Hi, I have a problem with my openvpn server. if I ping with internal openvpn ip (Server ping 192.168.9.6) i can establish communication but in other case if I ping with 192.168.11.204 I can't establish communication. I have done a picture to see easier the components (public ips are fake). Openvpn.log I have seen this. [code] Thu Nov 24 10:20:54 2011 us=241047 vpn-seafi/82.62.111.123:1195 MULTI: bad source address from client [192.168.11.201], packet dropped [/code] Thank you for your help!! [img]http://img11.imageshack.us/img11/3378/vpnu.jpg[/img] [size=200][b]SERVER[/b][/size] My server.conf [code] # Local address to listen on. i.e. the OpenVPN server's LAN address local 192.168.0.22 # The default OpenVPN port port 1195 # Protocol used to transmit between OpenVPN nodes proto udp # Interface for the OpevVPN tunnel dev tun0 # Required keys and certificates ca /etc/openvpn/certs/ca.crt cert /etc/openvpn/certs/vpn-server.crt key /etc/openvpn/keys/vpn-server.key # This file should be kept secret dh /etc/openvpn/dh2048.pem # The server directive instructs this OpenVPN instance to act as the central node. # The network IP address and netmask are used for the point-to-point connections # between the OpenVPN server and the client nodes. Only the server and the client # need to know about this subnet. server 192.168.9.0 255.255.255.0 # Create a file for persistent IP addresses. Helpful for intermittent connections. ifconfig-pool-persist /etc/openvpn/ipp.txt # Advertise the server's network to connecting clients push "route 192.168.0.0 255.255.255.0" # Specific client configurations client-config-dir client-configs # Route server-side traffic bound for the client network route 192.168.11.0 255.255.255.0 # Periodically check connectivity through the tunnel and restart if connectivity # is lost keepalive 10 120 # Cipher to use for encryption cipher BF-CBC # Blowfish (default) max-clients 5 # Downgrade to an unpriviledged user for security after initialization user nobody group nobody # Use a persistent key and tunnel interface. Helpful if running as an # unpriviledged user and the connection goes down. persist-key persist-tun # Log location and verbosity level status /var/log/openvpn-status.log log-append /var/log/openvpn.log verb 5 # Fork to the backgroud on successful initialization daemon [/code] server interfaces [code] eth0 Link encap:Ethernet direcciÃ³nHW 00:50:56:81:3f:45 Direc. inet:192.168.0.22 Difus.:0.0.0.0 MÃ¡sc:255.255.255.0 DirecciÃ³n inet6: fe80::250:56ff:fe81:3f45/64 Alcance:Enlace ACTIVO DIFUSIÃN FUNCIONANDO MULTICAST MTU:1500 MÃ©trica:1 Paquetes RX:20525 errores:0 perdidos:2889 overruns:0 frame:0 Paquetes TX:774 errores:0 perdidos:0 overruns:0 carrier:0 colisiones:0 long.colaTX:1000 Bytes RX:1746832 (1.7 MB) TX bytes:79513 (79.5 KB) InterrupciÃ³n:18 DirecciÃ³n base: 0x2000 lo Link encap:Bucle local Direc. inet:127.0.0.1 MÃ¡sc:255.0.0.0 DirecciÃ³n inet6: ::1/128 Alcance:AnfitriÃ³n ACTIVO BUCLE FUNCIONANDO MTU:16436 MÃ©trica:1 Paquetes RX:0 errores:0 perdidos:0 overruns:0 frame:0 Paquetes TX:0 errores:0 perdidos:0 overruns:0 carrier:0 colisiones:0 long.colaTX:0 Bytes RX:0 (0.0 B) TX bytes:0 (0.0 B) tun0 Link encap:UNSPEC direccionHW 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 Direc. inet:192.168.9.1 P-t-P:192.168.9.2 MÃ¡sc:255.255.255.255 ACTIVO PUNTO A PUNTO FUNCIONANDO NOARP MULTICAST MTU:1500 MÃ©trica:1 Paquetes RX:16 errores:0 perdidos:0 overruns:0 frame:0 Paquetes TX:5 errores:0 perdidos:0 overruns:0 carrier:0 colisiones:0 long.colaTX:100 Bytes RX:1156 (1.1 KB) TX bytes:420 (420.0 B) [/code] ccd vpn-seafi File in Server [code] iroute 192.168.11.0 255.255.255.0 push "route 192.168.0.0 255.255.255.0 vpn_gateway" [/code] server routes [code] Tabla de rutas IP del nucleo Destino Pasarela