No WAN / LAN connectivity?

FuzzyLogic

Hi all -

I have configured an OpenVPN client and server & the connection appears to work but I have some connectivity problems.. I have the following setup:

Internet Gateway is Virgin superhub. This provides IP addresses to the LAN in the range 192.168.36.x (port forwarding enabled to 1194) gateway (superhub) local address is 192.168.36.1
WRT54G router configured in wireless bridge mode & running DD-WRT firmware (VPN server) local address 192.168.36.2
Ipconfig on the LAN shows the DNS servers to be 192.168.4.100 and 192.168.8.100

Attempted goal: to create openVPN connection to the WRT54G router in order to establish an internet connection for ALL client traffic through the OpenVPN server.

Current situation: I can establish a connection between the client and server but unable to ping anything on the LAN / open any web pages (local or internet) or open either router gui page from the VPN client when connected

Client:
Windows 7 64 bit machine running openvpn software. client config file:
client
dev tun0
proto tcp
remote xx.xx.xx.xx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
float
tun-mtu 1500
tun-mtu-extra 32
#mssfix 1450
keepalive 10 60
#explicit-exit-notify 3
ca ca.crt
cert client1.crt
key client1.key
cipher AES-128-CBC
comp-lzo
verb 4
redirect-gateway def1
dhcp-option DNS 192.168.36.1
;ns-cert-type server

OpenVPN Server config file:
dev tun0
proto tcp
port 1194
management localhost 5001
server 192.168.66.0 255.255.255.0
push "route 192.168.36.1 255.255.255.0"
client-to-client
cipher AES-128-CBC
comp-lzo
max-clients 10
keepalive 10 60
verb 5
ca /tmp/openvpn/ca.crt
dh /tmp/openvpn/dh.pem
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem

I have the SPI firewall on the server disabled, however I do have the following rules set (there is probably a lot of unnecessary rules at this stage?):
iptables -I INPUT 1 -p tcp --dport 1194 -j ACCEPT
iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
iptables -I INPUT 1 -p tcp --dport 443 -j ACCEPT
iptables -I INPUT 1 -p udp --dport 443 -j ACCEPT
iptables -I INPUT 3 -i tun0 -j ACCEPT
iptables -I FORWARD 3 -i tun0 -o tun0 -j ACCEPT
iptables -I FORWARD 1 --source 192.168.0.66/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT

The current routing table on the WRT54 shows:
Destination LAN NET Subnet Mask Gateway Interface
192.168.36.0 255.255.255.0 0.0.0.0 LAN & WLAN
169.254.0.0 255.255.0.0 0.0.0.0 LAN & WLAN
0.0.0.0 0.0.0.0 192.168.36.1 LAN & WLAN

Please help, this is driving me nuts!!

Thanks in advance..

maikcat

hi there,

change this:

push "route 192.168.36.1 255.255.255.0"

to this:

push "route 192.168.36.0 255.255.255.0"

also ,

are you running openvpn client on win 7 with admin rights?
did you enabled ip forwarding on openvpn server?
when testing,choose one of your pcs (openvpn server side) and add
a static route to if for openvpn subnet pointing to your openvpn's lan ip .
configure firewalls accordingly.

Michael.

FuzzyLogic

Hi Micheal -

Thank you. I made the change to the 'push' command and it appears that I can now ping both 192.168.36.1 and 192.168.36.2. I can also open 192.168.36.2 (DD-WRT router GUI) whilst connected to the vpn which is definitely an improvement.

EDIT to add that although I can open the DD_WRT gui now, I cannot open the gateway (superhub) gui

Still no connection with the outside world via the vpn though.

I am running the client with admin rights.
not sure how to enable ip forwarding on the server... or whether it is set up currently (any ideas before I hit google!?)
Firewall on the server is turned off currently (for testing) so do I need to set the configs at the moment?

Also - I have seen several comments about using something along the lines of: iptables -t nat -I POSTROUTING -s 192.168.66.0/24 -o eth0 -j MASQUERADE (not sure if the sytax is correct) which I don't currently have set up anywhere. Is this required?

