OpenVPN Clients don't get IP via DHCP Server

Bam

Hi,

my problem is that the vpn-client don't get any IP from the DHCP Server (Win2003) which is in the same LAN like the openvpn Server with the current config. The openvpn Server itself gets a correct IP from the DHCP Server.

What can I do, the connectet VPN Clients get an IP directly from the DHCP Server and not from the openvpn Server ?

Please Help.

Thanks

****************************************************************
/etc/network/interfaces

auto lo
iface lo inet loopback

auto br0
iface br0 inet dhcp

*****************************************************************************
Server Config

local 10.34.0.195
port 1194
proto udp
dev tap0
script-security 3 system
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/ovpn-asg-server.crt
key /etc/openvpn/easy-rsa/2.0/keys/ovpn-asg-server.key # This file should be kept secret
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
mode server
tls-server
push "route 192.168.0.0 255.255.0.0"
push "route 172.16.0.0 255.240.0.0"
push "route 10.0.0.0 255.0.0.0"
push "dhcp-option DNS 10.34.0.30"
push "dhcp-option DNS 10.33.0.30"
push "ip-win32 dynamic 0 3600"
client-config-dir /etc/openvpn/ovpn-asg_ccd
keepalive 10 120
tls-auth ta.key 0 # This file is secret
cipher AES-128-CBC # AES
comp-lzo
max-clients 200
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/ovpn-asg-client.log
log-append /var/log/openvpn/ovpn-asg.log
verb 4
mute 20

***********************************************************************
Client Config

client
dev tap
proto udp
remote x.x.x.x 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert clients.crt
key clients.key
ns-cert-type server
tls-auth ta.key 1
cipher AES-128-CBC
comp-lzo
verb 3

maikcat

hi there,

for bridging to work remove this:

mode server

and add this

server-bridge

also you dont need to push dns info to your clients assuming your dhcp does that..

also to prevent your dhcp altering your default gateway add this:

push "route 0.0.0.0 255.255.255.255 net_gateway"

also what your ccd directory file contents are?

Michael.

Bam

Hi maikcat,

the server was actually set with TUN and I'm trying to configure it with TAP/Brdiging, now. I think the ccd file was important for the TUN, but it's empty now.
I've modified the server.conf like you've described, but the Client got stilll a APIPA Address and no IP from the DHCP server :-(

The modified Server.conf:

local 10.34.0.195
port 1194
proto udp
dev tap0
script-security 3 system
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/ovpn-asg-server.crt
key /etc/openvpn/easy-rsa/2.0/keys/ovpn-asg-server.key # This file should be kept secret
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
server-bridge
tls-server
push "route 0.0.0.0 255.255.255.255 10.34.0.1"
push "ip-win32 dynamic 0 3600"
client-config-dir /etc/openvpn/ovpn-asg_ccd
keepalive 10 120
tls-auth ta.key 0 # This file is secret
cipher AES-128-CBC # AES
comp-lzo
max-clients 200
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/ovpn-asg-client.log
log-append /var/log/openvpn/ovpn-asg.log
verb 4
mute 20

The Client.conf:

client
dev tap
proto udp
remote x.x.x.x 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert clients.crt
key clients.key
ns-cert-type server
tls-auth ta.key 1
cipher AES-128-CBC
comp-lzo
verb 3

That's what I could see in the Client.log:

Sat Jan 12 20:25:55 2013 PUSH: Received control message: 'PUSH_REPLY,route 0.0.0.0 255.255.255.255 10.34.0.1,ip-win32 dynamic 0 3600,route-gateway dhcp,ping 10,ping-restart 120'
Sat Jan 12 20:25:55 2013 OPTIONS IMPORT: timers and/or timeouts modified
Sat Jan 12 20:25:55 2013 OPTIONS IMPORT: route options modified
Sat Jan 12 20:25:55 2013 OPTIONS IMPORT: route-related options modified
Sat Jan 12 20:25:55 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sat Jan 12 20:25:55 2013 ROUTE default_gateway=192.168.0.1
Sat Jan 12 20:25:55 2013 TAP-WIN32 device [LAN-Verbindung 4] opened: \\.\Global\{424DEBCB-C340-4476-8D97-F4090C768840}.tap
Sat Jan 12 20:25:55 2013 TAP-Win32 Driver Version 9.9 
Sat Jan 12 20:25:55 2013 TAP-Win32 MTU=1500
Sat Jan 12 20:25:55 2013 Successful ARP Flush on interface [44] {424DEBCB-C340-4476-8D97-F4090C768840}
Sat Jan 12 20:26:00 2013 TEST ROUTES: 0/1 succeeded len=1 ret=0 a=0 u/d=up
Sat Jan 12 20:26:00 2013 Route: Waiting for TUN/TAP interface to come up...
Sat Jan 12 20:26:05 2013 TEST ROUTES: 0/1 succeeded len=1 ret=0 a=0 u/d=up
Sat Jan 12 20:26:05 2013 Route: Waiting for TUN/TAP interface to come up...
.
.
.

