Good day!
Suddenly, it turned out that I was an idiot and missed the moment when my "ca.crt" on the old OpenVPN server expired and I had to start everything from scratch on a new fresh Debian 11 distribution and I'm running into a problem.
First, I'll describe what I'm trying to replicate:
In my previous configuration, it was convenient for me to connect a big number of remote Mikrotik routers (more than 30) via OpenVPN using subnet masks for 2 IP addresses only, that is, "/30" (or "255.255.255.252"). The inclusion of all routers according to the classical scheme in one large subnet is not suitable. Client-server links must be on their own subnets and I was fine with the fact that only the server and only the client could be present on this subnet (/30).
On the old server, the configuration file looked like this:
#Server instance for remote Mikrotik 11
proto tcp
dev tap11
lport 25511
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/srv11.crt
key /etc/openvpn/easy-rsa/2.0/keys/srv11.key # This file should be kept secret
dh /etc/openvpn/easy-rsa/2.0/keys/dh2048.pem
client-config-dir /etc/openvpn/srv11cli
#Use subnet 11 with ip from 200.40 to 200.43 where 40 - network and 43 - boardcast
ifconfig 192.168.200.41 255.255.255.252
server 192.168.200.40 255.255.255.252
keepalive 10 120
tun-mtu 1500
mssfix 1450
cipher AES-256-CBC # AES
auth sha1
user nobody
group nogroup
persist-key
persist-tun
status /var/log/srv11-status.log
log /var/log/srv11.log
verb 3
mute 10
The Mikrotik client got a second ip address using a client config file on the same subnet:
#client mikrotik 11
ifconfig-push 192.168.200.42 255.255.255.252
push "route 192.168.1.0 255.255.255.0 192.168.200.41"
push "route 192.168.2.0 255.255.255.0 192.168.200.41"
push "route 172.16.0.100 255.255.255.255 192.168.200.41"
And everything worked fine, until my misstep when my root certificate expired.
Today, I installed Debian 11 (Bullseye), installed OpenVPN (2.5.1-3) and EasyRSA (3.0.8-1) from the official repositories, and ran into a wall.
root@vpnharbor-main:~# openvpn --version
OpenVPN 2.5.1 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2021
library versions: OpenSSL 1.1.1n 15 Mar 2022, LZO 2.10
Originally developed by James Yonan
Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>
Compile time defines: enable_async_push=no enable_comp_stub=no enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=needless enable_fragment=yes enable_iproute2=no enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_maintainer_mode=no enable_management=yes enable_multihome=yes enable_option_checking=no enable_pam_dlopen=no enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_shared=yes enable_shared_with_static_runtimes=no enable_silent_rules=no enable_small=no enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=yes enable_werror=no enable_win32_dll=yes enable_x509_alt_username=yes with_aix_soname=aix with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_sysroot=no
My current configuration looks like this:
proto tcp
dev tap11
port 25511
topology subnet
ifconfig 192.168.200.41 255.255.255.252
server 192.168.200.40 255.255.255.252
ca /etc/openvpn/srv11keys/ca.crt
cert /etc/openvpn/srv11keys/srv11new2022.crt
key /etc/openvpn/srv11keys/srv11new2022.key # This file should be kept secret
dh /etc/openvpn/srv11keys/dh2048.pem
client-config-dir /etc/openvpn/srv11cli
status /var/log/srv11-status.log
log-append /var/log/srv11.log
keepalive 10 120
tun-mtu 1500
mssfix 1450
cipher AES-256-CBC # AES
#New Auth algo
auth sha512
user nobody
group nogroup
persist-key
persist-tun
verb 4
#verb 3 - normal 6-11 - possible max
mute 10
The client, just as before, must receive the IP address and routes from the client configuration file (in the "srv11cli" dir):
#client mikrotik 11
ifconfig-push 192.168.200.42 255.255.255.252
push "route 192.168.1.0 255.255.255.0 192.168.200.41"
push "route 192.168.2.0 255.255.255.0 192.168.200.41"
push "route 172.16.0.100 255.255.255.255 192.168.200.41"
I want to run this instance:
root@vpnharbor-main:~# systemctl enable openvpn@srv11-v2022
Created symlink /etc/systemd/system/multi-user.target.wants/openvpn@srv11-v2022.service -> /lib/systemd/system/openvpn@.service.
