0

I was able to connect from within my local network connection but from remote site locations the connection looks to be dropping. Could this be a possible firewall issue? I see a connection but it does not stick.

This is my first time playing around with a Mikrotik. I can access the Mikrotik from WinBox just fine remotely.

I have the OpenVPN port open as well. But could another rule drop the connection?

Mon Jul 06 07:30:44 2015   pkcs11_protected_authentication = DISABLED
Mon Jul 06 07:30:44 2015   pkcs11_protected_authentication = DISABLED
Mon Jul 06 07:30:44 2015   pkcs11_protected_authentication = DISABLED
Mon Jul 06 07:30:44 2015   pkcs11_protected_authentication = DISABLED
Mon Jul 06 07:30:44 2015   pkcs11_private_mode = 00000000
Mon Jul 06 07:30:44 2015   pkcs11_private_mode = 00000000
Mon Jul 06 07:30:44 2015   pkcs11_private_mode = 00000000
Mon Jul 06 07:30:44 2015   pkcs11_private_mode = 00000000
Mon Jul 06 07:30:44 2015   pkcs11_private_mode = 00000000
Mon Jul 06 07:30:44 2015   pkcs11_private_mode = 00000000
Mon Jul 06 07:30:44 2015   pkcs11_private_mode = 00000000
Mon Jul 06 07:30:44 2015   pkcs11_private_mode = 00000000
Mon Jul 06 07:30:44 2015   pkcs11_private_mode = 00000000
Mon Jul 06 07:30:44 2015   pkcs11_private_mode = 00000000
Mon Jul 06 07:30:44 2015   pkcs11_private_mode = 00000000
Mon Jul 06 07:30:44 2015   pkcs11_private_mode = 00000000
Mon Jul 06 07:30:44 2015   pkcs11_private_mode = 00000000
Mon Jul 06 07:30:44 2015   pkcs11_private_mode = 00000000
Mon Jul 06 07:30:44 2015   pkcs11_private_mode = 00000000
Mon Jul 06 07:30:44 2015   pkcs11_private_mode = 00000000
Mon Jul 06 07:30:44 2015   pkcs11_cert_private = DISABLED
Mon Jul 06 07:30:44 2015   pkcs11_cert_private = DISABLED
Mon Jul 06 07:30:44 2015   pkcs11_cert_private = DISABLED
Mon Jul 06 07:30:44 2015   pkcs11_cert_private = DISABLED
Mon Jul 06 07:30:44 2015   pkcs11_cert_private = DISABLED
Mon Jul 06 07:30:44 2015   pkcs11_cert_private = DISABLED
Mon Jul 06 07:30:44 2015   pkcs11_cert_private = DISABLED
Mon Jul 06 07:30:44 2015   pkcs11_cert_private = DISABLED
Mon Jul 06 07:30:44 2015   pkcs11_cert_private = DISABLED
Mon Jul 06 07:30:44 2015   pkcs11_cert_private = DISABLED
Mon Jul 06 07:30:44 2015   pkcs11_cert_private = DISABLED
Mon Jul 06 07:30:44 2015   pkcs11_cert_private = DISABLED
Mon Jul 06 07:30:44 2015   pkcs11_cert_private = DISABLED
Mon Jul 06 07:30:44 2015   pkcs11_cert_private = DISABLED
Mon Jul 06 07:30:44 2015   pkcs11_cert_private = DISABLED
Mon Jul 06 07:30:44 2015   pkcs11_cert_private = DISABLED
Mon Jul 06 07:30:44 2015   pkcs11_pin_cache_period = -1
Mon Jul 06 07:30:44 2015   pkcs11_id = '[UNDEF]'
Mon Jul 06 07:30:44 2015   pkcs11_id_management = DISABLED
Mon Jul 06 07:30:44 2015   server_network = 0.0.0.0
Mon Jul 06 07:30:44 2015   server_netmask = 0.0.0.0
