Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i had a previously working configuration with the config files used in a previous question

However, i've changed this now to the following configuration using server mode, everything on the logs seem fine, however the client doesn't create any tun interface, so i don't have anything to connect to, presumably, i need to add or push some route commands, but i don't have any idea at this point what i need to do. I am posting all my relevant configuration files

server.conf:

dev tun
server 10.8.117.0 255.255.255.0
ifconfig-pool-persist ipp.txt
tls-server
dh /home/lurscher/keys/dh1024.pem
ca /home/lurscher/keys/ca.crt
cert /home/lurscher/keys/vpnCh8TestServer.crt
key /home/lurscher/keys/vpnCh8TestServer.key
status openvpn-status.log
log         openvpn.log
comp-lzo
verb 3

and client.conf:

dev tun
remote my.server.com
tls-client
ca /home/chuckq/keys/ca.crt
cert /home/chuckq/keys/vpnCh8TestClient.crt
key /home/chuckq/keys/vpnCh8TestClient.key
ns-cert-type server
; port 1194
; user nobody
; group nogroup
status openvpn-status.log
log         openvpn.log
comp-lzo
verb 3

the server ifconfig shows a tun device:

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.117.1  P-t-P:10.8.117.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

However the client ifconfig does not show any tun interface!

$ ifconfig tun0
tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          POINTOPOINT NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

the client log says:

Tue May 17 23:27:09 2011 OpenVPN 2.1.0 i686-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jul 12 2010
Tue May 17 23:27:09 2011 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Tue May 17 23:27:09 2011 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue May 17 23:27:09 2011 /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Tue May 17 23:27:09 2011 LZO compression initialized
Tue May 17 23:27:09 2011 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue May 17 23:27:09 2011 TUN/TAP device tun0 opened
Tue May 17 23:27:09 2011 TUN/TAP TX queue length set to 100
Tue May 17 23:27:09 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue May 17 23:27:09 2011 Local Options hash (VER=V4): '41690919'
Tue May 17 23:27:09 2011 Expected Remote Options hash (VER=V4): '530fdded'
Tue May 17 23:27:09 2011 Socket Buffers: R=[114688->131072] S=[114688->131072]
Tue May 17 23:27:09 2011 UDPv4 link local (bound): [undef]
Tue May 17 23:27:09 2011 UDPv4 link remote: [AF_INET]192.168.0.101:1194
Tue May 17 23:27:09 2011 TLS: Initial packet from [AF_INET]192.168.0.101:1194, sid=8e8bdc33 f4275407
Tue May 17 23:27:09 2011 VERIFY OK: depth=1, /C=CA/ST=Out/L=There/O=Ubuntu/OU=Home/CN=Ubuntu_CA/name=lurscher/emailAddress=me@myhost.mydomain
Tue May 17 23:27:09 2011 VERIFY OK: nsCertType=SERVER
Tue May 17 23:27:09 2011 VERIFY OK: depth=0, /C=CA/ST=Out/L=There/O=Ubuntu/OU=Home/CN=vpnCh8TestServer/name=lurscher/emailAddress=me@myhost.mydomain
Tue May 17 23:27:09 2011 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue May 17 23:27:09 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue May 17 23:27:09 2011 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue May 17 23:27:09 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue May 17 23:27:09 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue May 17 23:27:09 2011 [vpnCh8TestServer] Peer Connection Initiated with [AF_INET]192.168.0.101:1194
Tue May 17 23:27:10 2011 Initialization Sequence Completed

the client status log:

OpenVPN STATISTICS
Updated,Tue May 17 23:30:09 2011
TUN/TAP read bytes,0
TUN/TAP write bytes,0
TCP/UDP read bytes,5604
TCP/UDP write bytes,4244
Auth read bytes,0
pre-compress bytes,0
post-compress bytes,0
pre-decompress bytes,0
post-decompress bytes,0
END

and the server log says:

Tue May 17 23:18:25 2011 OpenVPN 2.1.0 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jul 12 2010
Tue May 17 23:18:25 2011 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Tue May 17 23:18:25 2011 WARNING: --keepalive option is missing from server config
Tue May 17 23:18:25 2011 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Tue May 17 23:18:25 2011 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue May 17 23:18:25 2011 Diffie-Hellman initialized with 1024 bit key
Tue May 17 23:18:25 2011 /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Tue May 17 23:18:25 2011 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue May 17 23:18:25 2011 ROUTE default_gateway=192.168.0.1
Tue May 17 23:18:25 2011 TUN/TAP device tun0 opened
Tue May 17 23:18:25 2011 TUN/TAP TX queue length set to 100
Tue May 17 23:18:25 2011 /sbin/ifconfig tun0 10.8.117.1 pointopoint 10.8.117.2 mtu 1500
Tue May 17 23:18:25 2011 /sbin/route add -net 10.8.117.0 netmask 255.255.255.0 gw 10.8.117.2
Tue May 17 23:18:25 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue May 17 23:18:25 2011 Socket Buffers: R=[126976->131072] S=[126976->131072]
Tue May 17 23:18:25 2011 UDPv4 link local (bound): [undef]
Tue May 17 23:18:25 2011 UDPv4 link remote: [undef]
Tue May 17 23:18:25 2011 MULTI: multi_init called, r=256 v=256
Tue May 17 23:18:25 2011 IFCONFIG POOL: base=10.8.117.4 size=62
Tue May 17 23:18:25 2011 IFCONFIG POOL LIST
Tue May 17 23:18:25 2011 vpnCh8TestClient,10.8.117.4
Tue May 17 23:18:25 2011 Initialization Sequence Completed
Tue May 17 23:27:22 2011 MULTI: multi_create_instance called
Tue May 17 23:27:22 2011 192.168.0.104:1194 Re-using SSL/TLS context
Tue May 17 23:27:22 2011 192.168.0.104:1194 LZO compression initialized
Tue May 17 23:27:22 2011 192.168.0.104:1194 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue May 17 23:27:22 2011 192.168.0.104:1194 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue May 17 23:27:22 2011 192.168.0.104:1194 Local Options hash (VER=V4): '530fdded'
Tue May 17 23:27:22 2011 192.168.0.104:1194 Expected Remote Options hash (VER=V4): '41690919'
Tue May 17 23:27:22 2011 192.168.0.104:1194 TLS: Initial packet from [AF_INET]192.168.0.104:1194, sid=8972b565 79323f68
Tue May 17 23:27:22 2011 192.168.0.104:1194 VERIFY OK: depth=1, /C=CA/ST=Out/L=There/O=Ubuntu/OU=Home/CN=Ubuntu_CA/name=lurscher/emailAddress=me@myhost.mydomain
Tue May 17 23:27:22 2011 192.168.0.104:1194 VERIFY OK: depth=0, /C=CA/ST=Out/L=There/O=Ubuntu/OU=Home/CN=Ubuntu_CA/name=lurscher/emailAddress=me@myhost.mydomain
Tue May 17 23:27:22 2011 192.168.0.104:1194 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue May 17 23:27:22 2011 192.168.0.104:1194 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue May 17 23:27:22 2011 192.168.0.104:1194 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue May 17 23:27:22 2011 192.168.0.104:1194 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue May 17 23:27:22 2011 192.168.0.104:1194 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue May 17 23:27:22 2011 192.168.0.104:1194 [vpnCh8TestClient] Peer Connection Initiated with [AF_INET]192.168.0.104:1194
Tue May 17 23:27:22 2011 vpnCh8TestClient/192.168.0.104:1194 MULTI: Learn: 10.8.117.6 -> vpnCh8TestClient/192.168.0.104:1194
Tue May 17 23:27:22 2011 vpnCh8TestClient/192.168.0.104:1194 MULTI: primary virtual IP for vpnCh8TestClient/192.168.0.104:1194: 10.8.117.6

finally, the server status log:

OpenVPN CLIENT LIST
Updated,Tue May 17 23:36:25 2011
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
vpnCh8TestClient,192.168.0.104:1194,4244,5604,Tue May 17 23:27:22 2011
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
10.8.117.6,vpnCh8TestClient,192.168.0.104:1194,Tue May 17 23:27:22 2011
GLOBAL STATS
Max bcast/mcast queue length,0
END
share|improve this question
    
Do you have the tunctl binary on the client? –  3molo May 18 '11 at 5:58
    
What is the content of file ipp.txt? –  wolfgangsz May 18 '11 at 8:52
    
"does not show a tun interface" as in "it is not there" or as in "it is unconfigured"? What is the output of "ifconfig tun0" on the client after initialization? –  the-wabbit May 18 '11 at 10:11
    
just add the result of ifconfig tun0 to the post –  lurscher May 18 '11 at 11:46
    
@wolfgangsz, ipp.txt has this line: vpnCh8TestClient,10.8.117.4 –  lurscher May 18 '11 at 11:47

1 Answer 1

Your server.conf file is probably missing a few things. For starters, there is no line declaring it a server:

mode server

Secondly, I would have to presume that your client is natively on a different network. In consequence the server needs to push some routes through to the client, e.g.:

push "route 10.x.y.z 255.255.255.0"

or similar. Repeat this line for all the subnets that are available through the VPN.

Thirdly, you will probably need to push a DNS server, a WINS server and a domain option, e.g.

push "dhcp-option DOMAIN my.domain"
push "dhcp-option DNS a.b.c.d"
push "dhcp-option WINS e.f.g.h"

And finally, you will need to instruct the server to route the pool addresses for the tunnels into the server, otherwise traffic will not flow, like this:

route 10.8.117.0 255.255.255.0
share|improve this answer
    
my server is in the 192.168.0.1 ip in the local network, the 10.8.117.x is just what i was hoping it would use as the virtual IP address range, does that make sense? –  lurscher May 18 '11 at 12:23
    
In that case you need to push a route to the 192.168.0.0/24 network. –  wolfgangsz May 18 '11 at 12:45
    
everything magically worked after i added "pull" after "tls-client" in the client.conf –  lurscher May 19 '11 at 20:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.