Server-Client Config openwrt-router

ssdnvv

Hello,

here's my server-config (/etc/config/openvpn):

config 'openvpn' 'lan'
        option 'enable' '1'
        option 'port' '1194'
        option 'proto' 'udp'
        option 'dev' 'tap0'
        option 'ca' '/etc/openvpn/ca.crt'
        option 'cert' '/etc/openvpn/server.crt'
        option 'key' '/etc/openvpn/server.key'
        option 'dh' '/etc/openvpn/dh2048.pem'
        option 'ifconfig_pool_persist' '/mnt/sda1/ipp.txt'
        option 'keepalive' '10 120'
	 option 'tls auth' '/etc/openvpn/ta.key 0'
	 option 'cipher' 'AES-256-CBC'
        option 'comp_lzo' '1'
        option 'persist_key' '1'
        option 'persist_tun' '1'
        option 'status' '/mnt/sda1/openvpn-status.log'
        option 'verb' '3'
        option 'server_bridge' '192.168.0.1 255.255.255.0 192.168.0.20 192.168.0.39'
        list 'push' 'dhcp-option DOMAIN <mydomain.local>'
        list 'push' 'dhcp-option DNS 192.168.0.1'

Client:

<no-ip.url> 1194
proto udp
nobind
ca ca.crt
cert vpnuser1.crt
key vpnuser1.key
comp-lzo
verb 3
keepalive 10 120
resolv-retry infinite
mute-replay-warnings
mute 20
tls-auth ta.key 1
tls-client
pull
cipher AES-256-CBC
dev tun

when i try to connect, i get the following feedback:

Wed May 22 12:32:08 2013 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Wed May 22 12:32:08 2013 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Wed May 22 12:32:08 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed May 22 12:32:08 2013 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Wed May 22 12:32:08 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 22 12:32:08 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 22 12:32:08 2013 LZO compression initialized
Wed May 22 12:32:08 2013 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]
Wed May 22 12:32:08 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed May 22 12:32:09 2013 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Wed May 22 12:32:09 2013 Local Options hash (VER=V4): '9e7066d2'
Wed May 22 12:32:09 2013 Expected Remote Options hash (VER=V4): '162b04de'
Wed May 22 12:32:09 2013 UDPv4 link local: [undef]
Wed May 22 12:32:09 2013 UDPv4 link remote: 95.88.9.222:1194
Wed May 22 12:32:10 2013 TLS: Initial packet from 95.88.9.222:1194, sid=9792a2f6 4b41cfd8
Wed May 22 12:32:10 2013 TLS Error: cannot locate HMAC in incoming packet from 95.88.9.222:1194
Wed May 22 12:32:10 2013 TLS: Initial packet from 95.88.9.222:1194, sid=9792a2f6 4b41cfd8
Wed May 22 12:32:10 2013 TLS Error: cannot locate HMAC in incoming packet from 95.88.9.222:1194
Wed May 22 12:32:10 2013 TLS: Initial packet from 95.88.9.222:1194, sid=9792a2f6 4b41cfd8
Wed May 22 12:32:10 2013 TLS Error: cannot locate HMAC in incoming packet from 95.88.9.222:1194
<and so on>

Could anyone tell me, what I have to change in order to get it working?
Thanks in advance and for reading,
ssdnvv

ssdnvv

That's strange - why can't I edit my initial post anymore?

janjust

that's normal - new users cannot edit posts...

what's wrong is that the client config uses 'tls-auth' but the server does not seem to - comment out the 'tls-auth' line and try again.

ssdnvv

1. Thanks for your answer, you're right (if I comment out the tls-auth, the connection will be opened up seamlessly) 🙂
But I don't understand why 😉

Because in the server config I use the line

option 'tls-auth' '/etc/openvpn/ta.key 1'

(I changed it, but couldn't edit the initial post anymore).
Whatelse do I have to fill in for the tls-handshake to function?

2. Another question of mine is about the connection type itself:
How do I block any internet-access outside the vpn-tunnel? My reason is that I want to connect to my server in order to avoid the problems of unsecure wlan hotspots.
(The IP that is shown when I visit http://checkip.dyndns.com/ is the same no matter whether I'm connected to the vpn-server or not. When any access would be blocked, the IPs I have would differ, or am I mistaken?)

janjust

this depends a bit on how you configure things in openwrt; there are other mismatches as well: the wrt box has 'dev tap' but the client has 'dev tun'.
You can redirect all traffic on the client by adding

redirect-gateway def1

ssdnvv

2. perfect - thank you very much for your help! 🙂

1. 'dev tap' has already been changed - I did a little try-n-error this afternoon and searched for misspellings/syntax-errors, but I had no luck.
Do you use an openwrt-system - what has to be done to make it work? Or rather - where do I have to search for the error?

janjust

I'm not an openwrt (or dd-wrt) user...
I don't know how the openwrt UI (gui?) configures openvpn - normally it would log to something like /var/log/openvpn.log

ssdnvv

ok, I'll see if i get one of the designers of openwrt to tell me were I can find it and post it here asap 🙂

blumman

Try this.

tail f -n 100 /var/log/openvpn/openvpn.log

If the log exists you should be able to see the log "live".

