Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Lots of issues with pivpn this time around #617

Closed
Fayyaadh opened this issue Oct 7, 2018 · 35 comments

Comments

@Fayyaadh
Copy link

commented Oct 7, 2018

PiVPN Issue Template

My previous install of pivpn went ok but I need to reinstall using another SD because I suspect my old one was giving up.

I put the latest image of Raspbian Stretch Lite onto the SD card and ran the installer command.

Lots of issues.

Firstly, the 2048 bit keys generate very quickly, something is wrong. It's supposed to take very long on a pi.

Next, when generating the ovpns folder, it seems that the variable for the INSTALL_USER isn't created even though I chose the user "pi" during install.

Have you searched for similar issues and solutions?

(yes) 

Console output of curl -L install.pivpn.io | bash

pi@raspberrypi:~ $ curl -L https://install.pivpn.io | bash
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   178  100   178    0     0     84      0  0:00:02  0:00:02 --:--:--    84
100 51064  100 51064    0     0  18177      0  0:00:02  0:00:02 --:--:--  127k
:::
::: sudo will be used for the install.
::: Verifying free disk space...
:::
::: apt-get update has not been run today. Running now... done!
:::
::: Checking apt-get for upgraded packages.... done!
:::
::: There are 48 updates available for your system!
::: We recommend you update your OS after installing PiVPN!
:::
:::
::: Setting IP to 192.168.0.104.  You may need to restart after the install is c
:::
::: Using User: pi
:::
::: Checking for existing base files...
:::    Checking /etc/.pivpn is a repo...:::    Cloning https://github.com/pivpn/
:::
::: Stopping OpenVPN service... done.
:::
::: Installing scripts to /opt/pivpn... done.
::: Using protocol: udp
::: Building CA...
Generating a 2048 bit RSA private key
.....................+++
.................................................+++
writing new private key to '/etc/openvpn/easy-rsa/pki/private/ca.key.Pa1YWdqnuj'
-----

::: CA Complete.

Note: using Easy-RSA configuration from: ./vars
rand: Use -help for summary.
Generating a 2048 bit RSA private key
...........+++
....................................................+++
writing new private key to '/etc/openvpn/easy-rsa/pki/private/server_3kClcY1KKej
-----
Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.cnf
Can't open /etc/openvpn/easy-rsa/pki/index.txt.attr for reading, No such file or
3069894656:error:02001002:system library:fopen:No such file or directory:../cryp
3069894656:error:2006D080:BIO routines:BIO_new_file:no such file:../crypto/bio/b
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'server_3kClcY1KKejx4hry'
Certificate is to be certified until Oct  4 09:50:58 2028 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated

Note: using Easy-RSA configuration from: ./vars
Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.cnf

An updated CRL has been created.
CRL file: /etc/openvpn/easy-rsa/pki/crl.pem

net.ipv4.ip_forward = 1
run-parts: executing /usr/share/netfilter-persistent/plugins.d/15-ip4tables save
run-parts: executing /usr/share/netfilter-persistent/plugins.d/25-ip6tables save
dig failed, now trying to curl eth0.me
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0cu
eth0.me failed, please check your internet connection/DNS
::: Install Complete...
::: Restarting services...
Synchronizing state of openvpn.service with SysV service script with /lib/system
Executing: /lib/systemd/systemd-sysv-install enable openvpn
::: done.
:::
::: Installation Complete!
::: Now run 'pivpn add' to create an ovpn profile for each of your devices.
::: Run 'pivpn help' to see what else you can do!
::: It is strongly recommended you reboot after installation.
:::
::: The install log is located at: /etc/pivpn/install.log

Console output of pivpn add or pivpn add nopass

pi@raspberrypi:/etc/openvpn $ pivpn add nopass
cat: /etc/pivpn/INSTALL_USER: No such file or directory
Enter a Name for the Client:  iphone
spawn ./easyrsa build-client-full iphone nopass

Note: using Easy-RSA configuration from: ./vars
rand: Use -help for summary.
Generating a 2048 bit RSA private key
..........................................+++
.......................................................................................+++
writing new private key to '/etc/openvpn/easy-rsa/pki/private/iphone.key.hExX12KwSZ'
-----
Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'iphone'
Certificate is to be certified until Oct  4 09:55:50 2028 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated
Client's cert found: iphone.crt
Client's Private Key found: iphone.key
CA public Key found: ca.crt
tls-auth Private Key found: ta.key
cat: Default.txt: No such file or directory
cp: cannot create regular file '/home//ovpns/iphone.ovpn': No such file or directory
chown: cannot access '/home//ovpns/iphone.ovpn': No such file or directory


========================================================
Done! iphone.ovpn successfully created!
iphone.ovpn was copied to:
  /home//ovpns
for easy transfer. Please use this profile only on one
device and create additional profiles for other devices.
========================================================

Console output of pivpn debug

pi@raspberrypi:/etc/openvpn $ pivpn debug
::: Generating Debug Output
:::                                     :::
::              PiVPN Debug              ::
:::                                     :::
::      Latest Commit                    ::
:::                                     :::
commit de76940b65bab86eda772158da58328482363559
Merge: 18bfa92 58fcaaf
Author: redfast00 <redfast00@users.noreply.github.com>
Date:   Wed Aug 15 21:17:33 2018 +0200

    Merge pull request #554 from Giraffe1966/issue-552

    Fix issue #552 (remove dead code)
:::                                     :::
::      Recursive list of files in       ::
::      /etc/openvpn/easy-rsa/pki        ::
:::                                     :::
/etc/openvpn/easy-rsa/pki/:
ca.crt
crl.pem
index.txt
index.txt.attr
index.txt.attr.old
index.txt.old
iphone.ovpn
issued
private
serial
serial.old
ta.key

/etc/openvpn/easy-rsa/pki/issued:
iphone.crt
server_3kClcY1KKejx4hry.crt

/etc/openvpn/easy-rsa/pki/private:
ca.key
iphone.key
server_3kClcY1KKejx4hry.key
:::                                     :::
::      Output of /etc/pivpn/*           ::
:::                                     :::
:: START /etc/pivpn/INSTALL_PORT ::
1195
:: END /etc/pivpn/INSTALL_PORT ::
:: START /etc/pivpn/INSTALL_PROTO ::
udp
:: END /etc/pivpn/INSTALL_PROTO ::
:: START /etc/pivpn/NO_UFW ::
1
:: END /etc/pivpn/NO_UFW ::
:: START /etc/pivpn/pivpnINTERFACE ::
eth0
:: END /etc/pivpn/pivpnINTERFACE ::
:: START /etc/pivpn/TWO_POINT_FOUR ::
:: END /etc/pivpn/TWO_POINT_FOUR ::
:::                                     :::
:: /etc/openvpn/easy-rsa/pki/Default.txt ::
:::                                     :::
cat: /etc/openvpn/easy-rsa/pki/Default.txt: No such file or directory
:::                                     :::
::      Debug Output Complete            ::
:::                                     :::
:::
::: Debug output completed above.
::: Copy saved to /tmp/debug.txt
:::

Console Output of sudo iptables -t nat -S

  Output Here

Console Output of sudo iptables -S

  Output Here

output of sudo netstat -uanp | grep openvpn

  Output Here

Have you taken any steps towards solving your issue?

@orazioedoardo

This comment has been minimized.

Copy link
Contributor

commented Oct 7, 2018

That INSTALL_USER issue showed up several times but I failed to reproduce the issue. Can you try this? #521 (comment)

@Fayyaadh

This comment has been minimized.

Copy link
Author

commented Oct 9, 2018

I'm sorry I only saw your comment now, not sure why I didn't get an email notification about it.

Anyways, I can test tomorrow no problem.

I think you should be able to reproduce it on a fresh install of Raspbian Stretch Lite.

Also, the other issue is that the ovpn file only had the keys in it and not the actual guts of the client config. Saw in another issue someone had exactly the same issue.

@Fayyaadh

This comment has been minimized.

Copy link
Author

commented Oct 10, 2018

One question, do I remove the set -u line at the top and replace it with set -v and set -x? Or do I have all 3 in the script?

@orazioedoardo

This comment has been minimized.

Copy link
Contributor

commented Oct 10, 2018

No you don’t need to remove it, just add those two.

@Fayyaadh

This comment has been minimized.

Copy link
Author

commented Oct 10, 2018

Ok, I'm at work right now but I'll post the results in the next 10 hours once I'm home.

@troyfontaine

This comment has been minimized.

Copy link

commented Oct 10, 2018

I encountered this issue after I had removed the nopasswd for my user from sudoers. The script said it was using sudo-but since it didn't prompt for the password it looks like it was failing but didn't bother to cease execution.

@Fayyaadh

This comment has been minimized.

Copy link
Author

commented Oct 10, 2018

This is the output when I have set -u, set -v and set -x at the beginning of the script:

pi@raspberrypi:~ $ ./install_pivpn.sh
set -x
######## VARIABLES #########

tmpLog="/tmp/pivpn-install.log"
+ tmpLog=/tmp/pivpn-install.log
instalLogLoc="/etc/pivpn/install.log"
+ instalLogLoc=/etc/pivpn/install.log
setupVars=/etc/pivpn/setupVars.conf
+ setupVars=/etc/pivpn/setupVars.conf
useUpdateVars=false
+ useUpdateVars=false

### PKG Vars ###
PKG_MANAGER="apt-get"
+ PKG_MANAGER=apt-get
PKG_CACHE="/var/lib/apt/lists/"
+ PKG_CACHE=/var/lib/apt/lists/
UPDATE_PKG_CACHE="${PKG_MANAGER} update"
+ UPDATE_PKG_CACHE='apt-get update'
PKG_INSTALL="${PKG_MANAGER} --yes --no-install-recommends install"
+ PKG_INSTALL='apt-get --yes --no-install-recommends install'
PKG_COUNT="${PKG_MANAGER} -s -o Debug::NoLocking=true upgrade | grep -c ^Inst || true"
+ PKG_COUNT='apt-get -s -o Debug::NoLocking=true upgrade | grep -c ^Inst || true'
PIVPN_DEPS=( openvpn git dhcpcd5 tar wget grep iptables-persistent dnsutils expect whiptail net-tools)
+ PIVPN_DEPS=(openvpn git dhcpcd5 tar wget grep iptables-persistent dnsutils expect whiptail net-tools)
###          ###

pivpnGitUrl="https://github.com/pivpn/pivpn.git"
+ pivpnGitUrl=https://github.com/pivpn/pivpn.git
pivpnFilesDir="/etc/.pivpn"
+ pivpnFilesDir=/etc/.pivpn
easyrsaVer="3.0.1-pivpn1"
+ easyrsaVer=3.0.1-pivpn1
easyrsaRel="https://github.com/pivpn/easy-rsa/releases/download/${easyrsaVer}/EasyRSA-${easyrsaVer}.tgz"
+ easyrsaRel=https://github.com/pivpn/easy-rsa/releases/download/3.0.1-pivpn1/EasyRSA-3.0.1-pivpn1.tgz

# Find the rows and columns. Will default to 80x24 if it can not be detected.
screen_size=$(stty size 2>/dev/null || echo 24 80)
++ stty size
+ screen_size='49 122'
rows=$(echo $screen_size | awk '{print $1}')
++ echo 49 122
++ awk '{print $1}'
+ rows=49
columns=$(echo $screen_size | awk '{print $2}')
++ echo 49 122
++ awk '{print $2}'
+ columns=122

# Divide by two so the dialogs take up half of the screen, which looks nice.
r=$(( rows / 2 ))
+ r=24
c=$(( columns / 2 ))
+ c=61
# Unless the screen is tiny
r=$(( r < 20 ? 20 : r ))
+ r=24
c=$(( c < 70 ? 70 : c ))
+ c=70

######## Undocumented Flags. Shhh ########
skipSpaceCheck=false
+ skipSpaceCheck=false
reconfigure=false
+ reconfigure=false
runUnattended=false
+ runUnattended=false

# Find IP used to route to outside world

IPv4dev=$(ip route get 8.8.8.8 | awk '{for(i=1;i<=NF;i++)if($i~/dev/)print $(i+1)}')
++ ip route get 8.8.8.8
++ awk '{for(i=1;i<=NF;i++)if($i~/dev/)print $(i+1)}'
+ IPv4dev=eth0
IPv4addr=$(ip route get 8.8.8.8| awk '{print $7}')
++ ip route get 8.8.8.8
++ awk '{print $7}'
+ IPv4addr=192.168.0.104
IPv4gw=$(ip route get 8.8.8.8 | awk '{print $3}')
++ ip route get 8.8.8.8
++ awk '{print $3}'
+ IPv4gw=192.168.0.1

availableInterfaces=$(ip -o link | grep "state UP" | awk '{print $2}' | cut -d':' -f1 | cut -d'@' -f1)
++ ip -o link
++ grep 'state UP'
++ cut -d@ -f1
++ cut -d: -f1
++ awk '{print $2}'
+ availableInterfaces=eth0
dhcpcdFile=/etc/dhcpcd.conf
+ dhcpcdFile=/etc/dhcpcd.conf

# Next see if we are on a tested and supported OS
function noOS_Support() {
    whiptail --msgbox --backtitle "INVALID OS DETECTED" --title "Invalid OS" "We have not been able to detect a supported OS.
Currently this installer supports Raspbian and Debian (Jessie and Stretch), Devuan (Jessie) and Ubuntu from 14.04 (trusty) to 17.04 (zesty).
If you think you received this message in error, you can post an issue on the GitHub at https://github.com/pivpn/pivpn/issues." ${r} ${c}
    exit 1
}

function maybeOS_Support() {
    if (whiptail --backtitle "Not Supported OS" --title "Not Supported OS" --yesno "You are on an OS that we have not tested but MAY work.
Currently this installer supports Raspbian and Debian (Jessie and Stretch), Devuan (Jessie) and Ubuntu from 14.04 (trusty) to 17.04 (zesty).
Would you like to continue anyway?" ${r} ${c}) then
        echo "::: Did not detect perfectly supported OS but,"
        echo "::: Continuing installation at user's own risk..."
    else
        echo "::: Exiting due to unsupported OS"
        exit 1
    fi
}

# Compatibility
distro_check() {
  # if lsb_release command is on their system
  if hash lsb_release 2>/dev/null; then

    PLAT=$(lsb_release -si)
    OSCN=$(lsb_release -sc) # We want this to be trusty xenial or jessie

  else # else get info from os-release

    PLAT=$(grep "^NAME" /etc/os-release | awk -F "=" '{print $2}' | tr -d '"' | awk '{print $1}')
    VER=$(grep "VERSION_ID" /etc/os-release | awk -F "=" '{print $2}' | tr -d '"')
    declare -A VER_MAP=(["9"]="stretch" ["8"]="jessie" ["16.04"]="xenial" ["14.04"]="trusty")
    OSCN=${VER_MAP["${VER}"]}

  fi

  case ${PLAT} in
    Ubuntu|Raspbian|Debian|Devuan)
      case ${OSCN} in
        trusty|xenial|jessie|stretch)
          ;;
        *)
          maybeOS_Support
          ;;
      esac
      ;;
    *)
      noOS_Support
      ;;
  esac

  echo "${PLAT}" > /tmp/DET_PLATFORM
}

####### FUNCTIONS ##########
spinner()
{
    local pid=$1
    local delay=0.50
    local spinstr='/-\|'
    while [ "$(ps a | awk '{print $1}' | grep "${pid}")" ]; do
        local temp=${spinstr#?}
        printf " [%c]  " "${spinstr}"
        local spinstr=${temp}${spinstr%"$temp"}
        sleep ${delay}
        printf "\b\b\b\b\b\b"
    done
    printf "    \b\b\b\b"
}

welcomeDialogs() {
    # Display the welcome dialog
    whiptail --msgbox --backtitle "Welcome" --title "PiVPN Automated Installer" "This installer will transform your Raspberry Pi into an OpenVPN server!" ${r} ${c}

    # Explain the need for a static address
    whiptail --msgbox --backtitle "Initiating network interface" --title "Static IP Needed" "The PiVPN is a SERVER so it needs a STATIC IP ADDRESS to function properly.

In the next section, you can choose to use your current network settings (DHCP) or to manually edit them." ${r} ${c}
}

chooseUser() {
    # Explain the local user
    whiptail --msgbox --backtitle "Parsing User List" --title "Local Users" "Choose a local user that will hold your ovpn configurations." ${r} ${c}
    # First, let's check if there is a user available.
    numUsers=$(awk -F':' 'BEGIN {count=0} $3>=500 && $3<=60000 { count++ } END{ print count }' /etc/passwd)
    if [ "$numUsers" -eq 0 ]
    then
        # We don't have a user, let's ask to add one.
        if userToAdd=$(whiptail --title "Choose A User" --inputbox "No non-root user account was found. Please type a new username." ${r} ${c} 3>&1 1>&2 2>&3)
        then
            # See http://askubuntu.com/a/667842/459815
            PASSWORD=$(whiptail  --title "password dialog" --passwordbox "Please enter the new user password" ${r} ${c} 3>&1 1>&2 2>&3)
            CRYPT=$(perl -e 'printf("%s\n", crypt($ARGV[0], "password"))' "${PASSWORD}")
            $SUDO useradd -m -p "${CRYPT}" -s /bin/bash "${userToAdd}"
            if [[ $? = 0 ]]; then
                echo "Succeeded"
                ((numUsers+=1))
            else
                exit 1
            fi
        else
            exit 1
        fi
    fi
    availableUsers=$(awk -F':' '$3>=500 && $3<=60000 {print $1}' /etc/passwd)
    local userArray=()
    local firstloop=1

    while read -r line
    do
        mode="OFF"
        if [[ $firstloop -eq 1 ]]; then
            firstloop=0
            mode="ON"
        fi
        userArray+=("${line}" "" "${mode}")
    done <<< "${availableUsers}"
    chooseUserCmd=(whiptail --title "Choose A User" --separate-output --radiolist "Choose (press space to select):" ${r} ${c} ${numUsers})
    chooseUserOptions=$("${chooseUserCmd[@]}" "${userArray[@]}" 2>&1 >/dev/tty)
    if [[ $? = 0 ]]; then
        for desiredUser in ${chooseUserOptions}; do
            pivpnUser=${desiredUser}
            echo "::: Using User: $pivpnUser"
            echo "${pivpnUser}" > /tmp/pivpnUSR
        done
    else
        echo "::: Cancel selected, exiting...."
        exit 1
    fi
}

verifyFreeDiskSpace() {
    # If user installs unattended-upgrades we'd need about 60MB so will check for 75MB free
    echo "::: Verifying free disk space..."
    local required_free_kilobytes=76800
    local existing_free_kilobytes=$(df -Pk | grep -m1 '\/$' | awk '{print $4}')

    # - Unknown free disk space , not a integer
    if ! [[ "${existing_free_kilobytes}" =~ ^([0-9])+$ ]]; then
        echo "::: Unknown free disk space!"
        echo "::: We were unable to determine available free disk space on this system."
        echo "::: You may continue with the installation, however, it is not recommended."
        read -r -p "::: If you are sure you want to continue, type YES and press enter :: " response
        case $response in
            [Y][E][S])
                ;;
            *)
                echo "::: Confirmation not received, exiting..."
                exit 1
                ;;
        esac
    # - Insufficient free disk space
    elif [[ ${existing_free_kilobytes} -lt ${required_free_kilobytes} ]]; then
        echo "::: Insufficient Disk Space!"
        echo "::: Your system appears to be low on disk space. PiVPN recommends a minimum of $required_free_kilobytes KiloBytes."
        echo "::: You only have ${existing_free_kilobytes} KiloBytes free."
        echo "::: If this is a new install on a Raspberry Pi you may need to expand your disk."
        echo "::: Try running 'sudo raspi-config', and choose the 'expand file system option'"
        echo "::: After rebooting, run this installation again. (curl -L https://install.pivpn.io | bash)"

        echo "Insufficient free space, exiting..."
        exit 1
    fi
}


chooseInterface() {
    # Turn the available interfaces into an array so it can be used with a whiptail dialog
    local interfacesArray=()
    # Number of available interfaces
    local interfaceCount
    # Whiptail variable storage
    local chooseInterfaceCmd
    # Temporary Whiptail options storage
    local chooseInterfaceOptions
    # Loop sentinel variable
    local firstloop=1

    if [[ $(echo "${availableInterfaces}" | wc -l) -eq 1 ]]; then
      pivpnInterface="${availableInterfaces}"
      echo "${pivpnInterface}" > /tmp/pivpnINT
      return
    fi

    while read -r line; do
        mode="OFF"
        if [[ ${firstloop} -eq 1 ]]; then
            firstloop=0
            mode="ON"
        fi
        interfacesArray+=("${line}" "available" "${mode}")
    done <<< "${availableInterfaces}"

    # Find out how many interfaces are available to choose from
    interfaceCount=$(echo "${availableInterfaces}" | wc -l)
    chooseInterfaceCmd=(whiptail --separate-output --radiolist "Choose An Interface (press space to select):" ${r} ${c} ${interfaceCount})
    chooseInterfaceOptions=$("${chooseInterfaceCmd[@]}" "${interfacesArray[@]}" 2>&1 >/dev/tty)
    if [[ $? = 0 ]]; then
        for desiredInterface in ${chooseInterfaceOptions}; do
            pivpnInterface=${desiredInterface}
            echo "::: Using interface: $pivpnInterface"
            echo "${pivpnInterface}" > /tmp/pivpnINT
        done
    else
        echo "::: Cancel selected, exiting...."
        exit 1
    fi
}

avoidStaticIPv4Ubuntu() {
    # If we are in Ubuntu then they need to have previously set their network, so just use what you have.
    whiptail --msgbox --backtitle "IP Information" --title "IP Information" "Since we think you are not using Raspbian, we will not configure a static IP for you.
If you are in Amazon then you can not configure a static IP anyway. Just ensure before this installer started you had set an elastic IP on your instance." ${r} ${c}
}

getStaticIPv4Settings() {
    local ipSettingsCorrect
    # Grab their current DNS Server
    IPv4dns=$(nslookup 127.0.0.1 | grep Server: | awk '{print $2}')
    # Ask if the user wants to use DHCP settings as their static IP
    if (whiptail --backtitle "Calibrating network interface" --title "Static IP Address" --yesno "Do you want to use your current network settings as a static address?
                    IP address:    ${IPv4addr}
                    Gateway:       ${IPv4gw}" ${r} ${c}); then
        # If they choose yes, let the user know that the IP address will not be available via DHCP and may cause a conflict.
        whiptail --msgbox --backtitle "IP information" --title "FYI: IP Conflict" "It is possible your router could still try to assign this IP to a device, which would cause a conflict.  But in most cases the router is smart enough to not do that.
If you are worried, either manually set the address, or modify the DHCP reservation pool so it does not include the IP you want.
It is also possible to use a DHCP reservation, but if you are going to do that, you might as well set a static address." ${r} ${c}
        # Nothing else to do since the variables are already set above
    else
        # Otherwise, we need to ask the user to input their desired settings.
        # Start by getting the IPv4 address (pre-filling it with info gathered from DHCP)
        # Start a loop to let the user enter their information with the chance to go back and edit it if necessary
        until [[ ${ipSettingsCorrect} = True ]]; do
            # Ask for the IPv4 address
            IPv4addr=$(whiptail --backtitle "Calibrating network interface" --title "IPv4 address" --inputbox "Enter your desired IPv4 address" ${r} ${c} "${IPv4addr}" 3>&1 1>&2 2>&3)
            if [[ $? = 0 ]]; then
            echo "::: Your static IPv4 address:    ${IPv4addr}"
            # Ask for the gateway
            IPv4gw=$(whiptail --backtitle "Calibrating network interface" --title "IPv4 gateway (router)" --inputbox "Enter your desired IPv4 default gateway" ${r} ${c} "${IPv4gw}" 3>&1 1>&2 2>&3)
            if [[ $? = 0 ]]; then
                echo "::: Your static IPv4 gateway:    ${IPv4gw}"
                # Give the user a chance to review their settings before moving on
                if (whiptail --backtitle "Calibrating network interface" --title "Static IP Address" --yesno "Are these settings correct?
                    IP address:    ${IPv4addr}
                    Gateway:       ${IPv4gw}" ${r} ${c}); then
                    # If the settings are correct, then we need to set the pivpnIP
                    echo "${IPv4addr%/*}" > /tmp/pivpnIP
                    echo "$pivpnInterface" > /tmp/pivpnINT
                    # After that's done, the loop ends and we move on
                    ipSettingsCorrect=True
                else
                    # If the settings are wrong, the loop continues
                    ipSettingsCorrect=False
                fi
            else
                # Cancelling gateway settings window
                ipSettingsCorrect=False
                echo "::: Cancel selected. Exiting..."
                exit 1
            fi
        else
            # Cancelling IPv4 settings window
            ipSettingsCorrect=False
            echo "::: Cancel selected. Exiting..."
            exit 1
        fi
        done
        # End the if statement for DHCP vs. static
    fi
}

setDHCPCD() {
    # Append these lines to dhcpcd.conf to enable a static IP
    echo "interface ${pivpnInterface}
    static ip_address=${IPv4addr}
    static routers=${IPv4gw}
    static domain_name_servers=${IPv4dns}" | $SUDO tee -a ${dhcpcdFile} >/dev/null
}

setStaticIPv4() {
    # Tries to set the IPv4 address
    if [[ -f /etc/dhcpcd.conf ]]; then
        if grep -q "${IPv4addr}" ${dhcpcdFile}; then
            echo "::: Static IP already configured."
        else
            setDHCPCD
            $SUDO ip addr replace dev "${pivpnInterface}" "${IPv4addr}"
            echo ":::"
            echo "::: Setting IP to ${IPv4addr}.  You may need to restart after the install is complete."
            echo ":::"
        fi
    else
        echo "::: Critical: Unable to locate configuration file to set static IPv4 address!"
        exit 1
    fi
}

function valid_ip()
{
    local  ip=$1
    local  stat=1

    if [[ $ip =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
        OIFS=$IFS
        IFS='.'
        ip=($ip)
        IFS=$OIFS
        [[ ${ip[0]} -le 255 && ${ip[1]} -le 255 \
        && ${ip[2]} -le 255 && ${ip[3]} -le 255 ]]
        stat=$?
    fi
    return $stat
}

installScripts() {
    # Install the scripts from /etc/.pivpn to their various locations
    $SUDO echo ":::"
    $SUDO echo -n "::: Installing scripts to /opt/pivpn..."
    if [ ! -d /opt/pivpn ]; then
        $SUDO mkdir /opt/pivpn
        $SUDO chown "$pivpnUser":root /opt/pivpn
        $SUDO chmod u+srwx /opt/pivpn
    fi
    $SUDO cp /etc/.pivpn/scripts/makeOVPN.sh /opt/pivpn/makeOVPN.sh
    $SUDO cp /etc/.pivpn/scripts/clientStat.sh /opt/pivpn/clientStat.sh
    $SUDO cp /etc/.pivpn/scripts/listOVPN.sh /opt/pivpn/listOVPN.sh
    $SUDO cp /etc/.pivpn/scripts/removeOVPN.sh /opt/pivpn/removeOVPN.sh
    $SUDO cp /etc/.pivpn/scripts/uninstall.sh /opt/pivpn/uninstall.sh
    $SUDO cp /etc/.pivpn/scripts/pivpnDebug.sh /opt/pivpn/pivpnDebug.sh
    $SUDO cp /etc/.pivpn/scripts/fix_iptables.sh /opt/pivpn/fix_iptables.sh
    $SUDO chmod 0755 /opt/pivpn/{makeOVPN,clientStat,listOVPN,removeOVPN,uninstall,pivpnDebug,fix_iptables}.sh
    $SUDO cp /etc/.pivpn/pivpn /usr/local/bin/pivpn
    $SUDO chmod 0755 /usr/local/bin/pivpn
    $SUDO cp /etc/.pivpn/scripts/bash-completion /etc/bash_completion.d/pivpn
    . /etc/bash_completion.d/pivpn
    # Copy interface setting for debug
    $SUDO cp /tmp/pivpnINT /etc/pivpn/pivpnINTERFACE

    $SUDO echo " done."
}

package_check_install() {
    dpkg-query -W -f='${Status}' "${1}" 2>/dev/null | grep -c "ok installed" || ${PKG_INSTALL} "${1}"
}

addSoftwareRepo() {
  # Add the official OpenVPN repo for distros that don't have the latest version in their default repos
  case ${PLAT} in
    Ubuntu|Debian|Devuan)
      case ${OSCN} in
        trusty|xenial|wheezy|jessie)
          wget -qO- https://swupdate.openvpn.net/repos/repo-public.gpg | $SUDO apt-key add -
          echo "deb http://build.openvpn.net/debian/openvpn/stable $OSCN main" | $SUDO tee /etc/apt/sources.list.d/swupdate.openvpn.net.list > /dev/null
          echo -n "::: Adding OpenVPN repo for $PLAT $OSCN ..."
          $SUDO apt-get -qq update & spinner $!
          echo " done!"
          ;;
      esac
      ;;
  esac
}

update_package_cache() {
  #Running apt-get update/upgrade with minimal output can cause some issues with
  #requiring user input

