Thanks both!
I try with server-client mode:
server configuration (192.168.1.1/24)
# cat /etc/config/openvpn
config openvpn 'myvpn'
option enabled '1'
option dev 'tun'
option port '1194'
option proto 'udp'
option log '/tmp/openvpn.log'
option verb '3'
option ca '/etc/openvpn/ca.crt'
option cert '/etc/openvpn/my-server.crt'
option key '/etc/openvpn/my-server.key'
option server '10.8.0.0 255.255.255.0'
option ifconfig '10.8.0.1 10.8.0.2'
option dh '/etc/openvpn/dh512.pem'
client configuration (192.168.2.1/24)
# cat /etc/config/openvpn
config openvpn 'myvpn'
option enabled '1'
option dev 'tun'
option proto 'udp'
option log '/tmp/openvpn.log'
option verb '3'
option ca '/etc/openvpn/ca.crt'
option cert '/etc/openvpn/my-client.crt'
option key '/etc/openvpn/my-client.key'
option client '1'
option remote_cert_tls 'server'
option ifconfig '10.8.0.2 10.8.0.1'
option remote 'MYHOST 1194'
This is the server log file:
Mon May 18 14:31:41 2015 OpenVPN 2.3.6 mips-openwrt-linux-gnu [SSL
(OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jan 6 2015
Mon May 18 14:31:41 2015 library versions: OpenSSL 1.0.2a 19 Mar 2015, LZO 2.08
Mon May 18 14:31:41 2015 WARNING: --keepalive option is missing from
server config
Mon May 18 14:31:41 2015 Diffie-Hellman initialized with 512 bit key
Mon May 18 14:31:41 2015 Socket Buffers: R=[163840->131072] S=[163840->131072]
Mon May 18 14:31:41 2015 TUN/TAP device tun0 opened
Mon May 18 14:31:41 2015 TUN/TAP TX queue length set to 100
Mon May 18 14:31:41 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon May 18 14:31:41 2015 /sbin/ifconfig tun0 10.8.0.1 pointopoint
10.8.0.2 mtu 1500
Mon May 18 14:31:41 2015 /sbin/route add -net 10.8.0.0 netmask
255.255.255.0 gw 10.8.0.2
Mon May 18 14:31:41 2015 UDPv4 link local (bound): [undef]
Mon May 18 14:31:41 2015 UDPv4 link remote: [undef]
Mon May 18 14:31:41 2015 MULTI: multi_init called, r=256 v=256
Mon May 18 14:31:41 2015 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Mon May 18 14:31:41 2015 Initialization Sequence Completed
###client connection#####
Mon May 18 14:32:14 2015 85.84.148.223:1194 TLS: Initial packet from
[AF_INET]85.84.148.223:1194, sid=07aaea2a afa2bb55
Mon May 18 14:32:14 2015 85.84.148.223:1194 VERIFY OK: depth=1, C=ES,
ST=Gipuzkoa, L=Zarautz, O=Mitxelena, OU=MYHOST, CN=Mitxelena CA,
name=EasyRSA, emailAddress=MYMAIL
Mon May 18 14:32:14 2015 85.84.148.223:1194 VERIFY OK: depth=0, C=ES,
ST=Gipuzkoa, L=Zarautz, O=Mitxelena, OU=MYHOST, CN=my-client,
name=EasyRSA, emailAddress=MYMAIL
Mon May 18 14:32:14 2015 85.84.148.223:1194 Data Channel Encrypt:
Cipher 'BF-CBC' initialized with 128 bit key
Mon May 18 14:32:14 2015 85.84.148.223:1194 Data Channel Encrypt:
Using 160 bit message hash 'SHA1' for HMAC authentication
Mon May 18 14:32:14 2015 85.84.148.223:1194 Data Channel Decrypt:
Cipher 'BF-CBC' initialized with 128 bit key
Mon May 18 14:32:14 2015 85.84.148.223:1194 Data Channel Decrypt:
Using 160 bit message hash 'SHA1' for HMAC authentication
Mon May 18 14:32:14 2015 85.84.148.223:1194 Control Channel: TLSv1,
cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 512 bit RSA
Mon May 18 14:32:14 2015 85.84.148.223:1194 [my-client] Peer
Connection Initiated with [AF_INET]85.84.148.223:1194
Mon May 18 14:32:14 2015 my-client/85.84.148.223:1194 MULTI_sva: pool
returned IPv4=10.8.0.6, IPv6=(Not enabled)
Mon May 18 14:32:14 2015 my-client/85.84.148.223:1194 MULTI: Learn:
10.8.0.6 -> my-client/85.84.148.223:1194
Mon May 18 14:32:14 2015 my-client/85.84.148.223:1194 MULTI: primary
virtual IP for my-client/85.84.148.223:1194: 10.8.0.6
Mon May 18 14:32:17 2015 my-client/85.84.148.223:1194 PUSH: Received
control message: 'PUSH_REQUEST'
Mon May 18 14:32:17 2015 my-client/85.84.148.223:1194
send_push_reply(): safe_cap=940
