Hello janjust,
Thank you for your input.
Bellow you will see the configuration files for the 3 servers plus all the related logs to VPN connection.
There is also the tests that I made showing the problem (last 2 code boxes)
This post will be a bit extensive 😛
Main VPN
SERVER A
port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server1.crt
key /etc/openvpn/server1.key
dh /etc/openvpn/dh1024.pem
server 10.222.1.0 255.255.255.0
client-config-dir /etc/openvpn/ccd
ifconfig-pool-persist /etc/openvpn/ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
SERVER B
client
dev tun
proto udp
remote 192.168.11.250 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server2.crt
key /etc/openvpn/server2.key
comp-lzo
verb 3
SERVER C
client
dev tun
proto udp
remote 192.168.11.250 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server3.crt
key /etc/openvpn/server3.key
comp-lzo
verb 3
VPN between servers B and C:
SERVER B
port 1194
proto udp
dev tun
ca /etc/openvpn/servers23/keys/ca.crt
cert /etc/openvpn/servers23/keys/server2.crt
key /etc/openvpn/servers23/keys/server2.key
dh /etc/openvpn/servers23/keys/dh1024.pem
server 10.222.23.0 255.255.255.0
client-config-dir /etc/openvpn/servers23/ccd
ifconfig-pool-persist /etc/openvpn/servers23/ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /etc/openvpn/servers23/openvpn-status.log
verb 3
SERVER C
client
dev tun
proto udp
remote 192.168.12.250 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/servers23/ca.crt
cert /etc/openvpn/servers23/server3.crt
key /etc/openvpn/servers23/server3.key
comp-lzo
verb 3
Openvpn LOGS
SERVER A
# /etc/init.d/openvpn start
* Starting virtual private network daemon(s)... * Autostarting VPN 'server1' [ OK ]
root@Server1:/etc/openvpn# Dec 5 07:09:40 Server1 ovpn-server1[3045]: OpenVPN 2.1.0 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jul 20 2010
Dec 5 07:09:40 Server1 ovpn-server1[3045]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Dec 5 07:09:40 Server1 ovpn-server1[3045]: Diffie-Hellman initialized with 1024 bit key
Dec 5 07:09:40 Server1 ovpn-server1[3045]: /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Dec 5 07:09:41 Server1 ovpn-server1[3045]: TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Dec 5 07:09:41 Server1 ovpn-server1[3045]: ROUTE default_gateway=192.168.111.1
Dec 5 07:09:41 Server1 ovpn-server1[3045]: TUN/TAP device tun0 opened
Dec 5 07:09:41 Server1 ovpn-server1[3045]: TUN/TAP TX queue length set to 100
Dec 5 07:09:41 Server1 ovpn-server1[3045]: /sbin/ifconfig tun0 10.222.1.1 pointopoint 10.222.1.2 mtu 1500
Dec 5 07:09:41 Server1 ovpn-server1[3045]: /sbin/route add -net 10.222.1.0 netmask 255.255.255.0 gw 10.222.1.2
Dec 5 07:09:41 Server1 ovpn-server1[3045]: Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Dec 5 07:09:41 Server1 ovpn-server1[3051]: Socket Buffers: R=[112640->131072] S=[112640->131072]
Dec 5 07:09:41 Server1 ovpn-server1[3051]: UDPv4 link local (bound): [undef]
Dec 5 07:09:41 Server1 ovpn-server1[3051]: UDPv4 link remote: [undef]
Dec 5 07:09:41 Server1 ovpn-server1[3051]: MULTI: multi_init called, r=256 v=256
Dec 5 07:09:41 Server1 ovpn-server1[3051]: IFCONFIG POOL: base=10.222.1.4 size=62
Dec 5 07:09:41 Server1 ovpn-server1[3051]: IFCONFIG POOL LIST
Dec 5 07:09:41 Server1 ovpn-server1[3051]: server2,10.222.1.4
Dec 5 07:09:41 Server1 ovpn-server1[3051]: server3,10.222.1.8
Dec 5 07:09:41 Server1 ovpn-server1[3051]: Initialization Sequence Completed
Dec 5 07:10:18 Server1 ovpn-server1[3051]: MULTI: multi_create_instance called
