Newsgroup: it.comp.os.linux.sys
Titolo: Opevpn che non pinga

Devo proprio riuscire a risolvere questo mistero perché mi sta proprio
sul gozzo :D
Dato che a volte sono dietro proxy ho attivato due server openvpn
diversi sulla stessa macchina (e li ho debitamente impostati sul
router), quello udp funziona senza problemi ma il tcp non va, si
collega senza dare errori ma poi non riesco neanche a pingare.
Sono molto semplici e con chiave condivisa, hanno entrambi gli stessi
settaggi, cambia solo il protocollo.
Questo è il tcp:
remote <server>
dev tun2
ifconfig 10.8.123.2 10.8.123.1
secret luisa.key
proto tcp-client
port 443
nobind
user nobody
group nobody
persist-tun
persist-key
resolv-retry infinite
verb 4
http-proxy myproxy 3128 pwproxy ntlm
E pingando:
andreaMb:openvpn andrea$ ping 10.8.123.1
PING 10.8.123.1 (10.8.123.1): 56 data bytes
^C
--- 10.8.123.1 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss
andreaMb:openvpn andrea$ ping 10.8.123.2
PING 10.8.123.2 (10.8.123.2): 56 data bytes
36 bytes from 
172.16.0.246
: Time to live exceeded
Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
 4  5  00 5400 d28f   0 0000  01  01 38a7 172.26.125.78  10.8.123.2
Ora sembrerebbe quindi un problema di routing ma la route c'è
10.8.123.1         10.8.123.2         UH          0        2   tun2
quindi che altro caspita potrebbe essere?
Qui sotto il log della connessione..
andreaMb:openvpn andrea$ sudo openvpn2 --config misterboxProxy.conf
Thu Jul 30 14:47:32 2009 us=52743 Current Parameter Settings:
Thu Jul 30 14:47:32 2009 us=53222   config = 'misterboxProxy.conf'
Thu Jul 30 14:47:32 2009 us=56450   mode = 0
Thu Jul 30 14:47:32 2009 us=56546   show_ciphers = DISABLED
Thu Jul 30 14:47:32 2009 us=56662   show_digests = DISABLED
Thu Jul 30 14:47:32 2009 us=56695   show_engines = DISABLED
Thu Jul 30 14:47:32 2009 us=56839   genkey = DISABLED
Thu Jul 30 14:47:32 2009 us=56913   key_pass_file = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=56999   show_tls_ciphers = DISABLED
Thu Jul 30 14:47:32 2009 us=57031   proto = 2
Thu Jul 30 14:47:32 2009 us=57120   local = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=57240   remote_list[0] = {'server', 443}
Thu Jul 30 14:47:32 2009 us=57400   remote_random = DISABLED
Thu Jul 30 14:47:32 2009 us=57583   local_port = 443
Thu Jul 30 14:47:32 2009 us=57598   remote_port = 443
Thu Jul 30 14:47:32 2009 us=57608   remote_float = DISABLED
Thu Jul 30 14:47:32 2009 us=57618   ipchange = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=57628   bind_local = DISABLED
Thu Jul 30 14:47:32 2009 us=57638   dev = 'tun2'
Thu Jul 30 14:47:32 2009 us=57648   dev_type = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=57657   dev_node = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=57667   tun_ipv6 = DISABLED
Thu Jul 30 14:47:32 2009 us=57676   ifconfig_local = '10.8.123.2'
Thu Jul 30 14:47:32 2009 us=57686   ifconfig_remote_netmask =
'10.8.123.1'
Thu Jul 30 14:47:32 2009 us=57695   ifconfig_noexec = DISABLED
Thu Jul 30 14:47:32 2009 us=57705   ifconfig_nowarn = DISABLED
Thu Jul 30 14:47:32 2009 us=57714   shaper = 0
Thu Jul 30 14:47:32 2009 us=57725   tun_mtu = 1500
Thu Jul 30 14:47:32 2009 us=57734   tun_mtu_defined = ENABLED
Thu Jul 30 14:47:32 2009 us=57755   link_mtu = 1500
Thu Jul 30 14:47:32 2009 us=57766   link_mtu_defined = DISABLED
Thu Jul 30 14:47:32 2009 us=57776   tun_mtu_extra = 0
Thu Jul 30 14:47:32 2009 us=57816   tun_mtu_extra_defined = DISABLED
Thu Jul 30 14:47:32 2009 us=57826   fragment = 0
