Since I couldn't figure out how to edit my original post in this thread, I'm just adding this as a reply hopefully properly formatted per the guidelines posted elsewhere..
server config:
[ code ]
port 1194
proto udp
dev tun
ca "D:\\Program Files\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "D:\\Program Files\\OpenVPN\\easy-rsa\\keys\\server.crt"
key "D:\\Program Files\\OpenVPN\\easy-rsa\\keys\\server.key" # This file should be kept secret
dh "D:\\Program Files\\OpenVPN\\easy-rsa\\keys\\dh2048.pem"
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.3.0 255.255.255.0"
client-config-dir "D:\\Program Files\\OpenVPN\\config\\ccd"
route 172.31.23.0 255.255.255.0
client-to-client
duplicate-cn
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log-append "D:\\Program Files\\OpenVPN\\openvpn.log"
verb 3
[ /code ]
server log:
[ code ]
Thu Oct 10 13:28:26 2013 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Enter Management Password:
Thu Oct 10 13:28:26 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25342
Thu Oct 10 13:28:26 2013 Need hold release from management interface, waiting...
Thu Oct 10 13:28:27 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25342
Thu Oct 10 13:28:27 2013 MANAGEMENT: CMD 'state on'
Thu Oct 10 13:28:27 2013 MANAGEMENT: CMD 'log all on'
Thu Oct 10 13:28:27 2013 MANAGEMENT: CMD 'hold off'
Thu Oct 10 13:28:27 2013 MANAGEMENT: CMD 'hold release'
Thu Oct 10 13:28:27 2013 WARNING: using --duplicate-cn and --client-config-dir together is probably not what you want
Thu Oct 10 13:28:27 2013 WARNING: --ifconfig-pool-persist will not work with --duplicate-cn
Thu Oct 10 13:28:27 2013 Diffie-Hellman initialized with 2048 bit key
Thu Oct 10 13:28:27 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Oct 10 13:28:27 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Oct 10 13:28:27 2013 MANAGEMENT: >STATE:1381426107,ASSIGN_IP,,10.8.0.1,
Thu Oct 10 13:28:27 2013 open_tun, tt->ipv6=0
Thu Oct 10 13:28:27 2013 TAP-WIN32 device [Local Area Connection 3] opened: \\.\Global\{4C305EB6-EDCF-426B-AC9D-CBBF56364E22}.tap
Thu Oct 10 13:28:27 2013 TAP-Windows Driver Version 9.9
Thu Oct 10 13:28:27 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.1/255.255.255.252 on interface {4C305EB6-EDCF-426B-AC9D-CBBF56364E22} [DHCP-serv: 10.8.0.2, lease-time: 31536000]
Thu Oct 10 13:28:27 2013 Sleeping for 10 seconds...
Thu Oct 10 13:28:37 2013 Successful ARP Flush on interface [18] {4C305EB6-EDCF-426B-AC9D-CBBF56364E22}
Thu Oct 10 13:28:37 2013 MANAGEMENT: >STATE:1381426117,ADD_ROUTES,,,
Thu Oct 10 13:28:37 2013 C:\Windows\system32\route.exe ADD 172.31.23.0 MASK 255.255.255.0 10.8.0.2
Thu Oct 10 13:28:37 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Oct 10 13:28:37 2013 Route addition via IPAPI succeeded [adaptive]
Thu Oct 10 13:28:37 2013 C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.2
Thu Oct 10 13:28:37 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Oct 10 13:28:37 2013 Route addition via IPAPI succeeded [adaptive]
Thu Oct 10 13:28:37 2013 UDPv4 link local (bound): [undef]
Thu Oct 10 13:28:37 2013 UDPv4 link remote: [undef]
Thu Oct 10 13:28:37 2013 MULTI: multi_init called, r=256 v=256
Thu Oct 10 13:28:37 2013 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Thu Oct 10 13:28:37 2013 IFCONFIG POOL LIST
