Tap was real easy to setup. However it seems tun interfaces are more supported and can be used by non rooted androids and jail broken iphones with little fuss.
My tap configs looked as follows
server
port 11940
proto udp
dev tap
dev-node tap0901
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server-bridge
push route 192.168.17.0 255.255.255.0 192.168.16.1
push route 192.168.18.0 255.255.255.0 192.168.16.1
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
client-config-dir ccd
route 192.168.17.0 255.255.255.0 192.168.16.1
route 192.168.18.0 255.255.255.0 192.168.16.1
client
client
dev tap
dev-node OpenVPNTap
proto udp
remote outsideaddress 11940
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
dh dh1024.pem
ns-cert-type server
comp-lzo
verb 3
script-security 2
route 192.168.16.2 255.255.255.255 192.168.16.1
route 192.168.16.190 255.255.255.255 192.168.16.1
route-method adaptive
route-delay 2
It worked to get to the 2 servers I need to get to both on the 192.168.16.0 subnet. Although after trying to configure it as a tun server I think there are a lot of mistakes in the files.
My servers IP is 192.168.16.2
its router to reach all internal subnets is 192.168.16.1
My server is a windows server 2003 machine no firewall is on the server.
My client machine is a Windows 7 machine. I run the openvpn gui as administrator so it can add routes unless there is a better way?
I need to be able to reach 192.168.16.2 and 192.168.16.190(for people that do not have login rights to 192.168.16.2)
Here is what I have so far.
server
port 11940
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 192.168.254.0 255.255.255.0
push "route 192.168.254.0 255.255.255.0"
push "route 192.168.16.0 255.255.255.0"
duplicate-cn
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
client
client
dev tun
proto udp
remote serversaddress 11940
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
dh dh1024.pem
ns-cert-type server
comp-lzo
verb 3
script-security 2
route 192.168.16.2 255.255.255.255 192.168.254.1
route 192.168.16.190 255.255.255.255 192.168.254.1
route-method adaptive
route-delay 2
I can remote desktop to 192.168.254.1 and to 192.168.16.2 but I can not reach 192.168.16.190. I use to be able to with the tap connection.
(side note:
My 192.168.16.2 is a domain controller. Because the tun method needs another IP it looks like I will need to move the openvpn server to another machine because of the other IP and Domain controllers like to have just one IP does anyone have any recommendations on how to use a tun server on a domain controller so I don't have to move it? The other server I would move it to is a linux machine if that would make any difference.)
