Server not assigning ipaddress to client

sparkbird

I have setup a openvpn server on raspberry pi B model.

Below are the problems
1. Server does not assign any ip to the client virtual adapter.
2. Server cannot ping client, nor can the client ping the server.
3. even if we manually set the ipaddress of the virtual adapter (on the client) to a address (10.10.10.200) in subnet of openvpn server, then also server and client cannot ping each other.

What i want to achieve
1. Any clients getting connected to openvpn should get a ipaddress assigned ins the subnet of the openvpn (10.10.10.xxx)
2. all clients should be able to see (ping, access and reach) other clients
3. All clients should be able to access all other machines in the subnet 10.10.10.xxx and vice-versa

Below are the details

Network diagram
Client ---- Modem-----internet------modem(port 1194 forwared to openvpn)----openvpn

Server.conf

local 10.10.10.102
port 1194
proto udp
dev tap0
#up "/etc/openvpn/up.sh br0 eth0"
ca ca.crt
cert vpnserver.crt
key vpnserver.key  # This file should be kept secret
dh dh1024.pem
server-bridge 10.10.10.102 255.255.255.0 10.10.10.200 10.10.10.210
ifconfig-pool-persist ipp.txt
push "route 10.10.10.0 255.255.255.0"
client-to-client
keepalive 10 120
tls-auth ta.key 0 # This file is secret
cipher AES-128-CBC   # AES
comp-lzo
max-clients 10
persist-key
persist-tun
status openvpn-status.log
log         /var/log/openvpn/openvpn.log
verb 3
script-security 3

Client.ovpn

remote mydomain.org
tls-client
port 1194
dev tap
dh ../keys/dh1024.pem
ca ../keys/ca.crt
cert ../keys/client1.crt
key ../keys/client1.key
tls-auth ../keys/ta.key 1
cipher AES-128-CBC
ping 10
comp-lzo
verb 6
mute 10

output of iptables -L -t nat -v

pi@raspberrypi /etc/openvpn $ sudo iptables -L -t nat -v
Chain PREROUTING (policy ACCEPT 2941 packets, 626K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain INPUT (policy ACCEPT 142 packets, 24738 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 65 packets, 4263 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 71 packets, 4661 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 MASQUERADE  all  --  any    eth0    10.10.10.0/24        anywhere

output of iptables -L

pi@raspberrypi /etc/openvpn $ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  10.10.10.0/24        anywhere
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

output of ifconfig on openvpn

br0       Link encap:Ethernet  HWaddr b8:27:eb:9f:d8:e3
          inet addr:10.10.10.102  Bcast:10.10.10.255  Mask:255.255.255.0
          inet6 addr: fe80::ba27:ebff:fe9f:d8e3/64 Scope:Link
          inet6 addr: fd77:a85:f4ba:0:ba27:ebff:fe9f:d8e3/64 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:6320 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3806 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:936148 (914.2 KiB)  TX bytes:490081 (478.5 KiB)

eth0      Link encap:Ethernet  HWaddr b8:27:eb:9f:d8:e3
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:8236 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3806 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:1427266 (1.3 MiB)  TX bytes:533561 (521.0 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:114 errors:0 dropped:0 overruns:0 frame:0
          TX packets:114 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:13296 (12.9 KiB)  TX bytes:13296 (12.9 KiB)

tap0      Link encap:Ethernet  HWaddr aa:fb:fc:d7:e8:90
          inet6 addr: fe80::a8fb:fcff:fed7:e890/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 B)  TX bytes:468 (468.0 B)

output of route print on client machine

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1      192.168.1.2     20
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      169.254.0.0      255.255.0.0         On-link   169.254.164.169    286
  169.254.164.169  255.255.255.255         On-link   169.254.164.169    286
  169.254.255.255  255.255.255.255         On-link   169.254.164.169    286
      192.168.1.0    255.255.255.0         On-link       192.168.1.2    276
      192.168.1.2  255.255.255.255         On-link       192.168.1.2    276
    192.168.1.255  255.255.255.255         On-link       192.168.1.2    276
     192.168.46.0    255.255.255.0         On-link      192.168.46.1    276
     192.168.46.1  255.255.255.255         On-link      192.168.46.1    276
   192.168.46.255  255.255.255.255         On-link      192.168.46.1    276
    192.168.110.0    255.255.255.0         On-link     192.168.110.1    276
    192.168.110.1  255.255.255.255         On-link     192.168.110.1    276
  192.168.110.255  255.255.255.255         On-link     192.168.110.1    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link       192.168.1.2    276
        224.0.0.0        240.0.0.0         On-link     192.168.110.1    276
        224.0.0.0        240.0.0.0         On-link      192.168.46.1    276
        224.0.0.0        240.0.0.0         On-link   169.254.164.169    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link       192.168.1.2    276
  255.255.255.255  255.255.255.255         On-link     192.168.110.1    276
  255.255.255.255  255.255.255.255         On-link      192.168.46.1    276
  255.255.255.255  255.255.255.255         On-link   169.254.164.169    286
===========================================================================
Persistent Routes:
  None

