Hi all, I have a problem with my VPN net. Server is Ubuntu 10, client are ubuntu and windows. My server.conf: [code] port 1723 proto tcp dev tun ca ca.crt cert server.crt key server.key # This file should be kept secret dh dh1024.pem server 10.8.0.0 255.255.255.0 client-config-dir /etc/openvpn/ccd route 10.8.0.0 255.255.255.0 client-to-client keepalive 10 120 comp-lzo persist-key persist-tun status openvpn-status.log log-append openvpn.log verb 3 [/code] My client.conf [code] client dev tun proto tcp remote xxx.xxx.xxx.xxx 1723 resolv-retry infinite nobind persist-key persist-tun ca /etc/openvpn/ca.crt cert /etc/openvpn/client.crt key /etc/openvpn/client.key ns-cert-type server comp-lzo verb 3 log-append openvpn.log [/code] Random my client are disconnected from VPN. Their don't ping 10.8.0.1 (vpn server) In my client.log I reed: [code] WARNING: Bad encapsulated packet length from peer (0), which must be > 0 and

[quote="janjust"]for debugging, disable the CCD file for this client or comment out the line [quote]client-config-dir[/quote][/quote] Thanks for reply. My problem manifested always, whit and without client-config-dir enabled. In my ccd file I have, for example: [code] ifconfig-push 10.8.0.5 10.8.0.6 [/code] My client get 10.8.0.5 always, because I want ip reserved! [quote="janjust"]Comment out the line (or fix the ifconfig-push), reconnect the client and see if the disconnects still occur.[/quote] I modified my ccd client file with: [code] ifconfig-push 10.8.0.6 10.8.0.5 [/code] and I reboot vpn client. Is it ok? Thanks

Disconnect problem

kmitnick

Hi all,

I have a problem with my VPN net. Server is Ubuntu 10, client are ubuntu and windows.

My server.conf:


port 1723
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
client-config-dir /etc/openvpn/ccd
route 10.8.0.0 255.255.255.0
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log-append  openvpn.log
verb 3

My client.conf

client
dev tun
proto tcp
remote xxx.xxx.xxx.xxx 1723
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/client.crt
key /etc/openvpn/client.key
ns-cert-type server
comp-lzo
verb 3
log-append  openvpn.log

Random my client are disconnected from VPN. Their don't ping 10.8.0.1 (vpn server)

In my client.log I reed:

WARNING: Bad encapsulated packet length from peer (0), which must be > 0 and <= 1544 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]

Removed comments from your configs - Maikcat

janjust

please sanitize config files before posting them - it makes it hard to read them with all the lines starting with # and ;

also, post the client log when it is connecting and with

verb 5

added; from this we can usually tell what is going on.