  #Check to see if apt-get update has already been run today
  #it needs to have been run at least once on new installs!
  timestamp=$(stat -c %Y ${PKG_CACHE})
  timestampAsDate=$(date -d @"${timestamp}" "+%b %e")
  today=$(date "+%b %e")


  if [ ! "${today}" == "${timestampAsDate}" ]; then
    #update package lists
    echo ":::"
    echo -n "::: ${PKG_MANAGER} update has not been run today. Running now..."
    $SUDO ${UPDATE_PKG_CACHE} &> /dev/null
    echo " done!"
  fi
}

notify_package_updates_available() {
  # Let user know if they have outdated packages on their system and
  # advise them to run a package update at soonest possible.
  echo ":::"
  echo -n "::: Checking ${PKG_MANAGER} for upgraded packages...."
  updatesToInstall=$(eval "${PKG_COUNT}")
  echo " done!"
  echo ":::"
  if [[ ${updatesToInstall} -eq "0" ]]; then
    echo "::: Your system is up to date! Continuing with PiVPN installation..."
  else
    echo "::: There are ${updatesToInstall} updates available for your system!"
    echo "::: We recommend you update your OS after installing PiVPN! "
    echo ":::"
  fi
}

install_dependent_packages() {
  # Install packages passed in via argument array
  # No spinner - conflicts with set -e
  declare -a argArray1=("${!1}")

  echo iptables-persistent iptables-persistent/autosave_v4 boolean true | $SUDO debconf-set-selections
  echo iptables-persistent iptables-persistent/autosave_v6 boolean false | $SUDO debconf-set-selections

  if command -v debconf-apt-progress &> /dev/null; then
    $SUDO debconf-apt-progress -- ${PKG_INSTALL} "${argArray1[@]}"
  else
    for i in "${argArray1[@]}"; do
      echo -n ":::    Checking for $i..."
      $SUDO package_check_install "${i}" &> /dev/null
      echo " installed!"
    done
  fi
}

unattendedUpgrades() {
    whiptail --msgbox --backtitle "Security Updates" --title "Unattended Upgrades" "Since this server will have at least one port open to the internet, it is recommended you enable unattended-upgrades.\nThis feature will check daily for security package updates only and apply them when necessary.\nIt will NOT automatically reboot the server so to fully apply some updates you should periodically reboot." ${r} ${c}

    if (whiptail --backtitle "Security Updates" --title "Unattended Upgrades" --yesno "Do you want to enable unattended upgrades of security patches to this server?" ${r} ${c}) then
        UNATTUPG="unattended-upgrades"
    else
        UNATTUPG=""
    fi
}

stopServices() {
    # Stop openvpn
    $SUDO echo ":::"
    $SUDO echo -n "::: Stopping OpenVPN service..."
    case ${PLAT} in
        Ubuntu|Debian|*vuan)
            $SUDO service openvpn stop || true
            ;;
        *)
            $SUDO systemctl stop openvpn.service || true
            ;;
    esac
    $SUDO echo " done."
}

getGitFiles() {
    # Setup git repos for base files
    echo ":::"
    echo "::: Checking for existing base files..."
    if is_repo "${1}"; then
        update_repo "${1}"
    else
        make_repo "${1}" "${2}"
    fi
}

is_repo() {
    # If the directory does not have a .git folder it is not a repo
    echo -n ":::    Checking $1 is a repo..."
    cd "${1}" &> /dev/null || return 1
    $SUDO git status &> /dev/null && echo " OK!"; return 0 || echo " not found!"; return 1
}

make_repo() {
    # Remove the non-repos interface and clone the interface
    echo -n ":::    Cloning $2 into $1..."
    $SUDO rm -rf "${1}"
    $SUDO git clone -q "${2}" "${1}" > /dev/null & spinner $!
    if [ -z "${TESTING+x}" ]; then
        :
    else
        $SUDO git -C "${1}" checkout test
    fi
    echo " done!"
}

update_repo() {
    if [[ "${reconfigure}" == true ]]; then
          echo "::: --reconfigure passed to install script. Not downloading/updating local repos"
    else
        # Pull the latest commits
        echo -n ":::     Updating repo in $1..."
        cd "${1}" || exit 1
        $SUDO git stash -q > /dev/null & spinner $!
        $SUDO git pull -q > /dev/null & spinner $!
        if [ -z "${TESTING+x}" ]; then
            :
        else
            ${SUDOE} git checkout test
        fi
        echo " done!"
    fi
}

setCustomProto() {
  # Set the available protocols into an array so it can be used with a whiptail dialog
  if protocol=$(whiptail --title "Protocol" --radiolist \
  "Choose a protocol (press space to select). Please only choose TCP if you know why you need TCP." ${r} ${c} 2 \
  "UDP" "" ON \
  "TCP" "" OFF 3>&1 1>&2 2>&3)
  then
      # Convert option into lowercase (UDP->udp)
      pivpnProto="${protocol,,}"
      echo "::: Using protocol: $pivpnProto"
      echo "${pivpnProto}" > /tmp/pivpnPROTO
  else
      echo "::: Cancel selected, exiting...."
      exit 1
  fi
    # write out the PROTO
    PROTO=$pivpnProto
    $SUDO cp /tmp/pivpnPROTO /etc/pivpn/INSTALL_PROTO
}


setCustomPort() {
    until [[ $PORTNumCorrect = True ]]
        do
            portInvalid="Invalid"

            PROTO=$(cat /etc/pivpn/INSTALL_PROTO)
            if [ "$PROTO" = "udp" ]; then
              DEFAULT_PORT=1194
            else
              DEFAULT_PORT=443
            fi
            if PORT=$(whiptail --title "Default OpenVPN Port" --inputbox "You can modify the default OpenVPN port. \nEnter a new value or hit 'Enter' to retain the default" ${r} ${c} $DEFAULT_PORT 3>&1 1>&2 2>&3)
            then
                if [[ "$PORT" =~ ^[0-9]+$ ]] && [ "$PORT" -ge 1 ] && [ "$PORT" -le 65535 ]; then
                    :
                else
                    PORT=$portInvalid
                fi
            else
                echo "::: Cancel selected, exiting...."
                exit 1
            fi

            if [[ $PORT == "$portInvalid" ]]; then
                whiptail --msgbox --backtitle "Invalid Port" --title "Invalid Port" "You entered an invalid Port number.\n    Please enter a number from 1 - 65535.\n    If you are not sure, please just keep the default." ${r} ${c}
                PORTNumCorrect=False
            else
                if (whiptail --backtitle "Specify Custom Port" --title "Confirm Custom Port Number" --yesno "Are these settings correct?\n    PORT:   $PORT" ${r} ${c}) then
                    PORTNumCorrect=True
                else
                    # If the settings are wrong, the loop continues
                    PORTNumCorrect=False
                fi
            fi
        done
    # write out the port
    echo ${PORT} > /tmp/INSTALL_PORT
    $SUDO cp /tmp/INSTALL_PORT /etc/pivpn/INSTALL_PORT
}

setClientDNS() {
    DNSChoseCmd=(whiptail --separate-output --radiolist "Select the DNS Provider for your VPN Clients (press space to select). To use your own, select Custom." ${r} ${c} 6)
    DNSChooseOptions=(Google "" on
            OpenDNS "" off
            Level3 "" off
            DNS.WATCH "" off
            Norton "" off
            FamilyShield "" off
            CloudFlare "" off
            Custom "" off)

    if DNSchoices=$("${DNSChoseCmd[@]}" "${DNSChooseOptions[@]}" 2>&1 >/dev/tty)
    then

      if [[ ${DNSchoices} != "Custom" ]]; then

        echo "::: Using ${DNSchoices} servers."
        declare -A DNS_MAP=(["Google"]="8.8.8.8 8.8.4.4" ["OpenDNS"]="208.67.222.222 208.67.220.220" ["Level3"]="209.244.0.3 209.244.0.4" ["DNS.WATCH"]="84.200.69.80 84.200.70.40" ["Norton"]="199.85.126.10 199.85.127.10" ["FamilyShield"]="208.67.222.123 208.67.220.123" ["CloudFlare"]="1.1.1.1 1.0.0.1")

        OVPNDNS1=$(awk '{print $1}' <<< "${DNS_MAP["${DNSchoices}"]}")
        OVPNDNS2=$(awk '{print $2}' <<< "${DNS_MAP["${DNSchoices}"]}")

        $SUDO sed -i '0,/\(dhcp-option DNS \)/ s/\(dhcp-option DNS \).*/\1'${OVPNDNS1}'\"/' /etc/openvpn/server.conf
        $SUDO sed -i '0,/\(dhcp-option DNS \)/! s/\(dhcp-option DNS \).*/\1'${OVPNDNS2}'\"/' /etc/openvpn/server.conf

      else

          until [[ $DNSSettingsCorrect = True ]]
          do
              strInvalid="Invalid"

              if OVPNDNS=$(whiptail --backtitle "Specify Upstream DNS Provider(s)"  --inputbox "Enter your desired upstream DNS provider(s), seperated by a comma.\n\nFor example '8.8.8.8, 8.8.4.4'" ${r} ${c} "" 3>&1 1>&2 2>&3)
              then
                    OVPNDNS1=$(echo "$OVPNDNS" | sed 's/[, \t]\+/,/g' | awk -F, '{print$1}')
                    OVPNDNS2=$(echo "$OVPNDNS" | sed 's/[, \t]\+/,/g' | awk -F, '{print$2}')
                    if ! valid_ip "$OVPNDNS1" || [ ! "$OVPNDNS1" ]; then
                        OVPNDNS1=$strInvalid
                    fi
                    if ! valid_ip "$OVPNDNS2" && [ "$OVPNDNS2" ]; then
                        OVPNDNS2=$strInvalid
                    fi
              else
                    echo "::: Cancel selected, exiting...."
                    exit 1
                fi
              if [[ $OVPNDNS1 == "$strInvalid" ]] || [[ $OVPNDNS2 == "$strInvalid" ]]; then
                    whiptail --msgbox --backtitle "Invalid IP" --title "Invalid IP" "One or both entered IP addresses were invalid. Please try again.\n\n    DNS Server 1:   $OVPNDNS1\n    DNS Server 2:   $OVPNDNS2" ${r} ${c}
                    if [[ $OVPNDNS1 == "$strInvalid" ]]; then
                        OVPNDNS1=""
                    fi
                    if [[ $OVPNDNS2 == "$strInvalid" ]]; then
                        OVPNDNS2=""
                    fi
                    DNSSettingsCorrect=False
              else
                    if (whiptail --backtitle "Specify Upstream DNS Provider(s)" --title "Upstream DNS Provider(s)" --yesno "Are these settings correct?\n    DNS Server 1:   $OVPNDNS1\n    DNS Server 2:   $OVPNDNS2" ${r} ${c}) then
                        DNSSettingsCorrect=True
                        $SUDO sed -i '0,/\(dhcp-option DNS \)/ s/\(dhcp-option DNS \).*/\1'${OVPNDNS1}'\"/' /etc/openvpn/server.conf
                        if [ -z ${OVPNDNS2} ]; then
                            $SUDO sed -i '/\(dhcp-option DNS \)/{n;N;d}' /etc/openvpn/server.conf
                        else
                            $SUDO sed -i '0,/\(dhcp-option DNS \)/! s/\(dhcp-option DNS \).*/\1'${OVPNDNS2}'\"/' /etc/openvpn/server.conf
                        fi
                    else
                        # If the settings are wrong, the loop continues
                        DNSSettingsCorrect=False
                    fi
                fi
          done
      fi

    else
      echo "::: Cancel selected. Exiting..."
      exit 1
    fi
}

confOpenVPN() {
    # Generate a random, alphanumeric identifier of 16 characters for this server so that we can use verify-x509-name later that is unique for this server installation. Source: Earthgecko (https://gist.github.com/earthgecko/3089509)
    NEW_UUID=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)
    SERVER_NAME="server_${NEW_UUID}"

    if [[ ${useUpdateVars} == false ]]; then
        # Ask user for desired level of encryption
        ENCRYPT=$(whiptail --backtitle "Setup OpenVPN" --title "Encryption strength" --radiolist \
        "Choose your desired level of encryption (press space to select):\n   This is an encryption key that will be generated on your system.  The larger the key, the more time this will take.  For most applications, it is recommended to use 2048 bits.  If you are testing, you can use 1024 bits to speed things up, but do not use this for normal use!  If you are paranoid about ... things... then grab a cup of joe and pick 4096 bits." ${r} ${c} 3 \
        "1024" "Use 1024-bit encryption (testing only)" OFF \
        "2048" "Use 2048-bit encryption (recommended level)" ON \
        "4096" "Use 4096-bit encryption (paranoid level)" OFF 3>&1 1>&2 2>&3)

        exitstatus=$?
        if [ $exitstatus != 0 ]; then
            echo "::: Cancel selected. Exiting..."
            exit 1
        fi
    fi

    # If easy-rsa exists, remove it
    if [[ -d /etc/openvpn/easy-rsa/ ]]; then
        $SUDO rm -rf /etc/openvpn/easy-rsa/
    fi

    # Get the PiVPN easy-rsa
    wget -q -O - "${easyrsaRel}" | $SUDO tar xz -C /etc/openvpn && $SUDO mv /etc/openvpn/EasyRSA-${easyrsaVer} /etc/openvpn/easy-rsa
    # fix ownership
    $SUDO chown -R root:root /etc/openvpn/easy-rsa
    $SUDO mkdir /etc/openvpn/easy-rsa/pki

    # Write out new vars file
    set +e
    IFS= read -d '' String <<"EOF"
if [ -z "$EASYRSA_CALLER" ]; then
    echo "Nope." >&2
    return 1
fi
set_var EASYRSA            "/etc/openvpn/easy-rsa"
set_var EASYRSA_PKI        "$EASYRSA/pki"
set_var EASYRSA_KEY_SIZE   2048
set_var EASYRSA_ALGO       rsa
set_var EASYRSA_CURVE      secp384r1
EOF

    echo "${String}" | $SUDO tee /etc/openvpn/easy-rsa/vars >/dev/null
    set -e

    # Edit the KEY_SIZE variable in the vars file to set user chosen key size
    cd /etc/openvpn/easy-rsa || exit
    $SUDO sed -i "s/\(KEY_SIZE\).*/\1   ${ENCRYPT}/" vars

    # Remove any previous keys
    ${SUDOE} ./easyrsa --batch init-pki

    # Build the certificate authority
    printf "::: Building CA...\n"
    ${SUDOE} ./easyrsa --batch build-ca nopass
    printf "\n::: CA Complete.\n"

    if [[ ${useUpdateVars} == false ]]; then
        whiptail --msgbox --backtitle "Setup OpenVPN" --title "Server Information" "The server key, Diffie-Hellman key, and HMAC key will now be generated." ${r} ${c}
    fi

    # Build the server
    ${SUDOE} ./easyrsa build-server-full ${SERVER_NAME} nopass

    if [[ ${useUpdateVars} == false ]]; then

      if [[ ${PLAT} == "Raspbian" ]] && [[ ${OSCN} != "stretch" ]]; then
        APPLY_TWO_POINT_FOUR=false
      else
        if (whiptail --backtitle "Setup OpenVPN" --title "Version 2.4 improvements" --yesno --defaultno "OpenVPN 2.4 brings support for stronger key exchange using Elliptic Curves and encrypted control channel, along with faster LZ4 compression.\n\nIf your clients do run OpenVPN 2.4 or later you can enable these features, otherwise choose 'No' for best compatibility.\n\nNOTE: Current mobile app, that is OpenVPN connect, is supported." ${r} ${c}); then
          APPLY_TWO_POINT_FOUR=true
          $SUDO touch /etc/pivpn/TWO_POINT_FOUR
        else
          APPLY_TWO_POINT_FOUR=false
        fi
      fi
    fi

    if [[ ${runUnattended} == true ]] && [[ ${APPLY_TWO_POINT_FOUR} == true ]]; then
      $SUDO touch /etc/pivpn/TWO_POINT_FOUR
    fi

    if [[ ${useUpdateVars} == false ]]; then
      if [[ ${APPLY_TWO_POINT_FOUR} == false ]]; then
        if ([ "$ENCRYPT" -ge "4096" ] && whiptail --backtitle "Setup OpenVPN" --title "Download Diffie-Hellman Parameters" --yesno --defaultno "Download Diffie-Hellman parameters from a public DH parameter generation service?\n\nGenerating DH parameters for a $ENCRYPT-bit key can take many hours on a Raspberry Pi. You can instead download DH parameters from \"2 Ton Digital\" that are generated at regular intervals as part of a public service. Downloaded DH parameters will be randomly selected from their database.\nMore information about this service can be found here: https://2ton.com.au/safeprimes/\n\nIf you're paranoid, choose 'No' and Diffie-Hellman parameters will be generated on your device." ${r} ${c}); then
          DOWNLOAD_DH_PARAM=true
        else
          DOWNLOAD_DH_PARAM=false
        fi
      fi
    fi

    if [[ ${APPLY_TWO_POINT_FOUR} == false ]]; then
      if [ "$ENCRYPT" -ge "4096" ] && [[ ${DOWNLOAD_DH_PARAM} == true ]]; then
        # Downloading parameters
        ${SUDOE} curl "https://2ton.com.au/getprimes/random/dhparam/${ENCRYPT}" -o "/etc/openvpn/easy-rsa/pki/dh${ENCRYPT}.pem"
      else
        # Generate Diffie-Hellman key exchange
        ${SUDOE} ./easyrsa gen-dh
        ${SUDOE} mv pki/dh.pem pki/dh${ENCRYPT}.pem
      fi
    fi

    # Generate static HMAC key to defend against DDoS
    ${SUDOE} openvpn --genkey --secret pki/ta.key

    # Generate an empty Certificate Revocation List
    ${SUDOE} ./easyrsa gen-crl
    ${SUDOE} cp pki/crl.pem /etc/openvpn/crl.pem
    ${SUDOE} chown nobody:nogroup /etc/openvpn/crl.pem

    # Write config file for server using the template .txt file
    $SUDO cp /etc/.pivpn/server_config.txt /etc/openvpn/server.conf

    if [[ ${APPLY_TWO_POINT_FOUR} == true ]]; then
      #If they enabled 2.4 change compression algorithm and use tls-crypt instead of tls-auth to encrypt control channel
      $SUDO sed -i "s/comp-lzo/compress lz4/" /etc/openvpn/server.conf
      $SUDO sed -i "s/tls-auth \/etc\/openvpn\/easy-rsa\/pki\/ta.key 0/tls-crypt \/etc\/openvpn\/easy-rsa\/pki\/ta.key/" /etc/openvpn/server.conf
    fi

    if [[ ${APPLY_TWO_POINT_FOUR} == true ]]; then
      #If they enabled 2.4 disable dh parameters, use a specific curve instead
      $SUDO sed -i "s/\(dh \/etc\/openvpn\/easy-rsa\/pki\/dh\).*/dh none\necdh-curve secp384r1/" /etc/openvpn/server.conf
    else
      # Otherwise set the user encryption key size
      $SUDO sed -i "s/\(dh \/etc\/openvpn\/easy-rsa\/pki\/dh\).*/\1${ENCRYPT}.pem/" /etc/openvpn/server.conf
    fi

    # if they modified port put value in server.conf
    if [ $PORT != 1194 ]; then
        $SUDO sed -i "s/1194/${PORT}/g" /etc/openvpn/server.conf
    fi

    # if they modified protocol put value in server.conf
    if [ "$PROTO" != "udp" ]; then
        $SUDO sed -i "s/proto udp/proto tcp/g" /etc/openvpn/server.conf
    fi

    # write out server certs to conf file
    $SUDO sed -i "s/\(key \/etc\/openvpn\/easy-rsa\/pki\/private\/\).*/\1${SERVER_NAME}.key/" /etc/openvpn/server.conf
    $SUDO sed -i "s/\(cert \/etc\/openvpn\/easy-rsa\/pki\/issued\/\).*/\1${SERVER_NAME}.crt/" /etc/openvpn/server.conf
}

confUnattendedUpgrades() {
    if [[ $UNATTUPG == "unattended-upgrades" ]]; then
        $SUDO apt-get --yes --quiet --no-install-recommends install "$UNATTUPG" > /dev/null & spinner $!
        if [[ $PLAT == "Ubuntu" ]]; then
            # Ubuntu 50unattended-upgrades should already just have security enabled
            # so we just need to configure the 10periodic file
            cat << EOT | $SUDO tee /etc/apt/apt.conf.d/10periodic >/dev/null
    APT::Periodic::Update-Package-Lists "1";
    APT::Periodic::Download-Upgradeable-Packages "1";
    APT::Periodic::AutocleanInterval "5";
    APT::Periodic::Unattended-Upgrade "1";
EOT
        else
            $SUDO sed -i '/\(o=Raspbian,n=jessie\)/c\"o=Raspbian,n=jessie,l=Raspbian-Security";\' /etc/apt/apt.conf.d/50unattended-upgrades
            cat << EOT | $SUDO tee /etc/apt/apt.conf.d/02periodic >/dev/null
    APT::Periodic::Enable "1";
    APT::Periodic::Update-Package-Lists "1";
    APT::Periodic::Download-Upgradeable-Packages "1";
    APT::Periodic::Unattended-Upgrade "1";
    APT::Periodic::AutocleanInterval "7";
    APT::Periodic::Verbose "0";
EOT
        fi
    fi

}

confNetwork() {
    # Enable forwarding of internet traffic
    $SUDO sed -i '/net.ipv4.ip_forward=1/s/^#//g' /etc/sysctl.conf
    $SUDO sysctl -p

    # if ufw enabled, configure that
    if hash ufw 2>/dev/null; then
        if LANG=en_US.UTF-8 $SUDO ufw status | grep -q inactive
        then
            noUFW=1
        else
            echo "::: Detected UFW is enabled."
            echo "::: Adding UFW rules..."
            $SUDO cp /etc/.pivpn/ufw_add.txt /tmp/ufw_add.txt
            $SUDO sed -i 's/IPv4dev/'"$IPv4dev"'/' /tmp/ufw_add.txt
            $SUDO sed -i "s/\(DEFAULT_FORWARD_POLICY=\).*/\1\"ACCEPT\"/" /etc/default/ufw
            $SUDO sed -i -e '/delete these required/r /tmp/ufw_add.txt' -e//N /etc/ufw/before.rules
            $SUDO ufw allow "${PORT}/${PROTO}"
            $SUDO ufw allow from 10.8.0.0/24
            $SUDO ufw reload
            echo "::: UFW configuration completed."
        fi
    else
        noUFW=1
    fi
    # else configure iptables
    if [[ $noUFW -eq 1 ]]; then
        echo 1 > /tmp/noUFW
        $SUDO iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o "$IPv4dev" -j MASQUERADE
        case ${PLAT} in
            Ubuntu|Debian|Devuan)
                $SUDO iptables-save | $SUDO tee /etc/iptables/rules.v4 > /dev/null
                ;;
            *)
                $SUDO netfilter-persistent save
                ;;
        esac
    else
        echo 0 > /tmp/noUFW
    fi

    $SUDO cp /tmp/noUFW /etc/pivpn/NO_UFW
}

confOVPN() {
    if ! IPv4pub=$(dig +short myip.opendns.com @resolver1.opendns.com)
    then
        echo "dig failed, now trying to curl eth0.me"
        if ! IPv4pub=$(curl eth0.me)
        then
            echo "eth0.me failed, please check your internet connection/DNS"
            exit $?
        fi
    fi
    $SUDO cp /tmp/pivpnUSR /etc/pivpn/INSTALL_USER
    $SUDO cp /tmp/DET_PLATFORM /etc/pivpn/DET_PLATFORM

    $SUDO cp /etc/.pivpn/Default.txt /etc/openvpn/easy-rsa/pki/Default.txt

    if [[ ${APPLY_TWO_POINT_FOUR} == true ]]; then
      #If they enabled 2.4 change compression algorithm and remove key-direction options since it's not required
      $SUDO sed -i "s/comp-lzo/compress lz4/" /etc/openvpn/easy-rsa/pki/Default.txt
      $SUDO sed -i "/key-direction 1/d" /etc/openvpn/easy-rsa/pki/Default.txt
    fi

    if [[ ${useUpdateVars} == false ]]; then
        METH=$(whiptail --title "Public IP or DNS" --radiolist "Will clients use a Public IP or DNS Name to connect to your server (press space to select)?" ${r} ${c} 2 \
        "$IPv4pub" "Use this public IP" "ON" \
        "DNS Entry" "Use a public DNS" "OFF" 3>&1 1>&2 2>&3)

        exitstatus=$?
        if [ $exitstatus != 0 ]; then
            echo "::: Cancel selected. Exiting..."
            exit 1
        fi

        if [ "$METH" == "$IPv4pub" ]; then
            $SUDO sed -i 's/IPv4pub/'"$IPv4pub"'/' /etc/openvpn/easy-rsa/pki/Default.txt
        else
            until [[ $publicDNSCorrect = True ]]
            do
                PUBLICDNS=$(whiptail --title "PiVPN Setup" --inputbox "What is the public DNS name of this Server?" ${r} ${c} 3>&1 1>&2 2>&3)
                exitstatus=$?
                if [ $exitstatus != 0 ]; then
                echo "::: Cancel selected. Exiting..."
                exit 1
                fi
                if (whiptail --backtitle "Confirm DNS Name" --title "Confirm DNS Name" --yesno "Is this correct?\n\n Public DNS Name:  $PUBLICDNS" ${r} ${c}) then
                    publicDNSCorrect=True
                    $SUDO sed -i 's/IPv4pub/'"$PUBLICDNS"'/' /etc/openvpn/easy-rsa/pki/Default.txt
                else
                    publicDNSCorrect=False
                fi
            done
        fi
    else
        $SUDO sed -i 's/IPv4pub/'"$PUBLICDNS"'/' /etc/openvpn/easy-rsa/pki/Default.txt
    fi

    # if they modified port put value in Default.txt for clients to use
    if [ $PORT != 1194 ]; then
        $SUDO sed -i -e "s/1194/${PORT}/g" /etc/openvpn/easy-rsa/pki/Default.txt
    fi

    # if they modified protocol put value in Default.txt for clients to use
    if [ "$PROTO" != "udp" ]; then
        $SUDO sed -i -e "s/proto udp/proto tcp/g" /etc/openvpn/easy-rsa/pki/Default.txt
    fi

    # verify server name to strengthen security
    $SUDO sed -i "s/SRVRNAME/${SERVER_NAME}/" /etc/openvpn/easy-rsa/pki/Default.txt

    if [ ! -d "/home/$pivpnUser/ovpns" ]; then
        $SUDO mkdir "/home/$pivpnUser/ovpns"
    fi
    $SUDO chmod 0777 -R "/home/$pivpnUser/ovpns"
}

confLogging() {
  echo "if \$programname == 'ovpn-server' then /var/log/openvpn.log
if \$programname == 'ovpn-server' then ~" | $SUDO tee /etc/rsyslog.d/30-openvpn.conf > /dev/null

  echo "/var/log/openvpn.log
{
        rotate 4
        weekly
        missingok
        notifempty
        compress
        delaycompress
        sharedscripts
        postrotate
                invoke-rc.d rsyslog rotate >/dev/null 2>&1 || true
        endscript
}" | $SUDO tee /etc/logrotate.d/openvpn > /dev/null

  # Restart the logging service
  case ${PLAT} in
    Ubuntu|Debian|*vuan)
      $SUDO service rsyslog restart || true
      ;;
    *)
      $SUDO systemctl restart rsyslog.service || true
      ;;
  esac
}

finalExports() {
    # Update variables in setupVars.conf file
    if [ -e "${setupVars}" ]; then
        $SUDO sed -i.update.bak '/pivpnUser/d;/UNATTUPG/d;/pivpnInterface/d;/IPv4dns/d;/IPv4addr/d;/IPv4gw/d;/pivpnProto/d;/PORT/d;/ENCRYPT/d;/DOWNLOAD_DH_PARAM/d;/PUBLICDNS/d;/OVPNDNS1/d;/OVPNDNS2/d;' "${setupVars}"
    fi
    {
        echo "pivpnUser=${pivpnUser}"
        echo "UNATTUPG=${UNATTUPG}"
        echo "pivpnInterface=${pivpnInterface}"
        echo "IPv4dns=${IPv4dns}"
        echo "IPv4addr=${IPv4addr}"
        echo "IPv4gw=${IPv4gw}"
        echo "pivpnProto=${pivpnProto}"
        echo "PORT=${PORT}"
        echo "ENCRYPT=${ENCRYPT}"
        echo "APPLY_TWO_POINT_FOUR=${APPLY_TWO_POINT_FOUR}"
        echo "DOWNLOAD_DH_PARAM=${DOWNLOAD_DH_PARAM}"
        echo "PUBLICDNS=${PUBLICDNS}"
        echo "OVPNDNS1=${OVPNDNS1}"
        echo "OVPNDNS2=${OVPNDNS2}"
    } | $SUDO tee "${setupVars}" > /dev/null
}


# I suggest replacing some of these names.

#accountForRefactor() {
#    # At some point in the future this list can be pruned, for now we'll need it to ensure updates don't break.
#
#    # Refactoring of install script has changed the name of a couple of variables. Sort them out here.
#    sed -i 's/pivpnUser/PIVPN_USER/g' ${setupVars}
#    #sed -i 's/UNATTUPG/UNATTUPG/g' ${setupVars}
#    sed -i 's/pivpnInterface/PIVPN_INTERFACE/g' ${setupVars}
#    sed -i 's/IPv4dns/IPV4_DNS/g' ${setupVars}
#    sed -i 's/IPv4addr/IPV4_ADDRESS/g' ${setupVars}
#    sed -i 's/IPv4gw/IPV4_GATEWAY/g' ${setupVars}
#    sed -i 's/pivpnProto/TRANSPORT_LAYER/g' ${setupVars}
#    #sed -i 's/PORT/PORT/g' ${setupVars}
#    #sed -i 's/ENCRYPT/ENCRYPT/g' ${setupVars}
#    #sed -i 's/DOWNLOAD_DH_PARAM/DOWNLOAD_DH_PARAM/g' ${setupVars}
#    sed -i 's/PUBLICDNS/PUBLIC_DNS/g' ${setupVars}
#    sed -i 's/OVPNDNS1/OVPN_DNS_1/g' ${setupVars}
#    sed -i 's/OVPNDNS2/OVPN_DNS_2/g' ${setupVars}
#}

installPiVPN() {
    stopServices
    $SUDO mkdir -p /etc/pivpn/
    confUnattendedUpgrades
    installScripts
    setCustomProto
    setCustomPort
    confOpenVPN
    confNetwork
    confOVPN
    setClientDNS
    confLogging
    finalExports
}

updatePiVPN() {
    #accountForRefactor
    stopServices
    confUnattendedUpgrades
    installScripts