ssdnvv

Within openwrt the openvpn.log doesn't exist on its own, as I found out. It's integrated in the system log with a maximum of 1024 bytes of log-text (RAM ringbuffer). Therefore I had to install syslog-ng to get it more accessible.
I gonna post the results of another test here tomorrow.
gn8 🙂

ssdnvv

syslog-ng works fine 🙂
Once again the server-config:

config 'openvpn' 'lan'
        option 'enable' '1'
        option 'port' '1194'
        option 'proto' 'udp'
        option 'dev' 'tap0'
        option 'ca' '/etc/openvpn/ca.crt'
        option 'cert' '/etc/openvpn/server.crt'
        option 'key' '/etc/openvpn/server.key'
        option 'dh' '/etc/openvpn/dh2048.pem'
        option 'ifconfig_pool_persist' '/mnt/sda1/ipp.txt'
        option 'keepalive' '10 120'
	 option 'tls-auth' '/etc/openvpn/ta.key 1'
	 option 'cipher' 'AES-256-CBC'
        option 'comp_lzo' '1'
        option 'persist_key' '1'
        option 'persist_tun' '1'
        option 'status' '/mnt/sda1/openvpn-status.log'
        option 'verb' '3'
        option 'server_bridge' '192.168.0.1 255.255.255.0 192.168.0.20 192.168.0.39'
        list 'push' 'dhcp-option DOMAIN <mydomain.local>'
        list 'push' 'dhcp-option DNS 192.168.0.1'

the client config:

tls-client
remote ssdnvv-family.no-ip.biz 1194
proto udp
dev tap
nobind
remote-cert-tls server
comp-lzo
verb 3
keepalive 10 120
resolv-retry infinite
mute-replay-warnings
mute 20
ca ca.crt
cert vpnuser1.crt
key vpnuser1.key
cipher AES-256-CBC
pull
redirect-gateway def1





tls-auth ta.key 1

server-log entries (I included the startup-sequence log-entries of yesterday night just in case you'd need them):

May 24 22:58:36 <my Network Name> openvpn(lan)[1995]: OpenVPN 2.2.2 mips-openwrt-linux [SSL] [LZO2] [EPOLL] built on Mar 14 2013
May 24 22:58:36 <my Network Name> openvpn(lan)[1995]: NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
May 24 22:58:36 <my Network Name> openvpn(lan)[1995]: NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
May 24 22:58:36 <my Network Name> openvpn(lan)[1995]: Diffie-Hellman initialized with 2048 bit key
May 24 22:58:36 <my Network Name> openvpn(lan)[1995]: WARNING: file '/etc/openvpn/server.key' is group or others accessible
May 24 22:58:36 <my Network Name> openvpn(lan)[1995]: TLS-Auth MTU parms [ L:1590 D:138 EF:38 EB:0 ET:0 EL:0 ]
May 24 22:58:36 <my Network Name> openvpn(lan)[1995]: Socket Buffers: R=[163840->131072] S=[163840->131072]
May 24 22:58:36 <my Network Name> openvpn(lan)[1995]: TUN/TAP device tap0 opened
May 24 22:58:37 <my Network Name> openvpn(lan)[1995]: TUN/TAP TX queue length set to 100
May 24 22:58:37 <my Network Name> openvpn(lan)[1995]: Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
May 24 22:58:37 <my Network Name> openvpn(lan)[1995]: UDPv4 link local (bound): [undef]:1194
May 24 22:58:37 <my Network Name> openvpn(lan)[1995]: UDPv4 link remote: [undef]
May 24 22:58:37 <my Network Name> openvpn(lan)[1995]: MULTI: multi_init called, r=256 v=256
May 24 22:58:37 <my Network Name> openvpn(lan)[1995]: IFCONFIG POOL: base=192.168.0.20 size=20
May 24 22:58:37 <my Network Name> openvpn(lan)[1995]: IFCONFIG POOL LIST
May 24 22:58:37 <my Network Name> openvpn(lan)[1995]: vpnuser1,192.168.0.20
May 24 22:58:37 <my Network Name> openvpn(lan)[1995]: Initialization Sequence Completed
May 25 12:18:50 <my Network Name> openvpn(lan)[1995]: <mymobile IP>:43790 Re-using SSL/TLS context
May 25 12:18:50 <my Network Name> openvpn(lan)[1995]: <mymobile IP>:43790 LZO compression initialized
May 25 12:18:50 <my Network Name> openvpn(lan)[1995]: <mymobile IP>:43790 Control Channel MTU parms [ L:1590 D:138 EF:38 EB:0 ET:0 EL:0 ]
May 25 12:18:50 <my Network Name> openvpn(lan)[1995]: <mymobile IP>:43790 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
May 25 12:18:50 <my Network Name> openvpn(lan)[1995]: <mymobile IP>:43790 TLS: Initial packet from <mymobile IP>:43790, sid=54ae4636 a67be40c
May 25 12:18:50 <my Network Name> openvpn(lan)[1995]: <mymobile IP>:43790 TLS Error: reading acknowledgement record from packet
May 25 12:18:52 <my Network Name> openvpn(lan)[1995]: <mymobile IP>:43790 TLS Error: reading acknowledgement record from packet
May 25 12:18:57 <my Network Name> openvpn(lan)[1995]: <mymobile IP>:43790 TLS Error: reading acknowledgement record from packet
May 25 12:19:04 <my Network Name> openvpn(lan)[1995]: <mymobile IP>:43790 TLS Error: reading acknowledgement record from packet
May 25 12:19:50 <my Network Name> openvpn(lan)[1995]: <mymobile IP>:43790 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
May 25 12:19:50 <my Network Name> openvpn(lan)[1995]: <mymobile IP>:43790 TLS Error: TLS handshake failed
May 25 12:19:50 <my Network Name> openvpn(lan)[1995]: <mymobile IP>:43790 SIGUSR1[soft,tls-error] received, client-instance restarting

and the client log-entries:

Sat May 25 12:18:42 2013 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Sat May 25 12:18:42 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sat May 25 12:18:42 2013 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Sat May 25 12:18:42 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat May 25 12:18:42 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat May 25 12:18:42 2013 LZO compression initialized
Sat May 25 12:18:42 2013 Control Channel MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:0 ]
Sat May 25 12:18:42 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sat May 25 12:18:44 2013 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Sat May 25 12:18:44 2013 Local Options hash (VER=V4): '48527533'
Sat May 25 12:18:44 2013 Expected Remote Options hash (VER=V4): '44bd8b5e'
Sat May 25 12:18:44 2013 UDPv4 link local: [undef]
Sat May 25 12:18:44 2013 UDPv4 link remote: <my public Network IP>:1194
Sat May 25 12:18:45 2013 TLS: Initial packet from <my public Network IP>:1194, sid=ae535a72 cc6ac263
Sat May 25 12:18:45 2013 TLS Error: cannot locate HMAC in incoming packet from <my public Network IP>:1194
Sat May 25 12:18:47 2013 TLS: Initial packet from <my public Network IP>:1194, sid=ae535a72 cc6ac263
Sat May 25 12:18:47 2013 TLS Error: cannot locate HMAC in incoming packet from <my public Network IP>:1194
Sat May 25 12:18:51 2013 TLS: Initial packet from <my public Network IP>:1194, sid=ae535a72 cc6ac263
Sat May 25 12:18:51 2013 TLS Error: cannot locate HMAC in incoming packet from <my public Network IP>:1194
Sat May 25 12:18:59 2013 TLS: Initial packet from <my public Network IP>:1194, sid=ae535a72 cc6ac263
Sat May 25 12:18:59 2013 TLS Error: cannot locate HMAC in incoming packet from <my public Network IP>:1194
Sat May 25 12:19:08 2013 TCP/UDP: Closing socket
Sat May 25 12:19:08 2013 SIGTERM[hard,] received, process exiting

In addition: When I comment out the last line of the client config, everything works fine (for testing I use an 3G-Internetconnection shared by my smartphone). I just want to use the initial tls-handshake, and that doesn't work 🙁

jedufa

@SSDNVV

How did you solve your synology login problem? I have the same issue but can't go through the login screen. What did you write down in the username in terms of URL?
For reference:
https://github.com/RainLoop/rainloop-webmail/issues/296

Thanks a lot!!

JW0914

Issue arises from the server config which has tls-auth set to 1 when servers need to be set to 0

ssdnvv

Hello again,

unfortunately the former working configs are gone through different crashes.
So I had to set up everything from scratch and after a day of unsuccessfully testing a need a hand...

System: openwrt

Server config:

config openvpn 'mobile_Clients'
	option enabled 1

	option port 1194
	option proto udp
	option dev tun

	option ca /etc/ssl/openvpn/ca.crt
	option cert /etc/ssl/openvpn/myhostname.crt
	option key /etc/ssl/openvpn/myhostname.key
	option dh /etc/ssl/openvpn/dh2048.pem
#	option tls_auth '/etc/ssl/openvpn/ta.key 0'

	option cipher AES-128-CBC
	option comp_lzo 1
	option ifconfig_pool_persist /var/log/ipp.txt
	option status /var/log/openvpn-status.log
	option log /var/log/openvpn.log
	option verb 4
	option mute 20
	option keepalive '10 120'
	option persist_key 1
	option persist_tun 1

	option server '11.0.2.0 255.255.255.0'
	option push 'redirect-gateway def1'
	option client_to_client 1

Client Config:

client

dev tun
proto udp
remote 	myhostname 1194
resolv-retry infinite
nobind

persist-key
persist-tun 

mute-replay-warnings

ca ca.crt
cert MD1.crt
key MD1.key
#tls-auth ta.key 1

remote-cert-tls server
cipher AES-128-CBC
verb 4
mute 20

keepalive 10 120

comp-lzo

Network-Config:

config interface 'openVPN1'
	option proto 'none'
	option ifname 'tun0'

Firewall-Config:

#Openvpn-Traffic über Port ermöglichen
config rule
	option name 'openVPN1'
	option src '*'
	option dest_port '1194'
	option proto 'udp'
	option target 'ACCEPT'
 
#Traffic über tun0 erlauben
config zone
	option name 'openVPN1'
	option input 'ACCEPT'
	option forward 'ACCEPT'
	option output 'ACCEPT'
	option network 'openVPN1'
	option masq 1
	option mtu_fix 1

#Traffic vom Client ins WAN erlauben
config forwarding
	option dest 'wan'
	option src 'openVPN1'

#Traffic vom Client ins LAN erlauben
config forwarding
	option dest 'lan'
	option src 'openVPN1'

#Traffic aus dem LAN zum Client erlauben
config forwarding
	option dest 'openVPN1'
	option src 'lan'

Additionally openvpn has any privilegs under windows regardings firewall-options.
I can reach myhostname flawlessly via scp (WinSCP) or https (firefox).

