Tunnel all traffic doesn't work

firepower2k11

Hi,

I've installed OpenVPN on my server. I configured it, made certificates and modified server / client config files. After few problems I got the VPN running, I can acces the internet via VPN but still there is traffic, for example TeamSpeak(UDP, no option for proxy settings) which doesn't go over the tunnel.
Background: My friend has port restrictions in his hotel. Only the ports 80, 8080 and 443 are allowed but I don't know if 8080 would work for VPN, so I've changed the port for OpenVPN to 443.
I've already tried an virtual Astaro VPN, which works but it's at my home, so you have very bad connection.
Different options for "redirect-gateway" also don't work(look for the outcommented options -> ; ) (DNS Option was also outcommented)

Somebody can help me what I did wrong and how to fix it that really ALL traffic will flow through VPN?

Here are my infos:
Server IP: 188.X.X.X
VPN Network: 10.8.0.X / 24

Route / NAT

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT   
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
(from here: https://forums.openvpn.net/topic8705.html)

and

route add -net 10.8.0.0 netmask 255.255.255.0 gw 188.X.X.X

server.conf

dev tun
proto udp
port 443

# Zertifikate
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem

# Verschluesselungs Algorithmus
cipher AES-256-CBC

# Authentifizierungsmethode
auth SHA1

# Server IP
server 10.8.0.0 255.255.255.0
mode server

# DHCP Lease speichern
ifconfig-pool-persist ipp.txt

# Push routes to client
;push "route 0.0.0.0 0.0.0.0"
push "route 0.0.0.0 0.0.0.0 gw 10.8.0.1"

# DHCP DNS auf Google DNS setzen
push "dhcp-option DNS 8.8.8.8"

# Tunnel ALL
push "redirect-gateway def1 bypass-dhcp"
;push "redirect-gateway bypass-dhcp"
;push "redirect-gateway def1"
;push "redirect-gateway"

keepalive 10 120
comp-lzo

# Security
user nobody
group nogroup

persist-key
persist-tun

# Log
status /etc/openvpn/openvpn-status.log
verb 3
tls-server

client2.ovpn

dev tun
proto udp
remote 188.X.X.X
tls-client
ca ca.crt
cert client2.crt
key client2.key
pull
port 443
cipher AES-256-CBC
comp-lzo
verb 3

Greetings from Germany

firepower2k11

janjust

what does the routing table look like on the client after the VPN has come up?
does it help if you restart TeamSpeak after the VPN has come up?

firepower2k11

[EDIT]Sorry my fault, understand you wrong...

Default Gateway/DNS/DHCP: 192.168.2.1
Network: 192.168.2.0 /24
OpenVPN Server IP: 188.138.122.4 (where also TeamSpeak, Apache, ... is running)

C:\Users\root>route print
===========================================================================
Schnittstellenliste
 24...00 ff f4 aa 8b a2 ......TeamViewer VPN Adapter
 22...00 ff db 1f 42 b9 ......TAP-Windows Adapter V9
 18...00 08 c9 e1 0a fa ......TechniSat DVB-PC TV Star PCI
 14...90 2b 34 50 47 41 ......Qualcomm Atheros AR8151 PCI-E Gigabit Ethernet Con
troller (NDIS 6.20)
 11...00 30 91 10 00 26 ......Bluetooth-Gerät (PAN)
  1...........................Software Loopback Interface 1
 12...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter
 15...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter #2
 16...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
 17...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter #3
 19...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter #4
 20...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter #5
===========================================================================