    # setCustomProto
    # write out the PROTO
    PROTO=$pivpnProto
    $SUDO cp /tmp/pivpnPROTO /etc/pivpn/INSTALL_PROTO

    #setCustomPort
    # write out the port
    $SUDO cp /tmp/INSTALL_PORT /etc/pivpn/INSTALL_PORT

    confOpenVPN
    confNetwork
    confOVPN

    # ?? Is this always OK? Also if you only select one DNS server ??
    $SUDO sed -i '0,/\(dhcp-option DNS \)/ s/\(dhcp-option DNS \).*/\1'${OVPNDNS1}'\"/' /etc/openvpn/server.conf
    $SUDO sed -i '0,/\(dhcp-option DNS \)/! s/\(dhcp-option DNS \).*/\1'${OVPNDNS2}'\"/' /etc/openvpn/server.conf

    finalExports #re-export setupVars.conf to account for any new vars added in new versions
}


displayFinalMessage() {
    # Final completion message to user
    whiptail --msgbox --backtitle "Make it so." --title "Installation Complete!" "Now run 'pivpn add' to create the ovpn profiles.
Run 'pivpn help' to see what else you can do!
The install log is in /etc/pivpn." ${r} ${c}
    if (whiptail --title "Reboot" --yesno --defaultno "It is strongly recommended you reboot after installation.  Would you like to reboot now?" ${r} ${c}); then
        whiptail --title "Rebooting" --msgbox "The system will now reboot." ${r} ${c}
        printf "\nRebooting system...\n"
        $SUDO sleep 3
        $SUDO shutdown -r now
    fi
}

update_dialogs() {
    # reconfigure
    if [ "${reconfigure}" = true ]; then
        opt1a="Repair"
        opt1b="This will retain existing settings"
        strAdd="You will remain on the same version"
    else
        opt1a="Update"
        opt1b="This will retain existing settings."
        strAdd="You will be updated to the latest version."
    fi
    opt2a="Reconfigure"
    opt2b="This will allow you to enter new settings"

    UpdateCmd=$(whiptail --title "Existing Install Detected!" --menu "\n\nWe have detected an existing install.\n\nPlease choose from the following options: \n($strAdd)" ${r} ${c} 2 \
    "${opt1a}"  "${opt1b}" \
    "${opt2a}"  "${opt2b}" 3>&2 2>&1 1>&3) || \
    { echo "::: Cancel selected. Exiting"; exit 1; }

    case ${UpdateCmd} in
        ${opt1a})
            echo "::: ${opt1a} option selected."
            useUpdateVars=true
            ;;
        ${opt2a})
            echo "::: ${opt2a} option selected"
            useUpdateVars=false
            ;;
    esac
}

clone_or_update_repos() {
    if [[ "${reconfigure}" == true ]]; then
        echo "::: --reconfigure passed to install script. Not downloading/updating local repos"
    else
        # Get Git files
        getGitFiles ${pivpnFilesDir} ${pivpnGitUrl} || \
        { echo "!!! Unable to clone ${pivpnGitUrl} into ${pivpnFilesDir}, unable to continue."; \
            exit 1; \
        }
    fi
}

######## SCRIPT ############

main() {

    ######## FIRST CHECK ########
    # Must be root to install
    echo ":::"
    if [[ $EUID -eq 0 ]];then
        echo "::: You are root."
    else
        echo "::: sudo will be used for the install."
        # Check if it is actually installed
        # If it isn't, exit because the install cannot complete
        if [[ $(dpkg-query -s sudo) ]];then
            export SUDO="sudo"
            export SUDOE="sudo -E"
        else
            echo "::: Please install sudo or run this as root."
            exit 1
        fi
    fi

    # Check for supported distribution
    distro_check

    # Check arguments for the undocumented flags
    for var in "$@"; do
        case "$var" in
            "--reconfigure"  ) reconfigure=true;;
            "--i_do_not_follow_recommendations"   ) skipSpaceCheck=false;;
            "--unattended"     ) runUnattended=true;;
        esac
    done

    if [[ -f ${setupVars} ]]; then
        if [[ "${runUnattended}" == true ]]; then
            echo "::: --unattended passed to install script, no whiptail dialogs will be displayed"
            useUpdateVars=true
        else
            update_dialogs
        fi
    fi

    # Start the installer
    # Verify there is enough disk space for the install
    if [[ "${skipSpaceCheck}" == true ]]; then
        echo "::: --i_do_not_follow_recommendations passed to script, skipping free disk space verification!"
    else
        verifyFreeDiskSpace
    fi

    # Install the packages (we do this first because we need whiptail)
    addSoftwareRepo

    update_package_cache

    # Notify user of package availability
    notify_package_updates_available

    # Install packages used by this installation script
    install_dependent_packages PIVPN_DEPS[@]

    if [[ ${useUpdateVars} == false ]]; then
        # Display welcome dialogs
        welcomeDialogs

        # Find interfaces and let the user choose one
        chooseInterface

        # Only try to set static on Raspbian, otherwise let user do it
        if [[ $PLAT != "Raspbian" ]]; then
            avoidStaticIPv4Ubuntu
        else
            getStaticIPv4Settings
            setStaticIPv4
        fi

        # Choose the user for the ovpns
        chooseUser

        # Ask if unattended-upgrades will be enabled
        unattendedUpgrades

        # Clone/Update the repos
        clone_or_update_repos

        # Install and log everything to a file
        installPiVPN | tee ${tmpLog}

        echo "::: Install Complete..."
    else
        # Source ${setupVars} for use in the rest of the functions.
        source ${setupVars}

        echo "::: Using IP address: $IPv4addr"
        echo "${IPv4addr%/*}" > /tmp/pivpnIP
        echo "::: Using interface: $pivpnInterface"
        echo "${pivpnInterface}" > /tmp/pivpnINT
        echo "::: Using User: $pivpnUser"
        echo "${pivpnUser}" > /tmp/pivpnUSR
        echo "::: Using protocol: $pivpnProto"
        echo "${pivpnProto}" > /tmp/pivpnPROTO
        echo "::: Using port: $PORT"
        echo ${PORT} > /tmp/INSTALL_PORT
        echo ":::"

        # Only try to set static on Raspbian
        case ${PLAT} in
          Rasp*)
            setStaticIPv4 # This might be a problem if a user tries to modify the ip in the config file and then runs an update because of the way we check for previous configuration in /etc/dhcpcd.conf
            ;;
          *)
            echo "::: IP Information"
            echo "::: Since we think you are not using Raspbian, we will not configure a static IP for you."
            echo "::: If you are in Amazon then you can not configure a static IP anyway."
            echo "::: Just ensure before this installer started you had set an elastic IP on your instance."
            ;;
          esac

        # Clone/Update the repos
        clone_or_update_repos


        updatePiVPN | tee ${tmpLog}
    fi

    #Move the install log into /etc/pivpn for storage
    $SUDO mv ${tmpLog} ${instalLogLoc}

    echo "::: Restarting services..."
    # Start services
    case ${PLAT} in
        Ubuntu|Debian|*vuan)
            $SUDO service openvpn start
            ;;
        *)
            $SUDO systemctl enable openvpn.service
            $SUDO systemctl start openvpn.service
            ;;
    esac

    echo "::: done."

    if [[ "${useUpdateVars}" == false ]]; then
        displayFinalMessage
    fi

    echo ":::"
    if [[ "${useUpdateVars}" == false ]]; then
        echo "::: Installation Complete!"
        echo "::: Now run 'pivpn add' to create an ovpn profile for each of your devices."
        echo "::: Run 'pivpn help' to see what else you can do!"
        echo "::: It is strongly recommended you reboot after installation."
    else
        echo "::: Update complete!"
    fi

    echo ":::"
    echo "::: The install log is located at: ${instalLogLoc}"
}

if [[ "${PIVPN_TEST}" != true ]] ; then
  main "$@"
fi
./install_pivpn.sh: line 1318: PIVPN_TEST: unbound variable

@Fayyaadh

This comment has been minimized.

Copy link
Author

commented Oct 10, 2018

This is with just set -v and set -x in there:


    fi

    if [[ ${runUnattended} == true ]] && [[ ${APPLY_TWO_POINT_FOUR} == true ]]; then
      $SUDO touch /etc/pivpn/TWO_POINT_FOUR
    fi

    if [[ ${useUpdateVars} == false ]]; then
      if [[ ${APPLY_TWO_POINT_FOUR} == false ]]; then
        if ([ "$ENCRYPT" -ge "4096" ] && whiptail --backtitle "Setup OpenVPN" --title "Download Diffie-Hellman Parameters" --yesno --defaultno "Download Diffie-Hellman parameters from a public DH parameter generation service?\n\nGenerating DH parameters for a $ENCRYPT-bit key can take many hours on a Raspberry Pi. You can instead download DH parameters from \"2 Ton Digital\" that are generated at regular intervals as part of a public service. Downloaded DH parameters will be randomly selected from their database.\nMore information about this service can be found here: https://2ton.com.au/safeprimes/\n\nIf you're paranoid, choose 'No' and Diffie-Hellman parameters will be generated on your device." ${r} ${c}); then
          DOWNLOAD_DH_PARAM=true
        else
          DOWNLOAD_DH_PARAM=false
        fi
      fi
    fi

    if [[ ${APPLY_TWO_POINT_FOUR} == false ]]; then
      if [ "$ENCRYPT" -ge "4096" ] && [[ ${DOWNLOAD_DH_PARAM} == true ]]; then
        # Downloading parameters
        ${SUDOE} curl "https://2ton.com.au/getprimes/random/dhparam/${ENCRYPT}" -o "/etc/openvpn/easy-rsa/pki/dh${ENCRYPT}.pem"
      else
        # Generate Diffie-Hellman key exchange
        ${SUDOE} ./easyrsa gen-dh
        ${SUDOE} mv pki/dh.pem pki/dh${ENCRYPT}.pem
      fi
    fi

    # Generate static HMAC key to defend against DDoS
    ${SUDOE} openvpn --genkey --secret pki/ta.key

    # Generate an empty Certificate Revocation List
    ${SUDOE} ./easyrsa gen-crl
    ${SUDOE} cp pki/crl.pem /etc/openvpn/crl.pem
    ${SUDOE} chown nobody:nogroup /etc/openvpn/crl.pem

    # Write config file for server using the template .txt file
    $SUDO cp /etc/.pivpn/server_config.txt /etc/openvpn/server.conf

    if [[ ${APPLY_TWO_POINT_FOUR} == true ]]; then
      #If they enabled 2.4 change compression algorithm and use tls-crypt instead of tls-auth to encrypt control channel
      $SUDO sed -i "s/comp-lzo/compress lz4/" /etc/openvpn/server.conf
      $SUDO sed -i "s/tls-auth \/etc\/openvpn\/easy-rsa\/pki\/ta.key 0/tls-crypt \/etc\/openvpn\/easy-rsa\/pki\/ta.key/" /etc/openvpn/server.conf
    fi

    if [[ ${APPLY_TWO_POINT_FOUR} == true ]]; then
      #If they enabled 2.4 disable dh parameters, use a specific curve instead
      $SUDO sed -i "s/\(dh \/etc\/openvpn\/easy-rsa\/pki\/dh\).*/dh none\necdh-curve secp384r1/" /etc/openvpn/server.conf
    else
      # Otherwise set the user encryption key size
      $SUDO sed -i "s/\(dh \/etc\/openvpn\/easy-rsa\/pki\/dh\).*/\1${ENCRYPT}.pem/" /etc/openvpn/server.conf
    fi

    # if they modified port put value in server.conf
    if [ $PORT != 1194 ]; then
        $SUDO sed -i "s/1194/${PORT}/g" /etc/openvpn/server.conf
    fi

    # if they modified protocol put value in server.conf
    if [ "$PROTO" != "udp" ]; then
        $SUDO sed -i "s/proto udp/proto tcp/g" /etc/openvpn/server.conf
    fi

    # write out server certs to conf file
    $SUDO sed -i "s/\(key \/etc\/openvpn\/easy-rsa\/pki\/private\/\).*/\1${SERVER_NAME}.key/" /etc/openvpn/server.conf
    $SUDO sed -i "s/\(cert \/etc\/openvpn\/easy-rsa\/pki\/issued\/\).*/\1${SERVER_NAME}.crt/" /etc/openvpn/server.conf
}

confUnattendedUpgrades() {
    if [[ $UNATTUPG == "unattended-upgrades" ]]; then
        $SUDO apt-get --yes --quiet --no-install-recommends install "$UNATTUPG" > /dev/null & spinner $!
        if [[ $PLAT == "Ubuntu" ]]; then
            # Ubuntu 50unattended-upgrades should already just have security enabled
            # so we just need to configure the 10periodic file
            cat << EOT | $SUDO tee /etc/apt/apt.conf.d/10periodic >/dev/null
    APT::Periodic::Update-Package-Lists "1";
    APT::Periodic::Download-Upgradeable-Packages "1";
    APT::Periodic::AutocleanInterval "5";
    APT::Periodic::Unattended-Upgrade "1";
EOT
        else
            $SUDO sed -i '/\(o=Raspbian,n=jessie\)/c\"o=Raspbian,n=jessie,l=Raspbian-Security";\' /etc/apt/apt.conf.d/50unattended-upgrades
            cat << EOT | $SUDO tee /etc/apt/apt.conf.d/02periodic >/dev/null
    APT::Periodic::Enable "1";
    APT::Periodic::Update-Package-Lists "1";
    APT::Periodic::Download-Upgradeable-Packages "1";
    APT::Periodic::Unattended-Upgrade "1";
    APT::Periodic::AutocleanInterval "7";
    APT::Periodic::Verbose "0";
EOT
        fi
    fi

}

confNetwork() {
    # Enable forwarding of internet traffic
    $SUDO sed -i '/net.ipv4.ip_forward=1/s/^#//g' /etc/sysctl.conf
    $SUDO sysctl -p

    # if ufw enabled, configure that
    if hash ufw 2>/dev/null; then
        if LANG=en_US.UTF-8 $SUDO ufw status | grep -q inactive
        then
            noUFW=1
        else
            echo "::: Detected UFW is enabled."
            echo "::: Adding UFW rules..."
            $SUDO cp /etc/.pivpn/ufw_add.txt /tmp/ufw_add.txt
            $SUDO sed -i 's/IPv4dev/'"$IPv4dev"'/' /tmp/ufw_add.txt
            $SUDO sed -i "s/\(DEFAULT_FORWARD_POLICY=\).*/\1\"ACCEPT\"/" /etc/default/ufw
            $SUDO sed -i -e '/delete these required/r /tmp/ufw_add.txt' -e//N /etc/ufw/before.rules
            $SUDO ufw allow "${PORT}/${PROTO}"
            $SUDO ufw allow from 10.8.0.0/24
            $SUDO ufw reload
            echo "::: UFW configuration completed."
        fi
    else
        noUFW=1
    fi
    # else configure iptables
    if [[ $noUFW -eq 1 ]]; then
        echo 1 > /tmp/noUFW
        $SUDO iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o "$IPv4dev" -j MASQUERADE
        case ${PLAT} in
            Ubuntu|Debian|Devuan)
                $SUDO iptables-save | $SUDO tee /etc/iptables/rules.v4 > /dev/null
                ;;
            *)
                $SUDO netfilter-persistent save
                ;;
        esac
    else
        echo 0 > /tmp/noUFW
    fi

    $SUDO cp /tmp/noUFW /etc/pivpn/NO_UFW
}

confOVPN() {
    if ! IPv4pub=$(dig +short myip.opendns.com @resolver1.opendns.com)
    then
        echo "dig failed, now trying to curl eth0.me"
        if ! IPv4pub=$(curl eth0.me)
        then
            echo "eth0.me failed, please check your internet connection/DNS"
            exit $?
        fi
    fi
    $SUDO cp /tmp/pivpnUSR /etc/pivpn/INSTALL_USER
    $SUDO cp /tmp/DET_PLATFORM /etc/pivpn/DET_PLATFORM

    $SUDO cp /etc/.pivpn/Default.txt /etc/openvpn/easy-rsa/pki/Default.txt

    if [[ ${APPLY_TWO_POINT_FOUR} == true ]]; then
      #If they enabled 2.4 change compression algorithm and remove key-direction options since it's not required
      $SUDO sed -i "s/comp-lzo/compress lz4/" /etc/openvpn/easy-rsa/pki/Default.txt
      $SUDO sed -i "/key-direction 1/d" /etc/openvpn/easy-rsa/pki/Default.txt
    fi

    if [[ ${useUpdateVars} == false ]]; then
        METH=$(whiptail --title "Public IP or DNS" --radiolist "Will clients use a Public IP or DNS Name to connect to your server (press space to select)?" ${r} ${c} 2 \
        "$IPv4pub" "Use this public IP" "ON" \
        "DNS Entry" "Use a public DNS" "OFF" 3>&1 1>&2 2>&3)

        exitstatus=$?
        if [ $exitstatus != 0 ]; then
            echo "::: Cancel selected. Exiting..."
            exit 1
        fi

        if [ "$METH" == "$IPv4pub" ]; then
            $SUDO sed -i 's/IPv4pub/'"$IPv4pub"'/' /etc/openvpn/easy-rsa/pki/Default.txt
        else
            until [[ $publicDNSCorrect = True ]]
            do
                PUBLICDNS=$(whiptail --title "PiVPN Setup" --inputbox "What is the public DNS name of this Server?" ${r} ${c} 3>&1 1>&2 2>&3)
                exitstatus=$?
                if [ $exitstatus != 0 ]; then
                echo "::: Cancel selected. Exiting..."
                exit 1
                fi
                if (whiptail --backtitle "Confirm DNS Name" --title "Confirm DNS Name" --yesno "Is this correct?\n\n Public DNS Name:  $PUBLICDNS" ${r} ${c}) then
                    publicDNSCorrect=True
                    $SUDO sed -i 's/IPv4pub/'"$PUBLICDNS"'/' /etc/openvpn/easy-rsa/pki/Default.txt
                else
                    publicDNSCorrect=False
                fi
            done
        fi
    else
        $SUDO sed -i 's/IPv4pub/'"$PUBLICDNS"'/' /etc/openvpn/easy-rsa/pki/Default.txt
    fi

    # if they modified port put value in Default.txt for clients to use
    if [ $PORT != 1194 ]; then
        $SUDO sed -i -e "s/1194/${PORT}/g" /etc/openvpn/easy-rsa/pki/Default.txt
    fi

    # if they modified protocol put value in Default.txt for clients to use
    if [ "$PROTO" != "udp" ]; then
        $SUDO sed -i -e "s/proto udp/proto tcp/g" /etc/openvpn/easy-rsa/pki/Default.txt
    fi

    # verify server name to strengthen security
    $SUDO sed -i "s/SRVRNAME/${SERVER_NAME}/" /etc/openvpn/easy-rsa/pki/Default.txt

    if [ ! -d "/home/$pivpnUser/ovpns" ]; then
        $SUDO mkdir "/home/$pivpnUser/ovpns"
    fi
    $SUDO chmod 0777 -R "/home/$pivpnUser/ovpns"
}

confLogging() {
  echo "if \$programname == 'ovpn-server' then /var/log/openvpn.log
if \$programname == 'ovpn-server' then ~" | $SUDO tee /etc/rsyslog.d/30-openvpn.conf > /dev/null

  echo "/var/log/openvpn.log
{
        rotate 4
        weekly
        missingok
        notifempty
        compress
        delaycompress
        sharedscripts
        postrotate
                invoke-rc.d rsyslog rotate >/dev/null 2>&1 || true
        endscript
}" | $SUDO tee /etc/logrotate.d/openvpn > /dev/null

  # Restart the logging service
  case ${PLAT} in
    Ubuntu|Debian|*vuan)
      $SUDO service rsyslog restart || true
      ;;
    *)
      $SUDO systemctl restart rsyslog.service || true
      ;;
  esac
}

finalExports() {
    # Update variables in setupVars.conf file
    if [ -e "${setupVars}" ]; then
        $SUDO sed -i.update.bak '/pivpnUser/d;/UNATTUPG/d;/pivpnInterface/d;/IPv4dns/d;/IPv4addr/d;/IPv4gw/d;/pivpnProto/d;/PORT/d;/ENCRYPT/d;/DOWNLOAD_DH_PARAM/d;/PUBLICDNS/d;/OVPNDNS1/d;/OVPNDNS2/d;' "${setupVars}"
    fi
    {
        echo "pivpnUser=${pivpnUser}"
        echo "UNATTUPG=${UNATTUPG}"
        echo "pivpnInterface=${pivpnInterface}"
        echo "IPv4dns=${IPv4dns}"
        echo "IPv4addr=${IPv4addr}"
        echo "IPv4gw=${IPv4gw}"
        echo "pivpnProto=${pivpnProto}"
        echo "PORT=${PORT}"
        echo "ENCRYPT=${ENCRYPT}"
        echo "APPLY_TWO_POINT_FOUR=${APPLY_TWO_POINT_FOUR}"
        echo "DOWNLOAD_DH_PARAM=${DOWNLOAD_DH_PARAM}"
        echo "PUBLICDNS=${PUBLICDNS}"
        echo "OVPNDNS1=${OVPNDNS1}"
        echo "OVPNDNS2=${OVPNDNS2}"
    } | $SUDO tee "${setupVars}" > /dev/null
}


# I suggest replacing some of these names.

#accountForRefactor() {
#    # At some point in the future this list can be pruned, for now we'll need it to ensure updates don't break.
#
#    # Refactoring of install script has changed the name of a couple of variables. Sort them out here.
#    sed -i 's/pivpnUser/PIVPN_USER/g' ${setupVars}
#    #sed -i 's/UNATTUPG/UNATTUPG/g' ${setupVars}
#    sed -i 's/pivpnInterface/PIVPN_INTERFACE/g' ${setupVars}
#    sed -i 's/IPv4dns/IPV4_DNS/g' ${setupVars}
#    sed -i 's/IPv4addr/IPV4_ADDRESS/g' ${setupVars}
#    sed -i 's/IPv4gw/IPV4_GATEWAY/g' ${setupVars}
#    sed -i 's/pivpnProto/TRANSPORT_LAYER/g' ${setupVars}
#    #sed -i 's/PORT/PORT/g' ${setupVars}
#    #sed -i 's/ENCRYPT/ENCRYPT/g' ${setupVars}
#    #sed -i 's/DOWNLOAD_DH_PARAM/DOWNLOAD_DH_PARAM/g' ${setupVars}
#    sed -i 's/PUBLICDNS/PUBLIC_DNS/g' ${setupVars}
#    sed -i 's/OVPNDNS1/OVPN_DNS_1/g' ${setupVars}
#    sed -i 's/OVPNDNS2/OVPN_DNS_2/g' ${setupVars}
#}

installPiVPN() {
    stopServices
    $SUDO mkdir -p /etc/pivpn/
    confUnattendedUpgrades
    installScripts
    setCustomProto
    setCustomPort
    confOpenVPN
    confNetwork
    confOVPN
    setClientDNS
    confLogging
    finalExports
}

updatePiVPN() {
    #accountForRefactor
    stopServices
    confUnattendedUpgrades
    installScripts

    # setCustomProto
    # write out the PROTO
    PROTO=$pivpnProto
    $SUDO cp /tmp/pivpnPROTO /etc/pivpn/INSTALL_PROTO

    #setCustomPort
    # write out the port
    $SUDO cp /tmp/INSTALL_PORT /etc/pivpn/INSTALL_PORT

    confOpenVPN
    confNetwork
    confOVPN

    # ?? Is this always OK? Also if you only select one DNS server ??
    $SUDO sed -i '0,/\(dhcp-option DNS \)/ s/\(dhcp-option DNS \).*/\1'${OVPNDNS1}'\"/' /etc/openvpn/server.conf
    $SUDO sed -i '0,/\(dhcp-option DNS \)/! s/\(dhcp-option DNS \).*/\1'${OVPNDNS2}'\"/' /etc/openvpn/server.conf

    finalExports #re-export setupVars.conf to account for any new vars added in new versions
}


displayFinalMessage() {
    # Final completion message to user
    whiptail --msgbox --backtitle "Make it so." --title "Installation Complete!" "Now run 'pivpn add' to create the ovpn profiles.
Run 'pivpn help' to see what else you can do!
The install log is in /etc/pivpn." ${r} ${c}
    if (whiptail --title "Reboot" --yesno --defaultno "It is strongly recommended you reboot after installation.  Would you like to reboot now?" ${r} ${c}); then
        whiptail --title "Rebooting" --msgbox "The system will now reboot." ${r} ${c}
        printf "\nRebooting system...\n"
        $SUDO sleep 3
        $SUDO shutdown -r now
    fi
}

update_dialogs() {
    # reconfigure
    if [ "${reconfigure}" = true ]; then
        opt1a="Repair"
        opt1b="This will retain existing settings"
        strAdd="You will remain on the same version"
    else
        opt1a="Update"
        opt1b="This will retain existing settings."
        strAdd="You will be updated to the latest version."
    fi
    opt2a="Reconfigure"
    opt2b="This will allow you to enter new settings"

    UpdateCmd=$(whiptail --title "Existing Install Detected!" --menu "\n\nWe have detected an existing install.\n\nPlease choose from the following options: \n($strAdd)" ${r} ${c} 2 \
    "${opt1a}"  "${opt1b}" \
    "${opt2a}"  "${opt2b}" 3>&2 2>&1 1>&3) || \
    { echo "::: Cancel selected. Exiting"; exit 1; }

    case ${UpdateCmd} in
        ${opt1a})
            echo "::: ${opt1a} option selected."
            useUpdateVars=true
            ;;
        ${opt2a})
            echo "::: ${opt2a} option selected"
            useUpdateVars=false
            ;;
    esac
}

clone_or_update_repos() {
    if [[ "${reconfigure}" == true ]]; then
        echo "::: --reconfigure passed to install script. Not downloading/updating local repos"
    else
        # Get Git files
        getGitFiles ${pivpnFilesDir} ${pivpnGitUrl} || \
        { echo "!!! Unable to clone ${pivpnGitUrl} into ${pivpnFilesDir}, unable to continue."; \
            exit 1; \
        }
    fi
}

######## SCRIPT ############

main() {

    ######## FIRST CHECK ########
    # Must be root to install
    echo ":::"
    if [[ $EUID -eq 0 ]];then
        echo "::: You are root."
    else
        echo "::: sudo will be used for the install."
        # Check if it is actually installed
        # If it isn't, exit because the install cannot complete
        if [[ $(dpkg-query -s sudo) ]];then
            export SUDO="sudo"
            export SUDOE="sudo -E"
        else
            echo "::: Please install sudo or run this as root."
            exit 1
        fi
    fi

    # Check for supported distribution
    distro_check

    # Check arguments for the undocumented flags
    for var in "$@"; do
        case "$var" in
            "--reconfigure"  ) reconfigure=true;;
            "--i_do_not_follow_recommendations"   ) skipSpaceCheck=false;;
            "--unattended"     ) runUnattended=true;;
        esac
    done

    if [[ -f ${setupVars} ]]; then
        if [[ "${runUnattended}" == true ]]; then
            echo "::: --unattended passed to install script, no whiptail dialogs will be displayed"
            useUpdateVars=true
        else
            update_dialogs
        fi
    fi

    # Start the installer
    # Verify there is enough disk space for the install
    if [[ "${skipSpaceCheck}" == true ]]; then
        echo "::: --i_do_not_follow_recommendations passed to script, skipping free disk space verification!"
    else
        verifyFreeDiskSpace
    fi

    # Install the packages (we do this first because we need whiptail)
    addSoftwareRepo

    update_package_cache

    # Notify user of package availability
    notify_package_updates_available

    # Install packages used by this installation script
    install_dependent_packages PIVPN_DEPS[@]

    if [[ ${useUpdateVars} == false ]]; then
        # Display welcome dialogs
        welcomeDialogs

        # Find interfaces and let the user choose one
        chooseInterface

        # Only try to set static on Raspbian, otherwise let user do it
        if [[ $PLAT != "Raspbian" ]]; then
            avoidStaticIPv4Ubuntu
        else
            getStaticIPv4Settings
            setStaticIPv4
        fi

        # Choose the user for the ovpns
        chooseUser

        # Ask if unattended-upgrades will be enabled
        unattendedUpgrades

        # Clone/Update the repos
        clone_or_update_repos

        # Install and log everything to a file
        installPiVPN | tee ${tmpLog}

        echo "::: Install Complete..."
    else
        # Source ${setupVars} for use in the rest of the functions.
        source ${setupVars}

        echo "::: Using IP address: $IPv4addr"
        echo "${IPv4addr%/*}" > /tmp/pivpnIP
        echo "::: Using interface: $pivpnInterface"
        echo "${pivpnInterface}" > /tmp/pivpnINT
        echo "::: Using User: $pivpnUser"
        echo "${pivpnUser}" > /tmp/pivpnUSR
        echo "::: Using protocol: $pivpnProto"
        echo "${pivpnProto}" > /tmp/pivpnPROTO
        echo "::: Using port: $PORT"
        echo ${PORT} > /tmp/INSTALL_PORT
        echo ":::"

        # Only try to set static on Raspbian
        case ${PLAT} in
          Rasp*)
            setStaticIPv4 # This might be a problem if a user tries to modify the ip in the config file and then runs an update because of the way we check for previous configuration in /etc/dhcpcd.conf
            ;;
          *)
            echo "::: IP Information"
            echo "::: Since we think you are not using Raspbian, we will not configure a static IP for you."
            echo "::: If you are in Amazon then you can not configure a static IP anyway."
            echo "::: Just ensure before this installer started you had set an elastic IP on your instance."
            ;;
          esac