Mon Jul 06 07:30:44 2015   server_network_ipv6 = ::
Mon Jul 06 07:30:44 2015   server_netbits_ipv6 = 0
Mon Jul 06 07:30:44 2015   server_bridge_ip = 0.0.0.0
Mon Jul 06 07:30:44 2015   server_bridge_netmask = 0.0.0.0
Mon Jul 06 07:30:44 2015   server_bridge_pool_start = 0.0.0.0
Mon Jul 06 07:30:44 2015   server_bridge_pool_end = 0.0.0.0
Mon Jul 06 07:30:44 2015   ifconfig_pool_defined = DISABLED
Mon Jul 06 07:30:44 2015   ifconfig_pool_start = 0.0.0.0
Mon Jul 06 07:30:44 2015   ifconfig_pool_end = 0.0.0.0
Mon Jul 06 07:30:44 2015   ifconfig_pool_netmask = 0.0.0.0
Mon Jul 06 07:30:44 2015   ifconfig_pool_persist_filename = '[UNDEF]'
Mon Jul 06 07:30:44 2015   ifconfig_pool_persist_refresh_freq = 600
Mon Jul 06 07:30:44 2015   ifconfig_ipv6_pool_defined = DISABLED
Mon Jul 06 07:30:44 2015   ifconfig_ipv6_pool_base = ::
Mon Jul 06 07:30:44 2015   ifconfig_ipv6_pool_netbits = 0
Mon Jul 06 07:30:44 2015   n_bcast_buf = 256
Mon Jul 06 07:30:44 2015   tcp_queue_limit = 64
Mon Jul 06 07:30:44 2015   real_hash_size = 256
Mon Jul 06 07:30:44 2015   virtual_hash_size = 256
Mon Jul 06 07:30:44 2015   client_connect_script = '[UNDEF]'
Mon Jul 06 07:30:44 2015   learn_address_script = '[UNDEF]'
Mon Jul 06 07:30:44 2015   client_disconnect_script = '[UNDEF]'
Mon Jul 06 07:30:44 2015   client_config_dir = '[UNDEF]'
Mon Jul 06 07:30:44 2015   ccd_exclusive = DISABLED
Mon Jul 06 07:30:44 2015   tmp_dir = 'C:\Users\thekitten\AppData\Local\Temp\'
Mon Jul 06 07:30:44 2015   push_ifconfig_defined = DISABLED
Mon Jul 06 07:30:44 2015   push_ifconfig_local = 0.0.0.0
Mon Jul 06 07:30:44 2015   push_ifconfig_remote_netmask = 0.0.0.0
Mon Jul 06 07:30:44 2015   push_ifconfig_ipv6_defined = DISABLED
Mon Jul 06 07:30:44 2015   push_ifconfig_ipv6_local = ::/0
Mon Jul 06 07:30:44 2015   push_ifconfig_ipv6_remote = ::
Mon Jul 06 07:30:44 2015   enable_c2c = DISABLED
Mon Jul 06 07:30:44 2015   duplicate_cn = DISABLED
Mon Jul 06 07:30:44 2015   cf_max = 0
Mon Jul 06 07:30:44 2015   cf_per = 0
Mon Jul 06 07:30:44 2015   max_clients = 1024
Mon Jul 06 07:30:44 2015   max_routes_per_client = 256
Mon Jul 06 07:30:44 2015   auth_user_pass_verify_script = '[UNDEF]'
Mon Jul 06 07:30:44 2015   auth_user_pass_verify_script_via_file = DISABLED
Mon Jul 06 07:30:44 2015   client = DISABLED
Mon Jul 06 07:30:44 2015   pull = ENABLED
Mon Jul 06 07:30:44 2015   auth_user_pass_file = 'stdin'
Mon Jul 06 07:30:44 2015   show_net_up = DISABLED
Mon Jul 06 07:30:44 2015   route_method = 0
Mon Jul 06 07:30:44 2015   ip_win32_defined = DISABLED
Mon Jul 06 07:30:44 2015   ip_win32_type = 3
Mon Jul 06 07:30:44 2015   dhcp_masq_offset = 0
Mon Jul 06 07:30:44 2015   dhcp_lease_time = 31536000
Mon Jul 06 07:30:44 2015   tap_sleep = 0
Mon Jul 06 07:30:44 2015   dhcp_options = DISABLED