kmitnick

This is verb 5 log

Thu Dec 22 21:58:22 2011 OpenVPN 2.1.3 i686-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Mar 11 2011
Thu Dec 22 21:58:22 2011 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Thu Dec 22 21:58:22 2011 WARNING: file '/etc/openvpn/oscazz.key' is group or others accessible
Thu Dec 22 21:58:22 2011 /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Thu Dec 22 21:58:22 2011 LZO compression initialized
Thu Dec 22 21:58:22 2011 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Thu Dec 22 21:58:22 2011 Socket Buffers: R=[87380->131072] S=[16384->131072]
Thu Dec 22 21:58:22 2011 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Dec 22 21:58:22 2011 Local Options hash (VER=V4): '69109d17'
Thu Dec 22 21:58:22 2011 Expected Remote Options hash (VER=V4): 'c0103fa8'
Thu Dec 22 21:58:22 2011 Attempting to establish TCP connection with [AF_INET]109.233.121.102:1723 [nonblock]
Thu Dec 22 21:58:23 2011 TCP connection established with [AF_INET]109.233.121.102:1723
Thu Dec 22 21:58:23 2011 TCPv4_CLIENT link local: [undef]
Thu Dec 22 21:58:23 2011 TCPv4_CLIENT link remote: [AF_INET]109.233.121.102:1723
Thu Dec 22 21:58:23 2011 TLS: Initial packet from [AF_INET]109.233.121.102:1723, sid=13e1523d a42fc54a
Thu Dec 22 21:58:24 2011 VERIFY OK: depth=1, /C=IT/ST=Italy/L=Napoli/O=pezzotto/OU=pezzotto/CN=pezzotto_CA/name=pezzotto_CA/emailAddress=k3v1n.hack@gmail.com
Thu Dec 22 21:58:24 2011 VERIFY OK: nsCertType=SERVER
Thu Dec 22 21:58:24 2011 VERIFY OK: depth=0, /C=IT/ST=Italy/L=Napoli/O=pezzotto/OU=pezzotto/CN=server/name=server/emailAddress=k3v1n.hack@gmail.com
Thu Dec 22 21:58:26 2011 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Dec 22 21:58:26 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec 22 21:58:26 2011 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Dec 22 21:58:26 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec 22 21:58:26 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Dec 22 21:58:26 2011 [server] Peer Connection Initiated with [AF_INET]109.233.121.102:1723
Thu Dec 22 21:58:28 2011 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Dec 22 21:58:29 2011 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.5 10.8.0.6'
Thu Dec 22 21:58:29 2011 OPTIONS IMPORT: timers and/or timeouts modified
Thu Dec 22 21:58:29 2011 OPTIONS IMPORT: --ifconfig/up options modified
Thu Dec 22 21:58:29 2011 OPTIONS IMPORT: route options modified
Thu Dec 22 21:58:29 2011 ROUTE default_gateway=192.168.200.254
Thu Dec 22 21:58:29 2011 TUN/TAP device tun0 opened
Thu Dec 22 21:58:29 2011 TUN/TAP TX queue length set to 100
Thu Dec 22 21:58:29 2011 /sbin/ifconfig tun0 10.8.0.5 pointopoint 10.8.0.6 mtu 1500
Thu Dec 22 21:58:29 2011 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.6
Thu Dec 22 21:58:29 2011 Initialization Sequence Completed
Thu Dec 22 22:11:09 2011 WARNING: Bad encapsulated packet length from peer (0), which must be > 0 and <= 1544 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Thu Dec 22 22:11:09 2011 Connection reset, restarting [0]
Thu Dec 22 22:11:09 2011 TCP/UDP: Closing socket
Thu Dec 22 22:11:09 2011 SIGUSR1[soft,connection-reset] received, process restarting
Thu Dec 22 22:11:09 2011 Restart pause, 5 second(s)