        # Clone/Update the repos
        clone_or_update_repos


        updatePiVPN | tee ${tmpLog}
    fi

    #Move the install log into /etc/pivpn for storage
    $SUDO mv ${tmpLog} ${instalLogLoc}

    echo "::: Restarting services..."
    # Start services
    case ${PLAT} in
        Ubuntu|Debian|*vuan)
            $SUDO service openvpn start
            ;;
        *)
            $SUDO systemctl enable openvpn.service
            $SUDO systemctl start openvpn.service
            ;;
    esac

    echo "::: done."

    if [[ "${useUpdateVars}" == false ]]; then
        displayFinalMessage
    fi

    echo ":::"
    if [[ "${useUpdateVars}" == false ]]; then
        echo "::: Installation Complete!"
        echo "::: Now run 'pivpn add' to create an ovpn profile for each of your devices."
        echo "::: Run 'pivpn help' to see what else you can do!"
        echo "::: It is strongly recommended you reboot after installation."
    else
        echo "::: Update complete!"
    fi

    echo ":::"
    echo "::: The install log is located at: ${instalLogLoc}"
}

if [[ "${PIVPN_TEST}" != true ]] ; then
  main "$@"
fi
+ [[ '' != true ]]
+ main
+ echo :::
:::
+ [[ 1000 -eq 0 ]]
+ echo '::: sudo will be used for the install.'
::: sudo will be used for the install.
++ dpkg-query -s sudo
+ [[ -n Package: sudo
Status: install ok installed
Priority: optional
Section: admin
Installed-Size: 3002
Maintainer: Bdale Garbee <bdale@gag.com>
Architecture: armhf
Version: 1.8.19p1-2.1
Replaces: sudo-ldap
Depends: libaudit1 (>= 1:2.2.1), libc6 (>= 2.17), libpam0g (>= 0.99.7.1), libselinux1 (>= 1.32), libpam-modules, lsb-base
Conflicts: sudo-ldap
Conffiles:
 /etc/init.d/sudo 69497d0565055f626ee2bc84f818ce0f
 /etc/pam.d/sudo 85da64f888739f193fc0fa896680030e
 /etc/sudoers 45437b4e86fba2ab890ac81db2ec3606
 /etc/sudoers.d/README 8d3cf36d1713f40a0ddc38e1b21a51b6
Description: Provide limited super user privileges to specific users
 Sudo is a program designed to allow a sysadmin to give limited root
 privileges to users and log root activity.  The basic philosophy is to give
 as few privileges as possible but still allow people to get their work done.
 .
 This version is built with minimal shared library dependencies, use the
 sudo-ldap package instead if you need LDAP support for sudoers.
Homepage: http://www.sudo.ws/ ]]
+ export SUDO=sudo
+ SUDO=sudo
+ export 'SUDOE=sudo -E'
+ SUDOE='sudo -E'
+ distro_check
+ hash lsb_release
++ lsb_release -si
+ PLAT=Raspbian
++ lsb_release -sc
+ OSCN=stretch
+ case ${PLAT} in
+ case ${OSCN} in
+ echo Raspbian
+ [[ -f /etc/pivpn/setupVars.conf ]]
+ [[ false == true ]]
+ verifyFreeDiskSpace
+ echo '::: Verifying free disk space...'
::: Verifying free disk space...
+ local required_free_kilobytes=76800
++ df -Pk
++ grep -m1 '\/$'
++ awk '{print $4}'
+ local existing_free_kilobytes=27732520
+ [[ 27732520 =~ ^([0-9])+$ ]]
+ [[ 27732520 -lt 76800 ]]
+ addSoftwareRepo
+ case ${PLAT} in
+ update_package_cache
++ stat -c %Y /var/lib/apt/lists/
+ timestamp=1539196204
++ date -d @1539196204 '+%b %e'
+ timestampAsDate='Oct 10'
++ date '+%b %e'
+ today='Oct 10'
+ '[' '!' 'Oct 10' == 'Oct 10' ']'
+ notify_package_updates_available
+ echo :::
:::
+ echo -n '::: Checking apt-get for upgraded packages....'
::: Checking apt-get for upgraded packages....++ eval 'apt-get -s -o Debug::NoLocking=true upgrade | grep -c ^Inst || true'
+++ apt-get -s -o Debug::NoLocking=true upgrade
+++ grep -c '^Inst'
+++ true
+ updatesToInstall=0
+ echo ' done!'
 done!
+ echo :::
:::
+ [[ 0 -eq 0 ]]
+ echo '::: Your system is up to date! Continuing with PiVPN installation...'
::: Your system is up to date! Continuing with PiVPN installation...
+ install_dependent_packages 'PIVPN_DEPS[@]'
+ argArray1=("${!1}")
+ declare -a argArray1
+ echo iptables-persistent iptables-persistent/autosave_v4 boolean true
+ sudo debconf-set-selections
+ sudo debconf-set-selections
+ echo iptables-persistent iptables-persistent/autosave_v6 boolean false
+ command -v debconf-apt-progress
+ sudo debconf-apt-progress -- apt-get --yes --no-install-recommends install openvpn git dhcpcd5 tar wget grep iptables-persistent dnsutils expect whiptail net-tools
+ [[ false == false ]]
+ welcomeDialogs
+ whiptail --msgbox --backtitle Welcome --title 'PiVPN Automated Installer' 'This installer will transform your Raspberry Pi into an OpenVPN server!' 24 70
+ whiptail --msgbox --backtitle 'Initiating network interface' --title 'Static IP Needed' 'The PiVPN is a SERVER so it needs a STATIC IP ADDRESS to function properly.

In the next section, you can choose to use your current network settings (DHCP) or to manually edit them.' 24 70
+ chooseInterface
+ interfacesArray=()
+ local interfacesArray
+ local interfaceCount
+ local chooseInterfaceCmd
+ local chooseInterfaceOptions
+ local firstloop=1
++ echo eth0
++ wc -l
+ [[ 1 -eq 1 ]]
+ pivpnInterface=eth0
+ echo eth0
+ return
+ [[ Raspbian != \R\a\s\p\b\i\a\n ]]
+ getStaticIPv4Settings
+ local ipSettingsCorrect
++ nslookup 127.0.0.1
++ grep Server:
++ awk '{print $2}'
+ IPv4dns=192.168.0.103
+ whiptail --backtitle 'Calibrating network interface' --title 'Static IP Address' --yesno 'Do you want to use your current network settings as a static address?
                    IP address:    192.168.0.104
                    Gateway:       192.168.0.1' 24 70
+ whiptail --msgbox --backtitle 'IP information' --title 'FYI: IP Conflict' 'It is possible your router could still try to assign this IP to a device, which would cause a conflict.  But in most cases the router is smart enough to not do that.
If you are worried, either manually set the address, or modify the DHCP reservation pool so it does not include the IP you want.
It is also possible to use a DHCP reservation, but if you are going to do that, you might as well set a static address.' 24 70
+ setStaticIPv4
+ [[ -f /etc/dhcpcd.conf ]]
+ grep -q 192.168.0.104 /etc/dhcpcd.conf
+ echo '::: Static IP already configured.'
::: Static IP already configured.
+ chooseUser
+ whiptail --msgbox --backtitle 'Parsing User List' --title 'Local Users' 'Choose a local user that will hold your ovpn configurations.' 24 70
++ awk -F: 'BEGIN {count=0} $3>=500 && $3<=60000 { count++ } END{ print count }' /etc/passwd
+ numUsers=1
+ '[' 1 -eq 0 ']'
++ awk -F: '$3>=500 && $3<=60000 {print $1}' /etc/passwd
+ availableUsers=pi
+ userArray=()
+ local userArray
+ local firstloop=1
+ read -r line
+ mode=OFF
+ [[ 1 -eq 1 ]]
+ firstloop=0
+ mode=ON
+ userArray+=("${line}" "" "${mode}")
+ read -r line
+ chooseUserCmd=(whiptail --title "Choose A User" --separate-output --radiolist "Choose (press space to select):" ${r} ${c} ${numUsers})
++ whiptail --title 'Choose A User' --separate-output --radiolist 'Choose (press space to select):' 24 70 1 pi '' ON
+ chooseUserOptions=pi
+ [[ 0 = 0 ]]
+ for desiredUser in ${chooseUserOptions}
+ pivpnUser=pi
+ echo '::: Using User: pi'
::: Using User: pi
+ echo pi
+ unattendedUpgrades
+ whiptail --msgbox --backtitle 'Security Updates' --title 'Unattended Upgrades' 'Since this server will have at least one port open to the internet, it is recommended you enable unattended-upgrades.\nThis feature will check daily for security package updates only and apply them when necessary.\nIt will NOT automatically reboot the server so to fully apply some updates you should periodically reboot.' 24 70
+ whiptail --backtitle 'Security Updates' --title 'Unattended Upgrades' --yesno 'Do you want to enable unattended upgrades of security patches to this server?' 24 70
+ UNATTUPG=unattended-upgrades
+ clone_or_update_repos
+ [[ false == true ]]
+ getGitFiles /etc/.pivpn https://github.com/pivpn/pivpn.git
+ echo :::
:::
+ echo '::: Checking for existing base files...'
::: Checking for existing base files...
+ is_repo /etc/.pivpn
+ echo -n ':::    Checking /etc/.pivpn is a repo...'
:::    Checking /etc/.pivpn is a repo...+ cd /etc/.pivpn
+ return 1
+ make_repo /etc/.pivpn https://github.com/pivpn/pivpn.git
+ echo -n ':::    Cloning https://github.com/pivpn/pivpn.git into /etc/.pivpn...'
:::    Cloning https://github.com/pivpn/pivpn.git into /etc/.pivpn...+ sudo rm -rf /etc/.pivpn
+ spinner 9479
+ local pid=9479
+ local delay=0.50
+ local 'spinstr=/-\|'
+ sudo git clone -q https://github.com/pivpn/pivpn.git /etc/.pivpn
++ ps a
++ grep 9479
++ awk '{print $1}'
+ '[' 9479 ']'
+ local 'temp=-\|'
+ printf ' [%c]  ' '/-\|'
 [/]  + local 'spinstr=-\|/'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ awk '{print $1}'
++ ps a
++ grep 9479
+ '[' 9479 ']'
+ local 'temp=\|/'
+ printf ' [%c]  ' '-\|/'
 [-]  + local 'spinstr=\|/-'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ grep 9479
++ awk '{print $1}'
+ '[' 9479 ']'
+ local 'temp=|/-'
+ printf ' [%c]  ' '\|/-'
 [\]  + local 'spinstr=|/-\'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ grep 9479
++ awk '{print $1}'
+ '[' 9479 ']'
+ local 'temp=/-\'
+ printf ' [%c]  ' '|/-\'
 [|]  + local 'spinstr=/-\|'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ awk '{print $1}'
++ grep 9479
++ ps a
+ '[' 9479 ']'
+ local 'temp=-\|'
+ printf ' [%c]  ' '/-\|'
 [/]  + local 'spinstr=-\|/'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9479
+ '[' 9479 ']'
+ local 'temp=\|/'
+ printf ' [%c]  ' '-\|/'
 [-]  + local 'spinstr=\|/-'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9479
+ '[' 9479 ']'
+ local 'temp=|/-'
+ printf ' [%c]  ' '\|/-'
 [\]  + local 'spinstr=|/-\'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9479
+ '[' 9479 ']'
+ local 'temp=/-\'
+ printf ' [%c]  ' '|/-\'
 [|]  + local 'spinstr=/-\|'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9479
+ '[' 9479 ']'
+ local 'temp=-\|'
+ printf ' [%c]  ' '/-\|'
 [/]  + local 'spinstr=-\|/'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9479
+ '[' '' ']'
+ printf '    \b\b\b\b'
+ '[' -z '' ']'
+ :
+ echo ' done!'
 done!
+ installPiVPN
+ stopServices
+ sudo echo :::
+ tee /tmp/pivpn-install.log
:::
+ sudo echo -n '::: Stopping OpenVPN service...'
::: Stopping OpenVPN service...+ case ${PLAT} in
+ sudo systemctl stop openvpn.service
+ sudo echo ' done.'
 done.
+ sudo mkdir -p /etc/pivpn/
+ confUnattendedUpgrades
+ [[ unattended-upgrades == \u\n\a\t\t\e\n\d\e\d\-\u\p\g\r\a\d\e\s ]]
+ spinner 9586
+ local pid=9586
+ local delay=0.50
+ local 'spinstr=/-\|'
+ sudo apt-get --yes --quiet --no-install-recommends install unattended-upgrades
++ ps a
++ grep 9586
++ awk '{print $1}'
+ '[' 9586 ']'
+ local 'temp=-\|'
+ printf ' [%c]  ' '/-\|'
 [/]  + local 'spinstr=-\|/'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ grep 9586
++ awk '{print $1}'
+ '[' 9586 ']'
+ local 'temp=\|/'
+ printf ' [%c]  ' '-\|/'
 [-]  + local 'spinstr=\|/-'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=|/-'
+ printf ' [%c]  ' '\|/-'
 [\]  + local 'spinstr=|/-\'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=/-\'
+ printf ' [%c]  ' '|/-\'
 [|]  + local 'spinstr=/-\|'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ grep 9586
++ awk '{print $1}'
+ '[' 9586 ']'
+ local 'temp=-\|'
+ printf ' [%c]  ' '/-\|'
 [/]  + local 'spinstr=-\|/'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ grep 9586
++ awk '{print $1}'
+ '[' 9586 ']'
+ local 'temp=\|/'
+ printf ' [%c]  ' '-\|/'
 [-]  + local 'spinstr=\|/-'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ awk '{print $1}'
++ ps a
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=|/-'
+ printf ' [%c]  ' '\|/-'
 [\]  + local 'spinstr=|/-\'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=/-\'
+ printf ' [%c]  ' '|/-\'
 [|]  + local 'spinstr=/-\|'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=-\|'
+ printf ' [%c]  ' '/-\|'
 [/]  + local 'spinstr=-\|/'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=\|/'
+ printf ' [%c]  ' '-\|/'
 [-]  + local 'spinstr=\|/-'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ awk '{print $1}'
++ ps a
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=|/-'
+ printf ' [%c]  ' '\|/-'
 [\]  + local 'spinstr=|/-\'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=/-\'
+ printf ' [%c]  ' '|/-\'
 [|]  + local 'spinstr=/-\|'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=-\|'
+ printf ' [%c]  ' '/-\|'
 [/]  + local 'spinstr=-\|/'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=\|/'
+ printf ' [%c]  ' '-\|/'
 [-]  + local 'spinstr=\|/-'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=|/-'
+ printf ' [%c]  ' '\|/-'
 [\]  + local 'spinstr=|/-\'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ grep 9586
++ awk '{print $1}'
+ '[' 9586 ']'
+ local 'temp=/-\'
+ printf ' [%c]  ' '|/-\'
 [|]  + local 'spinstr=/-\|'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=-\|'
+ printf ' [%c]  ' '/-\|'
 [/]  + local 'spinstr=-\|/'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=\|/'
+ printf ' [%c]  ' '-\|/'
 [-]  + local 'spinstr=\|/-'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=|/-'
+ printf ' [%c]  ' '\|/-'
 [\]  + local 'spinstr=|/-\'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=/-\'
+ printf ' [%c]  ' '|/-\'
 [|]  + local 'spinstr=/-\|'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ awk '{print $1}'
++ ps a
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=-\|'
+ printf ' [%c]  ' '/-\|'
 [/]  + local 'spinstr=-\|/'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=\|/'
+ printf ' [%c]  ' '-\|/'
 [-]  + local 'spinstr=\|/-'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ grep 9586
++ awk '{print $1}'
+ '[' 9586 ']'
+ local 'temp=|/-'
+ printf ' [%c]  ' '\|/-'
 [\]  + local 'spinstr=|/-\'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=/-\'
+ printf ' [%c]  ' '|/-\'
 [|]  + local 'spinstr=/-\|'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=-\|'
+ printf ' [%c]  ' '/-\|'
 [/]  + local 'spinstr=-\|/'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ awk '{print $1}'
++ ps a
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=\|/'
+ printf ' [%c]  ' '-\|/'
 [-]  + local 'spinstr=\|/-'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=|/-'
+ printf ' [%c]  ' '\|/-'
 [\]  + local 'spinstr=|/-\'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ grep 9586
++ awk '{print $1}'
++ ps a
+ '[' 9586 ']'
+ local 'temp=/-\'
+ printf ' [%c]  ' '|/-\'
 [|]  + local 'spinstr=/-\|'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ grep 9586
++ awk '{print $1}'
++ ps a
+ '[' 9586 ']'
+ local 'temp=-\|'
+ printf ' [%c]  ' '/-\|'
 [/]  + local 'spinstr=-\|/'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ awk '{print $1}'
++ ps a
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=\|/'
+ printf ' [%c]  ' '-\|/'
 [-]  + local 'spinstr=\|/-'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=|/-'
+ printf ' [%c]  ' '\|/-'
 [\]  + local 'spinstr=|/-\'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=/-\'
+ printf ' [%c]  ' '|/-\'
 [|]  + local 'spinstr=/-\|'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ grep 9586
++ awk '{print $1}'
+ '[' 9586 ']'
+ local 'temp=-\|'
+ printf ' [%c]  ' '/-\|'
 [/]  + local 'spinstr=-\|/'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'
                 ++ ps a
                        ++ awk '{print $1}'
                                           ++ grep 9586
                                                       + '[' 9586 ']'
                                                                     + local 'temp=\|/'
                                                                                       + printf ' [%c]  ' '-\|/'
                                                                                                                 [-]  + local 'spinstr=\|/-'
                  + sleep 0.50
                              + printf '\b\b\b\b\b\b'
                                               ++ grep 9586
                                                           ++ ps a
                                                                  ++ awk '{print $1}'
                                                                                     + '[' 9586 ']'
                                                                                                   + local 'temp=|/-'
                                                                                                                     + printf ' [%c]  ' '\|/-'
                     [\]  + local 'spinstr=|/-\'
                                                + sleep 0.50
                                                            + printf '\b\b\b\b\b\b'
                                                                             ++ ps a
                                                                                    ++ grep 9586
                                                                                                ++ awk '{print $1}'
                                                                                                                   + '[' 9586 ']'
       + local 'temp=/-\'
                         + printf ' [%c]  ' '|/-\'
                                                   [|]  + local 'spinstr=/-\|'
                                                                              + sleep 0.50
                                                                                          + printf '\b\b\b\b\b\b'
                                                                                                           ++ ps a
                                                                                                                  ++ awk '{print $1}'
           ++ grep 9586
                       + '[' 9586 ']'
                                     + local 'temp=-\|'
                                                       + printf ' [%c]  ' '/-\|'
                                                                                 [/]  + local 'spinstr=-\|/'
                                                                                                            + sleep 0.50
                                                                                                                        + printf '\b\b\b\b\b\b'
               ++ ps a
                      ++ grep 9586
                                  ++ awk '{print $1}'
                                                     + '[' 9586 ']'
                                                                   + local 'temp=\|/'
                                                                                     + printf ' [%c]  ' '-\|/'
                                                                                                               [-]  + local 'spinstr=\|/-'
                + sleep 0.50
                            + printf '\b\b\b\b\b\b'
                                             ++ ps a
                                                    ++ awk '{print $1}'
                                                                       ++ grep 9586
                                                                                   + '[' 9586 ']'
                                                                                                 + local 'temp=|/-'
                                                                                                                   + printf ' [%c]  ' '\|/-'
                   [\]  + local 'spinstr=|/-\'
                                              + sleep 0.50
                                                          + printf '\b\b\b\b\b\b'
                                                                           ++ ps a
                                                                                  ++ grep 9586
                                                                                              ++ awk '{print $1}'
                                                                                                                 + '[' 9586 ']'
     + local 'temp=/-\'
                       + printf ' [%c]  ' '|/-\'
                                                 [|]  + local 'spinstr=/-\|'
                                                                            + sleep 0.50
                                                                                        + printf '\b\b\b\b\b\b'
                                                                                                         ++ ps a
                                                                                                                ++ awk '{print $1}'
         ++ grep 9586
                     + '[' 9586 ']'
                                   + local 'temp=-\|'
                                                     + printf ' [%c]  ' '/-\|'
                                                                               [/]  + local 'spinstr=-\|/'
                                                                                                          + sleep 0.50
                                                                                                                      + printf '\b\b\b\b\b\b'
             ++ ps a
                    ++ awk '{print $1}'
                                       ++ grep 9586
                                                   + '[' 9586 ']'
                                                                 + local 'temp=\|/'
                                                                                   + printf ' [%c]  ' '-\|/'
                                                                                                             [-]  + local 'spinstr=\|/-'
              + sleep 0.50
                          + printf '\b\b\b\b\b\b'
                                           ++ ps a
                                                  ++ awk '{print $1}'
                                                                     ++ grep 9586
                                                                                 + '[' 9586 ']'
                                                                                               + local 'temp=|/-'
                                                                                                                 + printf ' [%c]  ' '\|/-'
                 [\]  + local 'spinstr=|/-\'
                                            + sleep 0.50
                                                        + printf '\b\b\b\b\b\b'
                                                                         ++ awk '{print $1}'
                                                                                            ++ ps a
                                                                                                   ++ grep 9586
                                                                                                               + '[' 9586 ']'
   + local 'temp=/-\'
                     + printf ' [%c]  ' '|/-\'
                                               [|]  + local 'spinstr=/-\|'
                                                                          + sleep 0.50
                                                                                      + printf '\b\b\b\b\b\b'
                                                                                                       ++ awk '{print $1}'
                                                                                                                         ++ grep 9586
           ++ ps a
                  + '[' 9586 ']'
                                + local 'temp=-\|'
                                                  + printf ' [%c]  ' '/-\|'
                                                                            [/]  + local 'spinstr=-\|/'
                                                                                                       + sleep 0.50
                                                                                                                   + printf '\b\b\b\b\b\b'
          ++ grep 9586
                      ++ awk '{print $1}'
                                         ++ ps a
                                                + '[' 9586 ']'
                                                              + local 'temp=\|/'
                                                                                + printf ' [%c]  ' '-\|/'
                                                                                                          [-]  + local 'spinstr=\|/-'
           + sleep 0.50
                       + printf '\b\b\b\b\b\b'
                                        ++ ps a
                                               ++ awk '{print $1}'
                                                                  ++ grep 9586
                                                                              + '[' 9586 ']'
                                                                                            + local 'temp=|/-'
                                                                                                              + printf ' [%c]  ' '\|/-'
              [\]  + local 'spinstr=|/-\'
                                         + sleep 0.50
                                                     + printf '\b\b\b\b\b\b'
                                                                      ++ ps a
                                                                             ++ awk '{print $1}'
                                                                                                ++ grep 9586
                                                                                                            + '[' 9586 ']'
                                                                                                                         + local 'temp=/-\'
                 + printf ' [%c]  ' '|/-\'
                                           [|]  + local 'spinstr=/-\|'
                                                                      + sleep 0.50
                                                                                  + printf '\b\b\b\b\b\b'
                                                                                                   ++ ps a
                                                                                                          ++ awk '{print $1}'
   ++ grep 9586
               + '[' 9586 ']'
                             + local 'temp=-\|'
                                               + printf ' [%c]  ' '/-\|'
                                                                         [/]  + local 'spinstr=-\|/'
                                                                                                    + sleep 0.50
                                                                                                                + printf '\b\b\b\b\b\b'
       ++ ps a
              ++ grep 9586
                          ++ awk '{print $1}'
                                             + '[' 9586 ']'
                                                           + local 'temp=\|/'
                                                                             + printf ' [%c]  ' '-\|/'
                                                                                                       [-]  + local 'spinstr=\|/-'
        + sleep 0.50
                    + printf '\b\b\b\b\b\b'
                                     ++ ps a
                                            ++ awk '{print $1}'
                                                               ++ grep 9586
                                                                           + '[' 9586 ']'
                                                                                         + local 'temp=|/-'
                                                                                                           + printf ' [%c]  ' '\|/-'
           [\]  + local 'spinstr=|/-\'
                                      + sleep 0.50
                                                  + printf '\b\b\b\b\b\b'
                                                                   ++ ps a
                                                                          ++ grep 9586
                                                                                      ++ awk '{print $1}'
                                                                                                         + '[' 9586 ']'
                                                                                                                       + local 'temp=/-\'
               + printf ' [%c]  ' '|/-\'
                                         [|]  + local 'spinstr=/-\|'
                                                                    + sleep 0.50
                                                                                + printf '\b\b\b\b\b\b'
                                                                                                 ++ ps a
                                                                                                        ++ awk '{print $1}'
 ++ grep 9586
             + '[' 9586 ']'
                           + local 'temp=-\|'
                                             + printf ' [%c]  ' '/-\|'
                                                                       [/]  + local 'spinstr=-\|/'
                                                                                                  + sleep 0.50
                                                                                                              + printf '\b\b\b\b\b\b'
     ++ ps a
            ++ grep 9586
                        ++ awk '{print $1}'
                                           + '[' 9586 ']'
                                                         + local 'temp=\|/'
                                                                           + printf ' [%c]  ' '-\|/'
                                                                                                     [-]  + local 'spinstr=\|/-'
      + sleep 0.50
                  + printf '\b\b\b\b\b\b'
                                   ++ awk '{print $1}'
                                                      ++ grep 9586
                                                                  ++ ps a
                                                                         + '[' 9586 ']'
                                                                                       + local 'temp=|/-'
                                                                                                         + printf ' [%c]  ' '\|/-'
         [\]  + local 'spinstr=|/-\'
                                    + sleep 0.50
                                                + printf '\b\b\b\b\b\b'
                                                                 ++ ps a
                                                                        ++ awk '{print $1}'
                                                                                           ++ grep 9586
                                                                                                       + '[' 9586 ']'
                                                                                                                     + local 'temp=/-\'
             + printf ' [%c]  ' '|/-\'
                                       [|]  + local 'spinstr=/-\|'
                                                                  + sleep 0.50
                                                                              + printf '\b\b\b\b\b\b'
                                                                                               ++ ps a
                                                                                                      ++ awk '{print $1}'
                                                                                                                         ++ grep 9586
           + '[' 9586 ']'
                         + local 'temp=-\|'
                                           + printf ' [%c]  ' '/-\|'
                                                                     [/]  + local 'spinstr=-\|/'
                                                                                                + sleep 0.50
                                                                                                            + printf '\b\b\b\b\b\b'
   ++ ps a
          ++ awk '{print $1}'
                             ++ grep 9586
                                         + '[' 9586 ']'
                                                       + local 'temp=\|/'
                                                                         + printf ' [%c]  ' '-\|/'
                                                                                                   [-]  + local 'spinstr=\|/-'
    + sleep 0.50
                + printf '\b\b\b\b\b\b'
                                 ++ ps a
                                        ++ awk '{print $1}'
                                                           ++ grep 9586
                                                                       + '[' 9586 ']'
                                                                                     + local 'temp=|/-'
                                                                                                       + printf ' [%c]  ' '\|/-'
       [\]  + local 'spinstr=|/-\'
                                  + sleep 0.50
                                              + printf '\b\b\b\b\b\b'
                                                               ++ ps a
                                                                      ++ awk '{print $1}'
                                                                                         ++ grep 9586
                                                                                                     + '[' 9586 ']'
                                                                                                                   + local 'temp=/-\'
           + printf ' [%c]  ' '|/-\'
                                     [|]  + local 'spinstr=/-\|'
                                                                + sleep 0.50
                                                                            + printf '\b\b\b\b\b\b'
                                                                                             ++ ps a
                                                                                                    ++ awk '{print $1}'
                                                                                                                       ++ grep 9586
         + '[' 9586 ']'
                       + local 'temp=-\|'
                                         + printf ' [%c]  ' '/-\|'
                                                                   [/]  + local 'spinstr=-\|/'
                                                                                              + sleep 0.50
                                                                                                          + printf '\b\b\b\b\b\b'
 ++ ps a
        ++ grep 9586
                    ++ awk '{print $1}'
                                       + '[' 9586 ']'
                                                     + local 'temp=\|/'
                                                                       + printf ' [%c]  ' '-\|/'
                                                                                                 [-]  + local 'spinstr=\|/-'
  + sleep 0.50
              + printf '\b\b\b\b\b\b'
                               ++ ps a
                                      ++ grep 9586
                                                  ++ awk '{print $1}'
                                                                     + '[' 9586 ']'
                                                                                   + local 'temp=|/-'
                                                                                                     + printf ' [%c]  ' '\|/-'
     [\]  + local 'spinstr=|/-\'
                                + sleep 0.50
                                            + printf '\b\b\b\b\b\b'
                                                             ++ awk '{print $1}'
                                                                                ++ grep 9586
                                                                                            ++ ps a
                                                                                                   + '[' 9586 ']'
                                                                                                                 + local 'temp=/-\'
         + printf ' [%c]  ' '|/-\'
                                   [|]  + local 'spinstr=/-\|'
                                                              + sleep 0.50
                                                                          + printf '\b\b\b\b\b\b'
                                                                                           ++ ps a
                                                                                                  ++ awk '{print $1}'
                                                                                                                     ++ grep 9586
       + '[' 9586 ']'
                     + local 'temp=-\|'
                                       + printf ' [%c]  ' '/-\|'
                                                                 [/]  + local 'spinstr=-\|/'
                                                                                            + sleep 0.50
                                                                                                        + printf '\b\b\b\b\b\b'                                                                                                                    ++ ps a
      ++ awk '{print $1}'
                         ++ grep 9586
                                     + '[' 9586 ']'
                                                   + local 'temp=\|/'
                                                                     + printf ' [%c]  ' '-\|/'
                                                                                               [-]  + local 'spinstr=\|/-'
                                                                                                                         + sleep 0.50
           + printf '\b\b\b\b\b\b'
                            ++ ps a
                                   ++ grep 9586
                                               ++ awk '{print $1}'
                                                                  + '[' 9586 ']'
                                                                                + local 'temp=|/-'
                                                                                                  + printf ' [%c]  ' '\|/-'
  [\]  + local 'spinstr=|/-\'
                             + sleep 0.50
                                         + printf '\b\b\b\b\b\b'
                                                          ++ ps a
                                                                 ++ awk '{print $1}'
                                                                                    ++ grep 9586
                                                                                                + '[' 9586 ']'
                                                                                                              + local 'temp=/-\'
      + printf ' [%c]  ' '|/-\'
                                [|]  + local 'spinstr=/-\|'
                                                           + sleep 0.50
                                                                       + printf '\b\b\b\b\b\b'
                                                                                        ++ ps a
                                                                                               ++ grep 9586
                                                                                                           ++ awk '{print $1}'
    + '[' 9586 ']'
                  + local 'temp=-\|'
                                    + printf ' [%c]  ' '/-\|'
                                                              [/]  + local 'spinstr=-\|/'
                                                                                         + sleep 0.50
                                                                                                     + printf '\b\b\b\b\b\b'                                                                                                                    ++ ps a
   ++ grep 9586
               ++ awk '{print $1}'
                                  + '[' 9586 ']'
                                                + local 'temp=\|/'
                                                                  + printf ' [%c]  ' '-\|/'
                                                                                            [-]  + local 'spinstr=\|/-'
                                                                                                                       + sleep 0.50
         + printf '\b\b\b\b\b\b'
                          ++ ps a
                                 ++ awk '{print $1}'
                                                    ++ grep 9586
                                                                + '[' 9586 ']'
                                                                              + local 'temp=|/-'
                                                                                                + printf ' [%c]  ' '\|/-'
                                                                                                                          [\]  + local 'spinstr=|/-\'
                           + sleep 0.50
                                       + printf '\b\b\b\b\b\b'
                                                        ++ awk '{print $1}'
                                                                           ++ ps a
                                                                                  ++ grep 9586
                                                                                              + '[' 9586 ']'
                                                                                                            + local 'temp=/-\'
    + printf ' [%c]  ' '|/-\'
                              [|]  + local 'spinstr=/-\|'
                                                         + sleep 0.50
                                                                     + printf '\b\b\b\b\b\b'
                                                                                      ++ grep 9586
                                                                                                  ++ awk '{print $1}'
                                                                                                                     ++ ps a
  + '[' 9586 ']'
                + local 'temp=-\|'
                                  + printf ' [%c]  ' '/-\|'
                                                            [/]  + local 'spinstr=-\|/'
                                                                                       + sleep 0.50
                                                                                                   + printf '\b\b\b\b\b\b'
                                                                                                                   ++ ps a
                                                                                                                         ++ awk '{print $1}'
                  ++ grep 9586
                              + '[' 9586 ']'
                                            + local 'temp=\|/'
                                                              + printf ' [%c]  ' '-\|/'
                                                                                        [-]  + local 'spinstr=\|/-'
                                                                                                                   + sleep 0.50
     + printf '\b\b\b\b\b\b'
                      ++ ps a
                             ++ grep 9586
                                         ++ awk '{print $1}'
                                                            + '[' 9586 ']'
                                                                          + local 'temp=|/-'
                                                                                            + printf ' [%c]  ' '\|/-'
                                                                                                                      [\]  + local 'spinstr=|/-\'
                       + sleep 0.50
                                   + printf '\b\b\b\b\b\b'
                                                    ++ awk '{print $1}'
                                                                       ++ ps a
                                                                              ++ grep 9586
                                                                                          + '[' 9586 ']'
                                                                                                        + local 'temp=/-\'
                                                                                                                         + printf ' [%c]  ' '|/-\'
                         [|]  + local 'spinstr=/-\|'
                                                    + sleep 0.50
                                                                + printf '\b\b\b\b\b\b'
                                                                                 ++ ps a
                                                                                        ++ awk '{print $1}'
                                                                                                           ++ grep 9586
                                                                                                                       + '[' 9586 ']'
           + local 'temp=-\|'
                             + printf ' [%c]  ' '/-\|'
                                                       [/]  + local 'spinstr=-\|/'
                                                                                  + sleep 0.50
                                                                                              + printf '\b\b\b\b\b\b'
                                                                                                               ++ grep 9586
 ++ ps a
        ++ awk '{print $1}'
                           + '[' 9586 ']'
                                         + local 'temp=\|/'
                                                           + printf ' [%c]  ' '-\|/'
                                                                                     [-]  + local 'spinstr=\|/-'
                                                                                                                + sleep 0.50
  + printf '\b\b\b\b\b\b'
                   ++ ps a
                          ++ grep 9586
                                      ++ awk '{print $1}'
                                                         + '[' 9586 ']'
                                                                       + local 'temp=|/-'
                                                                                         + printf ' [%c]  ' '\|/-'
                                                                                                                   [\]  + local 'spinstr=|/-\'
                    + sleep 0.50
                                + printf '\b\b\b\b\b\b'
                                                 ++ ps a
                                                        ++ awk '{print $1}'
                                                                           ++ grep 9586
                                                                                       + '[' 9586 ']'
                                                                                                     + local 'temp=/-\'
                                                                                                                       + printf ' [%c]  ' '|/-\'
                       [|]  + local 'spinstr=/-\|'
                                                  + sleep 0.50
                                                              + printf '\b\b\b\b\b\b'
                                                                               ++ ps a
                                                                                      ++ awk '{print $1}'
                                                                                                         ++ grep 9586
                                                                                                                     + '[' 9586 ']'
         + local 'temp=-\|'
                           + printf ' [%c]  ' '/-\|'
                                                     [/]  + local 'spinstr=-\|/'
                                                                                + sleep 0.50
                                                                                            + printf '\b\b\b\b\b\b'
                                                                                                             ++ ps a
                                                                                                                    ++ awk '{print $1}'
             ++ grep 9586
                         + '[' 9586 ']'
                                       + local 'temp=\|/'
                                                         + printf ' [%c]  ' '-\|/'
                                                                                   [-]  + local 'spinstr=\|/-'
                                                                                                              + sleep 0.50
                                                                                                                         + printf '\b\b\b\b\b\b'
                ++ ps a
                       ++ awk '{print $1}'
                                          ++ grep 9586
                                                      + '[' 9586 ']'
                                                                    + local 'temp=|/-'
                                                                                      + printf ' [%c]  ' '\|/-'
                                                                                                                [\]  + local 'spinstr=|/-\'
                 + sleep 0.50
                             + printf '\b\b\b\b\b\b'
                                              ++ ps a
                                                     ++ awk '{print $1}'
                                                                        ++ grep 9586
                                                                                    + '[' 9586 ']'
                                                                                                  + local 'temp=/-\'
                                                                                                                    + printf ' [%c]  ' '|/-\'
                    [|]  + local 'spinstr=/-\|'
                                               + sleep 0.50
                                                           + printf '\b\b\b\b\b\b'
                                                                            ++ ps a
                                                                                   ++ awk '{print $1}'
                                                                                                      ++ grep 9586
                                                                                                                  + '[' 9586 ']'
      + local 'temp=-\|'
                        + printf ' [%c]  ' '/-\|'
                                                  [/]  + local 'spinstr=-\|/'
                                                                             + sleep 0.50
                                                                                         + printf '\b\b\b\b\b\b'
                                                                                                          ++ ps a
                                                                                                                 ++ awk '{print $1}'
          ++ grep 9586
                      + '[' 9586 ']'
                                    + local 'temp=\|/'
                                                      + printf ' [%c]  ' '-\|/'
                                                                                [-]  + local 'spinstr=\|/-'
                                                                                                           + sleep 0.50
                                                                                                                       + printf '\b\b\b\b\b\b'
              ++ ps a
                     ++ grep 9586
                                 ++ awk '{print $1}'
                                                    + '[' 9586 ']'
                                                                  + local 'temp=|/-'
                                                                                    + printf ' [%c]  ' '\|/-'
                                                                                                              [\]  + local 'spinstr=|/-\'
               + sleep 0.50
                           + printf '\b\b\b\b\b\b'
                                            ++ ps a
                                                   ++ awk '{print $1}'
                                                                      ++ grep 9586
                                                                                  + '[' 9586 ']'
                                                                                                + local 'temp=/-\'
                                                                                                                  + printf ' [%c]  ' '|/-\'
                  [|]  + local 'spinstr=/-\|'
                                             + sleep 0.50
                                                         + printf '\b\b\b\b\b\b'
                                                                          ++ ps a
                                                                                 ++ grep 9586
                                                                                             ++ awk '{print $1}'
                                                                                                                + '[' 9586 ']'
    + local 'temp=-\|'
                      + printf ' [%c]  ' '/-\|'
                                                [/]  + local 'spinstr=-\|/'
                                                                           + sleep 0.50
                                                                                       + printf '\b\b\b\b\b\b'
                                                                                                        ++ ps a
                                                                                                               ++ awk '{print $1}'
        ++ grep 9586
                    + '[' 9586 ']'
                                  + local 'temp=\|/'
                                                    + printf ' [%c]  ' '-\|/'
                                                                              [-]  + local 'spinstr=\|/-'
                                                                                                         + sleep 0.50
                                                                                                                     + printf '\b\b\b\b\b\b'                                                                                                  ++ awk '{print $1}'
++ grep 9586
++ ps a
+ '[' 9586 ']'
+ local 'temp=|/-'
+ printf ' [%c]  ' '\|/-'
 [\]  + local 'spinstr=|/-\'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9586
+ '[' 9586 ']'
+ local 'temp=/-\'
+ printf ' [%c]  ' '|/-\'
 [|]  + local 'spinstr=/-\|'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ grep 9586
++ awk '{print $1}'
+ '[' 9586 ']'
+ local 'temp=-\|'
+ printf ' [%c]  ' '/-\|'
 [/]  + local 'spinstr=-\|/'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ grep 9586
++ awk '{print $1}'
+ '[' 9586 ']'
+ local 'temp=\|/'
+ printf ' [%c]  ' '-\|/'
 [-]  + local 'spinstr=\|/-'
+ sleep 0.50
+ printf '\b\b\b\b\b\b'                                                                                             ++ ps a
++ awk '{print $1}'
++ grep 9586
+ '[' '' ']'
+ printf '    \b\b\b\b'
+ [[ Raspbian == \U\b\u\n\t\u ]]
+ sudo sed -i '/\(o=Raspbian,n=jessie\)/c\"o=Raspbian,n=jessie,l=Raspbian-Security";\' /etc/apt/apt.conf.d/50unattended-upgrades
+ sudo tee /etc/apt/apt.conf.d/02periodic
+ cat
+ installScripts
+ sudo echo :::
:::
+ sudo echo -n '::: Installing scripts to /opt/pivpn...'
::: Installing scripts to /opt/pivpn...+ '[' '!' -d /opt/pivpn ']'
+ sudo mkdir /opt/pivpn
+ sudo chown pi:root /opt/pivpn
+ sudo chmod u+srwx /opt/pivpn
+ sudo cp /etc/.pivpn/scripts/makeOVPN.sh /opt/pivpn/makeOVPN.sh
+ sudo cp /etc/.pivpn/scripts/clientStat.sh /opt/pivpn/clientStat.sh
+ sudo cp /etc/.pivpn/scripts/listOVPN.sh /opt/pivpn/listOVPN.sh
+ sudo cp /etc/.pivpn/scripts/removeOVPN.sh /opt/pivpn/removeOVPN.sh
+ sudo cp /etc/.pivpn/scripts/uninstall.sh /opt/pivpn/uninstall.sh
+ sudo cp /etc/.pivpn/scripts/pivpnDebug.sh /opt/pivpn/pivpnDebug.sh
+ sudo cp /etc/.pivpn/scripts/fix_iptables.sh /opt/pivpn/fix_iptables.sh
+ sudo chmod 0755 /opt/pivpn/makeOVPN.sh /opt/pivpn/clientStat.sh /opt/pivpn/listOVPN.sh /opt/pivpn/removeOVPN.sh /opt/pivpn/uninstall.sh /opt/pivpn/pivpnDebug.sh /opt/pivpn/fix_iptables.sh
+ sudo cp /etc/.pivpn/pivpn /usr/local/bin/pivpn
+ sudo chmod 0755 /usr/local/bin/pivpn
+ sudo cp /etc/.pivpn/scripts/bash-completion /etc/bash_completion.d/pivpn
+ . /etc/bash_completion.d/pivpn
_pivpn()
{
    local cur prev opts
    COMPREPLY=()
    cur="${COMP_WORDS[COMP_CWORD]}"
    prev="${COMP_WORDS[COMP_CWORD-1]}"
    dashopts="-a -c -d -l -r -h -u"
    opts="debug add clients list revoke uninstall help"
    if [ "${#COMP_WORDS[@]}" -eq 2 ]
    then
        if [[ ${cur} == -* ]] ; then
            COMPREPLY=( $(compgen -W "${dashopts}" -- "${cur}") )
        else
            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
        fi
    elif [[ ( "$prev" == "add" || "$prev" == "-a" ) && "${#COMP_WORDS[@]}" -eq 3 ]]
    then
        COMPREPLY=( $(compgen -W "nopass" -- "${cur}") )
    fi
    return 0
}
complete -F _pivpn pivpn
++ complete -F _pivpn pivpn
+ sudo cp /tmp/pivpnINT /etc/pivpn/pivpnINTERFACE
+ sudo echo ' done.'
 done.
+ setCustomProto
++ whiptail --title Protocol --radiolist 'Choose a protocol (press space to select). Please only choose TCP if you know why you need TCP.' 24 70 2 UDP '' ON TCP '' OFF
+ protocol=UDP
+ pivpnProto=udp
+ echo '::: Using protocol: udp'
::: Using protocol: udp
+ echo udp
+ PROTO=udp
+ sudo cp /tmp/pivpnPROTO /etc/pivpn/INSTALL_PROTO
+ setCustomPort
+ [[ '' = True ]]
+ portInvalid=Invalid
++ cat /etc/pivpn/INSTALL_PROTO
+ PROTO=udp
+ '[' udp = udp ']'
+ DEFAULT_PORT=1194
++ whiptail --title 'Default OpenVPN Port' --inputbox 'You can modify the default OpenVPN port. \nEnter a new value or hit '\''Enter'\'' to retain the default' 24 70 1194
+ PORT=1195
+ [[ 1195 =~ ^[0-9]+$ ]]
+ '[' 1195 -ge 1 ']'
+ '[' 1195 -le 65535 ']'
+ :
+ [[ 1195 == \I\n\v\a\l\i\d ]]
+ whiptail --backtitle 'Specify Custom Port' --title 'Confirm Custom Port Number' --yesno 'Are these settings correct?\n    PORT:   1195' 24 70
+ PORTNumCorrect=True
+ [[ True = True ]]
+ echo 1195
+ sudo cp /tmp/INSTALL_PORT /etc/pivpn/INSTALL_PORT
+ confOpenVPN
++ tr -dc a-zA-Z0-9
++ head -n 1
++ fold -w 16
++ cat /dev/urandom
+ NEW_UUID=WAz3yWDTIwAaJrEV
+ SERVER_NAME=server_WAz3yWDTIwAaJrEV
+ [[ false == false ]]
++ whiptail --backtitle 'Setup OpenVPN' --title 'Encryption strength' --radiolist 'Choose your desired level of encryption (press space to select):\n   This is an encryption key that will be generated on your system.  The larger the key, the more time this will take.  For most applications, it is recommended to use 2048 bits.  If you are testing, you can use 1024 bits to speed things up, but do not use this for normal use!  If you are paranoid about ... things... then grab a cup of joe and pick 4096 bits.' 24 70 3 1024 'Use 1024-bit encryption (testing only)' OFF 2048 'Use 2048-bit encryption (recommended level)' ON 4096 'Use 4096-bit encryption (paranoid level)' OFF
+ ENCRYPT=1024
+ exitstatus=0
+ '[' 0 '!=' 0 ']'
+ [[ -d /etc/openvpn/easy-rsa/ ]]
+ wget -q -O - https://github.com/pivpn/easy-rsa/releases/download/3.0.1-pivpn1/EasyRSA-3.0.1-pivpn1.tgz
+ sudo tar xz -C /etc/openvpn
+ sudo mv /etc/openvpn/EasyRSA-3.0.1-pivpn1 /etc/openvpn/easy-rsa
+ sudo chown -R root:root /etc/openvpn/easy-rsa
+ sudo mkdir /etc/openvpn/easy-rsa/pki
+ set +e
+ IFS=
+ read -d '' String
+ sudo tee /etc/openvpn/easy-rsa/vars
+ echo 'if [ -z "$EASYRSA_CALLER" ]; then
    echo "Nope." >&2
    return 1
fi
set_var EASYRSA            "/etc/openvpn/easy-rsa"
set_var EASYRSA_PKI        "$EASYRSA/pki"
set_var EASYRSA_KEY_SIZE   2048
set_var EASYRSA_ALGO       rsa
set_var EASYRSA_CURVE      secp384r1
'
+ set -e
+ cd /etc/openvpn/easy-rsa
+ sudo sed -i 's/\(KEY_SIZE\).*/\1   1024/' vars
+ sudo -E ./easyrsa --batch init-pki
+ printf '::: Building CA...\n'
::: Building CA...
+ sudo -E ./easyrsa --batch build-ca nopass
Generating a 1024 bit RSA private key
.........................................++++++
.....................................................++++++
writing new private key to '/etc/openvpn/easy-rsa/pki/private/ca.key.aiuVTH4v58'
-----
+ printf '\n::: CA Complete.\n'