Dec 5 07:10:18 Server1 ovpn-server1[3051]: 192.168.12.250:41260 Re-using SSL/TLS context
Dec 5 07:10:18 Server1 ovpn-server1[3051]: 192.168.12.250:41260 LZO compression initialized
Dec 5 07:10:18 Server1 ovpn-server1[3051]: 192.168.12.250:41260 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Dec 5 07:10:18 Server1 ovpn-server1[3051]: 192.168.12.250:41260 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Dec 5 07:10:18 Server1 ovpn-server1[3051]: 192.168.12.250:41260 Local Options hash (VER=V4): '530fdded'
Dec 5 07:10:18 Server1 ovpn-server1[3051]: 192.168.12.250:41260 Expected Remote Options hash (VER=V4): '41690919'
Dec 5 07:10:18 Server1 ovpn-server1[3051]: 192.168.12.250:41260 TLS: Initial packet from [AF_INET]192.168.12.250:41260, sid=0a68c623 d73a92cb
Dec 5 07:10:18 Server1 ovpn-server1[3051]: 192.168.12.250:41260 VERIFY OK: depth=1, /C=BR/ST=SP/L=SaoPaulo/O=xxx/CN=xxx_CA/emailAddress=support@xxx.com
Dec 5 07:10:18 Server1 ovpn-server1[3051]: 192.168.12.250:41260 VERIFY OK: depth=0, /C=BR/ST=SP/L=SaoPaulo/O=xxx/CN=server2/emailAddress=support@xxx.com
Dec 5 07:10:18 Server1 ovpn-server1[3051]: 192.168.12.250:41260 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Dec 5 07:10:18 Server1 ovpn-server1[3051]: 192.168.12.250:41260 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Dec 5 07:10:18 Server1 ovpn-server1[3051]: 192.168.12.250:41260 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Dec 5 07:10:18 Server1 ovpn-server1[3051]: 192.168.12.250:41260 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Dec 5 07:10:18 Server1 ovpn-server1[3051]: 192.168.12.250:41260 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Dec 5 07:10:18 Server1 ovpn-server1[3051]: 192.168.12.250:41260 [server2] Peer Connection Initiated with [AF_INET]192.168.12.250:41260
Dec 5 07:10:18 Server1 ovpn-server1[3051]: server2/192.168.12.250:41260 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/server2
Dec 5 07:10:18 Server1 ovpn-server1[3051]: server2/192.168.12.250:41260 MULTI: Learn: 10.222.1.2 -> server2/192.168.12.250:41260
Dec 5 07:10:18 Server1 ovpn-server1[3051]: server2/192.168.12.250:41260 MULTI: primary virtual IP for server2/192.168.12.250:41260: 10.222.1.2
Dec 5 07:10:20 Server1 ovpn-server1[3051]: server2/192.168.12.250:41260 PUSH: Received control message: 'PUSH_REQUEST'
Dec 5 07:10:20 Server1 ovpn-server1[3051]: server2/192.168.12.250:41260 SENT CONTROL [server2]: 'PUSH_REPLY,route 10.222.1.1,topology net30,ping 10,ping-restart 120,ifconfig 10.222.1.2 10.222.1.1' (status=1)
Dec 5 07:10:51 Server1 ovpn-server1[3051]: MULTI: multi_create_instance called
Dec 5 07:10:51 Server1 ovpn-server1[3051]: 192.168.13.250:47346 Re-using SSL/TLS context
Dec 5 07:10:51 Server1 ovpn-server1[3051]: 192.168.13.250:47346 LZO compression initialized
Dec 5 07:10:51 Server1 ovpn-server1[3051]: 192.168.13.250:47346 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Dec 5 07:10:51 Server1 ovpn-server1[3051]: 192.168.13.250:47346 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Dec 5 07:10:51 Server1 ovpn-server1[3051]: 192.168.13.250:47346 Local Options hash (VER=V4): '530fdded'
Dec 5 07:10:51 Server1 ovpn-server1[3051]: 192.168.13.250:47346 Expected Remote Options hash (VER=V4): '41690919'
Dec 5 07:10:51 Server1 ovpn-server1[3051]: 192.168.13.250:47346 TLS: Initial packet from [AF_INET]192.168.13.250:47346, sid=5def4716 53090183