root@vpnharbor-main:~# systemctl start openvpn@srv11-v2022
root@vpnharbor-main:~# systemctl status openvpn@srv11-v2022
* openvpn@srv11-v2022.service - OpenVPN connection to srv11-v2022
Loaded: loaded (/lib/systemd/system/openvpn@.service; enabled; vendor preset: enabled)
Active: activating (auto-restart) (Result: exit-code) since Wed 2022-04-20 14:47:28 EEST; 1s ago
Docs: man:openvpn(8)
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
https://community.openvpn.net/openvpn/wiki/HOWTO
Process: 54010 ExecStart=/usr/sbin/openvpn --daemon ovpn-srv11-v2022 --status /run/openvpn/srv11-v2022.status 10 --cd /etc/openvpn --config /etc/openvpn/srv11-v2022.conf --writepid /run/openvpn/srv11-v2022.pid (code=exited, status=1/FAILURE)
Main PID: 54010 (code=exited, status=1/FAILURE)
Status: "Pre-connection initialization successful"
CPU: 37ms
This is my log-file (verb 6):
2022-04-20 15:13:20 us=303420 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
2022-04-20 15:13:20 us=304033 Current Parameter Settings:
2022-04-20 15:13:20 us=304068 config = '/etc/openvpn/srv11-v2022.conf'
2022-04-20 15:13:20 us=304092 mode = 1
2022-04-20 15:13:20 us=304116 persist_config = DISABLED
2022-04-20 15:13:20 us=304136 persist_mode = 1
2022-04-20 15:13:20 us=304158 show_ciphers = DISABLED
2022-04-20 15:13:20 us=304180 show_digests = DISABLED
2022-04-20 15:13:20 us=304201 show_engines = DISABLED
2022-04-20 15:13:20 us=304222 genkey = DISABLED
2022-04-20 15:13:20 us=304244 genkey_filename = '[UNDEF]'
2022-04-20 15:13:20 us=304265 key_pass_file = '[UNDEF]'
2022-04-20 15:13:20 us=304294 show_tls_ciphers = DISABLED
2022-04-20 15:13:20 us=304318 connect_retry_max = 0
2022-04-20 15:13:20 us=304340 Connection profiles [0]:
2022-04-20 15:13:20 us=304363 proto = tcp-server
2022-04-20 15:13:20 us=304384 local = '[UNDEF]'
2022-04-20 15:13:20 us=304405 local_port = '25511'
2022-04-20 15:13:20 us=304426 remote = '[UNDEF]'
2022-04-20 15:13:20 us=304447 remote_port = '1194'
2022-04-20 15:13:20 us=304468 remote_float = DISABLED
2022-04-20 15:13:20 us=304489 bind_defined = DISABLED
2022-04-20 15:13:20 us=304510 bind_local = ENABLED
2022-04-20 15:13:20 us=304531 bind_ipv6_only = DISABLED
2022-04-20 15:13:20 us=304552 connect_retry_seconds = 5
2022-04-20 15:13:20 us=304573 connect_timeout = 120
2022-04-20 15:13:20 us=304617 socks_proxy_server = '[UNDEF]'
2022-04-20 15:13:20 us=304640 socks_proxy_port = '[UNDEF]'
2022-04-20 15:13:20 us=304662 tun_mtu = 1500
2022-04-20 15:13:20 us=304683 tun_mtu_defined = ENABLED
2022-04-20 15:13:20 us=304704 link_mtu = 1500
2022-04-20 15:13:20 us=304726 link_mtu_defined = DISABLED
2022-04-20 15:13:20 us=304747 tun_mtu_extra = 32
2022-04-20 15:13:20 us=304769 tun_mtu_extra_defined = ENABLED
2022-04-20 15:13:20 us=304790 mtu_discover_type = -1
2022-04-20 15:13:20 us=304811 fragment = 0
2022-04-20 15:13:20 us=304849 mssfix = 1450
2022-04-20 15:13:20 us=304875 explicit_exit_notification = 0
2022-04-20 15:13:20 us=304896 tls_auth_file = '[UNDEF]'
2022-04-20 15:13:20 us=304918 key_direction = not set
2022-04-20 15:13:20 us=304939 tls_crypt_file = '[UNDEF]'
