I'm not sure what happened here. I've been using OpenVPN successfully and all I did was upgrade my Fedora version. OS [code] Linux 5.18.13-200.fc36.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Jul 22 14:03:36 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux[/code] Server Config (I redacted the port number and hostname) [code] port ## proto udp proto udp6 dev tun ca ca.crt cert issued/server.crt key private/server.key dh dh.pem topology subnet server 172.16.0.0 255.255.255.0 ipconfig-pool-persist ipp.txt push "redirect-gateway def1" push "dhcp-option DNS 10.10.10.1" push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 208.67.222.222" push "dhcp-option DNS 208.67.220.220" keepalive 10 120 tls-auth ta.key 0 cipher AES-256-CBC comp-lzo user nobody group nobody persist-key persist-tun status /var/log/openvpn/openvpn-status.log log-append /var/log/openvpn/openvpn.log verb 4 explicit-exit-notify 1 auth SHA512 route 10.10.10.1 255.255.255.0 [/code] Client Config [code] client tls-client pull dev tun proto udp remote hostname port resolv-retry infinite nobind dhcp-option DNS 8.8.8.8 persist-key persist-tun key-direction 1 tls-auth ta.key 1 comp-lzo verb 4 ca ca.crt cert client.crt key client.key auth SHA512 cipher AES-256-CBC client-config-dir ccd [/code] CCD file [code]iroute 10.10.10.1 255.255.255.0[/code] The logs aren't telling me anything helpful, but here are a few lines: [code] client/x.x.x.x:6958 IP packet with unknown IP version=15 seen read UDPv6 [NO-INFO]: Connection refused (code=111) client/x.x.x.x:6958 [client] Inactivity timeout (--ping-restart), restarting client/x.x.x.x:6958 SIGUSR1[soft,ping-restart] received, client-instance restarting [/code] I also ran the iptables routing: [code]iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -o enp3s0 -j MASQUERADE[/code] I hope I've provided enough info. I don't understand what the upgrade did to negate the VPN's usability. Thanks!

Perhaps you have forgotten to enable IP Forwarding..

[quote=TinCanTech post_id=107732 time=1658929764 user_id=37053] Perhaps you have forgotten to enable IP Forwarding.. [/quote] No luck. Port forwarding was there already. [code] $ sysctl -p fs.inotify.max_user_watches = 1048576 net.ipv4.ip_forward = 1 [/code] And thanks for removing the hostname on that other post.

[quote=tamar post_id=107729 time=1658928510 user_id=53502] [code]port ## proto udp proto udp6

Thanks. Still not working though with a server restart.

Need to see full logs @ --verb 4

hmm, so I just log into the management interface and then type verb 4? If so: Server log [code] client/10.10.10.1:49214 IP packet with unknown IP version=15 seen client/10.10.10.1:49214 IP packet with unknown IP version=15 seen client/10.10.10.1:49214 IP packet with unknown IP version=15 seen client/10.10.10.1:49214 IP packet with unknown IP version=15 seen client/10.10.10.1:49214 IP packet with unknown IP version=15 seen client/10.10.10.1:49214 IP packet with unknown IP version=15 seen client/10.10.10.1:49214 IP packet with unknown IP version=15 seen client/10.10.10.1:49214 IP packet with unknown IP version=15 seen [/code] Client log [code] TITLE,OpenVPN 2.5.7 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTI2 TIME,2022-07-27 18:52:13,1658962333 HEADER,CLIENT_LIST,Common Name,Real Address,Virtual Address,Virtual IPv6 Address,Bytes Received,Br CLIENT_LIST,client,10.10.10.1:49214,172.16.0.2,,57391,4181,2022-07-27 18:51:31,1658962291,UNDEF,0M HEADER,ROUTING_TABLE,Virtual Address,Common Name,Real Address,Last Ref,Last Ref (time_t) ROUTING_TABLE,172.16.0.2,client,10.10.10.1:49214,2022-07-27 18:51:31,1658962291 GLOBAL_STATS,Max bcast/mcast queue length,1 END [/code] I don't see public IPs here. Is that the issue?

