URL: https://www.opennet.me/cgi-bin/openforum/vsluhboard.cgi
Форум: vsluhforumID1
Нить номер: 94708
[ Назад ]
Исходное сообщение
"Помогите с OpenVPN"
Отправлено Exploit , 30-Май-13 12:52 
Добрый день. Прошу вашей помощи в первоначальном запуске OpenVPN.
Система Centos 6.4, OpenVPN 2.3.1
При установке опирался на мануал http://bozza.ru/art-130.html
Все сертификаты сгенерированы и рассованы по нужным папкам.
OpenVPN запускается нормально, ни на что не ругается.
При попытке подключения (OpenVPN client for Windows) в логе подключения не появляется ничего, просто выдаётся сообщение о невожможности подключения к серверу.
Заранее благодарен за помощь. От здравой критики конфигов тоже не откажусь :)
Необходимые конфиги прилагаю.

###server.conf
port 1194
proto udp
dev tun
ca "/etc/openvpn/keys/ca.crt"
cert "/etc/openvpn/keys/server.crt"
key "/etc/openvpn/keys/server.key" # Этот файл хранить в секрете!
dh "/etc/openvpn/keys/dh2048.pem"
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist "/etc/openvpn/config/ipp.txt"
push "route 192.168.10.0 255.255.255.0"
route 192.168.10.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
client-to-client
keepalive 10 120
tls-server
tls-auth "/etc/openvpn/keys/ta.key" 0
tls-timeout 120
auth MD5
cipher BF-CBC        # Blowfish (default)
comp-lzo
max-clients 10
persist-key
persist-tun
status "/etc/openvpn/log/openvpn-status.log"
log "/etc/openvpn/log/openvpn.log"
log-append "/etc/openvpn/log/openvpn.log"
verb 3

###iptables
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A FORWARD -p icmp -m comment -j ACCEPT --comment "allow icmp to WAN"
-A FORWARD -i eth0 -o tun0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i tun0 -o eth0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -j ACCEPT
-A FORWARD -p tcp -m multiport -d 195.122.229.16 -j ACCEPT --dports 8088,8089
-A FORWARD -p tcp -m multiport -s 195.122.229.16 -j ACCEPT --dports 8088,8089
-A FORWARD -p udp ! -d 192.168.10.2 --dport 53 -j REJECT --reject-with icmp-host-unreachable
-A FORWARD -s 192.168.10.244/31 -j ACCEPT
-A FORWARD -p tcp -m comment --dport 8005 -j ACCEPT --comment online-radio
-A FORWARD -m state -m comment --state ESTABLISHED,RELATED -j ACCEPT --comment "Allow established connections"
-A FORWARD -p tcp -m state -m comment --dport 21 --sport 1024:65535 --state NEW -j ACCEPT --comment "FTP new connection"
-A FORWARD -p tcp -m state -m comment -s 192.168.10.100 --dport 9443 --state NEW -j ACCEPT --comment "SberBank Client Veronika"
-A FORWARD -p tcp -m tcp -m multiport -m comment -j ACCEPT --dports 25,80,110,143,443,587,993,995,3389:3392,8989 --comment "MAIL, HTTP(DVR), HTTPS, RDP, DVR"
-A FORWARD -p udp -m udp -m comment --dport 8989 -j ACCEPT --comment "DVR"
-A FORWARD -p tcp -m tcp -m multiport -m comment -j ACCEPT --sports 25,80,110,143,443,587,993,995,3389:3392,8989 --comment "MAIL, HTTP(DVR), HTTPS, RDP, DVR"
-A FORWARD -p udp -m udp -m comment --sport 8989 -j ACCEPT --comment "DVR"
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i eth1 -p udp --dport 1194 -j ACCEPT
-A INPUT -i tun0 -j ACCEPT
-A INPUT -p icmp -m comment -j ACCEPT --comment "Allow icmp to proxy"
-A INPUT -m comment -i lo -j ACCEPT --comment "Allow input from localhost"
-A INPUT -p tcp --dport 21 -m state --state NEW -j ACCEPT
-A INPUT -p tcp --dport 60000:65000 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp -m multiport -m state -m comment --state NEW -j ACCEPT --dports 22,10000 --comment "SSH, Webmin"
-A INPUT -p tcp -m multiport -m comment -s 192.168.10.0/24 -j ACCEPT --dports 80,3128,3306 --comment "Wordpress, Squid, MySQL"
-A INPUT -p udp -m multiport -m comment -s 192.168.10.0/24 -j ACCEPT --dports 53 --comment "BIND"
-A INPUT -p tcp -m multiport -m comment -s 192.168.10.1 -j ACCEPT --dports 53,953 --comment "BIND Sync & Control"
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
*mangle
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -p tcp -m tcp -m multiport -s 192.168.10.0/24 ! -d 192.168.10.2 --dports 80,8000,8080,8081,8082 -j DNAT --to-destination 192.168.10.2:3128 -m comment --comment "to squid"
-A PREROUTING -p tcp -m tcp -m multiport -i tun0 ! -d 192.168.10.2 --dports 80,8000,8080,8081,8082 -j DNAT --to-destination 192.168.10.2:3128 -m comment --comment "to squid"
-A POSTROUTING -s 192.168.10.0/24 -o eth1 -j SNAT --to WAN IP -m comment --comment NAT
-A PREROUTING -p tcp -m tcp -d WAN IP --dport 3390 -j DNAT --to-destination 192.168.10.1:3389 -m comment --comment AD
-A PREROUTING -p tcp -m tcp -d WAN IP --dport 3391 -j DNAT --to-destination 192.168.10.4:3389 -m comment --comment 1C
-A PREROUTING -p tcp -m tcp -d WAN IP --dport 3400 -j DNAT --to-destination 192.168.10.82:3389 -m comment --comment MINE
-A PREROUTING -p tcp -m tcp -d WAN IP --dport 3392 -j DNAT --to-destination 192.168.10.234:3389 -m comment --comment TillyPad
-A PREROUTING -p tcp -m tcp -d WAN IP --dport 8989 -j DNAT --to-destination 192.168.10.60:80 -m comment --comment DVR
COMMIT

