Some questions on the HOWTo

dentalan

Hello. I have setup an openvpn between my home and the office. A win7 PC at home acts as a server for the VPN (10.8.0.1-VPN side and 192.168.1.148-LAN side)
I have entered on the router the "route" commands so that I route the VPN client subnet (10.8.0.0/24) to the OpenVPN server as it is described in the HOWTO
Now I can ping the address 10.8.0.18 from a laptop on my home LAN wich has the IP:192.168.1.100
Also from my office, the PC that is connected to the VPN server with an IP (vPN side) 10.8.0.6 can ping a pc on the LAN of my home successfully.
I follow the instruction on the HOWTO to make the devices from the client side LAN accessible from my server's side LAN device but I do not manage to do it. This what I do
1. I make a unique IP subnet for the office(client) LAN: 10.10.11.0
2. I enable IP forwarding on the client PC. Question: How can I enable it for the TUN/TAP in win XP
3. Enter the line "client-config-dir ccd". Question: Should I replace the word "ccd" with the actual path (C:\Program Files\openvpn\config) or just leave it as "ccd"? Maybe a stupid question but I cannot resolve it.
4. I create a file named "client2" (this is the clients common name) and enter there the line
iroute 10.10.11.0 255.255.255.0 I place it in the path "C:\Program Files\openvpn\config"
5. I add the line in the server's config file
route 10.10.11.0 255.255.255.0

6. I add the client-to-client and the push "route 10.10.11.0 255.255.255.0" lines in the server's config file
7. I add a route to the server's LAN gateway(home router) which directs 10.10.11.0/24 to the OpenVPN server (192.168.1.148) box .
But it does not work
Firewall is off on all mashines
Thank you

dentalan

my configs are these

port 1194

proto udp
dev tun

dev-node TAP-Win32

ca ca.crt
cert server.crt
key server.key  # This file should be kept secret

dh dh1024.pem

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt



management localhost 23
push "route 192.168.10.0 255.255.255.0"
push "route 192.168.1.0 255.255.255.0"
push "route 10.10.11.0 255.255.255.0"
client-config-dir ccd
route 10.10.11.0 255.255.255.0
route 192.168.10.0 255.255.255.0

client-to-client
keepalive 10 120
comp-lzo

persist-key
persist-tun

status openvpn-status.log

verb 3



#######Client

client

dev tun
dev-node TAP-Win32
proto udp
remote xxx.xxx.xxx 1194
resolv-retry infinite
nobind
persist-key
persist-tun

management localhost 23
ca ca.crt
cert client2.crt
key client2.key
ns-cert-type server

comp-lzo

verb 3

janjust

2. I enable IP forwarding on the client PC. Question: How can I enable it for the TUN/TAP in win XP

this is a global setting - if IP Forwarding is enabled it applies to all interfaces

3. Enter the line "client-config-dir ccd". Question: Should I replace the word "ccd" with the actual path (C:\Program Files\openvpn\config) or just leave it as "ccd"? Maybe a stupid question but I cannot resolve it.

it is best to use an absolute path, e.g.

client-config-dir "c:/program files/openvpn/config"

Alternatively you can try creating a directory 'ccd' underneath "C:\Program Files\openvpn\config" and then use

client-config-dir ccd

dentalan

OK. Thanks. I'll try it and see if I make it

dentalan

I cannot do it.
I need help I am postiong all the steps I have followed, wishing that someone with a good heart will help me
I repeat the network "topology"
I have a network (192.168.1.0/255.255.255.0) at home. The gateway is a thompson router (192.168.1.254) and the openVPN server is located in a win7 PC in this network(192.168.1.148)
A Second network is at my country home (192.168.10.0/255.255.255.0). A same router is used as a gateway (192.168.10.1) and the client PC (to the VPN) is a WinXP Pro Sp3 (192.168.1.249)
The VPN is active and running on this PCs and I can connect to it from other places too.
Server Config

port 1194
proto udp
dev tun
dev-node TAP-Win32
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
server 10.8.1.0 255.255.255.0
#ifconfig-pool-persist ipp.txt
#server-bridge
management localhost 23
#push "route 192.168.10.0 255.255.255.0"
#push "route 192.168.20.0 255.255.255.0"
#push "route 10.10.11.0 255.255.255.0"
#route 10.10.11.0 255.255.255.0
#route 192.168.10.0 255.255.255.0
#route 192.168.1.0 255.255.255.0
#client-config-dir C:\\Program Files\\OpenVPN\\config\\ccd
client-to-client
push "route 192.168.1.0 255.255.255.0"
keepalive 10 120
;tls-auth ta.key 0 # This file is secret
;cipher BF-CBC        # Blowfish (default)
;cipher AES-128-CBC   # AES
;cipher DES-EDE3-CBC  # Triple-DES
comp-lzo
max-clients 100
;user nobody
;group nobody
persist-key
persist-tun
status openvpn-status.log
verb 6
;mute 20

Client Config

client
dev tun
dev-node TAP-Win32
proto udp
remote xxxx.xxx.xxx 1194
resolv-retry infinite
nobind
;user nobody
;group nobody
persist-key
persist-tun
ca ca.crt
cert client4.crt
key client4.key
ns-cert-type server
comp-lzo
verb 3

1st STEP:include additional machines on the server subnet. -Enable IP forwarding
-add the line push "route 192.168.1.0 255.255.255.0" on the server config file
- using telnet (this is the only way for the Thompson router to add routes) I add a route for the 10.8.1.0 on the gateway which is located at the openvpn server LAN. I use this command:

ip rtadd ip rtadd dst = <ip-address>
  [dstmsk = <ip-mask(dotted or cidr)]>
[label = <{None|DSCP|Interactive|Management|
Video|VoIP-RTP|VoIP-Signal|default}]>
[gateway = <ip-address]>
[intf = <{loop|Internet|LocalNetwork}]>
[srcintf = <{loop|Internet|LocalNetwork}]>
[metric = <number{0-255}]>

dst=10.8.1.0
dstmsk=24
label "nothing"
gateway= 192.168.1.148 (the IP of the PC that runs the VPN server
intf=LocalNetwork
Also I use the command "ip saveall" to save this route on the router

So I've got a new entry on the IP table saying:
Destination=10.8.1.0/24, gateway=192.168.1.148, localnetwork
Firewall is disabled on both computers
Now I am at the home LAN(192.168.1.0), on a laptop with IP-192.168.1.68. I can ping the VPN server (10.8.1.0 and 192.168.1.148) and I can ping any other adress of the VPN (10.8.1.0). From my country home LAN(192.168.10.0) I can ping the VPN server and the Home LAN's gateway (192.168.1.254) but nothing else
So it seems that the VPN server (192.168.1.148 or 10.8.1.0) does not route the traffic correctly to the Home Lans PCs, since it routes it only to the router (192.168.10.254)