IPv4-Routentabelle
===========================================================================
Aktive Routen:
     Netzwerkziel    Netzwerkmaske          Gateway    Schnittstelle Metrik
          0.0.0.0          0.0.0.0      192.168.2.1    192.168.2.116     20
          0.0.0.0        128.0.0.0         10.8.0.5         10.8.0.6      1
         10.8.0.1  255.255.255.255         10.8.0.5         10.8.0.6      1
         10.8.0.4  255.255.255.252   Auf Verbindung          10.8.0.6    257
         10.8.0.6  255.255.255.255   Auf Verbindung          10.8.0.6    257
         10.8.0.7  255.255.255.255   Auf Verbindung          10.8.0.6    257
        127.0.0.0        255.0.0.0   Auf Verbindung         127.0.0.1    306
        127.0.0.1  255.255.255.255   Auf Verbindung         127.0.0.1    306
  127.255.255.255  255.255.255.255   Auf Verbindung         127.0.0.1    306
        128.0.0.0        128.0.0.0         10.8.0.5         10.8.0.6      1
    169.254.178.0    255.255.255.0   Auf Verbindung     169.254.178.3    276
    169.254.178.3  255.255.255.255   Auf Verbindung     169.254.178.3    276
  169.254.178.255  255.255.255.255   Auf Verbindung     169.254.178.3    276
    188.138.122.4  255.255.255.255      192.168.2.1    192.168.2.116     20
      192.168.2.0    255.255.255.0   Auf Verbindung     192.168.2.116    276
      192.168.2.1  255.255.255.255      192.168.2.1    192.168.2.116     20
    192.168.2.116  255.255.255.255   Auf Verbindung     192.168.2.116    276
    192.168.2.255  255.255.255.255   Auf Verbindung     192.168.2.116    276
        224.0.0.0        240.0.0.0   Auf Verbindung         127.0.0.1    306
        224.0.0.0        240.0.0.0   Auf Verbindung     169.254.178.3    276
        224.0.0.0        240.0.0.0   Auf Verbindung     192.168.2.116    276
        224.0.0.0        240.0.0.0   Auf Verbindung          10.8.0.6    257
  255.255.255.255  255.255.255.255   Auf Verbindung         127.0.0.1    306
  255.255.255.255  255.255.255.255   Auf Verbindung     169.254.178.3    276
  255.255.255.255  255.255.255.255   Auf Verbindung     192.168.2.116    276
  255.255.255.255  255.255.255.255   Auf Verbindung          10.8.0.6    257
===========================================================================
Ständige Routen:
  Keine

IPv6-Routentabelle
===========================================================================
Aktive Routen:
 If Metrik Netzwerkziel             Gateway
  1    306 ::1/128                  Auf Verbindung
 18    276 fe80::/64                Auf Verbindung
 14    276 fe80::/64                Auf Verbindung
 22    286 fe80::/64                Auf Verbindung
 18    276 fe80::2da5:21aa:27d1:cf85/128
                                    Auf Verbindung
 22    286 fe80::550f:a61b:b491:6c71/128
                                    Auf Verbindung
 14    276 fe80::c8af:3d4c:da4a:fb76/128
                                    Auf Verbindung
  1    306 ff00::/8                 Auf Verbindung
 18    276 ff00::/8                 Auf Verbindung
 14    276 ff00::/8                 Auf Verbindung
 22    286 ff00::/8                 Auf Verbindung
===========================================================================
Ständige Routen:
  Keine

Nope, restart of TS didn't help. Steam also didn't work.

Next thing I had to realise:
The VPN works for me like above said, at my friend it doesn't even connect to my server.
With the Astaro VPN or the OpenVPN AS Package it worked.
We tried all three ports (443, 8080 and 80) via UDP.
(Apache running on 443 / 80, Tomcat on 8080 -> which couldn't be the problem
because I can connect to the server)

firepower2k11

client log:

Tue May 14 22:52:21 2013 OpenVPN 2.3.1 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Mar 28 2013
Enter Management Password:
Tue May 14 22:52:21 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue May 14 22:52:21 2013 Need hold release from management interface, waiting...
Tue May 14 22:52:21 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue May 14 22:52:21 2013 MANAGEMENT: CMD 'state on'
Tue May 14 22:52:21 2013 MANAGEMENT: CMD 'log all on'
Tue May 14 22:52:21 2013 MANAGEMENT: CMD 'hold off'
Tue May 14 22:52:21 2013 MANAGEMENT: CMD 'hold release'
Tue May 14 22:52:21 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Tue May 14 22:52:21 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue May 14 22:52:22 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue May 14 22:52:22 2013 UDPv4 link local (bound): [undef]
Tue May 14 22:52:22 2013 UDPv4 link remote: [AF_INET]188.138.122.4:443
Tue May 14 22:52:22 2013 MANAGEMENT: >STATE:1368564742,WAIT,,,
Tue May 14 22:52:22 2013 MANAGEMENT: >STATE:1368564742,AUTH,,,
Tue May 14 22:52:22 2013 TLS: Initial packet from [AF_INET]188.138.122.4:443, sid=4b0ba365 a4eb1826
Tue May 14 22:52:22 2013 VERIFY OK: depth=1, C=DE, ST=Bayern, L=Ingolstadt, O=MyTDA, CN=MyTDA CA, name=Dominik Kuenne, emailAddress=kuenne@mytda.de
Tue May 14 22:52:22 2013 VERIFY OK: depth=0, C=DE, ST=Bayern, L=Ingolstadt, O=MyTDA, CN=server, name=Dominik Kuenne, emailAddress=kuenne@mytda.de
Tue May 14 22:52:22 2013 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue May 14 22:52:22 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue May 14 22:52:22 2013 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue May 14 22:52:22 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue May 14 22:52:22 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue May 14 22:52:22 2013 [server] Peer Connection Initiated with [AF_INET]188.138.122.4:443
Tue May 14 22:52:23 2013 MANAGEMENT: >STATE:1368564743,GET_CONFIG,,,
Tue May 14 22:52:24 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue May 14 22:52:24 2013 PUSH: Received control message: 'PUSH_REPLY,route 0.0.0.0 0.0.0.0 gw 10.8.0.1,dhcp-option DNS 8.8.8.8,redirect-gateway def1 bypass-dhcp,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Tue May 14 22:52:24 2013 Options error: route parameter gateway 'gw' must be a valid address
Tue May 14 22:52:24 2013 OPTIONS IMPORT: timers and/or timeouts modified
Tue May 14 22:52:24 2013 OPTIONS IMPORT: --ifconfig/up options modified
Tue May 14 22:52:24 2013 OPTIONS IMPORT: route options modified
Tue May 14 22:52:24 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue May 14 22:52:24 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue May 14 22:52:24 2013 MANAGEMENT: >STATE:1368564744,ASSIGN_IP,,10.8.0.6,
Tue May 14 22:52:24 2013 open_tun, tt->ipv6=0
Tue May 14 22:52:24 2013 TAP-WIN32 device [LAN-Verbindung 4] opened: \\.\Global\{DB1F42B9-597B-4062-8DF7-3627B3664F47}.tap
Tue May 14 22:52:24 2013 TAP-Windows Driver Version 9.9 
Tue May 14 22:52:24 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {DB1F42B9-597B-4062-8DF7-3627B3664F47} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Tue May 14 22:52:24 2013 Successful ARP Flush on interface [22] {DB1F42B9-597B-4062-8DF7-3627B3664F47}
Tue May 14 22:52:29 2013 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Tue May 14 22:52:29 2013 C:\Windows\system32\route.exe ADD 188.138.122.4 MASK 255.255.255.255 192.168.2.1
Tue May 14 22:52:29 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue May 14 22:52:29 2013 Route addition via IPAPI succeeded [adaptive]
Tue May 14 22:52:29 2013 C:\Windows\system32\route.exe ADD 192.168.2.1 MASK 255.255.255.255 192.168.2.1 IF 14
Tue May 14 22:52:29 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue May 14 22:52:29 2013 Route addition via IPAPI succeeded [adaptive]
Tue May 14 22:52:29 2013 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Tue May 14 22:52:29 2013 Route addition via IPAPI succeeded [adaptive]
Tue May 14 22:52:29 2013 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Tue May 14 22:52:29 2013 Route addition via IPAPI succeeded [adaptive]
Tue May 14 22:52:29 2013 MANAGEMENT: >STATE:1368564749,ADD_ROUTES,,,
Tue May 14 22:52:29 2013 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Tue May 14 22:52:29 2013 Route addition via IPAPI succeeded [adaptive]
Tue May 14 22:52:29 2013 Initialization Sequence Completed
Tue May 14 22:52:29 2013 MANAGEMENT: >STATE:1368564749,CONNECTED,SUCCESS,10.8.0.6,188.138.122.4

janjust

the log shows a succesful connection - so what is not working?