Thanks again
Steve

maikcat

EDIT to add that although I can open the DD_WRT gui now, I cannot open the gateway (superhub) gui

add a static route to superhub for the openvpn subnet

Also - I have seen several comments about using something along the lines of: iptables -t nat -I POSTROUTING -s 192.168.66.0/24 -o eth0 -j MASQUERADE (not sure if the sytax is correct) which I don't currently have set up anywhere. Is this required?

add to your server config:

push "redirect-gateway def1"

the iptables command is:

iptables -t nat -A POSTROUTING -s 192.168.66.0/24 -o eth0 -j MASQUERADE

if you issue iptables -L -t nat -v

on your wrt router ,can you post the output?

with the last iptables all traffic from vpn would seem it comes from wrt itself...

Michael.

FuzzyLogic

Here is the output of the iptables command from the router:

root@Roam Repeater Bridge:~# iptables -L -t nat -v
Chain PREROUTING (policy ACCEPT 119 packets, 8744 bytes)
pkts bytes target prot opt in out source destination
0 0 DNAT tcp -- any any anywhere 0.0.0.0 tcp dpt:9560 to:192.168.36.2:80
0 0 DNAT icmp -- any any anywhere 0.0.0.0 to:192.168.36.2

Chain POSTROUTING (policy ACCEPT 2 packets, 424 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE 0 -- any eth0 192.168.66.0/24 anywhere

Chain OUTPUT (policy ACCEPT 2 packets, 424 bytes)
pkts bytes target prot opt in out source destination

I have added the 'redirect gateway' push and will retry.
The superhub does not allow static routes to be added to it - will this be a problem?

I have noticed that when I try to open web pages to the outside world, they fail to open because the DNS lookup fails

Thanks

Steve

maikcat

I have added the 'redirect gateway' push and will retry.
The superhub does not allow static routes to be added to it - will this be a problem?

if you NATing traffic no...

I have noticed that when I try to open web pages to the outside world, they fail to open because the DNS lookup fails

then push valid dns servers to your clients.. 😉

Michael.

FuzzyLogic

maikcat wrote
I have added the 'redirect gateway' push and will retry.
The superhub does not allow static routes to be added to it - will this be a problem?
if you NATing traffic no...

I am now in a different location and have tried again. Unfortunately I still cannot access the outside via the vpn. Im still not sure that I have the correct POSTROUTING in place - any ideas?

maikcat wrote
I have noticed that when I try to open web pages to the outside world, they fail to open because the DNS lookup fails
then push valid dns servers to your clients.. 😉

Michael.

DNS is assigned by the superhub and it appears that it assigns 192.168.4.100 and 8.100. I have changed the client config file to include:
dhcp-option DNS 192.168.4.100 but it makes no difference. Do I need to include any further push commands on the server config file?

Also - In my current location I have tried to ping the 192.168.32.2 address as above and it is now no longer returning a ping so I am getting a little lost now.

Did the IP tables show you anything? I have no idea how to read them properly!

Thanks

Steve

maikcat

for testing flush ALL rules and add only the one needed for NAT

Michael.

FuzzyLogic

Thanks Michael.

I have spent the last several hours getting up to speed with the basics of iptables and have realised that a lot of my rules do not actually make sense as they stand (I have copied / pasted from various other setups online without really understanding how they work). For example :

- The inputs / forwards are chain numbered incorrectly and are therefore probably being overwritten rather than appended to the chain (hence your hint on the -A)
- There is currently an error on my iptables to forward the tunnel subnet (-I FORWARD 1 --source 192.168.0.66/24 -j ACCEPT) command (the 0.66 should be 66.0)
- I don't think that br0 exists in my configuration (since I am using routed not bridged) and probably should be eth0 instead.

As I am still away at the moment and cannot access my router from where I am, I cannot make changes and troubleshoot currently but I appreciate your help so far. Thank you.