::: CA Complete.
+ [[ false == false ]]
+ whiptail --msgbox --backtitle 'Setup OpenVPN' --title 'Server Information' 'The server key, Diffie-Hellman key, and HMAC key will now be generated.' 24 70

Note: using Easy-RSA configuration from: ./vars
rand: Use -help for summary.
Generating a 1024 bit RSA private key
...++++++
...++++++
writing new private key to '/etc/openvpn/easy-rsa/pki/private/server_WAz3yWDTIwAaJrEV.key.DZ2gMgVl4q'
-----
Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.cnf
Can't open /etc/openvpn/easy-rsa/pki/index.txt.attr for reading, No such file or directory
3069583360:error:02001002:system library:fopen:No such file or directory:../crypto/bio/bss_file.c:74:fopen('/etc/openvpn/easy-rsa/pki/index.txt.attr','r')
3069583360:error:2006D080:BIO routines:BIO_new_file:no such file:../crypto/bio/bss_file.c:81:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'server_WAz3yWDTIwAaJrEV'
Certificate is to be certified until Oct  7 18:59:00 2028 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated
+ [[ false == false ]]
+ [[ Raspbian == \R\a\s\p\b\i\a\n ]]
+ [[ stretch != \s\t\r\e\t\c\h ]]
+ whiptail --backtitle 'Setup OpenVPN' --title 'Version 2.4 improvements' --yesno --defaultno 'OpenVPN 2.4 brings support for stronger key exchange using Elliptic Curves and encrypted control channel, along with faster LZ4 compression.\n\nIf your clients do run OpenVPN 2.4 or later you can enable these features, otherwise choose '\''No'\'' for best compatibility.\n\nNOTE: Current mobile app, that is OpenVPN connect, is supported.' 24 70
+ APPLY_TWO_POINT_FOUR=true
+ sudo touch /etc/pivpn/TWO_POINT_FOUR
+ [[ false == true ]]
+ [[ false == false ]]
+ [[ true == false ]]
+ [[ true == false ]]
+ sudo -E openvpn --genkey --secret pki/ta.key
+ sudo -E ./easyrsa gen-crl

Note: using Easy-RSA configuration from: ./vars
Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.cnf

An updated CRL has been created.
CRL file: /etc/openvpn/easy-rsa/pki/crl.pem

+ sudo -E cp pki/crl.pem /etc/openvpn/crl.pem
+ sudo -E chown nobody:nogroup /etc/openvpn/crl.pem
+ sudo cp /etc/.pivpn/server_config.txt /etc/openvpn/server.conf
+ [[ true == true ]]
+ sudo sed -i 's/comp-lzo/compress lz4/' /etc/openvpn/server.conf
+ sudo sed -i 's/tls-auth \/etc\/openvpn\/easy-rsa\/pki\/ta.key 0/tls-crypt \/etc\/openvpn\/easy-rsa\/pki\/ta.key/' /etc/openvpn/server.conf
+ [[ true == true ]]
+ sudo sed -i 's/\(dh \/etc\/openvpn\/easy-rsa\/pki\/dh\).*/dh none\necdh-curve secp384r1/' /etc/openvpn/server.conf
+ '[' 1195 '!=' 1194 ']'
+ sudo sed -i s/1194/1195/g /etc/openvpn/server.conf
+ '[' udp '!=' udp ']'
+ sudo sed -i 's/\(key \/etc\/openvpn\/easy-rsa\/pki\/private\/\).*/\1server_WAz3yWDTIwAaJrEV.key/' /etc/openvpn/server.conf
+ sudo sed -i 's/\(cert \/etc\/openvpn\/easy-rsa\/pki\/issued\/\).*/\1server_WAz3yWDTIwAaJrEV.crt/' /etc/openvpn/server.conf
+ confNetwork
+ sudo sed -i '/net.ipv4.ip_forward=1/s/^#//g' /etc/sysctl.conf
+ sudo sysctl -p
net.ipv4.ip_forward = 1
+ hash ufw
+ noUFW=1
+ [[ 1 -eq 1 ]]
+ echo 1
+ sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
+ case ${PLAT} in
+ sudo netfilter-persistent save
run-parts: executing /usr/share/netfilter-persistent/plugins.d/15-ip4tables save
run-parts: executing /usr/share/netfilter-persistent/plugins.d/25-ip6tables save
+ sudo cp /tmp/noUFW /etc/pivpn/NO_UFW
+ confOVPN
++ dig +short myip.opendns.com @resolver1.opendns.com
+ IPv4pub=';; reply from unexpected source: 192.168.0.103#53, expected 208.67.222.222#53
;; reply from unexpected source: 192.168.0.103#53, expected 208.67.222.222#53
;; reply from unexpected source: 192.168.0.103#53, expected 208.67.222.222#53
;; connection timed out; no servers could be reached'
+ echo 'dig failed, now trying to curl eth0.me'
dig failed, now trying to curl eth0.me
++ curl eth0.me
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0curl: (6) Could not resolve host: eth0.me
+ IPv4pub=
+ echo 'eth0.me failed, please check your internet connection/DNS'
eth0.me failed, please check your internet connection/DNS
+ exit 0
+ echo '::: Install Complete...'
::: Install Complete...
+ sudo mv /tmp/pivpn-install.log /etc/pivpn/install.log
+ echo '::: Restarting services...'
::: Restarting services...
+ case ${PLAT} in
+ sudo systemctl enable openvpn.service
Synchronizing state of openvpn.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable openvpn
+ sudo systemctl start openvpn.service
+ echo '::: done.'
::: done.
+ [[ false == false ]]
+ displayFinalMessage
+ whiptail --msgbox --backtitle 'Make it so.' --title 'Installation Complete!' 'Now run '\''pivpn add'\'' to create the ovpn profiles.
Run '\''pivpn help'\'' to see what else you can do!
The install log is in /etc/pivpn.' 24 70
+ whiptail --title Reboot --yesno --defaultno 'It is strongly recommended you reboot after installation.  Would you like to reboot now?' 24 70
+ echo :::
:::
+ [[ false == false ]]
+ echo '::: Installation Complete!'
::: Installation Complete!
+ echo '::: Now run '\''pivpn add'\'' to create an ovpn profile for each of your devices.'
::: Now run 'pivpn add' to create an ovpn profile for each of your devices.
+ echo '::: Run '\''pivpn help'\'' to see what else you can do!'
::: Run 'pivpn help' to see what else you can do!
+ echo '::: It is strongly recommended you reboot after installation.'
::: It is strongly recommended you reboot after installation.
+ echo :::
:::
+ echo '::: The install log is located at: /etc/pivpn/install.log'
::: The install log is located at: /etc/pivpn/install.log
pi@raspberrypi:~ $

@Fayyaadh

This comment has been minimized.

Copy link
Author

commented Oct 10, 2018

I think some of the output got cut off or PuTTy has a limit of how much it keeps on screen.

@orazioedoardo

This comment has been minimized.

Copy link
Contributor

commented Oct 10, 2018

Thank you @Fayyaadh I think i got it, here’s the problem:

confOVPN() {
if ! IPv4pub=$(dig +short myip.opendns.com @resolver1.opendns.com)
then
echo "dig failed, now trying to curl eth0.me"
if ! IPv4pub=$(curl eth0.me)
then
echo "eth0.me failed, please check your internet connection/DNS"
exit $?
fi
fi
$SUDO cp /tmp/pivpnUSR /etc/pivpn/INSTALL_USER

At line 910 the script tries to get the public IP of your connection using dig, however, for reasons I don’t know, if fails for you:

++ dig +short myip.opendns.com @resolver1.opendns.com
+ IPv4pub=';; reply from unexpected source: 192.168.0.103#53, expected 208.67.222.222#53
;; reply from unexpected source: 192.168.0.103#53, expected 208.67.222.222#53
;; reply from unexpected source: 192.168.0.103#53, expected 208.67.222.222#53
;; connection timed out; no servers could be reached'
+ echo 'dig failed, now trying to curl eth0.me'
dig failed, now trying to curl eth0.me

Then, the script falls back to eth0.me (line 913), however, the server seems down so this fails as well (I addresses this in my pull request.
Now, exit 0 commands makes the installPiVPN function stop:

pivpn/auto_install/install.sh

Lines 1057 to 1070 in de76940

installPiVPN() {
stopServices
$SUDO mkdir -p /etc/pivpn/
confUnattendedUpgrades
installScripts
setCustomProto
setCustomPort
confOpenVPN
confNetwork
confOVPN
setClientDNS
confLogging
finalExports
}

At this point, the script resumes execution here (which is the end basically):

installPiVPN | tee ${tmpLog}

Note that line 919 would have been the next being executed if the script didn’t fail, it’s the reason why INSTALL_USER is missing.

To fix the issue, just redownload the script, replace lines 910 to 918 with this:

IPv4pub=$(dig +short myip.opendns.com @208.67.222.222)
    if [ $? -ne 0 ] || [ -z "$IPv4pub" ]; then
        echo "dig failed, now trying to curl whatismyip.akamai.com"
        if ! IPv4pub=$(curl -s http://whatismyip.akamai.com)
        then
            echo "whatismyip.akamai.com failed, please check your internet connection/DNS"
            exit $?
        fi
    fi

...and try again

@Fayyaadh

This comment has been minimized.

Copy link
Author

commented Oct 11, 2018

That line that says "Reply from unexpected source: 192.168.0.103#53" ...

That IP address is my pihole which is used handed out over DHCP as the DNS server to use for all clients in my home.

I think I even have a DNAT rule in place on my router so that even if a machine tries to query DNS using any other DNS server except the pihole, it redirects the request to the pihole.

I basically did that because devices like Chromecast have Google DNS servers hard coded.

Is that maybe why it failed?

@Fayyaadh

This comment has been minimized.

Copy link
Author

commented Oct 11, 2018

Another point here, using that akamai site to get your public IP in your replacement block of code, seems that site is blocked by pihole, but I can whitelist it.

There needs to be a better way to get the public IP, especially for people that use pihole for DNS.

@orazioedoardo

This comment has been minimized.

Copy link
Contributor

commented Oct 11, 2018

That line that says "Reply from unexpected source: 192.168.0.103#53" ...

That IP address is my pihole which is used handed out over DHCP as the DNS server to use for all clients in my home.

I think I even have a DNAT rule in place on my router so that even if a machine tries to query DNS using any other DNS server except the pihole, it redirects the request to the pihole.

I basically did that because devices like Chromecast have Google DNS servers hard coded.

Is that maybe why it failed?

Yeah, but it seems a misconfiguration on your end, the connection times out.

Another point here, using that akamai site to get your public IP in your replacement block of code, seems that site is blocked by pihole, but I can whitelist it.

Yes, I haven’t spotted that before.

There needs to be a better way to get the public IP, especially for people that use pihole for DNS.

That’s not that big of an issue, there are several other websites that you can curl or wget to get the public IP, I have pihole too and dig works for me.

By the way, did it work at last?

@Fayyaadh

This comment has been minimized.

Copy link
Author

commented Oct 11, 2018

I'm gonna try again, I was just trying the dig command on its own and the opendns one wasn't working. The akamai one worked once I disabled the pihole.

I'll post back here soon.

@Fayyaadh

This comment has been minimized.

Copy link
Author

commented Oct 11, 2018

Seems it still didn't work, here's the last few lines:

++ dig +short myip.opendns.com @208.67.222.222
+ IPv4pub=';; reply from unexpected source: 192.168.0.103#53, expected 208.67.222.222#53
;; reply from unexpected source: 192.168.0.103#53, expected 208.67.222.222#53
;; reply from unexpected source: 192.168.0.103#53, expected 208.67.222.222#53
;; connection timed out; no servers could be reached'
+ echo '::: Install Complete...'
::: Install Complete...
+ sudo mv /tmp/pivpn-install.log /etc/pivpn/install.log
+ echo '::: Restarting services...'
::: Restarting services...
+ case ${PLAT} in
+ sudo systemctl enable openvpn.service
Synchronizing state of openvpn.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable openvpn
+ sudo systemctl start openvpn.service
+ echo '::: done.'
::: done.
+ [[ false == false ]]
+ displayFinalMessage
+ whiptail --msgbox --backtitle 'Make it so.' --title 'Installation Complete!' 'Now run '\''pivpn add'\'' to create the ovpn profiles.
Run '\''pivpn help'\'' to see what else you can do!
The install log is in /etc/pivpn.' 20 70
+ whiptail --title Reboot --yesno --defaultno 'It is strongly recommended you reboot after installation.  Would you like to reboot now?' 20 70
+ echo :::
:::
+ [[ false == false ]]
+ echo '::: Installation Complete!'
::: Installation Complete!
+ echo '::: Now run '\''pivpn add'\'' to create an ovpn profile for each of your devices.'
::: Now run 'pivpn add' to create an ovpn profile for each of your devices.
+ echo '::: Run '\''pivpn help'\'' to see what else you can do!'
::: Run 'pivpn help' to see what else you can do!
+ echo '::: It is strongly recommended you reboot after installation.'
::: It is strongly recommended you reboot after installation.
+ echo :::
:::
+ echo '::: The install log is located at: /etc/pivpn/install.log'
::: The install log is located at: /etc/pivpn/install.log

@Fayyaadh

This comment has been minimized.

