After reading the **** manual, I’veconfigured an openvpn server on linux with the following configuration :
dev tap3
port 12003
proto tcp-server
persist-key
persist-tun
local 1.2.3.4
tls-server
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
user nobody
group nogroup
status status-br3
verb 5
cipher AES-256-CBC
auth sha1
plugin /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so login
keepalive 10 120
script-security 3
and setup the associated configuration on routeros :
0 X name="ovpn-bridge" mac-address=FE:15:CA:71:AC:FA max-mtu=1500 connect-to= 1.2.3.4 port=12003 mode=ethernet
user="username" password="password" profile=default certificate=client.crt_0 verify-server-certificate=no
auth=sha1 cipher=aes256 add-default-route=no
When enabling the client, it starts to connect, TLS seems to run fine, authentication is performed and successful as seen on the server :
Wed Jan 15 15:58:40 2020 us=172751 TLS: Username/Password authentication succeeded for username 'username'
Wed Jan 15 15:58:40 2020 us=172932 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Jan 15 15:58:40 2020 us=172955 Outgoing Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jan 15 15:58:40 2020 us=172967 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Jan 15 15:58:40 2020 us=172979 Incoming Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
WRWed Jan 15 15:58:40 2020 us=188396 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Wed Jan 15 15:58:40 2020 us=188446 [Test-Client] Peer Connection Initiated with [AF_INET]100.76.51.41:39470
RRWed Jan 15 15:58:40 2020 us=298915 PUSH: Received control message: 'PUSH_REQUEST'
Wed Jan 15 15:58:40 2020 us=298976 SENT CONTROL [Test-Client]: 'PUSH_REPLY' (status=1)
WWRWed Jan 15 15:58:40 2020 us=367930 Connection reset, restarting [0]
… but there is a reset that seems to come from the client, which shows the following
16:07:02 echo: ovpn,info ovpn-bridge: initializing...
16:07:02 echo: ovpn,info ovpn-bridge: connecting...
16:07:02 echo: ovpn,debug,packet sent P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 sid=96cc9cbdefcc491 pid=0 DATA len=0
16:07:03 echo: ovpn,debug,packet rcvd P_CONTROL_HARD_RESET_SERVER_V2 kid=0 sid=7fd2f479d3bf811f [0 sid=96cc9cbdefcc491] pid=0 DATA len=0
16:07:03 echo: ovpn,debug,packet sent P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 sid=96cc9cbdefcc491 [0 sid=7fd2f479d3bf811f] pid=1 DATA len=0
16:07:03 echo: ovpn,debug,packet rcvd P_ACK kid=0 sid=7fd2f479d3bf811f [1 sid=96cc9cbdefcc491] DATA len=0
16:07:03 echo: ovpn,debug,packet sent P_CONTROL kid=0 sid=96cc9cbdefcc491 pid=2 DATA len=295
16:07:03 echo: ovpn,debug,packet rcvd P_CONTROL kid=0 sid=7fd2f479d3bf811f [2 sid=96cc9cbdefcc491] pid=1 DATA len=1170
16:07:03 echo: ovpn,debug,packet sent P_ACK kid=0 sid=96cc9cbdefcc491 [1 sid=7fd2f479d3bf811f] DATA len=0
16:07:03 echo: ovpn,debug,packet rcvd P_CONTROL kid=0 sid=7fd2f479d3bf811f pid=2 DATA len=1170
16:07:03 echo: ovpn,debug,packet sent P_ACK kid=0 sid=96cc9cbdefcc491 [2 sid=7fd2f479d3bf811f] DATA len=0
16:07:03 echo: ovpn,debug,packet rcvd P_CONTROL kid=0 sid=7fd2f479d3bf811f pid=3 DATA len=1170
16:07:03 echo: ovpn,debug,packet sent P_ACK kid=0 sid=96cc9cbdefcc491 [3 sid=7fd2f479d3bf811f] DATA len=0
16:07:03 echo: ovpn,debug,packet rcvd P_CONTROL kid=0 sid=7fd2f479d3bf811f pid=4 DATA len=111
16:07:03 echo: ovpn,debug,packet sent P_ACK kid=0 sid=96cc9cbdefcc491 [4 sid=7fd2f479d3bf811f] DATA len=0
16:07:03 echo: ovpn,debug,packet sent P_CONTROL kid=0 sid=96cc9cbdefcc491 pid=4 DATA len=1400
16:07:03 echo: ovpn,debug,packet sent P_CONTROL kid=0 sid=96cc9cbdefcc491 pid=5 DATA len=530
16:07:03 echo: ovpn,debug,packet rcvd P_ACK kid=0 sid=7fd2f479d3bf811f [3 sid=96cc9cbdefcc491] DATA len=0
16:07:03 echo: ovpn,debug,packet rcvd P_ACK kid=0 sid=7fd2f479d3bf811f [4 sid=96cc9cbdefcc491] DATA len=0
16:07:04 echo: ovpn,debug,packet rcvd P_CONTROL kid=0 sid=7fd2f479d3bf811f [5 sid=96cc9cbdefcc491] pid=5 DATA len=51
16:07:04 echo: ovpn,debug,packet sent P_ACK kid=0 sid=96cc9cbdefcc491 [5 sid=7fd2f479d3bf811f] DATA len=0
16:07:04 echo: ovpn,debug,packet sent P_CONTROL kid=0 sid=96cc9cbdefcc491 pid=6 DATA len=297
16:07:04 echo: ovpn,debug,packet rcvd P_CONTROL kid=0 sid=7fd2f479d3bf811f [6 sid=96cc9cbdefcc491] pid=6 DATA len=233
16:07:04 echo: ovpn,debug,packet sent P_ACK kid=0 sid=96cc9cbdefcc491 [6 sid=7fd2f479d3bf811f] DATA len=0
16:07:04 echo: ovpn,info ovpn-bridge: using encoding - AES-256-CBC/SHA1
16:07:04 echo: ovpn,debug,packet sent P_ACK kid=0 sid=96cc9cbdefcc491 DATA len=0
16:07:04 echo: ovpn,debug,packet sent P_CONTROL kid=0 sid=96cc9cbdefcc491 pid=7 DATA len=42
16:07:04 echo: ovpn,debug,packet rcvd P_ACK kid=0 sid=7fd2f479d3bf811f [7 sid=96cc9cbdefcc491] DATA len=0
16:07:04 echo: ovpn,debug,packet rcvd P_CONTROL kid=0 sid=7fd2f479d3bf811f pid=7 DATA len=40
16:07:04 echo: ovpn,debug,packet sent P_ACK kid=0 sid=96cc9cbdefcc491 [7 sid=7fd2f479d3bf811f] DATA len=0
16:07:04 echo: ovpn,debug ovpn-bridge: disconnected <no ip address provided>
16:07:04 echo: ovpn,info ovpn-bridge: terminating... - no ip address provided
16:07:04 echo: ovpn,info ovpn-bridge: disconnected
It’s for a bridge, so no reason to provide an IP address…
Any hint ?