###ifconfig
eth0      Link encap:Ethernet  HWaddr 50:E5:49:C7:9E:60
          inet addr:192.168.10.2  Bcast:192.168.10.255  Mask:255.255.255.0
          inet6 addr: fe80::52e5:49ff:fec7:9e60/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:208324935 errors:0 dropped:0 overruns:0 frame:0
          TX packets:255568258 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:4074832290 (3.7 GiB)  TX bytes:2366163449 (2.2 GiB)

eth1      Link encap:Ethernet  HWaddr F8:D1:11:03:12:B8
          inet addr:WAN IP  Bcast:255.255.255.255  Mask:255.255.255.248
          inet6 addr: fe80::fad1:11ff:fe03:12b8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:328727448 errors:0 dropped:0 overruns:0 frame:0
          TX packets:219805081 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:1644180648 (1.5 GiB)  TX bytes:843322414 (804.2 MiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:5731771 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5731771 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:716881079 (683.6 MiB)  TX bytes:716881079 (683.6 MiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.1  Mask:255.255.255.0
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)


###lsof -i udp:1194
COMMAND   PID USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
openvpn 11906 root    4u  IPv4 46562123      0t0  UDP *:openvpn

###client1.ovpn (openvpn for windows)
#client
dev tun
proto udp
remote WAN IP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\OpenVPN\\config\\client1.crt"
key "C:\\Program Files\\OpenVPN\\config\\client1.key"
tls-client
tls-auth "C:\\Program Files\\OpenVPN\\config\\ta.key" 1
auth MD5
ns-cert-type server
comp-lzo
verb 3

Содержание
Сообщения в этом обсуждении
"Помогите с OpenVPN"
Отправлено reader , 30-Май-13 13:21 
в логах сервера что, пакетики до него то добрались?
"Помогите с OpenVPN"
Отправлено Exploit , 30-Май-13 14:17 
> в логах сервера что, пакетики до него то добрались?

В логах ничего, слушал tcpdump'ом - ничего не приходит. Менял протокол на tcp (в openvpn, openvpn client и в iptables соответственно) - та же история. в логах openvpn ничего о пришедших пакетах, tcpdump тоже не увидел ничего пришедшего по tcp на порт 1194. Что я делаю не так? или может где-то у провайдера косяк?