Steve

FuzzyLogic

Ok, so I had a chance to make some changes this morning and I can now ping the DD-WRT (which is hosting the vpn server) and the gateway superhub router through my VPN tunnel.

I used the following firewall commands:
iptables -I INPUT 1 -p tcp --dport 1194 -j ACCEPT
iptables -A INPUT -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -i tun0 -j ACCEPT
iptables -A INPUT -i eth0 -j ACCEPT
iptables -A FORWARD -j ACCEPT

So the only thing I cannot do now is reach the outside world.

If I run IPCONFIG /all on the openvpn client, I get the following:
Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TAP-Windows Adapter V9
Physical Address. . . . . . . . . : 00-FF-27xxxxxx
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::e0c3:9c9f:fc2:202c%13(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.66.6(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.252
Lease Obtained. . . . . . . . . . : 04 March 2013 14:37:02
Lease Expires . . . . . . . . . . : 04 March 2014 14:37:02
Default Gateway . . . . . . . . . :
DHCP Server . . . . . . . . . . . : 192.168.66.5
DHCPv6 IAID . . . . . . . . . . . : 234946343
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-87-4F-07-A4-17-31-39-72-3D
DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1
NetBIOS over Tcpip. . . . . . . . : Enabled

I have tried putting a push DHCP-option command in the server config file & have tried various DNS addresses, it just prevents the client from pinging the routers..

It feels like this is very close now, so any ideas please!

Thanks

maikcat

please also post the output of netstat -nr
on your client before and after he connects..

Michael.

FuzzyLogic

before connection:

C:\Users\Steve>netstat -nr
===========================================================================
Interface List
13...00 ff 27 da a3 3a ......TAP-Windows Adapter V9
11...a4 17 31 39 72 3d ......Killer Wireless-N 1202 (2.4GHz and 5GHz)
1...........................Software Loopback Interface 1
14...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
12...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
15...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.36.1 192.168.36.6 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.36.0 255.255.255.0 On-link 192.168.36.6 281
192.168.36.6 255.255.255.255 On-link 192.168.36.6 281
192.168.36.255 255.255.255.255 On-link 192.168.36.6 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.36.6 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.36.6 281
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
12 58 ::/0 On-link
1 306 ::1/128 On-link
12 58 2001::/32 On-link
12 306 2001:0:5ef5:79fb:34a6:1a1f:3f57:dbf9/128
On-link
11 281 fe80::/64 On-link
12 306 fe80::/64 On-link
12 306 fe80::34a6:1a1f:3f57:dbf9/128
On-link
11 281 fe80::cd6c:3ec:cc5e:4221/128
On-link
1 306 ff00::/8 On-link
12 306 ff00::/8 On-link
11 281 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

after connection:

C:\Users\Steve>netstat -nr
===========================================================================
Interface List
13...00 ff 27 da a3 3a ......TAP-Windows Adapter V9
11...a4 17 31 39 72 3d ......Killer Wireless-N 1202 (2.4GHz and 5GHz)
1...........................Software Loopback Interface 1
14...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
12...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
15...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.3 25
0.0.0.0 128.0.0.0 192.168.66.5 192.168.66.6 30
80.3.xx.xx 255.255.255.255 192.168.0.1 192.168.0.3 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
128.0.0.0 128.0.0.0 192.168.66.5 192.168.66.6 30
192.168.0.0 255.255.255.0 On-link 192.168.0.3 281
192.168.0.3 255.255.255.255 On-link 192.168.0.3 281
192.168.0.255 255.255.255.255 On-link 192.168.0.3 281
192.168.36.0 255.255.255.0 192.168.66.5 192.168.66.6 30
192.168.66.0 255.255.255.0 192.168.66.5 192.168.66.6 30
192.168.66.4 255.255.255.252 On-link 192.168.66.6 286
192.168.66.6 255.255.255.255 On-link 192.168.66.6 286
192.168.66.7 255.255.255.255 On-link 192.168.66.6 286
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.66.6 286
224.0.0.0 240.0.0.0 On-link 192.168.0.3 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.66.6 286
255.255.255.255 255.255.255.255 On-link 192.168.0.3 281
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
13 286 fe80::/64 On-link
11 281 fe80::/64 On-link
11 281 fe80::cd6c:3ec:cc5e:4221/128
On-link
13 286 fe80::e0c3:9c9f:fc2:202c/128
On-link
1 306 ff00::/8 On-link
13 286 ff00::/8 On-link
11 281 ff00::/8 On-link
===========================================================================
Persistent Routes:
none