Dec 5 07:10:51 Server1 ovpn-server1[3051]: 192.168.13.250:47346 VERIFY OK: depth=1, /C=BR/ST=SP/L=SaoPaulo/O=xxx/CN=xxx_CA/emailAddress=support@xxx.com
Dec 5 07:10:51 Server1 ovpn-server1[3051]: 192.168.13.250:47346 VERIFY OK: depth=0, /C=BR/ST=SP/L=SaoPaulo/O=xxx/CN=server3/emailAddress=support@xxx.com
Dec 5 07:10:51 Server1 ovpn-server1[3051]: 192.168.13.250:47346 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Dec 5 07:10:51 Server1 ovpn-server1[3051]: 192.168.13.250:47346 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Dec 5 07:10:51 Server1 ovpn-server1[3051]: 192.168.13.250:47346 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Dec 5 07:10:51 Server1 ovpn-server1[3051]: 192.168.13.250:47346 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Dec 5 07:10:51 Server1 ovpn-server1[3051]: 192.168.13.250:47346 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Dec 5 07:10:51 Server1 ovpn-server1[3051]: 192.168.13.250:47346 [server3] Peer Connection Initiated with [AF_INET]192.168.13.250:47346
Dec 5 07:10:51 Server1 ovpn-server1[3051]: server3/192.168.13.250:47346 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/server3
Dec 5 07:10:51 Server1 ovpn-server1[3051]: server3/192.168.13.250:47346 MULTI: Learn: 10.222.1.3 -> server3/192.168.13.250:47346
Dec 5 07:10:51 Server1 ovpn-server1[3051]: server3/192.168.13.250:47346 MULTI: primary virtual IP for server3/192.168.13.250:47346: 10.222.1.3
Dec 5 07:10:53 Server1 ovpn-server1[3051]: server3/192.168.13.250:47346 PUSH: Received control message: 'PUSH_REQUEST'
Dec 5 07:10:53 Server1 ovpn-server1[3051]: server3/192.168.13.250:47346 SENT CONTROL [server3]: 'PUSH_REPLY,route 10.222.1.1,topology net30,ping 10,ping-restart 120,ifconfig 10.222.1.3 10.222.1.1' (status=1)
SERVER B connecting to SERVER A
root@Server2:/etc/openvpn# openvpn server1.conf
Mon Dec 5 07:24:24 2011 OpenVPN 2.1.0 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jul 20 2010
Mon Dec 5 07:24:24 2011 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Mon Dec 5 07:24:24 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Dec 5 07:24:24 2011 /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Mon Dec 5 07:24:24 2011 LZO compression initialized
Mon Dec 5 07:24:24 2011 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Dec 5 07:24:24 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Dec 5 07:24:24 2011 Local Options hash (VER=V4): '41690919'
Mon Dec 5 07:24:24 2011 Expected Remote Options hash (VER=V4): '530fdded'
Mon Dec 5 07:24:24 2011 Socket Buffers: R=[112640->131072] S=[112640->131072]
Mon Dec 5 07:24:24 2011 UDPv4 link local: [undef]
Mon Dec 5 07:24:24 2011 UDPv4 link remote: [AF_INET]192.168.11.250:1194
Mon Dec 5 07:24:24 2011 TLS: Initial packet from [AF_INET]192.168.11.250:1194, sid=f88e2fbb dfcbf719
Mon Dec 5 07:24:24 2011 VERIFY OK: depth=1, /C=BR/ST=SP/L=SaoPaulo/O=xxx/CN=xxx_CA/emailAddress=support@xxx.com
Mon Dec 5 07:24:24 2011 VERIFY OK: depth=0, /C=BR/ST=SP/L=SaoPaulo/O=xxx/CN=server1/emailAddress=support@xxx.com
Mon Dec 5 07:24:24 2011 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Dec 5 07:24:24 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 5 07:24:24 2011 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Dec 5 07:24:24 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 5 07:24:24 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon Dec 5 07:24:24 2011 [server1] Peer Connection Initiated with [AF_INET]192.168.11.250:1194
Mon Dec 5 07:24:27 2011 SENT CONTROL [server1]: 'PUSH_REQUEST' (status=1)