2nd step "Including multiple machines on the client side when using a routed VPN (dev tun)
-I create the client config dir ("C:\Program files\openvpn\config\ccd")
-I add the entry client-config-dir C:\\Program files\\openvpn\\config\\ccd
-create a file names client4 (no extension, right?) that contains the line
iroute 192.168.10.0 255.255.255.0
and place it in the ccd dir. client4 is the common name of the client pc
-place the command
route 192.168.10.0 255.255.255.0
in the server config file
-uncomment the "client-to-client" option in tthe server config file
-add the
push "route 192.168.10.0 255.255.255.0"
command in the server config
-create a route on the home LAN gateway
ip rtadd dst=192.168.10.0/24 gateway=192.168.1.148 intf=LocalNetwork
-create a route on the Client side LAN gateway
ip rtadd dst=10.8.1.0/24 gateway=192.168.1.249 intf=LocalNetwork
and at last
ip saveall
so I should be able to reach anh ip of the subnet (192.168.10.0) from any ip on the subnet 192.168.1.0.
Well something is wrong because I cannot
Any help?

dentalan

It seems that I am almost there
The main problem was tha I had to add routes to the gateway of each subnet for each subnet of the server and client side. After I did that I begun to communicate with the clients' side.

I have managed to "see" devices in the client side and devices in the server side of the VPN from both directions.
But not all
For example I can trace an IP camera I have on the client side from any side of the VPN but not an Access point that is connect to this subnet:

traceroute 192.168.10.6 from 10.10.11.10
  1     1 ms     1 ms     2 ms  10.10.11.1  #This is the LAN gateway
  2     3 ms    40 ms    26 ms  ANASTOFFICE [10.10.11.5] #this is the client gateway to VPN
  3    82 ms    84 ms    75 ms  PC-HOME [10.8.1.6] #This is the other client gateway to VPN
  4    80 ms    76 ms    78 ms  192.168.10.6 #this the LAN address of the IP camera

This is a trace using windows traceroute command.
I use a laptop connected on subnet (10.10.11.0 with gateway 10.10.11.1) to trace another client on a diferent subnet (192.168.10.0, with gateway 192.168.1.1) the Client PC for the fist subnet is ANASTOFFIC (10.10.11.5) and for the second subnet is the PC-HOME(192.168.10.249)
This trace is successfull.
But if I try to trace from PC home the IP 10.10.11.128 it does not work. It stops on anastoffice (IP 10.8.1.10). 10.10.11.128 is another laptop on the first subnet

 
#Client ANASTOFFICE (10.10.11.5 or 10.8.1.10) config
client
dev tun
dev-node TAP-Win32
;proto tcp
proto udp
remote xxx.xxx.xxx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
management localhost 23
ca ca.crt
cert client3.crt
key client3.key
ns-cert-type server
comp-lzo
verb 3

Client2 Config (at PC-Home 192.168.10.249) is the same
Server config

dev tun
dev-node TAP-Win32
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
server 10.8.1.0 255.255.255.0
management localhost 23
route 10.10.11.0 255.255.255.0
route 192.168.10.0 255.255.255.0
client-config-dir ccd
client-to-client
push "route 192.168.1.0 255.255.255.0"
push "route 10.10.11.0 255.255.255.0"
push "route 192.168.10.0 255.255.255.0"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 6

I suspect that the problem is on the router of the 10.10.11.0 subnet.
When I add routes on this router/gateway iI have tow options on the interface: LAN/br0 and NAS 8_35
I select the first one is that correct?

janjust

I use a laptop connected on subnet (10.10.11.0 with gateway 10.10.11.1) to trace another client on a diferent subnet (192.168.10.0, with gateway 192.168.1.1) the Client PC for the fist subnet is ANASTOFFIC (10.10.11.5) and for the second subnet is the PC-HOME(192.168.10.249)
This trace is successfull.
But if I try to trace from PC home the IP 10.10.11.128 it does not work. It stops on anastoffice (IP 10.8.1.10). 10.10.11.128 is another laptop on the first subnet

so it works in one direction but not the other? do you have a 'ccd' file for the openvpn client (= ANASTOFFIC)? you will need this , with the right 'iroute' statement for subnet-to-subnet routing to work.

dentalan

I have 2 files in this dir (ccd)
file1: client3, this is for the PC anastoffice with the command
iroute 10.10.11.0.255.255.255.0
file2: client4. for PC-Home with command
iroute 192.168.10.0 255.255.255.0
The problem is not that it works only in one direction, but mostly it is that it cannot reach all the IPs
I can reach IP 10.10.11.5 but not 10.10.11.254 (which for example is an access point)
It is something I am missing.
Do I have to "iroute" all subnets in the ccd files?
I mean, do I have to add both iroute 10.10.11.0 and iroute 192.168.10.0 on both ffiles (client3 and client4) in the ccd dir?

janjust

I can reach IP 10.10.11.5 but not 10.10.11.254 (which for example is an access point)

the IP 10.10.11.5 is the IP of the VPN client - is IP forwarding enabled on this client? on Windows you can check this using 'ipconfig /all'.

Also, when pinging 10.10.11.254 from 192.168.10.X: does the machine 10.10.11.254 know where to send packets back to? (they need to go back to the VPN client). You can work around this by adding an extra route on your LAN router to point the subnet 192.168.10/24 to 10.10.11.5

Do I have to "iroute" all subnets in the ccd files?

no this is not required, and as the PC 192.168.10.XX can reach 10.10.11.5 this shows that *that* iroute statement is working - remove it from the CCD file and you should see that it can no longer be reached

dentalan

IP10.10.11.5 is a client and the gateway to the VPN from the client side(I hope I am saying it correctly)
Ip forwarding is enabled in this PC

Also, when pinging 10.10.11.254 from 192.168.10.X: does the machine 10.10.11.254 know where to send packets back to? (they need to go back to the VPN client). You can work around this by adding an extra route on your LAN router to point the subnet 192.168.10/24 to 10.10.11.5

Yes I have added this. theseare the static routes on my router

Static Routing  

Destination  
Network 
Address		Default Gateway Subnet Mask Interface 
10.8.1.0	              10.10.11.5	255.255.255.0	br0  
192.168.1.0	10.10.11.5	255.255.255.0	br0  
192.168.10.0	10.10.11.5	255.255.255.0 	br0

Just for fun, I made the mistake and entered bot iroute in both client files and this i a trace that bounced between the two client all the time

Tracing route to 10.10.11.3 over a maximum of 30 hops

1 70 ms 100 ms 1 ms PC3 [192.168.1.148]

2 35 ms 37 ms 37 ms PC-HOME [10.8.1.10]

3 37 ms 137 ms 99 ms 192.168.10.1

4 97 ms 36 ms 36 ms PC-HOME [192.168.10.249]

5 37 ms 38 ms 37 ms PC-HOME [192.168.10.249]

6 67 ms 37 ms 38 ms PC-HOME [192.168.10.249]

