Ping is ok.
DNS is ok.
Firewall shows nothing specific to the problem.
The problem occurs only when using the vpn. Without the vpn, there's no problem.
In the logs of the server, there's some PID_ERR replay-window backtrack occurred and a lot of MULTI: bad source address from client.
I read a lot about the bad source address from client error and it doesn't make sense to me : it is the IP address of the openvpn client but not the one of the virtual interface associated with the vpn but enp0s3 with the address leased by my local router. Why would some packets end up in the server going through the tun device and the server would see the enp0s3 interface's address ?
I suspected finally a bad integration between NetworkManager and openvpn but it's been working great for almost two years now. Yet I read that importing the configuration via nmcli may eliminate some bug so I did it but to no avail.
It is somehow unusable now...
It's an up to date Debian 11 with Xcfe as desktop environment.
Anyone any idea what's going on and what I should do to diagnostic correctly and fix it ?
Server and client configurations :
Code: Select all
port 1194
proto udp
dev tun
ca ca.crt
cert openvpn_server.crt
dh dh2048.pem
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.8.0.1"
duplicate-cn
keepalive 10 120
tls-crypt ta.key
auth SHA512
tls-version-min 1.3
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA:TLS-DHE-RSA-WITH-AES-128-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA
max-clients 3
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
verb 4
explicit-exit-notify 1
auth-nocache
chroot /etc/openvpn/jail
Code: Select all
client
tls-client
dev tun
proto udp
remote x.x.x 1194 udp4
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
remote-cert-tls server
auth SHA512
user nobody
group nogroup
script-security 2
dhcp-option DNS 10.8.0.1
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf
verb 5
explicit-exit-notify 2
--auth-nocache