"Помогите с OpenVPN"
Отправлено reader , 30-Май-13 14:26 
>> в логах сервера что, пакетики до него то добрались?
> В логах ничего, слушал tcpdump'ом - ничего не приходит. Менял протокол на
> tcp (в openvpn, openvpn client и в iptables соответственно) - та
> же история. в логах openvpn ничего о пришедших пакетах, tcpdump тоже
> не увидел ничего пришедшего по tcp на порт 1194. Что я
> делаю не так? или может где-то у провайдера косяк?

уверены что с клиента пакеты ушли?
попробуйте другие порты. пока tcpdump не покажет входящие дальше нет смысла дергаться

"Помогите с OpenVPN"
Отправлено Exploit , 30-Май-13 18:05 
>>> в логах сервера что, пакетики до него то добрались?
>> В логах ничего, слушал tcpdump'ом - ничего не приходит. Менял протокол на
>> tcp (в openvpn, openvpn client и в iptables соответственно) - та
>> же история. в логах openvpn ничего о пришедших пакетах, tcpdump тоже
>> не увидел ничего пришедшего по tcp на порт 1194. Что я
>> делаю не так? или может где-то у провайдера косяк?
> уверены что с клиента пакеты ушли?
> попробуйте другие порты. пока tcpdump не покажет входящие дальше нет смысла дергаться

Нашёл проблему в конфиге клиента.
Вот с таким конфигом начинаются какие-то телодвижения
client
dev tun
proto tcp
remote WAN IP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
tls-auth ta.key 1
cipher BF-CBC
comp-lzo
verb 3

Но при попытке соединения выдаётся ошибка TLS
###кусок openvpn.log
Thu May 30 17:45:00 2013 TCP connection established with [AF_INET]37.78.170.34:49207
Thu May 30 17:45:00 2013 37.78.170.34:49207 TLS: Initial packet from [AF_INET]37.78.170.34:49207, sid=70f685a6 6b599ce0
Thu May 30 17:45:00 2013 37.78.170.34:49207 Authenticate/Decrypt packet error: packet HMAC authentication failed
Thu May 30 17:45:00 2013 37.78.170.34:49207 TLS Error: incoming packet authentication failed from [AF_INET]37.78.170.34:49207
Thu May 30 17:45:00 2013 37.78.170.34:49207 Fatal TLS error (check_tls_errors_co), restarting
Thu May 30 17:45:00 2013 37.78.170.34:49207 SIGUSR1[soft,tls-error] received, client-instance restarting

###лог клиента при подключении
Thu May 30 18:03:27 2013 OpenVPN 2.3.1 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Mar 28 2013
Thu May 30 18:03:27 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25341
Thu May 30 18:03:27 2013 Need hold release from management interface, waiting...
Thu May 30 18:03:27 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25341
Thu May 30 18:03:27 2013 MANAGEMENT: CMD 'state on'
Thu May 30 18:03:27 2013 MANAGEMENT: CMD 'log all on'
Thu May 30 18:03:27 2013 MANAGEMENT: CMD 'hold off'
Thu May 30 18:03:27 2013 MANAGEMENT: CMD 'hold release'
Thu May 30 18:03:27 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu May 30 18:03:30 2013 MANAGEMENT: CMD 'password [...]'
Thu May 30 18:03:30 2013 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu May 30 18:03:30 2013 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Thu May 30 18:03:30 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May 30 18:03:30 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu May 30 18:03:30 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu May 30 18:03:30 2013 Attempting to establish TCP connection with [AF_INET]WAN IP:1194
Thu May 30 18:03:30 2013 MANAGEMENT: >STATE:1369922610,TCP_CONNECT,,,
Thu May 30 18:03:30 2013 TCP connection established with [AF_INET]WAN IP:1194
Thu May 30 18:03:30 2013 TCPv4_CLIENT link local: [undef]
Thu May 30 18:03:30 2013 TCPv4_CLIENT link remote: [AF_INET]WAN IP:1194
Thu May 30 18:03:30 2013 MANAGEMENT: >STATE:1369922610,WAIT,,,
Thu May 30 18:03:30 2013 Connection reset, restarting [0]
Thu May 30 18:03:30 2013 SIGUSR1[soft,connection-reset] received, process restarting
Thu May 30 18:03:30 2013 MANAGEMENT: >STATE:1369922610,RECONNECTING,connection-reset,,
Thu May 30 18:03:30 2013 Restart pause, 5 second(s)
Сертификаты и ключи вроде расфасованы по папкам как надо. что ему не хватает?