Genmask Indic MÃ©tric Ref Uso Interfaz default 192.168.0.17 0.0.0.0 UG 100 0 0 eth0 192.168.0.0 * 255.255.255.0 U 0 0 0 eth0 192.168.9.0 192.168.9.2 255.255.255.0 UG 0 0 0 tun0 192.168.9.2 * 255.255.255.255 UH 0 0 0 tun0 192.168.11.0 192.168.9.2 255.255.255.0 UG 0 0 0 tun0 [/code] Ping server tests [code] ping 192.168.9.6 PING 192.168.9.6 (192.168.9.6) 56(84) bytes of data. 64 bytes from 192.168.9.6: icmp_req=1 ttl=64 time=68.4 ms 64 bytes from 192.168.9.6: icmp_req=2 ttl=64 time=66.6 ms PING 192.168.11.204 (192.168.11.204) 56(84) bytes of data. ^C --- 192.168.11.204 ping statistics --- 1 packets transmitted, 0 received, 100% packet loss, time 0ms [/code] [size=200][b]CLIENT[/b][/size] client.conf [code] # Instructs OpenVPN to run in client mode, requests IP address and # special instructions (like routes) from the server. client # Interface for tunnel dev tun0 # Remote server to connect to. Can be domain name or IP address. remote 62.43.111.123 1195 # Certificates and keys required for connection ca /etc/openvpn/certs/ca.crt cert /etc/openvpn/certs/vpn-seafi.crt key /etc/openvpn/keys/vpn-seafi.key # Symmetric cipher - Must be the same as the server's cipher BF-CBC # Protocol and Port - Must be the same on both server and client. proto udp port 1195 # Log to file instead of syslog log-append /var/log/openvpn.log verb 9 # Since the OpenVPN client is acting as a gateway for other machines # on the client-side network, run as a daemon and downgrade user # priviledges. user nobody group nobody daemon # Use a persistent key and tunnel interface. persist-tun persist-key [/code] [b]client interfaces[/b] [code] eth0 Link encap:Ethernet direccionHW 00:0c:29:d9:ce:18 Direc. inet:192.168.11.204 Difus.:0.0.0.0 MÃ¡sc:255.255.255.0 DirecciÃ³n inet6: fe80::20c:29ff:fed9:ce18/64 Alcance:Enlace ACTIVO DIFUSIÃN FUNCIONANDO MULTICAST MTU:1500 MÃ©trica:1 Paquetes RX:1571 errores:0 perdidos:0 overruns:0 frame:0 Paquetes TX:737 errores:0 perdidos:0 overruns:0 carrier:0 colisiones:0 long.colaTX:1000 Bytes RX:132188 (132.1 KB) TX bytes:66919 (66.9 KB) InterrupciÃ³n:18 DirecciÃ³n base: 0x1400 lo Link encap:Bucle local Direc. inet:127.0.0.1 MÃ¡sc:255.0.0.0 DirecciÃ³n inet6: ::1/128 Alcance:AnfitriÃ³n ACTIVO BUCLE FUNCIONANDO MTU:16436 MÃ©trica:1 Paquetes RX:0 errores:0 perdidos:0 overruns:0 frame:0 Paquetes TX:0 errores:0 perdidos:0 overruns:0 carrier:0 colisiones:0 long.colaTX:0 Bytes RX:0 (0.0 B) TX bytes:0 (0.0 B) tun0 Link encap:UNSPEC direcciÃ³nHW 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 Direc. inet:192.168.9.6 P-t-P:192.168.9.5 MÃ¡sc:255.255.255.255 ACTIVO PUNTO A PUNTO FUNCIONANDO NOARP MULTICAST MTU:1500 MÃ©trica:1 Paquetes RX:0 errores:0 perdidos:0 overruns:0 frame:0 Paquetes TX:17 errores:0 perdidos:0 overruns:0 carrier:0 colisiones:0 long.colaTX:100 Bytes RX:0 (0.0 B) TX bytes:1216 (1.2 KB) [/code] client routes [code] Tabla de rutas IP del nucleo Destino Pasarela Genmask Indic Metrica Ref Uso Interfaz default 192.168.11.1 0.0.0.0 UG 100 0 0 eth0 192.168.0.0 192.168.9.5 255.255.255.0 UG 0 0 0 tun0 192.168.9.1 192.168.9.5 255.255.255.255 UGH 0 0 0 tun0 192.168.9.5 * 255.255.255.255 UH 0 0 0 tun0 192.168.11.0 * 255.255.255.0 U 0 0 0 eth0 [/code] CLIENT PING TESTS [code] PING 192.168.0.189 (192.168.0.189) 56(84) bytes of data. ^C --- 192.168.0.189 ping statistics --- 2 packets transmitted, 0 received, 100% packet loss, time 1005ms PING 192.168.9.1 (192.168.9.1) 56(84) bytes of data. 64 bytes from 192.168.9.1: icmp_req=1 ttl=64 time=67.4 ms 64 bytes from 192.168.9.1: icmp_req=2 ttl=64 time=65.7 ms [/code] I have ip forwarding enabled in the server and client. [code] net.ipv4.ip_forward = 1 [/code] Tracert beetwen my pc client with the other network [code] Traza a 192.168.0.7 sobre caminos de 30 saltos como máximo. 1

