OpenVPN Verbindung schlägt fehl

sharbich · Beitrag von **sharbich** » 02.12.2024 08:33:46

Hallo Ihr Lieben,
ich habe OpenVPN auf mein Debian Server installiert und versuche mit meinen Ubuntu Client eine Verbindung herzustellen. Das hat sehr lange funktioniert. Nun nicht mehr. Hier die Versionen die ich einsetze:
Server Version:

Code: Alles auswählen

root@dsme01:~# dpkg -l openvpn
Gewünscht=Unbekannt/Installieren/R=Entfernen/P=Vollständig Löschen/Halten
| Status=Nicht/Installiert/Config/U=Entpackt/halb konFiguriert/
         Halb installiert/Trigger erWartet/Trigger anhängig
|/ Fehler?=(kein)/R=Neuinstallation notwendig (Status, Fehler: GROSS=schlecht)
||/ Name           Version      Architektur  Beschreibung
+++-==============-============-============-=================================
ii  openvpn        2.5.1-3      amd64        virtual private network daemon

Client Version:

Code: Alles auswählen

(base) stefan.harbich@nsthwme02:~$ dpkg -l openvpn
Gewünscht=Unbekannt/Installieren/R=Entfernen/P=Vollständig Löschen/Halten
| Status=Nicht/Installiert/Config/U=Entpackt/halb konFiguriert/
         Halb installiert/Trigger erWartet/Trigger anhängig
|/ Fehler?=(kein)/R=Neuinstallation notwendig (Status, Fehler: GROSS=schlecht)
||/ Name           Version                 Architektur  Beschreibung
+++-==============-=======================-============-=================================
ii  openvpn        2.5.11-0ubuntu0.22.04.1 amd64        virtual private network daemon

Wenn ich von meinen Ubuntu Client eine Verbindung aufbauen will erhalte ich folgende Fehlermeldung:

Code: Alles auswählen

2024-12-02 08:18:12 us=12616 Current Parameter Settings:
Client Log:
2024-12-02 08:18:12 us=12731   config = '/etc/openvpn/client/nsthtme02.ovpn'
2024-12-02 08:18:12 us=12745   mode = 0
2024-12-02 08:18:12 us=12754   persist_config = DISABLED
2024-12-02 08:18:12 us=12763   persist_mode = 1
2024-12-02 08:18:12 us=12772   show_ciphers = DISABLED
2024-12-02 08:18:12 us=12780   show_digests = DISABLED
2024-12-02 08:18:12 us=12789   show_engines = DISABLED
2024-12-02 08:18:12 us=12797   genkey = DISABLED
2024-12-02 08:18:12 us=12810   genkey_filename = '[UNDEF]'
2024-12-02 08:18:12 us=12819   key_pass_file = '[UNDEF]'
2024-12-02 08:18:12 us=12828   show_tls_ciphers = DISABLED
2024-12-02 08:18:12 us=12837   connect_retry_max = 0
2024-12-02 08:18:12 us=12846 Connection profiles [0]:
2024-12-02 08:18:12 us=12856   proto = tcp-client
2024-12-02 08:18:12 us=12865   local = '[UNDEF]'
2024-12-02 08:18:12 us=12893   local_port = '[UNDEF]'
2024-12-02 08:18:12 us=12915   remote = 'dstme01.harnet.de'
2024-12-02 08:18:12 us=12924   remote_port = '1194'
2024-12-02 08:18:12 us=12934   remote_float = DISABLED
2024-12-02 08:18:12 us=12942   bind_defined = DISABLED
2024-12-02 08:18:12 us=12951   bind_local = DISABLED
2024-12-02 08:18:12 us=12961   bind_ipv6_only = DISABLED
2024-12-02 08:18:12 us=12970   connect_retry_seconds = 5
2024-12-02 08:18:12 us=12978   connect_timeout = 120
2024-12-02 08:18:12 us=12987   socks_proxy_server = '[UNDEF]'
2024-12-02 08:18:12 us=12996   socks_proxy_port = '[UNDEF]'
2024-12-02 08:18:12 us=13005   tun_mtu = 1500
2024-12-02 08:18:12 us=13015   tun_mtu_defined = ENABLED
2024-12-02 08:18:12 us=13024   link_mtu = 1500
2024-12-02 08:18:12 us=13033   link_mtu_defined = DISABLED
2024-12-02 08:18:12 us=13042   tun_mtu_extra = 32
2024-12-02 08:18:12 us=13051   tun_mtu_extra_defined = ENABLED
2024-12-02 08:18:12 us=13060   mtu_discover_type = -1
2024-12-02 08:18:12 us=13069   fragment = 0
2024-12-02 08:18:12 us=13090   mssfix = 1450
2024-12-02 08:18:12 us=13110   explicit_exit_notification = 0
2024-12-02 08:18:12 us=13122   tls_auth_file = '[UNDEF]'
2024-12-02 08:18:12 us=13131   key_direction = not set
2024-12-02 08:18:12 us=13140   tls_crypt_file = '[INLINE]'
2024-12-02 08:18:12 us=13148   tls_crypt_v2_file = '[UNDEF]'
2024-12-02 08:18:12 us=13185 Connection profiles END
2024-12-02 08:18:12 us=13197   remote_random = DISABLED
2024-12-02 08:18:12 us=13207   ipchange = '[UNDEF]'
2024-12-02 08:18:12 us=13217   dev = 'tap'
2024-12-02 08:18:12 us=13228   dev_type = '[UNDEF]'
2024-12-02 08:18:12 us=13239   dev_node = '[UNDEF]'
2024-12-02 08:18:12 us=13250   lladdr = '9a:53:79:02:a9:bd'
2024-12-02 08:18:12 us=13262   topology = 1
2024-12-02 08:18:12 us=13274   ifconfig_local = '[UNDEF]'
2024-12-02 08:18:12 us=13287   ifconfig_remote_netmask = '[UNDEF]'
2024-12-02 08:18:12 us=13298   ifconfig_noexec = DISABLED
2024-12-02 08:18:12 us=13315   ifconfig_nowarn = DISABLED
2024-12-02 08:18:12 us=13328   ifconfig_ipv6_local = '[UNDEF]'
2024-12-02 08:18:12 us=13342   ifconfig_ipv6_netbits = 0
2024-12-02 08:18:12 us=13353   ifconfig_ipv6_remote = '[UNDEF]'
2024-12-02 08:18:12 us=13366   shaper = 0
2024-12-02 08:18:12 us=13375   mtu_test = 0
2024-12-02 08:18:12 us=13383   mlock = DISABLED
2024-12-02 08:18:12 us=13390   keepalive_ping = 0
2024-12-02 08:18:12 us=13398   keepalive_timeout = 0
2024-12-02 08:18:12 us=13405   inactivity_timeout = 0
2024-12-02 08:18:12 us=13413   inactivity_minimum_bytes = 0
2024-12-02 08:18:12 us=13420   ping_send_timeout = 0
2024-12-02 08:18:12 us=13427   ping_rec_timeout = 0
2024-12-02 08:18:12 us=13435   ping_rec_timeout_action = 0
2024-12-02 08:18:12 us=13442   ping_timer_remote = DISABLED
2024-12-02 08:18:12 us=13450   remap_sigusr1 = 0
2024-12-02 08:18:12 us=13457   persist_tun = ENABLED
2024-12-02 08:18:12 us=13464   persist_local_ip = DISABLED
2024-12-02 08:18:12 us=13471   persist_remote_ip = DISABLED
2024-12-02 08:18:12 us=13479   persist_key = ENABLED
2024-12-02 08:18:12 us=13486   passtos = DISABLED
2024-12-02 08:18:12 us=13494   resolve_retry_seconds = 1000000000
2024-12-02 08:18:12 us=13502   resolve_in_advance = DISABLED
2024-12-02 08:18:12 us=13509   username = '[UNDEF]'
2024-12-02 08:18:12 us=13517   groupname = '[UNDEF]'
2024-12-02 08:18:12 us=13524   chroot_dir = '[UNDEF]'
2024-12-02 08:18:12 us=13532   cd_dir = '[UNDEF]'
2024-12-02 08:18:12 us=13539   writepid = '[UNDEF]'
2024-12-02 08:18:12 us=13546   up_script = '/etc/openvpn/client/dhcp.sh'
2024-12-02 08:18:12 us=13554   down_script = '/etc/openvpn/client/dhcp.sh'
2024-12-02 08:18:12 us=13561   down_pre = ENABLED