"Помогите с OpenVPN"
Отправлено ALex_hha , 30-Май-13 18:50 
Версия windows?
"Помогите с OpenVPN"
Отправлено Exploit , 30-Май-13 19:15 
> Версия windows?

Windows 7 x64 SP1
OpenVPN Client тоже x64

"Помогите с OpenVPN"
Отправлено ALex_hha , 30-Май-13 23:50 
>> Версия windows?
> Windows 7 x64 SP1
> OpenVPN Client тоже x64

запускается от Администратора?

"Помогите с OpenVPN"
Отправлено Exploit , 31-Май-13 08:17 
>>> Версия windows?
>> Windows 7 x64 SP1
>> OpenVPN Client тоже x64
> запускается от Администратора?

Да.

"Помогите с OpenVPN"
Отправлено reader , 31-Май-13 10:43 
>>>> Версия windows?
>>> Windows 7 x64 SP1
>>> OpenVPN Client тоже x64
>> запускается от Администратора?
> Да.

может попробовать auth SHA1 вместо MD5.
и у клиента тоже прописать

"Помогите с OpenVPN"
Отправлено Exploit , 07-Июн-13 20:26 
>>>>> Версия windows?
>>>> Windows 7 x64 SP1
>>>> OpenVPN Client тоже x64
>>> запускается от Администратора?
>> Да.
> может попробовать auth SHA1 вместо MD5.
> и у клиента тоже прописать

Помогло!!! Премного благодарен!

"Помогите с OpenVPN"
Отправлено h0per , 27-Фев-15 13:18 
>> может попробовать auth SHA1 вместо MD5.
>> и у клиента тоже прописать
> Помогло!!! Премного благодарен!

У меня такие же симптомы, но нет TLS_AUTH.
Конект падает на этом
Thu May 30 18:03:30 2013 MANAGEMENT: >STATE:1369922610,WAIT,,,
Thu May 30 18:03:30 2013 Connection reset, restarting [0]

Если я к локалке конекчусь не из локалки, а по 3G (любой открытый доступ), то все проходит и далее следует за WAIT это
MANAGEMENT: >STATE:1363143403,AUTH

Что на этом моменте происходит? Какая то авторизация?!

Клинент:
client
remote WWW.ru 1194
proto tcp
dev tun
ca   "C:\\OpenVPN\\easy-rsa\\keys\\omvvpn-ca.crt"
cert "C:\\OpenVPN\\easy-rsa\\keys\\omvvpn-client.crt"
key  "C:\\OpenVPN\\easy-rsa\\keys\\omvvpn-client.key"
ns-cert-type server
comp-lzo
;auth-user-pass
persist-key
persist-tun
nobind
resolv-retry infinite
verb 3
mute 10

Сервер

proto tcp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key # This file should be kept secret
dh /etc/openvpn/keys/dh2048.pem

server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
client-to-client
keepalive 10 120
;comp-lzo

user nobody
group nogroup

persist-key
persist-tun

status openvpn-status.log
log /var/log/openvpn.log
verb 7
mute 10
crl-verify /etc/openvpn/keys/crl.pem

При использовании настроек

Клиент

remote WWW.ru
dev tap
secret "C:\\OpenVPN\\easy-rsa\\keys\\ovpn.key"
port 443
proto tcp-client
resolv-retry infinite
verb 3
route-gateway 192.168.10.1


Сервер:

daemon
proto tcp-server
port 443
dev tap21
keepalive 15 60
verb 3
secret static.key
status-version 2
status status