[quote]Thu Nov 24 10:20:54 2011 us=241047 vpn-seafi/82.62.111.123:1195 MULTI: bad source address from client [192.168.11.201], packet dropped[/quote] You can skip this erratic error. I've seen this lines on every my full sequred remote sites sometimes. What version of OpenVPN you are using?

Problem to connect Site-to-Site routing with openvpn

clonic

Hi,
I have a problem with my openvpn server. if I ping with internal openvpn ip (Server ping 192.168.9.6) i can establish communication but in other case if I ping with 192.168.11.204 I can't establish communication.
I have done a picture to see easier the components (public ips are fake).

Openvpn.log I have seen this.


Thu Nov 24 10:20:54 2011 us=241047 vpn-seafi/82.62.111.123:1195 MULTI: bad source address from client [192.168.11.201], packet dropped

Thank you for your help!!

SERVER

My server.conf

# Local address to listen on. i.e. the OpenVPN server's LAN address
local 192.168.0.22

# The default OpenVPN port
port 1195

# Protocol used to transmit between OpenVPN nodes
proto udp 
# Interface for the OpevVPN tunnel 
dev tun0

# Required keys and certificates
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/vpn-server.crt
key /etc/openvpn/keys/vpn-server.key  # This file should be kept secret
dh /etc/openvpn/dh2048.pem

# The server directive instructs this OpenVPN instance to act as the central node.
# The network IP address and netmask are used for the point-to-point connections
# between the OpenVPN server and the client nodes. Only the server and the client
# need to know about this subnet.
server 192.168.9.0 255.255.255.0

# Create a file for persistent IP addresses. Helpful for intermittent connections.
ifconfig-pool-persist /etc/openvpn/ipp.txt

# Advertise the server's network to connecting clients
push "route 192.168.0.0 255.255.255.0"

# Specific client configurations
client-config-dir client-configs

# Route server-side traffic bound for the client network
route 192.168.11.0 255.255.255.0

# Periodically check connectivity through the tunnel and restart if connectivity 
# is lost
keepalive 10 120

# Cipher to use for encryption
cipher BF-CBC        # Blowfish (default)
max-clients 5

# Downgrade to an unpriviledged user for security after initialization
user nobody
group nobody

# Use a persistent key and tunnel interface. Helpful if running as an 
# unpriviledged user and the connection goes down.
persist-key
persist-tun

# Log location and verbosity level
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 5

# Fork to the backgroud on successful initialization
daemon

server interfaces

eth0      Link encap:Ethernet  direcciÃ³nHW 00:50:56:81:3f:45  
          Direc. inet:192.168.0.22  Difus.:0.0.0.0  MÃ¡sc:255.255.255.0
          DirecciÃ³n inet6: fe80::250:56ff:fe81:3f45/64 Alcance:Enlace
          ACTIVO DIFUSIÃN FUNCIONANDO MULTICAST  MTU:1500  MÃ©trica:1
          Paquetes RX:20525 errores:0 perdidos:2889 overruns:0 frame:0
          Paquetes TX:774 errores:0 perdidos:0 overruns:0 carrier:0
          colisiones:0 long.colaTX:1000 
          Bytes RX:1746832 (1.7 MB)  TX bytes:79513 (79.5 KB)
          InterrupciÃ³n:18 DirecciÃ³n base: 0x2000 