Thu Jul 30 14:47:32 2009 us=57835   mtu_discover_type = -1
Thu Jul 30 14:47:32 2009 us=57843   mtu_test = 0
Thu Jul 30 14:47:32 2009 us=57852   mlock = DISABLED
Thu Jul 30 14:47:32 2009 us=57861   keepalive_ping = 0
Thu Jul 30 14:47:32 2009 us=57870   keepalive_timeout = 0
Thu Jul 30 14:47:32 2009 us=57879   inactivity_timeout = 0
Thu Jul 30 14:47:32 2009 us=57888   ping_send_timeout = 0
Thu Jul 30 14:47:32 2009 us=57933   ping_rec_timeout = 0
Thu Jul 30 14:47:32 2009 us=57946   ping_rec_timeout_action = 0
Thu Jul 30 14:47:32 2009 us=57956   ping_timer_remote = DISABLED
Thu Jul 30 14:47:32 2009 us=57993   remap_sigusr1 = 0
Thu Jul 30 14:47:32 2009 us=58002   explicit_exit_notification = 0
Thu Jul 30 14:47:32 2009 us=58011   persist_tun = ENABLED
Thu Jul 30 14:47:32 2009 us=58020   persist_local_ip = DISABLED
Thu Jul 30 14:47:32 2009 us=58029   persist_remote_ip = DISABLED
Thu Jul 30 14:47:32 2009 us=58038   persist_key = ENABLED
Thu Jul 30 14:47:32 2009 us=58047   mssfix = 1450
Thu Jul 30 14:47:32 2009 us=58088   passtos = DISABLED
Thu Jul 30 14:47:32 2009 us=58103   resolve_retry_seconds = 1000000000
Thu Jul 30 14:47:32 2009 us=58137   connect_retry_seconds = 5
Thu Jul 30 14:47:32 2009 us=58150   username = 'nobody'
Thu Jul 30 14:47:32 2009 us=58159   groupname = 'nobody'
Thu Jul 30 14:47:32 2009 us=58168   chroot_dir = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=58176   cd_dir = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=58185   writepid = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=58194   up_script = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=58202   down_script = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=58248   down_pre = DISABLED
Thu Jul 30 14:47:32 2009 us=58260   up_restart = DISABLED
Thu Jul 30 14:47:32 2009 us=58296   up_delay = DISABLED
Thu Jul 30 14:47:32 2009 us=58307   daemon = DISABLED
Thu Jul 30 14:47:32 2009 us=58316   inetd = 0
Thu Jul 30 14:47:32 2009 us=58325   log = DISABLED
Thu Jul 30 14:47:32 2009 us=58334   suppress_timestamps = DISABLED
Thu Jul 30 14:47:32 2009 us=58342   nice = 0
Thu Jul 30 14:47:32 2009 us=58351   verbosity = 4
Thu Jul 30 14:47:32 2009 us=58403   mute = 0
Thu Jul 30 14:47:32 2009 us=58439   gremlin = 0
Thu Jul 30 14:47:32 2009 us=58451   status_file = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=58460   status_file_version = 1
Thu Jul 30 14:47:32 2009 us=58469   status_file_update_freq = 60
Thu Jul 30 14:47:32 2009 us=58477   occ = ENABLED
Thu Jul 30 14:47:32 2009 us=58486   rcvbuf = 65536
Thu Jul 30 14:47:32 2009 us=58495   sndbuf = 65536
Thu Jul 30 14:47:32 2009 us=58504 BEGIN http_proxy
Thu Jul 30 14:47:32 2009 us=58512   server = '
proxyopera.unitn.it
'
Thu Jul 30 14:47:32 2009 us=58521   port = 3128
Thu Jul 30 14:47:32 2009 us=58562   auth_method_string = 'ntlm'
Thu Jul 30 14:47:32 2009 us=58577   auth_file = 'pwproxy'
Thu Jul 30 14:47:32 2009 us=58587   retry = DISABLED
Thu Jul 30 14:47:32 2009 us=58624   timeout = 5
Thu Jul 30 14:47:32 2009 us=58633   http_version = '1.0'
Thu Jul 30 14:47:32 2009 us=58642   user_agent = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=58651 END http_proxy
Thu Jul 30 14:47:32 2009 us=58660   socks_proxy_server = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=58669   socks_proxy_port = 0
Thu Jul 30 14:47:32 2009 us=58678   socks_proxy_retry = DISABLED
Thu Jul 30 14:47:32 2009 us=58728   fast_io = DISABLED
Thu Jul 30 14:47:32 2009 us=58764   comp_lzo = DISABLED
Thu Jul 30 14:47:32 2009 us=58775   comp_lzo_adaptive = ENABLED