Канал поднимается


Вот лог клиента неудачного конекта

Fri Feb 27 12:12:46 2015 us=971500 Current Parameter Settings:
Fri Feb 27 12:12:46 2015 us=971500   config = 'client.ovpn'
Fri Feb 27 12:12:46 2015 us=971500   mode = 0
Fri Feb 27 12:12:46 2015 us=971500   show_ciphers = DISABLED
Fri Feb 27 12:12:46 2015 us=971500   show_digests = DISABLED
Fri Feb 27 12:12:46 2015 us=971500   show_engines = DISABLED
Fri Feb 27 12:12:46 2015 us=971500   genkey = DISABLED
Fri Feb 27 12:12:46 2015 us=971500   key_pass_file = '[UNDEF]'
Fri Feb 27 12:12:46 2015 us=971500   show_tls_ciphers = DISABLED
Fri Feb 27 12:12:46 2015 us=971500 Connection profiles [default]:
Fri Feb 27 12:12:46 2015 us=971500 NOTE: --mute triggered...
Fri Feb 27 12:12:46 2015 us=971500 275 variation(s) on previous 10 message(s) suppressed by --mute
Fri Feb 27 12:12:46 2015 us=971500 OpenVPN 2.3.6 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec  1 2014
Fri Feb 27 12:12:46 2015 us=971500 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Enter Management Password:
Fri Feb 27 12:12:46 2015 us=971500 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Fri Feb 27 12:12:46 2015 us=971500 Need hold release from management interface, waiting...
Fri Feb 27 12:12:47 2015 us=174625 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Fri Feb 27 12:12:47 2015 us=284000 MANAGEMENT: CMD 'state on'
Fri Feb 27 12:12:47 2015 us=284000 MANAGEMENT: CMD 'log all on'
Fri Feb 27 12:12:47 2015 us=346500 MANAGEMENT: CMD 'hold off'
Fri Feb 27 12:12:47 2015 us=346500 MANAGEMENT: CMD 'hold release'
Fri Feb 27 12:12:47 2015 us=768375 Control Channel MTU parms [ L:1543 D:140 EF:40 EB:0 ET:0 EL:0 ]
Fri Feb 27 12:12:47 2015 us=768375 Socket Buffers: R=[8192->8192] S=[8192->8192]
Fri Feb 27 12:12:47 2015 us=768375 MANAGEMENT: >STATE:1425028367,RESOLVE,,,
Fri Feb 27 12:12:47 2015 us=784000 Data Channel MTU parms [ L:1543 D:1450 EF:43 EB:4 ET:0 EL:0 ]
Fri Feb 27 12:12:47 2015 us=784000 Local Options String: 'V4,dev-type tun,link-mtu 1543,tun-mtu 1500,proto TCPv4_CLIENT,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Fri Feb 27 12:12:47 2015 us=784000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1543,tun-mtu 1500,proto TCPv4_SERVER,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Fri Feb 27 12:12:47 2015 us=784000 Local Options hash (VER=V4): 'db02a8f8'
Fri Feb 27 12:12:47 2015 us=784000 Expected Remote Options hash (VER=V4): '7e068940'
Fri Feb 27 12:12:47 2015 us=784000 Attempting to establish TCP connection with [AF_INET]хх.хх.ххх.хх:1194 [nonblock]
Fri Feb 27 12:12:47 2015 us=784000 MANAGEMENT: >STATE:1425028367,TCP_CONNECT,,,
Fri Feb 27 12:12:48 2015 us=830875 TCP connection established with [AF_INET]хх.хх.ххх.хх:1194
Fri Feb 27 12:12:48 2015 us=830875 TCPv4_CLIENT link local: [undef]
Fri Feb 27 12:12:48 2015 us=830875 TCPv4_CLIENT link remote: [AF_INET]хх.хх.ххх.хх:1194
Fri Feb 27 12:12:48 2015 us=846500 MANAGEMENT: >STATE:1425028368,WAIT,,,
Fri Feb 27 12:12:48 2015 us=862125 Connection reset, restarting [-1]


"Помогите с OpenVPN"
Отправлено h0per , 27-Фев-15 13:29 
> Если я к локалке конекчусь не из локалки, а по 3G (любой
> открытый доступ), то все проходит и далее следует за WAIT это
> MANAGEMENT: >STATE:1363143403,AUTH

вот успешный лог клиента (конект к локалке по 3G)