also, I'm confused by this:

The VPN works for me like above said, at my friend it doesn't even connect to my server.
With the Astaro VPN or the OpenVPN AS Package it worked.
We tried all three ports (443, 8080 and 80) via UDP.
(Apache running on 443 / 80, Tomcat on 8080 -> which couldn't be the problem
because I can connect to the server)

from which client does it not work? where does openvpn AS come into this?

firepower2k11

I just posted the log because you wanted the routing table and maybe you can see more
information in the log.

At my home I have no port restrictions so I first test the VPN every time I change
something and after that I give it to my friend who is in the hotel with the restrictions.

I just tried three different ways to get it working.

1. OpenVPN AS: My friend could connect to the AS, Youtube worked but Steam and TeamSpeak didn't.

2. For testing purposes I've started my Astaro Security Gateway at my home and configured an VPN(ASG 8 on ESXi). ALL worked but he couldn't really use it because I only have an 16k down and 1k up DSL. In TeamSpeak he had a latency of 200...

3. OpenVPN(installed via aptitude): At my home I can connect to the OpenVPN server(see log) but TeamSpeak and Steam don't go over the VPN tunnel(you can see your IP on TeamSpeak). And my friend which is actually in the hotel with the port restrictions can't even connect to the OpenVPN server(still with "verbose 11" no reaction on the server).

And just for information, doesn't know if you need this information:
Were the OpenVPN server is running is also an Apache(80 and 443) and an Tomcat(8080).

firepower2k11

FYI:

Both client's have Windows 7 x64 installed, the server runs on Ubuntu Server 10.04.

firepower2k11

*push*
*push*
*push*

janjust

this thread slipped my attention, sorry about that...
I've re-read it and two things pop out:

your openvpn setup seems to be using 'proto udp' which is blocked by most proxies/hotels; try 'proto tcp'

if the Astara box works then check its server-side config; if you cannot get at that, add 'verb 5' the client log file, connect the VPN client and watch for the line

Tue May 14 22:52:24 2013 PUSH: Received control message: 'PUSH_REPLY,route 0.0.0.0 0.0.0.0 gw 10.8.0.1,dhcp-option DNS 8.8.8.8,redirect-gateway def1 bypass-dhcp,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'

the first option that is pushed (route 0.0.0.0 0.0.0.0 gw 10.8.0.1) is ignored as it's wrongly specified in the server config.

A final note: if performance is really bad (over tcp , mostly) then try lowering the mtu size on both sides

tun-mtu 1400

On Windows this may als require a change in the tap-win32 adapter properties.

firepower2k11

janjust wrote
your openvpn setup seems to be using 'proto udp' which is blocked by most proxies/hotels; try 'proto tcp'
if the Astara box works then check its server-side config; if you cannot get at that, add 'verb 5' the client log file, connect the VPN client and watch for the line
Tue May 14 22:52:24 2013 PUSH: Received control message: 'PUSH_REPLY,route 0.0.0.0 0.0.0.0 gw 10.8.0.1,dhcp-option DNS 8.8.8.8,redirect-gateway def1 bypass-dhcp,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
the first option that is pushed (route 0.0.0.0 0.0.0.0 gw 10.8.0.1) is ignored as it's wrongly specified in the server config.

A final note: if performance is really bad (over tcp , mostly) then try lowering the mtu size on both sides
tun-mtu 1400
On Windows this may als require a change in the tap-win32 adapter properties.

No problem 😉

Proto TCP: I've connected via UDP the last time it worked. But I can try that, just have to see how to disable the https from the Apache...
Yesterday I got the config from my Astaro. Today I tried to copy as much as I could from the given config, but still the same problem.
Smaller MTU can't change much if I only got 100kBit/s Upload...