Logs like so: https://forums.openvpn.net/viewtopic.php?t=22603#p68963

Is this what you need? Not seeing public IPs here either. [code] event_wait : Interrupted system call (code=4) SENT CONTROL [client]: 'RESTART' (status=1) TCP/UDP: Closing socket Closing TUN/TAP interface net_addr_v4_del: 172.16.0.1 dev tun0 sitnl_send: rtnl: generic error (-1): Operation not permitted Linux can't del IP from iface tun0 SIGTERM[hard,] received, process exiting Current Parameter Settings: config = 'server.conf' mode = 1 persist_config = DISABLED persist_mode = 1 show_ciphers = DISABLED show_digests = DISABLED show_engines = DISABLED genkey = DISABLED genkey_filename = '[UNDEF]' key_pass_file = '[UNDEF]' show_tls_ciphers = DISABLED connect_retry_max = 0 Connection profiles [0]: proto = udp local = '[UNDEF]' local_port = '82' remote = '[UNDEF]' remote_port = '82' remote_float = DISABLED bind_defined = DISABLED bind_local = ENABLED bind_ipv6_only = DISABLED connect_retry_seconds = 5 connect_timeout = 120 socks_proxy_server = '[UNDEF]' socks_proxy_port = '[UNDEF]' tun_mtu = 1500 tun_mtu_defined = ENABLED link_mtu = 1500 link_mtu_defined = DISABLED tun_mtu_extra = 0 tun_mtu_extra_defined = DISABLED mtu_discover_type = -1 fragment = 0 mssfix = 1450 explicit_exit_notification = 1 tls_auth_file = '[INLINE]' key_direction = 0 tls_crypt_file = '[UNDEF]' tls_crypt_v2_file = '[UNDEF]' Connection profiles END remote_random = DISABLED ipchange = '[UNDEF]' dev = 'tun' dev_type = '[UNDEF]' dev_node = '[UNDEF]' lladdr = '[UNDEF]' topology = 3 ifconfig_local = '172.16.0.1' ifconfig_remote_netmask = '255.255.255.0' ifconfig_noexec = DISABLED ifconfig_nowarn = DISABLED ifconfig_ipv6_local = '[UNDEF]' ifconfig_ipv6_netbits = 0 ifconfig_ipv6_remote = '[UNDEF]' shaper = 0 mtu_test = 0 mlock = DISABLED keepalive_ping = 10 keepalive_timeout = 120 inactivity_timeout = 0 inactivity_minimum_bytes = 0 ping_send_timeout = 10 ping_rec_timeout = 240 ping_rec_timeout_action = 2 ping_timer_remote = DISABLED remap_sigusr1 = 0 persist_tun = ENABLED persist_local_ip = DISABLED persist_remote_ip = DISABLED persist_key = ENABLED passtos = DISABLED resolve_retry_seconds = 1000000000 resolve_in_advance = DISABLED username = 'nobody' groupname = 'nobody' chroot_dir = '[UNDEF]' cd_dir = '[UNDEF]' selinux_context = '[UNDEF]' writepid = '[UNDEF]' up_script = '[UNDEF]' down_script = '[UNDEF]' down_pre = DISABLED up_restart = DISABLED up_delay = DISABLED daemon = DISABLED inetd = 0 log = ENABLED suppress_timestamps = ENABLED machine_readable_output = DISABLED nice = 0 verbosity = 4 mute = 0 gremlin = 0 status_file = '/var/log/openvpn/openvpn-status.log' status_file_version = 2 status_file_update_freq = 60 occ = ENABLED rcvbuf = 0 sndbuf = 0 mark = 0 sockflags = 0 fast_io = DISABLED comp.alg = 0 comp.flags = 0 route_script = '[UNDEF]' route_default_gateway = '172.16.0.2' route_default_metric = 0 route_noexec = DISABLED route_delay = 0 route_delay_window = 30 route_delay_defined = DISABLED route_nopull = DISABLED route_gateway_via_dhcp = DISABLED allow_pull_fqdn = DISABLED route 10.10.10.1/255.255.255.0/default (not set)/default (not set) management_addr = '[UNDEF]' management_port = '[UNDEF]' management_user_pass = '[UNDEF]' management_log_history_cache = 250 management_echo_buffer_size = 100 management_write_peer_info_file = '[UNDEF]' management_client_user = '[UNDEF]' management_client_group = '[UNDEF]' management_flags = 0 shared_secret_file = '[UNDEF]' key_direction = 0 ciphername = 'AES-256-CBC' ncp_enabled = ENABLED ncp_ciphers = 'AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC' authname = 'SHA512' prng_hash = 'SHA1' prng_nonce_secret_len = 16 keysize = 0 engine = DISABLED replay = ENABLED mute_replay_warnings = DISABLED replay_window = 64 replay_time = 15 packet_id_file = '[UNDEF]' test_crypto = DISABLED tls_server = ENABLED tls_client = DISABLED ca_file = 'ca.crt' ca_path = '[UNDEF]' dh_file = 'dh.pem' cert_file = 'issued/server.crt' extra_certs_file = '[UNDEF]' priv_key_file = 'private/server.key' pkcs12_file = '[UNDEF]' cipher_list = '[UNDEF]' cipher_list_tls13 = '[UNDEF]' tls_cert_profile = '[UNDEF]' tls_verify = '[UNDEF]' tls_export_cert = '[UNDEF]' verify_x509_type = 0 verify_x509_name = '[UNDEF]' crl_file = '[UNDEF]' ns_cert_type = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_eku = '[UNDEF]' ssl_flags = 0 tls_timeout = 2 renegotiate_bytes = -1 renegotiate_packets = 0 renegotiate_seconds = 3600 handshake_window = 60 transition_window = 3600 single_session = DISABLED push_peer_info = DISABLED tls_exit = DISABLED tls_crypt_v2_metadata = '[UNDEF]' pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_pin_cache_period = -1 pkcs11_id = '[UNDEF]' pkcs11_id_management = DISABLED server_network = 172.16.0.0 server_netmask = 255.255.255.0 server_network_ipv6 = :: server_netbits_ipv6 = 0 server_bridge_ip = 0.0.0.0 server_bridge_netmask = 0.0.0.0 server_bridge_pool_start = 0.0.0.0 server_bridge_pool_end = 0.0.0.0 push_entry = 'redirect-gateway def1' push_entry = 'dhcp-option DNS 10.10.10.1' push_entry = 'dhcp-option DNS 8.8.8.8' push_entry = 'dhcp-option DNS 208.67.222.222' push_entry = 'dhcp-option DNS 208.67.220.220' push_entry = 'route-gateway 172.16.0.1' push_entry = 'topology subnet' push_entry = 'ping 10' push_entry = 'ping-restart 120' ifconfig_pool_defined = ENABLED ifconfig_pool_start = 172.16.0.2 ifconfig_pool_end = 172.16.0.254 ifconfig_pool_netmask = 255.255.255.0 ifconfig_pool_persist_filename = 'ipp.txt' ifconfig_pool_persist_refresh_freq = 600 ifconfig_ipv6_pool_defined = DISABLED ifconfig_ipv6_pool_base = :: ifconfig_ipv6_pool_netbits = 0 n_bcast_buf = 256 tcp_queue_limit = 64 real_hash_size = 256 virtual_hash_size = 256 client_connect_script = '[UNDEF]' learn_address_script = '[UNDEF]' client_disconnect_script = '[UNDEF]' client_config_dir = '[UNDEF]' ccd_exclusive = DISABLED tmp_dir = '/tmp' push_ifconfig_defined = DISABLED push_ifconfig_local = 0.0.0.0 push_ifconfig_remote_netmask = 0.0.0.0 push_ifconfig_ipv6_defined = DISABLED push_ifconfig_ipv6_local = ::/0 push_ifconfig_ipv6_remote = :: enable_c2c = DISABLED duplicate_cn = DISABLED cf_max = 0 cf_per = 0 max_clients = 1024 max_routes_per_client = 256 auth_user_pass_verify_script = '[UNDEF]' auth_user_pass_verify_script_via_file = DISABLED auth_token_generate = DISABLED auth_token_lifetime = 0 auth_token_secret_file = '[UNDEF]' port_share_host = '[UNDEF]' port_share_port = '[UNDEF]' vlan_tagging = DISABLED vlan_accept = all vlan_pvid = 1 client = DISABLED pull = DISABLED auth_user_pass_file = '[UNDEF]' OpenVPN 2.5.7 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 31 2022 library versions: OpenSSL 3.0.5 5 Jul 2022, LZO 2.10 net_route_v4_best_gw query: dst 0.0.0.0 net_route_v4_best_gw result: via 10.10.10.1 dev enp3s0 Diffie-Hellman initialized with 2048 bit key Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication TLS-Auth MTU parms [ L:1621 D:1140 EF:110 EB:0 ET:0 EL:3 ] net_route_v4_best_gw query: dst 0.0.0.0 net_route_v4_best_gw result: via 10.10.10.1 dev enp3s0 ROUTE_GATEWAY 10.10.10.1/255.255.255.0 IFACE=enp3s0 HWADDR=00:24:21:10:56:fb TUN/TAP device tun0 opened do_ifconfig, ipv4=1, ipv6=0 net_iface_mtu_set: mtu 1500 for tun0 net_iface_up: set tun0 up net_addr_v4_add: 172.16.0.1/24 dev tun0 net_route_v4_add: 10.10.10.1/24 via 172.16.0.2 dev [NULL] table 0 metric -1 sitnl_send: rtnl: generic error (-22): Invalid argument ERROR: Linux route add command failed Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ] Could not determine IPv4/IPv6 protocol. Using AF_INET Socket Buffers: R=[212992->212992] S=[212992->212992] UDPv4 link local (bound): [AF_INET][undef]:82 UDPv4 link remote: [AF_UNSPEC] GID set to nobody UID set to nobody MULTI: multi_init called, r=256 v=256 IFCONFIG POOL IPv4: base=172.16.0.2 size=253 ifconfig_pool_read(), in='client,172.16.0.2,' succeeded -> ifconfig_pool_set(hand=0) ifconfig_pool_read(), in='client,172.16.0.3,' succeeded -> ifconfig_pool_set(hand=1) IFCONFIG POOL LIST client,172.16.0.2, client,172.16.0.3, Initialization Sequence Completed [/code]