Thu Oct 10 13:28:37 2013 Initialization Sequence Completed
Thu Oct 10 13:28:37 2013 MANAGEMENT: >STATE:1381426117,CONNECTED,SUCCESS,10.8.0.1,
Thu Oct 10 13:28:42 2013 54.200.163.254:51507 TLS: Initial packet from [AF_INET]54.200.163.254:51507, sid=7a282b03 283df97d
Thu Oct 10 13:28:44 2013 54.200.163.254:51507 VERIFY OK: depth=1, C=US, ST=MI, L=GrandRapids, O=StudioAMD, OU=AWS-test, CN=AWSfarm, name=AWSFarm-Key, emailAddress=
ysmall@studioamd.com
Thu Oct 10 13:28:44 2013 54.200.163.254:51507 VERIFY OK: depth=0, C=US, ST=MI, L=GrandRapids, O=StudioAMD, OU=AWS-test, CN=SAMDAWS-Manager, name=AWSFarm-Key, emailAddress=
ysmall@studioamd.com
Thu Oct 10 13:28:44 2013 54.200.163.254:51507 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Oct 10 13:28:44 2013 54.200.163.254:51507 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Oct 10 13:28:44 2013 54.200.163.254:51507 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Oct 10 13:28:44 2013 54.200.163.254:51507 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Oct 10 13:28:45 2013 54.200.163.254:51507 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu Oct 10 13:28:45 2013 54.200.163.254:51507 [SAMDAWS-Manager] Peer Connection Initiated with [AF_INET]54.200.163.254:51507
Thu Oct 10 13:28:45 2013 SAMDAWS-Manager/54.200.163.254:51507 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Thu Oct 10 13:28:45 2013 SAMDAWS-Manager/54.200.163.254:51507 MULTI: Learn: 10.8.0.6 -> SAMDAWS-Manager/54.200.163.254:51507
Thu Oct 10 13:28:45 2013 SAMDAWS-Manager/54.200.163.254:51507 MULTI: primary virtual IP for SAMDAWS-Manager/54.200.163.254:51507: 10.8.0.6
Thu Oct 10 13:28:46 2013 SAMDAWS-Manager/54.200.163.254:51507 PUSH: Received control message: 'PUSH_REQUEST'
Thu Oct 10 13:28:46 2013 SAMDAWS-Manager/54.200.163.254:51507 send_push_reply(): safe_cap=940
Thu Oct 10 13:28:46 2013 SAMDAWS-Manager/54.200.163.254:51507 SENT CONTROL [SAMDAWS-Manager]: 'PUSH_REPLY,route 192.168.3.0 255.255.255.0,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Thu Oct 10 13:28:51 2013 72.215.238.219:3791 TLS: Initial packet from [AF_INET]72.215.238.219:3791, sid=bb567d84 85aafee9
Thu Oct 10 13:28:52 2013 72.215.238.219:3791 VERIFY OK: depth=1, C=US, ST=MI, L=GrandRapids, O=StudioAMD, OU=AWS-test, CN=AWSfarm, name=AWSFarm-Key, emailAddress=
ysmall@studioamd.com
Thu Oct 10 13:28:52 2013 72.215.238.219:3791 VERIFY OK: depth=0, C=US, ST=MI, L=GrandRapids, O=StudioAMD, OU=AWS-test, CN=SAMDAWS-Manager, name=AWSFarm-Key, emailAddress=
ysmall@studioamd.com
Thu Oct 10 13:28:52 2013 72.215.238.219:3791 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Oct 10 13:28:52 2013 72.215.238.219:3791 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Oct 10 13:28:52 2013 72.215.238.219:3791 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Oct 10 13:28:52 2013 72.215.238.219:3791 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Oct 10 13:28:53 2013 72.215.238.219:3791 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu Oct 10 13:28:53 2013 72.215.238.219:3791 [SAMDAWS-Manager] Peer Connection Initiated with [AF_INET]72.215.238.219:3791
Thu Oct 10 13:28:53 2013 SAMDAWS-Manager/72.215.238.219:3791 MULTI_sva: pool returned IPv4=10.8.0.10, IPv6=(Not enabled)