Mon May 18 14:32:17 2015 my-client/85.84.148.223:1194 SENT CONTROL
[my-client]: 'PUSH_REPLY,route 10.8.0.1,topology net30,ifconfig
10.8.0.6 10.8.0.5' (status=1)
This is the client log file:
Mon May 18 14:32:14 2015 OpenVPN 2.3.6 mips-openwrt-linux-gnu [SSL
(OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jan 6 2015
Mon May 18 14:32:14 2015 library versions: OpenSSL 1.0.2a 19 Mar 2015, LZO 2.08
Mon May 18 14:32:14 2015 WARNING: using --pull/--client and --ifconfig
together is probably not what you want
Mon May 18 14:32:14 2015 Socket Buffers: R=[163840->131072] S=[163840->131072]
Mon May 18 14:32:14 2015 UDPv4 link local (bound): [undef]
Mon May 18 14:32:14 2015 UDPv4 link remote: [AF_INET]85.86.X.X:1194
Mon May 18 14:32:14 2015 TLS: Initial packet from
[AF_INET]85.86.X.X:1194, sid=e6644868 82fc1c45
Mon May 18 14:32:14 2015 VERIFY OK: depth=1, C=ES, ST=Gipuzkoa,
L=Zarautz, O=Mitxelena, OU=MYHOST, CN=Mitxelena CA, name=EasyRSA,
emailAddress=MYMAIL
Mon May 18 14:32:14 2015 Validating certificate key usage
Mon May 18 14:32:14 2015 ++ Certificate has key usage 00a0, expects 00a0
Mon May 18 14:32:14 2015 VERIFY KU OK
Mon May 18 14:32:14 2015 Validating certificate extended key usage
Mon May 18 14:32:14 2015 ++ Certificate has EKU (str) TLS Web Server
Authentication, expects TLS Web Server Authentication
Mon May 18 14:32:14 2015 VERIFY EKU OK
Mon May 18 14:32:14 2015 VERIFY OK: depth=0, C=ES, ST=Gipuzkoa,
L=Zarautz, O=Mitxelena, OU=MYHOST, CN=my-server, name=EasyRSA,
emailAddress=MYMAIL
Mon May 18 14:32:14 2015 Data Channel Encrypt: Cipher 'BF-CBC'
initialized with 128 bit key
Mon May 18 14:32:14 2015 Data Channel Encrypt: Using 160 bit message
hash 'SHA1' for HMAC authentication
Mon May 18 14:32:14 2015 Data Channel Decrypt: Cipher 'BF-CBC'
initialized with 128 bit key
Mon May 18 14:32:14 2015 Data Channel Decrypt: Using 160 bit message
hash 'SHA1' for HMAC authentication
Mon May 18 14:32:14 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3
DHE-RSA-AES256-SHA, 512 bit RSA
Mon May 18 14:32:14 2015 [my-server] Peer Connection Initiated with
[AF_INET]85.86.X.X:1194
Mon May 18 14:32:17 2015 SENT CONTROL [my-server]: 'PUSH_REQUEST' (status=1)
Mon May 18 14:32:17 2015 PUSH: Received control message:
'PUSH_REPLY,route 10.8.0.1,topology net30,ifconfig 10.8.0.6 10.8.0.5'
Mon May 18 14:32:17 2015 OPTIONS IMPORT: --ifconfig/up options modified
Mon May 18 14:32:17 2015 OPTIONS IMPORT: route options modified
Mon May 18 14:32:17 2015 TUN/TAP device tun0 opened
Mon May 18 14:32:17 2015 TUN/TAP TX queue length set to 100
Mon May 18 14:32:17 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon May 18 14:32:17 2015 /sbin/ifconfig tun0 10.8.0.6 pointopoint
10.8.0.5 mtu 1500
Mon May 18 14:32:17 2015 /sbin/route add -net 10.8.0.1 netmask
255.255.255.255 gw 10.8.0.5
Mon May 18 14:32:17 2015 Initialization Sequence Completed
The problem is that in the client side the IPs are not well. This is
server tun0 interface:
# ifconfig tun0
tun0 Link encap:UNSPEC HWaddr
00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
This is in the client side:
# ifconfig tun0
tun0 Link encap:UNSPEC HWaddr
00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.6 P-t-P:10.8.0.5 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
I am missing something?
Thanks you the great support.
Best regards.
--
Josu Lazkano
------------------------------------------------------------------------------
One dashboard for servers and applications across Physical-Virtual-Cloud
Widest out-of-the-box monitoring support with 50+ applications
Performance metrics, stats and reports that give you Actionable Insights
Deep dive visibility with transaction tracing using APM Insight.
http://ad.doubleclick.net/ddm/clk/290420510;117567292;y
_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users