contents of /etc/network/interfaces

# The loopback network interface
auto lo br0
iface lo inet loopback

# The primary network interface
iface br0 inet static
        address 10.10.10.102
        netmask 255.255.255.0
        gateway 10.10.10.1
        bridge_ports eth0

iface eth0 inet manual
        up ip link set $IFACE up promisc on
        down ip link set $IFACE down promisc off

contents of up.sh

#!/bin/bash

#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth0"
eth_ip="10.10.10.102"
eth_netmask="255.255.255.0"
eth_broadcast="10.10.10.255"

for t in $tap; do
    openvpn --mktun --dev $t
done

brctl addbr $br
brctl addif $br $eth

for t in $tap; do
    brctl addif $br $t
done

for t in $tap; do
    ifconfig $t 0.0.0.0 promisc up
done

ifconfig $eth 0.0.0.0 promisc up

ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast
route add default gw 10.10.10.1 br0

output of brctl show

pi@raspberrypi /etc/openvpn $ sudo brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.b827eb9fd8e3       no              eth0

I am stuck and cannot proceed, :-( i tried lot many things for past 1 day, no success
Can somebody please help me here.

maikcat

hello there,

whats the masq rule for?

tap0 interface MUST be in PROMISC mode too,
did you enable ip forwarding?
try adding tap0 to bridge then start vpn , remember brctl show MUST show both eth & tap in br0 interface...

also server logs would be a valuable source of information..please post them.

Michael.

sparkbird

whats the masq rule for?

I dont know. I read on a "how to configure openvpn" and there was a instruction to add it.
Do you think it should not be there? How can i remove it?

tap0 interface MUST be in PROMISC mode too,

how do i do this ?

did you enable ip forwarding?

how can i check this? is it displayed in the iptables rules?

below is the server log contents

Mon Aug  5 00:18:30 2013 OpenVPN 2.2.1 arm-linux-gnueabihf [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Apr 28 2012
Mon Aug  5 00:18:30 2013 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Mon Aug  5 00:18:30 2013 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Mon Aug  5 00:18:30 2013 Diffie-Hellman initialized with 1024 bit key
Mon Aug  5 00:18:30 2013 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Mon Aug  5 00:18:30 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Aug  5 00:18:30 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Aug  5 00:18:30 2013 TLS-Auth MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:0 ]
Mon Aug  5 00:18:30 2013 Socket Buffers: R=[163840->131072] S=[163840->131072]
Mon Aug  5 00:18:30 2013 TUN/TAP device tap0 opened
Mon Aug  5 00:18:30 2013 TUN/TAP TX queue length set to 100
Mon Aug  5 00:18:30 2013 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Mon Aug  5 00:18:30 2013 UDPv4 link local (bound): [AF_INET]10.10.10.102:1194
Mon Aug  5 00:18:30 2013 UDPv4 link remote: [undef]
Mon Aug  5 00:18:30 2013 MULTI: multi_init called, r=256 v=256
Mon Aug  5 00:18:30 2013 IFCONFIG POOL: base=10.10.10.200 size=11, ipv6=0
Mon Aug  5 00:18:30 2013 ifconfig_pool_read(), in='BHAGINVPN-CA,10.10.10.200', TODO: IPv6
Mon Aug  5 00:18:30 2013 succeeded -> ifconfig_pool_set()
Mon Aug  5 00:18:30 2013 IFCONFIG POOL LIST
Mon Aug  5 00:18:30 2013 BHAGINVPN-CA,10.10.10.200
Mon Aug  5 00:18:30 2013 Initialization Sequence Completed

maikcat

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

sparkbird

🙂 ok from now on, i will not add rules that i dont understand.