Copy link
Author

commented Oct 11, 2018

I'm gonna disable that DNAT rule and try again.

I'm not sure why your new code didn't try Akamai after opendns dig failed?

@orazioedoardo

This comment has been minimized.

Copy link
Contributor

commented Oct 11, 2018

Oh, because the script has set -e which makes the subshell exit if a command (dig in your case returns a non zero exit code).

Use this instead:

set +e
IPv4pub=$(dig +short myip.opendns.com @208.67.222.222)
    if [ $? -ne 0 ] || [ -z "$IPv4pub" ]; then
        echo "dig failed, now trying to curl whatismyip.akamai.com"
        if ! IPv4pub=$(curl -s http://whatismyip.akamai.com)
        then
            echo "whatismyip.akamai.com failed, please check your internet connection/DNS"
            exit $?
        fi
    fi
set -e
@Fayyaadh

This comment has been minimized.

Copy link
Author

commented Oct 11, 2018

I only have set -v and set -x at the very beginning of the script though.

So just to be clear, I gotta have all 3 of set -e, set -v and set -x at the start, then do set +e before that code block and then set -e again after the end of the 2nd if statement.

@orazioedoardo

This comment has been minimized.

Copy link
Contributor

commented Oct 11, 2018

We placed set -x and set -v to debug the script, set -e was already there. Yes, just add set +e before the the code block to disable that behaviour and set -e immediately after to reenable it.

@Fayyaadh

This comment has been minimized.

Copy link
Author

commented Oct 11, 2018

Got it, it's busy running. Will post the output soon.

@Fayyaadh

This comment has been minimized.

Copy link
Author

commented Oct 11, 2018

Seems to have worked this time, have a look:

+ set +e
++ dig +short myip.opendns.com @208.67.222.222
+ IPv4pub=197.245.XXX.YYY
+ '[' 0 -ne 0 ']'
+ '[' -z 197.245.XXX.YYY ']'
+ set -e
+ sudo cp /tmp/pivpnUSR /etc/pivpn/INSTALL_USER
+ sudo cp /tmp/DET_PLATFORM /etc/pivpn/DET_PLATFORM
+ sudo cp /etc/.pivpn/Default.txt /etc/openvpn/easy-rsa/pki/Default.txt
+ [[ true == true ]]
+ sudo sed -i 's/comp-lzo/compress lz4/' /etc/openvpn/easy-rsa/pki/Default.txt
+ sudo sed -i '/key-direction 1/d' /etc/openvpn/easy-rsa/pki/Default.txt
+ [[ false == false ]]
++ whiptail --title 'Public IP or DNS' --radiolist 'Will clients use a Public IP or DNS Name to connect to your server (press space to select)?' 20 70 2 197.245.XXX.YYY 'Use this public IP' ON 'DNS Entry' 'Use a public DNS' OFF
+ METH='DNS Entry'
+ exitstatus=0
+ '[' 0 '!=' 0 ']'
+ '[' 'DNS Entry' == 197.245.XXX.YYY ']'
+ [[ '' = True ]]
++ whiptail --title 'PiVPN Setup' --inputbox 'What is the public DNS name of this Server?' 20 70
+ PUBLICDNS=no-ip.biz
+ exitstatus=0
+ '[' 0 '!=' 0 ']'
+ whiptail --backtitle 'Confirm DNS Name' --title 'Confirm DNS Name' --yesno 'Is this correct?\n\n Public DNS Name:  no-ip.biz' 20 70
+ publicDNSCorrect=True
+ sudo sed -i s/IPv4pub/no-ip.biz/ /etc/openvpn/easy-rsa/pki/Default.txt
+ [[ True = True ]]
+ '[' 1195 '!=' 1194 ']'
+ sudo sed -i -e s/1194/1195/g /etc/openvpn/easy-rsa/pki/Default.txt
+ '[' udp '!=' udp ']'
+ sudo sed -i s/SRVRNAME/server_iVAMWkABpJgTqplE/ /etc/openvpn/easy-rsa/pki/Default.txt
+ '[' '!' -d /home/pi/ovpns ']'
+ sudo mkdir /home/pi/ovpns
+ sudo chmod 0777 -R /home/pi/ovpns
+ setClientDNS
+ DNSChoseCmd=(whiptail --separate-output --radiolist "Select the DNS Provider for your VPN Clients (press space to select). To use your own, select Custom." ${r} ${c} 6)
+ DNSChooseOptions=(Google "" on OpenDNS "" off Level3 "" off DNS.WATCH "" off Norton "" off FamilyShield "" off CloudFlare "" off Custom "" off)
++ whiptail --separate-output --radiolist 'Select the DNS Provider for your VPN Clients (press space to select). To use your own, select Custom.' 20 70 6 Google '' on OpenDNS '' off Level3 '' off DNS.WATCH '' off Norton '' off FamilyShield '' off CloudFlare '' off Custom '' off
+ DNSchoices=Custom
+ [[ Custom != \C\u\s\t\o\m ]]
+ [[ '' = True ]]
+ strInvalid=Invalid
++ whiptail --backtitle 'Specify Upstream DNS Provider(s)' --inputbox 'Enter your desired upstream DNS provider(s), seperated by a comma.\n\nFor example '\''8.8.8.8, 8.8.4.4'\''' 20 70 ''
+ OVPNDNS=192.168.0.103
++ echo 192.168.0.103
++ sed 's/[, \t]\+/,/g'
++ awk -F, '{print$1}'
+ OVPNDNS1=192.168.0.103
++ echo 192.168.0.103
++ sed 's/[, \t]\+/,/g'
++ awk -F, '{print$2}'
+ OVPNDNS2=
+ valid_ip 192.168.0.103
+ local ip=192.168.0.103
+ local stat=1
+ [[ 192.168.0.103 =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]
+ OIFS='
'
+ IFS=.
+ ip=($ip)
+ IFS='
'
+ [[ 192 -le 255 ]]
+ [[ 168 -le 255 ]]
+ [[ 0 -le 255 ]]
+ [[ 103 -le 255 ]]
+ stat=0
+ return 0
+ '[' '!' 192.168.0.103 ']'
+ valid_ip ''
+ local ip=
+ local stat=1
+ [[ '' =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]
+ return 1
+ '[' '' ']'
+ [[ 192.168.0.103 == \I\n\v\a\l\i\d ]]
+ [[ '' == \I\n\v\a\l\i\d ]]
+ whiptail --backtitle 'Specify Upstream DNS Provider(s)' --title 'Upstream DNS Provider(s)' --yesno 'Are these settings correct?\n    DNS Server 1:   192.168.0.103\n    DNS Server 2:   ' 20 70
+ DNSSettingsCorrect=True
+ sudo sed -i '0,/\(dhcp-option DNS \)/ s/\(dhcp-option DNS \).*/\1192.168.0.103\"/' /etc/openvpn/server.conf
+ '[' -z ']'
+ sudo sed -i '/\(dhcp-option DNS \)/{n;N;d}' /etc/openvpn/server.conf
+ [[ True = True ]]
+ confLogging
+ echo 'if $programname == '\''ovpn-server'\'' then /var/log/openvpn.log
if $programname == '\''ovpn-server'\'' then ~'
+ sudo tee /etc/rsyslog.d/30-openvpn.conf
+ sudo tee /etc/logrotate.d/openvpn
+ echo '/var/log/openvpn.log
{
        rotate 4
        weekly
        missingok
        notifempty
        compress
        delaycompress
        sharedscripts
        postrotate
                invoke-rc.d rsyslog rotate >/dev/null 2>&1 || true
        endscript
}'
+ case ${PLAT} in
+ sudo systemctl restart rsyslog.service
+ finalExports
+ '[' -e /etc/pivpn/setupVars.conf ']'
+ echo pivpnUser=pi
+ echo UNATTUPG=unattended-upgrades
+ sudo tee /etc/pivpn/setupVars.conf
+ echo pivpnInterface=eth0
+ echo IPv4dns=192.168.0.103
+ echo IPv4addr=192.168.0.104
+ echo IPv4gw=192.168.0.1
+ echo pivpnProto=udp
+ echo PORT=1195
+ echo ENCRYPT=1024
+ echo APPLY_TWO_POINT_FOUR=true
+ echo DOWNLOAD_DH_PARAM=
+ echo PUBLICDNS=no-ip.biz
+ echo OVPNDNS1=192.168.0.103
+ echo OVPNDNS2=
+ echo '::: Install Complete...'
::: Install Complete...
+ sudo mv /tmp/pivpn-install.log /etc/pivpn/install.log
+ echo '::: Restarting services...'
::: Restarting services...
+ case ${PLAT} in
+ sudo systemctl enable openvpn.service
Synchronizing state of openvpn.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable openvpn
+ sudo systemctl start openvpn.service
+ echo '::: done.'
::: done.
+ [[ false == false ]]
+ displayFinalMessage
+ whiptail --msgbox --backtitle 'Make it so.' --title 'Installation Complete!' 'Now run '\''pivpn add'\'' to create the ovpn profiles.
Run '\''pivpn help'\'' to see what else you can do!
The install log is in /etc/pivpn.' 20 70
+ whiptail --title Reboot --yesno --defaultno 'It is strongly recommended you reboot after installation.  Would you like to reboot now?' 20 70
+ echo :::
:::
+ [[ false == false ]]
+ echo '::: Installation Complete!'
::: Installation Complete!
+ echo '::: Now run '\''pivpn add'\'' to create an ovpn profile for each of your devices.'
::: Now run 'pivpn add' to create an ovpn profile for each of your devices.
+ echo '::: Run '\''pivpn help'\'' to see what else you can do!'
::: Run 'pivpn help' to see what else you can do!
+ echo '::: It is strongly recommended you reboot after installation.'
::: It is strongly recommended you reboot after installation.
+ echo :::
:::
+ echo '::: The install log is located at: /etc/pivpn/install.log'
::: The install log is located at: /etc/pivpn/install.log
pi@raspberrypi:~ $ pivpn add nopass
Enter a Name for the Client:  iphone
spawn ./easyrsa build-client-full iphone nopass

Note: using Easy-RSA configuration from: ./vars
rand: Use -help for summary.
Generating a 1024 bit RSA private key
..++++++
.....................................................++++++
writing new private key to '/etc/openvpn/easy-rsa/pki/private/iphone.key.FYErVPwzAA'
-----
Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'iphone'
Certificate is to be certified until Oct  8 08:01:02 2028 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated
Client's cert found: iphone.crt
Client's Private Key found: iphone.key
CA public Key found: ca.crt
tls-auth Private Key found: ta.key


========================================================
Done! iphone.ovpn successfully created!
iphone.ovpn was copied to:
  /home/pi/ovpns
for easy transfer. Please use this profile only on one
device and create additional profiles for other devices.
========================================================

pi@raspberrypi:~ $
@orazioedoardo

This comment has been minimized.

Copy link
Contributor

commented Oct 11, 2018

That’s fine, two minor points though:

  • You censored the IP but not the domain name. If you care about, you should edit the comment and remove the initial revision (from the “edited” dropdown menu)
  • I would have chosen 2048 bit instead. Not that your Pi will be hacked now but 1024 bit is deprecated and weak (I would remove the option from the script). More info here.
@Fayyaadh

This comment has been minimized.

Copy link
Author

commented Oct 11, 2018

Thank you, edited.

I only chose 1024 for testing.

I have a few issues that aren't related to installation though.

I'll ask here anyways in case you can assist.

So the tunnel is working and I can connect back home from my phone. I can ping the OpenVPN server on it's 10.8.0.1 IP and also on my home LAN IP (192.168.0.104). I can also ping my LAN machine by hostname. All good.

I can also go the other way, ping my cellphones VPN IP address (10.8.0.2) from home. Great.

I can ping WAN ip addresses like 8.8.8.8 and also by domain like google.com

But for the life of me I cannot figure out why, in a browser, I can't actually browse to google.com or to my pihole's admin page.

Any ideas?

@orazioedoardo

This comment has been minimized.

Copy link
Contributor

commented Oct 11, 2018

Try this: #54 (remember to restart the server with sudo systemctl restart openvpn)

Also post the server log: cat /var/log/openvpn.log

@Fayyaadh

This comment has been minimized.

Copy link
Author

commented Oct 11, 2018

Try this: #54

Nope, didn't work.

I can ping anything on the LAN or WAN from my phone but I can't actually browse anything.

@orazioedoardo

This comment has been minimized.

Copy link
Contributor

commented Oct 11, 2018

I updated the comment, post the log too. Also post the output of sudo iptables -S and check inside the pihole web interface if DNS queries from your phone worked. Probably you need to enable all interfaces: #612

@Fayyaadh

This comment has been minimized.

Copy link
Author

commented Oct 11, 2018

I updated the comment, post the log too. Also post the output of sudo iptables -S and check inside the pihole web interface if DNS queries from your phone worked. Probably you need to enable all interfaces: #612

pi@raspberrypi:~ $ sudo iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT

pi@raspberrypi:~ $ sudo iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

The pi is set to listen on all interfaces, last option in the DNS section.

Still can't load any webpages, local or internet.

@orazioedoardo

This comment has been minimized.

Copy link
Contributor

commented Oct 11, 2018

The firewall setup seems ok, even though there are duplicated rules.
You are missing this though:

Also post the server log: cat /var/log/openvpn.log

@Fayyaadh

This comment has been minimized.