lo        Link encap:Bucle local  
          Direc. inet:127.0.0.1  MÃ¡sc:255.0.0.0
          DirecciÃ³n inet6: ::1/128 Alcance:AnfitriÃ³n
          ACTIVO BUCLE FUNCIONANDO  MTU:16436  MÃ©trica:1
          Paquetes RX:0 errores:0 perdidos:0 overruns:0 frame:0
          Paquetes TX:0 errores:0 perdidos:0 overruns:0 carrier:0
          colisiones:0 long.colaTX:0 
          Bytes RX:0 (0.0 B)  TX bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  direccionHW 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          Direc. inet:192.168.9.1  P-t-P:192.168.9.2  MÃ¡sc:255.255.255.255
          ACTIVO PUNTO A PUNTO FUNCIONANDO NOARP MULTICAST  MTU:1500  MÃ©trica:1
          Paquetes RX:16 errores:0 perdidos:0 overruns:0 frame:0
          Paquetes TX:5 errores:0 perdidos:0 overruns:0 carrier:0
          colisiones:0 long.colaTX:100 
          Bytes RX:1156 (1.1 KB)  TX bytes:420 (420.0 B)

ccd vpn-seafi File in Server

iroute 192.168.11.0 255.255.255.0
push "route 192.168.0.0 255.255.255.0 vpn_gateway"

server routes

Tabla de rutas IP del nucleo
Destino         Pasarela        Genmask         Indic MÃ©tric Ref    Uso Interfaz
default         192.168.0.17    0.0.0.0         UG    100    0        0 eth0
192.168.0.0     *               255.255.255.0   U     0      0        0 eth0
192.168.9.0     192.168.9.2     255.255.255.0   UG    0      0        0 tun0
192.168.9.2     *               255.255.255.255 UH    0      0        0 tun0
192.168.11.0    192.168.9.2     255.255.255.0   UG    0      0        0 tun0

Ping server tests

 ping 192.168.9.6
PING 192.168.9.6 (192.168.9.6) 56(84) bytes of data.
64 bytes from 192.168.9.6: icmp_req=1 ttl=64 time=68.4 ms
64 bytes from 192.168.9.6: icmp_req=2 ttl=64 time=66.6 ms



PING 192.168.11.204 (192.168.11.204) 56(84) bytes of data.
^C
--- 192.168.11.204 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

CLIENT

client.conf

# Instructs OpenVPN to run in client mode, requests IP address and
# special instructions (like routes) from the server. 
client

# Interface for tunnel
dev tun0

# Remote server to connect to. Can be domain name or IP address.
remote 62.43.111.123 1195


# Certificates and keys required for connection
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/vpn-seafi.crt
key /etc/openvpn/keys/vpn-seafi.key

# Symmetric cipher - Must be the same as the server's
cipher BF-CBC

# Protocol and Port - Must be the same on both server and client.
proto udp
port 1195


# Log to file instead of syslog
log-append /var/log/openvpn.log
verb 9

# Since the OpenVPN client is acting as a gateway for other machines
# on the client-side network, run as a daemon and downgrade user
# priviledges.
user nobody
group nobody
daemon

# Use a persistent key and tunnel interface.
persist-tun
persist-key

client interfaces

eth0      Link encap:Ethernet  direccionHW 00:0c:29:d9:ce:18  
          Direc. inet:192.168.11.204  Difus.:0.0.0.0  MÃ¡sc:255.255.255.0
          DirecciÃ³n inet6: fe80::20c:29ff:fed9:ce18/64 Alcance:Enlace
          ACTIVO DIFUSIÃN FUNCIONANDO MULTICAST  MTU:1500  MÃ©trica:1
          Paquetes RX:1571 errores:0 perdidos:0 overruns:0 frame:0
          Paquetes TX:737 errores:0 perdidos:0 overruns:0 carrier:0
          colisiones:0 long.colaTX:1000 
          Bytes RX:132188 (132.1 KB)  TX bytes:66919 (66.9 KB)
          InterrupciÃ³n:18 DirecciÃ³n base: 0x1400 