я╗┐Fri Feb 27 10:21:18 2015 OpenVPN 2.3.6 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec  1 2014
Fri Feb 27 10:21:18 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Enter Management Password:
Fri Feb 27 10:21:18 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Fri Feb 27 10:21:18 2015 Need hold release from management interface, waiting...
Fri Feb 27 10:21:19 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Fri Feb 27 10:21:19 2015 MANAGEMENT: CMD 'state on'
Fri Feb 27 10:21:19 2015 MANAGEMENT: CMD 'log all on'
Fri Feb 27 10:21:19 2015 MANAGEMENT: CMD 'hold off'
Fri Feb 27 10:21:19 2015 MANAGEMENT: CMD 'hold release'
Fri Feb 27 10:21:19 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Fri Feb 27 10:21:19 2015 MANAGEMENT: >STATE:1425021679,RESOLVE,,,
Fri Feb 27 10:21:20 2015 Attempting to establish TCP connection with [AF_INET]хх.хх.хх.хх:1194 [nonblock]
Fri Feb 27 10:21:20 2015 MANAGEMENT: >STATE:1425021680,TCP_CONNECT,,,
Fri Feb 27 10:21:21 2015 TCP connection established with [AF_INET]хх.хх.хх.хх:1194
Fri Feb 27 10:21:21 2015 TCPv4_CLIENT link local: [undef]
Fri Feb 27 10:21:21 2015 TCPv4_CLIENT link remote: [AF_INET]хх.хх.хх.хх:1194
Fri Feb 27 10:21:21 2015 MANAGEMENT: >STATE:1425021681,WAIT,,,
Fri Feb 27 10:21:21 2015 MANAGEMENT: >STATE:1425021681,AUTH,,,
Fri Feb 27 10:21:21 2015 TLS: Initial packet from [AF_INET]хх.хх.хх.хх:1194, sid=3cb7c25c 194244ed
Fri Feb 27 10:21:22 2015 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=changeme, CN=changeme, name=changeme, emailAddress=mail@host.domain
Fri Feb 27 10:21:22 2015 VERIFY OK: nsCertType=SERVER
Fri Feb 27 10:21:22 2015 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, CN=server, emailAddress=mail@host.domain
Fri Feb 27 10:21:27 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Feb 27 10:21:27 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Feb 27 10:21:27 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Feb 27 10:21:27 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Feb 27 10:21:27 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Fri Feb 27 10:21:27 2015 [server] Peer Connection Initiated with [AF_INET]хх.хх.хх.хх:1194
Fri Feb 27 10:21:28 2015 MANAGEMENT: >STATE:1425021688,GET_CONFIG,,,
Fri Feb 27 10:21:29 2015 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Fri Feb 27 10:21:30 2015 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Fri Feb 27 10:21:30 2015 OPTIONS IMPORT: timers and/or timeouts modified
Fri Feb 27 10:21:30 2015 OPTIONS IMPORT: --ifconfig/up options modified
Fri Feb 27 10:21:30 2015 OPTIONS IMPORT: route options modified
Fri Feb 27 10:21:30 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Feb 27 10:21:30 2015 MANAGEMENT: >STATE:1425021690,ASSIGN_IP,,10.8.0.6,
Fri Feb 27 10:21:30 2015 open_tun, tt->ipv6=0
Fri Feb 27 10:21:30 2015 TAP-WIN32 device [Подключение по локальной сети 2] opened: \\.\Global\{CED23524-70BE-43BA-9E6E-063E3BD923C1}.tap
Fri Feb 27 10:21:30 2015 TAP-Windows Driver Version 9.9
Fri Feb 27 10:21:30 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {CED23524-70BE-43BA-9E6E-063E3BD923C1} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Fri Feb 27 10:21:30 2015 Successful ARP Flush on interface [65541] {CED23524-70BE-43BA-9E6E-063E3BD923C1}
Fri Feb 27 10:21:35 2015 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Fri Feb 27 10:21:35 2015 C:\WINDOWS\system32\route.exe ADD хх.хх.хх.хх MASK 255.255.255.255 172.20.10.1
Fri Feb 27 10:21:35 2015 Route addition via IPAPI succeeded [adaptive]
Fri Feb 27 10:21:35 2015 C:\WINDOWS\system32\route.exe ADD 172.20.10.1 MASK 255.255.255.255 172.20.10.1 IF 3
Fri Feb 27 10:21:35 2015 Route addition via IPAPI succeeded [adaptive]
Fri Feb 27 10:21:35 2015 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Fri Feb 27 10:21:35 2015 Route addition via IPAPI succeeded [adaptive]
Fri Feb 27 10:21:35 2015 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Fri Feb 27 10:21:35 2015 Route addition via IPAPI succeeded [adaptive]
Fri Feb 27 10:21:35 2015 MANAGEMENT: >STATE:1425021695,ADD_ROUTES,,,
Fri Feb 27 10:21:35 2015 C:\WINDOWS\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.5
Fri Feb 27 10:21:35 2015 Route addition via IPAPI succeeded [adaptive]
Fri Feb 27 10:21:35 2015 Initialization Sequence Completed
Fri Feb 27 10:21:35 2015 MANAGEMENT: >STATE:1425021695,CONNECTED,SUCCESS,10.8.0.6,хх.хх.хх.хх