Thu Jul 30 14:47:32 2009 us=58784   route_script = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=58793   route_default_gateway = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=58802   route_noexec = DISABLED
Thu Jul 30 14:47:32 2009 us=58811   route_delay = 0
Thu Jul 30 14:47:32 2009 us=58853   route_delay_window = 30
Thu Jul 30 14:47:32 2009 us=58866   route_delay_defined = DISABLED
Thu Jul 30 14:47:32 2009 us=58902   management_addr = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=58914   management_port = 0
Thu Jul 30 14:47:32 2009 us=58924   management_user_pass = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=58933   management_log_history_cache = 250
Thu Jul 30 14:47:32 2009 us=58942   management_echo_buffer_size = 100
Thu Jul 30 14:47:32 2009 us=58952   management_query_passwords =
DISABLED
Thu Jul 30 14:47:32 2009 us=58994   management_hold = DISABLED
Thu Jul 30 14:47:32 2009 us=59008   shared_secret_file = 'luisa.key'
Thu Jul 30 14:47:32 2009 us=59045   key_direction = 0
Thu Jul 30 14:47:32 2009 us=59056   ciphername_defined = ENABLED
Thu Jul 30 14:47:32 2009 us=59066   ciphername = 'BF-CBC'
Thu Jul 30 14:47:32 2009 us=59075   authname_defined = ENABLED
Thu Jul 30 14:47:32 2009 us=59084   authname = 'SHA1'
Thu Jul 30 14:47:32 2009 us=59093   keysize = 0
Thu Jul 30 14:47:32 2009 us=59143   engine = DISABLED
Thu Jul 30 14:47:32 2009 us=59179   replay = ENABLED
Thu Jul 30 14:47:32 2009 us=59191   mute_replay_warnings = DISABLED
Thu Jul 30 14:47:32 2009 us=59200   replay_window = 0
Thu Jul 30 14:47:32 2009 us=59209   replay_time = 0
Thu Jul 30 14:47:32 2009 us=59218   packet_id_file = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=59261   use_iv = ENABLED
Thu Jul 30 14:47:32 2009 us=59273   test_crypto = DISABLED
Thu Jul 30 14:47:32 2009 us=59306   tls_server = DISABLED
Thu Jul 30 14:47:32 2009 us=59320   tls_client = DISABLED
Thu Jul 30 14:47:32 2009 us=59329   key_method = 2
Thu Jul 30 14:47:32 2009 us=59338   ca_file = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=59347   dh_file = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=59389   cert_file = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=59401   priv_key_file = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=59436   pkcs12_file = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=59449   cipher_list = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=59458   tls_verify = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=59467   tls_remote = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=59476   crl_file = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=59519   ns_cert_type = 0
Thu Jul 30 14:47:32 2009 us=59531   tls_timeout = 2
Thu Jul 30 14:47:32 2009 us=59567   renegotiate_bytes = 0
Thu Jul 30 14:47:32 2009 us=59579   renegotiate_packets = 0
Thu Jul 30 14:47:32 2009 us=59588   renegotiate_seconds = 3600
Thu Jul 30 14:47:32 2009 us=59597   handshake_window = 60
Thu Jul 30 14:47:32 2009 us=59607   transition_window = 3600
Thu Jul 30 14:47:32 2009 us=59649   single_session = DISABLED
Thu Jul 30 14:47:32 2009 us=59662   tls_exit = DISABLED
Thu Jul 30 14:47:32 2009 us=59696   tls_auth_file = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=59729   server_network = 0.0.0.0
Thu Jul 30 14:47:32 2009 us=59740   server_netmask = 0.0.0.0
Thu Jul 30 14:47:32 2009 us=59751   server_bridge_ip = 0.0.0.0
Thu Jul 30 14:47:32 2009 us=59804   server_bridge_netmask = 0.0.0.0
Thu Jul 30 14:47:32 2009 us=59953   server_bridge_pool_start = 0.0.0.0