at Jan 12 20:26:30 2013 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 255.255.255.255 10.34.0.1
Sat Jan 12 20:26:30 2013 Warning: route gateway is not reachable on any active network adapters: 10.34.0.1
Sat Jan 12 20:26:30 2013 Route addition via IPAPI failed [adaptive]
Sat Jan 12 20:26:30 2013 Route addition fallback to route.exe
.
.
SYSTEM ADAPTER LIST
TAP-Win32 Adapter V9
  Index = 44
  GUID = {424DEBCB-C340-4476-8D97-F4090C768840}
  IP = 169.254.25.14/255.255.0.0 
  MAC = 00:ff:42:4d:eb:cb
  GATEWAY = 0.0.0.0/255.255.255.255 
  DHCP SERV = 0.0.0.0/255.255.255.255 
  DHCP LEASE OBTAINED = Sat Jan 12 20:26:30 2013
  DHCP LEASE EXPIRES  = Mon Oct 12 00:15:24 1970
  DNS SERV =

The default Gateway on the openVPN Server is set to 10.34.0.1 and I can ping it from ther openVPN Server.

There is another problem with the up.sh. I'm not sure if that is causing the problem. If I activate the last line ( #/usr/sbin/brctl addif $BR $DEV) then nothing works. I go the message on ther server.log :"Can't find /usr/sbin/brctl.."
It's deactivated at the moment.

up.sh

#!/bin/sh

BR=$1
DEV=$2
MTU=$3
/sbin/ifconfig $DEV mtu $MTU promisc up
#/usr/sbin/brctl addif $BR $DEV

Many Thanks.

Bam

maikcat

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

Bam

Hi maikcat,

sorry, I thought I've to put the Gatway here :roll:
It's updated now.

push "route 0.0.0.0 255.255.255.255 net_gateway"

The bridge-utils are already installed:

root@ovpn-asg:/etc/openvpn# find / -name brctl
/sbin/brctl
/usr/sbin/brctl
/etc/bash_completion.d/brctl

root@ovpn-asg:/etc/openvpn# brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.0050569808e6       no              eth0

root@ovpn-asg:/etc/openvpn# ifconfig
br0       Link encap:Ethernet  HWaddr 00:50:56:98:08:e6
          inet addr:10.34.0.195  Bcast:10.34.0.255  Mask:255.255.255.0
          inet6 addr: fe80::250:56ff:fe98:8e6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:147616 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12251 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:13739089 (13.7 MB)  TX bytes:1343241 (1.3 MB)

eth0      Link encap:Ethernet  HWaddr 00:50:56:98:08:e6
          inet6 addr: fe80::250:56ff:fe98:8e6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:173161 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12841 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:18184002 (18.1 MB)  TX bytes:1370589 (1.3 MB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:40 errors:0 dropped:0 overruns:0 frame:0
          TX packets:40 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:5568 (5.5 KB)  TX bytes:5568 (5.5 KB)

tap0      Link encap:Ethernet  HWaddr 8a:79:74:31:16:4d
          inet6 addr: fe80::8879:74ff:fe31:164d/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:174 errors:0 dropped:0 overruns:0 frame:0
          TX packets:9 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:27575 (27.5 KB)  TX bytes:726 (726.0 B)

Client.log now:

.
.
.
Sun Jan 13 14:47:17 2013 PUSH: Received control message: 'PUSH_REPLY,route 0.0.0.0 255.255.255.255 net_gateway,ip-win32 dynamic 0 3600,route-gateway dhcp,ping 10,ping-restart 120'
Sun Jan 13 14:47:17 2013 OPTIONS IMPORT: timers and/or timeouts modified
Sun Jan 13 14:47:17 2013 OPTIONS IMPORT: route options modified
Sun Jan 13 14:47:17 2013 OPTIONS IMPORT: route-related options modified
Sun Jan 13 14:47:17 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Jan 13 14:47:17 2013 ROUTE default_gateway=192.168.0.1
Sun Jan 13 14:47:17 2013 TAP-WIN32 device [LAN-Verbindung 4] opened: \\.\Global\{424DEBCB-C340-4476-8D97-F4090C768840}.tap
Sun Jan 13 14:47:17 2013 TAP-Win32 Driver Version 9.9 
Sun Jan 13 14:47:17 2013 TAP-Win32 MTU=1500
Sun Jan 13 14:47:17 2013 Successful ARP Flush on interface [44] {424DEBCB-C340-4476-8D97-F4090C768840}
Sun Jan 13 14:47:22 2013 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Sun Jan 13 14:47:22 2013 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 255.255.255.255 192.168.0.1
Sun Jan 13 14:47:22 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Sun Jan 13 14:47:22 2013 Route addition via IPAPI succeeded [adaptive]
Sun Jan 13 14:47:22 2013 Initialization Sequence Completed