2024-12-02 08:18:12 us=13569   up_restart = DISABLED
2024-12-02 08:18:12 us=13576   up_delay = DISABLED
2024-12-02 08:18:12 us=13583   daemon = DISABLED
2024-12-02 08:18:12 us=13591   inetd = 0
2024-12-02 08:18:12 us=13598   log = ENABLED
2024-12-02 08:18:12 us=13606   suppress_timestamps = DISABLED
2024-12-02 08:18:12 us=13613   machine_readable_output = DISABLED
2024-12-02 08:18:12 us=13620   nice = 0
2024-12-02 08:18:12 us=13628   verbosity = 6
2024-12-02 08:18:12 us=13635   mute = 0
2024-12-02 08:18:12 us=13643   gremlin = 0
2024-12-02 08:18:12 us=13650   status_file = '[UNDEF]'
2024-12-02 08:18:12 us=13657   status_file_version = 1
2024-12-02 08:18:12 us=13665   status_file_update_freq = 60
2024-12-02 08:18:12 us=13672   occ = ENABLED
2024-12-02 08:18:12 us=13680   rcvbuf = 0
2024-12-02 08:18:12 us=13688   sndbuf = 0
2024-12-02 08:18:12 us=13695   mark = 0
2024-12-02 08:18:12 us=13703   sockflags = 0
2024-12-02 08:18:12 us=13710   fast_io = DISABLED
2024-12-02 08:18:12 us=13718   comp.alg = 0
2024-12-02 08:18:12 us=13725   comp.flags = 0
2024-12-02 08:18:12 us=13732   route_script = '[UNDEF]'
2024-12-02 08:18:12 us=13740   route_default_gateway = '[UNDEF]'
2024-12-02 08:18:12 us=13747   route_default_metric = 0
2024-12-02 08:18:12 us=13755   route_noexec = DISABLED
2024-12-02 08:18:12 us=13766   route_delay = 60
2024-12-02 08:18:12 us=13774   route_delay_window = 30
2024-12-02 08:18:12 us=13783   route_delay_defined = ENABLED
2024-12-02 08:18:12 us=13791   route_nopull = DISABLED
2024-12-02 08:18:12 us=13799   route_gateway_via_dhcp = DISABLED
2024-12-02 08:18:12 us=13807   allow_pull_fqdn = DISABLED
2024-12-02 08:18:12 us=13815   management_addr = '[UNDEF]'
2024-12-02 08:18:12 us=13823   management_port = '[UNDEF]'
2024-12-02 08:18:12 us=13840   management_user_pass = '[UNDEF]'
2024-12-02 08:18:12 us=13849   management_log_history_cache = 250
2024-12-02 08:18:12 us=13857   management_echo_buffer_size = 100
2024-12-02 08:18:12 us=13866   management_write_peer_info_file = '[UNDEF]'
2024-12-02 08:18:12 us=13874   management_client_user = '[UNDEF]'
2024-12-02 08:18:12 us=13882   management_client_group = '[UNDEF]'
2024-12-02 08:18:12 us=13891   management_flags = 0
2024-12-02 08:18:12 us=13899   shared_secret_file = '[UNDEF]'
2024-12-02 08:18:12 us=13908   key_direction = not set
2024-12-02 08:18:12 us=13916   ciphername = 'AES-256-GCM'
2024-12-02 08:18:12 us=13924   ncp_enabled = ENABLED
2024-12-02 08:18:12 us=13932   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
2024-12-02 08:18:12 us=13940   authname = 'SHA256'
2024-12-02 08:18:12 us=13949   prng_hash = 'SHA1'
2024-12-02 08:18:12 us=13957   prng_nonce_secret_len = 16
2024-12-02 08:18:12 us=13966   keysize = 0
2024-12-02 08:18:12 us=13974   engine = DISABLED
2024-12-02 08:18:12 us=13982   replay = ENABLED
2024-12-02 08:18:12 us=13990   mute_replay_warnings = DISABLED
2024-12-02 08:18:12 us=13999   replay_window = 64
2024-12-02 08:18:12 us=14007   replay_time = 15
2024-12-02 08:18:12 us=14015   packet_id_file = '[UNDEF]'
2024-12-02 08:18:12 us=14023   test_crypto = DISABLED
2024-12-02 08:18:12 us=14032   tls_server = DISABLED
2024-12-02 08:18:12 us=14040   tls_client = ENABLED
2024-12-02 08:18:12 us=14048   ca_file = '[INLINE]'
2024-12-02 08:18:12 us=14057   ca_path = '[UNDEF]'
2024-12-02 08:18:12 us=14065   dh_file = '[UNDEF]'
2024-12-02 08:18:12 us=14073   cert_file = '[INLINE]'
2024-12-02 08:18:12 us=14094   extra_certs_file = '[UNDEF]'
2024-12-02 08:18:12 us=14110   priv_key_file = '[INLINE]'
2024-12-02 08:18:12 us=14118   pkcs12_file = '[UNDEF]'
2024-12-02 08:18:12 us=14126   cipher_list = '[UNDEF]'
2024-12-02 08:18:12 us=14134   cipher_list_tls13 = '[UNDEF]'
2024-12-02 08:18:12 us=14142   tls_cert_profile = '[UNDEF]'
2024-12-02 08:18:12 us=14150   tls_verify = '[UNDEF]'
2024-12-02 08:18:12 us=14158   tls_export_cert = '[UNDEF]'
2024-12-02 08:18:12 us=14166   verify_x509_type = 0
2024-12-02 08:18:12 us=14174   verify_x509_name = '[UNDEF]'
2024-12-02 08:18:12 us=14182   crl_file = '[UNDEF]'
2024-12-02 08:18:12 us=14190   ns_cert_type = 0
2024-12-02 08:18:12 us=14198   remote_cert_ku[i] = 65535
2024-12-02 08:18:12 us=14206   remote_cert_ku[i] = 0
2024-12-02 08:18:12 us=14214   remote_cert_ku[i] = 0
2024-12-02 08:18:12 us=14222   remote_cert_ku[i] = 0
2024-12-02 08:18:12 us=14230   remote_cert_ku[i] = 0
2024-12-02 08:18:12 us=14239   remote_cert_ku[i] = 0
2024-12-02 08:18:12 us=14247   remote_cert_ku[i] = 0
2024-12-02 08:18:12 us=14255   remote_cert_ku[i] = 0
2024-12-02 08:18:12 us=14263   remote_cert_ku[i] = 0
2024-12-02 08:18:12 us=14271   remote_cert_ku[i] = 0
2024-12-02 08:18:12 us=14280   remote_cert_ku[i] = 0