Thu Dec 22 22:11:14 2011 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Thu Dec 22 22:11:14 2011 Re-using SSL/TLS context
Thu Dec 22 22:11:14 2011 LZO compression initialized
Thu Dec 22 22:11:14 2011 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Thu Dec 22 22:11:14 2011 Socket Buffers: R=[87380->131072] S=[16384->131072]
Thu Dec 22 22:11:14 2011 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Dec 22 22:11:14 2011 Local Options hash (VER=V4): '69109d17'
Thu Dec 22 22:11:14 2011 Expected Remote Options hash (VER=V4): 'c0103fa8'
Thu Dec 22 22:11:14 2011 Attempting to establish TCP connection with [AF_INET]109.233.121.102:1723 [nonblock]
Thu Dec 22 22:11:15 2011 TCP connection established with [AF_INET]109.233.121.102:1723
Thu Dec 22 22:11:15 2011 TCPv4_CLIENT link local: [undef]
Thu Dec 22 22:11:15 2011 TCPv4_CLIENT link remote: [AF_INET]109.233.121.102:1723
Thu Dec 22 22:11:15 2011 WARNING: Bad encapsulated packet length from peer (0), which must be > 0 and <= 1544 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Thu Dec 22 22:11:15 2011 Connection reset, restarting [0]
Thu Dec 22 22:11:15 2011 TCP/UDP: Closing socket
Thu Dec 22 22:11:15 2011 SIGUSR1[soft,connection-reset] received, process restarting
Thu Dec 22 22:11:15 2011 Restart pause, 5 second(s)
Thu Dec 22 22:11:20 2011 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Thu Dec 22 22:11:20 2011 Re-using SSL/TLS context
Thu Dec 22 22:11:20 2011 LZO compression initialized
Thu Dec 22 22:11:20 2011 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Thu Dec 22 22:11:20 2011 Socket Buffers: R=[87380->131072] S=[16384->131072]
Thu Dec 22 22:11:20 2011 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Dec 22 22:11:20 2011 Local Options hash (VER=V4): '69109d17'
Thu Dec 22 22:11:20 2011 Expected Remote Options hash (VER=V4): 'c0103fa8'
Thu Dec 22 22:11:20 2011 Attempting to establish TCP connection with [AF_INET]109.233.121.102:1723 [nonblock]
Thu Dec 22 22:11:21 2011 TCP connection established with [AF_INET]109.233.121.102:1723
Thu Dec 22 22:11:21 2011 TCPv4_CLIENT link local: [undef]
Thu Dec 22 22:11:21 2011 TCPv4_CLIENT link remote: [AF_INET]109.233.121.102:1723
Thu Dec 22 22:11:21 2011 WARNING: Bad encapsulated packet length from peer (0), which must be > 0 and <= 1544 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Thu Dec 22 22:11:21 2011 Connection reset, restarting [0]
Thu Dec 22 22:11:21 2011 TCP/UDP: Closing socket
Thu Dec 22 22:11:21 2011 SIGUSR1[soft,connection-reset] received, process restarting
Thu Dec 22 22:11:21 2011 Restart pause, 5 second(s)
Thu Dec 22 22:11:26 2011 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Thu Dec 22 22:11:26 2011 Re-using SSL/TLS context
Thu Dec 22 22:11:26 2011 LZO compression initialized
Thu Dec 22 22:11:26 2011 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Thu Dec 22 22:11:26 2011 Socket Buffers: R=[87380->131072] S=[16384->131072]
Thu Dec 22 22:11:26 2011 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Dec 22 22:11:26 2011 Local Options hash (VER=V4): '69109d17'
Thu Dec 22 22:11:26 2011 Expected Remote Options hash (VER=V4): 'c0103fa8'
Thu Dec 22 22:11:26 2011 Attempting to establish TCP connection with [AF_INET]109.233.121.102:1723 [nonblock]