Thanks
Bam

maikcat

you need to set eth0 in promisc mode & enable ip forwarding on server...

Michael.

Bam

Hi maikcat,

ip-forwarding was usually already setup, but I think not for permanent, so I've done following:

sysctl.conf

net/ipv4/ip_forward=1

net/ipv4/conf/all/accept_redirects=0
net/ipv4/conf/default/accept_redirects=0
net/ipv6/conf/all/accept_redirects=0
net/ipv6/conf/default/accept_redirects=0

net/ipv4/icmp_echo_ignore_broadcasts=1
net/ipv4/icmp_ignore_bogus_error_responses=1
net/ipv4/icmp_echo_ignore_all=0


net/ipv4/conf/all/log_martians=0
net/ipv4/conf/default/log_martians=0

cat /proc/sys/net/ipv4/ip_forward
1

And setuped promisc mode for eth0:

root@ovpn-asg:/etc/openvpn# ifconfig
br0       Link encap:Ethernet  HWaddr 00:50:56:98:08:e6
          inet addr:10.34.0.195  Bcast:10.34.0.255  Mask:255.255.255.0
          inet6 addr: fe80::250:56ff:fe98:8e6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:21743 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4248 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:1860002 (1.8 MB)  TX bytes:564048 (564.0 KB)

eth0      Link encap:Ethernet  HWaddr 00:50:56:98:08:e6
          inet6 addr: fe80::250:56ff:fe98:8e6/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:24927 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4327 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2463976 (2.4 MB)  TX bytes:567874 (567.8 KB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:28 errors:0 dropped:0 overruns:0 frame:0
          TX packets:28 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:3584 (3.5 KB)  TX bytes:3584 (3.5 KB)

tap0      Link encap:Ethernet  HWaddr c2:88:54:86:c8:51
          inet6 addr: fe80::c088:54ff:fe86:c851/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:123 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:22709 (22.7 KB)  TX bytes:468 (468.0 B)

But still no IP for the Client :-(

Client.log

Sun Jan 13 22:02:15 2013 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Sun Jan 13 22:02:15 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sun Jan 13 22:02:15 2013 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Sun Jan 13 22:02:15 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jan 13 22:02:15 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jan 13 22:02:15 2013 LZO compression initialized
Sun Jan 13 22:02:15 2013 Control Channel MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:0 ]
Sun Jan 13 22:02:15 2013 Socket Buffers: R=[8192->8192] S=[64512->64512]
Sun Jan 13 22:02:15 2013 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Sun Jan 13 22:02:15 2013 Local Options hash (VER=V4): 'a7133b47'
Sun Jan 13 22:02:15 2013 Expected Remote Options hash (VER=V4): 'c5677ab3'
Sun Jan 13 22:02:15 2013 UDPv4 link local: [undef]
Sun Jan 13 22:02:15 2013 UDPv4 link remote: x.x.x.x:1194
Sun Jan 13 22:02:15 2013 TLS: Initial packet from  x.x.x.x:1194, sid=e85fd14e 451669fc
Sun Jan 13 22:02:16 2013 VERIFY OK: depth=1,  x.x.x.x
Sun Jan 13 22:02:16 2013 VERIFY OK: nsCertType=SERVER
Sun Jan 13 22:02:16 2013 VERIFY OK: depth=0, x.x.x.x
Sun Jan 13 22:02:17 2013 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Jan 13 22:02:17 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jan 13 22:02:17 2013 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Jan 13 22:02:17 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jan 13 22:02:17 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Jan 13 22:02:17 2013 [ovpn-asg-server] Peer Connection Initiated with  x.x.x.x:1194
Sun Jan 13 22:02:19 2013 SENT CONTROL [ovpn-asg-server]: 'PUSH_REQUEST' (status=1)
Sun Jan 13 22:02:19 2013 PUSH: Received control message: 'PUSH_REPLY,route 0.0.0.0 255.255.255.255 net_gateway,ip-win32 dynamic 0 3600,route-gateway dhcp,ping 10,ping-restart 120'
Sun Jan 13 22:02:19 2013 OPTIONS IMPORT: timers and/or timeouts modified
Sun Jan 13 22:02:19 2013 OPTIONS IMPORT: route options modified
Sun Jan 13 22:02:19 2013 OPTIONS IMPORT: route-related options modified
Sun Jan 13 22:02:19 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Jan 13 22:02:19 2013 ROUTE default_gateway=192.168.0.1
Sun Jan 13 22:02:19 2013 TAP-WIN32 device [LAN-Verbindung 4] opened: \\.\Global\{424DEBCB-C340-4476-8D97-F4090C768840}.tap
Sun Jan 13 22:02:19 2013 TAP-Win32 Driver Version 9.9 
Sun Jan 13 22:02:19 2013 TAP-Win32 MTU=1500
Sun Jan 13 22:02:19 2013 Successful ARP Flush on interface [44] {424DEBCB-C340-4476-8D97-F4090C768840}
Sun Jan 13 22:02:24 2013 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Sun Jan 13 22:02:24 2013 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 255.255.255.255 192.168.0.1
Sun Jan 13 22:02:24 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Sun Jan 13 22:02:24 2013 Route addition via IPAPI succeeded [adaptive]
Sun Jan 13 22:02:24 2013 Initialization Sequence Completed