Thu Jul 30 14:47:32 2009 us=60005   server_bridge_pool_end = 0.0.0.0
Thu Jul 30 14:47:32 2009 us=60047   ifconfig_pool_defined = DISABLED
Thu Jul 30 14:47:32 2009 us=60064   ifconfig_pool_start = 0.0.0.0
Thu Jul 30 14:47:32 2009 us=60103   ifconfig_pool_end = 0.0.0.0
Thu Jul 30 14:47:32 2009 us=60115   ifconfig_pool_netmask = 0.0.0.0
Thu Jul 30 14:47:32 2009 us=60160   ifconfig_pool_persist_filename =
'[UNDEF]'
Thu Jul 30 14:47:32 2009 us=60174   ifconfig_pool_persist_refresh_freq
= 600
Thu Jul 30 14:47:32 2009 us=60211   ifconfig_pool_linear = DISABLED
Thu Jul 30 14:47:32 2009 us=60222   n_bcast_buf = 256
Thu Jul 30 14:47:32 2009 us=60231   tcp_queue_limit = 64
Thu Jul 30 14:47:32 2009 us=60241   real_hash_size = 256
Thu Jul 30 14:47:32 2009 us=60286   virtual_hash_size = 256
Thu Jul 30 14:47:32 2009 us=60297   client_connect_script = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=60307   learn_address_script = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=60316   client_disconnect_script =
'[UNDEF]'
Thu Jul 30 14:47:32 2009 us=60326   client_config_dir = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=60335   ccd_exclusive = DISABLED
Thu Jul 30 14:47:32 2009 us=60345   tmp_dir = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=60354   push_ifconfig_defined = DISABLED
Thu Jul 30 14:47:32 2009 us=60365   push_ifconfig_local = 0.0.0.0
Thu Jul 30 14:47:32 2009 us=60375   push_ifconfig_remote_netmask =
0.0.0.0
Thu Jul 30 14:47:32 2009 us=60385   enable_c2c = DISABLED
Thu Jul 30 14:47:32 2009 us=60394   duplicate_cn = DISABLED
Thu Jul 30 14:47:32 2009 us=60404   cf_max = 0
Thu Jul 30 14:47:32 2009 us=60413   cf_per = 0
Thu Jul 30 14:47:32 2009 us=60423   max_clients = 1024
Thu Jul 30 14:47:32 2009 us=60432   max_routes_per_client = 256
Thu Jul 30 14:47:32 2009 us=60442   client_cert_not_required =
DISABLED
Thu Jul 30 14:47:32 2009 us=60451   username_as_common_name = DISABLED
Thu Jul 30 14:47:32 2009 us=60460   auth_user_pass_verify_script =
'[UNDEF]'
Thu Jul 30 14:47:32 2009 us=60470
auth_user_pass_verify_script_via_file = DISABLED
Thu Jul 30 14:47:32 2009 us=60479   client = DISABLED
Thu Jul 30 14:47:32 2009 us=60489   pull = DISABLED
Thu Jul 30 14:47:32 2009 us=60498   auth_user_pass_file = '[UNDEF]'
Thu Jul 30 14:47:32 2009 us=60509 OpenVPN 2.0.9 i686-apple-darwin9.7.0
[SSL] [LZO] built on Jul 28 2009
Thu Jul 30 14:47:32 2009 us=60622 WARNING: file 'pwproxy' is group or
others accessible
Thu Jul 30 14:47:32 2009 us=60964 WARNING: file 'luisa.key' is group
or others accessible
Thu Jul 30 14:47:32 2009 us=61115 Static Encrypt: Cipher 'BF-CBC'
initialized with 128 bit key
Thu Jul 30 14:47:32 2009 us=61165 Static Encrypt: Using 160 bit
message hash 'SHA1' for HMAC authentication
Thu Jul 30 14:47:32 2009 us=61307 Static Decrypt: Cipher 'BF-CBC'
initialized with 128 bit key
Thu Jul 30 14:47:32 2009 us=61339 Static Decrypt: Using 160 bit
message hash 'SHA1' for HMAC authentication
Thu Jul 30 14:47:32 2009 us=61863 TUN/TAP device /dev/tun2 opened
Thu Jul 30 14:47:32 2009 us=61889 /sbin/ifconfig tun2 delete
Thu Jul 30 14:47:32 2009 us=136866 NOTE: Tried to delete pre-existing
tun/tap instance -- No Problem if failure
Thu Jul 30 14:47:32 2009 us=137064 /sbin/ifconfig tun2 10.8.123.2
10.8.123.1 mtu 1500 netmask 255.255.255.255 up
Thu Jul 30 14:47:32 2009 us=153767 Data Channel MTU parms [ L:1546 D:
1450 EF:46 EB:4 ET:0 EL:0 ]
Thu Jul 30 14:47:32 2009 us=153844 Local Options String: 'V4,dev-type
tun,link-mtu 1546,tun-mtu 1500,proto TCPv4_CLIENT,ifconfig 10.8.123.1