Thu Dec 22 22:11:27 2011 TCP connection established with [AF_INET]109.233.121.102:1723
Thu Dec 22 22:11:27 2011 TCPv4_CLIENT link local: [undef]
Thu Dec 22 22:11:27 2011 TCPv4_CLIENT link remote: [AF_INET]109.233.121.102:1723
Thu Dec 22 22:11:27 2011 WARNING: Bad encapsulated packet length from peer (0), which must be > 0 and <= 1544 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Thu Dec 22 22:11:27 2011 Connection reset, restarting [0]
Thu Dec 22 22:11:27 2011 TCP/UDP: Closing socket
Thu Dec 22 22:11:27 2011 SIGUSR1[soft,connection-reset] received, process restarting
Thu Dec 22 22:11:27 2011 Restart pause, 5 second(s)
Thu Dec 22 22:11:32 2011 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Thu Dec 22 22:11:32 2011 Re-using SSL/TLS context
Thu Dec 22 22:11:32 2011 LZO compression initialized
Thu Dec 22 22:11:32 2011 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Thu Dec 22 22:11:32 2011 Socket Buffers: R=[87380->131072] S=[16384->131072]
Thu Dec 22 22:11:32 2011 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Dec 22 22:11:32 2011 Local Options hash (VER=V4): '69109d17'
Thu Dec 22 22:11:32 2011 Expected Remote Options hash (VER=V4): 'c0103fa8'
Thu Dec 22 22:11:32 2011 Attempting to establish TCP connection with [AF_INET]109.233.121.102:1723 [nonblock]
Thu Dec 22 22:11:33 2011 TCP connection established with [AF_INET]109.233.121.102:1723
Thu Dec 22 22:11:33 2011 TCPv4_CLIENT link local: [undef]
Thu Dec 22 22:11:33 2011 TCPv4_CLIENT link remote: [AF_INET]109.233.121.102:1723
Thu Dec 22 22:11:33 2011 WARNING: Bad encapsulated packet length from peer (0), which must be > 0 and <= 1544 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Thu Dec 22 22:11:33 2011 Connection reset, restarting [0]
Thu Dec 22 22:11:33 2011 TCP/UDP: Closing socket
Thu Dec 22 22:11:33 2011 SIGUSR1[soft,connection-reset] received, process restarting
Thu Dec 22 22:11:33 2011 Restart pause, 5 second(s)
Thu Dec 22 22:11:38 2011 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Thu Dec 22 22:11:38 2011 Re-using SSL/TLS context
Thu Dec 22 22:11:38 2011 LZO compression initialized
Thu Dec 22 22:11:38 2011 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Thu Dec 22 22:11:38 2011 Socket Buffers: R=[87380->131072] S=[16384->131072]
Thu Dec 22 22:11:39 2011 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Dec 22 22:11:39 2011 Local Options hash (VER=V4): '69109d17'
Thu Dec 22 22:11:39 2011 Expected Remote Options hash (VER=V4): 'c0103fa8'
Thu Dec 22 22:11:39 2011 Attempting to establish TCP connection with [AF_INET]109.233.121.102:1723 [nonblock]
Thu Dec 22 22:11:40 2011 TCP connection established with [AF_INET]109.233.121.102:1723
Thu Dec 22 22:11:40 2011 TCPv4_CLIENT link local: [undef]
Thu Dec 22 22:11:40 2011 TCPv4_CLIENT link remote: [AF_INET]109.233.121.102:1723
Thu Dec 22 22:11:40 2011 WARNING: Bad encapsulated packet length from peer (0), which must be > 0 and <= 1544 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Thu Dec 22 22:11:40 2011 Connection reset, restarting [0]
Thu Dec 22 22:11:40 2011 TCP/UDP: Closing socket
Thu Dec 22 22:11:40 2011 SIGUSR1[soft,connection-reset] received, process restarting
Thu Dec 22 22:11:40 2011 Restart pause, 5 second(s)