Server.conf

.
.
.
Sun Jan 13 22:01:58 2013 us=104669 MULTI: new connection by client 'x.x.x.x' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Sun Jan 13 22:01:58 2013 us=104737 MULTI: no dynamic or static remote --ifconfig address is available for x.x.x.x
Sun Jan 13 22:02:00 2013 us=165092 x.x.x.x PUSH: Received control message: 'PUSH_REQUEST'
Sun Jan 13 22:02:00 2013 us=165149 x.x.x.x send_push_reply(): safe_cap=960
Sun Jan 13 22:02:00 2013 us=165194 x.x.x.x SENT CONTROL [x.x.x.x]: 'PUSH_REPLY,route 0.0.0.0 255.255.255.255 net_gateway,ip-win32 dynamic 0 3600,route-gateway dhcp,ping 10,ping-restart 120' (status=1)
Sun Jan 13 22:02:00 2013 us=264861 x.x.x.xMULTI: Learn: 00:ff:42:4d:eb:cb -> x.x.x.x

Any ideas ?

Thanks
Bam

maikcat

only 2 things i can suggest...

1) setup your config using the openvpn server itself giving out ips
so you can test bridging works,then switch over to internal dhcp server

2) run wireshark on dhcp server and monitor packets to see if your dhcp recieves
requests from clients...

Michael.

DarwinDuck

Hi,

Did you ever get this to work. I am trying with this but no success.

local 192.168.1.3
mode server
tls-server
tls-remote "openvpn.thehode.lan"
dev tap0
proto udp
port 1195
management localhost 5003
# server-bridge 192.168.1.3 255.255.255.0 192.168.1.245 192.168.1.254
push "route-gateway 192.168.1.1"
# ifconfig-pool-persist /etc/openvpn/ipp-bridged.txt
client-config-dir /etc/openvpn/ccd-bridged
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
cipher AES-128-CBC
comp-lzo
max-clients 10
keepalive 10 120
verb 3
script-security 2
log /etc/openvpn/log/log-OpenvpnBridged0.log
status /etc/openvpn/log/status-OpenvpnBridged0.log
ca /etc/openvpn/rootca-subscriptions.crt
cert /etc/openvpn/openvpn.crt
key /etc/openvpn/openvpn.key
dh /etc/openvpn/fshome-openvpn-dh.key
tls-auth /etc/openvpn/openvpn-ta.key 0
push "redirect-gateway def1"
# push "dhcp-option DOMAIN thehode.lan"
# push "dhcp-option DNS 192.168.1.1"
push "explicit-exit-notify 3"
client-to-client

DarwinDuck

I've had limited success now...but have to perform some actions normally. After conneting with the client there is no tap0 interface present

I have to manually run
ifconfig tap0 up
dhclient tap0

Is there a way to automate this in the file.

I also added server-bridge to the server side of the file.

DarwinDuck

Errors on the client side...