2024-12-02 08:18:12 us=14288   remote_cert_ku[i] = 0
2024-12-02 08:18:12 us=14296   remote_cert_ku[i] = 0
2024-12-02 08:18:12 us=14304   remote_cert_ku[i] = 0
2024-12-02 08:18:12 us=14312   remote_cert_ku[i] = 0
2024-12-02 08:18:12 us=14320   remote_cert_ku[i] = 0
2024-12-02 08:18:12 us=14328   remote_cert_eku = 'TLS Web Server Authentication'
2024-12-02 08:18:12 us=14337   ssl_flags = 0
2024-12-02 08:18:12 us=14345   tls_timeout = 2
2024-12-02 08:18:12 us=14353   renegotiate_bytes = -1
2024-12-02 08:18:12 us=14361   renegotiate_packets = 0
2024-12-02 08:18:12 us=14369   renegotiate_seconds = 3600
2024-12-02 08:18:12 us=14377   handshake_window = 60
2024-12-02 08:18:12 us=14385   transition_window = 3600
2024-12-02 08:18:12 us=14393   single_session = DISABLED
2024-12-02 08:18:12 us=14401   push_peer_info = DISABLED
2024-12-02 08:18:12 us=14410   tls_exit = DISABLED
2024-12-02 08:18:12 us=14418   tls_crypt_v2_metadata = '[UNDEF]'
2024-12-02 08:18:12 us=14426   pkcs11_protected_authentication = DISABLED
2024-12-02 08:18:12 us=14434   pkcs11_protected_authentication = DISABLED
2024-12-02 08:18:12 us=14442   pkcs11_protected_authentication = DISABLED
2024-12-02 08:18:12 us=14450   pkcs11_protected_authentication = DISABLED
2024-12-02 08:18:12 us=14466   pkcs11_protected_authentication = DISABLED
2024-12-02 08:18:12 us=14474   pkcs11_protected_authentication = DISABLED
2024-12-02 08:18:12 us=14482   pkcs11_protected_authentication = DISABLED
2024-12-02 08:18:12 us=14490   pkcs11_protected_authentication = DISABLED
2024-12-02 08:18:12 us=14498   pkcs11_protected_authentication = DISABLED
2024-12-02 08:18:12 us=14506   pkcs11_protected_authentication = DISABLED
2024-12-02 08:18:12 us=14514   pkcs11_protected_authentication = DISABLED
2024-12-02 08:18:12 us=14522   pkcs11_protected_authentication = DISABLED
2024-12-02 08:18:12 us=14530   pkcs11_protected_authentication = DISABLED
2024-12-02 08:18:12 us=14538   pkcs11_protected_authentication = DISABLED
2024-12-02 08:18:12 us=14546   pkcs11_protected_authentication = DISABLED
2024-12-02 08:18:12 us=14554   pkcs11_protected_authentication = DISABLED
2024-12-02 08:18:12 us=14563   pkcs11_private_mode = 00000000
2024-12-02 08:18:12 us=14571   pkcs11_private_mode = 00000000
2024-12-02 08:18:12 us=14580   pkcs11_private_mode = 00000000
2024-12-02 08:18:12 us=14588   pkcs11_private_mode = 00000000
2024-12-02 08:18:12 us=14596   pkcs11_private_mode = 00000000
2024-12-02 08:18:12 us=14604   pkcs11_private_mode = 00000000
2024-12-02 08:18:12 us=14612   pkcs11_private_mode = 00000000
2024-12-02 08:18:12 us=14620   pkcs11_private_mode = 00000000
2024-12-02 08:18:12 us=14627   pkcs11_private_mode = 00000000
2024-12-02 08:18:12 us=14635   pkcs11_private_mode = 00000000
2024-12-02 08:18:12 us=14643   pkcs11_private_mode = 00000000
2024-12-02 08:18:12 us=14651   pkcs11_private_mode = 00000000
2024-12-02 08:18:12 us=14659   pkcs11_private_mode = 00000000
2024-12-02 08:18:12 us=14666   pkcs11_private_mode = 00000000
2024-12-02 08:18:12 us=14674   pkcs11_private_mode = 00000000
2024-12-02 08:18:12 us=14682   pkcs11_private_mode = 00000000
2024-12-02 08:18:12 us=14690   pkcs11_cert_private = DISABLED
2024-12-02 08:18:12 us=14698   pkcs11_cert_private = DISABLED
2024-12-02 08:18:12 us=14706   pkcs11_cert_private = DISABLED
2024-12-02 08:18:12 us=14714   pkcs11_cert_private = DISABLED
2024-12-02 08:18:12 us=14722   pkcs11_cert_private = DISABLED
2024-12-02 08:18:12 us=14730   pkcs11_cert_private = DISABLED
2024-12-02 08:18:12 us=14738   pkcs11_cert_private = DISABLED
2024-12-02 08:18:12 us=14745   pkcs11_cert_private = DISABLED
2024-12-02 08:18:12 us=14753   pkcs11_cert_private = DISABLED
2024-12-02 08:18:12 us=14761   pkcs11_cert_private = DISABLED
2024-12-02 08:18:12 us=14769   pkcs11_cert_private = DISABLED
2024-12-02 08:18:12 us=14777   pkcs11_cert_private = DISABLED
2024-12-02 08:18:12 us=14785   pkcs11_cert_private = DISABLED
2024-12-02 08:18:12 us=14795   pkcs11_cert_private = DISABLED
2024-12-02 08:18:12 us=14803   pkcs11_cert_private = DISABLED
2024-12-02 08:18:12 us=14811   pkcs11_cert_private = DISABLED
2024-12-02 08:18:12 us=14819   pkcs11_pin_cache_period = -1
2024-12-02 08:18:12 us=14828   pkcs11_id = '[UNDEF]'
2024-12-02 08:18:12 us=14836   pkcs11_id_management = DISABLED
2024-12-02 08:18:12 us=14854   server_network = 0.0.0.0
2024-12-02 08:18:12 us=14865   server_netmask = 0.0.0.0
2024-12-02 08:18:12 us=14881   server_network_ipv6 = ::
2024-12-02 08:18:12 us=14891   server_netbits_ipv6 = 0
2024-12-02 08:18:12 us=14900   server_bridge_ip = 0.0.0.0
2024-12-02 08:18:12 us=14910   server_bridge_netmask = 0.0.0.0