Below are the answers for your question.

cat /proc/sys/net/ipv4/ip_forward

1
i did the following

openvpn --mktun --dev tap0
brctl addif br0 tap0
brctl show   
ifconfig tap0 0.0.0.0 promisc up
ifconfig eth0 0.0.0.0 promisc up
service openvpn start

still no success, :-( openvpn says connected but the virtual interface does not get any ip assigned.

below is the show brctl show output

pi@raspberrypi ~ $ sudo brctl show
bridge name bridge id STP enabled interfaces
br0 8000.8aa811022cf7 no eth0
tap0

pi@raspberrypi ~ $ sudo ifconfig
br0 Link encap:Ethernet HWaddr 8a:a8:11:02:2c:f7
inet addr:10.10.10.102 Bcast:10.10.10.255 Mask:255.255.255.0
inet6 addr: fe80::ba27:ebff:fe9f:d8e3/64 Scope:Link
inet6 addr: fd77:a85:f4ba:0:88a8:11ff:fe02:2cf7/64 Scope:Global
inet6 addr: fd77:a85:f4ba:0:ba27:ebff:fe9f:d8e3/64 Scope:Global
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:8649 errors:0 dropped:0 overruns:0 frame:0
TX packets:5265 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:856697 (836.6 KiB) TX bytes:820180 (800.9 KiB)

eth0 Link encap:Ethernet HWaddr b8:27:eb:9f:d8:e3
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:40041 errors:0 dropped:0 overruns:0 frame:0
TX packets:5436 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:10482476 (9.9 MiB) TX bytes:916117 (894.6 KiB)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:39 errors:0 dropped:0 overruns:0 frame:0
TX packets:39 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:3760 (3.6 KiB) TX bytes:3760 (3.6 KiB)

tap0 Link encap:Ethernet HWaddr 8a:a8:11:02:2c:f7
inet6 addr: fe80::88a8:11ff:fe02:2cf7/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:840 errors:0 dropped:0 overruns:0 frame:0
TX packets:1713 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:129906 (126.8 KiB) TX bytes:374328 (365.5 KiB)

let me know if u need nay further info..

maikcat

can you post full client logs?

Michael.