...
...
...
Thu Jun 20 11:10:21 2013 TUN/TAP device tap0 opened
Thu Jun 20 11:10:21 2013 TUN/TAP TX queue length set to 100
Thu Jun 20 11:10:21 2013 /etc/openvpn/update-resolv-conf tap0 1500 1590   init
Thu Jun 20 11:10:21 2013 /sbin/route add -net xxx.xxx.xxx.xxx netmask 255.255.255.255 gw 172.25.26.254
Thu Jun 20 11:10:21 2013 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 192.168.1.1
SIOCADDRT: No such process
Thu Jun 20 11:10:21 2013 ERROR: Linux route add command failed: external program exited with error status: 7
Thu Jun 20 11:10:21 2013 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 192.168.1.1
SIOCADDRT: No such process
Thu Jun 20 11:10:21 2013 ERROR: Linux route add command failed: external program exited with error status: 7
Thu Jun 20 11:10:21 2013 Initialization Sequence Completed

DarwinDuck

Jus some additional info...

SERVER

#=====================================
# Server Settings
#=====================================
local 192.168.1.3
dev tap0
proto udp
;proto tcp
port 1195
mode server
tls-server
tls-remote "openvpn.klingon.lan"
persist-key
persist-tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
max-clients 10
push "explicit-exit-notify 3"

#=====================================
# Network & DHCP Settings
#=====================================
;server-bridge 192.168.1.1 255.255.255.0 192.168.1.245 192.168.1.254
server-bridge
push "route-gateway 192.168.1.1"
;push "redirect-gateway def1 bypass-dhcp"
push "redirect-gateway def1"
;push "dhcp-option DOMAIN klingon.lan"
;push "dhcp-option DNS 192.168.1.1"
client-config-dir /etc/openvpn/ccd-bridged
;ifconfig-pool-persist /etc/openvpn/ipp-bridged.txt
client-to-client

#=====================================
# Certificates & Encryption Settings
#=====================================
ca /etc/openvpn/klingon-rootca-subscriptions.crt
cert /etc/openvpn/klingon-openvpn.crt
key /etc/openvpn/klingon-openvpn.key
dh /etc/openvpn/klingon-openvpn-dh.key
tls-auth /etc/openvpn/klingon-openvpn-ta.key 0
cipher AES-128-CBC
comp-lzo

#=====================================
# Management, Logs & Security Settings
#=====================================
management localhost 5003 /etc/openvpn/passwd.key
log /etc/openvpn/log/log-klingonOpenvpnBridged0.log
status /etc/openvpn/log/status-klingonOpenvpnBridged0.log
keepalive 10 120
verb 3
mute 20
script-security 2
;user nobody
;group nogroup
;client-connect /etc/openvpn/scripts/client-connect.sh
;client-disconnect /etc/openvpn/scripts/client-disconnect.sh

CLIENT

#=====================================
# Client Settings
#=====================================
remote xxx.xxx.xxx.xxx 995
dev tap
proto udp
;proto tcp
client
ns-cert-type server
persist-key
persist-tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450 
resolv-retry infinite
nobind
;float

#=====================================
# Certificates & Encryption Settings
#=====================================
ca /etc/openvpn/conf/klingonOpenvpn-ca.crt
cert /etc/openvpn/conf/klingonOpenvpn-client1.crt
key /etc/openvpn/conf/klingonOpenvpn-client1.key
tls-auth /etc/openvpn/conf/klingonOpenvpn-ta.key 1
cipher AES-128-CBC
comp-lzo

#=====================================
# Management, Logs & Security Settings
#=====================================
keepalive 10 60
verb 3
mute 20
script-security 2 system
up-delay
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf
;user nobody
;group nogroup

ERROR

...
...
...
Fri Jun 21 11:09:14 2013 TUN/TAP device tap0 opened
Fri Jun 21 11:09:14 2013 TUN/TAP TX queue length set to 100
Fri Jun 21 11:09:14 2013 /etc/openvpn/update-resolv-conf tap0 1500 1590   init
Fri Jun 21 11:09:14 2013 /sbin/route add -net xxx.xxx.xxx.xxx netmask 255.255.255.255 gw 172.25.26.254
Fri Jun 21 11:09:14 2013 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 172.25.25.1
SIOCADDRT: No such process
Fri Jun 21 11:09:14 2013 ERROR: Linux route add command failed: external program exited with error status: 7
Fri Jun 21 11:09:14 2013 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 172.25.25.1
SIOCADDRT: No such process
Fri Jun 21 11:09:14 2013 ERROR: Linux route add command failed: external program exited with error status: 7
Fri Jun 21 11:09:14 2013 Initialization Sequence Completed

If I introduce dhclient into the config files then the dhcp request times out. It only works if I perform the action after the openvpn client ha said initialization sequence complete.