Mon Jul 06 07:30:44 2015   dhcp_renew = DISABLED
Mon Jul 06 07:30:44 2015   dhcp_pre_release = DISABLED
Mon Jul 06 07:30:44 2015   dhcp_release = DISABLED
Mon Jul 06 07:30:44 2015   domain = '[UNDEF]'
Mon Jul 06 07:30:44 2015   netbios_scope = '[UNDEF]'
Mon Jul 06 07:30:44 2015   netbios_node_type = 0
Mon Jul 06 07:30:44 2015   disable_nbt = DISABLED
Mon Jul 06 07:30:44 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar 19 2015
Mon Jul 06 07:30:44 2015 library versions: OpenSSL 1.0.1m 19 Mar 2015, LZO 2.08
Mon Jul 06 07:30:44 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Mon Jul 06 07:30:44 2015 Need hold release from management interface, waiting...
Mon Jul 06 07:30:44 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Mon Jul 06 07:30:44 2015 MANAGEMENT: CMD 'state on'
Mon Jul 06 07:30:44 2015 MANAGEMENT: CMD 'log all on'
Mon Jul 06 07:30:45 2015 MANAGEMENT: CMD 'hold off'
Mon Jul 06 07:30:45 2015 MANAGEMENT: CMD 'hold release'
Mon Jul 06 07:30:52 2015 MANAGEMENT: CMD 'username "Auth" "vpnthekitten"'
Mon Jul 06 07:30:52 2015 MANAGEMENT: CMD 'password [...]'
Mon Jul 06 07:30:52 2015 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Jul 06 07:30:52 2015 Control Channel MTU parms [ L:1543 D:140 EF:40 EB:0 ET:0 EL:0 ]
Mon Jul 06 07:30:52 2015 Socket Buffers: R=[65536->65536] S=[65536->65536]
Mon Jul 06 07:30:52 2015 Data Channel MTU parms [ L:1543 D:1450 EF:43 EB:4 ET:0 EL:0 ]
Mon Jul 06 07:30:52 2015 Local Options String: 'V4,dev-type tun,link-mtu 1543,tun-mtu 1500,proto TCPv4_CLIENT,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Jul 06 07:30:52 2015 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1543,tun-mtu 1500,proto TCPv4_SERVER,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Jul 06 07:30:52 2015 Local Options hash (VER=V4): 'db02a8f8'
Mon Jul 06 07:30:52 2015 Expected Remote Options hash (VER=V4): '7e068940'
Mon Jul 06 07:30:52 2015 Attempting to establish TCP connection with [AF_INET]123.456.789.000:1194 [nonblock]
Mon Jul 06 07:30:52 2015 MANAGEMENT: >STATE:1436182252,TCP_CONNECT,,,
Mon Jul 06 07:30:53 2015 TCP connection established with [AF_INET]123.456.789.000:1194
Mon Jul 06 07:30:53 2015 TCPv4_CLIENT link local: [undef]
Mon Jul 06 07:30:53 2015 TCPv4_CLIENT link remote: [AF_INET]123.456.789.000:1194
Mon Jul 06 07:30:53 2015 MANAGEMENT: >STATE:1436182253,WAIT,,,
Mon Jul 06 07:30:53 2015 MANAGEMENT: >STATE:1436182253,AUTH,,,
Mon Jul 06 07:30:53 2015 TLS: Initial packet from [AF_INET]123.456.789.000:1194, sid=b64d00ba 4b8abc72
Mon Jul 06 07:30:53 2015 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mon Jul 06 07:30:53 2015 VERIFY OK: depth=1, C=US, ST=CA, L=MEOW, O=MEOW, OU=KITTENS, CN=MEOW CA, name=EasyRSA, emailAddress=kittens@meow.tld
Mon Jul 06 07:30:53 2015 VERIFY OK: depth=0, C=US, ST=CA, L=MEOW, O=MEOW, OU=KITTENS, CN=openvpn, name=EasyRSA, emailAddress=kittens@meow.tld