[quote=tamar post_id=107755 time=1658968916 user_id=53502] Is this what you need? [/quote]That is [i]part[/i] of it.

Okay, not sure what covers everything (my log files are huge) and I have 2MB since I replaced the old log file which was 32mb, so... hopefully this isn't too much this time. Note: the comp-lzo stuff was me testing the IP version=15 issue. It's in server.conf now but that doesn't make a difference. I've removed it on both sides, same effect. [code] Current Parameter Settings: config = 'server.conf' mode = 1 persist_config = DISABLED persist_mode = 1 show_ciphers = DISABLED show_digests = DISABLED show_engines = DISABLED genkey = DISABLED genkey_filename = '[UNDEF]' key_pass_file = '[UNDEF]' show_tls_ciphers = DISABLED connect_retry_max = 0 Connection profiles [0]: proto = udp6 local = '[UNDEF]' local_port = '82' remote = '[UNDEF]' remote_port = '82' remote_float = DISABLED bind_defined = DISABLED bind_local = ENABLED bind_ipv6_only = DISABLED connect_retry_seconds = 5 connect_timeout = 120 socks_proxy_server = '[UNDEF]' socks_proxy_port = '[UNDEF]' tun_mtu = 1500 tun_mtu_defined = ENABLED link_mtu = 1500 link_mtu_defined = DISABLED tun_mtu_extra = 0 tun_mtu_extra_defined = DISABLED mtu_discover_type = -1 fragment = 0 mssfix = 1450 explicit_exit_notification = 1 tls_auth_file = '[INLINE]' key_direction = 0 tls_crypt_file = '[UNDEF]' tls_crypt_v2_file = '[UNDEF]' Connection profiles END remote_random = DISABLED ipchange = '[UNDEF]' dev = 'tun' dev_type = '[UNDEF]' dev_node = '[UNDEF]' lladdr = '[UNDEF]' topology = 3 ifconfig_local = '172.16.0.1' ifconfig_remote_netmask = '255.255.255.0' ifconfig_noexec = DISABLED ifconfig_nowarn = DISABLED ifconfig_ipv6_local = '[UNDEF]' ifconfig_ipv6_netbits = 0 ifconfig_ipv6_remote = '[UNDEF]' shaper = 0 mtu_test = 0 mlock = DISABLED keepalive_ping = 10 keepalive_timeout = 120 inactivity_timeout = 0 inactivity_minimum_bytes = 0 ping_send_timeout = 10 ping_rec_timeout = 240 ping_rec_timeout_action = 2 ping_timer_remote = DISABLED remap_sigusr1 = 0 persist_tun = ENABLED persist_local_ip = DISABLED persist_remote_ip = DISABLED persist_key = ENABLED passtos = DISABLED resolve_retry_seconds = 1000000000 resolve_in_advance = DISABLED username = 'nobody' groupname = 'nobody' chroot_dir = '[UNDEF]' cd_dir = '[UNDEF]' selinux_context = '[UNDEF]' writepid = '[UNDEF]' up_script = '[UNDEF]' down_script = '[UNDEF]' down_pre = DISABLED up_restart = DISABLED up_delay = DISABLED daemon = DISABLED inetd = 0 log = ENABLED suppress_timestamps = ENABLED machine_readable_output = DISABLED nice = 0 verbosity = 4 mute = 0 gremlin = 0 status_file = '/var/log/openvpn/openvpn-status.log' status_file_version = 2 status_file_update_freq = 60 occ = ENABLED rcvbuf = 0 sndbuf = 0 mark = 0 sockflags = 0 fast_io = DISABLED comp.alg = 0 comp.flags = 0 route_script = '[UNDEF]' route_default_gateway = '172.16.0.2' route_default_metric = 0 route_noexec = DISABLED route_delay = 0 route_delay_window = 30 route_delay_defined = DISABLED route_nopull = DISABLED route_gateway_via_dhcp = DISABLED allow_pull_fqdn = DISABLED route 10.10.10.1/255.255.255.0/default (not set)/default (not set) management_addr = '[UNDEF]' management_port = '[UNDEF]' management_user_pass = '[UNDEF]' management_log_history_cache = 250 management_echo_buffer_size = 100 management_write_peer_info_file = '[UNDEF]' management_client_user = '[UNDEF]' management_client_group = '[UNDEF]' management_flags = 0 shared_secret_file = '[UNDEF]' key_direction = 0 ciphername = 'AES-256-CBC' ncp_enabled = ENABLED ncp_ciphers = 'AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC' authname = 'SHA512' prng_hash = 'SHA1' prng_nonce_secret_len = 16 keysize = 0 engine = DISABLED replay = ENABLED mute_replay_warnings = DISABLED replay_window = 64 replay_time = 15 packet_id_file = '[UNDEF]' test_crypto = DISABLED tls_server = ENABLED tls_client = DISABLED ca_file = 'ca.crt' ca_path = '[UNDEF]' dh_file = 'dh.pem' cert_file = 'issued/server.crt' extra_certs_file = '[UNDEF]' priv_key_file = 'private/server.key' pkcs12_file = '[UNDEF]' cipher_list = '[UNDEF]' cipher_list_tls13 = '[UNDEF]' tls_cert_profile = '[UNDEF]' tls_verify = '[UNDEF]' tls_export_cert = '[UNDEF]' verify_x509_type = 0 verify_x509_name = '[UNDEF]' crl_file = '[UNDEF]' ns_cert_type = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_ku[i] = 0 remote_cert_eku = '[UNDEF]' ssl_flags = 0 tls_timeout = 2 renegotiate_bytes = -1 renegotiate_packets = 0 renegotiate_seconds = 3600 handshake_window = 60 transition_window = 3600 single_session = DISABLED push_peer_info = DISABLED tls_exit = DISABLED tls_crypt_v2_metadata = '[UNDEF]' pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_protected_authentication = DISABLED pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_private_mode = 00000000 pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_cert_private = DISABLED pkcs11_pin_cache_period = -1 pkcs11_id = '[UNDEF]' pkcs11_id_management = DISABLED server_network = 172.16.0.0 server_netmask = 255.255.255.0 server_network_ipv6 = :: server_netbits_ipv6 = 0 server_bridge_ip = 0.0.0.0 server_bridge_netmask = 0.0.0.0 server_bridge_pool_start = 0.0.0.0 server_bridge_pool_end = 0.0.0.0 push_entry = 'redirect-gateway def1' push_entry = 'dhcp-option DNS 10.10.10.1' push_entry = 'dhcp-option DNS 8.8.8.8' push_entry = 'dhcp-option DNS 208.67.222.222' push_entry = 'dhcp-option DNS 208.67.220.220' push_entry = 'route-gateway 172.16.0.1' push_entry = 'topology subnet' push_entry = 'ping 10' push_entry = 'ping-restart 120' ifconfig_pool_defined = ENABLED ifconfig_pool_start = 172.16.0.2 ifconfig_pool_end = 172.16.0.254 ifconfig_pool_netmask = 255.255.255.0 ifconfig_pool_persist_filename = 'ipp.txt' ifconfig_pool_persist_refresh_freq = 600 ifconfig_ipv6_pool_defined = DISABLED ifconfig_ipv6_pool_base = :: ifconfig_ipv6_pool_netbits = 0 n_bcast_buf = 256 tcp_queue_limit = 64 real_hash_size = 256 virtual_hash_size = 256 client_connect_script = '[UNDEF]' learn_address_script = '[UNDEF]' client_disconnect_script = '[UNDEF]' client_config_dir = '[UNDEF]' ccd_exclusive = DISABLED tmp_dir = '/tmp' push_ifconfig_defined = DISABLED push_ifconfig_local = 0.0.0.0 push_ifconfig_remote_netmask = 0.0.0.0 push_ifconfig_ipv6_defined = DISABLED push_ifconfig_ipv6_local = ::/0 push_ifconfig_ipv6_remote = :: enable_c2c = DISABLED duplicate_cn = DISABLED cf_max = 0 cf_per = 0 max_clients = 1024 max_routes_per_client = 256 auth_user_pass_verify_script = '[UNDEF]' auth_user_pass_verify_script_via_file = DISABLED auth_token_generate = DISABLED auth_token_lifetime = 0 auth_token_secret_file = '[UNDEF]' port_share_host = '[UNDEF]' port_share_port = '[UNDEF]' vlan_tagging = DISABLED vlan_accept = all vlan_pvid = 1 client = DISABLED pull = DISABLED auth_user_pass_file = '[UNDEF]' OpenVPN 2.5.7 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 31 2022 library versions: OpenSSL 3.0.5 5 Jul 2022, LZO 2.10 net_route_v4_best_gw query: dst 0.0.0.0 net_route_v4_best_gw result: via 10.10.10.1 dev enp3s0 Diffie-Hellman initialized with 2048 bit key Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication TLS-Auth MTU parms [ L:1621 D:1140 EF:110 EB:0 ET:0 EL:3 ] net_route_v4_best_gw query: dst 0.0.0.0 net_route_v4_best_gw result: via 10.10.10.1 dev enp3s0 ROUTE_GATEWAY 10.10.10.1/255.255.255.0 IFACE=enp3s0 HWADDR=00:24:21:10:56:fb TUN/TAP device tun0 opened do_ifconfig, ipv4=1, ipv6=0 net_iface_mtu_set: mtu 1500 for tun0 net_iface_up: set tun0 up net_addr_v4_add: 172.16.0.1/24 dev tun0 net_route_v4_add: 10.10.10.1/24 via 172.16.0.2 dev [NULL] table 0 metric -1 sitnl_send: rtnl: generic error (-22): Invalid argument ERROR: Linux route add command failed Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ] Socket Buffers: R=[212992->212992] S=[212992->212992] setsockopt(IPV6_V6ONLY=0) UDPv6 link local (bound): [AF_INET6][undef]:82 UDPv6 link remote: [AF_UNSPEC] GID set to nobody UID set to nobody MULTI: multi_init called, r=256 v=256 IFCONFIG POOL IPv4: base=172.16.0.2 size=253 ifconfig_pool_read(), in='client,172.16.0.2,' succeeded -> ifconfig_pool_set(hand=0) ifconfig_pool_read(), in='client,172.16.0.3,' succeeded -> ifconfig_pool_set(hand=1) IFCONFIG POOL LIST client,172.16.0.2, client,172.16.0.3, Initialization Sequence Completed MULTI: multi_create_instance called 10.10.10.1:49751 