2022-04-20 15:13:20 us=304960 tls_crypt_v2_file = '[UNDEF]'
2022-04-20 15:13:20 us=304982 Connection profiles END
2022-04-20 15:13:20 us=305074 remote_random = DISABLED
2022-04-20 15:13:20 us=305101 ipchange = '[UNDEF]'
2022-04-20 15:13:20 us=305123 dev = 'tap11'
2022-04-20 15:13:20 us=305147 dev_type = '[UNDEF]'
2022-04-20 15:13:20 us=305167 dev_node = '[UNDEF]'
2022-04-20 15:13:20 us=305189 lladdr = '[UNDEF]'
2022-04-20 15:13:20 us=305210 topology = 3
2022-04-20 15:13:20 us=305231 ifconfig_local = '192.168.200.41'
2022-04-20 15:13:20 us=305253 ifconfig_remote_netmask = '255.255.255.252'
2022-04-20 15:13:20 us=305274 ifconfig_noexec = DISABLED
2022-04-20 15:13:20 us=305295 ifconfig_nowarn = DISABLED
2022-04-20 15:13:20 us=305316 ifconfig_ipv6_local = '[UNDEF]'
2022-04-20 15:13:20 us=305338 ifconfig_ipv6_netbits = 0
2022-04-20 15:13:20 us=305359 ifconfig_ipv6_remote = '[UNDEF]'
2022-04-20 15:13:20 us=305380 shaper = 0
2022-04-20 15:13:20 us=305402 mtu_test = 0
2022-04-20 15:13:20 us=305423 mlock = DISABLED
2022-04-20 15:13:20 us=305444 keepalive_ping = 10
2022-04-20 15:13:20 us=305465 keepalive_timeout = 120
2022-04-20 15:13:20 us=305486 inactivity_timeout = 0
2022-04-20 15:13:20 us=305507 ping_send_timeout = 10
2022-04-20 15:13:20 us=305529 ping_rec_timeout = 240
2022-04-20 15:13:20 us=305550 ping_rec_timeout_action = 2
2022-04-20 15:13:20 us=305571 ping_timer_remote = DISABLED
2022-04-20 15:13:20 us=305592 remap_sigusr1 = 0
2022-04-20 15:13:20 us=305613 persist_tun = ENABLED
2022-04-20 15:13:20 us=305634 persist_local_ip = DISABLED
2022-04-20 15:13:20 us=305655 persist_remote_ip = DISABLED
2022-04-20 15:13:20 us=305676 persist_key = ENABLED
2022-04-20 15:13:20 us=305697 passtos = DISABLED
2022-04-20 15:13:20 us=305719 resolve_retry_seconds = 1000000000
2022-04-20 15:13:20 us=305740 resolve_in_advance = DISABLED
2022-04-20 15:13:20 us=305761 username = 'nobody'
2022-04-20 15:13:20 us=305782 groupname = 'nogroup'
2022-04-20 15:13:20 us=305803 chroot_dir = '[UNDEF]'
2022-04-20 15:13:20 us=305824 cd_dir = '/etc/openvpn'
2022-04-20 15:13:20 us=305845 writepid = '/run/openvpn/srv11-v2022.pid'
2022-04-20 15:13:20 us=305866 up_script = '[UNDEF]'
2022-04-20 15:13:20 us=305887 down_script = '[UNDEF]'
2022-04-20 15:13:20 us=305908 down_pre = DISABLED
2022-04-20 15:13:20 us=305929 up_restart = DISABLED
2022-04-20 15:13:20 us=305950 up_delay = DISABLED
2022-04-20 15:13:20 us=305971 daemon = ENABLED
2022-04-20 15:13:20 us=305993 inetd = 0
2022-04-20 15:13:20 us=306014 log = ENABLED
2022-04-20 15:13:20 us=306035 suppress_timestamps = DISABLED
2022-04-20 15:13:20 us=306056 machine_readable_output = DISABLED
2022-04-20 15:13:20 us=306077 nice = 0
2022-04-20 15:13:20 us=306098 verbosity = 6
2022-04-20 15:13:20 us=306119 mute = 0
2022-04-20 15:13:20 us=306140 gremlin = 0
2022-04-20 15:13:20 us=306161 status_file = '/var/log/srv11-v2022-status.log'
2022-04-20 15:13:20 us=306182 status_file_version = 1
2022-04-20 15:13:20 us=306204 status_file_update_freq = 10
2022-04-20 15:13:20 us=306225 occ = ENABLED
