I have setup OpenVPN on a Windows Server 2012, and am accessing it from a single Windows 7 client (in future I will be using multiple clients with a single server). I just need to access a software license server installed on the same server machine, so no routing required. The server is remote and can only be accessed through Windows Remote Desktop. My server has a static IP. I have turned all software firewalls off. Hardware firewalls have ICMP and the specified UDP port open.
I am running the OpenVPN Windows Service, enabled from the Admin account. On my client I am using the OpenVPN GUI run as admin. I can always connect from my client, however only rarely does traffic get through (e.g., ping, and software license requests). When I do manage to get a stable, repeatable working state, if I do a server reboot everything silently breaks for hours or days. I can always connect and get all the appropriate connection messages, but just can't ping or transfer data. After multiple restarts, and changing settings and then reverting them back, it will usually get to a state where it can ping again until the next restart. So far I haven't found anything that repeatedly breaks or fixes the setup. (e.g., changing the client and server ping and keepalive config settings, changing the server IP pool values to 10.x.0.0, dev tap instead of dev tun).
My Server config is as follows. The only real change from the supplied sample-config is switching port from 1194 to 7812, a modified keepalive to prevent time-outs, and inactive to ensure server is always up:
port 7812
proto udp
dev tun
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem"
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 5 180
inactive 0
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 5
The client config is similar:
client
dev tun
proto udp
remote SERVERIP 7812
resolv-retry infinite
nobind
keepalive 5 180
persist-key
persist-tun
ca "C:\\Program Files (x86)\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files (x86)\\OpenVPN\\config\\nickw-laptop.crt"
key "C:\\Program Files (x86)\\OpenVPN\\config\\nickw-laptop.key"
ns-cert-type server
comp-lzo
verb 5
My client log (verb 5) is:
https://www.dropbox.com/s/eavskgbv3ughoii/server_persist1.log
My client log (verb 5) is:
https://www.dropbox.com/s/pjkywtd5rjd38a8/nickw-laptop_persist1.log
Because the connection does sometimes work, I have been able to identify the only difference between the working and non-working logs is the following set of entries in the client logs (the working and broken server logs are identical):
Working client log:
Successful ARP Flush on interface [15] {B99A6F9E-31E6-4D22-9D11-5A718EC4B074}
C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.2
ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Route addition via IPAPI succeeded [adaptive]
Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Broken client log:
Successful ARP Flush on interface [15] {B99A6F9E-31E6-4D22-9D11-5A718EC4B074}
C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.2
Warning: route gateway is not reachable on any active network adapters: 10.8.0.2
Route addition via IPAPI failed [adaptive]
Route addition fallback to route.exe
env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Any ideas what causes that subtle difference?
I have spent weeks trying to get this working. What other settings can I try? Is the problem likely to be client-side or server-side?
Many thanks!