sparkbird

Here goes the client log

Mon Aug 12 17:21:00 2013 us=995000 Current Parameter Settings:
Mon Aug 12 17:21:01 2013 us=58000   config = 'bhaginvpn_rohitmp.ovpn'
Mon Aug 12 17:21:01 2013 us=58000   mode = 0
Mon Aug 12 17:21:01 2013 us=58000   show_ciphers = DISABLED
Mon Aug 12 17:21:01 2013 us=58000   show_digests = DISABLED
Mon Aug 12 17:21:01 2013 us=58000   show_engines = DISABLED
Mon Aug 12 17:21:01 2013 us=58000   genkey = DISABLED
Mon Aug 12 17:21:01 2013 us=58000   key_pass_file = '[UNDEF]'
Mon Aug 12 17:21:01 2013 us=58000   show_tls_ciphers = DISABLED
Mon Aug 12 17:21:01 2013 us=58000 Connection profiles [default]:
Mon Aug 12 17:21:01 2013 us=58000 NOTE: --mute triggered...
Mon Aug 12 17:21:01 2013 us=58000 263 variation(s) on previous 10 message(s) suppressed by --mute
Mon Aug 12 17:21:01 2013 us=58000 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Mon Aug 12 17:21:01 2013 us=58000 WARNING: --ping should normally be used with --ping-restart or --ping-exit
Mon Aug 12 17:21:01 2013 us=58000 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Aug 12 17:21:01 2013 us=58000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Aug 12 17:21:01 2013 us=775000 Control Channel Authentication: using '../keys/ta.key' as a OpenVPN static key file
Mon Aug 12 17:21:01 2013 us=775000 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Aug 12 17:21:01 2013 us=775000 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Aug 12 17:21:01 2013 us=775000 LZO compression initialized
Mon Aug 12 17:21:01 2013 us=775000 Control Channel MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:0 ]
Mon Aug 12 17:21:01 2013 us=807000 Socket Buffers: R=[8192->8192] S=[64512->64512]
Mon Aug 12 17:21:02 2013 us=243000 TAP-WIN32 device [Local Area Connection 4] opened: \\.\Global\{B41D8A7A-C69B-4C98-AD19-96EA6C774C3B}.tap
Mon Aug 12 17:21:02 2013 us=243000 TAP-Win32 Driver Version 9.9 
Mon Aug 12 17:21:02 2013 us=243000 TAP-Win32 MTU=1500
Mon Aug 12 17:21:02 2013 us=243000 Successful ARP Flush on interface [27] {B41D8A7A-C69B-4C98-AD19-96EA6C774C3B}
Mon Aug 12 17:21:02 2013 us=243000 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Mon Aug 12 17:21:02 2013 us=243000 Local Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 1,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Mon Aug 12 17:21:02 2013 us=243000 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 0,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Mon Aug 12 17:21:02 2013 us=243000 Local Options hash (VER=V4): 'a7133b47'
Mon Aug 12 17:21:02 2013 us=243000 Expected Remote Options hash (VER=V4): 'c5677ab3'
Mon Aug 12 17:21:02 2013 us=243000 UDPv4 link local (bound): [undef]:1194
Mon Aug 12 17:21:02 2013 us=243000 UDPv4 link remote: 106.51.141.186:1194
Mon Aug 12 17:21:02 2013 us=243000 UDPv4 WRITE [42] to 106.51.141.186:1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #1 ] [ ] pid=0 DATA len=0
Mon Aug 12 17:21:02 2013 us=337000 TUN READ [110]
Mon Aug 12 17:21:02 2013 us=353000 TUN READ [110]
Mon Aug 12 17:21:02 2013 us=353000 TUN READ [110]
Mon Aug 12 17:21:02 2013 us=446000 TUN READ [90]
Mon Aug 12 17:21:02 2013 us=446000 TUN READ [54]
Mon Aug 12 17:21:02 2013 us=446000 TUN READ [342]
Mon Aug 12 17:21:02 2013 us=462000 TUN READ [54]
Mon Aug 12 17:21:02 2013 us=462000 TUN READ [78]
Mon Aug 12 17:21:02 2013 us=462000 TUN READ [70]
Mon Aug 12 17:21:02 2013 us=462000 NOTE: --mute triggered...
Mon Aug 12 17:22:02 2013 us=163000 115 variation(s) on previous 10 message(s) suppressed by --mute
Mon Aug 12 17:22:02 2013 us=163000 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Aug 12 17:22:02 2013 us=163000 TLS Error: TLS handshake failed
Mon Aug 12 17:22:02 2013 us=163000 TCP/UDP: Closing socket
Mon Aug 12 17:22:02 2013 us=163000 Closing TUN/TAP interface
Mon Aug 12 17:22:02 2013 us=163000 SIGUSR1[soft,tls-error] received, process restarting
Mon Aug 12 17:22:02 2013 us=163000 Restart pause, 2 second(s)
Mon Aug 12 17:22:04 2013 us=160000 WARNING: --ping should normally be used with --ping-restart or --ping-exit
Mon Aug 12 17:22:04 2013 us=160000 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Aug 12 17:22:04 2013 us=160000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Aug 12 17:22:04 2013 us=269000 Control Channel Authentication: using '../keys/ta.key' as a OpenVPN static key file
Mon Aug 12 17:22:04 2013 us=269000 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Aug 12 17:22:04 2013 us=269000 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Aug 12 17:22:04 2013 us=269000 LZO coMon Aug 12 17:22:04 2013 us=394000 Expected Remote Options hash (VER=V4): 'c5677ab3'
Mon Aug 12 17:22:04 2013 us=394000 UDPv4 link local (bound): [undef]:1194
Mon Aug 12 17:22:04 2013 us=394000 UDPv4 link remote: 106.51.141.186:1194
Mon Aug 12 17:22:04 2013 us=394000 UDPv4 WRITE [42] to 106.51.141.186:1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #1 ] [ ] pid=0 DATA len=0
Mon Aug 12 17:22:04 2013 us=457000 TUN READ [54]
Mon Aug 12 17:22:04 2013 us=457000 TUN READ [78]
Mon Aug 12 17:22:04 2013 us=457000 TUN READ [70]
Mon Aug 12 17:22:04 2013 us=457000 TUN READ [110]
Mon Aug 12 17:22:04 2013 us=503000 TUN READ [110]
Mon Aug 12 17:22:04 2013 us=535000 TUN READ [90]
Mon Aug 12 17:22:04 2013 us=535000 TUN READ [54]
Mon Aug 12 17:22:04 2013 us=550000 TUN READ [110]
Mon Aug 12 17:22:04 2013 us=566000 TUN READ [110]
Mon Aug 12 17:22:04 2013 us=581000 NOTE: --mute triggered...

maikcat

Mon Aug 12 17:22:02 2013 us=163000 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

did you forward the port (server side) from your router to your openvpn server?
did you configured firewalls (server side) to allow traffic to openvpn service?

