On 18/05/15 15:29, Josu Lazkano wrote: > Thanks both! > > I try with server-client mode: > > server configuration (192.168.1.1/24) > > # cat /etc/config/openvpn > > config openvpn 'myvpn' > option enabled '1' > option dev 'tun' > option port '1194' > option proto 'udp' > option log '/tmp/openvpn.log' > option verb '3' > option ca '/etc/openvpn/ca.crt' > option cert '/etc/openvpn/my-server.crt' > option key '/etc/openvpn/my-server.key' > option server '10.8.0.0 255.255.255.0' > option ifconfig '10.8.0.1 10.8.0.2' > option dh '/etc/openvpn/dh512.pem' > > client configuration (192.168.2.1/24) > > # cat /etc/config/openvpn > > config openvpn 'myvpn' > option enabled '1' > option dev 'tun' > option proto 'udp' > option log '/tmp/openvpn.log' > option verb '3' > option ca '/etc/openvpn/ca.crt' > option cert '/etc/openvpn/my-client.crt' > option key '/etc/openvpn/my-client.key' > option client '1' > option remote_cert_tls 'server' > option ifconfig '10.8.0.2 10.8.0.1' > option remote 'MYHOST 1194' > > This is the server log file: > > Mon May 18 14:31:41 2015 OpenVPN 2.3.6 mips-openwrt-linux-gnu [SSL > (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jan 6 2015 > Mon May 18 14:31:41 2015 library versions: OpenSSL 1.0.2a 19 Mar 2015, LZO > 2.08 > Mon May 18 14:31:41 2015 WARNING: --keepalive option is missing from > server config > Mon May 18 14:31:41 2015 Diffie-Hellman initialized with 512 bit key > Mon May 18 14:31:41 2015 Socket Buffers: R=[163840->131072] S=[163840->131072] > Mon May 18 14:31:41 2015 TUN/TAP device tun0 opened > Mon May 18 14:31:41 2015 TUN/TAP TX queue length set to 100 > Mon May 18 14:31:41 2015 do_ifconfig, tt->ipv6=0, > tt->did_ifconfig_ipv6_setup=0 > Mon May 18 14:31:41 2015 /sbin/ifconfig tun0 10.8.0.1 pointopoint > 10.8.0.2 mtu 1500 > Mon May 18 14:31:41 2015 /sbin/route add -net 10.8.0.0 netmask > 255.255.255.0 gw 10.8.0.2 > Mon May 18 14:31:41 2015 UDPv4 link local (bound): [undef] > Mon May 18 14:31:41 2015 UDPv4 link remote: [undef] > Mon May 18 14:31:41 2015 MULTI: multi_init called, r=256 v=256 > Mon May 18 14:31:41 2015 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0 > Mon May 18 14:31:41 2015 Initialization Sequence Completed > ###client connection##### > Mon May 18 14:32:14 2015 85.84.148.223:1194 TLS: Initial packet from > [AF_INET]85.84.148.223:1194, sid=07aaea2a afa2bb55 > Mon May 18 14:32:14 2015 85.84.148.223:1194 VERIFY OK: depth=1, C=ES, > ST=Gipuzkoa, L=Zarautz, O=Mitxelena, OU=MYHOST, CN=Mitxelena CA, > name=EasyRSA, emailAddress=MYMAIL > Mon May 18 14:32:14 2015 85.84.148.223:1194 VERIFY OK: depth=0, C=ES, > ST=Gipuzkoa, L=Zarautz, O=Mitxelena, OU=MYHOST, CN=my-client, > name=EasyRSA, emailAddress=MYMAIL > Mon May 18 14:32:14 2015 85.84.148.223:1194 Data Channel Encrypt: > Cipher 'BF-CBC' initialized with 128 bit key > Mon May 18 14:32:14 2015 85.84.148.223:1194 Data Channel Encrypt: > Using 160 bit message hash 'SHA1' for HMAC authentication > Mon May 18 14:32:14 2015 85.84.148.223:1194 Data Channel Decrypt: > Cipher 'BF-CBC' initialized with 128 bit key > Mon May 18 14:32:14 2015 85.84.148.223:1194 Data Channel Decrypt: > Using 160 bit message hash 'SHA1' for HMAC authentication > Mon May 18 14:32:14 2015 85.84.148.223:1194 Control Channel: TLSv1, > cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 512 bit RSA > Mon May 18 14:32:14 2015 85.84.148.223:1194 [my-client] Peer > Connection Initiated with [AF_INET]85.84.148.223:1194 > Mon May 18 14:32:14 2015 my-client/85.84.148.223:1194 MULTI_sva: pool > returned IPv4=10.8.0.6, IPv6=(Not enabled) > Mon May 18 14:32:14 2015 my-client/85.84.148.223:1194 MULTI: Learn: > 10.8.0.6 -> my-client/85.84.148.223:1194 > Mon May 18 14:32:14 2015 my-client/85.84.148.223:1194 MULTI: primary > virtual IP for my-client/85.84.148.223:1194: 10.8.0.6 > Mon May 18 14:32:17 2015 my-client/85.84.148.223:1194 PUSH: Received > control message: 'PUSH_REQUEST' > Mon May 18 14:32:17 2015 my-client/85.84.148.223:1194 > send_push_reply(): safe_cap=940 > Mon May 18 14:32:17 2015 my-client/85.84.148.223:1194 SENT CONTROL > [my-client]: 'PUSH_REPLY,route 10.8.0.1,topology net30,ifconfig > 10.8.0.6 10.8.0.5' (status=1) > > This is the client log file: > > Mon May 18 14:32:14 2015 OpenVPN 2.3.6 mips-openwrt-linux-gnu [SSL > (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jan 