7 99 ms 62 ms 117 ms 192.168.10.1

8 96 ms 37 ms 37 ms PC-HOME [192.168.10.249]

9 39 ms 39 ms 38 ms PC-HOME [192.168.10.249]

10 64 ms 38 ms 39 ms PC-HOME [192.168.10.249]

11 40 ms 40 ms 39 ms PC-HOME [192.168.10.249]

12 67 ms 37 ms 38 ms PC-HOME [192.168.10.249]

13 38 ms 40 ms 110 ms PC-HOME [192.168.10.249]

14 60 ms 99 ms 41 ms PC-HOME [192.168.10.249]

15 42 ms 450 ms 40 ms PC-HOME [192.168.10.249]

16 45 ms 99 ms 40 ms PC-HOME [192.168.10.249]

17 40 ms 52 ms 96 ms 192.168.10.1

18 94 ms 44 ms 42 ms PC-HOME [192.168.10.249]

19 94 ms 99 ms 100 ms 192.168.10.1

20 42 ms 42 ms 42 ms PC-HOME [192.168.10.249]

21 42 ms 42 ms 114 ms 192.168.10.1

22 46 ms 41 ms 41 ms PC-HOME [192.168.10.249]

23 41 ms 42 ms 138 ms 192.168.10.1

24 41 ms 42 ms 43 ms PC-HOME [192.168.10.249]

25 43 ms 98 ms 100 ms 192.168.10.1

26 41 ms 44 ms 43 ms PC-HOME [192.168.10.249]

27 127 ms 99 ms 97 ms 192.168.10.1

28 45 ms 42 ms 45 ms PC-HOME [192.168.10.249]

29 77 ms 100 ms 98 ms 192.168.10.1

30 97 ms 44 ms 48 ms PC-HOME [192.168.10.249]

Trace complete.

dentalan

I think I found the problem, now seeking the solution
I connected via telenet to the vpn server and typed the status command:

status
OpenVPN CLIENT LIST
Updated,Fri May 17 11:28:49 2013
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
client3,xx.xx.xx.106:1938,1305094,6951076,Fri May 17 07:56:26 2013
client4,yy.yy.yy.218:55546,1303670,263014,Fri May 17 07:34:08 2013
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
192.168.10.0/24,client4,xx.xx.xx.218:55546,Fri May 17 07:34:09 2013
10.10.11.0/24,client3,yy.yy.yy.106:1938,Fri May 17 07:56:40 2013
10.8.1.6,client3,xx.xx.xx.106:1938,Fri May 17 11:28:49 2013
10.8.1.10,client4,yy.yy.yy.218:55546,Fri May 17 11:28:46 2013
10.10.11.10C,client3,xx.xx.xx.106:1938,Fri May 17 11:28:48 2013
GLOBAL STATS
Max bcast/mcast queue length,1
END

The strange here is the line that says 10.10.11.10C.....
the IP 10.10.11.10 is a laptop connected to the client3 LAN via WiFi and has vpn connectivity to both directions. I notice that there are not any other similar entries for other IPs in client3 network
Now I go to laptop that is connected to the client3 LAN via cable (ethernet, cat5e) and hasNOT vpm connectivity. I dissable this connection. Then connect it to the LAN with wifi. Now look at the status commend on the vpn server

status
OpenVPN CLIENT LIST
Updated,Fri May 17 11:42:46 2013
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
client3,xx.xx.xx.106:1938,2196553,9338207,Fri May 17 07:56:26 2013
client4,yy.yy.yy.218:55546,1312679,273451,Fri May 17 07:34:08 2013
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
192.168.10.0/24,client4,yy.yy.yy.218:55546,Fri May 17 07:34:09 2013
10.10.11.0/24,client3,xx.xx.xx.106:1938,Fri May 17 07:56:40 2013
192.168.10.6C,client4,yy.yy.yy.218:55546,Fri May 17 11:42:35 2013
10.8.1.6,client3,xx.xx.xx.106:1938,Fri May 17 11:42:45 2013
10.8.1.10,client4,yy.yy.yy.218:55546,Fri May 17 11:38:46 2013
10.10.11.15C,client3,xx.xx.xx.106:1938,Fri May 17 11:41:56 2013
10.10.11.10C,client3,xx.xx.xx.106:1938,Fri May 17 11:42:42 2013
GLOBAL STATS
Max bcast/mcast queue length,1
END

an new line was added: " 10.10.11.15C...." which is the IP of the second laptop, which now has VPN connectivity
So I think that there is a routing problem on the client3 LAN gateway which routes only devices connected via wifi and not cable connections. Do you find it possible?

janjust

it's possible but that should show up in the routing tables of the LAN3 router ... does it work with the laptop disconnected from the ethernet cable?

dentalan

I didn't quiet understand what you ask but yes the Ethernet cable is disconnected (the device is deactivated ).It only appears when the laptop is connected on wifi . If i reconnect it with cable it losses vpn connectivity .

dentalan

I did a litle more search
This happens to the other subnet too (192.168.10.0). Every device is connected to the wifi has vpn connectivity. Every device that is connected via ethernet cable has not VPN connectivity.
It does not matter if it has a static IP or a dynamic one. It has to be connected on WiFi.
The router is a a Thompson 585
The command to add a route on this device is

ip rtadd dst=10.10.11.0 msk=24, gateway=192.168.10.249 interface = LocalNetwork

I am stuck again

janjust

I'm afraid this is outside the realm of OpenVPN - it sounds like a Thomson routing issue (although I've used similar routers in the past without too many problems).

dentalan

I did the following try and I had some interesting results
On the subnet (client4, 192.168.10.0/24 -10.8.1.14/24) I have a simple access point with the IP=192.168.10.251. This IP is pingable and the web server is accessible from inside the local subnet(192.168.10.0), but not from the VPN. I changed it's IP to 192.168.10.51 and now I can ping it from the VPN.
The AP is connected to the Thomson router with cable.
Something is missing. I am going to try it to the other subnet.

dentalan

I tried it too to the other client subnet (10.10.11.0/24) changing te IP 10.10.11.237 to 10.10.11.51 but no luck
Here the router is a Huawei HG530u and 10.10.11.237 is a DVR connected by cable
I also tried the IPs 10.10.11.14 and 10.10.11.28. Nothing

This is a tracert from a laptop on the server side to this IP on the client. What I do not undestand is the dupicate 2 and 3 lines

Tracing route to 10.10.11.28 over a maximum of 30 hops



  1     1 ms     *       <1 ms  PC3 [192.168.1.148] 'This is the VPN Server

  2    39 ms    37 ms    38 ms  ANASTOFFICE [10.8.1.6] 'This is the clients side VPN gateway

  3    40 ms    37 ms     *     ANASTOFFICE [10.8.1.6] 'This is the clients side VPN gateway

  4     *        *        *     Request timed out.

  5     *        *        *     Request timed out.

