basic openvpn installation works, but no ping to server

sksbir

hello

I'm using openvpn since a long time with succes, but just client side. Now I discovered the full power of this software and trying to install private server at home2, and using it from home1

Here is my network:
OpenVpn Client-----ISP Router1 -----ISP router2 ------ Openvpn Server

>>> Openvpn Client:
-windows 7 64
- 192.168.22.x ( DHCP, wifi)

>>> openvpn server:
-windows 7 32
- 192.168.1.x ( DHCP, wifi )

- I used registry on both side to move config directory to custom location

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN]
"config_dir"="D:\\divers\\OpenVpn_Config"
[HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN-GUI]
"config_dir"="D:\\divers\\OpenVpn_Config"

- openvpn starting well with openvpn Gui on both sides ( shortcut is customized to start with elevated privileges ), client and server are linked : I get a lot's of messages on server side has soon has client is starting ( so I suppose that port 1194 forwarding on ISP router 2 side is effective after I configure it for that)

- unable to ping server from client: ( ping 10.8.0.1 from 10.8.0.6)

starting server side with verbose 6, I get messages like:

(Real IP adress from ISP1) MULTI: bad source address from client [xxx], packet dropped

I suspect a routing problem, but I thought that Openvpn was able to return packets to client source automatically ?

I will come back here to give more information has soon has I can reach my server again : I used teamviewer to get remote access, but I have lost connection to my server once I tried to activate internet sharing on tun/tap interface.

Thank's to help me with my problem . I have found a lot's of case with same message, but not on server side, and not concerning ping between server and client themselves.

note : I replaced here my ISP2 public address with XXX.XXX.XXX.XXX ( config and log )
Client Ovpn file :

client
dev tun
proto udp
remote XXX.XXX.XXX.XXX 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ca vedic-ca.crt
cert vpnbel.crt
key vpnbel.key
ns-cert-type server
comp-lzo
verb 6
tls-auth ta.key 1