Mon Dec 5 07:24:27 2011 PUSH: Received control message: 'PUSH_REPLY,route 10.222.1.1,topology net30,ping 10,ping-restart 120,ifconfig 10.222.1.2 10.222.1.1'
Mon Dec 5 07:24:27 2011 OPTIONS IMPORT: timers and/or timeouts modified
Mon Dec 5 07:24:27 2011 OPTIONS IMPORT: --ifconfig/up options modified
Mon Dec 5 07:24:27 2011 OPTIONS IMPORT: route options modified
Mon Dec 5 07:24:27 2011 ROUTE default_gateway=192.168.112.1
Mon Dec 5 07:24:27 2011 TUN/TAP device tun0 opened
Mon Dec 5 07:24:27 2011 TUN/TAP TX queue length set to 100
Mon Dec 5 07:24:27 2011 /sbin/ifconfig tun0 10.222.1.2 pointopoint 10.222.1.1 mtu 1500
Mon Dec 5 07:24:27 2011 OpenVPN ROUTE: omitted no-op route: 10.222.1.1/255.255.255.255 -> 10.222.1.1
Mon Dec 5 07:24:27 2011 Initialization Sequence Completed
SERVER C connecting to SERVER A
root@Server3:/etc/openvpn# openvpn server1.conf
Mon Dec 5 07:28:19 2011 OpenVPN 2.1.0 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jul 20 2010
Mon Dec 5 07:28:19 2011 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Mon Dec 5 07:28:19 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Dec 5 07:28:19 2011 /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Mon Dec 5 07:28:19 2011 LZO compression initialized
Mon Dec 5 07:28:19 2011 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Dec 5 07:28:19 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Dec 5 07:28:19 2011 Local Options hash (VER=V4): '41690919'
Mon Dec 5 07:28:19 2011 Expected Remote Options hash (VER=V4): '530fdded'
Mon Dec 5 07:28:19 2011 Socket Buffers: R=[112640->131072] S=[112640->131072]
Mon Dec 5 07:28:19 2011 UDPv4 link local: [undef]
Mon Dec 5 07:28:19 2011 UDPv4 link remote: [AF_INET]192.168.11.250:1194
Mon Dec 5 07:28:19 2011 TLS: Initial packet from [AF_INET]192.168.11.250:1194, sid=1003a5bc 5c6f43ac
Mon Dec 5 07:28:20 2011 VERIFY OK: depth=1, /C=BR/ST=SP/L=SaoPaulo/O=xxx/CN=xxx_CA/emailAddress=support@xxx.com
Mon Dec 5 07:28:20 2011 VERIFY OK: depth=0, /C=BR/ST=SP/L=SaoPaulo/O=xxx/CN=server1/emailAddress=support@xxx.com
Mon Dec 5 07:28:20 2011 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Dec 5 07:28:20 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 5 07:28:20 2011 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Dec 5 07:28:20 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 5 07:28:20 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon Dec 5 07:28:20 2011 [server1] Peer Connection Initiated with [AF_INET]192.168.11.250:1194
Mon Dec 5 07:28:22 2011 SENT CONTROL [server1]: 'PUSH_REQUEST' (status=1)
Mon Dec 5 07:28:22 2011 PUSH: Received control message: 'PUSH_REPLY,route 10.222.1.1,topology net30,ping 10,ping-restart 120,ifconfig 10.222.1.3 10.222.1.1'
Mon Dec 5 07:28:22 2011 OPTIONS IMPORT: timers and/or timeouts modified
Mon Dec 5 07:28:22 2011 OPTIONS IMPORT: --ifconfig/up options modified
Mon Dec 5 07:28:22 2011 OPTIONS IMPORT: route options modified
Mon Dec 5 07:28:22 2011 ROUTE default_gateway=192.168.113.1
Mon Dec 5 07:28:22 2011 TUN/TAP device tun0 opened
Mon Dec 5 07:28:22 2011 TUN/TAP TX queue length set to 100
Mon Dec 5 07:28:22 2011 /sbin/ifconfig tun0 10.222.1.3 pointopoint 10.222.1.1 mtu 1500
Mon Dec 5 07:28:22 2011 OpenVPN ROUTE: omitted no-op route: 10.222.1.1/255.255.255.255 -> 10.222.1.1
Mon Dec 5 07:28:22 2011 Initialization Sequence Completed
SERVER B Listenning to SERVER C
Mon Dec 5 07:30:15 2011 OpenVPN 2.1.0 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jul 20 2010