Connecting to my (virtual) Astaro locally at home (192.168.2.1 Router with DHCP, DNS, ...):

Wed Jun 12 23:00:28 2013 us=96000 [Astaro01] Peer Connection Initiated with 93.203.204.28:443
Wed Jun 12 23:00:30 2013 us=187000 SENT CONTROL [Astaro01]: 'PUSH_REQUEST' (status=1)
Wed Jun 12 23:00:30 2013 us=390000 PUSH: Received control message: 'PUSH_REPLY,route remote_host 255.255.255.255 net_gateway,redirect-gateway def1,route 10.242.2.1,topology net30,ping 10,ping-restart 120,ifconfig 10.242.2.6 10.242.2.5'
Wed Jun 12 23:00:30 2013 us=390000 OPTIONS IMPORT: timers and/or timeouts modified
Wed Jun 12 23:00:30 2013 us=390000 OPTIONS IMPORT: --ifconfig/up options modified
Wed Jun 12 23:00:30 2013 us=390000 OPTIONS IMPORT: route options modified
Wed Jun 12 23:00:30 2013 us=405000 ROUTE default_gateway=192.168.2.1
Wed Jun 12 23:00:30 2013 us=405000 TAP-WIN32 device [LAN-Verbindung 3] opened: \\.\Global\{BC677851-9C2C-4701-AFE4-EFBF97DA6CCB}.tap
Wed Jun 12 23:00:30 2013 us=405000 TAP-Win32 Driver Version 9.6 
Wed Jun 12 23:00:30 2013 us=405000 TAP-Win32 MTU=1500
Wed Jun 12 23:00:30 2013 us=421000 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.242.2.6/255.255.255.252 on interface {BC677851-9C2C-4701-AFE4-EFBF97DA6CCB} [DHCP-serv: 10.242.2.5, lease-time: 31536000]
Wed Jun 12 23:00:30 2013 us=421000 Successful ARP Flush on interface [26] {BC677851-9C2C-4701-AFE4-EFBF97DA6CCB}
Wed Jun 12 23:00:34 2013 us=461000 TEST ROUTES: 3/3 succeeded len=2 ret=1 a=0 u/d=up
Wed Jun 12 23:00:34 2013 us=461000 C:\WINDOWS\system32\route.exe ADD 93.203.204.28 MASK 255.255.255.255 192.168.2.1
Wed Jun 12 23:00:34 2013 us=461000 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Wed Jun 12 23:00:34 2013 us=461000 Route addition via IPAPI succeeded [adaptive]
Wed Jun 12 23:00:34 2013 us=461000 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.242.2.5
Wed Jun 12 23:00:34 2013 us=461000 Route addition via IPAPI succeeded [adaptive]
Wed Jun 12 23:00:34 2013 us=461000 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.242.2.5
Wed Jun 12 23:00:34 2013 us=461000 Route addition via IPAPI succeeded [adaptive]
Wed Jun 12 23:00:34 2013 us=477000 C:\WINDOWS\system32\route.exe ADD 93.203.204.28 MASK 255.255.255.255 192.168.2.1
Wed Jun 12 23:00:34 2013 us=477000 ROUTE: route addition failed using CreateIpForwardEntry: Das Objekt ist bereits vorhanden.   [status=5010 if_index=13]
Wed Jun 12 23:00:34 2013 us=477000 Route addition via IPAPI failed [adaptive]
Wed Jun 12 23:00:34 2013 us=477000 Route addition fallback to route.exe
Wed Jun 12 23:00:34 2013 us=492000 C:\WINDOWS\system32\route.exe ADD 10.242.2.1 MASK 255.255.255.255 10.242.2.5
Wed Jun 12 23:00:34 2013 us=492000 Route addition via IPAPI succeeded [adaptive]
Wed Jun 12 23:00:34 2013 us=492000 Initialization Sequence Completed

When I try to connect to the OpenVPN Server (188.138.122.4 in the internet):