  6

dentalan

This is the log of the connection sequence from the client side (where the huawei router is located)

Tue May 28 09:50:08 2013 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Tue May 28 09:50:08 2013 MANAGEMENT: TCP Socket listening on 127.0.0.1:23
Tue May 28 09:50:08 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue May 28 09:50:09 2013 LZO compression initialized
Tue May 28 09:50:09 2013 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue May 28 09:50:09 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue May 28 09:50:09 2013 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue May 28 09:50:09 2013 Local Options hash (VER=V4): '41690919'
Tue May 28 09:50:09 2013 Expected Remote Options hash (VER=V4): '530fdded'
Tue May 28 09:50:09 2013 UDPv4 link local: [undef]
Tue May 28 09:50:09 2013 UDPv4 link remote: xxx.xxx.xxx.xxx:1194
Tue May 28 09:50:09 2013 TLS: Initial packet from xxx.xxx.xxx.xxx:1194, sid=a527836c 509f3565
Tue May 28 09:50:09 2013 VERIFY OK: depth=1, /C=GR/ST=GR/L=Larisa/O=OpenDent/OU=Main/CN=Dent/name=John/emailAddress=xxxx@gmail.com
Tue May 28 09:50:09 2013 VERIFY OK: nsCertType=SERVER
Tue May 28 09:50:09 2013 VERIFY OK: depth=0, /C=GR/ST=GR/L=Larisa/O=OpenDENT/OU=Main/CN=server/name=John/emailAddress=xxx@gmail.com
Tue May 28 09:50:10 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue May 28 09:50:10 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue May 28 09:50:10 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue May 28 09:50:10 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue May 28 09:50:10 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue May 28 09:50:10 2013 [server] Peer Connection Initiated with xxx.xxx.xxx.xxx:1194
Tue May 28 09:50:12 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue May 28 09:50:12 2013 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 192.168.10.0 255.255.255.0,route 10.8.1.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.1.6 10.8.1.5'
Tue May 28 09:50:12 2013 OPTIONS IMPORT: timers and/or timeouts modified
Tue May 28 09:50:12 2013 OPTIONS IMPORT: --ifconfig/up options modified
Tue May 28 09:50:12 2013 OPTIONS IMPORT: route options modified
Tue May 28 09:50:12 2013 ROUTE default_gateway=10.10.11.1
Tue May 28 09:50:12 2013 TAP-WIN32 device [TAP-Win32] opened: \\.\Global\{558901D0-2C20-4504-A6F9-75803EC79C7F}.tap
Tue May 28 09:50:12 2013 TAP-Win32 Driver Version 9.9 
Tue May 28 09:50:12 2013 TAP-Win32 MTU=1500
Tue May 28 09:50:12 2013 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.1.6/255.255.255.252 on interface {558901D0-2C20-4504-A6F9-75803EC79C7F} [DHCP-serv: 10.8.1.5, lease-time: 31536000]
Tue May 28 09:50:12 2013 Successful ARP Flush on interface [3] {558901D0-2C20-4504-A6F9-75803EC79C7F}
Tue May 28 09:50:17 2013 TEST ROUTES: 3/3 succeeded len=3 ret=1 a=0 u/d=up
Tue May 28 09:50:17 2013 C:\WINDOWS\system32\route.exe ADD 192.168.1.0 MASK 255.255.255.0 10.8.1.5
Tue May 28 09:50:17 2013 Route addition via IPAPI succeeded [adaptive]
Tue May 28 09:50:17 2013 C:\WINDOWS\system32\route.exe ADD 192.168.10.0 MASK 255.255.255.0 10.8.1.5
Tue May 28 09:50:17 2013 Route addition via IPAPI succeeded [adaptive]
Tue May 28 09:50:17 2013 C:\WINDOWS\system32\route.exe ADD 10.8.1.0 MASK 255.255.255.0 10.8.1.5
Tue May 28 09:50:17 2013 Route addition via IPAPI succeeded [adaptive]
Tue May 28 09:50:17 2013 Initialization Sequence Completed

