routing works fine, ethernet bridging fails

n0tan4m3

I initially configured openvpn using the routed method, and everything worked as it should (I was successfully able to ssh to the server from the client).

But I want ethernet bridging. So I made the appropriate code changes, and I am unable to get connected.

I have tried both UDP and TCP and neither work (both are enabled on my router). I have validated that they are transversing the router:

Sep 11 10:05:43.862 EST: %SEC-6-IPACCESSLOGP: list inboundfilters permitted udp <my source ip>(20954) -> <my server ip>(1194), 1 packet
Sep 11 10:06:45.886 EST: %SEC-6-IPACCESSLOGP: list inboundfilters permitted udp <my source ip>(16865) -> <my server ip>(1194), 1 packet
Sep 11 10:08:23.122 EST: %SEC-6-IPACCESSLOGP: list inboundfilters permitted tcp <my source ip>(25089) -> <my server ip>(1194), 1 packet
Sep 11 10:08:49.130 EST: %SEC-6-IPACCESSLOGP: list inboundfilters permitted tcp <my source ip>(22156) -> <my server ip>(1194), 1 packet
Sep 11 10:09:15.134 EST: %SEC-6-IPACCESSLOGP: list inboundfilters permitted tcp <my source ip>(7209) -> <my server ip>(1194), 1 packet

I get the "TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)" error when using UDP, and TCP retries when using TCP.

I have correctly configured the bridge-start.sh script, and am running it. I am also adding the appropriate lines to iptables:

iptables -L -v
Chain INPUT (policy ACCEPT 130 packets, 10494 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  tap0   any     anywhere             anywhere            
  694 63103 ACCEPT     all  --  br0    any     anywhere             anywhere            

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  214 47783 ACCEPT     all  --  br0    any     anywhere             anywhere            

Chain OUTPUT (policy ACCEPT 328 packets, 43136 bytes)
 pkts bytes target     prot opt in     out     source               destination


iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -i tap0 -j ACCEPT 
-A INPUT -i br0 -j ACCEPT 
-A FORWARD -i br0 -j ACCEPT

Here are my interfaces after the bridge-start.sh script is run:

ifconfig
br0       Link encap:Ethernet  HWaddr <redacted>
          inet addr:192.168.1.17  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: <redacted>/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1001 errors:0 dropped:0 overruns:0 frame:0
          TX packets:280 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:132459 (129.3 KiB)  TX bytes:40688 (39.7 KiB)

eth0      Link encap:Ethernet  HWaddr <redacted>
          inet6 addr: <redacted>/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:8934 errors:0 dropped:0 overruns:0 frame:0
          TX packets:522 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:969015 (946.3 KiB)  TX bytes:73555 (71.8 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:8 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:560 (560.0 B)  TX bytes:560 (560.0 B)

tap0      Link encap:Ethernet  HWaddr <redacted>
          inet6 addr: <redacted>/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:468 (468.0 B)

I looked for dropped incoming packets on the server machine, none were found. (I reiterate that tun worked when I set it up, tap does not).

Here are my configs:

server:

port 1194
;proto tcp
proto udp
dev tap0
;dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key  # This file should be kept secret
dh /etc/openvpn/keys/dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.1.0 255.255.255.0 192.168.1.200 192.168.1.205
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
cipher AES-128-CBC   # AES
comp-lzo
max-clients 2
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

client:

client
;dev tun
dev tap0
proto udp
;proto tcp
remote <my ip address> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca keys/ca.crt
cert keys/my.crt
key keys/my.key
ns-cert-type server
cipher AES-128-CBC
comp-lzo
verb 3

client log snippet (from UDP attempts):

Tue Sep 11 12:04:12 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Tue Sep 11 12:04:12 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Sep 11 12:04:12 2012 LZO compression initialized
Tue Sep 11 12:04:12 2012 Control Channel MTU parms [ L:1590 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Sep 11 12:04:12 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Sep 11 12:04:12 2012 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Sep 11 12:04:12 2012 Local Options hash (VER=V4): 'b498be7c'
Tue Sep 11 12:04:12 2012 Expected Remote Options hash (VER=V4): '26e19fc0'
Tue Sep 11 12:04:12 2012 UDPv4 link local: [undef]
Tue Sep 11 12:04:12 2012 UDPv4 link remote: <my ip address>:1194
Tue Sep 11 12:05:12 2012 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue Sep 11 12:05:12 2012 TLS Error: TLS handshake failed
Tue Sep 11 12:05:12 2012 TCP/UDP: Closing socket
Tue Sep 11 12:05:12 2012 SIGUSR1[soft,tls-error] received, process restarting
Tue Sep 11 12:05:12 2012 Restart pause, 2 second(s)
Tue Sep 11 12:05:14 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Sep 11 12:05:14 2012 Re-using SSL/TLS context
Tue Sep 11 12:05:14 2012 LZO compression initialized
Tue Sep 11 12:05:14 2012 Control Channel MTU parms [ L:1590 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Sep 11 12:05:14 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Sep 11 12:05:14 2012 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Sep 11 12:05:14 2012 Local Options hash (VER=V4): 'b498be7c'
Tue Sep 11 12:05:14 2012 Expected Remote Options hash (VER=V4): '26e19fc0'
Tue Sep 11 12:05:14 2012 UDPv4 link local: [undef]
Tue Sep 11 12:05:14 2012 UDPv4 link remote: <my ip address>:1194
Tue Sep 11 12:05:27 2012 TCP/UDP: Closing socket
Tue Sep 11 12:05:27 2012 SIGTERM[hard,] received, process exiting

