From owner-freebsd-questions@freebsd.org Tue Apr 23 00:53:58 2019 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 12FD41587F76 for ; Tue, 23 Apr 2019 00:53:58 +0000 (UTC) (envelope-from srs0=3ij4=sz=mail.sermon-archive.info=doug@sermon-archive.info) Received: from mail.sermon-archive.info (sermon-archive.info [71.177.216.148]) by mx1.freebsd.org (Postfix) with ESMTP id 3A3718707F for ; Tue, 23 Apr 2019 00:53:57 +0000 (UTC) (envelope-from srs0=3ij4=sz=mail.sermon-archive.info=doug@sermon-archive.info) Received: from [10.0.1.251] (mini [10.0.1.251]) by mail.sermon-archive.info (Postfix) with ESMTPSA id 44p4hD1qFSz2g0cL for ; Mon, 22 Apr 2019 17:53:48 -0700 (PDT) From: Doug Hardie Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.8\)) Subject: openvpn Message-Id: <0A8436BD-EFB8-4A54-B920-329096B89C5B@mail.sermon-archive.info> Date: Mon, 22 Apr 2019 17:53:47 -0700 To: FreeBSD Questions X-Mailer: Apple Mail (2.3445.104.8) X-Virus-Scanned: clamav-milter 0.100.2 at mail X-Virus-Status: Clean X-Rspamd-Queue-Id: 3A3718707F X-Spamd-Bar: - Authentication-Results: mx1.freebsd.org; spf=pass (mx1.freebsd.org: domain of srs0=3ij4=sz=mail.sermon-archive.info=doug@sermon-archive.info designates 71.177.216.148 as permitted sender) smtp.mailfrom=srs0=3ij4=sz=mail.sermon-archive.info=doug@sermon-archive.info X-Spamd-Result: default: False [-1.40 / 15.00]; ARC_NA(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; NEURAL_HAM_MEDIUM(-0.98)[-0.982,0]; FROM_HAS_DN(0.00)[]; MV_CASE(0.50)[]; R_SPF_ALLOW(-0.20)[+ip4:71.177.216.148]; MIME_GOOD(-0.10)[text/plain]; PREVIOUSLY_DELIVERED(0.00)[freebsd-questions@freebsd.org]; NEURAL_HAM_LONG(-0.95)[-0.954,0]; RCPT_COUNT_ONE(0.00)[1]; IP_SCORE(-0.04)[asn: 5650(-0.14), country: US(-0.06)]; TO_DN_ALL(0.00)[]; MX_GOOD(-0.01)[sermon-archive.info]; NEURAL_HAM_SHORT(-0.01)[-0.014,0]; RCVD_IN_DNSWL_NONE(0.00)[148.216.177.71.list.dnswl.org : 127.0.10.0]; TO_MATCH_ENVRCPT_ALL(0.00)[]; FORGED_SENDER(0.30)[bc979@lafn.org,srs0=3ij4=sz=mail.sermon-archive.info=doug@sermon-archive.info]; RCVD_NO_TLS_LAST(0.10)[]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:5650, ipnet:71.177.216.0/23, country:US]; FROM_NEQ_ENVFROM(0.00)[bc979@lafn.org,srs0=3ij4=sz=mail.sermon-archive.info=doug@sermon-archive.info]; RCVD_COUNT_TWO(0.00)[2] X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Apr 2019 00:53:58 -0000 I am trying to setup an openvpn server on my home network. Home = machines are all running FBSD 12.0 Release. openvpn was installed as a = package. The results are quite confusing. Ping from an external device = works correctly to all the home machines. I can use tcpdump to see the = request packets arriving at the openvpn server, being sent to the = recipient machine, the response packets being sent from the recipient = machine to the openvpn server, and then sent to the external device. = The external device shows that the response was received with a = reasonable response time given that it is a cell phone. =20 However, when I try to access a web page on any of the servers, I see = the same set of packets via tcpdump. In addition if I run ktrace on the = openvpn server, I see the encrypted packets from the client being = received. The decrypted packets sent to the home server. The = unencrypted response from the home server, and the encrypted response = sent to the phone. However, the phone says that the server dropped the = connection, or it shows a blank page. My first thought was that there was an encryption issue, but if that = were the case, ping would not work. Checking the ping packets shows = that they are encrypted between the phone and the openvpn server. = Likewise a routing issue in the home network does not seem to be the = problem for the same reason. All the info I have found on the web about = vpn indicates that a ping test should be sufficient. But, in this case = it is not. Any ideas on how to track down the problem, or fix it? Thanks, -- Doug