Client-Log

Wed Jun 17 02:33:03 2015 us=140580 Current Parameter Settings:
Wed Jun 17 02:33:03 2015 us=140580   config = 'Arbeit (auskommentiert).ovpn'
Wed Jun 17 02:33:03 2015 us=140580   mode = 0
Wed Jun 17 02:33:03 2015 us=140580   show_ciphers = DISABLED
Wed Jun 17 02:33:03 2015 us=140580   show_digests = DISABLED
Wed Jun 17 02:33:03 2015 us=140580   show_engines = DISABLED
Wed Jun 17 02:33:03 2015 us=140580   genkey = DISABLED
Wed Jun 17 02:33:03 2015 us=140580   key_pass_file = '[UNDEF]'
Wed Jun 17 02:33:03 2015 us=140580   show_tls_ciphers = DISABLED
Wed Jun 17 02:33:03 2015 us=140580 Connection profiles [default]:
Wed Jun 17 02:33:03 2015 us=140580   proto = udp
Wed Jun 17 02:33:03 2015 us=140580   local = '[UNDEF]'
Wed Jun 17 02:33:03 2015 us=140580   local_port = 0
Wed Jun 17 02:33:03 2015 us=140580   remote = 'myhostname'
Wed Jun 17 02:33:03 2015 us=140580   remote_port = 1194
Wed Jun 17 02:33:03 2015 us=140580   remote_float = DISABLED
Wed Jun 17 02:33:03 2015 us=140580   bind_defined = DISABLED
Wed Jun 17 02:33:03 2015 us=140580   bind_local = DISABLED
Wed Jun 17 02:33:03 2015 us=140580   connect_retry_seconds = 5
Wed Jun 17 02:33:03 2015 us=140580   connect_timeout = 10
Wed Jun 17 02:33:03 2015 us=140580 NOTE: --mute triggered...
Wed Jun 17 02:33:03 2015 us=140580 265 variation(s) on previous 20 message(s) suppressed by --mute
Wed Jun 17 02:33:03 2015 us=140580 OpenVPN 2.3.7 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Jun  8 2015
Wed Jun 17 02:33:03 2015 us=140580 library versions: OpenSSL 1.0.1m 19 Mar 2015, LZO 2.08
Enter Management Password:
Wed Jun 17 02:33:03 2015 us=141580 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Jun 17 02:33:03 2015 us=141580 Need hold release from management interface, waiting...
Wed Jun 17 02:33:03 2015 us=628608 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Jun 17 02:33:03 2015 us=728614 MANAGEMENT: CMD 'state on'
Wed Jun 17 02:33:03 2015 us=728614 MANAGEMENT: CMD 'log all on'
Wed Jun 17 02:33:03 2015 us=742615 MANAGEMENT: CMD 'hold off'
Wed Jun 17 02:33:03 2015 us=742615 MANAGEMENT: CMD 'hold release'
Wed Jun 17 02:33:03 2015 us=845620 LZO compression initialized
Wed Jun 17 02:33:03 2015 us=845620 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:3 ]
Wed Jun 17 02:33:03 2015 us=845620 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Jun 17 02:33:03 2015 us=845620 MANAGEMENT: >STATE:1434501183,RESOLVE,,,
Wed Jun 17 02:33:03 2015 us=948626 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:143 ET:0 EL:3 AF:3/1 ]
Wed Jun 17 02:33:03 2015 us=948626 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Jun 17 02:33:03 2015 us=948626 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Jun 17 02:33:03 2015 us=948626 Local Options hash (VER=V4): '66096c33'
Wed Jun 17 02:33:03 2015 us=948626 Expected Remote Options hash (VER=V4): '691e95c7'
Wed Jun 17 02:33:03 2015 us=948626 UDPv4 link local: [undef]
Wed Jun 17 02:33:03 2015 us=948626 UDPv4 link remote: [AF_INET]myServerIP:1194
Wed Jun 17 02:33:03 2015 us=948626 MANAGEMENT: >STATE:1434501183,WAIT,,,
Wed Jun 17 02:34:04 2015 us=94066 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Wed Jun 17 02:34:04 2015 us=94066 TLS Error: TLS handshake failed
Wed Jun 17 02:34:04 2015 us=94066 TCP/UDP: Closing socket
Wed Jun 17 02:34:04 2015 us=94066 SIGUSR1[soft,tls-error] received, process restarting
{... and so on}

Is there anything defined wrong? Cannot find my mystake... 🙁

Traffic

ssdnvv wroteWed Jun 17 02:34:04 2015 us=94066 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

This usually means that the packets are not getting to your server port either by a firewall-block or no port-forwarding ..

Traffic

You may also find this thread useful:
[Solved]Followed OpenWRT tutorials OpenWRT refuse connection

ssdnvv

Yes, I see - the firewall is the problem.
Thanks for your adivice, I'll take my time to read that other thread.

ssdnvv

One first question - if the logfiles openwrt is supposed to write to (in my case /etc/openvpn/openvpn.log and /etc/openvpn/openvpn-status.log) remain empty, does this imply that something is wrong with the openvpn-process itself?

Traffic

The logs may be in /tmp ..

Perhaps you need to ask openwrt.
I found #openwrt on freenode(irc) quite helpful.

Link to this thread if you like.

ssdnvv

Lucky me - I found the mystake. Maybe my installation went wrong, anyhow - I found out I have to start the server manually by typing

openvpn /path/to/config

I completely changed my setup
Server config:

tls-server

port 443
proto udp
dev tap

ca /etc/ssl/openvpn/ca.crt
cert /etc/ssl/openvpn/myHostname.crt
key /etc/ssl/openvpn/myHostname.key
dh /etc/ssl/openvpn/dh2048.pem
tls-auth /etc/ssl/openvpn/ta.key 0

cipher AES-256-CBC
comp-lzo
ifconfig-pool-persist /var/log/ipp.txt
status /etc/openvpn/openvpn-status.log
log /etc/openvpn/openvpn.log
verb 4
mute 20
keepalive 10 120
persist-key
persist-tun

server-bridge 192.168.84.2 255.255.255.0 192.168.84.47 192.168.84.49
push dhcp-option DNS 192.168.84.2
push redirect-gateway def1
client-to-client

Client config:

client

dev tap
proto udp
remote 	myHostname 443
resolv-retry infinite
nobind

persist-key
persist-tun 

mute-replay-warnings

ca ca.crt
cert MD1.crt
key MD1.key
tls-auth ta.key 1

remote-cert-tls server
cipher AES-256-CBC
verb 4
mute 20

keepalive 10 120

comp-lzo

Server log:

Fri Jun 19 02:40:01 2015 us=912368 OpenVPN 2.3.6 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on May  7 2015
Fri Jun 19 02:40:01 2015 us=912747 library versions: OpenSSL 1.0.2a 19 Mar 2015, LZO 2.08
Fri Jun 19 02:40:01 2015 us=913298 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Fri Jun 19 02:40:02 2015 us=286292 Diffie-Hellman initialized with 2048 bit key
Fri Jun 19 02:40:02 2015 us=290439 Control Channel Authentication: using '/etc/ssl/openvpn/ta.key' as a OpenVPN static key file
Fri Jun 19 02:40:02 2015 us=290733 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jun 19 02:40:02 2015 us=290952 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jun 19 02:40:02 2015 us=291210 TLS-Auth MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:0 ]
Fri Jun 19 02:40:02 2015 us=291469 Socket Buffers: R=[163840->131072] S=[163840->131072]
Fri Jun 19 02:40:02 2015 us=314524 TUN/TAP device tap0 opened
Fri Jun 19 02:40:02 2015 us=314811 TUN/TAP TX queue length set to 100
Fri Jun 19 02:40:02 2015 us=315314 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Fri Jun 19 02:40:02 2015 us=315532 UDPv4 link local (bound): [undef]
Fri Jun 19 02:40:02 2015 us=315728 UDPv4 link remote: [undef]
Fri Jun 19 02:40:02 2015 us=326720 MULTI: multi_init called, r=256 v=256
Fri Jun 19 02:40:02 2015 us=327061 IFCONFIG POOL: base=192.168.84.47 size=3, ipv6=0
Fri Jun 19 02:40:02 2015 us=327304 IFCONFIG POOL LIST
Fri Jun 19 02:40:02 2015 us=327706 Initialization Sequence Completed
Fri Jun 19 02:45:39 2015 us=120994 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Jun 19 02:45:39 2015 us=121349 TLS Error: incoming packet authentication failed from [AF_INET]myMobileIP:5936
Fri Jun 19 02:45:41 2015 us=620471 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Jun 19 02:45:41 2015 us=620766 TLS Error: incoming packet authentication failed from [AF_INET]myMobileIP:5936
Fri Jun 19 02:45:46 2015 us=540342 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Jun 19 02:45:46 2015 us=540650 TLS Error: incoming packet authentication failed from [AF_INET]myMobileIP:5936
Fri Jun 19 02:45:54 2015 us=720433 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Jun 19 02:45:54 2015 us=720737 TLS Error: incoming packet authentication failed from [AF_INET]myMobileIP:5936
Fri Jun 19 02:46:11 2015 us=530479 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Jun 19 02:46:11 2015 us=530786 TLS Error: incoming packet authentication failed from [AF_INET]myMobileIP:5936
Fri Jun 19 02:46:41 2015 us=661131 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Jun 19 02:46:41 2015 us=661584 TLS Error: incoming packet authentication failed from [AF_INET]myMobileIP:17293
Fri Jun 19 02:46:43 2015 us=740480 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Jun 19 02:46:43 2015 us=740776 TLS Error: incoming packet authentication failed from [AF_INET]myMobileIP:17293
Fri Jun 19 02:46:47 2015 us=890231 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Jun 19 02:46:48 2015 us=259046 TLS Error: incoming packet authentication failed from [AF_INET]myMobileIP:17293
Fri Jun 19 02:46:56 2015 us=248148 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Jun 19 02:46:56 2015 us=248453 TLS Error: incoming packet authentication failed from [AF_INET]myMobileIP:17293

Server status log remains empty.

Client log:

Fri Jun 19 02:45:40 2015 us=905702 Current Parameter Settings:
Fri Jun 19 02:45:40 2015 us=906702   config = 'Arbeit (auskommentiert).ovpn'
Fri Jun 19 02:45:40 2015 us=906702   mode = 0
Fri Jun 19 02:45:40 2015 us=906702   show_ciphers = DISABLED
Fri Jun 19 02:45:40 2015 us=906702   show_digests = DISABLED
Fri Jun 19 02:45:40 2015 us=906702   show_engines = DISABLED
Fri Jun 19 02:45:40 2015 us=906702   genkey = DISABLED
Fri Jun 19 02:45:40 2015 us=906702   key_pass_file = '[UNDEF]'
Fri Jun 19 02:45:40 2015 us=906702   show_tls_ciphers = DISABLED
Fri Jun 19 02:45:40 2015 us=906702 Connection profiles [default]:
Fri Jun 19 02:45:40 2015 us=906702   proto = udp
Fri Jun 19 02:45:40 2015 us=906702   local = '[UNDEF]'
Fri Jun 19 02:45:40 2015 us=906702   local_port = 0
Fri Jun 19 02:45:40 2015 us=906702   remote = 'myHostname'
Fri Jun 19 02:45:40 2015 us=906702   remote_port = 443
Fri Jun 19 02:45:40 2015 us=906702   remote_float = DISABLED
Fri Jun 19 02:45:40 2015 us=906702   bind_defined = DISABLED
Fri Jun 19 02:45:40 2015 us=906702   bind_local = DISABLED
Fri Jun 19 02:45:40 2015 us=906702   connect_retry_seconds = 5
Fri Jun 19 02:45:40 2015 us=906702   connect_timeout = 10
Fri Jun 19 02:45:40 2015 us=906702 NOTE: --mute triggered...
Fri Jun 19 02:45:40 2015 us=906702 265 variation(s) on previous 20 message(s) suppressed by --mute
Fri Jun 19 02:45:40 2015 us=906702 OpenVPN 2.3.7 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Jun  8 2015
Fri Jun 19 02:45:40 2015 us=906702 library versions: OpenSSL 1.0.1m 19 Mar 2015, LZO 2.08
Enter Management Password:
Fri Jun 19 02:45:40 2015 us=906702 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Fri Jun 19 02:45:40 2015 us=906702 Need hold release from management interface, waiting...
Fri Jun 19 02:45:41 2015 us=394730 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Fri Jun 19 02:45:41 2015 us=494735 MANAGEMENT: CMD 'state on'
Fri Jun 19 02:45:41 2015 us=494735 MANAGEMENT: CMD 'log all on'
Fri Jun 19 02:45:41 2015 us=507736 MANAGEMENT: CMD 'hold off'
Fri Jun 19 02:45:41 2015 us=508736 MANAGEMENT: CMD 'hold release'
Fri Jun 19 02:45:41 2015 us=605742 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Fri Jun 19 02:45:41 2015 us=605742 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jun 19 02:45:41 2015 us=605742 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jun 19 02:45:41 2015 us=605742 LZO compression initialized
Fri Jun 19 02:45:41 2015 us=605742 Control Channel MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:3 ]
Fri Jun 19 02:45:41 2015 us=605742 Socket Buffers: R=[8192->8192] S=[8192->8192]
Fri Jun 19 02:45:41 2015 us=606742 MANAGEMENT: >STATE:1434674741,RESOLVE,,,
Fri Jun 19 02:45:41 2015 us=694747 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:143 ET:32 EL:3 AF:3/1 ]
Fri Jun 19 02:45:41 2015 us=694747 Local Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Fri Jun 19 02:45:41 2015 us=694747 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Fri Jun 19 02:45:41 2015 us=694747 Local Options hash (VER=V4): '48527533'
Fri Jun 19 02:45:41 2015 us=694747 Expected Remote Options hash (VER=V4): '44bd8b5e'
Fri Jun 19 02:45:41 2015 us=694747 UDPv4 link local: [undef]
Fri Jun 19 02:45:41 2015 us=694747 UDPv4 link remote: [AF_INET]myServerIP:443
Fri Jun 19 02:45:41 2015 us=694747 MANAGEMENT: >STATE:1434674741,WAIT,,,
Fri Jun 19 02:46:42 2015 us=134204 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Fri Jun 19 02:46:42 2015 us=134204 TLS Error: TLS handshake failed
Fri Jun 19 02:46:42 2015 us=134204 TCP/UDP: Closing socket
Fri Jun 19 02:46:42 2015 us=134204 SIGUSR1[soft,tls-error] received, process restarting
Fri Jun 19 02:46:42 2015 us=134204 MANAGEMENT: >STATE:1434674802,RECONNECTING,tls-error,,
Fri Jun 19 02:46:42 2015 us=134204 Restart pause, 2 second(s)
Fri Jun 19 02:46:44 2015 us=134318 Re-using SSL/TLS context
Fri Jun 19 02:46:44 2015 us=134318 LZO compression initialized
Fri Jun 19 02:46:44 2015 us=134318 Control Channel MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:3 ]
Fri Jun 19 02:46:44 2015 us=134318 Socket Buffers: R=[8192->8192] S=[8192->8192]
Fri Jun 19 02:46:44 2015 us=134318 MANAGEMENT: >STATE:1434674804,RESOLVE,,,
Fri Jun 19 02:46:44 2015 us=237324 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:143 ET:32 EL:3 AF:3/1 ]
Fri Jun 19 02:46:44 2015 us=237324 Local Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Fri Jun 19 02:46:44 2015 us=237324 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Fri Jun 19 02:46:44 2015 us=237324 Local Options hash (VER=V4): '48527533'
Fri Jun 19 02:46:44 2015 us=237324 Expected Remote Options hash (VER=V4): '44bd8b5e'
Fri Jun 19 02:46:44 2015 us=237324 UDPv4 link local: [undef]
Fri Jun 19 02:46:44 2015 us=237324 UDPv4 link remote: [AF_INET]myServerIP:443
Fri Jun 19 02:46:44 2015 us=237324 MANAGEMENT: >STATE:1434674804,WAIT,,,
Fri Jun 19 02:47:03 2015 us=386419 TCP/UDP: Closing socket
Fri Jun 19 02:47:03 2015 us=386419 SIGTERM[hard,] received, process exiting
Fri Jun 19 02:47:03 2015 us=386419 MANAGEMENT: >STATE:1434674823,EXITING,SIGTERM,,

