From owner-freebsd-questions@freebsd.org Wed Apr 24 00:36:37 2019 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id E35651587724 for ; Wed, 24 Apr 2019 00:36:36 +0000 (UTC) (envelope-from srs0=6mtt=s2=mail.sermon-archive.info=doug@sermon-archive.info) Received: from mail.sermon-archive.info (sermon-archive.info [71.177.216.148]) by mx1.freebsd.org (Postfix) with ESMTP id D45386B5D1 for ; Wed, 24 Apr 2019 00:36:35 +0000 (UTC) (envelope-from srs0=6mtt=s2=mail.sermon-archive.info=doug@sermon-archive.info) Received: from [10.0.1.251] (mini [10.0.1.251]) by mail.sermon-archive.info (Postfix) with ESMTPSA id 44phFs68Mnz2fjxS; Tue, 23 Apr 2019 17:36:33 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.8\)) Subject: Re: openvpn From: Doug Hardie In-Reply-To: Date: Tue, 23 Apr 2019 17:36:33 -0700 Cc: freebsd-questions@freebsd.org Content-Transfer-Encoding: quoted-printable Message-Id: <9DABDBEC-B532-46F6-B09E-A65ED4EF5A1A@mail.sermon-archive.info> References: <0A8436BD-EFB8-4A54-B920-329096B89C5B@mail.sermon-archive.info> To: John Johnstone X-Mailer: Apple Mail (2.3445.104.8) X-Virus-Scanned: clamav-milter 0.100.2 at mail X-Virus-Status: Clean X-Rspamd-Queue-Id: D45386B5D1 X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org; spf=pass (mx1.freebsd.org: domain of srs0=6mtt=s2=mail.sermon-archive.info=doug@sermon-archive.info designates 71.177.216.148 as permitted sender) smtp.mailfrom=srs0=6mtt=s2=mail.sermon-archive.info=doug@sermon-archive.info X-Spamd-Result: default: False [-2.25 / 15.00]; ARC_NA(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; NEURAL_HAM_MEDIUM(-0.98)[-0.978,0]; FROM_HAS_DN(0.00)[]; TO_DN_SOME(0.00)[]; R_SPF_ALLOW(-0.20)[+ip4:71.177.216.148]; MV_CASE(0.50)[]; MIME_GOOD(-0.10)[text/plain]; IP_SCORE(-0.04)[asn: 5650(-0.13), country: US(-0.06)]; NEURAL_HAM_LONG(-0.99)[-0.987,0]; TO_MATCH_ENVRCPT_SOME(0.00)[]; MX_GOOD(-0.01)[cached: sermon-archive.info]; RCPT_COUNT_TWO(0.00)[2]; RCVD_IN_DNSWL_NONE(0.00)[148.216.177.71.list.dnswl.org : 127.0.10.0]; NEURAL_HAM_SHORT(-0.83)[-0.835,0]; FORGED_SENDER(0.30)[bc979@lafn.org,srs0=6mtt=s2=mail.sermon-archive.info=doug@sermon-archive.info]; RCVD_NO_TLS_LAST(0.10)[]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:5650, ipnet:71.177.216.0/23, country:US]; FROM_NEQ_ENVFROM(0.00)[bc979@lafn.org,srs0=6mtt=s2=mail.sermon-archive.info=doug@sermon-archive.info]; RCVD_COUNT_TWO(0.00)[2] X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Apr 2019 00:36:37 -0000 > On 23 April 2019, at 16:40, John Johnstone = wrote: >=20 > On 4/22/2019 8:53 PM, Doug Hardie wrote: >> I am trying to setup an openvpn server on my home network. Home = machines are all running FBSD 12.0 Release. openvpn was installed as a = package. The results are quite confusing. Ping from an external device = works correctly to all the home machines. I can use tcpdump to see the = request packets arriving at the openvpn server, being sent to the = recipient machine, the response packets being sent from the recipient = machine to the openvpn server, and then sent to the external device. The = external device shows that the response was received with a reasonable = response time given that it is a cell phone. >> However, when I try to access a web page on any of the servers, I see = the same set of packets via tcpdump. In addition if I run ktrace on the = openvpn server, I see the encrypted packets from the client being = received. The decrypted packets sent to the home server. The = unencrypted response from the home server, and the encrypted response = sent to the phone. However, the phone says that the server dropped the = connection, or it shows a blank page. >> My first thought was that there was an encryption issue, but if that = were the case, ping would not work. Checking the ping packets shows = that they are encrypted between the phone and the openvpn server. = Likewise a routing issue in the home network does not seem to be the = problem for the same reason. All the info I have found on the web about = vpn indicates that a ping test should be sufficient. But, in this case = it is not. >> Any ideas on how to track down the problem, or fix it? Thanks, >> -- Doug >=20 > My experience with OpenVPN is with pfSense which has always worked so = I don't have any good suggestions. You could try looking for the 3-way = TCP handshake syn - syn-ack - ack with tcpdump for an incoming = connection on the web server. Does the web server log show anything = interesting? Anything in the OpenVPN server logging? Nothing unexpected. >=20 > Might be difficult to arrange but testing from some hardware besides a = phone would help; being able to run tcpdump on the external device side. = This would allow verifying the 3-way TCP handshake at the client side. As I indicated, tcpdump has been use on all connections. The = connections are established and data is sent. The client just ignores = it. Or, that's what it appears. >=20 > It's not likely but an Ethernet duplex mismatch (full - half) can give = strange results where a few ping packets work fine but anything faster = than that produces trouble because of the high rate of collisions. The connections work just fine. They are in use with other traffic. >=20 > Perhaps review your OpenVPN server configuration compared to the = OpenVPN client to be sure that everything is compatible between them. I see nothing obvious between them. >=20 > - > John J. > _______________________________________________ > freebsd-questions@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to = "freebsd-questions-unsubscribe@freebsd.org"