10.8.123.2,cipher BF-CBC,auth SHA1,keysize 128,secret'
Thu Jul 30 14:47:32 2009 us=153865 Expected Remote Options String:
'V4,dev-type tun,link-mtu 1546,tun-mtu 1500,proto
TCPv4_SERVER,ifconfig 10.8.123.2 10.8.123.1,cipher BF-CBC,auth
SHA1,keysize 128,secret'
Thu Jul 30 14:47:32 2009 us=154195 Local Options hash (VER=V4):
'843425f4'
Thu Jul 30 14:47:32 2009 us=154215 Expected Remote Options hash
(VER=V4): '2d896ede'
Thu Jul 30 14:47:32 2009 us=156919 GID set to nobody
Thu Jul 30 14:47:32 2009 us=157037 UID set to nobody
Thu Jul 30 14:47:32 2009 us=157073 Attempting to establish TCP
connection with 
193.205.206.22:3128
Thu Jul 30 14:47:32 2009 us=158447 TCP connection established with
193.205.206.22:3128
Thu Jul 30 14:47:32 2009 us=158471 Send to HTTP proxy: 'CONNECT
misterbox.homeunix.org:443
 HTTP/1.0'
Thu Jul 30 14:47:32 2009 us=158507 Attempting NTLM Proxy-Authorization
phase 1
Thu Jul 30 14:47:34 2009 us=256319 HTTP proxy returned: 'HTTP/1.0 200
Connection established'
Thu Jul 30 14:47:36 2009 us=256682 Socket Buffers: R=[525624->65536] S=
[131768->65536]
Thu Jul 30 14:47:36 2009 us=256836 TCPv4_CLIENT link local: [undef]
Thu Jul 30 14:47:36 2009 us=256893 TCPv4_CLIENT link remote:
193.205.206.22:3128
Thu Jul 30 14:47:43 2009 us=955740 Peer Connection Initiated with
193.205.206.22:3128
Thu Jul 30 14:47:45 2009 us=97520 Initialization Sequence Completed

  4  5  00 5400 d28f   0 0000  01  01 38a7 172.26.125.78  10.8.123.2
Questo è un ping dal tuo client, suppongo.
Beh, c'è decisamente qualcosa di strano, visto che non riesci a pingare
un'interfaccia locale...
Cosa dice ip addr ls dev tun2, dopo aver tirato su openvpn?

 Cosa dice ip addr ls dev tun2, dopo aver tirato su openvpn?
iproute non ce l'ho purtroppo sul mac, stasera riprovo anche da linux
(ma avevo gli stessi risultati).
La cosa divertente è che se scambio gli indirizzi ottengo questo
warning (sacrosanto)
Thu Jul 30 15:53:19 2009 us=239537 WARNING: 'ifconfig' is used
inconsistently, local='ifconfig 10.8.123.1 10.8.123.2',
remote='ifconfig 10.8.123.2 10.8.123.1'
Ma poi ho lo stesso risultato in fase di ping..
andreaMb:openvpn andrea$ ifconfig tun2
tun2: flags=8851<UP,POINTOPOINT,RUNNING,SIMPLEX,MULTICAST> mtu 1500
	inet 10.8.123.1 --> 10.8.123.2 netmask 0xffffffff
	open (pid 73602)

 un'interfaccia locale...
Magari dico una caxxata, però a me è successo un problema simile quando 
l'interfaccia "lo" è giù... scoperto l'arcano, maledetto il giorno che 
ho deciso che la rete la alzo a mano, fix degli script e vissero tutti 
felici e contenti.
Enrico

La cosa strana è che ho un altra configurazione praticamente uguale
per collegarmi a un altro server openvpn sempre attraverso proxy.
E no ho provato anche quando l'altro è giù (si collegano entrambi alla
443 del proxy) non è un problema di "conflitti" interni.
Quindi è proprio questo bastardello che non va..
Non c'è qualcosa che non va negli indirizzi magari? (non dovrebbe che
gli cambia?)

 iproute non ce l'ho purtroppo sul mac
In effetti, quel ping aveva un sapor di BSD...:-)
Va bene anche ifconfig, eh, è solo che ormai tendo a usare solo ip.

 Va bene anche ifconfig, eh, è solo che ormai tendo a usare solo ip.
Mi piacerebbe trovare qualcosa tipo iproute su osx ma non ce n'è
traccia (o almeno io non lo trovo)..
Comunque nessuna idea, cosa posso provare a parte il vodoo?
Non posso cambiare gli ip dato che dovrei cambiarli anche sulla
macchina remota che adesso non posso raggiungere, e non saprei che
route aggiungere dato che già me l'aggiunge lui (e pare giusta)...