2022-04-20 15:13:20 us=306246 rcvbuf = 0
2022-04-20 15:13:20 us=306267 sndbuf = 0
2022-04-20 15:13:20 us=306305 mark = 0
2022-04-20 15:13:20 us=306328 sockflags = 0
2022-04-20 15:13:20 us=306349 fast_io = DISABLED
2022-04-20 15:13:20 us=306371 comp.alg = 0
2022-04-20 15:13:20 us=306392 comp.flags = 0
2022-04-20 15:13:20 us=306414 route_script = '[UNDEF]'
2022-04-20 15:13:20 us=306435 route_default_gateway = '[UNDEF]'
2022-04-20 15:13:20 us=306456 route_default_metric = 0
2022-04-20 15:13:20 us=306477 route_noexec = DISABLED
2022-04-20 15:13:20 us=306498 route_delay = 0
2022-04-20 15:13:20 us=306520 route_delay_window = 30
2022-04-20 15:13:20 us=306541 route_delay_defined = DISABLED
2022-04-20 15:13:20 us=306562 route_nopull = DISABLED
2022-04-20 15:13:20 us=306582 route_gateway_via_dhcp = DISABLED
2022-04-20 15:13:20 us=306603 allow_pull_fqdn = DISABLED
2022-04-20 15:13:20 us=306625 management_addr = '[UNDEF]'
2022-04-20 15:13:20 us=306647 management_port = '[UNDEF]'
2022-04-20 15:13:20 us=306669 management_user_pass = '[UNDEF]'
2022-04-20 15:13:20 us=306691 management_log_history_cache = 250
2022-04-20 15:13:20 us=306712 management_echo_buffer_size = 100
2022-04-20 15:13:20 us=306746 management_write_peer_info_file = '[UNDEF]'
2022-04-20 15:13:20 us=306769 management_client_user = '[UNDEF]'
2022-04-20 15:13:20 us=306790 management_client_group = '[UNDEF]'
2022-04-20 15:13:20 us=306812 management_flags = 0
2022-04-20 15:13:20 us=306834 shared_secret_file = '[UNDEF]'
2022-04-20 15:13:20 us=306856 key_direction = not set
2022-04-20 15:13:20 us=306877 ciphername = 'AES-256-CBC'
2022-04-20 15:13:20 us=306898 ncp_enabled = ENABLED
2022-04-20 15:13:20 us=306919 ncp_ciphers = 'AES-256-GCM:AES-128-GCM:AES-256-CBC'
2022-04-20 15:13:20 us=306941 authname = 'sha512'
2022-04-20 15:13:20 us=306962 prng_hash = 'SHA1'
2022-04-20 15:13:20 us=306984 prng_nonce_secret_len = 16
2022-04-20 15:13:20 us=307006 keysize = 0
2022-04-20 15:13:20 us=307027 engine = DISABLED
2022-04-20 15:13:20 us=307049 replay = ENABLED
2022-04-20 15:13:20 us=307071 mute_replay_warnings = DISABLED
2022-04-20 15:13:20 us=307093 replay_window = 64
2022-04-20 15:13:20 us=307115 replay_time = 15
2022-04-20 15:13:20 us=307136 packet_id_file = '[UNDEF]'
2022-04-20 15:13:20 us=307158 test_crypto = DISABLED
2022-04-20 15:13:20 us=307179 tls_server = ENABLED
2022-04-20 15:13:20 us=307200 tls_client = DISABLED
2022-04-20 15:13:20 us=307222 ca_file = '/etc/openvpn/srv11keys/ca.crt'
2022-04-20 15:13:20 us=307243 ca_path = '[UNDEF]'
2022-04-20 15:13:20 us=307265 dh_file = '/etc/openvpn/srv11keys/dh2048.pem'
2022-04-20 15:13:20 us=307287 cert_file = '/etc/openvpn/srv11keys/srv11new2022.crt'
2022-04-20 15:13:20 us=307310 extra_certs_file = '[UNDEF]'
2022-04-20 15:13:20 us=307332 priv_key_file = '/etc/openvpn/srv11keys/srv11new2022.key'
2022-04-20 15:13:20 us=307354 pkcs12_file = '[UNDEF]'
2022-04-20 15:13:20 us=307375 cipher_list = '[UNDEF]'
2022-04-20 15:13:20 us=307396 cipher_list_tls13 = '[UNDEF]'
2022-04-20 15:13:20 us=307418 tls_cert_profile = '[UNDEF]'
2022-04-20 15:13:20 us=307439 tls_verify = '[UNDEF]'