Michael.

sparkbird

Yes. The router has a proper forwarding. It is because of this, that the client is properly able to connect to openvpn.
I can see activity in server log when a client tries to connect.

Yes i believe the firewall setting is correct. Below is the iptables output.
Let me know if there is something wrong, and how do i fix it.

pi@raspberrypi ~ $ sudo iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
ACCEPT     all  --  10.10.10.0/24        0.0.0.0/0
REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

sparkbird

here is another set of client logs

Tue Aug 13 03:12:26 2013 us=153000 Current Parameter Settings:
Tue Aug 13 03:12:26 2013 us=168000 config = 'vpn_client.ovpn'
Tue Aug 13 03:12:26 2013 us=168000 mode = 0
Tue Aug 13 03:12:26 2013 us=168000 show_ciphers = DISABLED
Tue Aug 13 03:12:26 2013 us=168000 show_digests = DISABLED
Tue Aug 13 03:12:26 2013 us=168000 show_engines = DISABLED
Tue Aug 13 03:12:26 2013 us=168000 genkey = DISABLED
Tue Aug 13 03:12:26 2013 us=168000 key_pass_file = '[UNDEF]'
Tue Aug 13 03:12:26 2013 us=168000 show_tls_ciphers = DISABLED
Tue Aug 13 03:12:26 2013 us=168000 Connection profiles [default]:
Tue Aug 13 03:12:26 2013 us=168000 NOTE: --mute triggered...
Tue Aug 13 03:12:26 2013 us=168000 263 variation(s) on previous 10 message(s) suppressed by --mute
Tue Aug 13 03:12:26 2013 us=168000 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Tue Aug 13 03:12:26 2013 us=168000 WARNING: --ping should normally be used with --ping-restart or --ping-exit
Tue Aug 13 03:12:26 2013 us=168000 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Tue Aug 13 03:12:26 2013 us=168000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Aug 13 03:12:26 2013 us=730000 Control Channel Authentication: using '../keys/ta.key' as a OpenVPN static key file
Tue Aug 13 03:12:26 2013 us=730000 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Aug 13 03:12:26 2013 us=730000 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Aug 13 03:12:26 2013 us=730000 LZO compression initialized
Tue Aug 13 03:12:26 2013 us=730000 Control Channel MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Aug 13 03:12:26 2013 us=792000 Socket Buffers: R=[8192->8192] S=[64512->64512]
Tue Aug 13 03:12:27 2013 us=167000 TAP-WIN32 device [Local Area Connection 4] opened: \\.\Global\{B41D8A7A-C69B-4C98-AD19-96EA6C774C3B}.tap
Tue Aug 13 03:12:27 2013 us=167000 TAP-Win32 Driver Version 9.9
Tue Aug 13 03:12:27 2013 us=167000 TAP-Win32 MTU=1500
Tue Aug 13 03:12:27 2013 us=167000 Successful ARP Flush on interface [27] {B41D8A7A-C69B-4C98-AD19-96EA6C774C3B}
Tue Aug 13 03:12:27 2013 us=167000 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Aug 13 03:12:27 2013 us=167000 Local Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 1,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Tue Aug 13 03:12:27 2013 us=167000 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 0,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Tue Aug 13 03:12:27 2013 us=167000 Local Options hash (VER=V4): 'a7133b47'