схемка:
комп(win7) c 3G - ИНТЕРНЕТ - VPNserver(ubuntu) (xx.xx.xxx.xx (WWW.ru) )

"Помогите с OpenVPN"
Отправлено h0per , 27-Фев-15 14:00 
лог с сервера при неудачном конекте

Fri Feb 27 10:57:35 2015 us=997361 MULTI: multi_close_instance called
Fri Feb 27 10:57:35 2015 us=997471 PID packet_id_free
Fri Feb 27 10:57:35 2015 us=997731 PID packet_id_free
Fri Feb 27 10:57:35 2015 us=997789 PID packet_id_free
Fri Feb 27 10:57:35 2015 us=997832 PID packet_id_free
Fri Feb 27 10:57:35 2015 us=997894 PID packet_id_free
Fri Feb 27 10:57:35 2015 us=997938 PID packet_id_free
Fri Feb 27 10:57:35 2015 us=997979 PID packet_id_free
Fri Feb 27 10:57:35 2015 us=998018 PID packet_id_free
Fri Feb 27 10:57:35 2015 us=998061 TCP/UDP: Closing socket
Fri Feb 27 10:57:35 2015 us=998130 PID packet_id_free
Fri Feb 27 10:57:35 2015 us=998196 MULTI TCP: multi_tcp_post TA_SOCKET_READ -> TA_UNDEF
Fri Feb 27 10:57:46 2015 us=155 MULTI: REAP range 192 -> 208
Fri Feb 27 10:57:46 2015 us=282 MULTI TCP: multi_tcp_action a=TA_TIMEOUT p=0
Fri Feb 27 10:57:46 2015 us=331 MULTI TCP: multi_tcp_dispatch a=TA_TIMEOUT mi=0x00000000
Fri Feb 27 10:57:46 2015 us=374 MULTI TCP: multi_tcp_post TA_TIMEOUT -> TA_UNDEF
Fri Feb 27 10:57:56 2015 us=10458 MULTI: REAP range 208 -> 224
Fri Feb 27 10:57:56 2015 us=10583 MULTI TCP: multi_tcp_action a=TA_TIMEOUT p=0
Fri Feb 27 10:57:56 2015 us=10631 MULTI TCP: multi_tcp_dispatch a=TA_TIMEOUT mi=0x00000000
Fri Feb 27 10:57:56 2015 us=10675 MULTI TCP: multi_tcp_post TA_TIMEOUT -> TA_UNDEF
Fri Feb 27 10:58:06 2015 us=20758 NOTE: --mute triggered...
Fri Feb 27 10:58:07 2015 us=30776 5 variation(s) on previous 10 message(s) suppressed by --mute
Fri Feb 27 10:58:07 2015 us=30896 MULTI: multi_create_instance called
Fri Feb 27 10:58:07 2015 us=30990 Re-using SSL/TLS context
Fri Feb 27 10:58:07 2015 us=31043 MTU DYNAMIC mtu=0, flags=1, 0 -> 140
Fri Feb 27 10:58:07 2015 us=31104 PID packet_id_init seq_backtrack=0 time_backtrack=0
Fri Feb 27 10:58:07 2015 us=31231 PID packet_id_init seq_backtrack=0 time_backtrack=0
Fri Feb 27 10:58:07 2015 us=31286 PID packet_id_init seq_backtrack=0 time_backtrack=0
Fri Feb 27 10:58:07 2015 us=31376 PID packet_id_init seq_backtrack=0 time_backtrack=0
Fri Feb 27 10:58:07 2015 us=31431 Control Channel MTU parms [ L:1559 D:140 EF:40 EB:0 ET:0 EL:0 ]
Fri Feb 27 10:58:07 2015 us=31481 MTU DYNAMIC mtu=1450, flags=2, 1559 -> 1450
Fri Feb 27 10:58:07 2015 us=31534 Data Channel MTU parms [ L:1559 D:1450 EF:59 EB:4 ET:0 EL:0 ]
Fri Feb 27 10:58:07 2015 us=31633 Local Options String: 'V4,dev-type tun,link-mtu 1559,tun-mtu 1500,proto TCPv4_SERVER,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Fri Feb 27 10:58:07 2015 us=31678 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1559,tun-mtu 1500,proto TCPv4_CLIENT,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Fri Feb 27 10:58:07 2015 us=31774 Local Options hash (VER=V4): '898ae6c6'