I'd say everything as usual. Because if I comment out the

tls-auth ta.key 0/1

lines, everything works like a charm, I get connected quite fine:

Server log:

Fri Jun 19 03:04:01 2015 us=507165 OpenVPN 2.3.6 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on May  7 2015
Fri Jun 19 03:04:01 2015 us=507618 library versions: OpenSSL 1.0.2a 19 Mar 2015, LZO 2.08
Fri Jun 19 03:04:01 2015 us=508181 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Fri Jun 19 03:04:01 2015 us=878753 Diffie-Hellman initialized with 2048 bit key
Fri Jun 19 03:04:01 2015 us=887112 TLS-Auth MTU parms [ L:1590 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Jun 19 03:04:01 2015 us=887465 Socket Buffers: R=[163840->131072] S=[163840->131072]
Fri Jun 19 03:04:01 2015 us=910571 TUN/TAP device tap0 opened
Fri Jun 19 03:04:01 2015 us=910916 TUN/TAP TX queue length set to 100
Fri Jun 19 03:04:01 2015 us=911366 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Fri Jun 19 03:04:01 2015 us=911561 UDPv4 link local (bound): [undef]
Fri Jun 19 03:04:01 2015 us=911734 UDPv4 link remote: [undef]
Fri Jun 19 03:04:01 2015 us=911912 MULTI: multi_init called, r=256 v=256
Fri Jun 19 03:04:01 2015 us=912213 IFCONFIG POOL: base=192.168.84.47 size=3, ipv6=0
Fri Jun 19 03:04:01 2015 us=912438 IFCONFIG POOL LIST
Fri Jun 19 03:04:01 2015 us=912866 Initialization Sequence Completed
Fri Jun 19 03:05:26 2015 us=350299 MULTI: multi_create_instance called
Fri Jun 19 03:05:26 2015 us=350799 myMobileIP:24972 Re-using SSL/TLS context
Fri Jun 19 03:05:26 2015 us=351077 myMobileIP:24972 LZO compression initialized
Fri Jun 19 03:05:26 2015 us=352176 myMobileIP:24972 Control Channel MTU parms [ L:1590 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Jun 19 03:05:26 2015 us=352508 myMobileIP:24972 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Fri Jun 19 03:05:26 2015 us=352915 myMobileIP:24972 TLS: Initial packet from [AF_INET]myMobileIP:24972, sid=4d44ac93 0fa81400
Fri Jun 19 03:05:28 2015 us=201093 myMobileIP:24972 VERIFY OK: depth=1, CN=myHostname
Fri Jun 19 03:05:28 2015 us=205318 myMobileIP:24972 VERIFY OK: depth=0, CN=MD1
Fri Jun 19 03:05:28 2015 us=791128 myMobileIP:24972 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jun 19 03:05:28 2015 us=791426 myMobileIP:24972 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jun 19 03:05:28 2015 us=791637 myMobileIP:24972 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jun 19 03:05:28 2015 us=791853 myMobileIP:24972 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jun 19 03:05:28 2015 us=909350 myMobileIP:24972 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Fri Jun 19 03:05:28 2015 us=909728 myMobileIP:24972 [MD1] Peer Connection Initiated with [AF_INET]myMobileIP:24972
Fri Jun 19 03:05:28 2015 us=910085 MD1/myMobileIP:24972 MULTI_sva: pool returned IPv4=192.168.84.47, IPv6=(Not enabled)
Fri Jun 19 03:05:31 2015 us=377514 MD1/myMobileIP:24972 PUSH: Received control message: 'PUSH_REQUEST'
Fri Jun 19 03:05:31 2015 us=377778 MD1/myMobileIP:24972 send_push_reply(): safe_cap=940
Fri Jun 19 03:05:31 2015 us=378549 MD1/myMobileIP:24972 SENT CONTROL [MD1]: 'PUSH_REPLY,dhcp-option DNS 192.168.84.2,redirect-gateway def1,route-gateway 192.168.84.2,ping 10,ping-restart 120,ifconfig 192.168.84.47 255.255.255.0' (status=1)
Fri Jun 19 03:05:31 2015 us=566742 MD1/myMobileIP:24972 MULTI: Learn: 00:ff:6d:da:b7:c2 -> MD1/myMobileIP:24972