Tue Aug 13 03:12:27 2013 us=167000 Expected Remote Options hash (VER=V4): 'c5677ab3'
Tue Aug 13 03:12:27 2013 us=167000 UDPv4 link local (bound): [undef]:1194
Tue Aug 13 03:12:27 2013 us=167000 UDPv4 link remote: vpnserver.eg.com:1194
Tue Aug 13 03:12:27 2013 us=167000 UDPv4 WRITE [42] to vpnserver.eg.com:1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 pid=[ #1 ] [ ] pid=0 DATA len=0
Tue Aug 13 03:12:27 2013 us=182000 UDPv4 READ [54] from vpnserver.eg.com:1194: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 pid=[ #1 ] [ 0 ] pid=0 DATA len=0
Tue Aug 13 03:12:27 2013 us=182000 TLS: Initial packet from vpnserver.eg.com:1194, sid=1a05bcfe 81b27741
Tue Aug 13 03:12:27 2013 us=182000 UDPv4 WRITE [50] to vpnserver.eg.com:1194: P_ACK_V1 kid=0 pid=[ #2 ] [ 0 ]
Tue Aug 13 03:12:27 2013 us=198000 UDPv4 WRITE [142] to vpnserver.eg.com:1194: P_CONTROL_V1 kid=0 pid=[ #3 ] [ ] pid=1 DATA len=100
Tue Aug 13 03:12:27 2013 us=198000 UDPv4 WRITE [142] to vpnserver.eg.com:1194: P_CONTROL_V1 kid=0 pid=[ #4 ] [ ] pid=2 DATA len=100
Tue Aug 13 03:12:27 2013 us=198000 UDPv4 WRITE [52] to vpnserver.eg.com:1194: P_CONTROL_V1 kid=0 pid=[ #5 ] [ ] pid=3 DATA len=10
Tue Aug 13 03:12:27 2013 us=198000 UDPv4 READ [50] from vpnserver.eg.com:1194: P_ACK_V1 kid=0 pid=[ #2 ] [ 1 ]
Tue Aug 13 03:12:27 2013 us=198000 UDPv4 READ [50] from vpnserver.eg.com:1194: P_ACK_V1 kid=0 pid=[ #3 ] [ 2 ]
Tue Aug 13 03:12:27 2013 us=245000 TUN READ [342]
Tue Aug 13 03:12:27 2013 us=245000 UDPv4 READ [154] from vpnserver.eg.com:1194: P_CONTROL_V1 kid=0 pid=[ #4 ] [ 3 ] pid=1 DATA len=100
Tue Aug 13 03:12:27 2013 us=245000 UDPv4 WRITE [50] to vpnserver.eg.com:1194: P_ACK_V1 kid=0 pid=[ #6 ] [ 1 ]
Tue Aug 13 03:12:27 2013 us=245000 UDPv4 READ [142] from vpnserver.eg.com:1194: P_CONTROL_V1 kid=0 pid=[ #5 ] [ ] pid=2 DATA len=100
Tue Aug 13 03:12:27 2013 us=245000 NOTE: --mute triggered...
Tue Aug 13 03:12:27 2013 us=260000 38 variation(s) on previous 10 message(s) suppressed by --mute
Tue Aug 13 03:12:27 2013 us=260000 VERIFY OK: depth=1, /C=IN/ST=KAR/L=xxxxx/O=yyyyy/CN=xxxxxx_CA/emailAddress=xxxx.yyyy@outlook.com
Tue Aug 13 03:12:27 2013 us=260000 VERIFY OK: depth=0, /C=IN/ST=KAR/L=xxxxx/O=yyyyy/CN=vpnserver/emailAddress=xxxx.yyyy@outlook.com
Tue Aug 13 03:12:27 2013 us=260000 UDPv4 WRITE [50] to vpnserver.eg.com:1194: P_ACK_V1 kid=0 pid=[ #25 ] [ 20 ]
Tue Aug 13 03:12:27 2013 us=260000 UDPv4 READ [142] from vpnserver.eg.com:1194: P_CONTROL_V1 kid=0 pid=[ #24 ] [ ] pid=21 DATA len=100
Tue Aug 13 03:12:27 2013 us=260000 UDPv4 WRITE [50] to vpnserver.eg.com:1194: P_ACK_V1 kid=0 pid=[ #26 ] [ 21 ]
Tue Aug 13 03:12:27 2013 us=260000 UDPv4 READ [142] from vpnserver.eg.com:1194: P_CONTROL_V1 kid=0 pid=[ #25 ] [ ] pid=22 DATA len=100
Tue Aug 13 03:12:27 2013 us=260000 UDPv4 WRITE [50] to vpnserver.eg.com:1194: P_ACK_V1 kid=0 pid=[ #27 ] [ 22 ]
Tue Aug 13 03:12:27 2013 us=260000 UDPv4 READ [142] from vpnserver.eg.com:1194: P_CONTROL_V1 kid=0 pid=[ #26 ] [ ] pid=23 DATA len=100
Tue Aug 13 03:12:27 2013 us=260000 UDPv4 WRITE [50] to vpnserver.eg.com:1194: P_ACK_V1 kid=0 pid=[ #28 ] [ 23 ]