log

Wed May 01 22:46:52 2013 us=707126 Current Parameter Settings:
Wed May 01 22:46:52 2013 us=708126   config = 'Vedic_client.ovpn'
Wed May 01 22:46:52 2013 us=708126   mode = 0
Wed May 01 22:46:52 2013 us=708126   show_ciphers = DISABLED
Wed May 01 22:46:52 2013 us=708126   show_digests = DISABLED
Wed May 01 22:46:52 2013 us=708126   show_engines = DISABLED
Wed May 01 22:46:52 2013 us=708126   genkey = DISABLED
Wed May 01 22:46:52 2013 us=708126   key_pass_file = '[UNDEF]'
Wed May 01 22:46:52 2013 us=708126   show_tls_ciphers = DISABLED
Wed May 01 22:46:52 2013 us=708126 Connection profiles [default]:
Wed May 01 22:46:52 2013 us=708126   proto = udp
Wed May 01 22:46:52 2013 us=708126   local = '[UNDEF]'
Wed May 01 22:46:52 2013 us=708126   local_port = 0
Wed May 01 22:46:52 2013 us=708126   remote = 'XXX.XXX.XXX.XXX'
Wed May 01 22:46:52 2013 us=708126   remote_port = 1194
Wed May 01 22:46:52 2013 us=708126   remote_float = DISABLED
Wed May 01 22:46:52 2013 us=708126   bind_defined = DISABLED
Wed May 01 22:46:52 2013 us=708126   bind_local = DISABLED
Wed May 01 22:46:52 2013 us=708126   connect_retry_seconds = 5
Wed May 01 22:46:52 2013 us=708126   connect_timeout = 10
Wed May 01 22:46:52 2013 us=708126   connect_retry_max = 0
Wed May 01 22:46:52 2013 us=708126   socks_proxy_server = '[UNDEF]'
Wed May 01 22:46:52 2013 us=708126   socks_proxy_port = 0
Wed May 01 22:46:52 2013 us=708126   socks_proxy_retry = DISABLED
Wed May 01 22:46:52 2013 us=708126   tun_mtu = 1500
Wed May 01 22:46:52 2013 us=708126   tun_mtu_defined = ENABLED
Wed May 01 22:46:52 2013 us=708126   link_mtu = 1500
Wed May 01 22:46:52 2013 us=708126   link_mtu_defined = DISABLED
Wed May 01 22:46:52 2013 us=708126   tun_mtu_extra = 0
Wed May 01 22:46:52 2013 us=708126   tun_mtu_extra_defined = DISABLED
Wed May 01 22:46:52 2013 us=708126   mtu_discover_type = -1
Wed May 01 22:46:52 2013 us=708126   fragment = 0
Wed May 01 22:46:52 2013 us=708126   mssfix = 1450
Wed May 01 22:46:52 2013 us=708126   explicit_exit_notification = 0
Wed May 01 22:46:52 2013 us=709126 Connection profiles END
Wed May 01 22:46:52 2013 us=709126   remote_random = DISABLED
Wed May 01 22:46:52 2013 us=709126   ipchange = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   dev = 'tun'
Wed May 01 22:46:52 2013 us=709126   dev_type = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   dev_node = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   lladdr = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   topology = 1
Wed May 01 22:46:52 2013 us=709126   tun_ipv6 = DISABLED
Wed May 01 22:46:52 2013 us=709126   ifconfig_local = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   ifconfig_remote_netmask = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   ifconfig_noexec = DISABLED
Wed May 01 22:46:52 2013 us=709126   ifconfig_nowarn = DISABLED
Wed May 01 22:46:52 2013 us=709126   ifconfig_ipv6_local = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   ifconfig_ipv6_netbits = 0
Wed May 01 22:46:52 2013 us=709126   ifconfig_ipv6_remote = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   shaper = 0
Wed May 01 22:46:52 2013 us=709126   mtu_test = 0
Wed May 01 22:46:52 2013 us=709126   mlock = DISABLED
Wed May 01 22:46:52 2013 us=709126   keepalive_ping = 0
Wed May 01 22:46:52 2013 us=709126   keepalive_timeout = 0
Wed May 01 22:46:52 2013 us=709126   inactivity_timeout = 0
Wed May 01 22:46:52 2013 us=709126   ping_send_timeout = 0
Wed May 01 22:46:52 2013 us=709126   ping_rec_timeout = 0
Wed May 01 22:46:52 2013 us=709126   ping_rec_timeout_action = 0
Wed May 01 22:46:52 2013 us=709126   ping_timer_remote = DISABLED
Wed May 01 22:46:52 2013 us=709126   remap_sigusr1 = 0
Wed May 01 22:46:52 2013 us=709126   persist_tun = ENABLED
Wed May 01 22:46:52 2013 us=709126   persist_local_ip = DISABLED
Wed May 01 22:46:52 2013 us=709126   persist_remote_ip = DISABLED
Wed May 01 22:46:52 2013 us=709126   persist_key = ENABLED
Wed May 01 22:46:52 2013 us=709126   passtos = DISABLED
Wed May 01 22:46:52 2013 us=709126   resolve_retry_seconds = 1000000000