Client log:

Fri Jun 19 03:05:28 2015 us=85604 Current Parameter Settings:
Fri Jun 19 03:05:28 2015 us=86605   config = 'Arbeit (auskommentiert).ovpn'
Fri Jun 19 03:05:28 2015 us=86605   mode = 0
Fri Jun 19 03:05:28 2015 us=86605   show_ciphers = DISABLED
Fri Jun 19 03:05:28 2015 us=86605   show_digests = DISABLED
Fri Jun 19 03:05:28 2015 us=86605   show_engines = DISABLED
Fri Jun 19 03:05:28 2015 us=86605   genkey = DISABLED
Fri Jun 19 03:05:28 2015 us=86605   key_pass_file = '[UNDEF]'
Fri Jun 19 03:05:28 2015 us=86605   show_tls_ciphers = DISABLED
Fri Jun 19 03:05:28 2015 us=86605 Connection profiles [default]:
Fri Jun 19 03:05:28 2015 us=86605   proto = udp
Fri Jun 19 03:05:28 2015 us=86605   local = '[UNDEF]'
Fri Jun 19 03:05:28 2015 us=86605   local_port = 0
Fri Jun 19 03:05:28 2015 us=86605   remote = 'myHostname'
Fri Jun 19 03:05:28 2015 us=86605   remote_port = 443
Fri Jun 19 03:05:28 2015 us=86605   remote_float = DISABLED
Fri Jun 19 03:05:28 2015 us=86605   bind_defined = DISABLED
Fri Jun 19 03:05:28 2015 us=86605   bind_local = DISABLED
Fri Jun 19 03:05:28 2015 us=86605   connect_retry_seconds = 5
Fri Jun 19 03:05:28 2015 us=86605   connect_timeout = 10
Fri Jun 19 03:05:28 2015 us=86605 NOTE: --mute triggered...
Fri Jun 19 03:05:28 2015 us=86605 265 variation(s) on previous 20 message(s) suppressed by --mute
Fri Jun 19 03:05:28 2015 us=86605 OpenVPN 2.3.7 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Jun  8 2015
Fri Jun 19 03:05:28 2015 us=86605 library versions: OpenSSL 1.0.1m 19 Mar 2015, LZO 2.08
Enter Management Password:
Fri Jun 19 03:05:28 2015 us=86605 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Fri Jun 19 03:05:28 2015 us=86605 Need hold release from management interface, waiting...
Fri Jun 19 03:05:28 2015 us=573632 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Fri Jun 19 03:05:28 2015 us=673638 MANAGEMENT: CMD 'state on'
Fri Jun 19 03:05:28 2015 us=673638 MANAGEMENT: CMD 'log all on'
Fri Jun 19 03:05:28 2015 us=690639 MANAGEMENT: CMD 'hold off'
Fri Jun 19 03:05:28 2015 us=690639 MANAGEMENT: CMD 'hold release'
Fri Jun 19 03:05:28 2015 us=791645 LZO compression initialized
Fri Jun 19 03:05:28 2015 us=791645 Control Channel MTU parms [ L:1590 D:138 EF:38 EB:0 ET:0 EL:3 ]
Fri Jun 19 03:05:28 2015 us=791645 Socket Buffers: R=[8192->8192] S=[8192->8192]
Fri Jun 19 03:05:28 2015 us=791645 MANAGEMENT: >STATE:1434675928,RESOLVE,,,
Fri Jun 19 03:05:28 2015 us=892651 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:143 ET:32 EL:3 AF:3/1 ]
Fri Jun 19 03:05:28 2015 us=892651 Local Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Fri Jun 19 03:05:28 2015 us=892651 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Fri Jun 19 03:05:28 2015 us=892651 Local Options hash (VER=V4): 'c6c7c21a'
Fri Jun 19 03:05:28 2015 us=892651 Expected Remote Options hash (VER=V4): '1a6d5c5d'
Fri Jun 19 03:05:28 2015 us=892651 UDPv4 link local: [undef]
Fri Jun 19 03:05:28 2015 us=892651 UDPv4 link remote: [AF_INET]myServerIP:443
Fri Jun 19 03:05:28 2015 us=892651 MANAGEMENT: >STATE:1434675928,WAIT,,,
Fri Jun 19 03:05:29 2015 us=7657 MANAGEMENT: >STATE:1434675929,AUTH,,,
Fri Jun 19 03:05:29 2015 us=7657 TLS: Initial packet from [AF_INET]myServerIP:443, sid=63fee08c d4d58b67
Fri Jun 19 03:05:30 2015 us=67718 VERIFY OK: depth=1, CN=myHostname
Fri Jun 19 03:05:30 2015 us=69718 Validating certificate key usage
Fri Jun 19 03:05:30 2015 us=69718 ++ Certificate has key usage  00a0, expects 00a0
Fri Jun 19 03:05:30 2015 us=69718 VERIFY KU OK
Fri Jun 19 03:05:30 2015 us=69718 Validating certificate extended key usage
Fri Jun 19 03:05:30 2015 us=69718 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Fri Jun 19 03:05:30 2015 us=69718 VERIFY EKU OK
Fri Jun 19 03:05:30 2015 us=69718 VERIFY OK: depth=0, CN=myHostname
Fri Jun 19 03:05:31 2015 us=458797 NOTE: Options consistency check may be skewed by version differences
Fri Jun 19 03:05:31 2015 us=458797 WARNING: 'version' is used inconsistently, local='version V4', remote='version V0 UNDEF'
Fri Jun 19 03:05:31 2015 us=458797 WARNING: 'dev-type' is present in local config but missing in remote config, local='dev-type tap'