openvpn log from syslog:

Sep 11 12:33:56 deb-vpn kernel: [  277.653944] Bridge firewalling registered
Sep 11 12:33:57 deb-vpn kernel: [  277.767998] device eth0 entered promiscuous mode
Sep 11 12:33:57 deb-vpn kernel: [  277.839108] device tap0 entered promiscuous mode
Sep 11 12:33:57 deb-vpn kernel: [  278.062717] br0: port 2(tap0) entering learning state
Sep 11 12:33:57 deb-vpn kernel: [  278.062907] br0: port 1(eth0) entering learning state
Sep 11 12:34:07 deb-vpn kernel: [  288.152362] br0: no IPv6 routers present
Sep 11 12:34:07 deb-vpn kernel: [  288.196198] tap0: no IPv6 routers present
Sep 11 12:34:12 deb-vpn kernel: [  293.064065] br0: port 2(tap0) entering forwarding state
Sep 11 12:34:12 deb-vpn kernel: [  293.064876] br0: port 1(eth0) entering forwarding state
Sep 11 12:34:20 deb-vpn ovpn-server[1222]: OpenVPN 2.1.3 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Feb 20 2012
Sep 11 12:34:20 deb-vpn ovpn-server[1222]: NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Sep 11 12:34:20 deb-vpn ovpn-server[1222]: NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sep 11 12:34:20 deb-vpn ovpn-server[1222]: Diffie-Hellman initialized with 1024 bit key
Sep 11 12:34:20 deb-vpn ovpn-server[1222]: /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Sep 11 12:34:22 deb-vpn ovpn-server[1222]: TLS-Auth MTU parms [ L:1590 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sep 11 12:34:22 deb-vpn ovpn-server[1222]: Socket Buffers: R=[112640->131072] S=[112640->131072]
Sep 11 12:34:22 deb-vpn ovpn-server[1222]: TUN/TAP device tap0 opened
Sep 11 12:34:22 deb-vpn ovpn-server[1222]: TUN/TAP TX queue length set to 100
Sep 11 12:34:22 deb-vpn ovpn-server[1222]: Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Sep 11 12:34:22 deb-vpn ovpn-server[1224]: GID set to nogroup
Sep 11 12:34:22 deb-vpn ovpn-server[1224]: UID set to nobody
Sep 11 12:34:22 deb-vpn ovpn-server[1224]: UDPv4 link local (bound): [undef]
Sep 11 12:34:22 deb-vpn ovpn-server[1224]: UDPv4 link remote: [undef]
Sep 11 12:34:22 deb-vpn ovpn-server[1224]: MULTI: multi_init called, r=256 v=256
Sep 11 12:34:22 deb-vpn ovpn-server[1224]: IFCONFIG POOL: base=192.168.1.200 size=6
Sep 11 12:34:22 deb-vpn ovpn-server[1224]: IFCONFIG POOL LIST
Sep 11 12:34:22 deb-vpn ovpn-server[1224]: Initialization Sequence Completed
Sep 11 12:35:09 deb-vpn ovpn-server[1224]: MULTI: multi_create_instance called
Sep 11 12:35:09 deb-vpn ovpn-server[1224]: 174.70.24.194:26305 Re-using SSL/TLS context
Sep 11 12:35:09 deb-vpn ovpn-server[1224]: 174.70.24.194:26305 LZO compression initialized
Sep 11 12:35:09 deb-vpn ovpn-server[1224]: 174.70.24.194:26305 Control Channel MTU parms [ L:1590 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sep 11 12:35:09 deb-vpn ovpn-server[1224]: 174.70.24.194:26305 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Sep 11 12:35:09 deb-vpn ovpn-server[1224]: 174.70.24.194:26305 Local Options hash (VER=V4): '26e19fc0'
Sep 11 12:35:09 deb-vpn ovpn-server[1224]: 174.70.24.194:26305 Expected Remote Options hash (VER=V4): 'b498be7c'
Sep 11 12:35:09 deb-vpn ovpn-server[1224]: 174.70.24.194:26305 TLS: Initial packet from [AF_INET]174.70.24.194:26305, sid=2f237ca0 606b7855
Sep 11 12:35:09 deb-vpn ovpn-server[1224]: 174.70.24.194:26305 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:35:11 deb-vpn ovpn-server[1224]: 174.70.24.194:26305 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:35:15 deb-vpn ovpn-server[1224]: 174.70.24.194:26305 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:35:16 deb-vpn ovpn-server[1224]: 174.70.24.194:26305 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:35:23 deb-vpn ovpn-server[1224]: 174.70.24.194:26305 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:35:24 deb-vpn ovpn-server[1224]: 174.70.24.194:26305 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:35:39 deb-vpn ovpn-server[1224]: 174.70.24.194:26305 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:35:40 deb-vpn ovpn-server[1224]: 174.70.24.194:26305 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:36:09 deb-vpn ovpn-server[1224]: 174.70.24.194:26305 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sep 11 12:36:09 deb-vpn ovpn-server[1224]: 174.70.24.194:26305 TLS Error: TLS handshake failed