Wed May 01 22:46:52 2013 us=709126   username = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   groupname = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   chroot_dir = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   cd_dir = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   writepid = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   up_script = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   down_script = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   down_pre = DISABLED
Wed May 01 22:46:52 2013 us=709126   up_restart = DISABLED
Wed May 01 22:46:52 2013 us=709126   up_delay = DISABLED
Wed May 01 22:46:52 2013 us=709126   daemon = DISABLED
Wed May 01 22:46:52 2013 us=709126   inetd = 0
Wed May 01 22:46:52 2013 us=709126   log = ENABLED
Wed May 01 22:46:52 2013 us=709126   suppress_timestamps = DISABLED
Wed May 01 22:46:52 2013 us=709126   nice = 0
Wed May 01 22:46:52 2013 us=709126   verbosity = 6
Wed May 01 22:46:52 2013 us=709126   mute = 0
Wed May 01 22:46:52 2013 us=709126   status_file = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   status_file_version = 1
Wed May 01 22:46:52 2013 us=709126   status_file_update_freq = 60
Wed May 01 22:46:52 2013 us=709126   occ = ENABLED
Wed May 01 22:46:52 2013 us=709126   rcvbuf = 0
Wed May 01 22:46:52 2013 us=709126   sndbuf = 0
Wed May 01 22:46:52 2013 us=709126   sockflags = 0
Wed May 01 22:46:52 2013 us=709126   fast_io = DISABLED
Wed May 01 22:46:52 2013 us=709126   lzo = 7
Wed May 01 22:46:52 2013 us=709126   route_script = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   route_default_gateway = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   route_default_metric = 0
Wed May 01 22:46:52 2013 us=709126   route_noexec = DISABLED
Wed May 01 22:46:52 2013 us=709126   route_delay = 5
Wed May 01 22:46:52 2013 us=709126   route_delay_window = 30
Wed May 01 22:46:52 2013 us=709126   route_delay_defined = ENABLED
Wed May 01 22:46:52 2013 us=709126   route_nopull = DISABLED
Wed May 01 22:46:52 2013 us=709126   route_gateway_via_dhcp = DISABLED
Wed May 01 22:46:52 2013 us=709126   max_routes = 100
Wed May 01 22:46:52 2013 us=709126   allow_pull_fqdn = DISABLED
Wed May 01 22:46:52 2013 us=709126   management_addr = '127.0.0.1'
Wed May 01 22:46:52 2013 us=709126   management_port = 25342
Wed May 01 22:46:52 2013 us=709126   management_user_pass = 'stdin'
Wed May 01 22:46:52 2013 us=709126   management_log_history_cache = 250
Wed May 01 22:46:52 2013 us=709126   management_echo_buffer_size = 100
Wed May 01 22:46:52 2013 us=709126   management_write_peer_info_file = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   management_client_user = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   management_client_group = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   management_flags = 6
Wed May 01 22:46:52 2013 us=709126   shared_secret_file = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   key_direction = 2
Wed May 01 22:46:52 2013 us=709126   ciphername_defined = ENABLED
Wed May 01 22:46:52 2013 us=709126   ciphername = 'BF-CBC'
Wed May 01 22:46:52 2013 us=709126   authname_defined = ENABLED
Wed May 01 22:46:52 2013 us=709126   authname = 'SHA1'
Wed May 01 22:46:52 2013 us=709126   prng_hash = 'SHA1'
Wed May 01 22:46:52 2013 us=709126   prng_nonce_secret_len = 16
Wed May 01 22:46:52 2013 us=709126   keysize = 0
Wed May 01 22:46:52 2013 us=709126   engine = DISABLED
Wed May 01 22:46:52 2013 us=709126   replay = ENABLED
Wed May 01 22:46:52 2013 us=709126   mute_replay_warnings = ENABLED
Wed May 01 22:46:52 2013 us=709126   replay_window = 64
Wed May 01 22:46:52 2013 us=709126   replay_time = 15
Wed May 01 22:46:52 2013 us=709126   packet_id_file = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   use_iv = ENABLED
Wed May 01 22:46:52 2013 us=709126   test_crypto = DISABLED
Wed May 01 22:46:52 2013 us=709126   tls_server = DISABLED
Wed May 01 22:46:52 2013 us=709126   tls_client = ENABLED
Wed May 01 22:46:52 2013 us=709126   key_method = 2
Wed May 01 22:46:52 2013 us=709126   ca_file = 'vedic-ca.crt'
Wed May 01 22:46:52 2013 us=709126   ca_path = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   dh_file = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   cert_file = 'vpnbel.crt'
Wed May 01 22:46:52 2013 us=709126   priv_key_file = 'vpnbel.key'