Tue Aug 13 03:12:27 2013 us=260000 TUN READ [110]
Tue Aug 13 03:12:27 2013 us=260000 TUN READ [110]
Tue Aug 13 03:12:27 2013 us=260000 UDPv4 READ [142] from vpnserver.eg.com:1194: P_CONTROL_V1 kid=0 pid=[ #27 ] [ ] pid=24 DATA len=100
Tue Aug 13 03:12:27 2013 us=260000 NOTE: --mute triggered...
Tue Aug 13 03:12:27 2013 us=432000 88 variation(s) on previous 10 message(s) suppressed by --mute
Tue Aug 13 03:12:27 2013 us=432000 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Tue Aug 13 03:12:27 2013 us=432000 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Aug 13 03:12:27 2013 us=432000 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Tue Aug 13 03:12:27 2013 us=432000 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Aug 13 03:12:27 2013 us=432000 UDPv4 WRITE [50] to vpnserver.eg.com:1194: P_ACK_V1 kid=0 pid=[ #69 ] [ 40 ]
Tue Aug 13 03:12:27 2013 us=432000 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Aug 13 03:12:27 2013 us=432000 [vpnserver] Peer Connection Initiated with vpnserver.eg.com:1194
Tue Aug 13 03:12:27 2013 us=463000 TUN READ [62]
Tue Aug 13 03:12:27 2013 us=463000 UDPv4 WRITE [117] to vpnserver.eg.com:1194: P_DATA_V1 kid=0 DATA len=116
Tue Aug 13 03:12:27 2013 us=463000 TUN READ [78]
Tue Aug 13 03:12:27 2013 us=463000 UDPv4 WRITE [133] to vpnserver.eg.com:1194: P_DATA_V1 kid=0 DATA len=132
Tue Aug 13 03:12:27 2013 us=463000 TUN READ [70]
Tue Aug 13 03:12:27 2013 us=463000 UDPv4 WRITE [117] to vpnserver.eg.com:1194: P_DATA_V1 kid=0 DATA len=116
Tue Aug 13 03:12:27 2013 us=463000 TUN READ [130]
Tue Aug 13 03:12:27 2013 us=463000 UDPv4 WRITE [149] to vpnserver.eg.com:1194: P_DATA_V1 kid=0 DATA len=148
Tue Aug 13 03:12:27 2013 us=463000 UDPv4 READ [149] from vpnserver.eg.com:1194: P_DATA_V1 kid=0 DATA len=148
Tue Aug 13 03:12:27 2013 us=463000 TUN WRITE [110]
Tue Aug 13 03:12:27 2013 us=463000 NOTE: --mute triggered...
Tue Aug 13 03:12:33 2013 us=32000 237 variation(s) on previous 10 message(s) suppressed by --mute
Tue Aug 13 03:12:33 2013 us=32000 TEST ROUTES: 0/0 succeeded len=-1 ret=1 a=0 u/d=up
Tue Aug 13 03:12:33 2013 us=32000 Initialization Sequence Completed
Tue Aug 13 03:12:33 2013 us=32000 UDPv4 WRITE [149] to vpnserver.eg.com:1194: P_DATA_V1 kid=0 DATA len=148
Tue Aug 13 03:12:33 2013 us=32000 UDPv4 READ [149] from vpnserver.eg.com:1194: P_DATA_V1 kid=0 DATA len=148
Tue Aug 13 03:12:33 2013 us=32000 TUN WRITE [92]
Tue Aug 13 03:12:33 2013 us=32000 UDPv4 READ [149] from vpnserver.eg.com:1194: P_DATA_V1 kid=0 DATA len=148
Tue Aug 13 03:12:33 2013 us=32000 TUN WRITE [92]
Tue Aug 13 03:12:33 2013 us=32000 TUN READ [92]
Tue Aug 13 03:12:33 2013 us=32000 UDPv4 WRITE [149] to vpnserver.eg.com:1194: P_DATA_V1 kid=0 DATA len=148
Tue Aug 13 03:12:33 2013 us=32000 TUN READ [92]
Tue Aug 13 03:12:33 2013 us=32000 UDPv4 WRITE [149] to vpnserver.eg.com:1194: P_DATA_V1 kid=0 DATA len=148
Tue Aug 13 03:12:33 2013 us=48000 UDPv4 READ [149] from vpnserver.eg.com:1194: P_DATA_V1 kid=0 DATA len=148
Tue Aug 13 03:12:33 2013 us=48000 NOTE: --mute triggered...