Mon Dec 5 07:30:15 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Dec 5 07:30:15 2011 Diffie-Hellman initialized with 1024 bit key
Mon Dec 5 07:30:15 2011 /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Mon Dec 5 07:30:15 2011 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Dec 5 07:30:15 2011 ROUTE default_gateway=192.168.112.1
Mon Dec 5 07:30:15 2011 TUN/TAP device tun0 opened
Mon Dec 5 07:30:15 2011 TUN/TAP TX queue length set to 100
Mon Dec 5 07:30:15 2011 /sbin/ifconfig tun0 10.222.23.1 pointopoint 10.222.23.2 mtu 1500
Mon Dec 5 07:30:15 2011 /sbin/route add -net 10.222.23.0 netmask 255.255.255.0 gw 10.222.23.2
Mon Dec 5 07:30:15 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Dec 5 07:30:15 2011 Socket Buffers: R=[112640->131072] S=[112640->131072]
Mon Dec 5 07:30:15 2011 UDPv4 link local (bound): [undef]
Mon Dec 5 07:30:15 2011 UDPv4 link remote: [undef]
Mon Dec 5 07:30:15 2011 MULTI: multi_init called, r=256 v=256
Mon Dec 5 07:30:15 2011 IFCONFIG POOL: base=10.222.23.4 size=62
Mon Dec 5 07:30:15 2011 IFCONFIG POOL LIST
Mon Dec 5 07:30:15 2011 server3,10.222.23.4
Mon Dec 5 07:30:15 2011 Initialization Sequence Completed
Mon Dec 5 07:30:35 2011 MULTI: multi_create_instance called
Mon Dec 5 07:30:35 2011 192.168.13.250:40212 Re-using SSL/TLS context
Mon Dec 5 07:30:35 2011 192.168.13.250:40212 LZO compression initialized
Mon Dec 5 07:30:35 2011 192.168.13.250:40212 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Dec 5 07:30:35 2011 192.168.13.250:40212 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Dec 5 07:30:35 2011 192.168.13.250:40212 Local Options hash (VER=V4): '530fdded'
Mon Dec 5 07:30:35 2011 192.168.13.250:40212 Expected Remote Options hash (VER=V4): '41690919'
Mon Dec 5 07:30:35 2011 192.168.13.250:40212 TLS: Initial packet from [AF_INET]192.168.13.250:40212, sid=cbadd348 106802c2
Mon Dec 5 07:30:35 2011 192.168.13.250:40212 VERIFY OK: depth=1, /C=BR/ST=SP/L=SaoPaulo/O=xxx/OU=servers23/CN=xxx_CA/emailAddress=support@xxx.com
Mon Dec 5 07:30:35 2011 192.168.13.250:40212 VERIFY OK: depth=0, /C=BR/ST=SP/L=SaoPaulo/O=xxx/OU=servers23/CN=server3/emailAddress=support@xxx.com
Mon Dec 5 07:30:35 2011 192.168.13.250:40212 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Dec 5 07:30:35 2011 192.168.13.250:40212 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 5 07:30:35 2011 192.168.13.250:40212 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Dec 5 07:30:35 2011 192.168.13.250:40212 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 5 07:30:35 2011 192.168.13.250:40212 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon Dec 5 07:30:35 2011 192.168.13.250:40212 [server3] Peer Connection Initiated with [AF_INET]192.168.13.250:40212
Mon Dec 5 07:30:35 2011 server3/192.168.13.250:40212 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/servers23/ccd/server3
Mon Dec 5 07:30:35 2011 server3/192.168.13.250:40212 MULTI: Learn: 10.222.23.2 -> server3/192.168.13.250:40212
Mon Dec 5 07:30:35 2011 server3/192.168.13.250:40212 MULTI: primary virtual IP for server3/192.168.13.250:40212: 10.222.23.2
Mon Dec 5 07:30:37 2011 server3/192.168.13.250:40212 PUSH: Received control message: 'PUSH_REQUEST'
Mon Dec 5 07:30:37 2011 server3/192.168.13.250:40212 SENT CONTROL [server3]: 'PUSH_REPLY,route 10.222.23.1,topology net30,ping 10,ping-restart 120,ifconfig 10.222.23.2 10.222.23.1' (status=1)
SERVER C Connecting to SERVER B
Mon Dec 5 07:30:54 2011 OpenVPN 2.1.0 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jul 20 2010
