Need help determining why server generates message 'status=1' when pushing routes. Two of three pushed routes are created without complaints. The third route (10.10.12.1) in client log below appears to be source of client's complaint. Fedora server and client use shorewall and they are working bridge/router.
Server openvpn: OpenVPN 2.1.1 i686-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] built on Jan 5 2010
Client openvpn: OpenVPN 2.1.4 x86_64-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] built on Mar 17 2011
client log:
SENT CONTROL [hearty]: 'PUSH_REPLY,route 10.10.10.0 255.255.255.0 10.10.10.1,route 10.10.11.0 255.255.255.0 10.10.11.1,persist-key,persist-tun,route-gateway 10.10.12.1,ping 10,ping-restart 120,ifconfig 10.10.12.60 255.255.255.0' (status=1)
client routes:
route -v
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default ipxx-xxx-xxx-x. 0.0.0.0 UG 0 0 0 br0
10.0.0.0 * 255.0.0.0 U 0 0 0 eth0
10.0.2.0 * 255.255.255.0 U 0 0 0 eth0
10.0.8.0 * 255.255.255.0 U 0 0 0 eth2
10.10.10.0 10.10.10.1 255.255.255.0 UG 0 0 0 eth0
10.10.11.0 10.10.11.1 255.255.255.0 UG 0 0 0 eth0
10.10.12.0 * 255.255.255.0 U 0 0 0 tap0
xx.xxx.xxx.0 * 255.255.248.0 U 0 0 0 br0
link-local * 255.255.0.0 U 1002 0 0 eth2
link-local * 255.255.0.0 U 1003 0 0 eth0
link-local * 255.255.0.0 U 1005 0 0 br0
client conf:
client
dev tap0
port 2727
proto udp
remote xx.xxx.xx.xxx 2727
ping 10
resolv-retry infinite
user nobody
group nobody
persist-key
persist-tun
ca client/ca.crt
cert client/blackheart.crt
key client/blackheart.key
ns-cert-type server
tls-auth client/ta.key 1
cipher AES-128-CBC
comp-lzo
pull
verb 7
log-append /var/log/openvpn.log
server conf:
local xx.xxx.xx.xxx 2727
port 2727
proto udp
dev tap0
ca keys/ca.crt
cert keys/captain.crt
key keys/captain.key
dh keys/dh2048.pem
ifconfig-pool-persist logs/ipp.txt
server-bridge 10.10.12.1 255.255.255.0 10.10.12.60 10.10.12.70
client-to-client
keepalive 10 120
cipher AES-128-CBC
push "route 10.10.10.0 255.255.255.0 10.10.10.1"
push "route 10.10.11.0 255.255.255.0 10.10.11.1"
tls-auth keys/ta.key 0
comp-lzo
max-clients 5
user nobody
group nobody
persist-key
persist-tun
persist-local-ip
persist-remote-ip
push "persist-key"
push "persist-tun"
log-append /var/log/openvpn.log
status logs/openvpn-status.log
verb 7
Shorewall files:
zones:
#ZONE TYPE
fw firewall
bri ipv4 #zone for public address
dmz:bri bport4
vpn:bri bport4
wr0 ipv4
loc ipv4
#
interfaces:
#ZONE INTERFACE BROADCAST OPTIONS
bri br0 detect routefilter,bridge,nosmurfs,blacklist,tcpflags
dmz br0:eth1 detect blacklist
vpn br0:tap0 detect
loc eth2 detect dhcp,tcpflags
wr0 eth0 detect dhcp,tcpflags
#
Tunnels:
openvpn:2727 bri 0.0.0.0/0
One more question, would a second bridge help? Would greatly appreciate a nudge into right direction.
Thanks