Re-using SSL/TLS context 10.10.10.1:49751 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication 10.10.10.1:49751 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication 10.10.10.1:49751 Control Channel MTU parms [ L:1621 D:1140 EF:110 EB:0 ET:0 EL:3 ] 10.10.10.1:49751 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ] 10.10.10.1:49751 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,keydir 0,cipher AES-256-CBC,auth SHA512,keysize 256,tls-auth,key-method 2,tls-server' 10.10.10.1:49751 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,keydir 1,cipher AES-256-CBC,auth SHA512,keysize 256,tls-auth,key-method 2,tls-client' 10.10.10.1:49751 TLS: Initial packet from [AF_INET6]::ffff:10.10.10.1:49751, sid=6fcfea89 b9d2a548 10.10.10.1:49751 VERIFY OK: depth=1, CN=microwave 10.10.10.1:49751 VERIFY OK: depth=0, CN=client 10.10.10.1:49751 peer info: IV_VER=3.git::d3f8b18b:Release 10.10.10.1:49751 peer info: IV_PLAT=android 10.10.10.1:49751 peer info: IV_NCP=2 10.10.10.1:49751 peer info: IV_TCPNL=1 10.10.10.1:49751 peer info: IV_PROTO=30 10.10.10.1:49751 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC 10.10.10.1:49751 peer info: IV_LZO_STUB=1 10.10.10.1:49751 peer info: IV_COMP_STUB=1 10.10.10.1:49751 peer info: IV_COMP_STUBv2=1 10.10.10.1:49751 peer info: IV_AUTO_SESS=1 10.10.10.1:49751 peer info: IV_GUI_VER=net.openvpn.connect.android_3.2.7-7957 10.10.10.1:49751 peer info: IV_SSO=webauth,openurl 10.10.10.1:49751 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1601', remote='link-mtu 1602' 10.10.10.1:49751 WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo' 10.10.10.1:49751 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA256 10.10.10.1:49751 [client] Peer Connection Initiated with [AF_INET6]::ffff:10.10.10.1:49751 client/10.10.10.1:49751 MULTI_sva: pool returned IPv4=172.16.0.2, IPv6=(Not enabled) client/10.10.10.1:49751 MULTI: Learn: 172.16.0.2 -> client/10.10.10.1:49751 client/10.10.10.1:49751 MULTI: primary virtual IP for client/10.10.10.1:49751: 172.16.0.2 client/10.10.10.1:49751 Data Channel: using negotiated cipher 'AES-256-GCM' client/10.10.10.1:49751 Data Channel MTU parms [ L:1549 D:1450 EF:49 EB:406 ET:0 EL:3 ] client/10.10.10.1:49751 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key client/10.10.10.1:49751 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key client/10.10.10.1:49751 SENT CONTROL [client]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 10.10.10.1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route-gateway 172.16.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 172.16.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1) client/10.10.10.1:49751 PUSH: Received control message: 'PUSH_REQUEST' client/10.10.10.1:49751 IP packet with unknown IP version=15 seen client/10.10.10.1:49751 IP packet with unknown IP version=15 seen [a few hundred of these lines which I cannot source to any issue] read UDPv6 [NO-INFO]: Connection refused (code=111) MULTI: multi_create_instance called 10.10.10.1:46192 Re-using SSL/TLS context 10.10.10.1:46192 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication 10.10.10.1:46192 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication 10.10.10.1:46192 Control Channel MTU parms [ L:1621 D:1140 EF:110 EB:0 ET:0 EL:3 ] 10.10.10.1:46192 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ] 10.10.10.1:46192 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,keydir 0,cipher AES-256-CBC,auth SHA512,keysize 256,tls-auth,key-method 2,tls-server' 10.10.10.1:46192 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1601,tun-mtu 1500,proto UDPv4,keydir 1,cipher AES-256-CBC,auth SHA512,keysize 256,tls-auth,key-method 2,tls-client' 10.10.10.1:46192 TLS: Initial packet from [AF_INET6]::ffff:10.10.10.1:46192, sid=d19e9234 20265081 10.10.10.1:46192 VERIFY OK: depth=1, CN=microwave 10.10.10.1:46192 VERIFY OK: depth=0, CN=client 10.10.10.1:46192 peer info: IV_VER=3.git::d3f8b18b:Release 10.10.10.1:46192 peer info: IV_PLAT=android 10.10.10.1:46192 peer info: IV_NCP=2 10.10.10.1:46192 peer info: IV_TCPNL=1 10.10.10.1:46192 peer info: IV_PROTO=30 10.10.10.1:46192 