Wed May 01 22:46:52 2013 us=709126   pkcs12_file = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   cryptoapi_cert = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   cipher_list = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   tls_verify = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   tls_export_cert = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   verify_x509_type = 0
Wed May 01 22:46:52 2013 us=709126   verify_x509_name = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   crl_file = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   ns_cert_type = 1
Wed May 01 22:46:52 2013 us=709126   remote_cert_ku[i] = 0
Wed May 01 22:46:52 2013 us=709126   remote_cert_ku[i] = 0
Wed May 01 22:46:52 2013 us=709126   remote_cert_ku[i] = 0
Wed May 01 22:46:52 2013 us=709126   remote_cert_ku[i] = 0
Wed May 01 22:46:52 2013 us=709126   remote_cert_ku[i] = 0
Wed May 01 22:46:52 2013 us=709126   remote_cert_ku[i] = 0
Wed May 01 22:46:52 2013 us=709126   remote_cert_ku[i] = 0
Wed May 01 22:46:52 2013 us=709126   remote_cert_ku[i] = 0
Wed May 01 22:46:52 2013 us=709126   remote_cert_ku[i] = 0
Wed May 01 22:46:52 2013 us=709126   remote_cert_ku[i] = 0
Wed May 01 22:46:52 2013 us=709126   remote_cert_ku[i] = 0
Wed May 01 22:46:52 2013 us=709126   remote_cert_ku[i] = 0
Wed May 01 22:46:52 2013 us=709126   remote_cert_ku[i] = 0
Wed May 01 22:46:52 2013 us=709126   remote_cert_ku[i] = 0
Wed May 01 22:46:52 2013 us=709126   remote_cert_ku[i] = 0
Wed May 01 22:46:52 2013 us=709126   remote_cert_ku[i] = 0
Wed May 01 22:46:52 2013 us=709126   remote_cert_eku = '[UNDEF]'
Wed May 01 22:46:52 2013 us=709126   ssl_flags = 0
Wed May 01 22:46:52 2013 us=709126   tls_timeout = 2
Wed May 01 22:46:52 2013 us=709126   renegotiate_bytes = 0
Wed May 01 22:46:52 2013 us=709126   renegotiate_packets = 0
Wed May 01 22:46:52 2013 us=709126   renegotiate_seconds = 3600
Wed May 01 22:46:52 2013 us=709126   handshake_window = 60
Wed May 01 22:46:52 2013 us=709126   transition_window = 3600
Wed May 01 22:46:52 2013 us=709126   single_session = DISABLED
Wed May 01 22:46:52 2013 us=709126   push_peer_info = DISABLED
Wed May 01 22:46:52 2013 us=709126   tls_exit = DISABLED
Wed May 01 22:46:52 2013 us=709126   tls_auth_file = 'ta.key'
Wed May 01 22:46:52 2013 us=709126   pkcs11_protected_authentication = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_protected_authentication = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_protected_authentication = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_protected_authentication = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_protected_authentication = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_protected_authentication = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_protected_authentication = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_protected_authentication = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_protected_authentication = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_protected_authentication = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_protected_authentication = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_protected_authentication = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_protected_authentication = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_protected_authentication = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_protected_authentication = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_protected_authentication = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_private_mode = 00000000
Wed May 01 22:46:52 2013 us=710126   pkcs11_private_mode = 00000000
Wed May 01 22:46:52 2013 us=710126   pkcs11_private_mode = 00000000
Wed May 01 22:46:52 2013 us=710126   pkcs11_private_mode = 00000000
Wed May 01 22:46:52 2013 us=710126   pkcs11_private_mode = 00000000
Wed May 01 22:46:52 2013 us=710126   pkcs11_private_mode = 00000000
Wed May 01 22:46:52 2013 us=710126   pkcs11_private_mode = 00000000
Wed May 01 22:46:52 2013 us=710126   pkcs11_private_mode = 00000000
Wed May 01 22:46:52 2013 us=710126   pkcs11_private_mode = 00000000
Wed May 01 22:46:52 2013 us=710126   pkcs11_private_mode = 00000000