I reed:

WARNING: Bad encapsulated packet length from peer (0), which must be > 0 and <= 1544 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]

I have changed proto with:

proto tcp-server #on vpn server
proto tcp-client #on vpn clients

Help me please!

Thanks in advance

janjust

for debugging, disable the CCD file for this client or comment out the line

client-config-dir

there's a (minor) mistake in the CCD file (the IPs are reversed: it should be first high, then low) but it should not cause this error.

Comment out the line (or fix the ifconfig-push), reconnect the client and see if the disconnects still occur.

kmitnick

janjust wrotefor debugging, disable the CCD file for this client or comment out the line
client-config-dir

Thanks for reply.

My problem manifested always, whit and without client-config-dir enabled.

In my ccd file I have, for example:

ifconfig-push 10.8.0.5 10.8.0.6

My client get 10.8.0.5 always, because I want ip reserved!

janjust wroteComment out the line (or fix the ifconfig-push), reconnect the client and see if the disconnects still occur.

I modified my ccd client file with:

ifconfig-push 10.8.0.6 10.8.0.5

and I reboot vpn client. Is it ok?

Thanks

kmitnick

This is my test:

Start VPN client on ubuntu server 10 at 10.59
client connected but at 11.34 disconnected. See log:

Sat Dec 24 11:34:24 2011 us=752333 Fatal TLS error (check_tls_errors_co), restarting
Sat Dec 24 11:34:24 2011 us=752975 TCP/UDP: Closing socket
Sat Dec 24 11:34:24 2011 us=753119 SIGUSR1[soft,tls-error] received, process restarting
Sat Dec 24 11:34:24 2011 us=753192 Restart pause, 5 second(s)
Sat Dec 24 11:34:29 2011 us=753329 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sat Dec 24 11:34:29 2011 us=753474 Re-using SSL/TLS context
Sat Dec 24 11:34:29 2011 us=753537 LZO compression initialized
Sat Dec 24 11:34:29 2011 us=753666 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Sat Dec 24 11:34:29 2011 us=753746 Socket Buffers: R=[87380->131072] S=[16384->131072]
Sat Dec 24 11:34:29 2011 us=753802 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Dec 24 11:34:29 2011 us=753866 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Sat Dec 24 11:34:29 2011 us=753895 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Sat Dec 24 11:34:29 2011 us=753944 Local Options hash (VER=V4): '69109d17'
Sat Dec 24 11:34:29 2011 us=753987 Expected Remote Options hash (VER=V4): 'c0103fa8'
Sat Dec 24 11:34:29 2011 us=754028 Attempting to establish TCP connection with [AF_INET]109.233.121.102:1723 [nonblock]
Sat Dec 24 11:34:30 2011 us=754261 TCP connection established with [AF_INET]109.233.121.102:1723
Sat Dec 24 11:34:30 2011 us=754388 TCPv4_CLIENT link local: [undef]
Sat Dec 24 11:34:30 2011 us=754425 TCPv4_CLIENT link remote: [AF_INET]109.233.121.102:1723
WRSat Dec 24 11:34:30 2011 us=814143 TLS Error: unknown opcode received from [AF_INET]109.233.121.102:1723 op=0

Log is the same from 11.34 to 11.47 and client is disconnected. Then client connect automatically to VPN... Se log

Sat Dec 24 11:47:19 2011 us=798451 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sat Dec 24 11:47:19 2011 us=798605 Re-using SSL/TLS context
Sat Dec 24 11:47:19 2011 us=798647 LZO compression initialized
Sat Dec 24 11:47:19 2011 us=798766 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Sat Dec 24 11:47:19 2011 us=798874 Socket Buffers: R=[87380->131072] S=[16384->131072]
Sat Dec 24 11:47:19 2011 us=798931 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Dec 24 11:47:19 2011 us=798984 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Sat Dec 24 11:47:19 2011 us=799012 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Sat Dec 24 11:47:19 2011 us=799059 Local Options hash (VER=V4): '69109d17'
Sat Dec 24 11:47:19 2011 us=799101 Expected Remote Options hash (VER=V4): 'c0103fa8'
Sat Dec 24 11:47:19 2011 us=799139 Attempting to establish TCP connection with [AF_INET]109.233.121.102:1723 [nonblock]
Sat Dec 24 11:47:20 2011 us=799352 TCP connection established with [AF_INET]109.233.121.102:1723
Sat Dec 24 11:47:20 2011 us=799471 TCPv4_CLIENT link local: [undef]
Sat Dec 24 11:47:20 2011 us=799508 TCPv4_CLIENT link remote: [AF_INET]109.233.121.102:1723
WRSat Dec 24 11:47:20 2011 us=861876 TLS: Initial packet from [AF_INET]109.233.121.102:1723, sid=f2ab9ca9 d38eb760
WWRWRRRWWRWRWRRWWRWRWRRWWRWRWRRWWRWRWRRWWRWRSat Dec 24 11:47:21 2011 us=947460 VERIFY OK: depth=1, /C=IT/ST=Italy/L=Napoli/O=pezzotto/OU=pezzotto/CN=pezzotto_CA/name=pezzotto_CA/emailAddress=k3v1n.hack@gmail.com
Sat Dec 24 11:47:21 2011 us=948655 VERIFY OK: nsCertType=SERVER
Sat Dec 24 11:47:21 2011 us=948740 VERIFY OK: depth=0, /C=IT/ST=Italy/L=Napoli/O=pezzotto/OU=pezzotto/CN=server/name=server/emailAddress=k3v1n.hack@gmail.com
WRRWWRWRWRRWWWWWRWRRRWWWRWRWRRWWRWRWRRWWRWRWRRWWRWRWRRWWRRRRRRRWWRWRWRRWWRWRWRRWWRWWWWRRRRRRSat Dec 24 11:47:24 2011 us=180425 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Dec 24 11:47:24 2011 us=180532 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Dec 24 11:47:24 2011 us=180678 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Dec 24 11:47:24 2011 us=180743 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
WWSat Dec 24 11:47:24 2011 us=180997 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sat Dec 24 11:47:24 2011 us=181103 [server] Peer Connection Initiated with [AF_INET]109.233.121.102:1723
Sat Dec 24 11:47:26 2011 us=449655 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
WRRRSat Dec 24 11:47:26 2011 us=603926 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Sat Dec 24 11:47:26 2011 us=604050 OPTIONS IMPORT: timers and/or timeouts modified
Sat Dec 24 11:47:26 2011 us=604080 OPTIONS IMPORT: --ifconfig/up options modified
Sat Dec 24 11:47:26 2011 us=604106 OPTIONS IMPORT: route options modified
Sat Dec 24 11:47:26 2011 us=604133 Preserving previous TUN/TAP instance: tun0
Sat Dec 24 11:47:26 2011 us=604161 Initialization Sequence Completed
WWRWRwrWRwrWRwrWRwrWRwrWRwrW