maikcat

are you running your client with admin rights?
please use verb 3 and repost your client logs.

Michael.

sparkbird

Yes the client is running with admin privileges.
below are the logs at verb 3

Tue Aug 13 23:02:29 2013 OpenVPN 2.3.0 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Jan 8 2013
Enter Management Password:
Tue Aug 13 23:02:29 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Aug 13 23:02:29 2013 Need hold release from management interface, waiting...
Tue Aug 13 23:02:30 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Aug 13 23:02:30 2013 MANAGEMENT: CMD 'state on'
Tue Aug 13 23:02:30 2013 MANAGEMENT: CMD 'log all on'
Tue Aug 13 23:02:30 2013 MANAGEMENT: CMD 'hold off'
Tue Aug 13 23:02:30 2013 MANAGEMENT: CMD 'hold release'
Tue Aug 13 23:02:30 2013 WARNING: --ping should normally be used with --ping-restart or --ping-exit
Tue Aug 13 23:02:30 2013 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Tue Aug 13 23:02:30 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Aug 13 23:02:35 2013 MANAGEMENT: CMD 'password [...]'
Tue Aug 13 23:02:35 2013 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Aug 13 23:02:35 2013 Control Channel Authentication: using '../keys/ta.key' as a OpenVPN static key file
Tue Aug 13 23:02:35 2013 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Aug 13 23:02:35 2013 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Aug 13 23:02:35 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Aug 13 23:02:35 2013 MANAGEMENT: >STATE:1376415155,RESOLVE,,,
Tue Aug 13 23:02:35 2013 open_tun, tt->ipv6=0
Tue Aug 13 23:02:35 2013 TAP-WIN32 device [Local Area Connection 4] opened: \\.\Global\{90CEF3E5-2C9B-477A-9300-58B61192A9CE}.tap
Tue Aug 13 23:02:35 2013 TAP-Windows Driver Version 9.9
Tue Aug 13 23:02:35 2013 Successful ARP Flush on interface [43] {90CEF3E5-2C9B-477A-9300-58B61192A9CE}
Tue Aug 13 23:02:35 2013 UDPv4 link local (bound): [undef]
Tue Aug 13 23:02:35 2013 UDPv4 link remote: [AF_INET]106.51.142.250:1194
Tue Aug 13 23:02:35 2013 MANAGEMENT: >STATE:1376415155,WAIT,,,
Tue Aug 13 23:02:37 2013 MANAGEMENT: >STATE:1376415157,AUTH,,,
Tue Aug 13 23:02:37 2013 TLS: Initial packet from [AF_INET]106.51.142.250:1194, sid=9d1b0b5b eb0c108b
Tue Aug 13 23:02:37 2013 VERIFY OK: depth=1, C=IN, ST=KAR, L=xxxx, O=yyyyy, CN=yyyyyy CA, emailAddress=ssss.wwwww@outlook.com
Tue Aug 13 23:02:37 2013 VERIFY OK: depth=0, C=IN, ST=KAR, L=xxxx, O=yyyy, CN=vpnserver, emailAddress=wwwww.qqqqqq@outlook.com
Tue Aug 13 23:02:38 2013 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Tue Aug 13 23:02:38 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Aug 13 23:02:38 2013 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Tue Aug 13 23:02:38 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Aug 13 23:02:38 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Aug 13 23:02:38 2013 [vpnserver] Peer Connection Initiated with [AF_INET]106.51.142.250:1194
Tue Aug 13 23:02:44 2013 TEST ROUTES: 0/0 succeeded len=-1 ret=1 a=0 u/d=up
Tue Aug 13 23:02:44 2013 Initialization Sequence Completed
Tue Aug 13 23:02:44 2013 MANAGEMENT: >STATE:1376415164,CONNECTED,SUCCESS,,106.51.142.250

also here are new iptables rules on server

pi@raspberrypi ~ $ sudo iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- 10.10.10.0/24 anywhere
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
ACCEPT all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

And DHCP is also enabled on my router (below which is the vpnserver), might this be causing some conflict ?
router server address from 10.10.10.100 to 10.10.10.150
and line in openvpn server is
server-bridge 10.10.10.102 255.255.255.0 10.10.10.200 10.10.10.210

if it helps i can create SSL certificates for you, add then in my openvpn, and give you the client config file, so u can try and connect to my openvpn and check. let me know, if want to try this approach.

Also heartfelt thanks and i appreciate you helping me out.