Wed May 01 22:46:52 2013 us=710126   pkcs11_private_mode = 00000000
Wed May 01 22:46:52 2013 us=710126   pkcs11_private_mode = 00000000
Wed May 01 22:46:52 2013 us=710126   pkcs11_private_mode = 00000000
Wed May 01 22:46:52 2013 us=710126   pkcs11_private_mode = 00000000
Wed May 01 22:46:52 2013 us=710126   pkcs11_private_mode = 00000000
Wed May 01 22:46:52 2013 us=710126   pkcs11_private_mode = 00000000
Wed May 01 22:46:52 2013 us=710126   pkcs11_cert_private = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_cert_private = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_cert_private = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_cert_private = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_cert_private = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_cert_private = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_cert_private = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_cert_private = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_cert_private = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_cert_private = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_cert_private = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_cert_private = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_cert_private = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_cert_private = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_cert_private = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_cert_private = DISABLED
Wed May 01 22:46:52 2013 us=710126   pkcs11_pin_cache_period = -1
Wed May 01 22:46:52 2013 us=710126   pkcs11_id = '[UNDEF]'
Wed May 01 22:46:52 2013 us=710126   pkcs11_id_management = DISABLED
Wed May 01 22:46:52 2013 us=710126   server_network = 0.0.0.0
Wed May 01 22:46:52 2013 us=710126   server_netmask = 0.0.0.0
Wed May 01 22:46:52 2013 us=711126   server_network_ipv6 = ::
Wed May 01 22:46:52 2013 us=711126   server_netbits_ipv6 = 0
Wed May 01 22:46:52 2013 us=711126   server_bridge_ip = 0.0.0.0
Wed May 01 22:46:52 2013 us=711126   server_bridge_netmask = 0.0.0.0
Wed May 01 22:46:52 2013 us=711126   server_bridge_pool_start = 0.0.0.0
Wed May 01 22:46:52 2013 us=711126   server_bridge_pool_end = 0.0.0.0
Wed May 01 22:46:52 2013 us=711126   ifconfig_pool_defined = DISABLED
Wed May 01 22:46:52 2013 us=711126   ifconfig_pool_start = 0.0.0.0
Wed May 01 22:46:52 2013 us=711126   ifconfig_pool_end = 0.0.0.0
Wed May 01 22:46:52 2013 us=711126   ifconfig_pool_netmask = 0.0.0.0
Wed May 01 22:46:52 2013 us=711126   ifconfig_pool_persist_filename = '[UNDEF]'
Wed May 01 22:46:52 2013 us=711126   ifconfig_pool_persist_refresh_freq = 600
Wed May 01 22:46:52 2013 us=711126   ifconfig_ipv6_pool_defined = DISABLED
Wed May 01 22:46:52 2013 us=711126   ifconfig_ipv6_pool_base = ::
Wed May 01 22:46:52 2013 us=711126   ifconfig_ipv6_pool_netbits = 0
Wed May 01 22:46:52 2013 us=711126   n_bcast_buf = 256
Wed May 01 22:46:52 2013 us=711126   tcp_queue_limit = 64
Wed May 01 22:46:52 2013 us=711126   real_hash_size = 256
Wed May 01 22:46:52 2013 us=711126   virtual_hash_size = 256
Wed May 01 22:46:52 2013 us=711126   client_connect_script = '[UNDEF]'
Wed May 01 22:46:52 2013 us=711126   learn_address_script = '[UNDEF]'
Wed May 01 22:46:52 2013 us=711126   client_disconnect_script = '[UNDEF]'
Wed May 01 22:46:52 2013 us=711126   client_config_dir = '[UNDEF]'
Wed May 01 22:46:52 2013 us=711126   ccd_exclusive = DISABLED
Wed May 01 22:46:52 2013 us=711126   tmp_dir = 'C:\Users\gips\AppData\Local\Temp\'
Wed May 01 22:46:52 2013 us=711126   push_ifconfig_defined = DISABLED
Wed May 01 22:46:52 2013 us=711126   push_ifconfig_local = 0.0.0.0
Wed May 01 22:46:52 2013 us=711126   push_ifconfig_remote_netmask = 0.0.0.0
Wed May 01 22:46:52 2013 us=711126   push_ifconfig_ipv6_defined = DISABLED
Wed May 01 22:46:52 2013 us=711126   push_ifconfig_ipv6_local = ::/0
Wed May 01 22:46:52 2013 us=711126   push_ifconfig_ipv6_remote = ::
Wed May 01 22:46:52 2013 us=711126   enable_c2c = DISABLED
Wed May 01 22:46:52 2013 us=711126   duplicate_cn = DISABLED
Wed May 01 22:46:52 2013 us=711126   cf_max = 0
Wed May 01 22:46:52 2013 us=711126   cf_per = 0
Wed May 01 22:46:52 2013 us=711126   max_clients = 1024