Mon Dec 5 07:30:54 2011 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Mon Dec 5 07:30:54 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Dec 5 07:30:54 2011 /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Mon Dec 5 07:30:54 2011 LZO compression initialized
Mon Dec 5 07:30:54 2011 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Dec 5 07:30:54 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Dec 5 07:30:54 2011 Local Options hash (VER=V4): '41690919'
Mon Dec 5 07:30:54 2011 Expected Remote Options hash (VER=V4): '530fdded'
Mon Dec 5 07:30:54 2011 Socket Buffers: R=[112640->131072] S=[112640->131072]
Mon Dec 5 07:30:54 2011 UDPv4 link local: [undef]
Mon Dec 5 07:30:54 2011 UDPv4 link remote: [AF_INET]192.168.12.250:1194
Mon Dec 5 07:30:54 2011 TLS: Initial packet from [AF_INET]192.168.12.250:1194, sid=52d7f869 45f6d041
Mon Dec 5 07:30:54 2011 VERIFY OK: depth=1, /C=BR/ST=SP/L=SaoPaulo/O=xxx/OU=servers23/CN=xxx_CA/emailAddress=support@xxx.com
Mon Dec 5 07:30:54 2011 VERIFY OK: depth=0, /C=BR/ST=SP/L=SaoPaulo/O=xxx/OU=servers23/CN=server2/emailAddress=support@xxx.com
Mon Dec 5 07:30:54 2011 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Dec 5 07:30:54 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 5 07:30:54 2011 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Dec 5 07:30:54 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 5 07:30:54 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon Dec 5 07:30:54 2011 [server2] Peer Connection Initiated with [AF_INET]192.168.12.250:1194
Mon Dec 5 07:30:56 2011 SENT CONTROL [server2]: 'PUSH_REQUEST' (status=1)
Mon Dec 5 07:30:56 2011 PUSH: Received control message: 'PUSH_REPLY,route 10.222.23.1,topology net30,ping 10,ping-restart 120,ifconfig 10.222.23.2 10.222.23.1'
Mon Dec 5 07:30:56 2011 OPTIONS IMPORT: timers and/or timeouts modified
Mon Dec 5 07:30:56 2011 OPTIONS IMPORT: --ifconfig/up options modified
Mon Dec 5 07:30:56 2011 OPTIONS IMPORT: route options modified
Mon Dec 5 07:30:56 2011 ROUTE default_gateway=192.168.113.1
Mon Dec 5 07:30:56 2011 TUN/TAP device tun0 opened
Mon Dec 5 07:30:56 2011 TUN/TAP TX queue length set to 100
Mon Dec 5 07:30:56 2011 /sbin/ifconfig tun0 10.222.23.2 pointopoint 10.222.23.1 mtu 1500
Mon Dec 5 07:30:56 2011 OpenVPN ROUTE: omitted no-op route: 10.222.23.1/255.255.255.255 -> 10.222.23.1
Mon Dec 5 07:30:56 2011 Initialization Sequence Completed
SERVER A Pinging SERVER B and C
root@Server1:~# ping -c2 10.222.1.2
PING 10.222.1.2 (10.222.1.2) 56(84) bytes of data.
64 bytes from 10.222.1.2: icmp_seq=1 ttl=64 time=12.1 ms
64 bytes from 10.222.1.2: icmp_seq=2 ttl=64 time=11.1 ms
--- 10.222.1.2 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 11.102/11.616/12.130/0.514 ms
root@Server1:~# ping -c2 10.222.1.3
PING 10.222.1.3 (10.222.1.3) 56(84) bytes of data.
64 bytes from 10.222.1.3: icmp_seq=1 ttl=64 time=10.9 ms
64 bytes from 10.222.1.3: icmp_seq=2 ttl=64 time=10.6 ms
--- 10.222.1.3 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 10.634/10.813/10.992/0.179 ms
SERVER B Pinging Server A and C
root@Server2:/etc/openvpn# ping -c2 10.222.1.1
PING 10.222.1.1 (10.222.1.1) 56(84) bytes of data.
64 bytes from 10.222.1.1: icmp_seq=1 ttl=64 time=11.5 ms
64 bytes from 10.222.1.1: icmp_seq=2 ttl=64 time=11.1 ms
--- 10.222.1.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 11.129/11.328/11.528/0.226 ms
root@Server2:/etc/openvpn# ping -c2 10.222.23.2
PING 10.222.23.2 (10.222.23.2) 56(84) bytes of data.