2022-04-20 15:13:20 us=307459 tls_export_cert = '[UNDEF]'
2022-04-20 15:13:20 us=307481 verify_x509_type = 0
2022-04-20 15:13:20 us=307502 verify_x509_name = '[UNDEF]'
2022-04-20 15:13:20 us=307523 crl_file = '[UNDEF]'
2022-04-20 15:13:20 us=307545 ns_cert_type = 0
2022-04-20 15:13:20 us=307567 remote_cert_ku[i] = 0
2022-04-20 15:13:20 us=307589 remote_cert_ku[i] = 0
2022-04-20 15:13:20 us=307610 remote_cert_ku[i] = 0
2022-04-20 15:13:20 us=307632 remote_cert_ku[i] = 0
2022-04-20 15:13:20 us=307653 remote_cert_ku[i] = 0
2022-04-20 15:13:20 us=307675 remote_cert_ku[i] = 0
2022-04-20 15:13:20 us=307697 remote_cert_ku[i] = 0
2022-04-20 15:13:20 us=307719 remote_cert_ku[i] = 0
2022-04-20 15:13:20 us=307741 remote_cert_ku[i] = 0
2022-04-20 15:13:20 us=307763 remote_cert_ku[i] = 0
2022-04-20 15:13:20 us=307785 remote_cert_ku[i] = 0
2022-04-20 15:13:20 us=307806 remote_cert_ku[i] = 0
2022-04-20 15:13:20 us=307842 remote_cert_ku[i] = 0
2022-04-20 15:13:20 us=307865 remote_cert_ku[i] = 0
2022-04-20 15:13:20 us=307887 remote_cert_ku[i] = 0
2022-04-20 15:13:20 us=307909 remote_cert_ku[i] = 0
2022-04-20 15:13:20 us=307931 remote_cert_eku = '[UNDEF]'
2022-04-20 15:13:20 us=307953 ssl_flags = 0
2022-04-20 15:13:20 us=307974 tls_timeout = 2
2022-04-20 15:13:20 us=307996 renegotiate_bytes = -1
2022-04-20 15:13:20 us=308017 renegotiate_packets = 0
2022-04-20 15:13:20 us=308039 renegotiate_seconds = 3600
2022-04-20 15:13:20 us=308060 handshake_window = 60
2022-04-20 15:13:20 us=308082 transition_window = 3600
2022-04-20 15:13:20 us=308103 single_session = DISABLED
2022-04-20 15:13:20 us=308124 push_peer_info = DISABLED
2022-04-20 15:13:20 us=308146 tls_exit = DISABLED
2022-04-20 15:13:20 us=308167 tls_crypt_v2_metadata = '[UNDEF]'
2022-04-20 15:13:20 us=308189 pkcs11_protected_authentication = DISABLED
2022-04-20 15:13:20 us=308211 pkcs11_protected_authentication = DISABLED
2022-04-20 15:13:20 us=308233 pkcs11_protected_authentication = DISABLED
2022-04-20 15:13:20 us=308256 pkcs11_protected_authentication = DISABLED
2022-04-20 15:13:20 us=308277 pkcs11_protected_authentication = DISABLED
2022-04-20 15:13:20 us=308299 pkcs11_protected_authentication = DISABLED
2022-04-20 15:13:20 us=308321 pkcs11_protected_authentication = DISABLED
2022-04-20 15:13:20 us=308342 pkcs11_protected_authentication = DISABLED
2022-04-20 15:13:20 us=308364 pkcs11_protected_authentication = DISABLED
2022-04-20 15:13:20 us=308386 pkcs11_protected_authentication = DISABLED
2022-04-20 15:13:20 us=308408 pkcs11_protected_authentication = DISABLED
2022-04-20 15:13:20 us=308430 pkcs11_protected_authentication = DISABLED
2022-04-20 15:13:20 us=308452 pkcs11_protected_authentication = DISABLED
2022-04-20 15:13:20 us=308473 pkcs11_protected_authentication = DISABLED
2022-04-20 15:13:20 us=308495 pkcs11_protected_authentication = DISABLED
2022-04-20 15:13:20 us=308517 pkcs11_protected_authentication = DISABLED
2022-04-20 15:13:20 us=308540 pkcs11_private_mode = 00000000
2022-04-20 15:13:20 us=308562 pkcs11_private_mode = 00000000