Mon Jul 06 07:30:55 2015 Connection reset, restarting [0]
Mon Jul 06 07:30:55 2015 TCP/UDP: Closing socket
Mon Jul 06 07:30:55 2015 SIGUSR1[soft,connection-reset] received, process restarting
Mon Jul 06 07:30:55 2015 MANAGEMENT: >STATE:1436182255,RECONNECTING,connection-reset,,
Mon Jul 06 07:30:55 2015 Restart pause, 5 second(s)
Mon Jul 06 07:31:00 2015 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Jul 06 07:31:00 2015 Re-using SSL/TLS context
Mon Jul 06 07:31:00 2015 Control Channel MTU parms [ L:1543 D:140 EF:40 EB:0 ET:0 EL:0 ]
Mon Jul 06 07:31:00 2015 Socket Buffers: R=[65536->65536] S=[65536->65536]
Mon Jul 06 07:31:00 2015 Data Channel MTU parms [ L:1543 D:1450 EF:43 EB:4 ET:0 EL:0 ]
Mon Jul 06 07:31:00 2015 Local Options String: 'V4,dev-type tun,link-mtu 1543,tun-mtu 1500,proto TCPv4_CLIENT,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Jul 06 07:31:00 2015 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1543,tun-mtu 1500,proto TCPv4_SERVER,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Jul 06 07:31:00 2015 Local Options hash (VER=V4): 'db02a8f8'
Mon Jul 06 07:31:00 2015 Expected Remote Options hash (VER=V4): '7e068940'
Mon Jul 06 07:31:00 2015 Attempting to establish TCP connection with [AF_INET]123.456.789.000:1194 [nonblock]
Mon Jul 06 07:31:00 2015 MANAGEMENT: >STATE:1436182260,TCP_CONNECT,,,
Mon Jul 06 07:31:01 2015 TCP connection established with [AF_INET]123.456.789.000:1194
Mon Jul 06 07:31:01 2015 TCPv4_CLIENT link local: [undef]
Mon Jul 06 07:31:01 2015 TCPv4_CLIENT link remote: [AF_INET]123.456.789.000:1194
Mon Jul 06 07:31:01 2015 MANAGEMENT: >STATE:1436182261,WAIT,,,
Mon Jul 06 07:31:01 2015 MANAGEMENT: >STATE:1436182261,AUTH,,,
Mon Jul 06 07:31:01 2015 TLS: Initial packet from [AF_INET]123.456.789.000:1194, sid=575ea56f 8a8dcaf7
Mon Jul 06 07:31:02 2015 VERIFY OK: depth=1, C=US, ST=CA, L=MEOW, O=MEOW, OU=KITTENS, CN=MEOW CA, name=EasyRSA, emailAddress=kittens@meow.tld
Mon Jul 06 07:31:02 2015 VERIFY OK: depth=0, C=US, ST=CA, L=MEOW, O=MEOW, OU=KITTENS, CN=openvpn, name=EasyRSA, emailAddress=kittens@meow.tld
Mon Jul 06 07:31:02 2015 Connection reset, restarting [0]
Mon Jul 06 07:31:02 2015 TCP/UDP: Closing socket
Mon Jul 06 07:31:02 2015 SIGUSR1[soft,connection-reset] received, process restarting
Mon Jul 06 07:31:02 2015 MANAGEMENT: >STATE:1436182262,RECONNECTING,connection-reset,,
Mon Jul 06 07:31:02 2015 Restart pause, 5 second(s)
Mon Jul 06 07:31:07 2015 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Jul 06 07:31:07 2015 Re-using SSL/TLS context
Mon Jul 06 07:31:07 2015 Control Channel MTU parms [ L:1543 D:140 EF:40 EB:0 ET:0 EL:0 ]
Mon Jul 06 07:31:07 2015 Socket Buffers: R=[65536->65536] S=[65536->65536]
