{"id":306,"date":"2008-05-17T11:49:59","date_gmt":"2008-05-17T08:49:59","guid":{"rendered":"http:\/\/www.void.gr\/kargig\/blog\/?p=306"},"modified":"2008-05-17T11:51:51","modified_gmt":"2008-05-17T08:51:51","slug":"openvpn-multi-bad-source-address-from-client-solution","status":"publish","type":"post","link":"https:\/\/www.void.gr\/kargig\/blog\/2008\/05\/17\/openvpn-multi-bad-source-address-from-client-solution\/","title":{"rendered":"Openvpn – MULTI: bad source address from client – solution"},"content":{"rendered":"

Problematic Configuration:<\/strong>
\nOpenVPN server config:<\/em>
\ndev tun
\nport 1194
\nproto udp
\nca \/etc\/openvpn\/ca.crt
\ncert \/etc\/openvpn\/server.crt
\nkey \/etc\/openvpn\/server.key
\ndh \/etc\/openvpn\/dh1024.pem
\npersist-key
\npersist-tun
\nserver 10.8.0.0 255.255.255.0
\nkeepalive 10 30
\nclient-to-client
\ncomp-lzo
\nifconfig-pool-persist ipp.txt
\nstatus \/etc\/openvpn\/openvpn-status.log
\nverb 3
\npush \"redirect-gateway\"
\n<\/code><\/p>\n

OpenVPN client config:<\/em>
\ndev tun
\nclient
\nproto udp
\npersist-tun
\npersist-key
\nresolv-retry infinite
\nmute-replay-warnings
\nremote REMOTE.HOST 1194
\nca \/etc\/openvpn\/ca.crt
\ncert \/etc\/openvpn\/client1.crt
\nkey \/etc\/openvpn\/client1.key
\ncomp-lzo
\nverb 3
\n<\/code><\/p>\n

The problem:<\/strong>
\nUsing the above config files I continuously got errors like this on the server syslog: <\/p>\n

May 1 00:00:00 hostname ovpn-openvpn[22563]: client1\/X.Y.Z.W:1194 MULTI: bad source address from client [10.10.1.11], packet dropped<\/p><\/blockquote>\n

where X.Y.Z.W is my public IP and 10.10.1.11 is the Lan IP of the machine that makes the connection to the openvpn server.<\/p>\n

The solution:<\/strong>
\nOpenVPN server config:<\/em>
\ndev tun
\nport 1194
\nproto udp
\nca \/etc\/openvpn\/ca.crt
\ncert \/etc\/openvpn\/server.crt
\nkey \/etc\/openvpn\/server.key
\ndh \/etc\/openvpn\/dh1024.pem
\npersist-key
\npersist-tun
\nserver 10.8.0.0 255.255.255.0
\nkeepalive 10 30
\nclient-to-client
\ncomp-lzo
\nifconfig-pool-persist ipp.txt
\nstatus \/etc\/openvpn\/openvpn-status.log
\nverb 3
\npush \"redirect-gateway\"
\nclient-config-dir ccd
\nroute 10.10.1.0 255.255.255.0
\n<\/strong><\/code><\/p>\n

Then I created the \/etc\/openvpn\/ccd\/<\/em> dir and put inside a file named client1<\/em> with the following contents:
\n# cat \/etc\/openvpn\/ccd\/client1
\niroute 10.10.1.0 255.255.255.0
\n<\/code><\/p>\n

Client configuration stays the same. <\/p>\n

All should be fine now and in your server logs you will now see entries like this:<\/p>\n

May 1 00:00:00 hostname ovpn-openvpn[27096]: client1\/X.Y.Z.W:1194 MULTI: Learn: 10.10.1.11 -> client1\/X.Y.Z.W:1194<\/p><\/blockquote>\n

Hint:<\/strong> If you want your clients to be able to access the internet through the VPN tunnel you _must_ create NAT.
\na typical config on a debian acting as the OpenVPN server:<\/em>
\n# cat \/etc\/network\/interfaces
\nauto lo
\niface lo inet loopback
\n# The primary network interface
\nauto eth0
\niface eth0 inet static
\n address A.B.C.D
\n netmask 255.255.255.0
\n gateway A.B.C.E
\n network A.B.C.0
\n broadcast A.B.C.255
\n post-up iptables -t nat -A POSTROUTING -o eth0 -s 10.8.0.1\/24 -j MASQUERADE
\n post-up echo 1 > \/proc\/sys\/net\/ipv4\/ip_forward
\n<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"

Problematic Configuration: OpenVPN server config: dev tun port 1194 proto udp ca \/etc\/openvpn\/ca.crt cert \/etc\/openvpn\/server.crt key \/etc\/openvpn\/server.key dh \/etc\/openvpn\/dh1024.pem persist-key persist-tun server 10.8.0.0 255.255.255.0 keepalive 10 30 client-to-client comp-lzo ifconfig-pool-persist ipp.txt status \/etc\/openvpn\/openvpn-status.log verb 3 push “redirect-gateway” OpenVPN client config: dev tun client proto udp persist-tun persist-key resolv-retry infinite mute-replay-warnings remote REMOTE.HOST 1194 ca \/etc\/openvpn\/ca.crt […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"footnotes":""},"categories":[6,5,3,8,4],"tags":[],"class_list":["post-306","post","type-post","status-publish","format-standard","hentry","category-encryption","category-internet","category-linux","category-networking","category-privacy"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t