2022-04-20 15:13:20 us=308585 pkcs11_private_mode = 00000000
2022-04-20 15:13:20 us=308607 pkcs11_private_mode = 00000000
2022-04-20 15:13:20 us=308629 pkcs11_private_mode = 00000000
2022-04-20 15:13:20 us=308650 pkcs11_private_mode = 00000000
2022-04-20 15:13:20 us=308672 pkcs11_private_mode = 00000000
2022-04-20 15:13:20 us=308694 pkcs11_private_mode = 00000000
2022-04-20 15:13:20 us=308716 pkcs11_private_mode = 00000000
2022-04-20 15:13:20 us=308738 pkcs11_private_mode = 00000000
2022-04-20 15:13:20 us=308759 pkcs11_private_mode = 00000000
2022-04-20 15:13:20 us=308781 pkcs11_private_mode = 00000000
2022-04-20 15:13:20 us=308802 pkcs11_private_mode = 00000000
2022-04-20 15:13:20 us=308824 pkcs11_private_mode = 00000000
2022-04-20 15:13:20 us=308845 pkcs11_private_mode = 00000000
2022-04-20 15:13:20 us=308867 pkcs11_private_mode = 00000000
2022-04-20 15:13:20 us=308888 pkcs11_cert_private = DISABLED
2022-04-20 15:13:20 us=308909 pkcs11_cert_private = DISABLED
2022-04-20 15:13:20 us=308931 pkcs11_cert_private = DISABLED
2022-04-20 15:13:20 us=308952 pkcs11_cert_private = DISABLED
2022-04-20 15:13:20 us=308973 pkcs11_cert_private = DISABLED
2022-04-20 15:13:20 us=308994 pkcs11_cert_private = DISABLED
2022-04-20 15:13:20 us=309100 pkcs11_cert_private = DISABLED
2022-04-20 15:13:20 us=309115 pkcs11_cert_private = DISABLED
2022-04-20 15:13:20 us=309130 pkcs11_cert_private = DISABLED
2022-04-20 15:13:20 us=309152 pkcs11_cert_private = DISABLED
2022-04-20 15:13:20 us=309174 pkcs11_cert_private = DISABLED
2022-04-20 15:13:20 us=309196 pkcs11_cert_private = DISABLED
2022-04-20 15:13:20 us=309217 pkcs11_cert_private = DISABLED
2022-04-20 15:13:20 us=309239 pkcs11_cert_private = DISABLED
2022-04-20 15:13:20 us=309261 pkcs11_cert_private = DISABLED
2022-04-20 15:13:20 us=309283 pkcs11_cert_private = DISABLED
2022-04-20 15:13:20 us=309320 pkcs11_pin_cache_period = -1
2022-04-20 15:13:20 us=309343 pkcs11_id = '[UNDEF]'
2022-04-20 15:13:20 us=309365 pkcs11_id_management = DISABLED
2022-04-20 15:13:20 us=309390 server_network = 192.168.200.40
2022-04-20 15:13:20 us=309414 server_netmask = 255.255.255.252
2022-04-20 15:13:20 us=309438 server_network_ipv6 = ::
2022-04-20 15:13:20 us=309459 server_netbits_ipv6 = 0
2022-04-20 15:13:20 us=309483 server_bridge_ip = 0.0.0.0
2022-04-20 15:13:20 us=309506 server_bridge_netmask = 0.0.0.0
2022-04-20 15:13:20 us=309529 server_bridge_pool_start = 0.0.0.0
2022-04-20 15:13:20 us=309552 server_bridge_pool_end = 0.0.0.0
2022-04-20 15:13:20 us=309575 push_entry = 'route-gateway 192.168.200.41'
2022-04-20 15:13:20 us=309596 push_entry = 'ping 10'
2022-04-20 15:13:20 us=309618 push_entry = 'ping-restart 120'
2022-04-20 15:13:20 us=309639 ifconfig_pool_defined = ENABLED
2022-04-20 15:13:20 us=309663 ifconfig_pool_start = 192.168.200.42
2022-04-20 15:13:20 us=309687 ifconfig_pool_end = 192.168.200.42
2022-04-20 15:13:20 us=309712 ifconfig_pool_netmask = 255.255.255.252
2022-04-20 15:13:20 us=309734 ifconfig_pool_persist_filename = '[UNDEF]'
2022-04-20 15:13:20 us=309756 ifconfig_pool_persist_refresh_freq = 600