2024-12-02 08:18:12 us=14920   server_bridge_pool_start = 0.0.0.0
2024-12-02 08:18:12 us=14930   server_bridge_pool_end = 0.0.0.0
2024-12-02 08:18:12 us=14938   ifconfig_pool_defined = DISABLED
2024-12-02 08:18:12 us=14947   ifconfig_pool_start = 0.0.0.0
2024-12-02 08:18:12 us=14956   ifconfig_pool_end = 0.0.0.0
2024-12-02 08:18:12 us=14965   ifconfig_pool_netmask = 0.0.0.0
2024-12-02 08:18:12 us=14973   ifconfig_pool_persist_filename = '[UNDEF]'
2024-12-02 08:18:12 us=14982   ifconfig_pool_persist_refresh_freq = 600
2024-12-02 08:18:12 us=14990   ifconfig_ipv6_pool_defined = DISABLED
2024-12-02 08:18:12 us=14998   ifconfig_ipv6_pool_base = ::
2024-12-02 08:18:12 us=15014   ifconfig_ipv6_pool_netbits = 0
2024-12-02 08:18:12 us=15023   n_bcast_buf = 256
2024-12-02 08:18:12 us=15032   tcp_queue_limit = 64
2024-12-02 08:18:12 us=15041   real_hash_size = 256
2024-12-02 08:18:12 us=15050   virtual_hash_size = 256
2024-12-02 08:18:12 us=15058   client_connect_script = '[UNDEF]'
2024-12-02 08:18:12 us=15066   learn_address_script = '[UNDEF]'
2024-12-02 08:18:12 us=15075   client_disconnect_script = '[UNDEF]'
2024-12-02 08:18:12 us=15098   client_config_dir = '[UNDEF]'
2024-12-02 08:18:12 us=15107   ccd_exclusive = DISABLED
2024-12-02 08:18:12 us=15115   tmp_dir = '/tmp'
2024-12-02 08:18:12 us=15124   push_ifconfig_defined = DISABLED
2024-12-02 08:18:12 us=15133   push_ifconfig_local = 0.0.0.0
2024-12-02 08:18:12 us=15143   push_ifconfig_remote_netmask = 0.0.0.0
2024-12-02 08:18:12 us=15152   push_ifconfig_ipv6_defined = DISABLED
2024-12-02 08:18:12 us=15162   push_ifconfig_ipv6_local = ::/0
2024-12-02 08:18:12 us=15171   push_ifconfig_ipv6_remote = ::
2024-12-02 08:18:12 us=15179   enable_c2c = DISABLED
2024-12-02 08:18:12 us=15188   duplicate_cn = DISABLED
2024-12-02 08:18:12 us=15197   cf_max = 0
2024-12-02 08:18:12 us=15205   cf_per = 0
2024-12-02 08:18:12 us=15213   max_clients = 1024
2024-12-02 08:18:12 us=15222   max_routes_per_client = 256
2024-12-02 08:18:12 us=15230   auth_user_pass_verify_script = '[UNDEF]'
2024-12-02 08:18:12 us=15239   auth_user_pass_verify_script_via_file = DISABLED
2024-12-02 08:18:12 us=15247   auth_token_generate = DISABLED
2024-12-02 08:18:12 us=15255   auth_token_lifetime = 0
2024-12-02 08:18:12 us=15263   auth_token_secret_file = '[UNDEF]'
2024-12-02 08:18:12 us=15271   port_share_host = '[UNDEF]'
2024-12-02 08:18:12 us=15279   port_share_port = '[UNDEF]'
2024-12-02 08:18:12 us=15287   vlan_tagging = DISABLED
2024-12-02 08:18:12 us=15295   vlan_accept = all
2024-12-02 08:18:12 us=15304   vlan_pvid = 1
2024-12-02 08:18:12 us=15347   client = DISABLED
2024-12-02 08:18:12 us=15358   pull = ENABLED
2024-12-02 08:18:12 us=15367   auth_user_pass_file = '[UNDEF]'
2024-12-02 08:18:12 us=15378 OpenVPN 2.5.11 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Sep 17 2024
2024-12-02 08:18:12 us=15401 library versions: OpenSSL 3.0.2 15 Mar 2022, LZO 2.10
2024-12-02 08:18:12 us=15576 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2024-12-02 08:18:12 us=23532 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2024-12-02 08:18:12 us=23603 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2024-12-02 08:18:12 us=23617 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2024-12-02 08:18:12 us=23630 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2024-12-02 08:18:12 us=23753 Control Channel MTU parms [ L:1655 D:1154 EF:96 EB:0 ET:0 EL:3 ]
2024-12-02 08:18:12 us=43291 Data Channel MTU parms [ L:1655 D:1450 EF:123 EB:411 ET:32 EL:3 ]
2024-12-02 08:18:12 us=43381 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1583,tun-mtu 1532,proto TCPv4_CLIENT,cipher AES-256-GCM,auth [null-digest],keysize 256,key-method 2,tls-client'
2024-12-02 08:18:12 us=43391 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1583,tun-mtu 1532,proto TCPv4_SERVER,cipher AES-256-GCM,auth [null-digest],keysize 256,key-method 2,tls-server'
2024-12-02 08:18:12 us=43408 TCP/UDP: Preserving recently used remote address: [AF_INET6]2a00:d0c0:200:0:b9:1a:9c:46:1194
2024-12-02 08:18:12 us=43446 Socket Buffers: R=[131072->131072] S=[16384->16384]
2024-12-02 08:18:12 us=43458 Attempting to establish TCP connection with [AF_INET6]2a00:d0c0:200:0:b9:1a:9c:46:1194 [nonblock]
2024-12-02 08:18:12 us=43484 TCP: connect to [AF_INET6]2a00:d0c0:200:0:b9:1a:9c:46:1194 failed: Network is unreachable
2024-12-02 08:18:12 us=43565 SIGUSR1[connection failed(soft),init_instance] received, process restarting
2024-12-02 08:18:12 us=43584 Restart pause, 5 second(s)
2024-12-02 08:18:16 us=306177 SIGINT[hard,init_instance] received, process exiting