Wed May 01 22:46:52 2013 us=711126   max_routes_per_client = 256
Wed May 01 22:46:52 2013 us=711126   auth_user_pass_verify_script = '[UNDEF]'
Wed May 01 22:46:52 2013 us=711126   auth_user_pass_verify_script_via_file = DISABLED
Wed May 01 22:46:52 2013 us=711126   client = ENABLED
Wed May 01 22:46:52 2013 us=711126   pull = ENABLED
Wed May 01 22:46:52 2013 us=711126   auth_user_pass_file = '[UNDEF]'
Wed May 01 22:46:52 2013 us=711126   show_net_up = DISABLED
Wed May 01 22:46:52 2013 us=711126   route_method = 0
Wed May 01 22:46:52 2013 us=711126   ip_win32_defined = DISABLED
Wed May 01 22:46:52 2013 us=711126   ip_win32_type = 3
Wed May 01 22:46:52 2013 us=711126   dhcp_masq_offset = 0
Wed May 01 22:46:52 2013 us=711126   dhcp_lease_time = 31536000
Wed May 01 22:46:52 2013 us=711126   tap_sleep = 0
Wed May 01 22:46:52 2013 us=711126   dhcp_options = DISABLED
Wed May 01 22:46:52 2013 us=711126   dhcp_renew = DISABLED
Wed May 01 22:46:52 2013 us=711126   dhcp_pre_release = DISABLED
Wed May 01 22:46:52 2013 us=711126   dhcp_release = DISABLED
Wed May 01 22:46:52 2013 us=711126   domain = '[UNDEF]'
Wed May 01 22:46:52 2013 us=711126   netbios_scope = '[UNDEF]'
Wed May 01 22:46:52 2013 us=711126   netbios_node_type = 0
Wed May 01 22:46:52 2013 us=711126   disable_nbt = DISABLED
Wed May 01 22:46:52 2013 us=711126 OpenVPN 2.3.1 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Mar 28 2013
Enter Management Password:
Wed May 01 22:46:52 2013 us=713126 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25342
Wed May 01 22:46:52 2013 us=713126 Need hold release from management interface, waiting...
Wed May 01 22:46:53 2013 us=125150 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25342
Wed May 01 22:46:53 2013 us=226155 MANAGEMENT: CMD 'state on'
Wed May 01 22:46:53 2013 us=227155 MANAGEMENT: CMD 'log all on'
Wed May 01 22:46:53 2013 us=343162 MANAGEMENT: CMD 'hold off'
Wed May 01 22:46:53 2013 us=344162 MANAGEMENT: CMD 'hold release'
Wed May 01 22:46:53 2013 us=345162 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed May 01 22:46:53 2013 us=562175 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Wed May 01 22:46:53 2013 us=562175 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 01 22:46:53 2013 us=562175 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 01 22:46:53 2013 us=562175 LZO compression initialized
Wed May 01 22:46:53 2013 us=562175 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Wed May 01 22:46:53 2013 us=562175 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed May 01 22:46:53 2013 us=562175 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed May 01 22:46:53 2013 us=562175 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Wed May 01 22:46:53 2013 us=562175 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Wed May 01 22:46:53 2013 us=562175 Local Options hash (VER=V4): '504e774e'
Wed May 01 22:46:53 2013 us=562175 Expected Remote Options hash (VER=V4): '14168603'
Wed May 01 22:46:53 2013 us=562175 UDPv4 link local: [undef]
Wed May 01 22:46:53 2013 us=562175 UDPv4 link remote: [AF_INET]109.190.4.197:1194
Wed May 01 22:46:53 2013 us=562175 MANAGEMENT: >STATE:1367441213,WAIT,,,
Wed May 01 22:46:53 2013 us=563175 UDPv4 WRITE [42] to [AF_INET]109.190.4.197:1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #1 ] [ ] pid=0 DATA len=0
Wed May 01 22:46:53 2013 us=563175 UDPv4 READ [0] from [undef]: DATA UNDEF len=-1
Wed May 01 22:46:55 2013 us=792302 UDPv4 WRITE [42] to [AF_INET]109.190.4.197:1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #2 ] [ ] pid=0 DATA len=0
Wed May 01 22:46:59 2013 us=135493 UDPv4 WRITE [42] to [AF_INET]109.190.4.197:1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #3 ] [ ] pid=0 DATA len=0
Wed May 01 22:47:07 2013 us=788988 UDPv4 WRITE [42] to [AF_INET]109.190.4.197:1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #4 ] [ ] pid=0 DATA len=0
( note : it's not closing by itselve but because I decided to close it just after sucessfull starting in purpose of getting a log )
Wed May 01 22:47:16 2013 us=262473 TCP/UDP: Closing socket
Wed May 01 22:47:16 2013 us=263473 SIGTERM[hard,] received, process exiting
Wed May 01 22:47:16 2013 us=263473 MANAGEMENT: >STATE:1367441236,EXITING,SIGTERM,,