maikcat

hi there,

I used the following firewall commands:
iptables -I INPUT 1 -p tcp --dport 1194 -j ACCEPT
iptables -A INPUT -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -i tun0 -j ACCEPT
iptables -A INPUT -i eth0 -j ACCEPT
iptables -A FORWARD -j ACCEPT

your clients routing table is ok...

are these the ONLY iptables used?
if yes you are missing the masquerade rule...

Michael.

FuzzyLogic

Hi Michael -

I had indeed forgotten to put it back in, however it has made little difference. I can currently ping both routers on the internal LAN when connected & I can connect to both routers using the external ip addresses whilst connected to the VPN however I cannot ping any other external IP address or hostname.

My current netstat routing tables looks like this:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.3 30
0.0.0.0 128.0.0.0 192.168.66.5 192.168.66.6 30
80.xx.xx.xx 255.255.255.255 192.168.0.1 192.168.0.3 30
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
128.0.0.0 128.0.0.0 192.168.66.5 192.168.66.6 30
192.168.0.0 255.255.255.0 On-link 192.168.0.3 286
192.168.0.3 255.255.255.255 On-link 192.168.0.3 286
192.168.0.255 255.255.255.255 On-link 192.168.0.3 286
192.168.36.0 255.255.255.0 192.168.66.5 192.168.66.6 30
192.168.66.0 255.255.255.0 192.168.66.5 192.168.66.6 30
192.168.66.4 255.255.255.252 On-link 192.168.66.6 286
192.168.66.6 255.255.255.255 On-link 192.168.66.6 286
192.168.66.7 255.255.255.255 On-link 192.168.66.6 286
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.66.6 286
224.0.0.0 240.0.0.0 On-link 192.168.0.3 286
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.66.6 286
255.255.255.255 255.255.255.255 On-link 192.168.0.3 286
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
13 286 fe80::/64 On-link
11 286 fe80::/64 On-link
11 286 fe80::cd6c:3ec:cc5e:4221/128
On-link
13 286 fe80::e0c3:9c9f:fc2:202c/128
On-link
1 306 ff00::/8 On-link
13 286 ff00::/8 On-link
11 286 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

and running iptables -vnL gives this:
root@Roam Repeater Bridge:~# iptables -vnL | more
Chain INPUT (policy ACCEPT 944 packets, 189K bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:1194
0 0 DROP tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
0 0 DROP tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
456 76904 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1194
4 240 ACCEPT 0 -- tun0 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- eth0 * 0.0.0.0/0 0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT 0 -- br0 br0 0.0.0.0/0 0.0.0.0/0
0 0 logdrop 0 -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
4 200 TCPMSS tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
58 3746 lan2wan 0 -- * * 0.0.0.0/0 0.0.0.0/0
24 1686 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT udp -- eth0 * 0.0.0.0/0 224.0.0.0/4 udp
0 0 TRIGGER 0 -- eth0 br0 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0
0 0 trigger_out 0 -- br0 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT 0 -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW
34 2060 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0

any other ideas?

Thanks,

Steve

FuzzyLogic

I am still struggling with this and would very much appreciate any further thoughts.

