server log, why?

Because openvpn-server@.service sets --suppress-timestamps