lo        Link encap:Bucle local  
          Direc. inet:127.0.0.1  MÃ¡sc:255.0.0.0
          DirecciÃ³n inet6: ::1/128 Alcance:AnfitriÃ³n
          ACTIVO BUCLE FUNCIONANDO  MTU:16436  MÃ©trica:1
          Paquetes RX:0 errores:0 perdidos:0 overruns:0 frame:0
          Paquetes TX:0 errores:0 perdidos:0 overruns:0 carrier:0
          colisiones:0 long.colaTX:0 
          Bytes RX:0 (0.0 B)  TX bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  direcciÃ³nHW 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          Direc. inet:192.168.9.6  P-t-P:192.168.9.5  MÃ¡sc:255.255.255.255
          ACTIVO PUNTO A PUNTO FUNCIONANDO NOARP MULTICAST  MTU:1500  MÃ©trica:1
          Paquetes RX:0 errores:0 perdidos:0 overruns:0 frame:0
          Paquetes TX:17 errores:0 perdidos:0 overruns:0 carrier:0
          colisiones:0 long.colaTX:100 
          Bytes RX:0 (0.0 B)  TX bytes:1216 (1.2 KB)

client routes

Tabla de rutas IP del nucleo
Destino         Pasarela        Genmask         Indic Metrica Ref    Uso Interfaz
default         192.168.11.1    0.0.0.0         UG    100    0        0 eth0
192.168.0.0     192.168.9.5     255.255.255.0   UG    0      0        0 tun0
192.168.9.1     192.168.9.5     255.255.255.255 UGH   0      0        0 tun0
192.168.9.5     *               255.255.255.255 UH    0      0        0 tun0
192.168.11.0    *               255.255.255.0   U     0      0        0 eth0

CLIENT PING TESTS

PING 192.168.0.189 (192.168.0.189) 56(84) bytes of data.
^C
--- 192.168.0.189 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1005ms

PING 192.168.9.1 (192.168.9.1) 56(84) bytes of data.
64 bytes from 192.168.9.1: icmp_req=1 ttl=64 time=67.4 ms
64 bytes from 192.168.9.1: icmp_req=2 ttl=64 time=65.7 ms

I have ip forwarding enabled in the server and client.

net.ipv4.ip_forward = 1

Tracert beetwen my pc client with the other network

Traza a 192.168.0.7 sobre caminos de 30 saltos como máximo.

  1    <1 ms     2 ms     1 ms  192.168.11.204
  2     *        *        *     Tiempo de espera agotado para esta solicitud.
  3     *     ^C

maikcat

can you add this to your ccd file:

ifconfig-push 192.168.9.10 192.168.9.9

restart your client and check if he gets 192.168.9.10 ip..

your configs looks ok... :?

Michael.

ps:can you post server log?

Mimiko

Thu Nov 24 10:20:54 2011 us=241047 vpn-seafi/82.62.111.123:1195 MULTI: bad source address from client [192.168.11.201], packet dropped

You can skip this erratic error. I've seen this lines on every my full sequred remote sites sometimes. What version of OpenVPN you are using?

clonic

Thank you for the help.

I have wrotten the line in the ccd file.

iroute 192.168.11.0 255.255.255.0
push "route 192.168.0.0 255.255.255.0 vpn_gateway"
ifconfig-push 192.168.9.10 192.168.9.9

And the private ip address of my client is (is the same):

tun0      Link encap:UNSPEC  direcciÃ³nHW 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          Direc. inet:192.168.9.6  P-t-P:192.168.9.5  MÃ¡sc:255.255.255.255

then I tried to put this

iroute 192.168.11.0 255.255.255.0
push "route 192.168.0.0 255.255.255.0 vpn_gateway"
push "192.168.9.10 192.168.9.9"

the same result

tun0      Link encap:UNSPEC  direcciÃ³nHW 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          Direc. inet:192.168.9.6  P-t-P:192.168.9.5  MÃ¡sc:255.255.255.255

My server log (openvpn.log)