2022-04-20 15:13:20 us=309778 ifconfig_ipv6_pool_defined = DISABLED
2022-04-20 15:13:20 us=309801 ifconfig_ipv6_pool_base = ::
2022-04-20 15:13:20 us=309824 ifconfig_ipv6_pool_netbits = 0
2022-04-20 15:13:20 us=309846 n_bcast_buf = 256
2022-04-20 15:13:20 us=309868 tcp_queue_limit = 64
2022-04-20 15:13:20 us=309890 real_hash_size = 256
2022-04-20 15:13:20 us=309912 virtual_hash_size = 256
2022-04-20 15:13:20 us=309934 client_connect_script = '[UNDEF]'
2022-04-20 15:13:20 us=309956 learn_address_script = '[UNDEF]'
2022-04-20 15:13:20 us=309977 client_disconnect_script = '[UNDEF]'
2022-04-20 15:13:20 us=309999 client_config_dir = '/etc/openvpn/srv11cli'
2022-04-20 15:13:20 us=310021 ccd_exclusive = DISABLED
2022-04-20 15:13:20 us=310042 tmp_dir = '/tmp'
2022-04-20 15:13:20 us=310064 push_ifconfig_defined = DISABLED
2022-04-20 15:13:20 us=310088 push_ifconfig_local = 0.0.0.0
2022-04-20 15:13:20 us=310113 push_ifconfig_remote_netmask = 0.0.0.0
2022-04-20 15:13:20 us=310135 push_ifconfig_ipv6_defined = DISABLED
2022-04-20 15:13:20 us=310158 push_ifconfig_ipv6_local = ::/0
2022-04-20 15:13:20 us=310182 push_ifconfig_ipv6_remote = ::
2022-04-20 15:13:20 us=310203 enable_c2c = DISABLED
2022-04-20 15:13:20 us=310225 duplicate_cn = DISABLED
2022-04-20 15:13:20 us=310247 cf_max = 0
2022-04-20 15:13:20 us=310269 cf_per = 0
2022-04-20 15:13:20 us=310292 max_clients = 1024
2022-04-20 15:13:20 us=310314 max_routes_per_client = 256
2022-04-20 15:13:20 us=310336 auth_user_pass_verify_script = '[UNDEF]'
2022-04-20 15:13:20 us=310358 auth_user_pass_verify_script_via_file = DISABLED
2022-04-20 15:13:20 us=310380 auth_token_generate = DISABLED
2022-04-20 15:13:20 us=310401 auth_token_lifetime = 0
2022-04-20 15:13:20 us=310422 auth_token_secret_file = '[UNDEF]'
2022-04-20 15:13:20 us=310444 port_share_host = '[UNDEF]'
2022-04-20 15:13:20 us=310465 port_share_port = '[UNDEF]'
2022-04-20 15:13:20 us=310487 vlan_tagging = DISABLED
2022-04-20 15:13:20 us=310509 vlan_accept = all
2022-04-20 15:13:20 us=310531 vlan_pvid = 1
2022-04-20 15:13:20 us=310553 client = DISABLED
2022-04-20 15:13:20 us=310575 pull = DISABLED
2022-04-20 15:13:20 us=310597 auth_user_pass_file = '[UNDEF]'
2022-04-20 15:13:20 us=310622 OpenVPN 2.5.1 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2021
2022-04-20 15:13:20 us=310659 library versions: OpenSSL 1.1.1n 15 Mar 2022, LZO 2.10
2022-04-20 15:13:20 us=311112 net_route_v4_best_gw query: dst 0.0.0.0
2022-04-20 15:13:20 us=311271 sitnl_send: checking for received messages
2022-04-20 15:13:20 us=311327 sitnl_send: rtnl: received 1252 bytes
2022-04-20 15:13:20 us=311430 net_route_v4_best_gw result: via 192.168.xxx.xxx dev eth0
2022-04-20 15:13:20 us=312593 Diffie-Hellman initialized with 2048 bit key
2022-04-20 15:13:20 us=313533 TLS-Auth MTU parms [ L:1655 D:1210 EF:40 EB:0 ET:0 EL:3 ]
2022-04-20 15:13:20 us=315970 TUN/TAP device tap11 opened
2022-04-20 15:13:20 us=316020 do_ifconfig, ipv4=1, ipv6=0
2022-04-20 15:13:20 us=316077 net_iface_mtu_set: mtu 1500 for tap11
2022-04-20 15:13:20 us=316144 sitnl_send: checking for received messages