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC 10.10.10.1:46192 peer info: IV_LZO_STUB=1 10.10.10.1:46192 peer info: IV_COMP_STUB=1 10.10.10.1:46192 peer info: IV_COMP_STUBv2=1 10.10.10.1:46192 peer info: IV_AUTO_SESS=1 10.10.10.1:46192 peer info: IV_GUI_VER=net.openvpn.connect.android_3.2.7-7957 10.10.10.1:46192 peer info: IV_SSO=webauth,openurl 10.10.10.1:46192 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1601', remote='link-mtu 1602' 10.10.10.1:46192 WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo' 10.10.10.1:46192 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA256 10.10.10.1:46192 [client] Peer Connection Initiated with [AF_INET6]::ffff:10.10.10.1:46192 MULTI: new connection by client 'client' will cause previous active sessions by this client to be dropped. Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect. MULTI_sva: pool returned IPv4=172.16.0.2, IPv6=(Not enabled) MULTI: Learn: 172.16.0.2 -> client/10.10.10.1:46192 MULTI: primary virtual IP for client/10.10.10.1:46192: 172.16.0.2 Data Channel: using negotiated cipher 'AES-256-GCM' Data Channel MTU parms [ L:1549 D:1450 EF:49 EB:406 ET:0 EL:3 ] Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key SENT CONTROL [client]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 10.10.10.1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route-gateway 172.16.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 172.16.0.2 255.255.255.0,peer-id 1,cipher AES-256-GCM' (status=1) client/10.10.10.1:46192 PUSH: Received control message: 'PUSH_REQUEST' client/10.10.10.1:46192 IP packet with unknown IP version=15 seen client/10.10.10.1:46192 IP packet with unknown IP version=15 seen (yadda yadda) client/10.10.10.1:46192 IP packet with unknown IP version=15 seen client/10.10.10.1:46192 IP packet with unknown IP version=15 seen client/10.10.10.1:46192 IP packet with unknown IP version=15 seen client/10.10.10.1:46192 IP packet with unknown IP version=15 seen client/10.10.10.1:46192 IP packet with unknown IP version=15 seen client/10.10.10.1:46192 IP packet with unknown IP version=15 seen client/10.10.10.1:46192 IP packet with unknown IP version=15 seen client/10.10.10.1:46192 IP packet with unknown IP version=15 seen client/10.10.10.1:46192 IP packet with unknown IP version=15 seen client/10.10.10.1:46192 IP packet with unknown IP version=15 seen client/10.10.10.1:46192 IP packet with unknown IP version=15 seen client/10.10.10.1:46192 IP packet with unknown IP version=15 seen client/10.10.10.1:46192 IP packet with unknown IP version=15 seen client/10.10.10.1:46192 IP packet with unknown IP version=15 seen client/10.10.10.1:46192 IP packet with unknown IP version=15 seen client/10.10.10.1:46192 IP packet with unknown IP version=15 seen read UDPv6 [NO-INFO]: Connection refused (code=111) read UDPv6 [NO-INFO]: Connection refused (code=111) read UDPv6 [NO-INFO]: Connection refused (code=111) read UDPv6 [NO-INFO]: Connection refused (code=111) read UDPv6 [NO-INFO]: Connection refused (code=111) read UDPv6 [NO-INFO]: Connection refused (code=111) read UDPv6 [NO-INFO]: Connection refused (code=111) read UDPv6 [NO-INFO]: Connection refused (code=111) read UDPv6 [NO-INFO]: Connection refused (code=111) read UDPv6 [NO-INFO]: Connection refused (code=111) read UDPv6 [NO-INFO]: Connection refused (code=111) read UDPv6 [NO-INFO]: Connection refused (code=111) read UDPv6 [NO-INFO]: Connection refused (code=111) read UDPv6 [NO-INFO]: Connection refused (code=111) read UDPv6 [NO-INFO]: Connection refused (code=111) read UDPv6 [NO-INFO]: Connection refused (code=111) read UDPv6 [NO-INFO]: Connection refused (code=111) read UDPv6 [NO-INFO]: Connection refused (code=111) read UDPv6 [NO-INFO]: Connection refused (code=111) read UDPv6 [NO-INFO]: Connection refused (code=111) read UDPv6 [NO-INFO]: Connection refused (code=111) read UDPv6 [NO-INFO]: Connection refused (code=111) read UDPv6 [NO-INFO]: Connection refused (code=111) client/10.10.10.1:46192 [client] Inactivity timeout (--ping-restart), restarting client/10.10.10.1:46192 SIGUSR1[soft,ping-restart] received, client-instance restarting MULTI: multi_create_instance called [/code]