Mon Jul 06 07:31:07 2015 Data Channel MTU parms [ L:1543 D:1450 EF:43 EB:4 ET:0 EL:0 ]
Mon Jul 06 07:31:07 2015 Local Options String: 'V4,dev-type tun,link-mtu 1543,tun-mtu 1500,proto TCPv4_CLIENT,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Jul 06 07:31:07 2015 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1543,tun-mtu 1500,proto TCPv4_SERVER,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Jul 06 07:31:07 2015 Local Options hash (VER=V4): 'db02a8f8'
Mon Jul 06 07:31:07 2015 Expected Remote Options hash (VER=V4): '7e068940'
Mon Jul 06 07:31:07 2015 Attempting to establish TCP connection with [AF_INET]123.456.789.000:1194 [nonblock]
Mon Jul 06 07:31:07 2015 MANAGEMENT: >STATE:1436182267,TCP_CONNECT,,,
Mon Jul 06 07:31:08 2015 TCP connection established with [AF_INET]123.456.789.000:1194
Mon Jul 06 07:31:08 2015 TCPv4_CLIENT link local: [undef]
Mon Jul 06 07:31:08 2015 TCPv4_CLIENT link remote: [AF_INET]123.456.789.000:1194
Mon Jul 06 07:31:08 2015 MANAGEMENT: >STATE:1436182268,WAIT,,,
Mon Jul 06 07:31:08 2015 MANAGEMENT: >STATE:1436182268,AUTH,,,
Mon Jul 06 07:31:08 2015 TLS: Initial packet from [AF_INET]123.456.789.000:1194, sid=63deba2d bde9236c
Mon Jul 06 07:31:09 2015 VERIFY OK: depth=1, C=US, ST=CA, L=MEOW, O=MEOW, OU=KITTENS, CN=MEOW CA, name=EasyRSA, emailAddress=kittens@meow.tld
Mon Jul 06 07:31:09 2015 VERIFY OK: depth=0, C=US, ST=CA, L=MEOW, O=MEOW, OU=KITTENS, CN=openvpn, name=EasyRSA, emailAddress=kittens@meow.tld
Mon Jul 06 07:31:10 2015 Connection reset, restarting [0]
Mon Jul 06 07:31:10 2015 TCP/UDP: Closing socket
Mon Jul 06 07:31:10 2015 SIGUSR1[soft,connection-reset] received, process restarting
Mon Jul 06 07:31:10 2015 MANAGEMENT: >STATE:1436182270,RECONNECTING,connection-reset,,
Mon Jul 06 07:31:10 2015 Restart pause, 5 second(s)

CLIENT:

dev tun
remote home-ip 1194
proto tcp-client
resolv-retry infinite
nobind
pull
persist-key
persist-tun
verb 5
auth-user-pass
tls-client
<ca>
-----END CERTIFICATE-----
</ca>
route 192.168.2.0 255.255.255.0 172.25.10.1

enter image description here

Jason
  • 3,821
  • 17
  • 65
  • 106
  • What do Mikrotik's Logs say? You can enable debug logging for OpenVPN in `/system logging` – Cha0s Jul 06 '15 at 15:46
  • It's using TCP. Mikrotik does not support UDP. I'll enable the logs and post those when I get a chance. – Jason Jul 06 '15 at 17:07
  • How do you log or pull the openvpn logs? – Jason Jul 06 '15 at 23:22
  • When you say it drops the connection you mean that it does connect and then it disconnects after a while? Taking a wild guess here: If so, when you connect, can you ping the openvpn IP from the client? If not, maybe you need to add a static route for that IP so that when the vpn connection is established the packets to the vpn server won't go through the vpn itself. – Cha0s Aug 10 '15 at 17:32

0 Answers0