Sep 11 12:36:09 deb-vpn ovpn-server[1224]: 174.70.24.194:26305 SIGUSR1[soft,tls-error] received, client-instance restarting
Sep 11 12:36:11 deb-vpn ovpn-server[1224]: MULTI: multi_create_instance called
Sep 11 12:36:11 deb-vpn ovpn-server[1224]: 174.70.24.194:20012 Re-using SSL/TLS context
Sep 11 12:36:11 deb-vpn ovpn-server[1224]: 174.70.24.194:20012 LZO compression initialized
Sep 11 12:36:11 deb-vpn ovpn-server[1224]: 174.70.24.194:20012 Control Channel MTU parms [ L:1590 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sep 11 12:36:11 deb-vpn ovpn-server[1224]: 174.70.24.194:20012 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Sep 11 12:36:11 deb-vpn ovpn-server[1224]: 174.70.24.194:20012 Local Options hash (VER=V4): '26e19fc0'
Sep 11 12:36:11 deb-vpn ovpn-server[1224]: 174.70.24.194:20012 Expected Remote Options hash (VER=V4): 'b498be7c'
Sep 11 12:36:11 deb-vpn ovpn-server[1224]: 174.70.24.194:20012 TLS: Initial packet from [AF_INET]174.70.24.194:20012, sid=3d480fac ffb4ca32
Sep 11 12:36:11 deb-vpn ovpn-server[1224]: 174.70.24.194:20012 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:36:13 deb-vpn ovpn-server[1224]: 174.70.24.194:20012 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:36:13 deb-vpn ovpn-server[1224]: 174.70.24.194:20012 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:36:17 deb-vpn ovpn-server[1224]: 174.70.24.194:20012 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:36:18 deb-vpn ovpn-server[1224]: 174.70.24.194:20012 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:36:26 deb-vpn ovpn-server[1224]: 174.70.24.194:20012 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:36:26 deb-vpn ovpn-server[1224]: 174.70.24.194:20012 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:36:42 deb-vpn ovpn-server[1224]: 174.70.24.194:20012 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:36:43 deb-vpn ovpn-server[1224]: 174.70.24.194:20012 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:37:11 deb-vpn ovpn-server[1224]: 174.70.24.194:20012 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sep 11 12:37:11 deb-vpn ovpn-server[1224]: 174.70.24.194:20012 TLS Error: TLS handshake failed
Sep 11 12:37:11 deb-vpn ovpn-server[1224]: 174.70.24.194:20012 SIGUSR1[soft,tls-error] received, client-instance restarting
Sep 11 12:37:14 deb-vpn ovpn-server[1224]: MULTI: multi_create_instance called
Sep 11 12:37:14 deb-vpn ovpn-server[1224]: 174.70.24.194:16895 Re-using SSL/TLS context
Sep 11 12:37:14 deb-vpn ovpn-server[1224]: 174.70.24.194:16895 LZO compression initialized
Sep 11 12:37:14 deb-vpn ovpn-server[1224]: 174.70.24.194:16895 Control Channel MTU parms [ L:1590 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sep 11 12:37:14 deb-vpn ovpn-server[1224]: 174.70.24.194:16895 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Sep 11 12:37:14 deb-vpn ovpn-server[1224]: 174.70.24.194:16895 Local Options hash (VER=V4): '26e19fc0'
Sep 11 12:37:14 deb-vpn ovpn-server[1224]: 174.70.24.194:16895 Expected Remote Options hash (VER=V4): 'b498be7c'
Sep 11 12:37:14 deb-vpn ovpn-server[1224]: 174.70.24.194:16895 TLS: Initial packet from [AF_INET]174.70.24.194:16895, sid=22e4015d be8def06
Sep 11 12:37:14 deb-vpn ovpn-server[1224]: 174.70.24.194:16895 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:37:15 deb-vpn ovpn-server[1224]: 174.70.24.194:16895 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:37:16 deb-vpn ovpn-server[1224]: 174.70.24.194:16895 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:37:20 deb-vpn ovpn-server[1224]: 174.70.24.194:16895 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:37:28 deb-vpn ovpn-server[1224]: 174.70.24.194:16895 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:37:29 deb-vpn ovpn-server[1224]: 174.70.24.194:16895 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:37:44 deb-vpn ovpn-server[1224]: 174.70.24.194:16895 write UDPv4 []: Network is unreachable (code=101)
Sep 11 12:38:14 deb-vpn ovpn-server[1224]: 174.70.24.194:16895 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sep 11 12:38:14 deb-vpn ovpn-server[1224]: 174.70.24.194:16895 TLS Error: TLS handshake failed
Sep 11 12:38:14 deb-vpn ovpn-server[1224]: 174.70.24.194:16895 SIGUSR1[soft,tls-error] received, client-instance restarting