Upgraded Fedora 35 to Fedora 36, all OpenVPN settings are the same, but no Internet

tamar

I'm sorry you are frustrated with Fedora but I am stuck with it for a number of critical operations and merely need assistance because this upgrade is being wonky. I've been using flavors of RedHat since before Ubuntu even existed.

I followed the howto. OpenVPN worked for Fedora 34 and 35, and failed at version 36.

It seems that to date, we haven't figured out what the issue is. It was fine until I upgraded. If it is truly howto related, please tell me what I am not doing properly, because again, OpenVPN worked fine until the upgrade.

Can you kindly tell me what you're seeing in these results that we're missing here?

Pippin

Hi,

Remove this,

ipconfig-pool-persist ipp.txt

and try again.

It is spelled wrongly...
There is a better way to reserve tunnel IP but first try it.

TinCanTech

tamar wrote I am stuck with it for a number of critical operation

:roll:

Pippin

@tamar
Ok, I have taken a closer look and have a hard time believing this ever worked with what you posted .....?

tamar

I swear it did, Pippin. 🤷🏻‍♀️

But I manually hand typed the ifconfig-pool-persist ipp.txt. (I still have a commented version of the server.conf, so I reposted here by hand.) It was correct in the conf.

TinCanTech

Also remove compression settings from all of your client configs.

tamar

All done - still not connecting 🙁 grr.

TinCanTech

Not connecting is not the same as IP Version 15, please post the log files of server and client for the single connection attempt.

Pippin

Hi,

Your config with some comments/adjustments, read them side by side with manual 2.5:
https://build.openvpn.net/man/openvpn-2.5/openvpn.8.html

port     ###<change
proto udp
dev tun
ca ca.crt
cert issued/server.crt
key private/server.key
dh dh.pem
topology subnet
server 172.16.0.0 255.255.255.0
#ipconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 10.10.10.1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 60
tls-auth ta.key 0
cipher AES-256-CBC
#comp-lzo
#user nobody
#group nobody
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
#log-append  /var/log/openvpn/openvpn.log     ###< for per start log, see log  /var/log/openvpn/openvpn.log
log  /var/log/openvpn/openvpn.log
verb 4
explicit-exit-notify 1
auth SHA512
route 10.10.10.1 255.255.255.0

client
#tls-client     ###<client already does this
#pull     ###<client already does this
dev tun
proto udp
remote hostname port     ###<change
resolv-retry infinite
nobind
#dhcp-option DNS 8.8.8.8
persist-key
persist-tun
#key-direction 1     ###<no need, see tls-auth ta.key 1
tls-auth ta.key 1
#comp-lzo
verb 4
ca ca.crt
cert client.crt
key client.key
auth SHA512
cipher AES-256-CBC
#client-config-dir ccd      ###<server side option here???
explicit-exit-notify 2

Try it and post server and client logs if it doesn't work.

TinCanTech

Pippin wrote client
<snip>
#client-config-dir ccd ###<server side option here???

Indeed ..

Options error: --client-config-dir/--ccd-exclusive requires --mode server
Use --help for more information.

tamar

Weird, that exact layout worked beforehand. Anyway, curious to hear why you recommend changing the port number.

I changed a few ports, and restarted the server and it seems to have worked, but it works on the old port as well. I don't know exactly what changed, maybe the fact that I had to delete and reload the .ovpn file with that client-config-dir ccd removal. A note for anyone like me: it helps to fully delete the profile from the app, not just to restart it with edits (since I guess it only reads it once).

I tried the exact same settings in my all-in-one file with the certificates, but that never got to working, despite the first half being identical (except for the calls to the certificates and keys). Can't explain that one. Still can't explain the other really either though.

client
#tls-client
#pull
dev tun
proto udp
remote server port
resolv-retry infinite
nobind
#dhcp-option DNS 8.8.8.8
persist-key
persist-tun
#key-direction 1
verb 4
auth SHA512
cipher AES-256-CBC
#client-config-dir ccd 
<ca>
----BEGIN CERTIFICATE-----
----END CERTIFICATE-----
</ca>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
-----END OpenVPN Static key V1-----
</tls-auth>
<key>
-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
</key>
<cert>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</cert>

I appreciate your assistance and your patience with me.

TinCanTech

tamar wrote Weird, that exact layout worked beforehand

<snip>

it helps to fully delete the profile from the app

If the app is Android then the option is probably ignored.

tamar

TinCanTech wrote
tamar wrote Weird, that exact layout worked beforehand

<snip>

it helps to fully delete the profile from the app
If the app is Android then the option is probably ignored.

Done each time. I figured it wasn't reloading the profile via app restarts anyway.

tamar

Any further recommendations since removing/restoring the profile is not resolving the issue?

TinCanTech

Remove compression settings from your server and all of your clients configuration files.

IP version=15 errors are caused by incompatible compression between server and client.

tamar

Compression is turned off on the server and client sides. These are the files that contain the different .crt and .key references.

Can't figure out what it is here.

client
dev tun
proto udp
remote server port
resolv-retry infinite
nobind
persist-key
persist-tun
verb 4
auth SHA512
cipher AES-256-CBC
<ca>
----BEGIN CERTIFICATE-----
----END CERTIFICATE-----
</ca>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
-----END OpenVPN Static key V1-----
</tls-auth>
<key>
-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
</key>
<cert>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</cert>

TinCanTech

Does the VPN work for all of your clients ?

Do you still see IP-Version 15 packet messages in your log ?

If the answer is yes to both those questions then you have probably missed one of your clients.

I can't do any more than that.

« Previous Page