Copy link
Author

commented Oct 11, 2018

pi@raspberrypi:~ $ cat /var/log/openvpn.log
Oct 11 08:00:35 raspberrypi ovpn-server[22375]: OpenVPN 2.4.0 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 18 2017
Oct 11 08:00:35 raspberrypi ovpn-server[22375]: library versions: OpenSSL 1.0.2l  25 May 2017, LZO 2.08
Oct 11 08:00:35 raspberrypi ovpn-server[22377]: NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Oct 11 08:00:35 raspberrypi ovpn-server[22377]: ECDH curve secp384r1 added
Oct 11 08:00:35 raspberrypi ovpn-server[22377]: Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Oct 11 08:00:35 raspberrypi ovpn-server[22377]: Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Oct 11 08:00:35 raspberrypi ovpn-server[22377]: Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Oct 11 08:00:35 raspberrypi ovpn-server[22377]: Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Oct 11 08:00:35 raspberrypi ovpn-server[22377]: TUN/TAP device tun0 opened
Oct 11 08:00:35 raspberrypi ovpn-server[22377]: TUN/TAP TX queue length set to 100
Oct 11 08:00:35 raspberrypi ovpn-server[22377]: do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Oct 11 08:00:35 raspberrypi ovpn-server[22377]: /sbin/ip link set dev tun0 up mtu 1500
Oct 11 08:00:35 raspberrypi ovpn-server[22377]: /sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
Oct 11 08:00:35 raspberrypi ovpn-server[22377]: Could not determine IPv4/IPv6 protocol. Using AF_INET
Oct 11 08:00:35 raspberrypi ovpn-server[22377]: Socket Buffers: R=[163840->163840] S=[163840->163840]
Oct 11 08:00:35 raspberrypi ovpn-server[22377]: UDPv4 link local (bound): [AF_INET][undef]:1195
Oct 11 08:00:35 raspberrypi ovpn-server[22377]: UDPv4 link remote: [AF_UNSPEC]
Oct 11 08:00:35 raspberrypi ovpn-server[22377]: GID set to nogroup
Oct 11 08:00:35 raspberrypi ovpn-server[22377]: UID set to nobody
Oct 11 08:00:35 raspberrypi ovpn-server[22377]: MULTI: multi_init called, r=256 v=256
Oct 11 08:00:35 raspberrypi ovpn-server[22377]: IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
Oct 11 08:00:35 raspberrypi ovpn-server[22377]: Initialization Sequence Completed
Oct 11 08:11:10 raspberrypi ovpn-server[22377]: 41.13.XX.YY:59025 TLS: Initial packet from [AF_INET]41.13.XX.YY:59025, sid=489539b9 f7cdc962
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: 41.13.XX.YY:59025 VERIFY OK: depth=1, CN=ChangeMe
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: 41.13.XX.YY:59025 Validating certificate key usage
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: 41.13.XX.YY:59025 ++ Certificate has key usage  0080, expects 0080
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: 41.13.XX.YY:59025 VERIFY KU OK
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: 41.13.XX.YY:59025 Validating certificate extended key usage
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: 41.13.XX.YY:59025 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: 41.13.XX.YY:59025 VERIFY EKU OK
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: 41.13.XX.YY:59025 VERIFY OK: depth=0, CN=iphone
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: 41.13.XX.YY:59025 peer info: IV_GUI_VER=net.openvpn.connect.ios_3.0.2-894
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: 41.13.XX.YY:59025 peer info: IV_VER=3.2
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: 41.13.XX.YY:59025 peer info: IV_PLAT=ios
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: 41.13.XX.YY:59025 peer info: IV_NCP=2
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: 41.13.XX.YY:59025 peer info: IV_TCPNL=1
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: 41.13.XX.YY:59025 peer info: IV_PROTO=2
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: 41.13.XX.YY:59025 peer info: IV_LZO_STUB=1
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: 41.13.XX.YY:59025 peer info: IV_COMP_STUB=1
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: 41.13.XX.YY:59025 peer info: IV_COMP_STUBv2=1
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: 41.13.XX.YY:59025 peer info: IV_AUTO_SESS=1
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: 41.13.XX.YY:59025 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: 41.13.XX.YY:59025 [iphone] Peer Connection Initiated with [AF_INET]41.13.XX.YY:59025
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: iphone/41.13.XX.YY:59025 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: iphone/41.13.XX.YY:59025 MULTI: Learn: 10.8.0.2 -> iphone/41.13.XX.YY:59025
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: iphone/41.13.XX.YY:59025 MULTI: primary virtual IP for iphone/41.13.XX.YY:59025: 10.8.0.2
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: iphone/41.13.XX.YY:59025 PUSH: Received control message: 'PUSH_REQUEST'
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: iphone/41.13.XX.YY:59025 SENT CONTROL [iphone]: 'PUSH_REPLY,dhcp-option DNS 192.168.0.103,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: iphone/41.13.XX.YY:59025 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 08:11:11 raspberrypi ovpn-server[22377]: iphone/41.13.XX.YY:59025 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 08:16:12 raspberrypi ovpn-server[22377]: event_wait : Interrupted system call (code=4)
Oct 11 08:16:12 raspberrypi ovpn-server[22377]: Closing TUN/TAP interface
Oct 11 08:16:12 raspberrypi ovpn-server[22377]: /sbin/ip addr del dev tun0 10.8.0.1/24
Oct 11 08:16:12 raspberrypi ovpn-server[22377]: Linux ip addr del failed: external program exited with error status: 2
Oct 11 08:16:12 raspberrypi ovpn-server[22377]: SIGTERM[hard,] received, process exiting
Oct 11 08:16:13 raspberrypi ovpn-server[22504]: OpenVPN 2.4.0 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 18 2017
Oct 11 08:16:13 raspberrypi ovpn-server[22504]: library versions: OpenSSL 1.0.2l  25 May 2017, LZO 2.08
Oct 11 08:16:13 raspberrypi ovpn-server[22505]: NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Oct 11 08:16:13 raspberrypi ovpn-server[22505]: ECDH curve secp384r1 added
Oct 11 08:16:13 raspberrypi ovpn-server[22505]: Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Oct 11 08:16:13 raspberrypi ovpn-server[22505]: Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Oct 11 08:16:13 raspberrypi ovpn-server[22505]: Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Oct 11 08:16:13 raspberrypi ovpn-server[22505]: Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Oct 11 08:16:13 raspberrypi ovpn-server[22505]: TUN/TAP device tun0 opened
Oct 11 08:16:13 raspberrypi ovpn-server[22505]: TUN/TAP TX queue length set to 100
Oct 11 08:16:13 raspberrypi ovpn-server[22505]: do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Oct 11 08:16:13 raspberrypi ovpn-server[22505]: /sbin/ip link set dev tun0 up mtu 1500
Oct 11 08:16:13 raspberrypi ovpn-server[22505]: /sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
Oct 11 08:16:13 raspberrypi ovpn-server[22505]: Could not determine IPv4/IPv6 protocol. Using AF_INET
Oct 11 08:16:13 raspberrypi ovpn-server[22505]: Socket Buffers: R=[163840->163840] S=[163840->163840]
Oct 11 08:16:13 raspberrypi ovpn-server[22505]: UDPv4 link local (bound): [AF_INET][undef]:1195
Oct 11 08:16:13 raspberrypi ovpn-server[22505]: UDPv4 link remote: [AF_UNSPEC]
Oct 11 08:16:13 raspberrypi ovpn-server[22505]: GID set to nogroup
Oct 11 08:16:13 raspberrypi ovpn-server[22505]: UID set to nobody
Oct 11 08:16:13 raspberrypi ovpn-server[22505]: MULTI: multi_init called, r=256 v=256
Oct 11 08:16:13 raspberrypi ovpn-server[22505]: IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
Oct 11 08:16:13 raspberrypi ovpn-server[22505]: Initialization Sequence Completed
Oct 11 08:16:24 raspberrypi ovpn-server[22505]: 41.13.XX.YY:63427 TLS: Initial packet from [AF_INET]41.13.XX.YY:63427, sid=957b865d 587a929f
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: 41.13.XX.YY:63427 VERIFY OK: depth=1, CN=ChangeMe
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: 41.13.XX.YY:63427 Validating certificate key usage
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: 41.13.XX.YY:63427 ++ Certificate has key usage  0080, expects 0080
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: 41.13.XX.YY:63427 VERIFY KU OK
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: 41.13.XX.YY:63427 Validating certificate extended key usage
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: 41.13.XX.YY:63427 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: 41.13.XX.YY:63427 VERIFY EKU OK
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: 41.13.XX.YY:63427 VERIFY OK: depth=0, CN=iphone
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: 41.13.XX.YY:63427 peer info: IV_GUI_VER=net.openvpn.connect.ios_3.0.2-894
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: 41.13.XX.YY:63427 peer info: IV_VER=3.2
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: 41.13.XX.YY:63427 peer info: IV_PLAT=ios
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: 41.13.XX.YY:63427 peer info: IV_NCP=2
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: 41.13.XX.YY:63427 peer info: IV_TCPNL=1
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: 41.13.XX.YY:63427 peer info: IV_PROTO=2
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: 41.13.XX.YY:63427 peer info: IV_LZO_STUB=1
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: 41.13.XX.YY:63427 peer info: IV_COMP_STUB=1
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: 41.13.XX.YY:63427 peer info: IV_COMP_STUBv2=1
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: 41.13.XX.YY:63427 peer info: IV_AUTO_SESS=1
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: 41.13.XX.YY:63427 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: 41.13.XX.YY:63427 [iphone] Peer Connection Initiated with [AF_INET]41.13.XX.YY:63427
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: iphone/41.13.XX.YY:63427 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: iphone/41.13.XX.YY:63427 MULTI: Learn: 10.8.0.2 -> iphone/41.13.XX.YY:63427
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: iphone/41.13.XX.YY:63427 MULTI: primary virtual IP for iphone/41.13.XX.YY:63427: 10.8.0.2
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: iphone/41.13.XX.YY:63427 PUSH: Received control message: 'PUSH_REQUEST'
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: iphone/41.13.XX.YY:63427 SENT CONTROL [iphone]: 'PUSH_REPLY,dhcp-option DNS 1.1.1.1,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: iphone/41.13.XX.YY:63427 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 08:16:25 raspberrypi ovpn-server[22505]: iphone/41.13.XX.YY:63427 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 08:25:57 raspberrypi ovpn-server[22505]: event_wait : Interrupted system call (code=4)
Oct 11 08:25:57 raspberrypi ovpn-server[22505]: Closing TUN/TAP interface
Oct 11 08:25:57 raspberrypi ovpn-server[22505]: /sbin/ip addr del dev tun0 10.8.0.1/24
Oct 11 08:25:57 raspberrypi ovpn-server[22505]: Linux ip addr del failed: external program exited with error status: 2
Oct 11 08:25:57 raspberrypi ovpn-server[22505]: SIGTERM[hard,] received, process exiting
Oct 11 08:25:58 raspberrypi ovpn-server[22556]: OpenVPN 2.4.0 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 18 2017
Oct 11 08:25:58 raspberrypi ovpn-server[22556]: library versions: OpenSSL 1.0.2l  25 May 2017, LZO 2.08
Oct 11 08:25:58 raspberrypi ovpn-server[22557]: NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Oct 11 08:25:58 raspberrypi ovpn-server[22557]: ECDH curve secp384r1 added
Oct 11 08:25:58 raspberrypi ovpn-server[22557]: Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Oct 11 08:25:58 raspberrypi ovpn-server[22557]: Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Oct 11 08:25:58 raspberrypi ovpn-server[22557]: Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Oct 11 08:25:58 raspberrypi ovpn-server[22557]: Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Oct 11 08:25:58 raspberrypi ovpn-server[22557]: TUN/TAP device tun0 opened
Oct 11 08:25:58 raspberrypi ovpn-server[22557]: TUN/TAP TX queue length set to 100
Oct 11 08:25:58 raspberrypi ovpn-server[22557]: do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Oct 11 08:25:58 raspberrypi ovpn-server[22557]: /sbin/ip link set dev tun0 up mtu 1500
Oct 11 08:25:58 raspberrypi ovpn-server[22557]: /sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
Oct 11 08:25:58 raspberrypi ovpn-server[22557]: Could not determine IPv4/IPv6 protocol. Using AF_INET
Oct 11 08:25:58 raspberrypi ovpn-server[22557]: Socket Buffers: R=[163840->163840] S=[163840->163840]
Oct 11 08:25:58 raspberrypi ovpn-server[22557]: UDPv4 link local (bound): [AF_INET][undef]:1195
Oct 11 08:25:58 raspberrypi ovpn-server[22557]: UDPv4 link remote: [AF_UNSPEC]
Oct 11 08:25:58 raspberrypi ovpn-server[22557]: GID set to nogroup
Oct 11 08:25:58 raspberrypi ovpn-server[22557]: UID set to nobody
Oct 11 08:25:58 raspberrypi ovpn-server[22557]: MULTI: multi_init called, r=256 v=256
Oct 11 08:25:58 raspberrypi ovpn-server[22557]: IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
Oct 11 08:25:58 raspberrypi ovpn-server[22557]: Initialization Sequence Completed
Oct 11 08:26:18 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 TLS: Initial packet from [AF_INET]41.13.XX.YY:39581, sid=bbcec624 0bc4297d
Oct 11 08:26:18 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 tls-crypt unwrap error: bad packet ID (may be a replay): [ #1 / time = (1539246371) Thu Oct 11 08:26:11 2018 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Oct 11 08:26:18 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 tls-crypt unwrap error: packet replay
Oct 11 08:26:18 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 TLS Error: tls-crypt unwrapping failed from [AF_INET]41.13.XX.YY:39581
Oct 11 08:26:18 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 VERIFY OK: depth=1, CN=ChangeMe
Oct 11 08:26:18 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 Validating certificate key usage
Oct 11 08:26:18 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 ++ Certificate has key usage  0080, expects 0080
Oct 11 08:26:18 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 VERIFY KU OK
Oct 11 08:26:18 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 Validating certificate extended key usage
Oct 11 08:26:18 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Oct 11 08:26:18 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 VERIFY EKU OK
Oct 11 08:26:18 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 VERIFY OK: depth=0, CN=iphone
Oct 11 08:26:19 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 peer info: IV_GUI_VER=net.openvpn.connect.ios_3.0.2-894
Oct 11 08:26:19 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 peer info: IV_VER=3.2
Oct 11 08:26:19 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 peer info: IV_PLAT=ios
Oct 11 08:26:19 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 peer info: IV_NCP=2
Oct 11 08:26:19 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 peer info: IV_TCPNL=1
Oct 11 08:26:19 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 peer info: IV_PROTO=2
Oct 11 08:26:19 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 peer info: IV_LZO_STUB=1
Oct 11 08:26:19 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 peer info: IV_COMP_STUB=1
Oct 11 08:26:19 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 peer info: IV_COMP_STUBv2=1
Oct 11 08:26:19 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 peer info: IV_AUTO_SESS=1
Oct 11 08:26:19 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Oct 11 08:26:19 raspberrypi ovpn-server[22557]: 41.13.XX.YY:39581 [iphone] Peer Connection Initiated with [AF_INET]41.13.XX.YY:39581
Oct 11 08:26:19 raspberrypi ovpn-server[22557]: iphone/41.13.XX.YY:39581 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Oct 11 08:26:19 raspberrypi ovpn-server[22557]: iphone/41.13.XX.YY:39581 MULTI: Learn: 10.8.0.2 -> iphone/41.13.XX.YY:39581
Oct 11 08:26:19 raspberrypi ovpn-server[22557]: iphone/41.13.XX.YY:39581 MULTI: primary virtual IP for iphone/41.13.XX.YY:39581: 10.8.0.2
Oct 11 08:26:19 raspberrypi ovpn-server[22557]: iphone/41.13.XX.YY:39581 PUSH: Received control message: 'PUSH_REQUEST'
Oct 11 08:26:19 raspberrypi ovpn-server[22557]: iphone/41.13.XX.YY:39581 SENT CONTROL [iphone]: 'PUSH_REPLY,dhcp-option DNS 192.168.0.103,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Oct 11 08:26:19 raspberrypi ovpn-server[22557]: iphone/41.13.XX.YY:39581 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 08:26:19 raspberrypi ovpn-server[22557]: iphone/41.13.XX.YY:39581 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 08:40:47 raspberrypi ovpn-server[22557]: iphone/41.13.XX.YY:39581 SIGTERM[soft,remote-exit] received, client-instance exiting
Oct 11 08:41:40 raspberrypi ovpn-server[236]: OpenVPN 2.4.0 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 18 2017
Oct 11 08:41:40 raspberrypi ovpn-server[236]: library versions: OpenSSL 1.0.2l  25 May 2017, LZO 2.08
Oct 11 08:41:40 raspberrypi ovpn-server[252]: ECDH curve secp384r1 added
Oct 11 08:41:40 raspberrypi ovpn-server[252]: Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Oct 11 08:41:40 raspberrypi ovpn-server[252]: Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Oct 11 08:41:40 raspberrypi ovpn-server[252]: Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Oct 11 08:41:40 raspberrypi ovpn-server[252]: Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Oct 11 08:41:40 raspberrypi ovpn-server[252]: TUN/TAP device tun0 opened
Oct 11 08:41:40 raspberrypi ovpn-server[252]: TUN/TAP TX queue length set to 100
Oct 11 08:41:40 raspberrypi ovpn-server[252]: do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Oct 11 08:41:40 raspberrypi ovpn-server[252]: /sbin/ip link set dev tun0 up mtu 1500
Oct 11 08:41:40 raspberrypi ovpn-server[252]: /sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
Oct 11 08:41:40 raspberrypi ovpn-server[252]: Could not determine IPv4/IPv6 protocol. Using AF_INET
Oct 11 08:41:40 raspberrypi ovpn-server[252]: Socket Buffers: R=[163840->163840] S=[163840->163840]
Oct 11 08:41:40 raspberrypi ovpn-server[252]: UDPv4 link local (bound): [AF_INET][undef]:1195
Oct 11 08:41:40 raspberrypi ovpn-server[252]: UDPv4 link remote: [AF_UNSPEC]
Oct 11 08:41:40 raspberrypi ovpn-server[252]: GID set to nogroup
Oct 11 08:41:40 raspberrypi ovpn-server[252]: UID set to nobody
Oct 11 08:41:40 raspberrypi ovpn-server[252]: MULTI: multi_init called, r=256 v=256
Oct 11 08:41:40 raspberrypi ovpn-server[252]: IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
Oct 11 08:41:40 raspberrypi ovpn-server[252]: Initialization Sequence Completed
Oct 11 08:52:01 raspberrypi ovpn-server[252]: 41.13.XX.YY:51474 TLS: Initial packet from [AF_INET]41.13.XX.YY:51474, sid=f8ad26b1 4e8a6c43
Oct 11 08:52:02 raspberrypi ovpn-server[252]: 41.13.XX.YY:51474 VERIFY OK: depth=1, CN=ChangeMe
Oct 11 08:52:02 raspberrypi ovpn-server[252]: 41.13.XX.YY:51474 Validating certificate key usage
Oct 11 08:52:02 raspberrypi ovpn-server[252]: 41.13.XX.YY:51474 ++ Certificate has key usage  0080, expects 0080
Oct 11 08:52:02 raspberrypi ovpn-server[252]: 41.13.XX.YY:51474 VERIFY KU OK
Oct 11 08:52:02 raspberrypi ovpn-server[252]: 41.13.XX.YY:51474 Validating certificate extended key usage
Oct 11 08:52:02 raspberrypi ovpn-server[252]: 41.13.XX.YY:51474 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Oct 11 08:52:02 raspberrypi ovpn-server[252]: 41.13.XX.YY:51474 VERIFY EKU OK
Oct 11 08:52:02 raspberrypi ovpn-server[252]: 41.13.XX.YY:51474 VERIFY OK: depth=0, CN=iphone
Oct 11 08:52:02 raspberrypi ovpn-server[252]: 41.13.XX.YY:51474 peer info: IV_GUI_VER=net.openvpn.connect.ios_3.0.2-894
Oct 11 08:52:02 raspberrypi ovpn-server[252]: 41.13.XX.YY:51474 peer info: IV_VER=3.2
Oct 11 08:52:02 raspberrypi ovpn-server[252]: 41.13.XX.YY:51474 peer info: IV_PLAT=ios
Oct 11 08:52:02 raspberrypi ovpn-server[252]: 41.13.XX.YY:51474 peer info: IV_NCP=2
Oct 11 08:52:02 raspberrypi ovpn-server[252]: 41.13.XX.YY:51474 peer info: IV_TCPNL=1
Oct 11 08:52:02 raspberrypi ovpn-server[252]: 41.13.XX.YY:51474 peer info: IV_PROTO=2
Oct 11 08:52:02 raspberrypi ovpn-server[252]: 41.13.XX.YY:51474 peer info: IV_LZO_STUB=1
Oct 11 08:52:02 raspberrypi ovpn-server[252]: 41.13.XX.YY:51474 peer info: IV_COMP_STUB=1
Oct 11 08:52:02 raspberrypi ovpn-server[252]: 41.13.XX.YY:51474 peer info: IV_COMP_STUBv2=1
Oct 11 08:52:02 raspberrypi ovpn-server[252]: 41.13.XX.YY:51474 peer info: IV_AUTO_SESS=1
Oct 11 08:52:02 raspberrypi ovpn-server[252]: 41.13.XX.YY:51474 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Oct 11 08:52:02 raspberrypi ovpn-server[252]: 41.13.XX.YY:51474 [iphone] Peer Connection Initiated with [AF_INET]41.13.XX.YY:51474
Oct 11 08:52:02 raspberrypi ovpn-server[252]: iphone/41.13.XX.YY:51474 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Oct 11 08:52:02 raspberrypi ovpn-server[252]: iphone/41.13.XX.YY:51474 MULTI: Learn: 10.8.0.2 -> iphone/41.13.XX.YY:51474
Oct 11 08:52:02 raspberrypi ovpn-server[252]: iphone/41.13.XX.YY:51474 MULTI: primary virtual IP for iphone/41.13.XX.YY:51474: 10.8.0.2
Oct 11 08:52:02 raspberrypi ovpn-server[252]: iphone/41.13.XX.YY:51474 PUSH: Received control message: 'PUSH_REQUEST'
Oct 11 08:52:02 raspberrypi ovpn-server[252]: iphone/41.13.XX.YY:51474 SENT CONTROL [iphone]: 'PUSH_REPLY,dhcp-option DNS 192.168.0.103,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Oct 11 08:52:02 raspberrypi ovpn-server[252]: iphone/41.13.XX.YY:51474 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 08:52:02 raspberrypi ovpn-server[252]: iphone/41.13.XX.YY:51474 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 08:52:32 raspberrypi ovpn-server[252]: iphone/41.13.XX.YY:51474 SIGTERM[soft,remote-exit] received, client-instance exiting
Oct 11 08:52:39 raspberrypi ovpn-server[252]: event_wait : Interrupted system call (code=4)
Oct 11 08:52:39 raspberrypi ovpn-server[252]: Closing TUN/TAP interface
Oct 11 08:52:39 raspberrypi ovpn-server[252]: /sbin/ip addr del dev tun0 10.8.0.1/24
Oct 11 08:52:39 raspberrypi ovpn-server[252]: Linux ip addr del failed: external program exited with error status: 2
Oct 11 08:52:40 raspberrypi ovpn-server[252]: SIGTERM[hard,] received, process exiting
Oct 11 08:53:09 raspberrypi ovpn-server[538]: OpenVPN 2.4.0 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 18 2017
Oct 11 08:53:09 raspberrypi ovpn-server[538]: library versions: OpenSSL 1.0.2l  25 May 2017, LZO 2.08
Oct 11 08:53:09 raspberrypi ovpn-server[539]: NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Oct 11 08:53:09 raspberrypi ovpn-server[539]: ECDH curve secp384r1 added
Oct 11 08:53:09 raspberrypi ovpn-server[539]: Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Oct 11 08:53:09 raspberrypi ovpn-server[539]: Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Oct 11 08:53:09 raspberrypi ovpn-server[539]: Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Oct 11 08:53:09 raspberrypi ovpn-server[539]: Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Oct 11 08:53:09 raspberrypi ovpn-server[539]: TUN/TAP device tun0 opened
Oct 11 08:53:09 raspberrypi ovpn-server[539]: TUN/TAP TX queue length set to 100
Oct 11 08:53:09 raspberrypi ovpn-server[539]: do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Oct 11 08:53:09 raspberrypi ovpn-server[539]: /sbin/ip link set dev tun0 up mtu 1500
Oct 11 08:53:09 raspberrypi ovpn-server[539]: /sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
Oct 11 08:53:09 raspberrypi ovpn-server[539]: Could not determine IPv4/IPv6 protocol. Using AF_INET
Oct 11 08:53:09 raspberrypi ovpn-server[539]: Socket Buffers: R=[163840->163840] S=[163840->163840]
Oct 11 08:53:09 raspberrypi ovpn-server[539]: UDPv4 link local (bound): [AF_INET][undef]:1195
Oct 11 08:53:09 raspberrypi ovpn-server[539]: UDPv4 link remote: [AF_UNSPEC]
Oct 11 08:53:09 raspberrypi ovpn-server[539]: GID set to nogroup
Oct 11 08:53:09 raspberrypi ovpn-server[539]: UID set to nobody
Oct 11 08:53:09 raspberrypi ovpn-server[539]: MULTI: multi_init called, r=256 v=256
Oct 11 08:53:09 raspberrypi ovpn-server[539]: IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
Oct 11 08:53:09 raspberrypi ovpn-server[539]: Initialization Sequence Completed
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 TLS: Initial packet from [AF_INET]41.13.XX.YY:52532, sid=37ca73ea 9b26b601
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 tls-crypt unwrap error: bad packet ID (may be a replay): [ #1 / time = (1539247998) Thu Oct 11 08:53:18 2018 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 tls-crypt unwrap error: packet replay
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 TLS Error: tls-crypt unwrapping failed from [AF_INET]41.13.XX.YY:52532
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 VERIFY OK: depth=1, CN=ChangeMe
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 Validating certificate key usage
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 ++ Certificate has key usage  0080, expects 0080
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 VERIFY KU OK
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 Validating certificate extended key usage
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 VERIFY EKU OK
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 VERIFY OK: depth=0, CN=iphone
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 peer info: IV_GUI_VER=net.openvpn.connect.ios_3.0.2-894
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 peer info: IV_VER=3.2
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 peer info: IV_PLAT=ios
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 peer info: IV_NCP=2
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 peer info: IV_TCPNL=1
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 peer info: IV_PROTO=2
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 peer info: IV_LZO_STUB=1
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 peer info: IV_COMP_STUB=1
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 peer info: IV_COMP_STUBv2=1
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 peer info: IV_AUTO_SESS=1
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Oct 11 08:53:20 raspberrypi ovpn-server[539]: 41.13.XX.YY:52532 [iphone] Peer Connection Initiated with [AF_INET]41.13.XX.YY:52532
Oct 11 08:53:20 raspberrypi ovpn-server[539]: iphone/41.13.XX.YY:52532 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Oct 11 08:53:20 raspberrypi ovpn-server[539]: iphone/41.13.XX.YY:52532 MULTI: Learn: 10.8.0.2 -> iphone/41.13.XX.YY:52532
Oct 11 08:53:20 raspberrypi ovpn-server[539]: iphone/41.13.XX.YY:52532 MULTI: primary virtual IP for iphone/41.13.XX.YY:52532: 10.8.0.2
Oct 11 08:53:20 raspberrypi ovpn-server[539]: iphone/41.13.XX.YY:52532 PUSH: Received control message: 'PUSH_REQUEST'
Oct 11 08:53:20 raspberrypi ovpn-server[539]: iphone/41.13.XX.YY:52532 SENT CONTROL [iphone]: 'PUSH_REPLY,dhcp-option DNS 192.168.0.103,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Oct 11 08:53:20 raspberrypi ovpn-server[539]: iphone/41.13.XX.YY:52532 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 08:53:20 raspberrypi ovpn-server[539]: iphone/41.13.XX.YY:52532 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 08:53:41 raspberrypi ovpn-server[539]: iphone/41.13.XX.YY:52532 SIGTERM[soft,remote-exit] received, client-instance exiting
Oct 11 08:53:51 raspberrypi ovpn-server[539]: 41.13.XX.YY:53031 TLS: Initial packet from [AF_INET]41.13.XX.YY:53031, sid=8eae6bd1 65b6937f
Oct 11 08:53:51 raspberrypi ovpn-server[539]: 41.13.XX.YY:53031 VERIFY OK: depth=1, CN=ChangeMe
Oct 11 08:53:51 raspberrypi ovpn-server[539]: 41.13.XX.YY:53031 Validating certificate key usage
Oct 11 08:53:51 raspberrypi ovpn-server[539]: 41.13.XX.YY:53031 ++ Certificate has key usage  0080, expects 0080
Oct 11 08:53:51 raspberrypi ovpn-server[539]: 41.13.XX.YY:53031 VERIFY KU OK
Oct 11 08:53:51 raspberrypi ovpn-server[539]: 41.13.XX.YY:53031 Validating certificate extended key usage
Oct 11 08:53:51 raspberrypi ovpn-server[539]: 41.13.XX.YY:53031 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Oct 11 08:53:51 raspberrypi ovpn-server[539]: 41.13.XX.YY:53031 VERIFY EKU OK
Oct 11 08:53:51 raspberrypi ovpn-server[539]: 41.13.XX.YY:53031 VERIFY OK: depth=0, CN=iphone
Oct 11 08:53:52 raspberrypi ovpn-server[539]: 41.13.XX.YY:53031 peer info: IV_GUI_VER=net.openvpn.connect.ios_3.0.2-894
Oct 11 08:53:52 raspberrypi ovpn-server[539]: 41.13.XX.YY:53031 peer info: IV_VER=3.2
Oct 11 08:53:52 raspberrypi ovpn-server[539]: 41.13.XX.YY:53031 peer info: IV_PLAT=ios
Oct 11 08:53:52 raspberrypi ovpn-server[539]: 41.13.XX.YY:53031 peer info: IV_NCP=2
Oct 11 08:53:52 raspberrypi ovpn-server[539]: 41.13.XX.YY:53031 peer info: IV_TCPNL=1
Oct 11 08:53:52 raspberrypi ovpn-server[539]: 41.13.XX.YY:53031 peer info: IV_PROTO=2
Oct 11 08:53:52 raspberrypi ovpn-server[539]: 41.13.XX.YY:53031 peer info: IV_LZO_STUB=1
Oct 11 08:53:52 raspberrypi ovpn-server[539]: 41.13.XX.YY:53031 peer info: IV_COMP_STUB=1
Oct 11 08:53:52 raspberrypi ovpn-server[539]: 41.13.XX.YY:53031 peer info: IV_COMP_STUBv2=1
Oct 11 08:53:52 raspberrypi ovpn-server[539]: 41.13.XX.YY:53031 peer info: IV_AUTO_SESS=1
Oct 11 08:54:51 raspberrypi ovpn-server[539]: 41.13.XX.YY:53031 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Oct 11 08:54:51 raspberrypi ovpn-server[539]: 41.13.XX.YY:53031 TLS Error: TLS handshake failed
Oct 11 08:54:51 raspberrypi ovpn-server[539]: 41.13.XX.YY:53031 SIGUSR1[soft,tls-error] received, client-instance restarting
Oct 11 08:55:17 raspberrypi ovpn-server[539]: event_wait : Interrupted system call (code=4)
Oct 11 08:55:17 raspberrypi ovpn-server[539]: Closing TUN/TAP interface
Oct 11 08:55:17 raspberrypi ovpn-server[539]: /sbin/ip addr del dev tun0 10.8.0.1/24
Oct 11 08:55:17 raspberrypi ovpn-server[539]: Linux ip addr del failed: external program exited with error status: 2
Oct 11 08:55:17 raspberrypi ovpn-server[539]: SIGTERM[hard,] received, process exiting
Oct 11 08:55:17 raspberrypi ovpn-server[613]: OpenVPN 2.4.0 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 18 2017
Oct 11 08:55:17 raspberrypi ovpn-server[613]: library versions: OpenSSL 1.0.2l  25 May 2017, LZO 2.08
Oct 11 08:55:17 raspberrypi ovpn-server[614]: NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Oct 11 08:55:17 raspberrypi ovpn-server[614]: ECDH curve secp384r1 added
Oct 11 08:55:17 raspberrypi ovpn-server[614]: Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Oct 11 08:55:17 raspberrypi ovpn-server[614]: Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Oct 11 08:55:17 raspberrypi ovpn-server[614]: Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Oct 11 08:55:17 raspberrypi ovpn-server[614]: Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Oct 11 08:55:17 raspberrypi ovpn-server[614]: WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Oct 11 08:55:17 raspberrypi ovpn-server[614]: TUN/TAP device tun0 opened
Oct 11 08:55:17 raspberrypi ovpn-server[614]: TUN/TAP TX queue length set to 100
Oct 11 08:55:17 raspberrypi ovpn-server[614]: do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Oct 11 08:55:17 raspberrypi ovpn-server[614]: /sbin/ip link set dev tun0 up mtu 1400
Oct 11 08:55:17 raspberrypi ovpn-server[614]: /sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
Oct 11 08:55:17 raspberrypi ovpn-server[614]: Could not determine IPv4/IPv6 protocol. Using AF_INET
Oct 11 08:55:17 raspberrypi ovpn-server[614]: Socket Buffers: R=[163840->163840] S=[163840->163840]
Oct 11 08:55:17 raspberrypi ovpn-server[614]: UDPv4 link local (bound): [AF_INET][undef]:1195
Oct 11 08:55:17 raspberrypi ovpn-server[614]: UDPv4 link remote: [AF_UNSPEC]
Oct 11 08:55:17 raspberrypi ovpn-server[614]: GID set to nogroup
Oct 11 08:55:17 raspberrypi ovpn-server[614]: UID set to nobody
Oct 11 08:55:17 raspberrypi ovpn-server[614]: MULTI: multi_init called, r=256 v=256
Oct 11 08:55:17 raspberrypi ovpn-server[614]: IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
Oct 11 08:55:17 raspberrypi ovpn-server[614]: Initialization Sequence Completed
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 TLS: Initial packet from [AF_INET]41.13.XX.YY:54476, sid=c4875950 7384f597
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 VERIFY OK: depth=1, CN=ChangeMe
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 Validating certificate key usage
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 ++ Certificate has key usage  0080, expects 0080
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 VERIFY KU OK
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 Validating certificate extended key usage
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 VERIFY EKU OK
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 VERIFY OK: depth=0, CN=iphone
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 peer info: IV_GUI_VER=net.openvpn.connect.ios_3.0.2-894
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 peer info: IV_VER=3.2
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 peer info: IV_PLAT=ios
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 peer info: IV_NCP=2
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 peer info: IV_TCPNL=1
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 peer info: IV_PROTO=2
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 peer info: IV_LZO_STUB=1
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 peer info: IV_COMP_STUB=1
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 peer info: IV_COMP_STUBv2=1
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 peer info: IV_AUTO_SESS=1
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1470', remote='link-mtu 1570'
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1400', remote='tun-mtu 1500'
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Oct 11 08:55:42 raspberrypi ovpn-server[614]: 41.13.XX.YY:54476 [iphone] Peer Connection Initiated with [AF_INET]41.13.XX.YY:54476
Oct 11 08:55:42 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:54476 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Oct 11 08:55:42 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:54476 MULTI: Learn: 10.8.0.2 -> iphone/41.13.XX.YY:54476
Oct 11 08:55:42 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:54476 MULTI: primary virtual IP for iphone/41.13.XX.YY:54476: 10.8.0.2
Oct 11 08:55:42 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:54476 PUSH: Received control message: 'PUSH_REQUEST'
Oct 11 08:55:42 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:54476 SENT CONTROL [iphone]: 'PUSH_REPLY,dhcp-option DNS 192.168.0.103,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Oct 11 08:55:42 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:54476 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 08:55:42 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:54476 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 08:58:52 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:54476 SIGTERM[soft,remote-exit] received, client-instance exiting
Oct 11 08:59:05 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Oct 11 08:59:05 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 TLS: Initial packet from [AF_INET]41.13.XX.YY:57488, sid=59fdbfe0 343c4f3b
Oct 11 08:59:06 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 VERIFY OK: depth=1, CN=ChangeMe
Oct 11 08:59:06 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 Validating certificate key usage
Oct 11 08:59:06 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 ++ Certificate has key usage  0080, expects 0080
Oct 11 08:59:06 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 VERIFY KU OK
Oct 11 08:59:06 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 Validating certificate extended key usage
Oct 11 08:59:06 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Oct 11 08:59:06 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 VERIFY EKU OK
Oct 11 08:59:06 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 VERIFY OK: depth=0, CN=iphone
Oct 11 08:59:06 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 peer info: IV_GUI_VER=net.openvpn.connect.ios_3.0.2-894
Oct 11 08:59:06 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 peer info: IV_VER=3.2
Oct 11 08:59:06 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 peer info: IV_PLAT=ios
Oct 11 08:59:06 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 peer info: IV_NCP=2
Oct 11 08:59:06 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 peer info: IV_TCPNL=1
Oct 11 08:59:06 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 peer info: IV_PROTO=2
Oct 11 08:59:06 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 peer info: IV_LZO_STUB=1
Oct 11 08:59:06 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 peer info: IV_COMP_STUB=1
Oct 11 08:59:06 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 peer info: IV_COMP_STUBv2=1
Oct 11 08:59:06 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 peer info: IV_AUTO_SESS=1
Oct 11 08:59:06 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1470', remote='link-mtu 1570'
Oct 11 08:59:06 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1400', remote='tun-mtu 1500'
Oct 11 08:59:06 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Oct 11 08:59:06 raspberrypi ovpn-server[614]: 41.13.XX.YY:57488 [iphone] Peer Connection Initiated with [AF_INET]41.13.XX.YY:57488
Oct 11 08:59:06 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:57488 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Oct 11 08:59:06 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:57488 MULTI: Learn: 10.8.0.2 -> iphone/41.13.XX.YY:57488
Oct 11 08:59:06 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:57488 MULTI: primary virtual IP for iphone/41.13.XX.YY:57488: 10.8.0.2
Oct 11 08:59:06 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:57488 PUSH: Received control message: 'PUSH_REQUEST'
Oct 11 08:59:06 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:57488 SENT CONTROL [iphone]: 'PUSH_REPLY,dhcp-option DNS 192.168.0.103,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Oct 11 08:59:06 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:57488 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 08:59:06 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:57488 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 08:59:19 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:57488 SIGTERM[soft,remote-exit] received, client-instance exiting
Oct 11 09:14:55 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Oct 11 09:14:55 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 TLS: Initial packet from [AF_INET]41.13.XX.YY:42003, sid=b1c10643 87150905
Oct 11 09:14:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 VERIFY OK: depth=1, CN=ChangeMe
Oct 11 09:14:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 Validating certificate key usage
Oct 11 09:14:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 ++ Certificate has key usage  0080, expects 0080
Oct 11 09:14:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 VERIFY KU OK
Oct 11 09:14:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 Validating certificate extended key usage
Oct 11 09:14:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Oct 11 09:14:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 VERIFY EKU OK
Oct 11 09:14:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 VERIFY OK: depth=0, CN=iphone
Oct 11 09:14:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 peer info: IV_GUI_VER=net.openvpn.connect.ios_3.0.2-894
Oct 11 09:14:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 peer info: IV_VER=3.2
Oct 11 09:14:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 peer info: IV_PLAT=ios
Oct 11 09:14:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 peer info: IV_NCP=2
Oct 11 09:14:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 peer info: IV_TCPNL=1
Oct 11 09:14:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 peer info: IV_PROTO=2
Oct 11 09:14:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 peer info: IV_LZO_STUB=1
Oct 11 09:14:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 peer info: IV_COMP_STUB=1
Oct 11 09:14:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 peer info: IV_COMP_STUBv2=1
Oct 11 09:14:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 peer info: IV_AUTO_SESS=1
Oct 11 09:14:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1470', remote='link-mtu 1570'
Oct 11 09:14:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1400', remote='tun-mtu 1500'
Oct 11 09:14:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Oct 11 09:14:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:42003 [iphone] Peer Connection Initiated with [AF_INET]41.13.XX.YY:42003
Oct 11 09:14:56 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:42003 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Oct 11 09:14:56 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:42003 MULTI: Learn: 10.8.0.2 -> iphone/41.13.XX.YY:42003
Oct 11 09:14:56 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:42003 MULTI: primary virtual IP for iphone/41.13.XX.YY:42003: 10.8.0.2
Oct 11 09:14:56 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:42003 PUSH: Received control message: 'PUSH_REQUEST'
Oct 11 09:14:56 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:42003 SENT CONTROL [iphone]: 'PUSH_REPLY,dhcp-option DNS 192.168.0.103,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Oct 11 09:14:56 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:42003 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:14:56 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:42003 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:16:20 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:42003 SIGTERM[soft,remote-exit] received, client-instance exiting
Oct 11 09:17:14 raspberrypi ovpn-server[614]: 41.13.XX.YY:44088 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Oct 11 09:17:14 raspberrypi ovpn-server[614]: 41.13.XX.YY:44088 TLS: Initial packet from [AF_INET]41.13.XX.YY:44088, sid=ee8ae3ab 136cd72c
Oct 11 09:18:15 raspberrypi ovpn-server[614]: 41.13.XX.YY:44088 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Oct 11 09:18:15 raspberrypi ovpn-server[614]: 41.13.XX.YY:44088 TLS Error: TLS handshake failed
Oct 11 09:18:15 raspberrypi ovpn-server[614]: 41.13.XX.YY:44088 SIGUSR1[soft,tls-error] received, client-instance restarting
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 TLS: Initial packet from [AF_INET]41.13.XX.YY:45097, sid=447aee9d 6e606162
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 VERIFY OK: depth=1, CN=ChangeMe
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 Validating certificate key usage
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 ++ Certificate has key usage  0080, expects 0080
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 VERIFY KU OK
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 Validating certificate extended key usage
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 VERIFY EKU OK
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 VERIFY OK: depth=0, CN=iphone
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 peer info: IV_GUI_VER=net.openvpn.connect.ios_3.0.2-894
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 peer info: IV_VER=3.2
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 peer info: IV_PLAT=ios
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 peer info: IV_NCP=2
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 peer info: IV_TCPNL=1
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 peer info: IV_PROTO=2
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 peer info: IV_LZO_STUB=1
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 peer info: IV_COMP_STUB=1
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 peer info: IV_COMP_STUBv2=1
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 peer info: IV_AUTO_SESS=1
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1470', remote='link-mtu 1570'
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1400', remote='tun-mtu 1500'
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Oct 11 09:18:20 raspberrypi ovpn-server[614]: 41.13.XX.YY:45097 [iphone] Peer Connection Initiated with [AF_INET]41.13.XX.YY:45097
Oct 11 09:18:20 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:45097 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Oct 11 09:18:20 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:45097 MULTI: Learn: 10.8.0.2 -> iphone/41.13.XX.YY:45097
Oct 11 09:18:20 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:45097 MULTI: primary virtual IP for iphone/41.13.XX.YY:45097: 10.8.0.2
Oct 11 09:18:20 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:45097 PUSH: Received control message: 'PUSH_REQUEST'
Oct 11 09:18:20 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:45097 SENT CONTROL [iphone]: 'PUSH_REPLY,dhcp-option DNS 192.168.0.103,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Oct 11 09:18:20 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:45097 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:18:20 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:45097 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:19:18 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:45097 SIGTERM[soft,remote-exit] received, client-instance exiting
Oct 11 09:19:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Oct 11 09:19:56 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 TLS: Initial packet from [AF_INET]41.13.XX.YY:46481, sid=4ba18455 26d506ac
Oct 11 09:19:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 VERIFY OK: depth=1, CN=ChangeMe
Oct 11 09:19:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 Validating certificate key usage
Oct 11 09:19:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 ++ Certificate has key usage  0080, expects 0080
Oct 11 09:19:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 VERIFY KU OK
Oct 11 09:19:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 Validating certificate extended key usage
Oct 11 09:19:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Oct 11 09:19:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 VERIFY EKU OK
Oct 11 09:19:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 VERIFY OK: depth=0, CN=iphone
Oct 11 09:19:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 peer info: IV_GUI_VER=net.openvpn.connect.ios_3.0.2-894
Oct 11 09:19:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 peer info: IV_VER=3.2
Oct 11 09:19:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 peer info: IV_PLAT=ios
Oct 11 09:19:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 peer info: IV_NCP=2
Oct 11 09:19:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 peer info: IV_TCPNL=1
Oct 11 09:19:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 peer info: IV_PROTO=2
Oct 11 09:19:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 peer info: IV_LZO_STUB=1
Oct 11 09:19:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 peer info: IV_COMP_STUB=1
Oct 11 09:19:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 peer info: IV_COMP_STUBv2=1
Oct 11 09:19:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 peer info: IV_AUTO_SESS=1
Oct 11 09:19:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1470', remote='link-mtu 1570'
Oct 11 09:19:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1400', remote='tun-mtu 1500'
Oct 11 09:19:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Oct 11 09:19:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:46481 [iphone] Peer Connection Initiated with [AF_INET]41.13.XX.YY:46481
Oct 11 09:19:57 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:46481 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Oct 11 09:19:57 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:46481 MULTI: Learn: 10.8.0.2 -> iphone/41.13.XX.YY:46481
Oct 11 09:19:57 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:46481 MULTI: primary virtual IP for iphone/41.13.XX.YY:46481: 10.8.0.2
Oct 11 09:19:57 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:46481 PUSH: Received control message: 'PUSH_REQUEST'
Oct 11 09:19:57 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:46481 SENT CONTROL [iphone]: 'PUSH_REPLY,dhcp-option DNS 192.168.0.103,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Oct 11 09:19:57 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:46481 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:19:57 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:46481 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:20:11 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:46481 SIGTERM[soft,remote-exit] received, client-instance exiting
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 TLS: Initial packet from [AF_INET]41.13.XX.YY:48690, sid=6d4b7174 4992f25c
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 VERIFY OK: depth=1, CN=ChangeMe
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 Validating certificate key usage
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 ++ Certificate has key usage  0080, expects 0080
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 VERIFY KU OK
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 Validating certificate extended key usage
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 VERIFY EKU OK
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 VERIFY OK: depth=0, CN=iphone
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 peer info: IV_GUI_VER=net.openvpn.connect.ios_3.0.2-894
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 peer info: IV_VER=3.2
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 peer info: IV_PLAT=ios
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 peer info: IV_NCP=2
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 peer info: IV_TCPNL=1
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 peer info: IV_PROTO=2
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 peer info: IV_LZO_STUB=1
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 peer info: IV_COMP_STUB=1
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 peer info: IV_COMP_STUBv2=1
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 peer info: IV_AUTO_SESS=1
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1470', remote='link-mtu 1570'
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1400', remote='tun-mtu 1500'
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Oct 11 09:22:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:48690 [iphone] Peer Connection Initiated with [AF_INET]41.13.XX.YY:48690
Oct 11 09:22:01 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:48690 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Oct 11 09:22:01 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:48690 MULTI: Learn: 10.8.0.2 -> iphone/41.13.XX.YY:48690
Oct 11 09:22:01 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:48690 MULTI: primary virtual IP for iphone/41.13.XX.YY:48690: 10.8.0.2
Oct 11 09:22:01 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:48690 PUSH: Received control message: 'PUSH_REQUEST'
Oct 11 09:22:01 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:48690 SENT CONTROL [iphone]: 'PUSH_REPLY,dhcp-option DNS 192.168.0.103,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Oct 11 09:22:01 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:48690 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:22:01 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:48690 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:22:03 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:48690 SIGTERM[soft,remote-exit] received, client-instance exiting
Oct 11 09:22:26 raspberrypi ovpn-server[614]: 41.13.XX.YY:49134 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Oct 11 09:22:26 raspberrypi ovpn-server[614]: 41.13.XX.YY:49134 TLS: Initial packet from [AF_INET]41.13.XX.YY:49134, sid=07aa2c77 e4ce132b
Oct 11 09:22:26 raspberrypi ovpn-server[614]: 41.13.XX.YY:49134 VERIFY OK: depth=1, CN=ChangeMe
Oct 11 09:22:26 raspberrypi ovpn-server[614]: 41.13.XX.YY:49134 Validating certificate key usage
Oct 11 09:22:26 raspberrypi ovpn-server[614]: 41.13.XX.YY:49134 ++ Certificate has key usage  0080, expects 0080
Oct 11 09:22:26 raspberrypi ovpn-server[614]: 41.13.XX.YY:49134 VERIFY KU OK
Oct 11 09:22:26 raspberrypi ovpn-server[614]: 41.13.XX.YY:49134 Validating certificate extended key usage
Oct 11 09:22:26 raspberrypi ovpn-server[614]: 41.13.XX.YY:49134 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Oct 11 09:22:26 raspberrypi ovpn-server[614]: 41.13.XX.YY:49134 VERIFY EKU OK
Oct 11 09:22:26 raspberrypi ovpn-server[614]: 41.13.XX.YY:49134 VERIFY OK: depth=0, CN=iphone
Oct 11 09:22:31 raspberrypi ovpn-server[614]: 41.13.XX.YY:49209 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Oct 11 09:22:31 raspberrypi ovpn-server[614]: 41.13.XX.YY:49209 TLS: Initial packet from [AF_INET]41.13.XX.YY:49209, sid=c4ae1b07 bf800eec
Oct 11 09:23:26 raspberrypi ovpn-server[614]: 41.13.XX.YY:49134 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Oct 11 09:23:26 raspberrypi ovpn-server[614]: 41.13.XX.YY:49134 TLS Error: TLS handshake failed
Oct 11 09:23:26 raspberrypi ovpn-server[614]: 41.13.XX.YY:49134 SIGUSR1[soft,tls-error] received, client-instance restarting
Oct 11 09:23:31 raspberrypi ovpn-server[614]: 41.13.XX.YY:49209 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Oct 11 09:23:31 raspberrypi ovpn-server[614]: 41.13.XX.YY:49209 TLS Error: TLS handshake failed
Oct 11 09:23:31 raspberrypi ovpn-server[614]: 41.13.XX.YY:49209 SIGUSR1[soft,tls-error] received, client-instance restarting
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 TLS: Initial packet from [AF_INET]41.13.XX.YY:52501, sid=d60dc04d eba4561d
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 VERIFY OK: depth=1, CN=ChangeMe
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 Validating certificate key usage
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 ++ Certificate has key usage  0080, expects 0080
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 VERIFY KU OK
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 Validating certificate extended key usage
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 VERIFY EKU OK
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 VERIFY OK: depth=0, CN=iphone
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 peer info: IV_GUI_VER=net.openvpn.connect.ios_3.0.2-894
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 peer info: IV_VER=3.2
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 peer info: IV_PLAT=ios
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 peer info: IV_NCP=2
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 peer info: IV_TCPNL=1
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 peer info: IV_PROTO=2
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 peer info: IV_LZO_STUB=1
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 peer info: IV_COMP_STUB=1
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 peer info: IV_COMP_STUBv2=1
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 peer info: IV_AUTO_SESS=1
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1470', remote='link-mtu 1570'
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1400', remote='tun-mtu 1500'
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Oct 11 09:25:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:52501 [iphone] Peer Connection Initiated with [AF_INET]41.13.XX.YY:52501
Oct 11 09:25:40 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:52501 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Oct 11 09:25:40 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:52501 MULTI: Learn: 10.8.0.2 -> iphone/41.13.XX.YY:52501
Oct 11 09:25:40 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:52501 MULTI: primary virtual IP for iphone/41.13.XX.YY:52501: 10.8.0.2
Oct 11 09:25:40 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:52501 PUSH: Received control message: 'PUSH_REQUEST'
Oct 11 09:25:40 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:52501 SENT CONTROL [iphone]: 'PUSH_REPLY,dhcp-option DNS 192.168.0.103,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Oct 11 09:25:40 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:52501 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:25:40 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:52501 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:26:20 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:52501 SIGTERM[soft,remote-exit] received, client-instance exiting
Oct 11 09:27:00 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Oct 11 09:27:00 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 TLS: Initial packet from [AF_INET]41.13.XX.YY:54225, sid=3d3cc820 94fc1d2c
Oct 11 09:27:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 VERIFY OK: depth=1, CN=ChangeMe
Oct 11 09:27:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 Validating certificate key usage
Oct 11 09:27:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 ++ Certificate has key usage  0080, expects 0080
Oct 11 09:27:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 VERIFY KU OK
Oct 11 09:27:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 Validating certificate extended key usage
Oct 11 09:27:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Oct 11 09:27:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 VERIFY EKU OK
Oct 11 09:27:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 VERIFY OK: depth=0, CN=iphone
Oct 11 09:27:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 peer info: IV_GUI_VER=net.openvpn.connect.ios_3.0.2-894
Oct 11 09:27:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 peer info: IV_VER=3.2
Oct 11 09:27:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 peer info: IV_PLAT=ios
Oct 11 09:27:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 peer info: IV_NCP=2
Oct 11 09:27:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 peer info: IV_TCPNL=1
Oct 11 09:27:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 peer info: IV_PROTO=2
Oct 11 09:27:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 peer info: IV_LZO_STUB=1
Oct 11 09:27:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 peer info: IV_COMP_STUB=1
Oct 11 09:27:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 peer info: IV_COMP_STUBv2=1
Oct 11 09:27:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 peer info: IV_AUTO_SESS=1
Oct 11 09:27:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1470', remote='link-mtu 1570'
Oct 11 09:27:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1400', remote='tun-mtu 1500'
Oct 11 09:27:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Oct 11 09:27:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:54225 [iphone] Peer Connection Initiated with [AF_INET]41.13.XX.YY:54225
Oct 11 09:27:01 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:54225 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Oct 11 09:27:01 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:54225 MULTI: Learn: 10.8.0.2 -> iphone/41.13.XX.YY:54225
Oct 11 09:27:01 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:54225 MULTI: primary virtual IP for iphone/41.13.XX.YY:54225: 10.8.0.2
Oct 11 09:27:01 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:54225 PUSH: Received control message: 'PUSH_REQUEST'
Oct 11 09:27:01 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:54225 SENT CONTROL [iphone]: 'PUSH_REPLY,dhcp-option DNS 192.168.0.103,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Oct 11 09:27:01 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:54225 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:27:01 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:54225 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:27:22 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:54225 SIGTERM[soft,remote-exit] received, client-instance exiting
Oct 11 09:28:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Oct 11 09:28:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 TLS: Initial packet from [AF_INET]41.13.XX.YY:56180, sid=8eb57919 f6fa7de6
Oct 11 09:28:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 tls-crypt unwrap error: bad packet ID (may be a replay): [ #1 / time = (1539250112) Thu Oct 11 09:28:32 2018 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Oct 11 09:28:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 tls-crypt unwrap error: packet replay
Oct 11 09:28:40 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 TLS Error: tls-crypt unwrapping failed from [AF_INET]41.13.XX.YY:56180
Oct 11 09:28:41 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 VERIFY OK: depth=1, CN=ChangeMe
Oct 11 09:28:41 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 Validating certificate key usage
Oct 11 09:28:41 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 ++ Certificate has key usage  0080, expects 0080
Oct 11 09:28:41 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 VERIFY KU OK
Oct 11 09:28:41 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 Validating certificate extended key usage
Oct 11 09:28:41 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Oct 11 09:28:41 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 VERIFY EKU OK
Oct 11 09:28:41 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 VERIFY OK: depth=0, CN=iphone
Oct 11 09:28:41 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 peer info: IV_GUI_VER=net.openvpn.connect.ios_3.0.2-894
Oct 11 09:28:41 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 peer info: IV_VER=3.2
Oct 11 09:28:41 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 peer info: IV_PLAT=ios
Oct 11 09:28:41 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 peer info: IV_NCP=2
Oct 11 09:28:41 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 peer info: IV_TCPNL=1
Oct 11 09:28:41 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 peer info: IV_PROTO=2
Oct 11 09:28:41 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 peer info: IV_LZO_STUB=1
Oct 11 09:28:41 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 peer info: IV_COMP_STUB=1
Oct 11 09:28:41 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 peer info: IV_COMP_STUBv2=1
Oct 11 09:28:41 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 peer info: IV_AUTO_SESS=1
Oct 11 09:28:41 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1470', remote='link-mtu 1570'
Oct 11 09:28:41 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1400', remote='tun-mtu 1500'
Oct 11 09:28:41 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Oct 11 09:28:41 raspberrypi ovpn-server[614]: 41.13.XX.YY:56180 [iphone] Peer Connection Initiated with [AF_INET]41.13.XX.YY:56180
Oct 11 09:28:41 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:56180 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Oct 11 09:28:41 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:56180 MULTI: Learn: 10.8.0.2 -> iphone/41.13.XX.YY:56180
Oct 11 09:28:41 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:56180 MULTI: primary virtual IP for iphone/41.13.XX.YY:56180: 10.8.0.2
Oct 11 09:28:41 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:56180 PUSH: Received control message: 'PUSH_REQUEST'
Oct 11 09:28:41 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:56180 SENT CONTROL [iphone]: 'PUSH_REPLY,dhcp-option DNS 192.168.0.103,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Oct 11 09:28:41 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:56180 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:28:41 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:56180 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:28:48 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:56180 SIGTERM[soft,remote-exit] received, client-instance exiting
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 TLS: Initial packet from [AF_INET]41.13.XX.YY:63100, sid=35298aef d7698dce
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 VERIFY OK: depth=1, CN=ChangeMe
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 Validating certificate key usage
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 ++ Certificate has key usage  0080, expects 0080
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 VERIFY KU OK
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 Validating certificate extended key usage
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 VERIFY EKU OK
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 VERIFY OK: depth=0, CN=iphone
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 peer info: IV_GUI_VER=net.openvpn.connect.ios_3.0.2-894
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 peer info: IV_VER=3.2
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 peer info: IV_PLAT=ios
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 peer info: IV_NCP=2
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 peer info: IV_TCPNL=1
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 peer info: IV_PROTO=2
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 peer info: IV_LZO_STUB=1
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 peer info: IV_COMP_STUB=1
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 peer info: IV_COMP_STUBv2=1
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 peer info: IV_AUTO_SESS=1
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1470', remote='link-mtu 1570'
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1400', remote='tun-mtu 1500'
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Oct 11 09:34:57 raspberrypi ovpn-server[614]: 41.13.XX.YY:63100 [iphone] Peer Connection Initiated with [AF_INET]41.13.XX.YY:63100
Oct 11 09:34:57 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:63100 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Oct 11 09:34:57 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:63100 MULTI: Learn: 10.8.0.2 -> iphone/41.13.XX.YY:63100
Oct 11 09:34:57 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:63100 MULTI: primary virtual IP for iphone/41.13.XX.YY:63100: 10.8.0.2
Oct 11 09:34:57 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:63100 PUSH: Received control message: 'PUSH_REQUEST'
Oct 11 09:34:57 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:63100 SENT CONTROL [iphone]: 'PUSH_REPLY,dhcp-option DNS 192.168.0.103,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Oct 11 09:34:58 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:63100 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:34:58 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:63100 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:35:46 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:63100 SIGTERM[soft,remote-exit] received, client-instance exiting
Oct 11 09:36:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Oct 11 09:36:01 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 TLS: Initial packet from [AF_INET]41.13.XX.YY:33166, sid=c6cc2936 cb76df37
Oct 11 09:36:02 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 VERIFY OK: depth=1, CN=ChangeMe
Oct 11 09:36:02 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 Validating certificate key usage
Oct 11 09:36:02 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 ++ Certificate has key usage  0080, expects 0080
Oct 11 09:36:02 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 VERIFY KU OK
Oct 11 09:36:02 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 Validating certificate extended key usage
Oct 11 09:36:02 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Oct 11 09:36:02 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 VERIFY EKU OK
Oct 11 09:36:02 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 VERIFY OK: depth=0, CN=iphone
Oct 11 09:36:02 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 peer info: IV_GUI_VER=net.openvpn.connect.ios_3.0.2-894
Oct 11 09:36:02 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 peer info: IV_VER=3.2
Oct 11 09:36:02 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 peer info: IV_PLAT=ios
Oct 11 09:36:02 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 peer info: IV_NCP=2
Oct 11 09:36:02 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 peer info: IV_TCPNL=1
Oct 11 09:36:02 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 peer info: IV_PROTO=2
Oct 11 09:36:02 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 peer info: IV_LZO_STUB=1
Oct 11 09:36:02 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 peer info: IV_COMP_STUB=1
Oct 11 09:36:02 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 peer info: IV_COMP_STUBv2=1
Oct 11 09:36:02 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 peer info: IV_AUTO_SESS=1
Oct 11 09:36:02 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1470', remote='link-mtu 1570'
Oct 11 09:36:02 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1400', remote='tun-mtu 1500'
Oct 11 09:36:02 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Oct 11 09:36:02 raspberrypi ovpn-server[614]: 41.13.XX.YY:33166 [iphone] Peer Connection Initiated with [AF_INET]41.13.XX.YY:33166
Oct 11 09:36:02 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:33166 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Oct 11 09:36:02 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:33166 MULTI: Learn: 10.8.0.2 -> iphone/41.13.XX.YY:33166
Oct 11 09:36:02 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:33166 MULTI: primary virtual IP for iphone/41.13.XX.YY:33166: 10.8.0.2
Oct 11 09:36:02 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:33166 PUSH: Received control message: 'PUSH_REQUEST'
Oct 11 09:36:02 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:33166 SENT CONTROL [iphone]: 'PUSH_REPLY,dhcp-option DNS 192.168.0.103,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Oct 11 09:36:02 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:33166 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:36:02 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:33166 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:36:05 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:33166 SIGTERM[soft,remote-exit] received, client-instance exiting
Oct 11 09:39:22 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Oct 11 09:39:22 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 TLS: Initial packet from [AF_INET]41.13.XX.YY:37140, sid=8974bf07 9898aa0b
Oct 11 09:39:23 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 VERIFY OK: depth=1, CN=ChangeMe
Oct 11 09:39:23 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 Validating certificate key usage
Oct 11 09:39:23 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 ++ Certificate has key usage  0080, expects 0080
Oct 11 09:39:23 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 VERIFY KU OK
Oct 11 09:39:23 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 Validating certificate extended key usage
Oct 11 09:39:23 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Oct 11 09:39:23 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 VERIFY EKU OK
Oct 11 09:39:23 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 VERIFY OK: depth=0, CN=iphone
Oct 11 09:39:23 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 peer info: IV_GUI_VER=net.openvpn.connect.ios_3.0.2-894
Oct 11 09:39:23 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 peer info: IV_VER=3.2
Oct 11 09:39:23 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 peer info: IV_PLAT=ios
Oct 11 09:39:23 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 peer info: IV_NCP=2
Oct 11 09:39:23 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 peer info: IV_TCPNL=1
Oct 11 09:39:23 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 peer info: IV_PROTO=2
Oct 11 09:39:23 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 peer info: IV_LZO_STUB=1
Oct 11 09:39:23 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 peer info: IV_COMP_STUB=1
Oct 11 09:39:23 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 peer info: IV_COMP_STUBv2=1
Oct 11 09:39:23 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 peer info: IV_AUTO_SESS=1
Oct 11 09:39:23 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1470', remote='link-mtu 1570'
Oct 11 09:39:23 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1400', remote='tun-mtu 1500'
Oct 11 09:39:24 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Oct 11 09:39:24 raspberrypi ovpn-server[614]: 41.13.XX.YY:37140 [iphone] Peer Connection Initiated with [AF_INET]41.13.XX.YY:37140
Oct 11 09:39:24 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:37140 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Oct 11 09:39:24 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:37140 MULTI: Learn: 10.8.0.2 -> iphone/41.13.XX.YY:37140
Oct 11 09:39:24 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:37140 MULTI: primary virtual IP for iphone/41.13.XX.YY:37140: 10.8.0.2
Oct 11 09:39:24 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:37140 PUSH: Received control message: 'PUSH_REQUEST'
Oct 11 09:39:24 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:37140 SENT CONTROL [iphone]: 'PUSH_REPLY,dhcp-option DNS 192.168.0.103,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Oct 11 09:39:24 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:37140 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:39:24 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:37140 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:39:29 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:37140 SIGTERM[soft,remote-exit] received, client-instance exiting
Oct 11 09:39:34 raspberrypi ovpn-server[614]: 41.13.XX.YY:37337 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Oct 11 09:39:34 raspberrypi ovpn-server[614]: 41.13.XX.YY:37337 TLS: Initial packet from [AF_INET]41.13.XX.YY:37337, sid=bfcb0046 a65f5478
Oct 11 09:39:35 raspberrypi ovpn-server[614]: 41.13.XX.YY:37337 VERIFY OK: depth=1, CN=ChangeMe
Oct 11 09:39:35 raspberrypi ovpn-server[614]: 41.13.XX.YY:37337 Validating certificate key usage
Oct 11 09:39:35 raspberrypi ovpn-server[614]: 41.13.XX.YY:37337 ++ Certificate has key usage  0080, expects 0080
Oct 11 09:39:35 raspberrypi ovpn-server[614]: 41.13.XX.YY:37337 VERIFY KU OK
Oct 11 09:39:35 raspberrypi ovpn-server[614]: 41.13.XX.YY:37337 Validating certificate extended key usage
Oct 11 09:39:35 raspberrypi ovpn-server[614]: 41.13.XX.YY:37337 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Oct 11 09:39:35 raspberrypi ovpn-server[614]: 41.13.XX.YY:37337 VERIFY EKU OK
Oct 11 09:39:35 raspberrypi ovpn-server[614]: 41.13.XX.YY:37337 VERIFY OK: depth=0, CN=iphone
Oct 11 09:40:13 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Oct 11 09:40:13 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 TLS: Initial packet from [AF_INET]41.13.XX.YY:38202, sid=01caac0c fb178c71
Oct 11 09:40:14 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 tls-crypt unwrap error: bad packet ID (may be a replay): [ #1 / time = (1539250813) Thu Oct 11 09:40:13 2018 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Oct 11 09:40:14 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 tls-crypt unwrap error: packet replay
Oct 11 09:40:14 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 TLS Error: tls-crypt unwrapping failed from [AF_INET]41.13.XX.YY:38202
Oct 11 09:40:15 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 tls-crypt unwrap error: bad packet ID (may be a replay): [ #1 / time = (1539250813) Thu Oct 11 09:40:13 2018 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Oct 11 09:40:15 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 tls-crypt unwrap error: packet replay
Oct 11 09:40:15 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 TLS Error: tls-crypt unwrapping failed from [AF_INET]41.13.XX.YY:38202
Oct 11 09:40:17 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 VERIFY OK: depth=1, CN=ChangeMe
Oct 11 09:40:17 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 Validating certificate key usage
Oct 11 09:40:17 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 ++ Certificate has key usage  0080, expects 0080
Oct 11 09:40:17 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 VERIFY KU OK
Oct 11 09:40:17 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 Validating certificate extended key usage
Oct 11 09:40:17 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Oct 11 09:40:17 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 VERIFY EKU OK
Oct 11 09:40:17 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 VERIFY OK: depth=0, CN=iphone
Oct 11 09:40:17 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 tls-crypt unwrap error: bad packet ID (may be a replay): [ #5 / time = (1539250813) Thu Oct 11 09:40:13 2018 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Oct 11 09:40:17 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 tls-crypt unwrap error: packet replay
Oct 11 09:40:17 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 TLS Error: tls-crypt unwrapping failed from [AF_INET]41.13.XX.YY:38202
Oct 11 09:40:18 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 tls-crypt unwrap error: bad packet ID (may be a replay): [ #5 / time = (1539250813) Thu Oct 11 09:40:13 2018 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Oct 11 09:40:18 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 tls-crypt unwrap error: packet replay
Oct 11 09:40:18 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 TLS Error: tls-crypt unwrapping failed from [AF_INET]41.13.XX.YY:38202
Oct 11 09:40:19 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 peer info: IV_GUI_VER=net.openvpn.connect.ios_3.0.2-894
Oct 11 09:40:19 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 peer info: IV_VER=3.2
Oct 11 09:40:19 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 peer info: IV_PLAT=ios
Oct 11 09:40:19 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 peer info: IV_NCP=2
Oct 11 09:40:19 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 peer info: IV_TCPNL=1
Oct 11 09:40:19 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 peer info: IV_PROTO=2
Oct 11 09:40:19 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 peer info: IV_LZO_STUB=1
Oct 11 09:40:19 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 peer info: IV_COMP_STUB=1
Oct 11 09:40:19 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 peer info: IV_COMP_STUBv2=1
Oct 11 09:40:19 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 peer info: IV_AUTO_SESS=1
Oct 11 09:40:19 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1470', remote='link-mtu 1570'
Oct 11 09:40:19 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1400', remote='tun-mtu 1500'
Oct 11 09:40:19 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Oct 11 09:40:19 raspberrypi ovpn-server[614]: 41.13.XX.YY:38202 [iphone] Peer Connection Initiated with [AF_INET]41.13.XX.YY:38202
Oct 11 09:40:19 raspberrypi ovpn-server[614]: MULTI: new connection by client 'iphone' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Oct 11 09:40:19 raspberrypi ovpn-server[614]: MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Oct 11 09:40:19 raspberrypi ovpn-server[614]: MULTI: Learn: 10.8.0.2 -> iphone/41.13.XX.YY:38202
Oct 11 09:40:19 raspberrypi ovpn-server[614]: MULTI: primary virtual IP for iphone/41.13.XX.YY:38202: 10.8.0.2
Oct 11 09:40:19 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:38202 PUSH: Received control message: 'PUSH_REQUEST'
Oct 11 09:40:19 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:38202 SENT CONTROL [iphone]: 'PUSH_REPLY,dhcp-option DNS 192.168.0.103,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 1,cipher AES-256-GCM' (status=1)
Oct 11 09:40:19 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:38202 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:40:19 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:38202 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:42:29 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:38202 SIGTERM[soft,remote-exit] received, client-instance exiting
Oct 11 09:42:33 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Oct 11 09:42:33 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 TLS: Initial packet from [AF_INET]41.13.XX.YY:40612, sid=a7598c91 ebc7894d
Oct 11 09:42:33 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 tls-crypt unwrap error: bad packet ID (may be a replay): [ #1 / time = (1539250951) Thu Oct 11 09:42:31 2018 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Oct 11 09:42:33 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 tls-crypt unwrap error: packet replay
Oct 11 09:42:33 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 TLS Error: tls-crypt unwrapping failed from [AF_INET]41.13.XX.YY:40612
Oct 11 09:42:35 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 VERIFY OK: depth=1, CN=ChangeMe
Oct 11 09:42:35 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 Validating certificate key usage
Oct 11 09:42:35 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 ++ Certificate has key usage  0080, expects 0080
Oct 11 09:42:35 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 VERIFY KU OK
Oct 11 09:42:35 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 Validating certificate extended key usage
Oct 11 09:42:35 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Oct 11 09:42:35 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 VERIFY EKU OK
Oct 11 09:42:35 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 VERIFY OK: depth=0, CN=iphone
Oct 11 09:42:36 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 tls-crypt unwrap error: bad packet ID (may be a replay): [ #4 / time = (1539250951) Thu Oct 11 09:42:31 2018 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Oct 11 09:42:36 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 tls-crypt unwrap error: packet replay
Oct 11 09:42:36 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 TLS Error: tls-crypt unwrapping failed from [AF_INET]41.13.XX.YY:40612
Oct 11 09:42:36 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 peer info: IV_GUI_VER=net.openvpn.connect.ios_3.0.2-894
Oct 11 09:42:36 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 peer info: IV_VER=3.2
Oct 11 09:42:36 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 peer info: IV_PLAT=ios
Oct 11 09:42:36 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 peer info: IV_NCP=2
Oct 11 09:42:36 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 peer info: IV_TCPNL=1
Oct 11 09:42:36 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 peer info: IV_PROTO=2
Oct 11 09:42:36 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 peer info: IV_LZO_STUB=1
Oct 11 09:42:36 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 peer info: IV_COMP_STUB=1
Oct 11 09:42:36 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 peer info: IV_COMP_STUBv2=1
Oct 11 09:42:36 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 peer info: IV_AUTO_SESS=1
Oct 11 09:42:36 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1470', remote='link-mtu 1570'
Oct 11 09:42:36 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1400', remote='tun-mtu 1500'
Oct 11 09:42:36 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 tls-crypt unwrap error: bad packet ID (may be a replay): [ #5 / time = (1539250951) Thu Oct 11 09:42:31 2018 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Oct 11 09:42:36 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 tls-crypt unwrap error: packet replay
Oct 11 09:42:36 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 TLS Error: tls-crypt unwrapping failed from [AF_INET]41.13.XX.YY:40612
Oct 11 09:42:36 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Oct 11 09:42:36 raspberrypi ovpn-server[614]: 41.13.XX.YY:40612 [iphone] Peer Connection Initiated with [AF_INET]41.13.XX.YY:40612
Oct 11 09:42:36 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:40612 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Oct 11 09:42:36 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:40612 MULTI: Learn: 10.8.0.2 -> iphone/41.13.XX.YY:40612
Oct 11 09:42:36 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:40612 MULTI: primary virtual IP for iphone/41.13.XX.YY:40612: 10.8.0.2
Oct 11 09:42:36 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:40612 PUSH: Received control message: 'PUSH_REQUEST'
Oct 11 09:42:36 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:40612 SENT CONTROL [iphone]: 'PUSH_REPLY,dhcp-option DNS 192.168.0.103,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Oct 11 09:42:36 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:40612 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Oct 11 09:42:36 raspberrypi ovpn-server[614]: iphone/41.13.XX.YY:40612 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
@orazioedoardo