Gateway router - (virgin superhub) - provides ip addresses in the range 192.168.36.x
gateway router address on LAN 192.168.36.1
gateway provides dns servers as 194.168.4.100 & 194.168.8.100

Openvpn server / router is configured as a wireless bridge with DHCP turned off locally (since the superhub provides ip addresses)
ipaddress on LAN 192.168.36.2

When the VPN tunnel is set up, I can ping both routers from the client machine but cannot ping anything outside the LAN i.e. google by ip address 8.8.8.8 or by name.

an update with my latest config:

Client machine (windows7) config file

client
dev tun0
proto udp
remote 80.3.69.134 1194
resolv-retry infinite
nobind
persist-key
persist-tun
float
tun-mtu 1500
tun-mtu-extra 32
#mssfix 1450
keepalive 10 60
#explicit-exit-notify 3
ca ca.crt
cert client1.crt
key client1.key
cipher AES-128-CBC
#comp-lzo
verb 4
redirect-gateway def1 
#dhcp-option DNS 192.168.4.100
#dhcp-option DNS 192.168.8.100
#ns-cert-type server

server (DD-WRT router) config file

dev tun0
proto udp
port 1194
management localhost 5001
server 192.168.66.0 255.255.255.0
push "route 192.168.36.0 255.255.255.0"
push "redirect-gateway def1"
client-to-client
cipher AES-128-CBC
max-clients 10 
keepalive 10 60 
verb 5 
ca /tmp/openvpn/ca.crt
dh /tmp/openvpn/dh.pem
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem

Firewall rules on server

iptables -I INPUT 1 -p tcp --dport 1194 -j ACCEPT
iptables -A INPUT -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -i tun0 -j ACCEPT 
iptables -A INPUT -i eth0 -j ACCEPT 
iptables -A FORWARD -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.66.0/24 -o eth0 -j MASQUERADE

Netstat -nr

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0        10.43.1.1       10.43.2.45     25
          0.0.0.0        128.0.0.0     192.168.66.5     192.168.66.6     30
        10.43.0.0      255.255.0.0         On-link        10.43.2.45    281
       10.43.2.45  255.255.255.255         On-link        10.43.2.45    281
    10.43.255.255  255.255.255.255         On-link        10.43.2.45    281
      xx.x.xx.xxx  255.255.255.255        10.43.1.1       10.43.2.45     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        128.0.0.0        128.0.0.0     192.168.66.5     192.168.66.6     30
------>    192.168.36.0    255.255.255.0     192.168.66.5     192.168.66.6     30  <-------
     192.168.66.0    255.255.255.0     192.168.66.5     192.168.66.6     30
     192.168.66.4  255.255.255.252         On-link      192.168.66.6    286
     192.168.66.6  255.255.255.255         On-link      192.168.66.6    286
     192.168.66.7  255.255.255.255         On-link      192.168.66.6    286
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      192.168.66.6    286
        224.0.0.0        240.0.0.0         On-link        10.43.2.45    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      192.168.66.6    286
  255.255.255.255  255.255.255.255         On-link        10.43.2.45    281
===========================================================================
Persistent Routes:
  None

(Does this look correct - It looks like I can see a route to the LAN from the VPN.. by arrows above, does there need to be a similar routing going back the other way? from LAN 192.168.36.0 to VPN 192.168.66.0?)

Alternatively, any other suggestions how to trouble shoot this please?

maikcat

your routing table looks ok..

can you post the output of

tracert 8.8.8.8

from your client while connected...

Michael.

FuzzyLogic

It doesn't show much i'm afraid:

C:\Users>ping 192.168.36.1

Pinging 192.168.36.1 with 32 bytes of data:
Reply from 192.168.36.1: bytes=32 time=43ms TTL=63
Reply from 192.168.36.1: bytes=32 time=42ms TTL=63
Reply from 192.168.36.1: bytes=32 time=47ms TTL=63
Reply from 192.168.36.1: bytes=32 time=43ms TTL=63

Ping statistics for 192.168.36.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 42ms, Maximum = 47ms, Average = 43ms

C:\Users>tracert 8.8.8.8

Tracing route to 8.8.8.8 over a maximum of 30 hops

1 * 42 ms 41 ms 192.168.66.1
2 * * * Request timed out.
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
11 * * * Request timed out.

maikcat

something on your openvpn server is not configured correctly..

flush ALL rules on your firewall and use only the one for NAT.

Michael.