I did a fresh install of Ubuntu 11.10. I installed openvpn with my old .conf files which were working before. The point of this script is to route my internet traffic from my laptop through my server so that I can browse securly over unsecure wireless networks. Ths script connects to the server and once connected I can ssh into the server @ 10.31.33.1. The problem is that I lose all internet access on the client once the connection is complete. I am guessing that this has something to do with the "ERROR: Linux route add command failed:" in the connection output below. Does anyone have any thoughts on how to fix this?
Thanks,
Chris
Client config file.
client
proto udp
dev tun
remote server.server.com 1194
float
nobind
ca /etc/openvpn/2.0/keys/ca.crt
cert /etc/openvpn/2.0/keys/cl.crt
key /etc/openvpn/2.0/keys/cl.key
ns-cert-type server
tls-auth /etc/openvpn/2.0/keys/ta.key 1
cipher BF-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
redirect-gateway def1 bypass-dhcp
mute-replay-warnings
verb 3
mute 20
Running The client config file with this command.
sudo openvpn --config /etc/openvpn/safe.conf
Results in this output. Note the error near the bottom. (BTW, I've changed my external IP's to XXX.XXX.XXX.XXX for privacy.)
cl@shibby-shibby:/etc/openvpn$ sudo openvpn --config /etc/openvpn/safe.conf
Tue Jan 31 09:32:40 2012 OpenVPN 2.2.0 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Jul 4 2011
Tue Jan 31 09:32:40 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Enter Private Key Password:
Tue Jan 31 09:32:44 2012 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Jan 31 09:32:44 2012 Control Channel Authentication: using '/etc/openvpn/2.0/keys/ta.key' as a OpenVPN static key file
Tue Jan 31 09:32:44 2012 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jan 31 09:32:44 2012 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jan 31 09:32:44 2012 LZO compression initialized
Tue Jan 31 09:32:44 2012 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Jan 31 09:32:44 2012 Socket Buffers: R=[126976->131072] S=[126976->131072]
Tue Jan 31 09:32:44 2012 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Jan 31 09:32:44 2012 Local Options hash (VER=V4): '504e774e'
Tue Jan 31 09:32:44 2012 Expected Remote Options hash (VER=V4): '14168603'
Tue Jan 31 09:32:44 2012 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Tue Jan 31 09:32:44 2012 UDPv4 link local: [undef]
Tue Jan 31 09:32:44 2012 UDPv4 link remote: [AF_INET]XXX.XXX.XXX.XXX:1194
Tue Jan 31 09:32:44 2012 TLS: Initial packet from [AF_INET]XXX.XXX.XXX.XXX:1194, sid=db44f9c5 fa9919a3
Tue Jan 31 09:32:44 2012 VERIFY OK: depth=1, /C=CA/ST=AB/L=Sky/O=boldlygoingnowhere/CN=boldlygoingnowhere_CA/emailAddress=blablabla@blabla.com
Tue Jan 31 09:32:44 2012 VERIFY OK: nsCertType=SERVER
Tue Jan 31 09:32:44 2012 VERIFY OK: depth=0, /C=CA/ST=AB/L=Sky/O=boldlygoingnowhere/CN=server/emailAddress=blablabla@blabla.com
Tue Jan 31 09:32:44 2012 Replay-window backtrack occurred [2]
Tue Jan 31 09:32:45 2012 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jan 31 09:32:45 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jan 31 09:32:45 2012 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jan 31 09:32:45 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jan 31 09:32:45 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Jan 31 09:32:45 2012 [server] Peer Connection Initiated with [AF_INET]XXX.XXX.XXX.XXX:1194
Tue Jan 31 09:32:47 2012 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue Jan 31 09:32:47 2012 PUSH: Received control message: 'PUSH_REPLY,route 10.31.33.1,topology net30,ping 10,ping-restart 120,ifconfig 10.31.33.6 10.31.33.5'
Tue Jan 31 09:32:47 2012 OPTIONS IMPORT: timers and/or timeouts modified
Tue Jan 31 09:32:47 2012 OPTIONS IMPORT: --ifconfig/up options modified
Tue Jan 31 09:32:47 2012 OPTIONS IMPORT: route options modified
Tue Jan 31 09:32:47 2012 ROUTE default_gateway=192.168.77.1
Tue Jan 31 09:32:47 2012 TUN/TAP device tun0 opened
Tue Jan 31 09:32:47 2012 TUN/TAP TX queue length set to 100
Tue Jan 31 09:32:47 2012 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Jan 31 09:32:47 2012 /sbin/ifconfig tun0 10.31.33.6 pointopoint 10.31.33.5 mtu 1500
Tue Jan 31 09:32:47 2012 /sbin/route add -net XXX.XXX.XXX.XXX netmask 255.255.255.255 gw 192.168.77.1
SIOCADDRT: File exists
Tue Jan 31 09:32:47 2012 ERROR: Linux route add command failed: external program exited with error status: 7
Tue Jan 31 09:32:47 2012 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.31.33.5
Tue Jan 31 09:32:47 2012 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.31.33.5
Tue Jan 31 09:32:47 2012 /sbin/route add -net 10.31.33.1 netmask 255.255.255.255 gw 10.31.33.5
Tue Jan 31 09:32:47 2012 GID set to nogroup
Tue Jan 31 09:32:47 2012 UID set to nobody
Tue Jan 31 09:32:47 2012 Initialization Sequence Completed