This comment has been minimized.

Copy link
Contributor

commented Oct 11, 2018

Log seems ok, the link-mtu and mssfix weren’t useful so you can remove them. Have you removed that “hijack dns” rule from your router? Also, while trying to browse via the VPN from your iPhone, do you see DNS queries in the pihole page?

Try to browse by ip, do nslookup github.com on your pi, put the Ip inside the browser and check whether the page loads.

@Fayyaadh

This comment has been minimized.

Copy link
Author

commented Oct 11, 2018

Log seems ok, the link-mtu and mssfix weren’t useful so you can remove them. Have you removed that “hyjack dns” rule from your router? Also, while trying to browse via the VPN from your iPhone, do you see DNS queries in the pihole page?

Try to browse by ip, do nslookup github.com on your pi, put the Ip inside the browser and check whether the page loads.

Ok removed those options.

Disabled the hijack NAT rule, the server is still pushing the pihole IP as the DNS server to the iPhone though.

Tried browsing to github.com and digg.com from iPhone while connected to VPN and they show up in the query log, the client though is the raspberry pi running openvpn.

Screenshot

The site (github.com) doesn't load even if I put it's IP address in the browser but I can ping it's IP address from my phone while connected to the VPN.

@orazioedoardo

This comment has been minimized.

Copy link
Contributor

commented Oct 11, 2018

I’m running out of ideas now, I don’t think the issue is related to DNS at this point if you can ping the address.

In the OpenVPN connect app, go to settings and check whether compression is set to “No”. If it is, then set it to “Full”.
Can you try a different device? Maybe not an iOS device?

@Fayyaadh

This comment has been minimized.

Copy link
Author

commented Oct 11, 2018

That was it!

Setting it "Full" worked! OMG, you're a legend!

Thank you so much.

@orazioedoardo

This comment has been minimized.

Copy link
Contributor

commented Oct 11, 2018

Lol thanks, close the issue if we are done.

@surak

This comment has been minimized.

Copy link

commented Nov 15, 2018

I just had the same issue. However, it says it's insecure. What's with the insecurity here?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
4 participants
You can’t perform that action at this time.