Only thing I can't see is if I'm getting packets back from the server. What is going on, and what can I do?

maikcat

hi there,

server-bridge 192.168.1.0 255.255.255.0 192.168.1.200 192.168.1.205

replace the 192.168.1.0 with your servers lan ip address..

check that ip forwarding is enabled.

Michael.

n0tan4m3

maikcat wrote replace the 192.168.1.0 with your servers lan ip address..

check that ip forwarding is enabled.

Changing the IP address fixed my ability to connect, thanks.

I'm not getting routing through the connection, though, unable to ping through it to devices on the opposite sides. Not sure how to verify ip forwarding on linux.

On my windows client, I am seeing the following in my (culled) routing table:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
192.168.1.0 255.255.255.0 On-link 192.168.1.200 286
192.168.1.0 255.255.255.0 192.168.1.17 192.168.1.200 30
192.168.1.200 255.255.255.255 On-link 192.168.1.200 286
192.168.1.255 255.255.255.255 On-link 192.168.1.200 286
===========================================================================
Persistent Routes:
None

maikcat

to permamently enable ip forwarding look into a file named sysctl.conf inside /etc
edit this:

net.ipv4.ip_forward = 0

to this

net.ipv4.ip_forward = 1

you can check if its enabled by entering this on a cli

cat /proc/sys/net/ipv4/ip_forward

1 means on 0 means off...

Michael.

n0tan4m3

maikcat wroteto permamently enable ip forwarding look into a file named sysctl.conf inside /etc

Done, verified, and sysctl reloaded to make it effective.

still not able to get a ping across the pipe. Wondering if its a routing issue on the server side, but no time to check it now.

n0tan4m3

n0tan4m3 wrotestill not able to get a ping across the pipe. Wondering if its a routing issue on the server side, but no time to check it now.

I actually think this may be a routing issue on the client side. In my ping attempts across the pipe, I am getting destination unreachable from the IP address given to the tap adapter (in this case, 192.168.1.200):

>ping 192.168.1.5 -n 10

Pinging 192.168.1.5 with 32 bytes of data:
Reply from 192.168.1.200: Destination host unreachable.
Reply from 192.168.1.200: Destination host unreachable.
(truncated)
Reply from 192.168.1.200: Destination host unreachable.
Reply from 192.168.1.200: Destination host unreachable.

Ping statistics for 192.168.1.5:
    Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),

My clients routing table contains the following (where 192.168.1.17 is my servers IP):

      192.168.1.0    255.255.255.0         On-link     192.168.1.200    286
      192.168.1.0    255.255.255.0     192.168.1.17    192.168.1.200     30
    192.168.1.200  255.255.255.255         On-link     192.168.1.200    286
    192.168.1.255  255.255.255.255         On-link     192.168.1.200    286

and the server.conf file contains the following:

server-bridge 192.168.1.17 255.255.255.0 192.168.1.200 192.168.1.205
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"

Am I still missing some settings?

janjust

the server seems to be a Linux/Unix-ish box ; try running tcpdump on the server when doing the ping from the client side - do the packets arrive? what is returned?
also, is the server a virtual machine? bridging+vms can be tricky, depending on the virtualization software used.

n0tan4m3

janjust wrotethe server seems to be a Linux/Unix-ish box ; try running tcpdump on the server when doing the ping from the client side - do the packets arrive? what is returned?
also, is the server a virtual machine? bridging+vms can be tricky, depending on the virtualization software used.

My apologies, I thought I added that info: tcpdump shows no packets being received from the client over any of the interfaces. And yes, the server is a VM, virtualbox variety.

janjust

there's a chance you're being hit by this: http://forums.openvpn.net/topic8910.html