2022-04-20 15:13:20 us=316176 sitnl_send: rtnl: received 36 bytes
2022-04-20 15:13:20 us=316226 net_iface_up: set tap11 up
2022-04-20 15:13:20 us=316434 sitnl_send: checking for received messages
2022-04-20 15:13:20 us=316470 sitnl_send: rtnl: received 36 bytes
2022-04-20 15:13:20 us=316504 net_addr_v4_add: 192.168.200.41/30 dev tap11
2022-04-20 15:13:20 us=316720 sitnl_send: checking for received messages
2022-04-20 15:13:20 us=316759 sitnl_send: rtnl: received 36 bytes
2022-04-20 15:13:20 us=316818 Data Channel MTU parms [ L:1655 D:1450 EF:123 EB:411 ET:32 EL:3 ]
2022-04-20 15:13:20 us=317482 Could not determine IPv4/IPv6 protocol. Using AF_INET
2022-04-20 15:13:20 us=317553 Socket Buffers: R=[131072->131072] S=[16384->16384]
2022-04-20 15:13:20 us=317590 Listening for incoming TCP connection on [AF_INET][undef]:25511
2022-04-20 15:13:20 us=317625 TCPv4_SERVER link local (bound): [AF_INET][undef]:25511
2022-04-20 15:13:20 us=317648 TCPv4_SERVER link remote: [AF_UNSPEC]
2022-04-20 15:13:20 us=317677 GID set to nogroup
2022-04-20 15:13:20 us=317710 UID set to nobody
2022-04-20 15:13:20 us=317741 MULTI: multi_init called, r=256 v=256
2022-04-20 15:13:20 us=317806 IPv4 pool size is too small (1), must be at least 2
2022-04-20 15:13:20 us=317831 Exiting due to fatal error
2022-04-20 15:13:20 us=317873 Closing TUN/TAP interface
2022-04-20 15:13:20 us=317899 net_addr_v4_del: 192.168.200.41 dev tap11
2022-04-20 15:13:20 us=317979 sitnl_send: checking for received messages
2022-04-20 15:13:20 us=318012 sitnl_send: rtnl: received 52 bytes
2022-04-20 15:13:20 us=318036 sitnl_send: rtnl: generic error (-1): Operation not permitted
2022-04-20 15:13:20 us=318065 Linux can't del IP from iface tap11
The following few lines confuse me:
ifconfig_pool_defined = ENABLED
ifconfig_pool_start = 192.168.200.42
ifconfig_pool_end = 192.168.200.42
ifconfig_pool_netmask = 255.255.255.252
IPv4 pool size is too small (1), must be at least 2
Exiting due to fatal error
If in the server config file I change the subnet mask to "255.255.255.248" and all the corresponding IP addresses and routes for the server and client, then everything becomes fine and the server starts successfully, the tap interface is successfully created and the client can connect.
But, it doesn???t suit me at all, because I have just one subnet 192.168.200.0/24 and I need to "cut" it (very-very thin like pepperoni or salami) into many tiny isolated subnets for 2 ip addresses only, not 6!
Is it possible to force OpenVPN to ignore the "ifconfig_pool_defined = ENABLED" directive?
I do not need OpenVPN to decide for me which pools I will have and which subnet masks I must use if all addresses in my case are assigned manually. If OpenVPN is now doing such nonsense as deciding for the administrator whether he can accidentally "shoot himself in the foot" or not, then I think that this is bad, it takes away flexibility and only adds possible security holes in the future, and does not close them.
Or am I misunderstanding something and this is the problem of my Debian 11?