Thu Oct 10 13:28:53 2013 SAMDAWS-Manager/72.215.238.219:3791 MULTI: Learn: 10.8.0.10 -> SAMDAWS-Manager/72.215.238.219:3791
Thu Oct 10 13:28:53 2013 SAMDAWS-Manager/72.215.238.219:3791 MULTI: primary virtual IP for SAMDAWS-Manager/72.215.238.219:3791: 10.8.0.10
Thu Oct 10 13:28:55 2013 SAMDAWS-Manager/72.215.238.219:3791 PUSH: Received control message: 'PUSH_REQUEST'
Thu Oct 10 13:28:55 2013 SAMDAWS-Manager/72.215.238.219:3791 send_push_reply(): safe_cap=940
Thu Oct 10 13:28:55 2013 SAMDAWS-Manager/72.215.238.219:3791 SENT CONTROL [SAMDAWS-Manager]: 'PUSH_REPLY,route 192.168.3.0 255.255.255.0,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9' (status=1)
Thu Oct 10 13:29:05 2013 C:\Windows\system32\route.exe DELETE 10.8.0.0 MASK 255.255.255.0 10.8.0.2
Thu Oct 10 13:29:05 2013 Route deletion via IPAPI succeeded [adaptive]
Thu Oct 10 13:29:05 2013 C:\Windows\system32\route.exe DELETE 172.31.23.0 MASK 255.255.255.0 10.8.0.2
Thu Oct 10 13:29:05 2013 Route deletion via IPAPI succeeded [adaptive]
Thu Oct 10 13:29:05 2013 Closing TUN/TAP interface
Thu Oct 10 13:29:05 2013 SIGTERM[hard,] received, process exiting
Thu Oct 10 13:29:05 2013 MANAGEMENT: >STATE:1381426145,EXITING,SIGTERM,,
[ /code ]
---------------------------------------------------------------------------------
client config:
[ code ]
client
dev tun
proto udp
remote 71.238.118.217 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\keys\\client1.crt"
key "C:\\Program Files\\OpenVPN\\keys\\client1.key"
ns-cert-type server
comp-lzo
verb 3
[ /code ]
client log:
[ code ]
Thu Oct 10 17:28:36 2013 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Enter Management Password:
Thu Oct 10 17:28:36 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Oct 10 17:28:36 2013 Need hold release from management interface, waiting...
Thu Oct 10 17:28:37 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Oct 10 17:28:37 2013 MANAGEMENT: CMD 'state on'
Thu Oct 10 17:28:37 2013 MANAGEMENT: CMD 'log all on'
Thu Oct 10 17:28:37 2013 MANAGEMENT: CMD 'hold off'
Thu Oct 10 17:28:37 2013 MANAGEMENT: CMD 'hold release'
Thu Oct 10 17:28:37 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Oct 10 17:28:37 2013 UDPv4 link local: [undef]
Thu Oct 10 17:28:37 2013 UDPv4 link remote: [AF_INET]71.238.118.217:1194
Thu Oct 10 17:28:37 2013 MANAGEMENT: >STATE:1381426117,WAIT,,,
Thu Oct 10 17:28:37 2013 MANAGEMENT: >STATE:1381426117,AUTH,,,
Thu Oct 10 17:28:37 2013 TLS: Initial packet from [AF_INET]71.238.118.217:1194, sid=2cc1819e 7e49e11d
Thu Oct 10 17:28:38 2013 VERIFY OK: depth=1, C=US, ST=MI, L=GrandRapids, O=StudioAMD, OU=AWS-test, CN=AWSfarm, name=AWSFarm-Key, emailAddress=
ysmall@studioamd.com
Thu Oct 10 17:28:38 2013 VERIFY OK: nsCertType=SERVER
Thu Oct 10 17:28:38 2013 VERIFY OK: depth=0, C=US, ST=MI, L=GrandRapids, O=StudioAMD, OU=AWS-test, CN=AWSfarm, name=AWSFarm-Key, emailAddress=
ysmall@studioamd.com
Thu Oct 10 17:28:39 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Oct 10 17:28:39 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Oct 10 17:28:39 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Oct 10 17:28:39 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Oct 10 17:28:39 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu Oct 10 17:28:39 2013 [AWSfarm] Peer Connection Initiated with [AF_INET]71.238.118.217:1194