Das Problem scheint zu sein das der Client nur versucht eine Verbindung über ipv6 herzustellen, nicht über ipv4. Aber ich weiß nicht warum? Ich habe an der Konfiguration nichts geändert. Ich hatte nur ein "apt update && apt upgrade" durchgeführt. Wie bekomme ich es hin das nur ipv4 verwendet wird? Hier die Client und Server config's.
Server config:

Code: Alles auswählen

root@dsme01:~# cat /etc/openvpn/server/server.conf
local dstme01.intern.example.com
port 1194
proto tcp
dev tap0
script-security 2
up "/etc/openvpn/server/up.sh br0 tap0 1400"
down "/etc/openvpn/server/down.sh br0 tap0"
pkcs12 /etc/ssl/certs/dstme01.intern.harnet.de.p12
dh none
server-bridge
push "route-gateway 192.168.190.1"
push "route 192.168.20.0 255.255.255.0 192.168.190.2"
push "dhcp-option DNS 192.168.20.20"
push "dhcp-option DOMAIN intern.harnet.de"
push "route-gateway dhcp"
push "redirect-gateway"
client-to-client
keepalive 10 120
tls-crypt /etc/ssl/private/OpenVPN.key
cipher AES-256-GCM   # AES
auth SHA256
max-clients 100
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log-append  /var/log/openvpn/openvpn.log
verb 3
sndbuf 0
rcvbuf 0
push "sndbuf 393216"
push "rcvbuf 393216"

Client config:

Code: Alles auswählen

root@nsthwme02:~# cat /etc/openvpn/client/nsthtme02.ovpn 
tls-client
dev tap
proto tcp-client
remote-cert-tls server
lladdr 9a:53:79:02:a9:bd
nobind
persist-key
persist-tun
# Certificate Authority
<ca>
-----BEGIN CERTIFICATE-----
MIIDsTCCApmgAwIBAgIUa5YTHxAZeFQbxtTHDusUqiQWj4owDQYJKoZIhvcNAQEL
BQAwYDESMBAGA1UEAwwJSGFyYmljaENBMQwwCgYDVQQLDANwa2kxEDAOBgNVBAoM
B0hhcmJpY2gxFjAUBgoJkiaJk/IsZAEZFgZoYXJuZXQxEjAQBgoJkiaJk/IsZAEZ
FgJkZTAeFw0yMzEwMzAxMzQ3MzdaFw0zMzEwMjcxMzQ3MzZaMGAxEjAQBgNVBAMM
...
+6B+1V6Dp7nQVvx+onETi6AOpoUiC6GonLiomxeE8mQMqF1RvDMPYwWunOklQ5LK
GBTsfn6hmCpQ9Pi65cWhxXWHGNzYsGyzGzn5jUHYie+Gq9GNVAosbK3y1TCrJaW8
rTfdXW/BLVha2B7KDJ2AlgDNh+RuMDY9curxW5cssrv22w3bpQ==
-----END CERTIFICATE-----
</ca>
# Certificate
<cert>
-----BEGIN CERTIFICATE-----
MIIFoTCCBImgAwIBAgIUOI35L+OFsMCf2kQiSdfvra7nlJYwDQYJKoZIhvcNAQEL
BQAwYDESMBAGA1UEAwwJSGFyYmljaENBMQwwCgYDVQQLDANwa2kxEDAOBgNVBAoM
B0hhcmJpY2gxFjAUBgoJkiaJk/IsZAEZFgZoYXJuZXQxEjAQBgoJkiaJk/IsZAEZ
FgJkZTAeFw0yMzEyMDUxOTQ4MDhaFw0yNTEyMDQxOTQ4MDdaMCUxIzAhBgNVBAMM
Gm5zdGh0bWUwMi5pbnRlcm4uaGFybmV0LmRlMIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEAtDrwsWNtRhVa5CFslO38jIfKyjLk3cIMIPDG8//k5BBQ4Yf8
...
M0RIYXJiaWNoQ0ElMkNPVSUzRHBraSUyQ08lM0RIYXJiaWNoJTJDREMlM0RoYXJu
ZXQlMkNEQyUzRGRlomSkYjBgMRIwEAYDVQQDDAlIYXJiaWNoQ0ExDDAKBgNVBAsM
A3BraTEQMA4GA1UECgwHSGFyYmljaDEWMBQGCgmSJomT8ixkARkWBmhhcm5ldDES
MBAGCgmSJomT8ixkARkWAmRlMB0GA1UdDgQWBBSCpvKga/2pe4i3DyKV+0PU4668
6zAOBgNVHQ8BAf8EBAMCBaAwDQYJKoZIhvcNAQELBQADggEBABHAEbdUjYNvzWCA
JZNl5RFFBTJMn/jPS5ezXBaYX3blngoM4iPNje85qgUIiRUxgEXLwKNJttmB6f52
W/jm45GxPrHWY2fu6V238eDWypodJM0YvuiPhtz9La9L8sjLZZtobR3f/LuKQyjD
Hmx1pkNg7N24lX4Wfgqo5c9kAkwBxaj+/hctmlPlFKQBocAJDAPR1c6lkMtlN6ES
WwoPrVO3YGH+DJzaCinEx9AnA5WibApPG6jgsxwmKACUuu6SSaC7hgfTVgBH014s
8Isx2HAb0ji+yVGhQS89150pmckTDzpfNsyl3XULNrXy63VDxplFOJllsiRT83Tb
h8zkQgc=
-----END CERTIFICATE-----
</cert>
# Private Key
<key>
-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC0OvCxY21GFVrk
IWyU7fyMh8rKMuTdwgwg8Mbz/+TkEFDhh/xQYaJZAYxVECFGsdqLUBPTBQmdF98O
bpusdTT2nYTrd+zbeRop2taNmPE8mtmura7Y7fq3RmPuTec2lG/hPv0xpnDauoVZ
MrQG5OMsfMU6hsVsjqMuyZ9ixMmaxHVpO0ZIOGGAOlZfKB5nmIXuxli8Fv2Zci10
YCuKMTB2t2ZB+f3nEDPjGOOIku2RFKiTf0ZhsnZUjoqUYFfg++eyzmnzF7yP683F
...
uZphZzTg/rYNwYk0oI5vpbgbGUIqhrnFtf6ddEf4H3TBd5SWJtDICjAqdih7xitY
eSD8rzR94SnDTztlQlVAaWI=
-----END PRIVATE KEY-----
</key>
<tls-crypt>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
0e3202deb20e4a515a5c8c4c4a47c692
410d386e4f621fae109be713166a2b7c
...
9ddc5ccda3a4319a372a15d4bf5e37fe
61dffee972f1560f4c95a66bd7c759d9
241b7a6e4166c241728149a5ccc6902a
-----END OpenVPN Static key V1-----
</tls-crypt>
cipher AES-256-GCM
auth SHA256
log-append  /var/log/openvpn/openvpn.log
verb 6
script-security 2
route-delay 60
up /etc/openvpn/client/dhcp.sh
down-pre
down /etc/openvpn/client/dhcp.sh
pull