and this from the server side

Tue May 28 07:31:34 2013 us=344000 Current Parameter Settings:
Tue May 28 07:31:34 2013 us=344000   config = 'server.ovpn'
Tue May 28 07:31:34 2013 us=344000   mode = 1
Tue May 28 07:31:34 2013 us=344000   show_ciphers = DISABLED
Tue May 28 07:31:34 2013 us=344000   show_digests = DISABLED
Tue May 28 07:31:34 2013 us=344000   show_engines = DISABLED
Tue May 28 07:31:34 2013 us=344000   genkey = DISABLED
Tue May 28 07:31:34 2013 us=344000   key_pass_file = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   show_tls_ciphers = DISABLED
Tue May 28 07:31:34 2013 us=344000 Connection profiles [default]:
Tue May 28 07:31:34 2013 us=344000   proto = udp
Tue May 28 07:31:34 2013 us=344000   local = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   local_port = 1194
Tue May 28 07:31:34 2013 us=344000   remote = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   remote_port = 1194
Tue May 28 07:31:34 2013 us=344000   remote_float = DISABLED
Tue May 28 07:31:34 2013 us=344000   bind_defined = DISABLED
Tue May 28 07:31:34 2013 us=344000   bind_local = ENABLED
Tue May 28 07:31:34 2013 us=344000   connect_retry_seconds = 5
Tue May 28 07:31:34 2013 us=344000   connect_timeout = 10
Tue May 28 07:31:34 2013 us=344000   connect_retry_max = 0
Tue May 28 07:31:34 2013 us=344000   socks_proxy_server = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   socks_proxy_port = 0
Tue May 28 07:31:34 2013 us=344000   socks_proxy_retry = DISABLED
Tue May 28 07:31:34 2013 us=344000 Connection profiles END
Tue May 28 07:31:34 2013 us=344000   remote_random = DISABLED
Tue May 28 07:31:34 2013 us=344000   ipchange = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   dev = 'tun'
Tue May 28 07:31:34 2013 us=344000   dev_type = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   dev_node = 'TAP-Win32'
Tue May 28 07:31:34 2013 us=344000   lladdr = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   topology = 1
Tue May 28 07:31:34 2013 us=344000   tun_ipv6 = DISABLED
Tue May 28 07:31:34 2013 us=344000   ifconfig_local = '10.8.1.1'
Tue May 28 07:31:34 2013 us=344000   ifconfig_remote_netmask = '10.8.1.2'
Tue May 28 07:31:34 2013 us=344000   ifconfig_noexec = DISABLED
Tue May 28 07:31:34 2013 us=344000   ifconfig_nowarn = DISABLED
Tue May 28 07:31:34 2013 us=344000   shaper = 0
Tue May 28 07:31:34 2013 us=344000   tun_mtu = 1500
Tue May 28 07:31:34 2013 us=344000   tun_mtu_defined = ENABLED
Tue May 28 07:31:34 2013 us=344000   link_mtu = 1500
Tue May 28 07:31:34 2013 us=344000   link_mtu_defined = DISABLED
Tue May 28 07:31:34 2013 us=344000   tun_mtu_extra = 0
Tue May 28 07:31:34 2013 us=344000   tun_mtu_extra_defined = DISABLED
Tue May 28 07:31:34 2013 us=344000   fragment = 0
Tue May 28 07:31:34 2013 us=344000   mtu_discover_type = -1
Tue May 28 07:31:34 2013 us=344000   mtu_test = 0
Tue May 28 07:31:34 2013 us=344000   mlock = DISABLED
Tue May 28 07:31:34 2013 us=344000   keepalive_ping = 10
Tue May 28 07:31:34 2013 us=344000   keepalive_timeout = 120
Tue May 28 07:31:34 2013 us=344000   inactivity_timeout = 0
Tue May 28 07:31:34 2013 us=344000   ping_send_timeout = 10
Tue May 28 07:31:34 2013 us=344000   ping_rec_timeout = 240
Tue May 28 07:31:34 2013 us=344000   ping_rec_timeout_action = 2
Tue May 28 07:31:34 2013 us=344000   ping_timer_remote = DISABLED
Tue May 28 07:31:34 2013 us=344000   remap_sigusr1 = 0
Tue May 28 07:31:34 2013 us=344000   explicit_exit_notification = 0
Tue May 28 07:31:34 2013 us=344000   persist_tun = ENABLED
Tue May 28 07:31:34 2013 us=344000   persist_local_ip = DISABLED
Tue May 28 07:31:34 2013 us=344000   persist_remote_ip = DISABLED
Tue May 28 07:31:34 2013 us=344000   persist_key = ENABLED
Tue May 28 07:31:34 2013 us=344000   mssfix = 1450
Tue May 28 07:31:34 2013 us=344000   resolve_retry_seconds = 1000000000
Tue May 28 07:31:34 2013 us=344000   username = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   groupname = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   chroot_dir = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   cd_dir = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   writepid = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   up_script = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   down_script = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   down_pre = DISABLED
Tue May 28 07:31:34 2013 us=344000   up_restart = DISABLED
Tue May 28 07:31:34 2013 us=344000   up_delay = DISABLED
Tue May 28 07:31:34 2013 us=344000   daemon = DISABLED
Tue May 28 07:31:34 2013 us=344000   inetd = 0
Tue May 28 07:31:34 2013 us=344000   log = DISABLED
Tue May 28 07:31:34 2013 us=344000   suppress_timestamps = DISABLED
Tue May 28 07:31:34 2013 us=344000   nice = 0
Tue May 28 07:31:34 2013 us=344000   verbosity = 6
Tue May 28 07:31:34 2013 us=344000   mute = 0
Tue May 28 07:31:34 2013 us=344000   gremlin = 0
Tue May 28 07:31:34 2013 us=344000   status_file = 'openvpn-status.log'
Tue May 28 07:31:34 2013 us=344000   status_file_version = 1
Tue May 28 07:31:34 2013 us=344000   status_file_update_freq = 60
Tue May 28 07:31:34 2013 us=344000   occ = ENABLED
Tue May 28 07:31:34 2013 us=344000   rcvbuf = 0
Tue May 28 07:31:34 2013 us=344000   sndbuf = 0
Tue May 28 07:31:34 2013 us=344000   sockflags = 0
Tue May 28 07:31:34 2013 us=344000   fast_io = DISABLED
Tue May 28 07:31:34 2013 us=344000   lzo = 7
Tue May 28 07:31:34 2013 us=344000   route_script = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   route_default_gateway = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   route_default_metric = 0
Tue May 28 07:31:34 2013 us=344000   route_noexec = DISABLED
Tue May 28 07:31:34 2013 us=344000   route_delay = 0
Tue May 28 07:31:34 2013 us=344000   route_delay_window = 30
Tue May 28 07:31:34 2013 us=344000   route_delay_defined = DISABLED
Tue May 28 07:31:34 2013 us=344000   route_nopull = DISABLED
Tue May 28 07:31:34 2013 us=344000   route_gateway_via_dhcp = DISABLED
Tue May 28 07:31:34 2013 us=344000   max_routes = 100
Tue May 28 07:31:34 2013 us=344000   allow_pull_fqdn = DISABLED
Tue May 28 07:31:34 2013 us=344000   route 10.10.11.0/255.255.255.0/nil/nil
Tue May 28 07:31:34 2013 us=344000   route 192.168.10.0/255.255.255.0/nil/nil
Tue May 28 07:31:34 2013 us=344000   route 10.8.1.0/255.255.255.0/nil/nil
Tue May 28 07:31:34 2013 us=344000   management_addr = 'localhost'
Tue May 28 07:31:34 2013 us=344000   management_port = 23
Tue May 28 07:31:34 2013 us=344000   management_user_pass = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   management_log_history_cache = 250
Tue May 28 07:31:34 2013 us=344000   management_echo_buffer_size = 100
Tue May 28 07:31:34 2013 us=344000   management_write_peer_info_file = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   management_client_user = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   management_client_group = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   management_flags = 0
Tue May 28 07:31:34 2013 us=344000   shared_secret_file = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   key_direction = 0
Tue May 28 07:31:34 2013 us=344000   ciphername_defined = ENABLED
Tue May 28 07:31:34 2013 us=344000   ciphername = 'BF-CBC'
Tue May 28 07:31:34 2013 us=344000   authname_defined = ENABLED
Tue May 28 07:31:34 2013 us=344000   authname = 'SHA1'
Tue May 28 07:31:34 2013 us=344000   prng_hash = 'SHA1'
Tue May 28 07:31:34 2013 us=344000   prng_nonce_secret_len = 16
Tue May 28 07:31:34 2013 us=344000   keysize = 0