Wed Jun 12 23:14:07 2013 us=429000 [server] Peer Connection Initiated with 188.138.122.4:443
Wed Jun 12 23:14:09 2013 us=878000 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Jun 12 23:14:09 2013 us=894000 PUSH: Received control message: 'PUSH_REPLY,route remote_host 255.255.255.255 net_gateway,redirect-gateway def1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Wed Jun 12 23:14:09 2013 us=894000 OPTIONS IMPORT: timers and/or timeouts modified
Wed Jun 12 23:14:09 2013 us=894000 OPTIONS IMPORT: --ifconfig/up options modified
Wed Jun 12 23:14:09 2013 us=894000 OPTIONS IMPORT: route options modified
Wed Jun 12 23:14:09 2013 us=894000 ROUTE default_gateway=192.168.2.1
Wed Jun 12 23:14:09 2013 us=910000 TAP-WIN32 device [LAN-Verbindung 3] opened: \\.\Global\{BC677851-9C2C-4701-AFE4-EFBF97DA6CCB}.tap
Wed Jun 12 23:14:09 2013 us=910000 TAP-Win32 Driver Version 9.6 
Wed Jun 12 23:14:09 2013 us=910000 TAP-Win32 MTU=1500
Wed Jun 12 23:14:09 2013 us=910000 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {BC677851-9C2C-4701-AFE4-EFBF97DA6CCB} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Wed Jun 12 23:14:09 2013 us=910000 Successful ARP Flush on interface [26] {BC677851-9C2C-4701-AFE4-EFBF97DA6CCB}
Wed Jun 12 23:14:14 2013 us=168000 TEST ROUTES: 3/3 succeeded len=2 ret=1 a=0 u/d=up
Wed Jun 12 23:14:14 2013 us=168000 C:\WINDOWS\system32\route.exe ADD 188.138.122.4 MASK 255.255.255.255 192.168.2.1
Wed Jun 12 23:14:14 2013 us=168000 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Wed Jun 12 23:14:14 2013 us=168000 Route addition via IPAPI succeeded [adaptive]
Wed Jun 12 23:14:14 2013 us=168000 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Wed Jun 12 23:14:14 2013 us=184000 Route addition via IPAPI succeeded [adaptive]
Wed Jun 12 23:14:14 2013 us=184000 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Wed Jun 12 23:14:14 2013 us=184000 Route addition via IPAPI succeeded [adaptive]
Wed Jun 12 23:14:14 2013 us=184000 C:\WINDOWS\system32\route.exe ADD 188.138.122.4 MASK 255.255.255.255 192.168.2.1
Wed Jun 12 23:14:14 2013 us=184000 ROUTE: route addition failed using CreateIpForwardEntry: Das Objekt ist bereits vorhanden.   [status=5010 if_index=13]
Wed Jun 12 23:14:14 2013 us=184000 Route addition via IPAPI failed [adaptive]
Wed Jun 12 23:14:14 2013 us=184000 Route addition fallback to route.exe
Wed Jun 12 23:14:14 2013 us=200000 C:\WINDOWS\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Wed Jun 12 23:14:14 2013 us=200000 Route addition via IPAPI succeeded [adaptive]
Wed Jun 12 23:14:14 2013 us=200000 Initialization Sequence Completed

New OpenVPN Server Config(Astaro CFG as example, outcommented all which killed the server before it even did run):

dev tun

proto udp
local 0.0.0.0
port 443

multihome
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /etc/openvpn/ipp.txt

ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem

cipher AES-256-CBC
auth SHA1
comp-lzo

;ccd-exclusive
client-config-dir /etc/openvpn/server

push "route remote_host 255.255.255.255 net_gateway"
push "redirect-gateway def1"

duplicate-cn

;port-share 127.0.0.1 10443

management /var/run/ovpn_mgmt unix
management-client-user root
management-client-group root

persist-key
persist-tun
status /etc/openvpn/openvpn-status.log
reneg-sec 28800
keepalive 10 120
verb 3

script-security 2
;up "/etc/openvpn/openvpn_updown.plx up"
;down "/etc/openvpn/openvpn_updown.plx down"
;down-pre

OpenVPN Server Log:

Wed Jun 12 23:33:43 2013 OpenVPN 2.1.0 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jul 20 2010
Wed Jun 12 23:33:43 2013 MANAGEMENT: client_uid=0
Wed Jun 12 23:33:43 2013 MANAGEMENT: client_gid=0
Wed Jun 12 23:33:43 2013 MANAGEMENT: unix domain socket listening on /var/run/ovpn_mgmt
Wed Jun 12 23:33:43 2013 WARNING: using --duplicate-cn and --client-config-dir together is probably not what you want
Wed Jun 12 23:33:43 2013 WARNING: --ifconfig-pool-persist will not work with --duplicate-cn
Wed Jun 12 23:33:43 2013 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Wed Jun 12 23:33:43 2013 Diffie-Hellman initialized with 2048 bit key
Wed Jun 12 23:33:43 2013 /usr/bin/openssl-vulnkey -q -b 2048 -m <modulus omitted>
Wed Jun 12 23:33:43 2013 TLS-Auth MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Jun 12 23:33:43 2013 ROUTE default_gateway=188.138.122.1
Wed Jun 12 23:33:43 2013 TUN/TAP device tun0 opened
Wed Jun 12 23:33:43 2013 TUN/TAP TX queue length set to 100
Wed Jun 12 23:33:43 2013 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Wed Jun 12 23:33:43 2013 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Wed Jun 12 23:33:43 2013 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Jun 12 23:33:43 2013 Socket Buffers: R=[124928->131072] S=[124928->131072]
Wed Jun 12 23:33:43 2013 UDPv4 link local (bound): [undef]
Wed Jun 12 23:33:43 2013 UDPv4 link remote: [undef]
Wed Jun 12 23:33:43 2013 MULTI: multi_init called, r=256 v=256
Wed Jun 12 23:33:43 2013 IFCONFIG POOL: base=10.8.0.4 size=62
Wed Jun 12 23:33:43 2013 IFCONFIG POOL LIST
Wed Jun 12 23:33:43 2013 Initialization Sequence Completed
Wed Jun 12 23:33:44 2013 MULTI: multi_create_instance called
Wed Jun 12 23:33:44 2013 93.203.204.28:56806 Re-using SSL/TLS context
Wed Jun 12 23:33:44 2013 93.203.204.28:56806 LZO compression initialized
Wed Jun 12 23:33:44 2013 93.203.204.28:56806 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Jun 12 23:33:44 2013 93.203.204.28:56806 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Jun 12 23:33:44 2013 93.203.204.28:56806 Local Options hash (VER=V4): 'a8f55717'
Wed Jun 12 23:33:44 2013 93.203.204.28:56806 Expected Remote Options hash (VER=V4): '22188c5b'
Wed Jun 12 23:33:44 2013 93.203.204.28:56806 TLS: Initial packet from [AF_INET]93.203.204.28:56806, sid=cbc0bd91 c05c30cf
Wed Jun 12 23:33:44 2013 93.203.204.28:56806 VERIFY OK: depth=1, /C=DE/*****
Wed Jun 12 23:33:44 2013 93.203.204.28:56806 VERIFY OK: depth=0, /C=DE/*****
Wed Jun 12 23:33:44 2013 93.203.204.28:56806 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Jun 12 23:33:44 2013 93.203.204.28:56806 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jun 12 23:33:44 2013 93.203.204.28:56806 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Jun 12 23:33:44 2013 93.203.204.28:56806 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jun 12 23:33:44 2013 93.203.204.28:56806 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Jun 12 23:33:44 2013 93.203.204.28:56806 [client2] Peer Connection Initiated with [AF_INET]93.203.204.28:56806
Wed Jun 12 23:33:44 2013 client2/93.203.204.28:56806 MULTI: Learn: 10.8.0.6 -> client2/93.203.204.28:56806
Wed Jun 12 23:33:44 2013 client2/93.203.204.28:56806 MULTI: primary virtual IP for client2/93.203.204.28:56806: 10.8.0.6
Wed Jun 12 23:33:47 2013 client2/93.203.204.28:56806 PUSH: Received control message: 'PUSH_REQUEST'
Wed Jun 12 23:33:47 2013 client2/93.203.204.28:56806 SENT CONTROL [client2]: 'PUSH_REPLY,route remote_host 255.255.255.255 net_gateway,redirect-gateway def1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

Maybe tomorrow I will post again an client log from outside of my network (mobile phone).