Habt Ihr einen Tipp was ich machen kann?
Gruß von Stefan Harbich

debilian · Beitrag von **debilian** » 02.12.2024 08:46:28

Code: Alles auswählen

lladdr 9a:53:79:02:a9:bd

nutzt du das im lokalen Netzwerk,
warum verbindest du nicht zur IP Adresse?

gruss

sharbich · Beitrag von **sharbich** » 02.12.2024 09:55:14

debilian hat geschrieben:
02.12.2024 08:46:28
nutzt du das im lokalen Netzwerk,
warum verbindest du nicht zur IP Adresse?
gruss

Ja, weil ich einen zentralen DHCP-Server verwende und über die MAC Adresse der OpenVPN Client die IP zugewiesen bekommt. Deshalb verwende ich auch TAP anstatt TUN. Über eine TUN Verbindung habe ich keine Lösung gefunden wie ich den lokalen Client eine IP Adresse vom zentralen DHCP-Server zuweisen kann. Gerne Lösungsvorschläge. Das ist aber ein anderes Problem. Jetzt geht es darum warum alle Client's nur eine IPv6 Verbindung aufbauen wollen?

debilian · Beitrag von **debilian** » 02.12.2024 09:58:46

würde vermuten, dass deine Netzwerkkonfiguration IPv6 bevorzugt,
kannst es ja mal temporär abschalten.

sharbich · Beitrag von **sharbich** » 02.12.2024 10:02:42

debilian hat geschrieben:
02.12.2024 09:58:46
würde vermuten, dass deine Netzwerkkonfiguration IPv6 bevorzugt,
kanns es ja mal temporär abschalten.

Wie schalte ich das temporär ab?

debilian · Beitrag von **debilian** » 02.12.2024 10:04:39

https://www.thomas-krenn.com/de/wiki/IPv6_deaktivieren

sharbich · Beitrag von **sharbich** » 02.12.2024 10:43:00

Ich habe das auf dem Server und auf dem Client deaktiviert. Ohne Neustart. gleiches Ergebnis.

Code: Alles auswählen

2024-12-02 10:40:09 us=937508 TCP/UDP: Preserving recently used remote address: [AF_INET6]2a00:d0c0:200:0:b9:1a:9c:46:1194

So wie das aussieht greift der Client auf einen vorhanden Wert "Preserving recently..." zurück. Ggf. DNS Cache löschen? Nur wie?

sharbich · Beitrag von **sharbich** » 03.12.2024 18:07:13

Kann mir keiner helfen?

mat6937 · Beitrag von **mat6937** » 03.12.2024 18:23:08

sharbich hat geschrieben:
02.12.2024 10:43:00
So wie das aussieht greift der Client auf einen vorhanden Wert "Preserving recently..." zurück. Ggf. DNS Cache löschen? Nur wie?

Das ist abhängig was Du auf dem Client konfiguriert bzw. installiert hast (nscd, systemd-resolved, ...).

Code: Alles auswählen

sudo resolvectl flush-caches

Code: Alles auswählen

systemctl status nscd

EDIT:

Evtl. auch IPv6-Adressen mit statischer/fester Interface-ID benutzen und einen v6-fähigen dyndns-Client/-Provider.

MSfree · Beitrag von **MSfree** » 03.12.2024 18:28:08

sharbich hat geschrieben:
03.12.2024 18:07:13
Kann mir keiner helfen?

Meiner Erfahrung nach ist ein OpenVPN im bridged Setup, also über tap-Device, eher unstabil. Ein geroutetes VPN ist da deutlich besser und benötigt keinerlei iptables/nftables-Regeln.

debianforum.de

OpenVPN Verbindung schlägt fehl

OpenVPN Verbindung schlägt fehl

Re: OpenVPN Verbindung schlägt fehl

Re: OpenVPN Verbindung schlägt fehl

Re: OpenVPN Verbindung schlägt fehl

Re: OpenVPN Verbindung schlägt fehl

Re: OpenVPN Verbindung schlägt fehl

Re: OpenVPN Verbindung schlägt fehl

Re: OpenVPN Verbindung schlägt fehl

Re: OpenVPN Verbindung schlägt fehl

Re: OpenVPN Verbindung schlägt fehl