Tue May 28 07:31:34 2013 us=344000   engine = DISABLED
Tue May 28 07:31:34 2013 us=344000   replay = ENABLED
Tue May 28 07:31:34 2013 us=344000   mute_replay_warnings = DISABLED
Tue May 28 07:31:34 2013 us=344000   replay_window = 64
Tue May 28 07:31:34 2013 us=344000   replay_time = 15
Tue May 28 07:31:34 2013 us=344000   packet_id_file = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   use_iv = ENABLED
Tue May 28 07:31:34 2013 us=344000   test_crypto = DISABLED
Tue May 28 07:31:34 2013 us=344000   tls_server = ENABLED
Tue May 28 07:31:34 2013 us=344000   tls_client = DISABLED
Tue May 28 07:31:34 2013 us=344000   key_method = 2
Tue May 28 07:31:34 2013 us=344000   ca_file = 'ca.crt'
Tue May 28 07:31:34 2013 us=344000   ca_path = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   dh_file = 'dh1024.pem'
Tue May 28 07:31:34 2013 us=344000   cert_file = 'server.crt'
Tue May 28 07:31:34 2013 us=344000   priv_key_file = 'server.key'
Tue May 28 07:31:34 2013 us=344000   pkcs12_file = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   cryptoapi_cert = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   cipher_list = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   tls_verify = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   tls_export_cert = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   tls_remote = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   crl_file = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   ns_cert_type = 0
Tue May 28 07:31:34 2013 us=344000   remote_cert_ku[i] = 0
Tue May 28 07:31:34 2013 us=344000   remote_cert_ku[i] = 0
Tue May 28 07:31:34 2013 us=344000   remote_cert_ku[i] = 0
Tue May 28 07:31:34 2013 us=344000   remote_cert_ku[i] = 0
Tue May 28 07:31:34 2013 us=344000   remote_cert_ku[i] = 0
Tue May 28 07:31:34 2013 us=344000   remote_cert_ku[i] = 0
Tue May 28 07:31:34 2013 us=344000   remote_cert_ku[i] = 0
Tue May 28 07:31:34 2013 us=344000   remote_cert_ku[i] = 0
Tue May 28 07:31:34 2013 us=344000   remote_cert_ku[i] = 0
Tue May 28 07:31:34 2013 us=344000   remote_cert_ku[i] = 0
Tue May 28 07:31:34 2013 us=344000   remote_cert_ku[i] = 0
Tue May 28 07:31:34 2013 us=344000   remote_cert_ku[i] = 0
Tue May 28 07:31:34 2013 us=344000   remote_cert_ku[i] = 0
Tue May 28 07:31:34 2013 us=344000   remote_cert_ku[i] = 0
Tue May 28 07:31:34 2013 us=344000   remote_cert_ku[i] = 0
Tue May 28 07:31:34 2013 us=344000   remote_cert_ku[i] = 0
Tue May 28 07:31:34 2013 us=344000   remote_cert_eku = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   tls_timeout = 2
Tue May 28 07:31:34 2013 us=344000   renegotiate_bytes = 0
Tue May 28 07:31:34 2013 us=344000   renegotiate_packets = 0
Tue May 28 07:31:34 2013 us=344000   renegotiate_seconds = 3600
Tue May 28 07:31:34 2013 us=344000   handshake_window = 60
Tue May 28 07:31:34 2013 us=344000   transition_window = 3600
Tue May 28 07:31:34 2013 us=344000   single_session = DISABLED
Tue May 28 07:31:34 2013 us=344000   push_peer_info = DISABLED
Tue May 28 07:31:34 2013 us=344000   tls_exit = DISABLED
Tue May 28 07:31:34 2013 us=344000   tls_auth_file = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   pkcs11_protected_authentication = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_protected_authentication = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_protected_authentication = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_protected_authentication = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_protected_authentication = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_protected_authentication = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_protected_authentication = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_protected_authentication = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_protected_authentication = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_protected_authentication = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_protected_authentication = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_protected_authentication = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_protected_authentication = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_protected_authentication = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_protected_authentication = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_protected_authentication = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_private_mode = 00000000
Tue May 28 07:31:34 2013 us=344000   pkcs11_private_mode = 00000000
Tue May 28 07:31:34 2013 us=344000   pkcs11_private_mode = 00000000
Tue May 28 07:31:34 2013 us=344000   pkcs11_private_mode = 00000000
Tue May 28 07:31:34 2013 us=344000   pkcs11_private_mode = 00000000
Tue May 28 07:31:34 2013 us=344000   pkcs11_private_mode = 00000000
Tue May 28 07:31:34 2013 us=344000   pkcs11_private_mode = 00000000
Tue May 28 07:31:34 2013 us=344000   pkcs11_private_mode = 00000000
Tue May 28 07:31:34 2013 us=344000   pkcs11_private_mode = 00000000
Tue May 28 07:31:34 2013 us=344000   pkcs11_private_mode = 00000000
Tue May 28 07:31:34 2013 us=344000   pkcs11_private_mode = 00000000
Tue May 28 07:31:34 2013 us=344000   pkcs11_private_mode = 00000000
Tue May 28 07:31:34 2013 us=344000   pkcs11_private_mode = 00000000
Tue May 28 07:31:34 2013 us=344000   pkcs11_private_mode = 00000000
Tue May 28 07:31:34 2013 us=344000   pkcs11_private_mode = 00000000
Tue May 28 07:31:34 2013 us=344000   pkcs11_private_mode = 00000000
Tue May 28 07:31:34 2013 us=344000   pkcs11_cert_private = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_cert_private = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_cert_private = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_cert_private = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_cert_private = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_cert_private = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_cert_private = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_cert_private = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_cert_private = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_cert_private = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_cert_private = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_cert_private = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_cert_private = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_cert_private = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_cert_private = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_cert_private = DISABLED
Tue May 28 07:31:34 2013 us=344000   pkcs11_pin_cache_period = -1
Tue May 28 07:31:34 2013 us=344000   pkcs11_id = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   pkcs11_id_management = DISABLED
Tue May 28 07:31:34 2013 us=344000   server_network = 10.8.1.0
Tue May 28 07:31:34 2013 us=344000   server_netmask = 255.255.255.0
Tue May 28 07:31:34 2013 us=344000   server_bridge_ip = 0.0.0.0
Tue May 28 07:31:34 2013 us=344000   server_bridge_netmask = 0.0.0.0
Tue May 28 07:31:34 2013 us=344000   server_bridge_pool_start = 0.0.0.0
Tue May 28 07:31:34 2013 us=344000   server_bridge_pool_end = 0.0.0.0
Tue May 28 07:31:34 2013 us=344000   push_entry = 'route 192.168.1.0 255.255.255.0'
Tue May 28 07:31:34 2013 us=344000   push_entry = 'route 10.10.11.0 255.255.255.0'
Tue May 28 07:31:34 2013 us=344000   push_entry = 'route 192.168.10.0 255.255.255.0'
Tue May 28 07:31:34 2013 us=344000   push_entry = 'route 10.8.1.0 255.255.255.0'
Tue May 28 07:31:34 2013 us=344000   push_entry = 'topology net30'
