The Goal: To create a bridge using OpenVPN in bridge mode from a working OpenVPN implementation using Routing mode with the Server on Windows Server 2008 R2 and clients on Windows7 and Windows8. (I use linux too, but this is to connect a developer for a windows project).
The Resources: I have a Windows Server 2008 R2 installation up with OpenVPN in routed mode and it's worked like a champ, no issues once I got it running. We've used certs issued from the server. I now need to change this to bridged mode to allow a windows developer to connect directly to the environment. The server is remotely hosted. I have setup the TAP32 bridge, renaming the adapter 'tap-bridge' as per the howto's and set the bridge adapter to the proper IP/subnet. There are two NICs on the server, one I maintain a connection to via RDP if needed for the moment since I can't very well bridge and lose the connection should it not work on only one NIC.
I have tried configurations using TCP and UDP. TCP config connects when configured to proto tcp and port 443, but then won't recognize the tap adapter giving an error tap-win32 adapter 'tap-bridge' not found. UDP config doesn't seem to connect at all. UDP configs for server and client are below as is the output log. I see an error re: cert verification in the UDP output (below) that is not present in the TCP output, but d/k what to do to address it or even if it's the source of the issue.
I know this has to be me missing something, but after struggling a lot and researching for hours I can't figure it out and I have to get it running to get this dev working today. This is my first time setting up OpenVPN in bridge mode. I've set it up successfully several times for routing, includuing the cert auth and cutting certs for clients, etc. so I'm believing this is some noob mistake. Thank you in advance for your help.
SERVER
port 1194
proto udp
dev tap
dev-node tap-bridge
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server-bridge 10.8.0.4 255.255.255.0 10.8.0.5 10.8.0.7
keepalive 10 120
comp-lzo
persist-key
persist-tun
verb 3
CLIENT
client
dev tap
dev-node tap-bridge
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
comp-lzo
verb 3
The output for the UDP session is as follows:
OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
WARNING: No server certificate verification method has been enabled. See
http://openvpn.net/howto.html#mitm for more info.
NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
LZO compression initialized
Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Socket Buffers: R=[65536->65536] S=[65536->65536]
Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Local Options hash (VER=V4): 'xxxxxxxx'
Expected Remote Options hash (VER=V4): 'xxxxxxxx'
UDPv4 link local: [undef]
UDPv4 link remote: xxx.xxx.xxx.xxx:1194
TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
TLS Error: TLS handshake failed
TCP/UDP: Closing socket
SIGUSR1[soft,tls-error] received, process restarting
Restart pause, 2 second(s)
WARNING: No server certificate verification method has been enabled. See
http://openvpn.net/howto.html#mitm for more info.
NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Re-using SSL/TLS context
LZO compression initialized
Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Socket Buffers: R=[65536->65536] S=[65536->65536]
Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Local Options hash (VER=V4): 'xxxxxxxx'
Expected Remote Options hash (VER=V4): 'xxxxxxxx'
2013 UDPv4 link local: [undef]
UDPv4 link remote: xxx.xxx.xxx.xxx:1194
