0

I have set a OpenVPN server on a Debain machine and connected to it with a windows client.

However, I found the blocked site is still blocked and when I check the TAP adapter status, I got:
TAP adapter status

The sent&reveive data do not increase after I view the Internet.

I also have tried to download something with firefox and connected VPN while downloading. But the download wasn't interrupted.

My VPN client config is like this:
client
dev tun
port 443
proto tcp-client

remote XXX.XXX.XXX.XXX   
nobind

ca ca.crt
cert x250.crt
key x250.key

comp-lzo
persist-key
persist-tun

verb 5

And my connection log:

Thu Nov 10 14:24:03 2016 OpenVPN 2.3.13 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Nov  3 2016
Thu Nov 10 14:24:03 2016 Windows version 6.2 (Windows 8 or greater) 64bit
Thu Nov 10 14:24:03 2016 library versions: OpenSSL 1.0.1u  22 Sep 2016, LZO 2.09
Enter Management Password:
Thu Nov 10 14:24:03 2016 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Nov 10 14:24:03 2016 Need hold release from management interface, waiting...
Thu Nov 10 14:24:03 2016 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Nov 10 14:24:04 2016 MANAGEMENT: CMD 'state on'
Thu Nov 10 14:24:04 2016 MANAGEMENT: CMD 'log all on'
Thu Nov 10 14:24:04 2016 MANAGEMENT: CMD 'hold off'
Thu Nov 10 14:24:04 2016 MANAGEMENT: CMD 'hold release'
Thu Nov 10 14:24:04 2016 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu Nov 10 14:24:04 2016 Socket Buffers: R=[65536->65536] S=[65536->65536]
Thu Nov 10 14:24:04 2016 Attempting to establish TCP connection with [AF_INET]XXX.XXX.XXX.XXX:443 [nonblock]
Thu Nov 10 14:24:04 2016 MANAGEMENT: >STATE:1478759044,TCP_CONNECT,,,
Thu Nov 10 14:24:05 2016 TCP connection established with [AF_INET]XXX.XXX.XXX.XXX:443
Thu Nov 10 14:24:05 2016 TCPv4_CLIENT link local: [undef]
Thu Nov 10 14:24:05 2016 TCPv4_CLIENT link remote: [AF_INET]XXX.XXX.XXX.XXX:443
Thu Nov 10 14:24:05 2016 MANAGEMENT: >STATE:1478759045,WAIT,,,
Thu Nov 10 14:24:05 2016 MANAGEMENT: >STATE:1478759045,AUTH,,,
Thu Nov 10 14:24:05 2016 TLS: Initial packet from [AF_INET]XXX.XXX.XXX.XXX:443, sid=d182fb33 10309c01
Thu Nov 10 14:24:05 2016 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=junhongbill@gmail.com
Thu Nov 10 14:24:05 2016 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=server, name=EasyRSA, emailAddress=junhongbill@gmail.com
Thu Nov 10 14:24:05 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Nov 10 14:24:05 2016 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Thu Nov 10 14:24:05 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Nov 10 14:24:05 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Nov 10 14:24:05 2016 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Thu Nov 10 14:24:05 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Nov 10 14:24:05 2016 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Nov 10 14:24:05 2016 [server] Peer Connection Initiated with [AF_INET]XXX.XXX.XXX.XXX:443
Thu Nov 10 14:24:06 2016 MANAGEMENT: >STATE:1478759046,GET_CONFIG,,,
Thu Nov 10 14:24:07 2016 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Nov 10 14:24:07 2016 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.9.8.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.9.8.6 10.9.8.5'
Thu Nov 10 14:24:07 2016 OPTIONS IMPORT: timers and/or timeouts modified
Thu Nov 10 14:24:07 2016 OPTIONS IMPORT: --ifconfig/up options modified
Thu Nov 10 14:24:07 2016 OPTIONS IMPORT: route options modified
Thu Nov 10 14:24:07 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Nov 10 14:24:07 2016 ROUTE_GATEWAY 172.16.130.254/255.255.255.0 I=14 HWADDR=10:02:b5:0b:be:fe
Thu Nov 10 14:24:07 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Nov 10 14:24:07 2016 MANAGEMENT: >STATE:1478759047,ASSIGN_IP,,10.9.8.6,
Thu Nov 10 14:24:07 2016 open_tun, tt->ipv6=0
Thu Nov 10 14:24:07 2016 TAP-WIN32 device [Ethernet] opened: \\.\Global\{CA812F9D-0DEF-4C28-B625-41869522A869}.tap
Thu Nov 10 14:24:07 2016 TAP-Windows Driver Version 9.21 
Thu Nov 10 14:24:07 2016 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.9.8.6/255.255.255.252 on interface {CA812F9D-0DEF-4C28-B625-41869522A869} [DHCP-serv: 10.9.8.5, lease-time: 31536000]
Thu Nov 10 14:24:07 2016 Successful ARP Flush on interface [19] {CA812F9D-0DEF-4C28-B625-41869522A869}
Thu Nov 10 14:24:12 2016 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Thu Nov 10 14:24:12 2016 MANAGEMENT: >STATE:1478759052,ADD_ROUTES,,,
Thu Nov 10 14:24:12 2016 C:\WINDOWS\system32\route.exe ADD 10.9.8.0 MASK 255.255.255.0 10.9.8.5
Thu Nov 10 14:24:12 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=35 and dwForwardType=4
Thu Nov 10 14:24:12 2016 Route addition via IPAPI succeeded [adaptive]
Thu Nov 10 14:24:12 2016 Initialization Sequence Completed
Thu Nov 10 14:24:12 2016 MANAGEMENT: >STATE:1478759052,CONNECTED,SUCCESS,10.9.8.6,XXX.XXX.XXX.XXX
  • You need to add a default route via the VPN or make OpenVPN assign the default route via VPN during connect. – Tero Kilkanen Nov 10 '16 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.