64 bytes from 10.222.23.2: icmp_seq=1 ttl=64 time=10.8 ms
64 bytes from 10.222.23.2: icmp_seq=2 ttl=64 time=10.8 ms
--- 10.222.23.2 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 10.820/10.851/10.883/0.108 ms
SERVER C Pinging Server A and B
root@Server3:/etc/openvpn# ping -c2 10.222.1.1
PING 10.222.1.1 (10.222.1.1) 56(84) bytes of data.
64 bytes from 10.222.1.1: icmp_seq=1 ttl=64 time=11.2 ms
64 bytes from 10.222.1.1: icmp_seq=2 ttl=64 time=11.1 ms
--- 10.222.1.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 11.185/11.228/11.272/0.114 ms
root@Server3:/etc/openvpn# ping -c2 10.222.23.1
PING 10.222.23.1 (10.222.23.1) 56(84) bytes of data.
64 bytes from 10.222.23.1: icmp_seq=1 ttl=64 time=10.6 ms
64 bytes from 10.222.23.1: icmp_seq=2 ttl=64 time=10.4 ms
--- 10.222.23.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 10.477/10.563/10.649/0.086 ms
Just to show the problem:
On SERVER B I will add a static route to the ip 208.67.222.222 and run a testping
root@Server2:/etc/openvpn# route add 208.67.222.222 gw 10.222.1.1
root@Server2:/etc/openvpn# ping 208.67.222.222
PING 208.67.222.222 (208.67.222.222) 56(84) bytes of data.
64 bytes from 208.67.222.222: icmp_seq=1 ttl=54 time=137 ms
64 bytes from 208.67.222.222: icmp_seq=2 ttl=54 time=137 ms
64 bytes from 208.67.222.222: icmp_seq=3 ttl=54 time=137 ms
64 bytes from 208.67.222.222: icmp_seq=4 ttl=54 time=137 ms
64 bytes from 208.67.222.222: icmp_seq=5 ttl=54 time=137 ms
^C
--- 208.67.222.222 ping statistics ---
6 packets transmitted, 5 received, 16% packet loss, time 5006ms
rtt min/avg/max/mdev = 137.027/137.226/137.342/0.421 ms
root@Server2:/etc/openvpn# ping -c2 208.67.222.222
PING 208.67.222.222 (208.67.222.222) 56(84) bytes of data.
64 bytes from 208.67.222.222: icmp_seq=1 ttl=54 time=137 ms
64 bytes from 208.67.222.222: icmp_seq=2 ttl=54 time=137 ms
--- 208.67.222.222 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 137.289/137.443/137.598/0.401 ms
root@Server2:/etc/openvpn# route del 208.67.222.222 gw 10.222.1.1
root@Server2:/etc/openvpn#
On SERVER A I can see the icmp packets with tcpdump
root@Server1:~# tcpdump -i tun0 host 208.67.222.222 -nn
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 96 bytes
07:47:27.855604 IP 10.222.1.2 > 208.67.222.222: ICMP echo request, id 17943, seq 1, length 64
07:47:27.981930 IP 208.67.222.222 > 10.222.1.2: ICMP echo reply, id 17943, seq 1, length 64
07:47:28.857004 IP 10.222.1.2 > 208.67.222.222: ICMP echo request, id 17943, seq 2, length 64
07:47:28.983525 IP 208.67.222.222 > 10.222.1.2: ICMP echo reply, id 17943, seq 2, length 64
If I try to do the same test but in oposite order I can't see the packets arriving on SERVER B
(this is my problem)
root@Server1:~# route add 208.67.222.222 gw 10.222.1.2
root@Server1:~# ping -c2 208.67.222.222
PING 208.67.222.222 (208.67.222.222) 56(84) bytes of data.
--- 208.67.222.222 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1008ms
root@Server2:/etc/openvpn# tcpdump -i tun1 host 208.67.222.222 -nn
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun1, link-type RAW (Raw IP), capture size 96 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel
root@Server2:/etc/openvpn# ifconfig tun1 |head -n2
tun1 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.222.1.2 P-t-P:10.222.1.1 Mask:255.255.255.255
Thank you