Tue May 28 07:31:34 2013 us=344000   push_entry = 'ping 10'
Tue May 28 07:31:34 2013 us=344000   push_entry = 'ping-restart 120'
Tue May 28 07:31:34 2013 us=344000   ifconfig_pool_defined = ENABLED
Tue May 28 07:31:34 2013 us=344000   ifconfig_pool_start = 10.8.1.4
Tue May 28 07:31:34 2013 us=344000   ifconfig_pool_end = 10.8.1.251
Tue May 28 07:31:34 2013 us=344000   ifconfig_pool_netmask = 0.0.0.0
Tue May 28 07:31:34 2013 us=344000   ifconfig_pool_persist_filename = 'ipp.txt'
Tue May 28 07:31:34 2013 us=344000   ifconfig_pool_persist_refresh_freq = 600
Tue May 28 07:31:34 2013 us=344000   n_bcast_buf = 256
Tue May 28 07:31:34 2013 us=344000   tcp_queue_limit = 64
Tue May 28 07:31:34 2013 us=344000   real_hash_size = 256
Tue May 28 07:31:34 2013 us=344000   virtual_hash_size = 256
Tue May 28 07:31:34 2013 us=344000   client_connect_script = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   learn_address_script = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   client_disconnect_script = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   client_config_dir = 'ccd'
Tue May 28 07:31:34 2013 us=344000   ccd_exclusive = DISABLED
Tue May 28 07:31:34 2013 us=344000   tmp_dir = 'C:\Windows\TEMP\'
Tue May 28 07:31:34 2013 us=344000   push_ifconfig_defined = DISABLED
Tue May 28 07:31:34 2013 us=344000   push_ifconfig_local = 0.0.0.0
Tue May 28 07:31:34 2013 us=344000   push_ifconfig_remote_netmask = 0.0.0.0
Tue May 28 07:31:34 2013 us=344000   enable_c2c = ENABLED
Tue May 28 07:31:34 2013 us=344000   duplicate_cn = DISABLED
Tue May 28 07:31:34 2013 us=344000   cf_max = 0
Tue May 28 07:31:34 2013 us=344000   cf_per = 0
Tue May 28 07:31:34 2013 us=344000   max_clients = 1024
Tue May 28 07:31:34 2013 us=344000   max_routes_per_client = 256
Tue May 28 07:31:34 2013 us=344000   auth_user_pass_verify_script = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   auth_user_pass_verify_script_via_file = DISABLED
Tue May 28 07:31:34 2013 us=344000   ssl_flags = 0
Tue May 28 07:31:34 2013 us=344000   client = DISABLED
Tue May 28 07:31:34 2013 us=344000   pull = DISABLED
Tue May 28 07:31:34 2013 us=344000   auth_user_pass_file = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   show_net_up = DISABLED
Tue May 28 07:31:34 2013 us=344000   route_method = 0
Tue May 28 07:31:34 2013 us=344000   ip_win32_defined = DISABLED
Tue May 28 07:31:34 2013 us=344000   ip_win32_type = 3
Tue May 28 07:31:34 2013 us=344000   dhcp_masq_offset = 0
Tue May 28 07:31:34 2013 us=344000   dhcp_lease_time = 31536000
Tue May 28 07:31:34 2013 us=344000   tap_sleep = 10
Tue May 28 07:31:34 2013 us=344000   dhcp_options = DISABLED
Tue May 28 07:31:34 2013 us=344000   dhcp_renew = DISABLED
Tue May 28 07:31:34 2013 us=344000   dhcp_pre_release = DISABLED
Tue May 28 07:31:34 2013 us=344000   dhcp_release = DISABLED
Tue May 28 07:31:34 2013 us=344000   domain = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   netbios_scope = '[UNDEF]'
Tue May 28 07:31:34 2013 us=344000   netbios_node_type = 0
Tue May 28 07:31:34 2013 us=344000   disable_nbt = DISABLED
Tue May 28 07:31:34 2013 us=344000 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Tue May 28 07:31:34 2013 us=344000 MANAGEMENT: TCP Socket listening on 127.0.0.1:23
Tue May 28 07:31:34 2013 us=360000 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Tue May 28 07:31:34 2013 us=360000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue May 28 07:31:34 2013 us=578000 Diffie-Hellman initialized with 1024 bit key
Tue May 28 07:31:34 2013 us=625000 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue May 28 07:31:34 2013 us=625000 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue May 28 07:31:34 2013 us=625000 ROUTE default_gateway=192.168.1.254
Tue May 28 07:31:34 2013 us=625000 TAP-WIN32 device [TAP-Win32] opened: \\.\Global\{5F045232-8392-494E-A4A6-1CCC38B70B8B}.tap
Tue May 28 07:31:34 2013 us=625000 TAP-Win32 Driver Version 9.9 
Tue May 28 07:31:34 2013 us=625000 TAP-Win32 MTU=1500
Tue May 28 07:31:34 2013 us=625000 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.1.1/255.255.255.252 on interface {5F045232-8392-494E-A4A6-1CCC38B70B8B} [DHCP-serv: 10.8.1.2, lease-time: 31536000]
Tue May 28 07:31:34 2013 us=625000 Sleeping for 10 seconds...
Tue May 28 07:31:44 2013 us=765000 Successful ARP Flush on interface [20] {5F045232-8392-494E-A4A6-1CCC38B70B8B}
Tue May 28 07:31:44 2013 us=765000 C:\WINDOWS\system32\route.exe ADD 10.10.11.0 MASK 255.255.255.0 10.8.1.2
Tue May 28 07:31:44 2013 us=765000 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue May 28 07:31:44 2013 us=765000 Route addition via IPAPI succeeded [adaptive]
Tue May 28 07:31:44 2013 us=765000 C:\WINDOWS\system32\route.exe ADD 192.168.10.0 MASK 255.255.255.0 10.8.1.2
Tue May 28 07:31:44 2013 us=765000 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue May 28 07:31:44 2013 us=765000 Route addition via IPAPI succeeded [adaptive]
Tue May 28 07:31:44 2013 us=765000 C:\WINDOWS\system32\route.exe ADD 10.8.1.0 MASK 255.255.255.0 10.8.1.2
Tue May 28 07:31:44 2013 us=765000 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue May 28 07:31:44 2013 us=765000 Route addition via IPAPI succeeded [adaptive]
Tue May 28 07:31:44 2013 us=765000 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue May 28 07:31:44 2013 us=765000 UDPv4 link local (bound): [undef]:1194
Tue May 28 07:31:44 2013 us=765000 UDPv4 link remote: [undef]
Tue May 28 07:31:44 2013 us=765000 MULTI: multi_init called, r=256 v=256
Tue May 28 07:31:44 2013 us=765000 IFCONFIG POOL: base=10.8.1.4 size=62
Tue May 28 07:31:44 2013 us=765000 IFCONFIG POOL LIST
Tue May 28 07:31:44 2013 us=765000 client3,10.8.1.4
Tue May 28 07:31:44 2013 us=765000 client4,10.8.1.8
Tue May 28 07:31:44 2013 us=765000 Galaxy,10.8.1.12
Tue May 28 07:31:44 2013 us=765000 PC2,10.8.1.16
Tue May 28 07:31:44 2013 us=765000 acer1,10.8.1.20
Tue May 28 07:31:44 2013 us=765000 Initialization Sequence Completed
Tue May 28 07:31:44 2013 us=781000 MULTI: multi_create_instance called
Tue May 28 07:31:44 2013 us=781000 xx.xx.xxx.xxx:51175 Re-using SSL/TLS context
Tue May 28 07:31:44 2013 us=781000 xx.xx.xxx.xxx:51175 LZO compression initialized
Tue May 28 07:31:44 2013 us=781000 xx.xx.xxx.xxx:51175 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue May 28 07:31:44 2013 us=781000 xx.xx.xxx.xxx:51175 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue May 28 07:31:44 2013 us=781000 xx.xx.xxx.xxx:51175 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Tue May 28 07:31:44 2013 us=781000 xx.xx.xxx.xxx:51175 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Tue May 28 07:31:44 2013 us=781000 xx.xx.xxx.xxx:51175 Local Options hash (VER=V4): '530fdded'
Tue May 28 07:31:44 2013 us=781000 xx.xx.xxx.xxx:51175 Expected Remote Options hash (VER=V4): '41690919'
Tue May 28 07:31:44 2013 us=781000 xx.xx.xxx.xxx:51175 UDPv4 READ [14] from xx.xx.xxx.xxx:51175: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Tue May 28 07:31:44 2013 us=781000 xx.xx.xxx.xxx:51175 TLS: Initial packet from xx.xx.xxx.xxx:51175, sid=de1a55ca 28e90be9
Tue May 28 07:31:44 2013 us=781000 xx.xx.xxx.xxx:51175 UDPv4 WRITE [26] to xx.xx.xxx.xxx:51175: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ 0 ] pid=0 DATA len=0
Tue May 28 07:31:44 2013 us=781000 xx.xx.xxx.xxx:51175 UDPv4 READ [14] from xx.xx.xxx.xxx:51175: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Tue May 28 07:31:44 2013 us=781000 xx.xx.xxx.xxx:51175 UDPv4 WRITE [22] to xx.xx.xxx.xxx:51175: P_ACK_V1 kid=0 [ 0 ]