Fri Feb 27 10:58:07 2015 us=31833 Expected Remote Options hash (VER=V4): '5cb3f8dc'
Fri Feb 27 10:58:07 2015 us=31959 TCP connection established with [AF_INET]IP_FROM_CONECT:17608
Fri Feb 27 10:58:07 2015 us=32014 TCPv4_SERVER link local: [undef]
Fri Feb 27 10:58:07 2015 us=32063 TCPv4_SERVER link remote: [AF_INET]IP_FROM_CONECT:17608
Fri Feb 27 10:58:07 2015 us=32125 IP_FROM_CONECT:17608 SENT PING
Fri Feb 27 10:58:07 2015 us=32261 IP_FROM_CONECT:17608 MULTI TCP: instance added: IP_FROM_CONECT:17608
Fri Feb 27 10:58:07 2015 us=32313 IP_FROM_CONECT:17608 MULTI TCP: multi_tcp_action a=TA_INITIAL p=0
Fri Feb 27 10:58:07 2015 us=32356 IP_FROM_CONECT:17608 MULTI TCP: multi_tcp_dispatch a=TA_INITIAL mi=0x7fe469fa2760
Fri Feb 27 10:58:07 2015 us=32432 IP_FROM_CONECT:17608 MULTI TCP: multi_tcp_post TA_INITIAL -> TA_UNDEF
Fri Feb 27 10:58:08 2015 us=61446 IP_FROM_CONECT:17608 MULTI: REAP range 0 -> 16
Fri Feb 27 10:58:08 2015 us=61558 IP_FROM_CONECT:17608 MULTI TCP: multi_tcp_action a=TA_SOCKET_READ p=0
Fri Feb 27 10:58:08 2015 us=61605 IP_FROM_CONECT:17608 MULTI TCP: multi_tcp_dispatch a=TA_SOCKET_READ mi=0x7fe469fa2760
Fri Feb 27 10:58:08 2015 us=61679 IP_FROM_CONECT:17608 TCPv4_SERVER READ [14] from [AF_INET]IP_FROM_CONECT:17608: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Fri Feb 27 10:58:08 2015 us=61739 IP_FROM_CONECT:17608 TLS: Initial packet from [AF_INET]IP_FROM_CONECT:17608, sid=aa4a6729 bdd56277
Fri Feb 27 10:58:08 2015 us=61813 MULTI TCP: multi_tcp_post TA_SOCKET_READ -> TA_SOCKET_WRITE
Fri Feb 27 10:58:08 2015 us=61856 MULTI TCP: multi_tcp_action a=TA_SOCKET_WRITE p=1
Fri Feb 27 10:58:08 2015 us=61898 MULTI TCP: multi_tcp_wait_lite a=TA_SOCKET_WRITE mi=0x7fe469fa2760
Fri Feb 27 10:58:08 2015 us=61948 MULTI TCP: multi_tcp_dispatch a=TA_SOCKET_WRITE mi=0x7fe469fa2760
Fri Feb 27 10:58:08 2015 us=62005 IP_FROM_CONECT:17608 TCPv4_SERVER WRITE [26] to [AF_INET]IP_FROM_CONECT:17608: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ 0 ] pid=0 DATA len=0
Fri Feb 27 10:58:08 2015 us=62161 MULTI TCP: multi_tcp_post TA_SOCKET_WRITE -> TA_UNDEF
Fri Feb 27 10:58:08 2015 us=66763 MULTI TCP: multi_tcp_action a=TA_SOCKET_READ p=0
Fri Feb 27 10:58:08 2015 us=66875 MULTI TCP: multi_tcp_dispatch a=TA_SOCKET_READ mi=0x7fe469fa2760
Fri Feb 27 10:58:08 2015 us=66929 IP_FROM_CONECT:17608 Connection reset, restarting [-1]
Fri Feb 27 10:58:08 2015 us=66973 IP_FROM_CONECT:17608 SIGUSR1[soft,connection-reset] received, client-instance restarting
Fri Feb 27 10:58:08 2015 us=67014 MULTI: multi_close_instance called


схемка:
комп(win7) - шлюз(IP_FROM_CONECT) - ИНТЕРНЕТ - VPNserver(ubuntu) (xx.xx.xxx.xx (WWW.ru) )