sksbir

mmm, no more EDIT option after a so short time ?.... too bad.

I must say here that
- I started using sample config files for server and client, just bringing a few changes.
- I have read this section of the FAQ...

Thanks.

janjust

- unable to ping server from client: ( ping 10.8.0.1 from 10.8.0.6)

this is a Windows security issue : by default, Win7 does not trust the tap-win32 adapter and therefore refuses ping access to it (Public interface). Try it with the firewall disabled to see if that helps. There are 2 ways to make the interface trusted: either a registry key or by pushing a route from the server to the client (strange, but this works)/

starting server side with verbose 6, I get messages like:
Code:
(Real IP adress from ISP1) MULTI: bad source address from client [xxx], packet dropped

I suspect a routing problem, but I thought that Openvpn was able to return packets to client source automatically ?

this is actually a different issue: by default Windows binds all/several protocols to the tap-win32 adapters, some of which send broadcasts out over it; these broadcasts tend to use a strange source address, however and openvpn does not recognize them and therefore prints this warning.

sksbir

hello janjust
thank's for your response. You gave me enough clues to get it working.
I thirst added this lines, but without changes:

route-method exe
route-delay 2

janjust wrote
- unable to ping server from client: ( ping 10.8.0.1 from 10.8.0.6)
this is a Windows security issue : by default, Win7 does not trust the tap-win32 adapter and therefore refuses ping access to it (Public interface). Try it with the firewall disabled to see if that helps. There are 2 ways to make the interface trusted: either a registry key or by pushing a route from the server to the client (strange, but this works)/

There are 2 things here :
- 1/ force windows to trust the tap-win32 adapter, that is to place it on private location
- 2/ open firewall (private section rules ) to bring ping and smb shares to work

For the first point, they are a lot's of discussion on internet, I follow this subject and add the lines

route-metric 512
route 0.0.0.0 0.0.0.0

on server and client config file.

But this was not enough : I had either to
- disable the "private" firewall
- or disable the network card associated with the tap-win32 adapter ( on my computers, it is named "connexion au reseau local 2" ) in private section of firewall
- accept incomming packets in private section of firewall

The two firsts methods bring a warning from the security center.

The third method is now mine : I have to do this on server to be able to ping the server from the client, and I have to do this on client to be able to ping the client from server ( I mean : ping the internal IP address 10.8.xxxx ).
This validate the fact that the network card associated with tap-win32 adapter is really as private network recognized.