janjust

the client and server logs don't show anything too weird with the Huawei router; what do the routing tables look like on the router, the client and the openvpn server after the VPN has been established? you ARE changing subnets everytime as far as I can tell.

I must also add that I've lost focus of this topic a bit :?

dentalan

I must admit that I am experimenting all the time to find out what is going wrong
Today I changed the subnet 192.168.1.0 to 192.168.20.0 to avoid possible conflicts

This is the "route print" command on the server after the vpn is established

          0.0.0.0          0.0.0.0   192.168.20.254   192.168.20.148    266
         10.8.1.0    255.255.255.0         10.8.1.2         10.8.1.1     30
         10.8.1.0  255.255.255.252      ‹ ©η¤›©          10.8.1.1    286
         10.8.1.1  255.255.255.255      ‹ ©η¤›©          10.8.1.1    286
         10.8.1.3  255.255.255.255      ‹ ©η¤›©          10.8.1.1    286
       10.10.11.0    255.255.255.0         10.8.1.2         10.8.1.1     30
        127.0.0.0        255.0.0.0      ‹ ©η¤›©         127.0.0.1    306
        127.0.0.1  255.255.255.255      ‹ ©η¤›©         127.0.0.1    306
  127.255.255.255  255.255.255.255      ‹ ©η¤›©         127.0.0.1    306
     192.168.10.0    255.255.255.0         10.8.1.2         10.8.1.1     30
     192.168.20.0    255.255.255.0      ‹ ©η¤›©    192.168.20.148    266
   192.168.20.148  255.255.255.255      ‹ ©η¤›©    192.168.20.148    266
   192.168.20.255  255.255.255.255      ‹ ©η¤›©    192.168.20.148    266
        224.0.0.0        240.0.0.0      ‹ ©η¤›©         127.0.0.1    306
        224.0.0.0        240.0.0.0      ‹ ©η¤›©    192.168.20.148    266
        224.0.0.0        240.0.0.0      ‹ ©η¤›©          10.8.1.1    286
  255.255.255.255  255.255.255.255      ‹ ©η¤›©         127.0.0.1    306
  255.255.255.255  255.255.255.255      ‹ ©η¤›©    192.168.20.148    266
  255.255.255.255  255.255.255.255      ‹ ©η¤›©          10.8.1.1    286

This is at the client

0.0.0.0 0.0.0.0 10.10.11.1 10.10.11.5 20
10.8.1.0 255.255.255.0 10.8.1.5 10.8.1.6 1
10.8.1.4 255.255.255.252 10.8.1.6 10.8.1.6 30
10.8.1.6 255.255.255.255 127.0.0.1 127.0.0.1 30
10.10.11.0 255.255.255.0 10.10.11.5 10.10.11.5 20
10.10.11.5 255.255.255.255 127.0.0.1 127.0.0.1 20
10.255.255.255 255.255.255.255 10.8.1.6 10.8.1.6 30
10.255.255.255 255.255.255.255 10.10.11.5 10.10.11.5 20
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.10.0 255.255.255.0 10.8.1.5 10.8.1.6 1
192.168.20.0 255.255.255.0 10.8.1.5 10.8.1.6 1
224.0.0.0 240.0.0.0 10.8.1.6 10.8.1.6 30
224.0.0.0 240.0.0.0 10.10.11.5 10.10.11.5 20
255.255.255.255 255.255.255.255 10.8.1.6 10.8.1.6 1
255.255.255.255 255.255.255.255 10.8.1.6 4 1
255.255.255.255 255.255.255.255 10.10.11.5 10.10.11.5

and this is to the huawei router

Destination	Network Address	Default Gateway	Subnet Mask	Interface 
80.106.108.22	0.0.0.0	255.255.255.255	ppp256 
192.168.20.0	10.10.11.5	255.255.255.0	br0 
10.8.1.0	10.10.11.5	255.255.255.0	br0 
192.168.10.0	10.10.11.5	255.255.255.0	br0 
10.10.11.0	0.0.0.0	255.255.255.0	br0 
239.0.0.0	0.0.0.0	255.0.0.0	br0 
0.0.0.0	80.106.108.22	0.0.0.0	ppp256

I'll try to make again a report of the network
_________________________________________________________
Home--Server: LAN = 192.168.20.0(was 192.168.1.0). VPN=10.8.1.0
Home VPN Server PC= 192.168.20.148 and 10.8.1.1
Home router 192.168.20.254.Thomson, works OK. I can see the server side devices.
_________________________________________________________
Office---Client3 : LAN 10.10.11.0
Office VPN gateway =10.10.11.5 /10.8.1.6
Office router 10.10.11.1 Huawei, Does not seem to route. When I trace a route that is initiated from a client side PC, it stops here
___________________________________________________________
Second place---client4 : LAN 192.168.10.0
Second place VPN gateway = 192.168.10.249 / 10.8.1.10
Second place router =192.168.10.1. Thomson. Works almost OK. I can ping for example the device 192.168.10.51, but if I change it to 192.168.10.251, I cannot ping it.
____________________________________________________________

I hope I made it clear now. Sorry for the mess and thank you for your effort. I am not a pro, I am just an amateur.