Fri Nov 25 14:11:35 2011 us=539964 OpenVPN 2.2.0 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jul  4 2011
Fri Nov 25 14:11:35 2011 us=540196 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Fri Nov 25 14:11:35 2011 us=540213 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Fri Nov 25 14:11:35 2011 us=546355 SIGTERM[hard,] received, process exiting
Fri Nov 25 14:11:35 2011 us=640362 Diffie-Hellman initialized with 2048 bit key
Fri Nov 25 14:11:35 2011 us=641379 TLS-Auth MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Nov 25 14:11:35 2011 us=641420 Socket Buffers: R=[114688->131072] S=[114688->131072]
Fri Nov 25 14:11:35 2011 us=641568 ROUTE default_gateway=192.168.0.17
Fri Nov 25 14:11:35 2011 us=645643 TUN/TAP device tun0 opened
Fri Nov 25 14:11:35 2011 us=645664 TUN/TAP TX queue length set to 100
Fri Nov 25 14:11:35 2011 us=645681 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Nov 25 14:11:35 2011 us=645714 /sbin/ifconfig tun0 192.168.9.1 pointopoint 192.168.9.2 mtu 1500
Fri Nov 25 14:11:35 2011 us=651852 /sbin/route add -net 192.168.11.0 netmask 255.255.255.0 gw 192.168.9.2
Fri Nov 25 14:11:35 2011 us=653800 /sbin/route add -net 192.168.9.0 netmask 255.255.255.0 gw 192.168.9.2
Fri Nov 25 14:11:35 2011 us=657741 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Fri Nov 25 14:11:35 2011 us=664469 GID set to nobody
Fri Nov 25 14:11:35 2011 us=664628 UID set to nobody
Fri Nov 25 14:11:35 2011 us=664693 UDPv4 link local (bound): [AF_INET]192.168.0.22:1195
Fri Nov 25 14:11:35 2011 us=664710 UDPv4 link remote: [undef]
Fri Nov 25 14:11:35 2011 us=664744 MULTI: multi_init called, r=256 v=256
Fri Nov 25 14:11:35 2011 us=664963 IFCONFIG POOL: base=192.168.9.4 size=62, ipv6=0
Fri Nov 25 14:11:35 2011 us=664992 ifconfig_pool_read(), in='vpn-seafi,192.168.9.4', TODO: IPv6
Fri Nov 25 14:11:35 2011 us=665045 succeeded -> ifconfig_pool_set()
Fri Nov 25 14:11:35 2011 us=665073 IFCONFIG POOL LIST
Fri Nov 25 14:11:35 2011 us=665086 vpn-seafi,192.168.9.4
Fri Nov 25 14:11:35 2011 us=665143 Initialization Sequence Completed
Fri Nov 25 14:12:24 2011 us=745176 MULTI: multi_create_instance called
Fri Nov 25 14:12:24 2011 us=745358 x.y.z.w (fakeip):1195 Re-using SSL/TLS context
Fri Nov 25 14:12:24 2011 us=745806 x.y.z.w (fakeip):1195 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Nov 25 14:12:24 2011 us=745821 x.y.z.w (fakeip):1195 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Fri Nov 25 14:12:24 2011 us=745908 x.y.z.w (fakeip):1195 Local Options String: 'V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Fri Nov 25 14:12:24 2011 us=745920 x.y.z.w (fakeip):1195 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Fri Nov 25 14:12:24 2011 us=745953 x.y.z.w (fakeip):1195 Local Options hash (VER=V4): '239669a8'
Fri Nov 25 14:12:24 2011 us=745969 x.y.z.w (fakeip):1195 Expected Remote Options hash (VER=V4): '3514370b'
RFri Nov 25 14:12:24 2011 us=746056 x.y.z.w (fakeip):1195 TLS: Initial packet from [AF_INET]x.y.z.w (fakeip):1195, sid=1a36ba5a b15de214
WRRWRWRWWWWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRRRRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRFri Nov 25 14:12:26 2011 us=496646 x.y.z.w (fakeip):1195 VERIFY OK: depth=1, /C=ES/ST=CS/L=Burriana/O=ayto-burriana/OU=ayto-burriana/CN=vpn-server/name=vpn/emailAddress=alertas@burriana.es
Fri Nov 25 14:12:26 2011 us=497624 x.y.z.w (fakeip):1195 VERIFY OK: depth=0, /C=ES/ST=CS/L=fake/O=fake/OU=fakeou/CN=vpn-seafi/name=vpn/emailAddress=xxx@fakeemail.com
WRWRWRWRWRWRWWWWRWRWRWRWRWRWRWRWRWRWRWRWRRRRWRWRWRFri Nov 25 14:12:26 2011 us=956958 x.y.z.w (fakeip):1195 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Nov 25 14:12:26 2011 us=957015 x.y.z.w (fakeip):1195 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Nov 25 14:12:26 2011 us=957072 x.y.z.w (fakeip):1195 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Nov 25 14:12:26 2011 us=957085 x.y.z.w (fakeip):1195 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Nov 25 14:12:26 2011 us=957015 x.y.z.w (fakeip):1195 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Nov 25 14:12:26 2011 us=957072 x.y.z.w (fakeip):1195 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Nov 25 14:12:26 2011 us=957085 x.y.z.w (fakeip):1195 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
WWWRRRFri Nov 25 14:12:27 2011 us=33177 x.y.z.w (fakeip):1195 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Fri Nov 25 14:12:27 2011 us=33243 x.y.z.w (fakeip):1195 [vpn-seafi] Peer Connection Initiated with [AF_INET]x.y.z.w (fakeip):1195
Fri Nov 25 14:12:27 2011 us=33326 vpn-seafi/x.y.z.w (fakeip):1195 MULTI_sva: pool returned IPv4=192.168.9.6, IPv6=dc43:209:cae4:b08:100:0:dc43:209
Fri Nov 25 14:12:27 2011 us=33376 vpn-seafi/x.y.z.w (fakeip):1195 MULTI: Learn: 192.168.9.6 -> vpn-seafi/x.y.z.w (fakeip):1195
Fri Nov 25 14:12:27 2011 us=33391 vpn-seafi/x.y.z.w (fakeip):1195 MULTI: primary virtual IP for vpn-seafi/x.y.z.w (fakeip):1195: 192.168.9.6
RFri Nov 25 14:12:29 2011 us=119037 vpn-seafi/x.y.z.w (fakeip):1195 PUSH: Received control message: 'PUSH_REQUEST'
Fri Nov 25 14:12:29 2011 us=119081 vpn-seafi/x.y.z.w (fakeip):1195 send_push_reply(): safe_cap=960
Fri Nov 25 14:12:29 2011 us=119162 vpn-seafi/x.y.z.w (fakeip):1195 SENT CONTROL [vpn-seafi]: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,route 192.168.9.1,topology net30,ping 10,ping-restart 120,ifconfig 192.168.9.6 192.168.9.5' (status=1)
WWWRRRWWRWRWRWRWRWRWRWRWRRWRWWRRWRWRWWRWRWRRWWRRWWRRWRWRWRWRWRWRWRwRwRWwRwWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWR

Note: x.y.z.w (fakeip) is my public ip

My openvpn version

OpenVPN 2.2.0 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jul  4 2011
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>

  $ ./configure --enable-pthread --enable-password-save --host=i686-linux-gnu --build=i686-linux-gnu --prefix=/usr --mandir=${prefix}/share/man --with-ifconfig-path=/sbin/ifconfig --with-route-path=/sbin/route CFLAGS=-g -O2

Compile time defines:  ENABLE_CLIENT_SERVER ENABLE_DEBUG ENABLE_EUREPHIA ENABLE_FRAGMENT ENABLE_HTTP_PROXY ENABLE_MANAGEMENT ENABLE_MULTIHOME ENABLE_PASSWORD_SAVE ENABLE_PORT_SHARE ENABLE_SOCKS USE_CRYPTO USE_LIBDL USE_LZO USE_PF_INET6 USE_PKCS11 USE_SSL

Mimiko

What is the ccd file name for the client which does not get correct ip?

clonic

The name is vpn-seafi (the client), i have created certificates with this name.

It is very strange. Are the routing table correct? I think that yes.

Thanks you for the help 🙂

Mimiko

Delete on the server ipp.txt file and try again. See what IP client gets.

maikcat

also try to use absolute path name to your ccd directory,

also filenames is linux are case sensitive...

Michael.

clonic

I tried to remove ipp.txt but the same Ip, I'll try to put all the filepath and review case sensitives (but I thought that is correct).

clonic

I have put the absolute path in ccd files and now the client ip are 192.168.9.9 and 192.168.9.10.
Now seemsly works perfectly.

The problem was the absolute path.

I have changed this line in server.conf

client-config-dir client-configs

for this

client-config-dir /etc/openvpn/client-configs

Thank you very much for all.

maikcat

glad to helped you,

cheers,

closing topic

Michael.