6 2015 > Mon May 18 14:32:14 2015 library versions: OpenSSL 1.0.2a 19 Mar 2015, LZO > 2.08 > Mon May 18 14:32:14 2015 WARNING: using --pull/--client and --ifconfig > together is probably not what you want > Mon May 18 14:32:14 2015 Socket Buffers: R=[163840->131072] S=[163840->131072] > Mon May 18 14:32:14 2015 UDPv4 link local (bound): [undef] > Mon May 18 14:32:14 2015 UDPv4 link remote: [AF_INET]85.86.X.X:1194 > Mon May 18 14:32:14 2015 TLS: Initial packet from > [AF_INET]85.86.X.X:1194, sid=e6644868 82fc1c45 > Mon May 18 14:32:14 2015 VERIFY OK: depth=1, C=ES, ST=Gipuzkoa, > L=Zarautz, O=Mitxelena, OU=MYHOST, CN=Mitxelena CA, name=EasyRSA, > emailAddress=MYMAIL > Mon May 18 14:32:14 2015 Validating certificate key usage > Mon May 18 14:32:14 2015 ++ Certificate has key usage 00a0, expects 00a0 > Mon May 18 14:32:14 2015 VERIFY KU OK > Mon May 18 14:32:14 2015 Validating certificate extended key usage > Mon May 18 14:32:14 2015 ++ Certificate has EKU (str) TLS Web Server > Authentication, expects TLS Web Server Authentication > Mon May 18 14:32:14 2015 VERIFY EKU OK > Mon May 18 14:32:14 2015 VERIFY OK: depth=0, C=ES, ST=Gipuzkoa, > L=Zarautz, O=Mitxelena, OU=MYHOST, CN=my-server, name=EasyRSA, > emailAddress=MYMAIL > Mon May 18 14:32:14 2015 Data Channel Encrypt: Cipher 'BF-CBC' > initialized with 128 bit key > Mon May 18 14:32:14 2015 Data Channel Encrypt: Using 160 bit message > hash 'SHA1' for HMAC authentication > Mon May 18 14:32:14 2015 Data Channel Decrypt: Cipher 'BF-CBC' > initialized with 128 bit key > Mon May 18 14:32:14 2015 Data Channel Decrypt: Using 160 bit message > hash 'SHA1' for HMAC authentication > Mon May 18 14:32:14 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 > DHE-RSA-AES256-SHA, 512 bit RSA > Mon May 18 14:32:14 2015 [my-server] Peer Connection Initiated with > [AF_INET]85.86.X.X:1194 > Mon May 18 14:32:17 2015 SENT CONTROL [my-server]: 'PUSH_REQUEST' (status=1) > Mon May 18 14:32:17 2015 PUSH: Received control message: > 'PUSH_REPLY,route 10.8.0.1,topology net30,ifconfig 10.8.0.6 10.8.0.5' > Mon May 18 14:32:17 2015 OPTIONS IMPORT: --ifconfig/up options modified > Mon May 18 14:32:17 2015 OPTIONS IMPORT: route options modified > Mon May 18 14:32:17 2015 TUN/TAP device tun0 opened > Mon May 18 14:32:17 2015 TUN/TAP TX queue length set to 100 > Mon May 18 14:32:17 2015 do_ifconfig, tt->ipv6=0, > tt->did_ifconfig_ipv6_setup=0 > Mon May 18 14:32:17 2015 /sbin/ifconfig tun0 10.8.0.6 pointopoint > 10.8.0.5 mtu 1500 > Mon May 18 14:32:17 2015 /sbin/route add -net 10.8.0.1 netmask > 255.255.255.255 gw 10.8.0.5 > Mon May 18 14:32:17 2015 Initialization Sequence Completed > > The problem is that in the client side the IPs are not well. This is > server tun0 interface: > > # ifconfig tun0 > tun0 Link encap:UNSPEC HWaddr > 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 > inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255 > UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 > RX packets:0 errors:0 dropped:0 overruns:0 frame:0 > TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:100 > RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) > > This is in the client side: > > # ifconfig tun0 > tun0 Link encap:UNSPEC HWaddr > 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 > inet addr:10.8.0.6 P-t-P:10.8.0.5 Mask:255.255.255.255 > UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 > RX packets:0 errors:0 dropped:0 overruns:0 frame:0 > TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:100 > RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) > > I am missing something? > > in a 'default' setup this is exactly what you're supposed to see :) don't try to ping the 10.8.0.5 interface, ping the 10.8.0.1 interface instead. If you can reach that address then your VPN is functioning.
HTH, JJK ------------------------------------------------------------------------------ One dashboard for servers and applications across Physical-Virtual-Cloud Widest out-of-the-box monitoring support with 50+ applications Performance metrics, stats and reports that give you Actionable Insights Deep dive visibility with transaction tracing using APM Insight. http://ad.doubleclick.net/ddm/clk/290420510;117567292;y _______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users