Thu Oct 10 17:28:40 2013 MANAGEMENT: >STATE:1381426120,GET_CONFIG,,,
Thu Oct 10 17:28:41 2013 SENT CONTROL [AWSfarm]: 'PUSH_REQUEST' (status=1)
Thu Oct 10 17:28:41 2013 PUSH: Received control message: 'PUSH_REPLY,route 192.168.3.0 255.255.255.0,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Thu Oct 10 17:28:41 2013 OPTIONS IMPORT: timers and/or timeouts modified
Thu Oct 10 17:28:41 2013 OPTIONS IMPORT: --ifconfig/up options modified
Thu Oct 10 17:28:41 2013 OPTIONS IMPORT: route options modified
Thu Oct 10 17:28:41 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Oct 10 17:28:41 2013 MANAGEMENT: >STATE:1381426121,ASSIGN_IP,,10.8.0.6,
Thu Oct 10 17:28:41 2013 open_tun, tt->ipv6=0
Thu Oct 10 17:28:41 2013 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{0DBD06C8-C568-477A-8B90-664CFDBFE2DD}.tap
Thu Oct 10 17:28:41 2013 TAP-Windows Driver Version 9.9
Thu Oct 10 17:28:41 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {0DBD06C8-C568-477A-8B90-664CFDBFE2DD} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Thu Oct 10 17:28:41 2013 Successful ARP Flush on interface [15] {0DBD06C8-C568-477A-8B90-664CFDBFE2DD}
Thu Oct 10 17:28:46 2013 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Thu Oct 10 17:28:46 2013 MANAGEMENT: >STATE:1381426126,ADD_ROUTES,,,
Thu Oct 10 17:28:46 2013 C:\Windows\system32\route.exe ADD 192.168.3.0 MASK 255.255.255.0 10.8.0.5
Thu Oct 10 17:28:46 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Oct 10 17:28:46 2013 Route addition via IPAPI succeeded [adaptive]
Thu Oct 10 17:28:46 2013 C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.5
Thu Oct 10 17:28:46 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Oct 10 17:28:46 2013 Route addition via IPAPI succeeded [adaptive]
Thu Oct 10 17:28:46 2013 Initialization Sequence Completed
Thu Oct 10 17:28:46 2013 MANAGEMENT: >STATE:1381426126,CONNECTED,SUCCESS,10.8.0.6,71.238.118.217
Thu Oct 10 17:28:53 2013 C:\Windows\system32\route.exe DELETE 10.8.0.0 MASK 255.255.255.0 10.8.0.5
Thu Oct 10 17:28:53 2013 Route deletion via IPAPI succeeded [adaptive]
Thu Oct 10 17:28:53 2013 C:\Windows\system32\route.exe DELETE 192.168.3.0 MASK 255.255.255.0 10.8.0.5
Thu Oct 10 17:28:53 2013 Route deletion via IPAPI succeeded [adaptive]
Thu Oct 10 17:28:53 2013 Closing TUN/TAP interface
Thu Oct 10 17:28:53 2013 SIGTERM[hard,] received, process exiting
Thu Oct 10 17:28:53 2013 MANAGEMENT: >STATE:1381426133,EXITING,SIGTERM,,
[ /code ]
So, hopefully the above information is formatted propperly. As I mentioned earlier, I can ping the client from the server, but can't ping the server from the client. I can RDP into the client through the VPN tunnel, but having RDP'd into the client through it's Public IP or the VPN IP can not RDP back to the server. I did establish a second client connection yesterday and the two clients could ping one another, but could not ping the subnets behind them, nor the server nor the subnet behind it.
I have read the how-to page, I have googled the heck out of "OpenVPN" and nothing seems to tell me what I'm missing. I also tried using the pre-configured linux OpenVPN server available on AWS but I have no experience with Linux and found the tools completely useless to me, I really need this to work from windows.