Fri Jun 19 03:05:31 2015 us=458797 WARNING: 'link-mtu' is present in local config but missing in remote config, local='link-mtu 1590'
Fri Jun 19 03:05:31 2015 us=458797 WARNING: 'tun-mtu' is present in local config but missing in remote config, local='tun-mtu 1532'
Fri Jun 19 03:05:31 2015 us=458797 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Fri Jun 19 03:05:31 2015 us=458797 WARNING: 'cipher' is present in local config but missing in remote config, local='cipher AES-256-CBC'
Fri Jun 19 03:05:31 2015 us=458797 WARNING: 'auth' is present in local config but missing in remote config, local='auth SHA1'
Fri Jun 19 03:05:31 2015 us=458797 WARNING: 'keysize' is present in local config but missing in remote config, local='keysize 256'
Fri Jun 19 03:05:31 2015 us=458797 WARNING: 'key-method' is present in local config but missing in remote config, local='key-method 2'
Fri Jun 19 03:05:31 2015 us=458797 WARNING: 'tls-server' is present in local config but missing in remote config, local='tls-server'
Fri Jun 19 03:05:31 2015 us=458797 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jun 19 03:05:31 2015 us=458797 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jun 19 03:05:31 2015 us=458797 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Jun 19 03:05:31 2015 us=458797 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jun 19 03:05:31 2015 us=458797 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Fri Jun 19 03:05:31 2015 us=458797 [myHostname] Peer Connection Initiated with [AF_INET]myServerIP:443
Fri Jun 19 03:05:32 2015 us=683867 MANAGEMENT: >STATE:1434675932,GET_CONFIG,,,
Fri Jun 19 03:05:33 2015 us=908938 SENT CONTROL [myHostname]: 'PUSH_REQUEST' (status=1)
Fri Jun 19 03:05:34 2015 us=44945 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 192.168.84.2,redirect-gateway def1,route-gateway 192.168.84.2,ping 10,ping-restart 120,ifconfig 192.168.84.47 255.255.255.0'
Fri Jun 19 03:05:34 2015 us=44945 OPTIONS IMPORT: timers and/or timeouts modified
Fri Jun 19 03:05:34 2015 us=44945 OPTIONS IMPORT: --ifconfig/up options modified
Fri Jun 19 03:05:34 2015 us=44945 OPTIONS IMPORT: route options modified
Fri Jun 19 03:05:34 2015 us=44945 OPTIONS IMPORT: route-related options modified
Fri Jun 19 03:05:34 2015 us=44945 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Fri Jun 19 03:05:34 2015 us=56946 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Jun 19 03:05:34 2015 us=56946 MANAGEMENT: >STATE:1434675934,ASSIGN_IP,,192.168.84.47,
Fri Jun 19 03:05:34 2015 us=56946 open_tun, tt->ipv6=0
Fri Jun 19 03:05:34 2015 us=57946 TAP-WIN32 device [LAN-Verbindung 2] opened: \\.\Global\{6DDAB7C2-A589-43D6-96DA-63CC0B7432EA}.tap
Fri Jun 19 03:05:34 2015 us=57946 TAP-Windows Driver Version 9.21 
Fri Jun 19 03:05:34 2015 us=57946 TAP-Windows MTU=1500
Fri Jun 19 03:05:34 2015 us=58946 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.84.47/255.255.255.0 on interface {6DDAB7C2-A589-43D6-96DA-63CC0B7432EA} [DHCP-serv: 192.168.84.0, lease-time: 31536000]
Fri Jun 19 03:05:34 2015 us=58946 DHCP option string: 0604c0a8 5402
Fri Jun 19 03:05:34 2015 us=59946 Successful ARP Flush on interface [30] {6DDAB7C2-A589-43D6-96DA-63CC0B7432EA}
Fri Jun 19 03:05:39 2015 us=165238 TEST ROUTES: 1/1 succeeded len=0 ret=1 a=0 u/d=up
Fri Jun 19 03:05:39 2015 us=166238 C:\Windows\system32\route.exe ADD myServerIP MASK 255.255.255.255 192.168.43.1
Fri Jun 19 03:05:39 2015 us=167238 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Fri Jun 19 03:05:39 2015 us=167238 Route addition via IPAPI succeeded [adaptive]
Fri Jun 19 03:05:39 2015 us=167238 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 192.168.84.2
Fri Jun 19 03:05:39 2015 us=169238 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Fri Jun 19 03:05:39 2015 us=169238 Route addition via IPAPI succeeded [adaptive]
Fri Jun 19 03:05:39 2015 us=169238 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 192.168.84.2
Fri Jun 19 03:05:39 2015 us=170238 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Fri Jun 19 03:05:39 2015 us=170238 Route addition via IPAPI succeeded [adaptive]
Fri Jun 19 03:05:39 2015 us=170238 Initialization Sequence Completed
Fri Jun 19 03:05:39 2015 us=170238 MANAGEMENT: >STATE:1434675939,CONNECTED,SUCCESS,192.168.84.47,myServerIP