Can ou help me?

Thanks

janjust

errr, so the client first connect at 11:34 , but this fails, then nothing happens until 11:47, at which the client reconnects and then it IS ok? or am I missing something there?

the second connnection log looks fine.

kmitnick

janjust wroteerrr, so the client first connect at 11:34 , but this fails, then nothing happens until 11:47, at which the client reconnects and then it IS ok? or am I missing something there?

yes! it's right

Mimiko

It's seems that something is interfering on the phisical link. If this problem occurs on every client - check the faulty routers on the server connection to the internet. If only on one client - find the faulty router on that client that makes problem.
It's a good idea to upgrade the OpenVPN to the latest version.

kmitnick

Which is router problem? How can I solve it?

In my log:

Tue Dec 27 22:57:54 2011 us=64849 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue Dec 27 22:57:54 2011 us=64987 Re-using SSL/TLS context
Tue Dec 27 22:57:54 2011 us=65055 LZO compression initialized
Tue Dec 27 22:57:54 2011 us=65173 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue Dec 27 22:57:54 2011 us=65252 Socket Buffers: R=[87380->131072] S=[16384->131072]
Tue Dec 27 22:57:54 2011 us=65307 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Dec 27 22:57:54 2011 us=65361 Local Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Tue Dec 27 22:57:54 2011 us=65389 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1544,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Tue Dec 27 22:57:54 2011 us=65435 Local Options hash (VER=V4): '69109d17'
Tue Dec 27 22:57:54 2011 us=65477 Expected Remote Options hash (VER=V4): 'c0103fa8'
Tue Dec 27 22:57:54 2011 us=65517 Attempting to establish TCP connection with [AF_INET]109.233.121.102:1723 [nonblock]
Tue Dec 27 22:57:55 2011 us=65726 TCP connection established with [AF_INET]109.233.121.102:1723
Tue Dec 27 22:57:55 2011 us=65842 TCPv4_CLIENT link local: [undef]
Tue Dec 27 22:57:55 2011 us=65878 TCPv4_CLIENT link remote: [AF_INET]109.233.121.102:1723
WRTue Dec 27 22:57:55 2011 us=127423 TLS Error: unknown opcode received from [AF_INET]109.233.121.102:1723 op=0
Tue Dec 27 22:57:55 2011 us=127524 Fatal TLS error (check_tls_errors_co), restarting
Tue Dec 27 22:57:55 2011 us=127659 TCP/UDP: Closing socket
Tue Dec 27 22:57:55 2011 us=127757 SIGUSR1[soft,tls-error] received, process restarting
Tue Dec 27 22:57:55 2011 us=127818 Restart pause, 5 second(s)

thanks