Настройка OpenVPN

OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Feb 27 2013
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>

  $ ./configure --build=x86_64-linux-gnu --prefix=/usr --includedir=${prefix}/include --mandir=${prefix}/share/man --infodir=${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --libexecdir=${prefix}/lib/openvpn --disable-maintainer-mode --disable-dependency-tracking CFLAGS=-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security CPPFLAGS=-D_FORTIFY_SOURCE=2 CXXFLAGS=-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security FFLAGS=-g -O2 LDFLAGS=-Wl,-Bsymbolic-functions -fPIE -pie -Wl,-z,relro -Wl,-z,now --enable-password-save --host=x86_64-linux-gnu --build=x86_64-linux-gnu --prefix=/usr --mandir=${prefix}/share/man --with-ifconfig-path=/sbin/ifconfig --with-route-path=/sbin/route

Compile time defines:  ENABLE_CLIENT_SERVER ENABLE_DEBUG ENABLE_EUREPHIA ENABLE_FRAGMENT ENABLE_HTTP_PROXY ENABLE_MANAGEMENT ENABLE_MULTIHOME ENABLE_PASSWORD_SAVE ENABLE_PORT_SHARE ENABLE_SOCKS USE_CRYPTO USE_LIBDL USE_LZO USE_PF_INET6 USE_PKCS11 USE_SSL

port 1194
proto udp
dev tun

ca /etc/openvpn/rsa/keys/ca.crt
cert /etc/openvpn/rsa/keys/server.crt
key /etc/openvpn/rsa/keys/server.key  
                               
dh /etc/openvpn/rsa/keys/dh1024.pem

                                                                                     
server 10.8.0.0 255.255.255.0  
ifconfig-pool-persist ipp.txt

keepalive 10 120

comp-lzo

persist-key
persist-tun                                                                                                               
status /var/log/openvpn-status.log
log /var/log/openvpn.log   
                                                  
verb 3
                                             
mute 20

push "redirect-gateway"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source <SERVER_IP>

Sun Mar  2 02:37:42 2014 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Feb 27 2013
Sun Mar  2 02:37:42 2014 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sun Mar  2 02:37:42 2014 Diffie-Hellman initialized with 1024 bit key
Sun Mar  2 02:37:42 2014 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Mar  2 02:37:42 2014 Socket Buffers: R=[212992->131072] S=[212992->131072]
Sun Mar  2 02:37:42 2014 ROUTE default_gateway=<SERVER_GATEWAY_IP>
Sun Mar  2 02:37:42 2014 TUN/TAP device tun0 opened
Sun Mar  2 02:37:42 2014 TUN/TAP TX queue length set to 100
Sun Mar  2 02:37:42 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Mar  2 02:37:42 2014 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Sun Mar  2 02:37:42 2014 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Sun Mar  2 02:37:42 2014 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Mar  2 02:37:42 2014 UDPv4 link local (bound): [undef]
Sun Mar  2 02:37:42 2014 UDPv4 link remote: [undef]
Sun Mar  2 02:37:42 2014 MULTI: multi_init called, r=256 v=256
Sun Mar  2 02:37:42 2014 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Sun Mar  2 02:37:42 2014 ifconfig_pool_read(), in='nameless,10.8.0.4', TODO: IPv6
Sun Mar  2 02:37:42 2014 succeeded -> ifconfig_pool_set()
Sun Mar  2 02:37:42 2014 IFCONFIG POOL LIST
Sun Mar  2 02:37:42 2014 nameless,10.8.0.4
Sun Mar  2 02:37:42 2014 Initialization Sequence Completed
Sun Mar  2 02:45:29 2014 MULTI: multi_create_instance called
Sun Mar  2 02:45:29 2014 <CLIENT_IP>:16715 Re-using SSL/TLS context
Sun Mar  2 02:45:29 2014 <CLIENT_IP>:16715 LZO compression initialized
Sun Mar  2 02:45:29 2014 <CLIENT_IP>:16715 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Mar  2 02:45:29 2014 <CLIENT_IP>:16715 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Mar  2 02:45:29 2014 <CLIENT_IP>:16715 Local Options hash (VER=V4): '530fdded'
Sun Mar  2 02:45:29 2014 <CLIENT_IP>:16715 Expected Remote Options hash (VER=V4): '41690919'
Sun Mar  2 02:45:29 2014 <CLIENT_IP>:16715 TLS: Initial packet from [AF_INET]193.169.36.230:16715, sid=8ec516e0 9723ee11
Sun Mar  2 02:45:32 2014 <CLIENT_IP>:16715 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/OU=changeme/CN=changeme/name=changeme/emailAddress=mail@host.domain
Sun Mar  2 02:45:32 2014 <CLIENT_IP>:16715 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/OU=changeme/CN=nameless/name=changeme/emailAddress=mail@host.domain
Sun Mar  2 02:45:33 2014 <CLIENT_IP>:16715 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Mar  2 02:45:33 2014 <CLIENT_IP>:16715 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Mar  2 02:45:33 2014 <CLIENT_IP>:16715 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Mar  2 02:45:33 2014 <CLIENT_IP>:16715 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Mar  2 02:45:33 2014 <CLIENT_IP>:16715 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Mar  2 02:45:33 2014 <CLIENT_IP>:16715 [nameless] Peer Connection Initiated with [AF_INET]193.169.36.230:16715
Sun Mar  2 02:45:33 2014 nameless/<CLIENT_IP>:16715 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=1::1d00:0:a47f:0
Sun Mar  2 02:45:33 2014 nameless/<CLIENT_IP>:16715 MULTI: Learn: 10.8.0.6 -> nameless/193.169.36.230:16715
Sun Mar  2 02:45:33 2014 nameless/<CLIENT_IP>:16715 MULTI: primary virtual IP for nameless/193.169.36.230:16715: 10.8.0.6
Sun Mar  2 02:45:36 2014 nameless/<CLIENT_IP>:16715 PUSH: Received control message: 'PUSH_REQUEST'
Sun Mar  2 02:45:36 2014 nameless/<CLIENT_IP>:16715 send_push_reply(): safe_cap=960
Sun Mar  2 02:45:36 2014 nameless/<CLIENT_IP>:16715 SENT CONTROL [nameless]: 'PUSH_REPLY,redirect-gateway,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

Sun Mar  2 02:50:36 2014 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)