I have one problem with OpenVPN. There are a lot drops records in the openvpn log file on the server:

Mon Oct 22 10:14:41 2012 us=726541 laptop/ххх:1194 MULTI: bad source address from client [], packet dropped

grep -E "^[a-z]" server.conf  
port 1194  
proto udp
dev tun 
ca data/ca.crt 
cert data/server.crt
key data/server.key 
dh data/dh1024.pem 
tls-auth data/ta.key 0
remote-cert-tls client 
cipher AES-256-CBC
tun-mtu 1200
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS"
client-config-dir /etc/openvpn/ccd
keepalive 10 120
max-clients 5
status /var/log/status-openvpn.log
log  /var/log/openvpn.log
verb 4
auth-user-pass-verify /etc/openvpn/verify.sh via-file
tmp-dir /tmp
script-security 2

cat ccd/laptop

cat client.conf 
remote server ip 1194
dev tun
ping 10

proto udp
tls-auth data/ta.key 1
pkcs12 data/vpn.laptop.p12

remote-cert-tls server
#ns-cert-type server
cipher AES-256-CBC

verb 3

auth-user-pass /home/user/.openvpn/users.db 

According to "Jan Just Keijser - OpenVPN 2 Cookbook" root of the problem is incorrect config options.see the screenshot

But, as you see, my config has such options. Could you please help me to solve this problem.

@week Verb leverl=6;

client log.
Mon Oct 22 16:06:02 2012 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Oct 22 16:06:02 2012 /sbin/ifconfig tun0 pointopoint mtu 1500
Mon Oct 22 16:06:02 2012 /sbin/route add -net xxxx netmask gw
Mon Oct 22 16:06:02 2012 /sbin/route add -net netmask gw
Mon Oct 22 16:06:02 2012 /sbin/route add -net netmask gw
Mon Oct 22 16:06:02 2012 Initialization Sequence Completed

cat ccd/latop
iroute ifconfig-push


You are specifying client-config-dir which in turn would control the subnet routes added for connected clients and the subnets allowed to transport data over the tun interface. Your CCD file specifies an iroute to which obviously does not include, so a packet with this source IP address coming from laptop is dropped on reception.

  • Thank you for a good explanation. But how I can fix this problem? – Klesk Oct 22 '12 at 17:47
  • @Bogdan obviously by either adding the subnet as an iroute to your CCD or stopping sending from the network as the source address (e.g. by masquerading your traffic going through the VPN at the OpenVPN client to the address of its tun interface) – the-wabbit Oct 22 '12 at 18:40
  • Is this message critical ? – Klesk Oct 22 '12 at 21:46
  • @Bogdan the message is telling you that a host with the IP address has tried sending packets through the VPN via your connected "laptop" OpenVPN client. The OpenVPN gateway has discarded this packet. Whether this is critical or not is entirely up to your requirements. – the-wabbit Oct 23 '12 at 12:10
  • I have this message, too. It seems more like a client issue -- the server should never see packets with a source of 192.168.x.x, as the address assigned to the client end of the tunnel is in the 10.11.0/24 network. – TomG Sep 24 '13 at 2:12

Are you certain about that hostname laptop, try to add DEFAULT config file to ccd dir. I would also try checking access rights to dir and files within ccd.

  • vpn.laptop.p12 has CN = laptop, rights on the openvpn config dir and all files are 777 – Klesk Oct 22 '12 at 12:16
  • Did you try more verb level on both client and server? If client is receiving that config iroute? – week Oct 22 '12 at 12:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.