So the question remains : why should I have to open firewall restrictions on incomming packet although the tap-win32 is associated with a private (not public) network ?
I don't have to do this for getting the computer working within it's default lan network : of course I can ping it, use shares and so on within the lan...

annexes:
config file for my openvpn server:

port 1194
proto udp
dev tun
ca vedic-ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
;; push "redirect-gateway def1 bypass-dhcp"
client-to-client
keepalive 10 120
tls-auth ta.key 0 # This file is secret
comp-lzo
max-clients 20
persist-key
persist-tun
status openvpn-status.log
verb 3
mute 20
route-method exe
route-delay 2
route-metric 512
route 0.0.0.0 0.0.0.0

config file for my openvpn client :

client
dev tun
proto udp
remote xxxxxxxxxxxxx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ca vedic-ca.crt
cert vpnbel.crt
key vpnbel.key
ns-cert-type server
comp-lzo
verb 3
tls-auth ta.key 1
route-method exe
route-delay 2
route-metric 512
route 0.0.0.0 0.0.0.0
#from https://forums.openvpn.net/topic7806.html
explicit-exit-notify 2
ping 10
ping-restart 60

janjust

So the question remains : why should I have to open firewall restrictions on incomming packet although the tap-win32 is associated with a private (not public) network ?
I don't have to do this for getting the computer working within it's default lan network : of course I can ping it, use shares and so on within the lan...

AFAIK this is a Windows-specific issue and it has little to do with OpenVPN itself. Instead of

route 0.0.0.0 0.0.0.0

try

redirect-gateway

(leave the 'metric' intact).

sksbir

janjust wrote
So the question remains : why should I have to open firewall restrictions on incomming packet although the tap-win32 is associated with a private (not public) network ?
I don't have to do this for getting the computer working within it's default lan network : of course I can ping it, use shares and so on within the lan...
AFAIK this is a Windows-specific issue and it has little to do with OpenVPN itself.

Ok for your answer at a global scope.
But I asked that because it seems that other users with same configuration ( openvpn server / windows 7 ) don't need to open firewall: is my configuration OK or did I missed something which permits not to open firewall ?

janjust wrote Instead of

route 0.0.0.0 0.0.0.0

try

redirect-gateway

(leave the 'metric' intact).

On server side :

Options error: --redirect-gateway cannot be used with --mode server (however --push "redirect-gateway" is fine)
Use --help for more information.

On client side, network associated with tap interface is back on public location, and I loose internet connection.
Here is the head of netstat -r command: ( where is my router ? )

IPv4 Table de routage
===========================================================================
Itinéraires actifs :
Destination réseau    Masque réseau  Adr. passerelle   Adr. interface Métrique
          0.0.0.0          0.0.0.0        10.8.0.13        10.8.0.14     31
         10.8.0.0    255.255.255.0        10.8.0.13        10.8.0.14     31
        10.8.0.12  255.255.255.252         On-link         10.8.0.14    286
        10.8.0.14  255.255.255.255         On-link         10.8.0.14    286
        10.8.0.15  255.255.255.255         On-link         10.8.0.14    286
    109.190.4.197  255.255.255.255   192.168.22.254    192.168.22.12     26
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306...

reverting to options :
route-metric 512
route 0.0.0.0 0.0.0.0

my router which permits going out on internet is back

IPv4 Table de routage
===========================================================================
Itinéraires actifs :
Destination réseau    Masque réseau  Adr. passerelle   Adr. interface Métrique
          0.0.0.0          0.0.0.0   192.168.22.254    192.168.22.12     31
          0.0.0.0          0.0.0.0        10.8.0.13        10.8.0.14    542
         10.8.0.0    255.255.255.0        10.8.0.13        10.8.0.14    542
        10.8.0.12  255.255.255.252         On-link         10.8.0.14    286
        10.8.0.14  255.255.255.255         On-link         10.8.0.14    286
        10.8.0.15  255.255.255.255         On-link         10.8.0.14    286
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306

nice try 🙂